fullshield 0.4.0 → 1.0.0

package/dist/runtime/auto.js

@@ -1,1260 +1,5 @@
-import dns from 'dns';
-import { createRequire } from 'module';
-import { AsyncLocalStorage } from 'async_hooks';
-
-// src/runtime/rasp/nosql.ts
-function isOperatorObject(value) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-  return Object.keys(value).some((k) => k.startsWith("$"));
-}
-function deepEqual(a, b) {
-  if (a === b) return true;
-  if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
-  if (Array.isArray(a) || Array.isArray(b)) {
-    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-    return a.every((v, i) => deepEqual(v, b[i]));
-  }
-  const ak = Object.keys(a);
-  const bk = Object.keys(b);
-  if (ak.length !== bk.length) return false;
-  return ak.every((k) => deepEqual(a[k], b[k]));
-}
-function collect(value, out, depth) {
-  if (depth > 8 || value === null || typeof value !== "object") return;
-  out.push(value);
-  if (Array.isArray(value)) {
-    for (const item of value) collect(item, out, depth + 1);
-    return;
-  }
-  for (const child of Object.values(value)) collect(child, out, depth + 1);
-}
-function nosqlUserOperators(sink, ctx) {
-  const userObjects = [];
-  for (const obj of ctx.objects) collect(obj, userObjects, 0);
-  const userOps = userObjects.filter(isOperatorObject);
-  if (userOps.length === 0) return false;
-  const seen = /* @__PURE__ */ new Set();
-  const walk2 = (value, depth) => {
-    if (depth > 8 || value === null || typeof value !== "object") return false;
-    if (seen.has(value)) return false;
-    seen.add(value);
-    if (isOperatorObject(value) && userOps.some((u) => u === value || deepEqual(u, value))) {
-      return true;
-    }
-    if (Array.isArray(value)) return value.some((item) => walk2(item, depth + 1));
-    return Object.values(value).some((child) => walk2(child, depth + 1));
-  };
-  return walk2(sink, 0);
-}
-
-// src/runtime/rasp/path.ts
-function logicalResolve(p) {
-  const isAbs = p.startsWith("/") || /^[A-Za-z]:[\\/]/.test(p);
-  const parts = [];
-  for (const seg of p.split(/[\\/]+/)) {
-    if (seg === "" || seg === ".") continue;
-    if (seg === "..") {
-      parts.pop();
-      continue;
-    }
-    parts.push(seg);
-  }
-  return (isAbs ? "/" : "") + parts.join("/");
-}
-function isInside(base, target) {
-  const b = logicalResolve(base).replace(/\/+$/, "");
-  const t = logicalResolve(target);
-  if (b === "") return !t.startsWith("/") && !t.split("/").includes("..");
-  return t === b || t.startsWith(`${b}/`);
-}
-function inferBase(sink, input) {
-  const idx = sink.indexOf(input);
-  if (idx <= 0) return "";
-  return sink.slice(0, idx);
-}
-function lastSeg(p) {
-  const parts = logicalResolve(p).split("/").filter(Boolean);
-  return parts[parts.length - 1];
-}
-function pathInputEscapes(sink, input, base) {
-  if (!input) return false;
-  if (input.includes("\0") || sink.includes("\0")) return true;
-  if (sink.includes(input)) {
-    if (input.includes("..")) return true;
-    const intended = base !== void 0 && base.length > 0 ? base : inferBase(sink, input);
-    if (intended === "") {
-      return input.startsWith("/") || /^[A-Za-z]:[\\/]/.test(input) || input.includes("..");
-    }
-    return !isInside(intended, sink);
-  }
-  if (input.includes("..") || input.startsWith("/") || /^[A-Za-z]:[\\/]/.test(input)) {
-    const a = lastSeg(input);
-    const b = lastSeg(sink);
-    if (a && a === b) return true;
-  }
-  return false;
-}
-
-// src/runtime/rasp/proto.ts
-var DANGEROUS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
-function walk(value, depth, seen) {
-  if (depth > 8 || value === null || typeof value !== "object") return false;
-  if (seen.has(value)) return false;
-  seen.add(value);
-  for (const key of Object.getOwnPropertyNames(value)) {
-    if (DANGEROUS.has(key)) return true;
-  }
-  if (Array.isArray(value)) return value.some((item) => walk(item, depth + 1, seen));
-  return Object.values(value).some((child) => walk(child, depth + 1, seen));
-}
-function protoPolluted(ctx) {
-  const seen = /* @__PURE__ */ new Set();
-  return ctx.objects.some((obj) => walk(obj, 0, seen));
-}
-
-// src/runtime/rasp/shell.ts
-function tokenizeShell(command) {
-  const tokens = [];
-  let i = 0;
-  const n = command.length;
-  while (i < n) {
-    const c = command[i];
-    if (c === " " || c === "	" || c === "\n") {
-      const start2 = i;
-      while (i < n && (command[i] === " " || command[i] === "	" || command[i] === "\n")) i += 1;
-      tokens.push({ kind: "space", start: start2, end: i });
-      continue;
-    }
-    if (c === "'" || c === '"') {
-      const quote = c;
-      const start2 = i;
-      i += 1;
-      while (i < n && command[i] !== quote) {
-        if (quote === '"' && command[i] === "\\") i += 1;
-        i += 1;
-      }
-      if (i < n) i += 1;
-      tokens.push({ kind: "word", start: start2, end: i });
-      continue;
-    }
-    if (c === "`") {
-      const start2 = i;
-      i += 1;
-      while (i < n && command[i] !== "`") i += 1;
-      if (i < n) i += 1;
-      tokens.push({ kind: "op", start: start2, end: i });
-      continue;
-    }
-    if (c === "$" && (command[i + 1] === "(" || command[i + 1] === "{")) {
-      const open = command[i + 1];
-      const close = open === "(" ? ")" : "}";
-      const start2 = i;
-      i += 2;
-      let depth = 1;
-      while (i < n && depth > 0) {
-        if (command[i] === open) depth += 1;
-        else if (command[i] === close) depth -= 1;
-        i += 1;
-      }
-      tokens.push({ kind: "op", start: start2, end: i });
-      continue;
-    }
-    if (command.startsWith("||", i) || command.startsWith("&&", i) || command.startsWith(">>", i) || command.startsWith("<<", i)) {
-      tokens.push({ kind: "op", start: i, end: i + 2 });
-      i += 2;
-      continue;
-    }
-    if (";|&<>()".includes(c)) {
-      tokens.push({ kind: "op", start: i, end: i + 1 });
-      i += 1;
-      continue;
-    }
-    const start = i;
-    while (i < n && !/[\s;|&$`<>()]/.test(command[i])) i += 1;
-    tokens.push({ kind: "word", start, end: i });
-  }
-  return tokens;
-}
-function shellInputChangesStructure(command, input) {
-  if (!input) return false;
-  const tokens = tokenizeShell(command);
-  let from = 0;
-  while (from <= command.length) {
-    const idx = command.indexOf(input, from);
-    if (idx === -1) return false;
-    const end = idx + input.length;
-    const hit = tokens.filter((t) => t.kind !== "space" && t.start < end && t.end > idx);
-    if (!(hit.length === 1 && hit[0].kind === "word" && hit[0].start <= idx && hit[0].end >= end)) {
-      return true;
-    }
-    from = idx + Math.max(input.length, 1);
-  }
-  return false;
-}
-
-// src/runtime/rasp/sql.ts
-function tokenizeSql(sql) {
-  const tokens = [];
-  let i = 0;
-  const n = sql.length;
-  while (i < n) {
-    const c = sql[i];
-    if (c <= " ") {
-      const start2 = i;
-      while (i < n && sql[i] <= " ") i += 1;
-      tokens.push({ kind: "space", start: start2, end: i });
-      continue;
-    }
-    if (c === "'" || c === '"' || c === "`") {
-      const quote = c;
-      const start2 = i;
-      i += 1;
-      while (i < n) {
-        if (sql[i] === quote) {
-          if (sql[i + 1] === quote) {
-            i += 2;
-            continue;
-          }
-          i += 1;
-          break;
-        }
-        i += 1;
-      }
-      tokens.push({ kind: "string", start: start2, end: i });
-      continue;
-    }
-    if (c === "-" && sql[i + 1] === "-") {
-      const start2 = i;
-      i += 2;
-      while (i < n && sql[i] !== "\n") i += 1;
-      tokens.push({ kind: "comment", start: start2, end: i });
-      continue;
-    }
-    if (c === "/" && sql[i + 1] === "*") {
-      const start2 = i;
-      i += 2;
-      while (i < n && !(sql[i] === "*" && sql[i + 1] === "/")) i += 1;
-      if (i + 1 < n) i += 2;
-      tokens.push({ kind: "comment", start: start2, end: i });
-      continue;
-    }
-    if (c === "#") {
-      const start2 = i;
-      while (i < n && sql[i] !== "\n") i += 1;
-      tokens.push({ kind: "comment", start: start2, end: i });
-      continue;
-    }
-    if (c >= "0" && c <= "9" || c === "." && i + 1 < n && sql[i + 1] >= "0" && sql[i + 1] <= "9") {
-      const start2 = i;
-      while (i < n && /[0-9.eE+-]/.test(sql[i])) i += 1;
-      tokens.push({ kind: "number", start: start2, end: i });
-      continue;
-    }
-    if (/[A-Za-z_]/.test(c)) {
-      const start2 = i;
-      while (i < n && /[A-Za-z0-9_$]/.test(sql[i])) i += 1;
-      tokens.push({ kind: "ident", start: start2, end: i });
-      continue;
-    }
-    const start = i;
-    if (sql.startsWith("<=", i) || sql.startsWith(">=", i) || sql.startsWith("<>", i) || sql.startsWith("!=", i) || sql.startsWith("||", i) || sql.startsWith("&&", i)) {
-      i += 2;
-    } else {
-      i += 1;
-    }
-    tokens.push({ kind: "op", start, end: i });
-  }
-  return tokens;
-}
-function spanUnsafe(tokens, start, end) {
-  const hit = tokens.filter((t) => t.kind !== "space" && t.start < end && t.end > start);
-  if (hit.length === 1) {
-    const t = hit[0];
-    const safe = t.kind === "string" || t.kind === "number" || t.kind === "comment";
-    return !safe || t.start > start || t.end < end;
-  }
-  return hit.length > 0;
-}
-function sqlInputChangesStructure(query, input) {
-  if (!input) return false;
-  const tokens = tokenizeSql(query);
-  let from = 0;
-  while (from <= query.length) {
-    const idx = query.indexOf(input, from);
-    if (idx === -1) return false;
-    if (spanUnsafe(tokens, idx, idx + input.length)) return true;
-    from = idx + Math.max(input.length, 1);
-  }
-  return false;
-}
-function normalizeHost(host) {
-  let h = host.trim().toLowerCase();
-  h = h.replace(/\.+$/, "");
-  if (h.startsWith("[") && h.endsWith("]")) h = h.slice(1, -1);
-  if (h.startsWith("::ffff:")) h = h.slice(7);
-  if (h.startsWith("[") && h.endsWith("]")) h = h.slice(1, -1);
-  return h;
-}
-function parseIpv4Part(part) {
-  if (/^0x[0-9a-f]+$/i.test(part)) {
-    const n = Number.parseInt(part, 16);
-    return Number.isFinite(n) ? n : void 0;
-  }
-  if (/^0[0-7]+$/.test(part)) {
-    const n = Number.parseInt(part, 8);
-    return Number.isFinite(n) ? n : void 0;
-  }
-  if (/^\d+$/.test(part)) {
-    const n = Number(part);
-    return Number.isFinite(n) ? n : void 0;
-  }
-  return void 0;
-}
-function parseIpv4(host) {
-  const h = normalizeHost(host);
-  if (!h || h.includes(":")) return void 0;
-  const parts = h.split(".");
-  if (parts.length === 0 || parts.length > 4) return void 0;
-  const nums = parts.map(parseIpv4Part);
-  if (nums.some((n) => n === void 0)) return void 0;
-  const a = nums[0];
-  if (parts.length === 1) {
-    if (a > 4294967295) return void 0;
-    return [a >>> 24 & 255, a >>> 16 & 255, a >>> 8 & 255, a & 255];
-  }
-  if (parts.length === 2) {
-    const b2 = nums[1];
-    if (a > 255 || b2 > 16777215) return void 0;
-    return [a, b2 >>> 16 & 255, b2 >>> 8 & 255, b2 & 255];
-  }
-  if (parts.length === 3) {
-    const b2 = nums[1];
-    const c2 = nums[2];
-    if (a > 255 || b2 > 255 || c2 > 65535) return void 0;
-    return [a, b2, c2 >>> 8 & 255, c2 & 255];
-  }
-  const b = nums[1];
-  const c = nums[2];
-  const d = nums[3];
-  if ([a, b, c, d].some((n) => n > 255)) return void 0;
-  return [a, b, c, d];
-}
-function isPrivateV4(octets) {
-  const [a, b] = octets;
-  if (a === 127 || a === 0 || a === 10) return true;
-  if (a === 169 && b === 254) return true;
-  if (a === 192 && b === 168) return true;
-  if (a === 172 && b >= 16 && b <= 31) return true;
-  return false;
-}
-function isPrivateIpv6(h) {
-  if (h === "::1" || h === "::" || h === "0:0:0:0:0:0:0:1") return true;
-  if (h.startsWith("fc") || h.startsWith("fd") || h.startsWith("fe80:")) return true;
-  return false;
-}
-function isPrivateOrMetadata(host) {
-  const h = normalizeHost(host);
-  if (h === "localhost" || h.endsWith(".localhost") || h === "metadata.google.internal") return true;
-  const v4 = parseIpv4(h);
-  if (v4) return isPrivateV4(v4);
-  if (h.includes(":")) return isPrivateIpv6(h);
-  return false;
-}
-function defaultLookup(host) {
-  const h = normalizeHost(host);
-  if (parseIpv4(h) || h.includes(":")) return [h];
-  try {
-    const lookupSync = dns.lookupSync;
-    if (typeof lookupSync === "function") {
-      return lookupSync(h, { all: true }).map((row) => row.address);
-    }
-  } catch {
-  }
-  return [];
-}
-function resolveHostAddresses(host) {
-  try {
-    return defaultLookup(host);
-  } catch {
-    return [];
-  }
-}
-function hostIsBlocked(host) {
-  if (isPrivateOrMetadata(host)) return true;
-  for (const addr of resolveHostAddresses(host)) {
-    if (isPrivateOrMetadata(addr)) return true;
-  }
-  return false;
-}
-function ssrfHostFromUser(url, input) {
-  if (!input || !url.includes(input)) return false;
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return false;
-  }
-  const host = parsed.hostname;
-  if (!host) return false;
-  const rawAuth = /^https?:\/\/([^/?#]+)/i.exec(url)?.[1] ?? host;
-  const rawHost = rawAuth.replace(/:\d+$/, "");
-  const inputTouchesHost = input === url || input.includes(host) || input.includes(rawHost) || rawHost.includes(input) && input.length >= 3;
-  if (!inputTouchesHost) return false;
-  return hostIsBlocked(host) || hostIsBlocked(rawHost);
-}
-function urlFromHttpArgs(args) {
-  const first = args[0];
-  if (typeof first === "string") return first;
-  if (first instanceof URL) return first.href;
-  if (first && typeof first === "object") {
-    const o = first;
-    if (typeof o.href === "string") return o.href;
-    const proto = o.protocol ?? "http:";
-    const host = o.hostname ?? o.host ?? "";
-    const path = o.path ?? "/";
-    return `${proto}//${host}${path}`;
-  }
-  return "";
-}
-function fetchUrl(input) {
-  if (typeof input === "string") return input;
-  if (input instanceof URL) return input.href;
-  if (input && typeof input === "object" && "url" in input && typeof input.url === "string") {
-    return input.url;
-  }
-  return "";
-}
-
-// src/runtime/rasp/types.ts
-var RASP_RULE = {
-  sql: "RASP-SQL-001",
-  shell: "RASP-SHELL-001",
-  path: "RASP-PATH-001",
-  nosql: "RASP-NOSQL-001",
-  ssrf: "RASP-SSRF-001",
-  proto: "RASP-PROTO-001"
-};
-var RASP_FAIL_OPEN = "RASP-FAIL-OPEN-001";
-var RaspBlockedError = class extends Error {
-  ruleId;
-  constructor(ruleId) {
-    super(`fullshield rasp blocked ${ruleId}`);
-    this.name = "RaspBlockedError";
-    this.ruleId = ruleId;
-  }
-};
-
-// src/runtime/rasp/decide.ts
-function sinkTexts(sink) {
-  if (typeof sink === "string") return [sink];
-  if (typeof sink === "number" || typeof sink === "boolean") return [String(sink)];
-  return [];
-}
-function whereJsChangesStructure(sink, ctx) {
-  let code = "";
-  if (typeof sink === "string") code = sink;
-  else if (sink !== null && typeof sink === "object" && !Array.isArray(sink) && "$where" in sink) {
-    const where = sink.$where;
-    if (typeof where === "string") code = where;
-  }
-  if (!code) return false;
-  for (const input of ctx.strings) {
-    if (input && sqlInputChangesStructure(code, input)) return true;
-  }
-  return false;
-}
-function detectStructureChange(kind, sink, ctx, base) {
-  if (kind === "proto") return protoPolluted(ctx);
-  if (kind === "nosql") {
-    if (nosqlUserOperators(sink, ctx)) return true;
-    return whereJsChangesStructure(sink, ctx);
-  }
-  for (const text of sinkTexts(sink)) {
-    for (const input of ctx.strings) {
-      if (!input) continue;
-      if (kind === "sql" && sqlInputChangesStructure(text, input)) return true;
-      if (kind === "shell" && shellInputChangesStructure(text, input)) return true;
-      if (kind === "path" && pathInputEscapes(text, input, base)) return true;
-      if (kind === "ssrf" && ssrfHostFromUser(text, input)) return true;
-    }
-  }
-  return false;
-}
-function decideSink(kind, sink, ctx, base) {
-  const hit = detectStructureChange(kind, sink, ctx, base);
-  if (hit) return { block: true, ruleId: RASP_RULE[kind] };
-  return { block: false };
-}
-var SKIP_HEADERS = /* @__PURE__ */ new Set([
-  "host",
-  "connection",
-  "user-agent",
-  "accept",
-  "accept-encoding",
-  "accept-language",
-  "content-type",
-  "content-length",
-  "transfer-encoding",
-  "cookie"
-]);
-var storage = new AsyncLocalStorage();
-function flatten(value, out, depth) {
-  if (depth > 8 || out.length > 200) return;
-  if (typeof value === "string") {
-    out.push(value);
-    return;
-  }
-  if (typeof value === "number" || typeof value === "boolean") {
-    out.push(String(value));
-    return;
-  }
-  if (Array.isArray(value)) {
-    for (const item of value) flatten(item, out, depth + 1);
-    return;
-  }
-  if (value !== null && typeof value === "object") {
-    for (const child of Object.values(value)) flatten(child, out, depth + 1);
-  }
-}
-function collectObjects(value, out, depth) {
-  if (depth > 8 || value === null || typeof value !== "object") return;
-  out.push(value);
-  if (Array.isArray(value)) {
-    for (const item of value) collectObjects(item, out, depth + 1);
-    return;
-  }
-  for (const child of Object.values(value)) collectObjects(child, out, depth + 1);
-}
-function contextFromRequest(req) {
-  const strings = [];
-  const objects = [];
-  for (const value of [req.query, req.body, req.params, req.cookies]) {
-    flatten(value, strings, 0);
-    collectObjects(value, objects, 0);
-  }
-  if (req.headers && typeof req.headers === "object") {
-    for (const [key, value] of Object.entries(req.headers)) {
-      if (SKIP_HEADERS.has(key.toLowerCase())) continue;
-      flatten(value, strings, 0);
-    }
-    collectObjects(req.headers, objects, 0);
-  }
-  return {
-    path: req.path ?? req.url?.split("?")[0] ?? "/",
-    ip: req.ip ?? "unknown",
-    strings,
-    objects
-  };
-}
-function enterRaspContext(ctx, fn) {
-  return storage.run(ctx, fn);
-}
-function currentRaspContext() {
-  return storage.getStore();
-}
-
-// src/runtime/rasp/egress.ts
-function egressAllowed(host, allow) {
-  const h = host.toLowerCase().replace(/\.+$/, "");
-  for (const rule of allow) {
-    const r = rule.toLowerCase();
-    if (r.startsWith("*.")) {
-      const suffix = r.slice(1);
-      if (h.endsWith(suffix) && h !== r.slice(2)) return true;
-    } else if (h === r) {
-      return true;
-    }
-  }
-  return false;
-}
-
-// src/runtime/rasp/threat.ts
-var scores = /* @__PURE__ */ new Map();
-var blockUntil = /* @__PURE__ */ new Map();
-var WEIGHT = {
-  block: 2,
-  honey: 5,
-  anomaly: 1
-};
-var DEFAULT_MAX_BLOCK_MS = 15 * 60 * 1e3;
-var autoBlock = false;
-var maxBlockMs = DEFAULT_MAX_BLOCK_MS;
-function configureThreat(opts = {}) {
-  autoBlock = opts.autoBlock === true;
-  if (typeof opts.maxBlockMs === "number" && opts.maxBlockMs > 0) maxBlockMs = opts.maxBlockMs;
-}
-function addThreat(ip, kind, now = Date.now()) {
-  const next = (scores.get(ip) ?? 0) + WEIGHT[kind];
-  scores.set(ip, next);
-  if (autoBlock && next >= 10) {
-    blockUntil.set(ip, now + maxBlockMs);
-  }
-  return next;
-}
-function isIpBlocked(ip, now = Date.now()) {
-  if (!autoBlock) return false;
-  const until = blockUntil.get(ip);
-  if (until === void 0) return false;
-  if (now >= until) {
-    blockUntil.delete(ip);
-    return false;
-  }
-  return true;
-}
-
-// src/runtime/rasp/honey.ts
-var DECOY_ROUTES = ["/admin.php", "/.git/config", "/wp-login.php"];
-var registered = /* @__PURE__ */ new Set();
-var ROUTE_WINDOW_MS = 6e4;
-var routeHits = /* @__PURE__ */ new Map();
-function isHoneyRoute(path) {
-  const p = path.split("?")[0] ?? path;
-  return DECOY_ROUTES.includes(p);
-}
-function isHoneyCanary(text) {
-  if (!text) return false;
-  for (const c of registered) {
-    if (c && text.includes(c)) return true;
-  }
-  return false;
-}
-function noteHoneyRouteHit(ip, now = Date.now()) {
-  const prev = routeHits.get(ip);
-  if (prev === void 0 || now - prev.start > ROUTE_WINDOW_MS) {
-    routeHits.set(ip, { count: 1, start: now });
-    return 1;
-  }
-  prev.count += 1;
-  return prev.count;
-}
-
-// src/runtime/rasp/middleware.ts
-function raspContext() {
-  return function raspContextMiddleware(req, res, next) {
-    const ctx = contextFromRequest(req);
-    try {
-      const credHit = ctx.strings.some((s) => isHoneyCanary(s));
-      const routeHit = isHoneyRoute(ctx.path);
-      if (routeHit && !credHit) {
-        const count = noteHoneyRouteHit(ctx.ip);
-        addThreat(ctx.ip, "honey");
-        emitRaspEvent({
-          ruleId: "RASP-HONEY-001",
-          path: ctx.path,
-          ip: ctx.ip,
-          sample: "honeytoken",
-          severity: "low",
-          count
-        });
-      } else if (credHit) {
-        addThreat(ctx.ip, "honey");
-        emitRaspEvent({
-          ruleId: "RASP-HONEY-001",
-          path: ctx.path,
-          ip: ctx.ip,
-          sample: "canary-credential",
-          severity: "critical"
-        });
-        if (isIpBlocked(ctx.ip)) {
-          if (typeof res.status === "function") {
-            res.status(403).json({ error: "blocked", ruleId: "RASP-HONEY-001" });
-            return;
-          }
-          res.statusCode = 403;
-          res.end?.(JSON.stringify({ error: "blocked", ruleId: "RASP-HONEY-001" }));
-          return;
-        }
-      }
-      const proto = runDecide("proto", null, ctx);
-      if (proto.block && proto.ruleId) {
-        emitRaspEvent({
-          ruleId: proto.ruleId,
-          path: ctx.path,
-          ip: ctx.ip,
-          sample: "prototype-key"
-        });
-        if (raspModeFor(ctx.path, "proto") === "block") {
-          if (typeof res.status === "function") {
-            res.status(403).json({ error: "blocked", ruleId: proto.ruleId });
-            return;
-          }
-          res.statusCode = 403;
-          res.end?.(JSON.stringify({ error: "blocked", ruleId: proto.ruleId }));
-          return;
-        }
-      }
-    } catch (err) {
-      if (err instanceof RaspBlockedError) {
-        if (typeof res.status === "function") {
-          res.status(403).json({ error: "blocked", ruleId: err.ruleId });
-          return;
-        }
-        throw err;
-      }
-      emitRaspEvent({
-        ruleId: RASP_FAIL_OPEN,
-        path: ctx.path,
-        ip: ctx.ip,
-        sample: "hook-error"
-      });
-    }
-    enterRaspContext(ctx, () => {
-      next();
-    });
-  };
-}
-
-// src/runtime/rasp/hooks.ts
-var require2 = createRequire(import.meta.url);
-var restorers = [];
-var wrappedPackages = /* @__PURE__ */ new WeakSet();
-var hooksLive = false;
-var sqliteHookRegistered = false;
-function sampleOf(sink) {
-  if (typeof sink === "string") return sink.slice(0, 40);
-  if (sink === null || sink === void 0) return "";
-  return "[object]";
-}
-function inferPathBase(p) {
-  const ctx = currentRaspContext();
-  if (!ctx) return void 0;
-  for (const s of ctx.strings) {
-    if (!s) continue;
-    const idx = p.indexOf(s);
-    if (idx > 0) return p.slice(0, idx);
-  }
-  return void 0;
-}
-function guardSink(kind, sink, base) {
-  try {
-    const ctx = currentRaspContext();
-    if (ctx) {
-      const decision = runDecide(kind, sink, ctx, base);
-      if (decision.block && decision.ruleId) {
-        emitRaspEvent({
-          ruleId: decision.ruleId,
-          path: ctx.path,
-          ip: ctx.ip,
-          sample: sampleOf(sink)
-        });
-        addThreat(ctx.ip, "block");
-        if (raspModeFor(ctx.path, kind) === "block") throw new RaspBlockedError(decision.ruleId);
-      }
-    }
-  } catch (err) {
-    if (err instanceof RaspBlockedError) throw err;
-    const ctx = currentRaspContext();
-    emitRaspEvent({
-      ruleId: RASP_FAIL_OPEN,
-      path: ctx?.path ?? "/",
-      ip: ctx?.ip ?? "unknown",
-      sample: "hook-error"
-    });
-  }
-}
-function applySink(kind, sink, base, original) {
-  guardSink(kind, sink, base);
-  return original();
-}
-function patchMethod(obj, key, wrapper) {
-  const record = obj;
-  const orig = record[key];
-  if (typeof orig !== "function") return;
-  const wrapped = wrapper(orig);
-  try {
-    Object.defineProperty(wrapped, "name", { value: orig.name });
-  } catch {
-  }
-  record[key] = wrapped;
-  restorers.push(() => {
-    record[key] = orig;
-  });
-}
-function sqlTextFrom(sql) {
-  if (typeof sql === "string") return sql;
-  if (Array.isArray(sql)) {
-    return sql.filter((part) => typeof part === "string").join(" ");
-  }
-  if (sql !== null && typeof sql === "object") {
-    const rec = sql;
-    if (typeof rec.text === "string") return rec.text;
-    if (typeof rec.sql === "string") return rec.sql;
-    if (Array.isArray(rec.strings)) {
-      return rec.strings.filter((part) => typeof part === "string").join(" ");
-    }
-  }
-  return "";
-}
-function wrapSqlMethod(obj, key) {
-  patchMethod(obj, key, (orig) => {
-    return function(sql, ...rest) {
-      return applySink(
-        "sql",
-        sqlTextFrom(sql),
-        void 0,
-        () => orig.call(this, sql, ...rest)
-      );
-    };
-  });
-}
-function wrapNosqlWhere(obj, key) {
-  patchMethod(obj, key, (orig) => {
-    return function(expr, ...rest) {
-      const sink = typeof expr === "string" ? { $where: expr } : expr ?? {};
-      return applySink("nosql", sink, void 0, () => orig.call(this, expr, ...rest));
-    };
-  });
-}
-function wrapShellCommand(obj, key, shellAlways) {
-  patchMethod(obj, key, (orig) => {
-    return function(...args) {
-      const opts = args[1] && typeof args[1] === "object" ? args[1] : args[2] && typeof args[2] === "object" ? args[2] : void 0;
-      const useShell = shellAlways || opts?.shell === true;
-      if (!useShell) return orig.call(this, ...args);
-      const cmd = typeof args[0] === "string" ? args[0] : "";
-      return applySink("shell", cmd, void 0, () => orig.call(this, ...args));
-    };
-  });
-}
-function wrapFsPath(obj, key) {
-  patchMethod(obj, key, (orig) => {
-    return function(pathArg, ...rest) {
-      const p = typeof pathArg === "string" ? pathArg : Buffer.isBuffer(pathArg) ? pathArg.toString() : pathArg instanceof URL ? pathArg.pathname : typeof pathArg === "number" || typeof pathArg === "boolean" ? String(pathArg) : "";
-      return applySink("path", p, inferPathBase(p), () => orig.call(this, pathArg, ...rest));
-    };
-  });
-}
-function checkEgress(url) {
-  const allow = raspEgressAllow();
-  if (!allow || allow.length === 0) return;
-  let host = "";
-  try {
-    host = new URL(url).hostname;
-  } catch {
-    return;
-  }
-  if (host && !egressAllowed(host, allow)) {
-    const ctx = currentRaspContext();
-    emitRaspEvent({
-      ruleId: "RASP-EGRESS-001",
-      path: ctx?.path ?? "/",
-      ip: ctx?.ip ?? "unknown",
-      sample: host.slice(0, 40)
-    });
-    if (ctx) addThreat(ctx.ip, "block");
-    if (raspModeFor(ctx?.path ?? "/", "ssrf") === "block") throw new RaspBlockedError("RASP-EGRESS-001");
-  }
-}
-function wrapSsrf(obj, key, urlOf) {
-  patchMethod(obj, key, (orig) => {
-    return function(...args) {
-      const url = urlOf(args);
-      checkEgress(url);
-      return applySink("ssrf", url, void 0, () => orig.call(this, ...args));
-    };
-  });
-}
-var WRAP_SQLITE = /* @__PURE__ */ Symbol.for("fullshield.rasp.wrapSqlite");
-var SQLITE_WRAPPED = /* @__PURE__ */ Symbol.for("fullshield.rasp.sqliteWrapped");
-var origModuleLoad;
-function protoFrom(value) {
-  if (!value || typeof value !== "object") return void 0;
-  const proto = value.DatabaseSync?.prototype;
-  if (proto && typeof proto === "object") return proto;
-  return void 0;
-}
-function sqlitePrototype(hint) {
-  const fromHint = protoFrom(hint);
-  if (fromHint) return fromHint;
-  const getBuiltin = process.getBuiltinModule;
-  if (typeof getBuiltin === "function") {
-    try {
-      const fromBuiltin = protoFrom(getBuiltin.call(process, "node:sqlite") ?? getBuiltin.call(process, "sqlite"));
-      if (fromBuiltin) return fromBuiltin;
-    } catch {
-    }
-  }
-  if (origModuleLoad) {
-    try {
-      return protoFrom(origModuleLoad("node:sqlite", void 0, false));
-    } catch {
-    }
-  }
-  return void 0;
-}
-function sqliteAlreadyLoaded() {
-  const list = process.moduleLoadList;
-  return Array.isArray(list) && list.some((entry) => /(?:^| )sqlite$/i.test(entry));
-}
-function wrapSqliteNow(hint) {
-  try {
-    const proto = sqlitePrototype(hint);
-    if (!proto || proto[SQLITE_WRAPPED]) return;
-    Object.defineProperty(proto, SQLITE_WRAPPED, { value: true, configurable: true });
-    wrapSqlMethod(proto, "exec");
-    wrapSqlMethod(proto, "prepare");
-    restorers.push(() => {
-      delete proto[SQLITE_WRAPPED];
-    });
-  } catch {
-  }
-}
-function wrapBuiltins() {
-  globalThis[WRAP_SQLITE] = wrapSqliteNow;
-  const cp = require2("node:child_process");
-  const cpAlias = require2("child_process");
-  for (const mod of /* @__PURE__ */ new Set([cp, cpAlias])) {
-    wrapShellCommand(mod, "exec", true);
-    wrapShellCommand(mod, "execSync", true);
-    wrapShellCommand(mod, "spawn", false);
-    wrapShellCommand(mod, "spawnSync", false);
-    wrapShellCommand(mod, "execFile", false);
-    wrapShellCommand(mod, "execFileSync", false);
-  }
-  const fsNames = [
-    "readFile",
-    "readFileSync",
-    "writeFile",
-    "writeFileSync",
-    "appendFile",
-    "appendFileSync",
-    "open",
-    "openSync",
-    "createReadStream",
-    "createWriteStream",
-    "stat",
-    "statSync",
-    "lstat",
-    "lstatSync",
-    "access",
-    "accessSync",
-    "readdir",
-    "readdirSync",
-    "unlink",
-    "unlinkSync",
-    "rm",
-    "rmSync"
-  ];
-  const fs = require2("node:fs");
-  const fsAlias = require2("fs");
-  for (const mod of /* @__PURE__ */ new Set([fs, fsAlias])) {
-    for (const name of fsNames) wrapFsPath(mod, name);
-  }
-  try {
-    const fsp = require2("node:fs/promises");
-    for (const name of ["readFile", "writeFile", "appendFile", "open", "stat", "lstat", "access", "readdir", "unlink", "rm"]) {
-      wrapFsPath(fsp, name);
-    }
-  } catch {
-  }
-  const http = require2("node:http");
-  const https = require2("node:https");
-  wrapSsrf(http, "request", urlFromHttpArgs);
-  wrapSsrf(http, "get", urlFromHttpArgs);
-  wrapSsrf(https, "request", urlFromHttpArgs);
-  wrapSsrf(https, "get", urlFromHttpArgs);
-  if (typeof globalThis.fetch === "function") {
-    const origFetch = globalThis.fetch;
-    globalThis.fetch = function(input, init) {
-      const start = fetchUrl(input);
-      checkEgress(start);
-      const mode = init?.redirect ?? "follow";
-      if (mode !== "follow") {
-        return applySink("ssrf", start, void 0, () => origFetch.call(this, input, init));
-      }
-      guardSink("ssrf", start);
-      return (async () => {
-        let current = start;
-        let nextInput = input;
-        for (let hop = 0; hop < 8; hop += 1) {
-          const res = await origFetch.call(this, nextInput, { ...init, redirect: "manual" });
-          if (res.status < 300 || res.status >= 400) return res;
-          const loc = res.headers.get("location");
-          if (!loc) return res;
-          current = new URL(loc, current).href;
-          guardSink("ssrf", current);
-          nextInput = current;
-        }
-        return origFetch.call(this, current, init);
-      })();
-    };
-    restorers.push(() => {
-      globalThis.fetch = origFetch;
-    });
-  }
-  const vm = require2("node:vm");
-  for (const name of ["runInNewContext", "runInThisContext", "runInContext", "compileFunction"]) {
-    patchMethod(vm, name, (orig) => {
-      return function(code, ...rest) {
-        return applySink(
-          "sql",
-          typeof code === "string" ? code : "",
-          void 0,
-          () => orig.call(this, code, ...rest)
-        );
-      };
-    });
-  }
-  const Module = require2("node:module");
-  origModuleLoad = Module._load.bind(Module);
-  const origLoad = Module._load;
-  Module._load = function(request, parent, isMain) {
-    const exported = origLoad.call(this, request, parent, isMain);
-    try {
-      return wrapKnownPackage(String(request), exported);
-    } catch {
-      emitRaspEvent({
-        ruleId: RASP_FAIL_OPEN,
-        path: currentRaspContext()?.path ?? "/",
-        ip: currentRaspContext()?.ip ?? "unknown",
-        sample: "hook-error"
-      });
-      return exported;
-    }
-  };
-  restorers.push(() => {
-    Module._load = origLoad;
-    origModuleLoad = void 0;
-  });
-  const registerHooks = Module.registerHooks;
-  if (typeof registerHooks === "function" && !sqliteHookRegistered) {
-    sqliteHookRegistered = true;
-    registerHooks({
-      load(url, context, nextLoad) {
-        const result = nextLoad(url, context);
-        if (hooksLive && typeof url === "string" && (url === "node:sqlite" || url.startsWith("node:sqlite"))) {
-          wrapSqliteNow();
-        }
-        return result;
-      }
-    });
-  }
-  if (sqliteAlreadyLoaded()) wrapSqliteNow();
-}
-function wrapExpressLike(exported) {
-  if (typeof exported !== "function") return;
-  const orig = exported;
-  if (wrappedPackages.has(orig)) return;
-  function patched(...args) {
-    const app = orig.apply(this, args);
-    try {
-      if (app && typeof app.use === "function" && !app.__fullshieldRasp) {
-        app.use(raspContext());
-        app.__fullshieldRasp = true;
-      }
-    } catch {
-      emitRaspEvent({
-        ruleId: RASP_FAIL_OPEN,
-        path: "/",
-        ip: "unknown",
-        sample: "hook-error"
-      });
-    }
-    return app;
-  }
-  Object.assign(patched, orig);
-  Object.setPrototypeOf(patched, orig);
-  wrappedPackages.add(orig);
-  exported.__fullshieldExpressPatch = patched;
-}
-function wrapKnownPackage(request, exported) {
-  if (exported === null || typeof exported !== "object" && typeof exported !== "function") return exported;
-  const obj = exported;
-  if (wrappedPackages.has(obj)) return exported;
-  const name = request.replace(/^node:/, "");
-  if (name === "sqlite") {
-    wrapSqliteNow(exported);
-    return exported;
-  }
-  if (name === "pg" || name.endsWith("/pg")) {
-    const pg = exported;
-    if (pg.Client?.prototype) wrapSqlMethod(pg.Client.prototype, "query");
-    if (pg.Pool?.prototype) wrapSqlMethod(pg.Pool.prototype, "query");
-    wrappedPackages.add(obj);
-    return exported;
-  }
-  if (name === "mysql2" || name.endsWith("/mysql2") || name.includes("mysql2/")) {
-    const mysql = exported;
-    const proto = mysql.Connection?.prototype ?? mysql.prototype;
-    if (proto) {
-      wrapSqlMethod(proto, "query");
-      wrapSqlMethod(proto, "execute");
-    }
-    wrappedPackages.add(obj);
-    return exported;
-  }
-  if (name === "better-sqlite3" || name.endsWith("/better-sqlite3")) {
-    const proto = exported.prototype;
-    if (proto) {
-      wrapSqlMethod(proto, "exec");
-      wrapSqlMethod(proto, "prepare");
-    }
-    wrappedPackages.add(obj);
-    return exported;
-  }
-  if (name === "@prisma/client" || name === "prisma" || name.endsWith("/@prisma/client")) {
-    const client = exported.PrismaClient?.prototype;
-    if (client) {
-      wrapSqlMethod(client, "$queryRawUnsafe");
-      wrapSqlMethod(client, "$executeRawUnsafe");
-      wrapSqlMethod(client, "$queryRaw");
-      wrapSqlMethod(client, "$executeRaw");
-    }
-    const Prisma = exported.Prisma;
-    if (Prisma) wrapSqlMethod(Prisma, "raw");
-    wrappedPackages.add(obj);
-    return exported;
-  }
-  if (name === "sequelize" || name.endsWith("/sequelize")) {
-    const rec = exported;
-    const proto = rec.Sequelize?.prototype ?? rec.prototype;
-    if (proto) wrapSqlMethod(proto, "query");
-    if (typeof rec.literal === "function") wrapSqlMethod(rec, "literal");
-    if (rec.Sequelize && typeof rec.Sequelize.literal === "function") wrapSqlMethod(rec.Sequelize, "literal");
-    wrappedPackages.add(obj);
-    return exported;
-  }
-  if (name === "knex" || name.endsWith("/knex")) {
-    if (typeof exported.raw === "function") wrapSqlMethod(obj, "raw");
-    const client = exported.Client?.prototype;
-    if (client) {
-      wrapSqlMethod(client, "raw");
-      wrapSqlMethod(client, "whereRaw");
-      wrapSqlMethod(client, "orderByRaw");
-      wrapSqlMethod(client, "query");
-    }
-    wrappedPackages.add(obj);
-    return exported;
-  }
-  if (name === "typeorm" || name.endsWith("/typeorm")) {
-    const rec = exported;
-    for (const cls of ["DataSource", "EntityManager", "QueryRunner", "Connection"]) {
-      const proto = rec[cls]?.prototype;
-      if (proto) wrapSqlMethod(proto, "query");
-    }
-    const qb = rec.SelectQueryBuilder?.prototype ?? rec.QueryBuilder?.prototype;
-    if (qb) wrapSqlMethod(qb, "where");
-    wrappedPackages.add(obj);
-    return exported;
-  }
-  if (name === "drizzle-orm" || name.endsWith("/drizzle-orm")) {
-    const sql = exported.sql;
-    if (sql) wrapSqlMethod(sql, "raw");
-    wrappedPackages.add(obj);
-    return exported;
-  }
-  if (name === "mongodb" || name.includes("mongodb")) {
-    const col = exported.Collection?.prototype;
-    if (col) {
-      patchMethod(col, "find", (orig) => {
-        return function(query, ...rest) {
-          return applySink("nosql", query ?? {}, void 0, () => orig.call(this, query, ...rest));
-        };
-      });
-    }
-    wrappedPackages.add(obj);
-    return exported;
-  }
-  if (name === "mongoose" || name.includes("mongoose")) {
-    const q = exported.Query?.prototype;
-    if (q) {
-      patchMethod(q, "find", (orig) => {
-        return function(query, ...rest) {
-          return applySink("nosql", query ?? {}, void 0, () => orig.call(this, query, ...rest));
-        };
-      });
-      wrapNosqlWhere(q, "$where");
-    }
-    const model = exported.Model?.prototype;
-    if (model) wrapNosqlWhere(model, "$where");
-    wrappedPackages.add(obj);
-    return exported;
-  }
-  if (name === "axios") {
-    const ax = exported;
-    const urlOf = (args) => {
-      const a = args[0];
-      if (typeof a === "string") return a;
-      if (a && typeof a === "object" && "url" in a && typeof a.url === "string") return a.url;
-      return "";
-    };
-    wrapSsrf(ax, "request", urlOf);
-    wrapSsrf(ax, "get", urlOf);
-    wrapSsrf(ax, "post", urlOf);
-    wrappedPackages.add(obj);
-    return exported;
-  }
-  if (name === "express") {
-    wrapExpressLike(exported);
-    const patched = exported.__fullshieldExpressPatch;
-    if (typeof patched === "function") {
-      const resp = exported.response;
-      if (resp && typeof resp.redirect === "function") {
-        patchMethod(resp, "redirect", (orig) => {
-          return function(...args) {
-            const url = typeof args[0] === "string" ? args[0] : typeof args[1] === "string" ? args[1] : "";
-            return applySink("ssrf", url, void 0, () => orig.call(this, ...args));
-          };
-        });
-      }
-      wrappedPackages.add(obj);
-      return patched;
-    }
-  }
-  return exported;
-}
-function installHooks() {
-  hooksLive = true;
-  wrapBuiltins();
-}
-
-// src/runtime/rasp/vpatch.ts
-function patchForcesBlock(patches, route, kind) {
-  return patches.some((p) => {
-    const routeHit = p.route === void 0 || p.route === route;
-    const sinkHit = p.sink === void 0 || p.sink === kind;
-    return routeHit && sinkHit;
-  });
-}
-
-// src/runtime/rasp/enable.ts
-var enabled = false;
-var options = {};
-function raspMode() {
-  return options.mode ?? "monitor";
-}
-function raspModeFor(route, kind) {
-  if (patchForcesBlock(options.virtualPatches ?? [], route, kind)) return "block";
-  return raspMode();
-}
-function raspEgressAllow() {
-  return options.egress?.allow;
-}
-function runDecide(kind, sink, ctx, base) {
-  if (options.decide) return options.decide(kind, sink, ctx);
-  return decideSink(kind, sink, ctx, base);
-}
-function emitRaspEvent(event) {
-  options.onEvent?.(event);
-}
-function enableRasp(opts = {}) {
-  if (!opts.experimental && process.env.FULLSHIELD_EXPERIMENTAL_RASP !== "1") {
-    return;
-  }
-  options = { ...opts, experimental: true };
-  configureThreat({ autoBlock: opts.threatAutoBlock === true, maxBlockMs: opts.threatMaxBlockMs });
-  if (!enabled) {
-    installHooks();
-    enabled = true;
-  }
-}
-function enableRaspFromEnv() {
-  if (process.env.FULLSHIELD_EXPERIMENTAL_RASP !== "1") return;
-  enableRasp({
-    experimental: true,
-    mode: process.env.FULLSHIELD_RASP_MODE === "block" ? "block" : "monitor"
-  });
-}
-
-// src/runtime/auto.ts
-enableRaspFromEnv();
+import Un from'dns';import {createRequire}from'module';import {AsyncLocalStorage}from'async_hooks';function J(n){return n===null||typeof n!="object"||Array.isArray(n)?false:Object.keys(n).some(t=>t.startsWith("$"))}function H(n,t){if(n===t)return  true;if(n===null||t===null||typeof n!="object"||typeof t!="object")return  false;if(Array.isArray(n)||Array.isArray(t))return !Array.isArray(n)||!Array.isArray(t)||n.length!==t.length?false:n.every((o,s)=>H(o,t[s]));let e=Object.keys(n),r=Object.keys(t);return e.length!==r.length?false:e.every(o=>H(n[o],t[o]))}function M(n,t,e){if(!(e>8||n===null||typeof n!="object")){if(t.push(n),Array.isArray(n)){for(let r of n)M(r,t,e+1);return}for(let r of Object.values(n))M(r,t,e+1);}}function nn(n,t){let e=[];for(let i of t.objects)M(i,e,0);let r=e.filter(J);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),J(i)&&r.some(c=>c===i||H(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(n,0)}function W(n){let t=n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n),e=[];for(let r of n.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (t?"/":"")+e.join("/")}function Hn(n,t){let e=W(n).replace(/\/+$/,""),r=W(t);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function Mn(n,t){let e=n.indexOf(t);return e<=0?"":n.slice(0,e)}function tn(n){let t=W(n).split("/").filter(Boolean);return t[t.length-1]}function en(n,t,e){if(!t)return  false;if(t.includes("\0")||n.includes("\0"))return  true;if(n.includes(t)){if(t.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:Mn(n,t);return r===""?t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t)||t.includes(".."):!Hn(r,n)}if(t.includes("..")||t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t)){let r=tn(t),o=tn(n);if(r&&r===o)return  true}return  false}var Wn=new Set(["__proto__","constructor","prototype"]);function B(n,t,e){if(t>8||n===null||typeof n!="object"||e.has(n))return  false;e.add(n);for(let r of Object.getOwnPropertyNames(n))if(Wn.has(r))return  true;return Array.isArray(n)?n.some(r=>B(r,t+1,e)):Object.values(n).some(r=>B(r,t+1,e))}function rn(n){let t=new Set;return n.objects.some(e=>B(e,0,t))}function Bn(n){let t=[],e=0,r=n.length;for(;e<r;){let o=n[e];if(o===" "||o==="	"||o===`
+`){let i=e;for(;e<r&&(n[e]===" "||n[e]==="	"||n[e]===`
+`);)e+=1;t.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&n[e]!==i;)i==='"'&&n[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),t.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&n[e]!=="`";)e+=1;e<r&&(e+=1),t.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(n[e+1]==="("||n[e+1]==="{")){let i=n[e+1],u=i==="("?")":"}",c=e;e+=2;let k=1;for(;e<r&&k>0;)n[e]===i?k+=1:n[e]===u&&(k-=1),e+=1;t.push({kind:"op",start:c,end:e});continue}if(n.startsWith("||",e)||n.startsWith("&&",e)||n.startsWith(">>",e)||n.startsWith("<<",e)){t.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){t.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(n[e]);)e+=1;t.push({kind:"word",start:s,end:e});}return t}function on(n,t){if(!t)return  false;let e=Bn(n),r=0;for(;r<=n.length;){let o=n.indexOf(t,r);if(o===-1)return  false;let s=o+t.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(t.length,1);}return  false}function Kn(n){let t=[],e=0,r=n.length;for(;e<r;){let o=n[e];if(o<=" "){let i=e;for(;e<r&&n[e]<=" ";)e+=1;t.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(n[e]===i){if(n[e+1]===i){e+=2;continue}e+=1;break}e+=1;}t.push({kind:"string",start:u,end:e});continue}if(o==="-"&&n[e+1]==="-"){let i=e;for(e+=2;e<r&&n[e]!==`
+`;)e+=1;t.push({kind:"comment",start:i,end:e});continue}if(o==="/"&&n[e+1]==="*"){let i=e;for(e+=2;e<r&&!(n[e]==="*"&&n[e+1]==="/");)e+=1;e+1<r&&(e+=2),t.push({kind:"comment",start:i,end:e});continue}if(o==="#"){let i=e;for(;e<r&&n[e]!==`
+`;)e+=1;t.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&n[e+1]>="0"&&n[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(n[e]);)e+=1;t.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(n[e]);)e+=1;t.push({kind:"ident",start:i,end:e});continue}let s=e;n.startsWith("<=",e)||n.startsWith(">=",e)||n.startsWith("<>",e)||n.startsWith("!=",e)||n.startsWith("||",e)||n.startsWith("&&",e)?e+=2:e+=1,t.push({kind:"op",start:s,end:e});}return t}function Nn(n,t,e){let r=n.filter(o=>o.kind!=="space"&&o.start<e&&o.end>t);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>t||o.end<e}return r.length>0}function K(n,t){if(!t)return  false;let e=Kn(n),r=0;for(;r<=n.length;){let o=n.indexOf(t,r);if(o===-1)return  false;if(Nn(e,o,o+t.length))return  true;r=o+Math.max(t.length,1);}return  false}function N(n){let t=n.trim().toLowerCase();return t=t.replace(/\.+$/,""),t.startsWith("[")&&t.endsWith("]")&&(t=t.slice(1,-1)),t.startsWith("::ffff:")&&(t=t.slice(7)),t.startsWith("[")&&t.endsWith("]")&&(t=t.slice(1,-1)),t}function $n(n){if(/^0x[0-9a-f]+$/i.test(n)){let t=Number.parseInt(n,16);return Number.isFinite(t)?t:void 0}if(/^0[0-7]+$/.test(n)){let t=Number.parseInt(n,8);return Number.isFinite(t)?t:void 0}if(/^\d+$/.test(n)){let t=Number(n);return Number.isFinite(t)?t:void 0}}function fn(n){let t=N(n);if(!t||t.includes(":"))return;let e=t.split(".");if(e.length===0||e.length>4)return;let r=e.map($n);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],k=r[2];return o>255||c>255||k>65535?void 0:[o,c,k>>>8&255,k&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function Dn(n){let[t,e]=n;return t===127||t===0||t===10||t===169&&e===254||t===192&&e===168||t===172&&e>=16&&e<=31}function zn(n){return !!(n==="::1"||n==="::"||n==="0:0:0:0:0:0:0:1"||n.startsWith("fc")||n.startsWith("fd")||n.startsWith("fe80:"))}function un(n){let t=N(n);if(t==="localhost"||t.endsWith(".localhost")||t==="metadata.google.internal")return  true;let e=fn(t);return e?Dn(e):t.includes(":")?zn(t):false}function Qn(n){let t=N(n);if(fn(t)||t.includes(":"))return [t];try{let e=Un.lookupSync;if(typeof e=="function")return e(t,{all:!0}).map(r=>r.address)}catch{}return []}function Vn(n){try{return Qn(n)}catch{return []}}function cn(n){if(un(n))return  true;for(let t of Vn(n))if(un(t))return  true;return  false}function an(n,t){if(!t||!n.includes(t))return  false;let e;try{e=new URL(n);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(n)?.[1]??r).replace(/:\d+$/,"");return t===n||t.includes(r)||t.includes(s)||s.includes(t)&&t.length>=3?cn(r)||cn(s):false}function C(n){let t=n[0];if(typeof t=="string")return t;if(t instanceof URL)return t.href;if(t&&typeof t=="object"){let e=t;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function ln(n){return typeof n=="string"?n:n instanceof URL?n.href:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}var pn={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001"},j="RASP-FAIL-OPEN-001",w=class extends Error{ruleId;constructor(t){super(`fullshield rasp blocked ${t}`),this.name="RaspBlockedError",this.ruleId=t;}};function Zn(n){return typeof n=="string"?[n]:typeof n=="number"||typeof n=="boolean"?[String(n)]:[]}function Yn(n,t){let e="";if(typeof n=="string")e=n;else if(n!==null&&typeof n=="object"&&!Array.isArray(n)&&"$where"in n){let r=n.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of t.strings)if(r&&K(e,r))return  true;return  false}function Gn(n,t,e,r){if(n==="proto")return rn(e);if(n==="nosql")return nn(t,e)?true:Yn(t,e);for(let o of Zn(t))for(let s of e.strings)if(s&&(n==="sql"&&K(o,s)||n==="shell"&&on(o,s)||n==="path"&&en(o,s,r)||n==="ssrf"&&an(o,s)))return  true;return  false}function dn(n,t,e,r){return Gn(n,t,e,r)?{block:true,ruleId:pn[n]}:{block:false}}var Jn=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),hn=new AsyncLocalStorage;function v(n,t,e){if(!(e>8||t.length>200)){if(typeof n=="string"){t.push(n);return}if(typeof n=="number"||typeof n=="boolean"){t.push(String(n));return}if(Array.isArray(n)){for(let r of n)v(r,t,e+1);return}if(n!==null&&typeof n=="object")for(let r of Object.values(n))v(r,t,e+1);}}function O(n,t,e){if(!(e>8||n===null||typeof n!="object")){if(t.push(n),Array.isArray(n)){for(let r of n)O(r,t,e+1);return}for(let r of Object.values(n))O(r,t,e+1);}}function gn(n){let t=[],e=[];for(let r of [n.query,n.body,n.params,n.cookies])v(r,t,0),O(r,e,0);if(n.headers&&typeof n.headers=="object"){for(let[r,o]of Object.entries(n.headers))Jn.has(r.toLowerCase())||v(o,t,0);O(n.headers,e,0);}return {path:n.path??n.url?.split("?")[0]??"/",ip:n.ip??"unknown",strings:t,objects:e}}function kn(n,t){return hn.run(n,t)}function R(){return hn.getStore()}function yn(n,t){let e=n.toLowerCase().replace(/\.+$/,"");for(let r of t){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var mn=new Map,U=new Map,nt={block:2,honey:5,anomaly:1},tt=900*1e3,$=false,bn=tt;function wn(n={}){$=n.autoBlock===true,typeof n.maxBlockMs=="number"&&n.maxBlockMs>0&&(bn=n.maxBlockMs);}function A(n,t,e=Date.now()){let r=(mn.get(n)??0)+nt[t];return mn.set(n,r),$&&r>=10&&U.set(n,e+bn),r}function Rn(n,t=Date.now()){if(!$)return  false;let e=U.get(n);return e===void 0?false:t>=e?(U.delete(n),false):true}var et=["/admin.php","/.git/config","/wp-login.php"],rt=new Set,ot=6e4,Sn=new Map;function xn(n){let t=n.split("?")[0]??n;return et.includes(t)}function jn(n){if(!n)return  false;for(let t of rt)if(t&&n.includes(t))return  true;return  false}function An(n,t=Date.now()){let e=Sn.get(n);return e===void 0||t-e.start>ot?(Sn.set(n,{count:1,start:t}),1):(e.count+=1,e.count)}function En(){return function(t,e,r){let o=gn(t);try{let s=o.strings.some(c=>jn(c));if(xn(o.path)&&!s){let c=An(o.ip);A(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(A(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),Rn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=q("proto",null,o);if(u.block&&u.ruleId&&(g({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),L(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof w){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}g({ruleId:j,path:o.path,ip:o.ip,sample:"hook-error"});}kn(o,()=>{r();});}}var m=createRequire(import.meta.url),T=[],l=new WeakSet,Ln=false,In=false;function it(n){return typeof n=="string"?n.slice(0,40):n==null?"":"[object]"}function ut(n){let t=R();if(t)for(let e of t.strings){if(!e)continue;let r=n.indexOf(e);if(r>0)return n.slice(0,r)}}function Q(n,t,e){try{let r=R();if(r){let o=q(n,t,r,e);if(o.block&&o.ruleId&&(g({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:it(t)}),A(r.ip,"block"),L(r.path,n)==="block"))throw new w(o.ruleId)}}catch(r){if(r instanceof w)throw r;let o=R();g({ruleId:j,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function y(n,t,e,r){return Q(n,t,e),r()}function b(n,t,e){let r=n,o=r[t];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[t]=s,T.push(()=>{r[t]=o;});}function ct(n){if(typeof n=="string")return n;if(Array.isArray(n))return n.filter(t=>typeof t=="string").join(" ");if(n!==null&&typeof n=="object"){let t=n;if(typeof t.text=="string")return t.text;if(typeof t.sql=="string")return t.sql;if(Array.isArray(t.strings))return t.strings.filter(e=>typeof e=="string").join(" ")}return ""}function a(n,t){b(n,t,e=>function(r,...o){return y("sql",ct(r),void 0,()=>e.call(this,r,...o))});}function Pn(n,t){b(n,t,e=>function(r,...o){return y("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function E(n,t,e){b(n,t,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return y("shell",u,void 0,()=>r.call(this,...o))});}function Cn(n,t){b(n,t,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return y("path",s,ut(s),()=>e.call(this,r,...o))});}function vn(n){let t=qn();if(!t||t.length===0)return;let e="";try{e=new URL(n).hostname;}catch{return}if(e&&!yn(e,t)){let r=R();if(g({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&A(r.ip,"block"),L(r?.path??"/","ssrf")==="block")throw new w("RASP-EGRESS-001")}}function S(n,t,e){b(n,t,r=>function(...o){let s=e(o);return vn(s),y("ssrf",s,void 0,()=>r.call(this,...o))});}var ft=Symbol.for("fullshield.rasp.wrapSqlite"),D=Symbol.for("fullshield.rasp.sqliteWrapped"),F;function z(n){if(!n||typeof n!="object")return;let t=n.DatabaseSync?.prototype;if(t&&typeof t=="object")return t}function at(n){let t=z(n);if(t)return t;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=z(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(F)try{return z(F("node:sqlite",void 0,!1))}catch{}}function lt(){let n=process.moduleLoadList;return Array.isArray(n)&&n.some(t=>/(?:^| )sqlite$/i.test(t))}function _(n){try{let t=at(n);if(!t||t[D])return;Object.defineProperty(t,D,{value:!0,configurable:!0}),a(t,"exec"),a(t,"prepare"),T.push(()=>{delete t[D];});}catch{}}function pt(){globalThis[ft]=_;let n=m("node:child_process"),t=m("child_process");for(let f of new Set([n,t]))E(f,"exec",true),E(f,"execSync",true),E(f,"spawn",false),E(f,"spawnSync",false),E(f,"execFile",false),E(f,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=m("node:fs"),o=m("fs");for(let f of new Set([r,o]))for(let p of e)Cn(f,p);try{let f=m("node:fs/promises");for(let p of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])Cn(f,p);}catch{}let s=m("node:http"),i=m("node:https");if(S(s,"request",C),S(s,"get",C),S(i,"request",C),S(i,"get",C),typeof globalThis.fetch=="function"){let f=globalThis.fetch;globalThis.fetch=function(p,d){let h=ln(p);return vn(h),(d?.redirect??"follow")!=="follow"?y("ssrf",h,void 0,()=>f.call(this,p,d)):(Q("ssrf",h),(async()=>{let I=h,Y=p;for(let G=0;G<8;G+=1){let P=await f.call(this,Y,{...d,redirect:"manual"});if(P.status<300||P.status>=400)return P;let X=P.headers.get("location");if(!X)return P;I=new URL(X,I).href,Q("ssrf",I),Y=I;}return f.call(this,I,d)})())},T.push(()=>{globalThis.fetch=f;});}let u=m("node:vm");for(let f of ["runInNewContext","runInThisContext","runInContext","compileFunction"])b(u,f,p=>function(d,...h){return y("sql",typeof d=="string"?d:"",void 0,()=>p.call(this,d,...h))});let c=m("node:module");F=c._load.bind(c);let k=c._load;c._load=function(f,p,d){let h=k.call(this,f,p,d);try{return ht(String(f),h)}catch{return g({ruleId:j,path:R()?.path??"/",ip:R()?.ip??"unknown",sample:"hook-error"}),h}},T.push(()=>{c._load=k,F=void 0;});let Z=c.registerHooks;typeof Z=="function"&&!In&&(In=true,Z({load(f,p,d){let h=d(f,p);return Ln&&typeof f=="string"&&(f==="node:sqlite"||f.startsWith("node:sqlite"))&&_(),h}})),lt()&&_();}function dt(n){if(typeof n!="function")return;let t=n;if(l.has(t))return;function e(...r){let o=t.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(En()),o.__fullshieldRasp=!0);}catch{g({ruleId:j,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,t),Object.setPrototypeOf(e,t),l.add(t),n.__fullshieldExpressPatch=e;}function ht(n,t){if(t===null||typeof t!="object"&&typeof t!="function")return t;let e=t;if(l.has(e))return t;let r=n.replace(/^node:/,"");if(r==="sqlite")return _(t),t;if(r==="pg"||r.endsWith("/pg")){let o=t;return o.Client?.prototype&&a(o.Client.prototype,"query"),o.Pool?.prototype&&a(o.Pool.prototype,"query"),l.add(e),t}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=t,s=o.Connection?.prototype??o.prototype;return s&&(a(s,"query"),a(s,"execute")),l.add(e),t}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=t.prototype;return o&&(a(o,"exec"),a(o,"prepare")),l.add(e),t}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=t.PrismaClient?.prototype;o&&(a(o,"$queryRawUnsafe"),a(o,"$executeRawUnsafe"),a(o,"$queryRaw"),a(o,"$executeRaw"));let s=t.Prisma;return s&&a(s,"raw"),l.add(e),t}if(r==="sequelize"||r.endsWith("/sequelize")){let o=t,s=o.Sequelize?.prototype??o.prototype;return s&&a(s,"query"),typeof o.literal=="function"&&a(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&a(o.Sequelize,"literal"),l.add(e),t}if(r==="knex"||r.endsWith("/knex")){typeof t.raw=="function"&&a(e,"raw");let o=t.Client?.prototype;return o&&(a(o,"raw"),a(o,"whereRaw"),a(o,"orderByRaw"),a(o,"query")),l.add(e),t}if(r==="typeorm"||r.endsWith("/typeorm")){let o=t;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&a(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&a(s,"where"),l.add(e),t}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=t.sql;return o&&a(o,"raw"),l.add(e),t}if(r==="mongodb"||r.includes("mongodb")){let o=t.Collection?.prototype;return o&&b(o,"find",s=>function(i,...u){return y("nosql",i??{},void 0,()=>s.call(this,i,...u))}),l.add(e),t}if(r==="mongoose"||r.includes("mongoose")){let o=t.Query?.prototype;o&&(b(o,"find",i=>function(u,...c){return y("nosql",u??{},void 0,()=>i.call(this,u,...c))}),Pn(o,"$where"));let s=t.Model?.prototype;return s&&Pn(s,"$where"),l.add(e),t}if(r==="axios"){let o=t,s=i=>{let u=i[0];return typeof u=="string"?u:u&&typeof u=="object"&&"url"in u&&typeof u.url=="string"?u.url:""};return S(o,"request",s),S(o,"get",s),S(o,"post",s),l.add(e),t}if(r==="express"){dt(t);let o=t.__fullshieldExpressPatch;if(typeof o=="function"){let s=t.response;return s&&typeof s.redirect=="function"&&b(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return y("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return t}function On(){Ln=true,pt();}function _n(n,t,e){return n.some(r=>{let o=r.route===void 0||r.route===t,s=r.sink===void 0||r.sink===e;return o&&s})}var Tn=false,x={};function kt(){return x.mode??"monitor"}function L(n,t){return _n(x.virtualPatches??[],n,t)?"block":kt()}function qn(){return x.egress?.allow}function q(n,t,e,r){return x.decide?x.decide(n,t,e):dn(n,t,e,r)}function g(n){x.onEvent?.(n);}function yt(n={}){!n.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...n,experimental:true},wn({autoBlock:n.threatAutoBlock===true,maxBlockMs:n.threatMaxBlockMs}),Tn||(On(),Tn=true));}function Fn(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&yt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}Fn();