shield360 1.1.0 → 1.2.1

package/dist/rasp/config-client.js

@@ -0,0 +1,337 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RaspConfigClient = exports.BACKOFF_MS = exports.JITTER_MS = exports.POLL_MS = exports.SKEW_S = exports.JWS_TYPE = void 0;
+exports.parsePublicKeys = parsePublicKeys;
+exports.jwsKid = jwsKid;
+exports.verifyConfigJws = verifyConfigJws;
+/**
+ * Signed RASP config client (README "The signed config").
+ *
+ * `GET /api/rasp/config?app=` returns `{ config: <compact JWS>, keys }`. The
+ * JWS is trusted only when it verifies against a key the app pinned
+ * (`configPublicKey` / `SHIELD360_CONFIG_PUBLIC_KEY`: a JWK, a JWKS for
+ * rotation, or the bare base64url Ed25519 `x`). The `keys` in the response
+ * are never trusted on their own: they came over the same channel as the
+ * config. Only with trust on first use (development: `allowUnpinnedConfig`
+ * or `SHIELD360_CONFIG_TOFU=dev`, never in production) is the first `kid`
+ * seen pinned; a config signed by another kid after that is rejected. A
+ * pinned key that does not verify never falls back to trust on first use.
+ *
+ * ETag polling every 60 s ± 10 s, 5 minutes after a failure; the last
+ * verified config is kept in memory and in a cache file that is re-verified
+ * when loaded. Never throws and never blocks start-up.
+ */
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const path_1 = require("path");
+exports.JWS_TYPE = 'shield360-rasp+jws';
+exports.SKEW_S = 60;
+exports.POLL_MS = 60000;
+exports.JITTER_MS = 10000;
+exports.BACKOFF_MS = 5 * 60000;
+const FETCH_TIMEOUT_MS = 10000;
+const MAX_TOKEN = 256 * 1024;
+// Captured at load, before any later file-system hook, so the cache never
+// trips RASP itself.
+const readFile = fs.readFileSync.bind(fs);
+const writeFile = fs.writeFileSync.bind(fs);
+const mkdir = fs.mkdirSync.bind(fs);
+const rename = fs.renameSync.bind(fs);
+const b64url = (s) => Buffer.from(s.replace(/-/g, '+').replace(/_/g, '/'), 'base64');
+const B64URL = /^[A-Za-z0-9_-]+$/;
+function fromJwk(jwk) {
+    try {
+        const j = jwk;
+        if (!j || j.kty !== 'OKP' || j.crv !== 'Ed25519' || typeof j.x !== 'string' || !B64URL.test(j.x) || b64url(j.x).length !== 32)
+            return null;
+        const key = (0, crypto_1.createPublicKey)({ key: { kty: 'OKP', crv: 'Ed25519', x: j.x }, format: 'jwk' });
+        return { kid: typeof j.kid === 'string' && j.kid ? j.kid : undefined, x: j.x, key };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Parses a pinned key: a JWK, a JWKS, or the bare base64url Ed25519 `x`
+ * (objects or JSON text). Unusable entries are left out; [] when none is usable.
+ */
+function parsePublicKeys(input) {
+    if (input == null || input === '')
+        return [];
+    let value = input;
+    if (typeof value === 'string') {
+        const s = value.trim();
+        if (s.startsWith('{') || s.startsWith('[')) {
+            try {
+                value = JSON.parse(s);
+            }
+            catch {
+                return [];
+            }
+        }
+        else {
+            const k = fromJwk({ kty: 'OKP', crv: 'Ed25519', x: s });
+            return k ? [k] : [];
+        }
+    }
+    const list = Array.isArray(value) ? value : value && typeof value === 'object' && Array.isArray(value.keys) ? value.keys : [value];
+    return list
+        .slice(0, 16)
+        .map(fromJwk)
+        .filter((k) => k !== null);
+}
+function header(token) {
+    try {
+        const h = JSON.parse(b64url(token.split('.')[0] || '').toString('utf8'));
+        return h && typeof h === 'object' ? h : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The `kid` in a JWS header, or undefined. */
+function jwsKid(token) {
+    const h = typeof token === 'string' ? header(token) : null;
+    return h && typeof h.kid === 'string' ? h.kid : undefined;
+}
+/**
+ * Verifies a compact JWS against the given keys only: `alg` EdDSA, `typ`
+ * shield360-rasp+jws, an Ed25519 signature by the pinned key whose kid
+ * matches the header (any pinned key when the header names none listed), `v` 1, `app` equal to ours, `exp` in the future
+ * (60 s skew).
+ */
+function verifyConfigJws(token, keys, app, nowS = Date.now() / 1000) {
+    try {
+        if (typeof token !== 'string' || token.length > MAX_TOKEN)
+            return { ok: false, reason: 'malformed' };
+        const parts = token.split('.');
+        if (parts.length !== 3 || !parts.every((p) => B64URL.test(p)))
+            return { ok: false, reason: 'malformed' };
+        const h = header(token);
+        if (!h)
+            return { ok: false, reason: 'malformed' };
+        if (h.alg !== 'EdDSA')
+            return { ok: false, reason: 'alg' };
+        if (h.typ !== exports.JWS_TYPE)
+            return { ok: false, reason: 'typ' };
+        const kid = typeof h.kid === 'string' ? h.kid : undefined;
+        let candidates = kid ? keys.filter((k) => k.kid === kid) : [];
+        if (!candidates.length)
+            candidates = keys;
+        if (!candidates.length)
+            return { ok: false, reason: 'no_key' };
+        const signed = Buffer.from(`${parts[0]}.${parts[1]}`);
+        const sig = b64url(parts[2]);
+        if (!candidates.some((k) => (0, crypto_1.verify)(null, signed, k.key, sig)))
+            return { ok: false, reason: 'signature' };
+        const claims = JSON.parse(b64url(parts[1]).toString('utf8'));
+        if (!claims || typeof claims !== 'object' || claims.v !== 1)
+            return { ok: false, reason: 'version' };
+        if (claims.app !== app)
+            return { ok: false, reason: 'app' };
+        if (typeof claims.exp !== 'number' || claims.exp + exports.SKEW_S <= nowS)
+            return { ok: false, reason: 'expired' };
+        if (typeof claims.version !== 'string' || !claims.version)
+            return { ok: false, reason: 'version' };
+        return { ok: true, claims, kid };
+    }
+    catch {
+        return { ok: false, reason: 'malformed' };
+    }
+}
+class RaspConfigClient {
+    constructor(o) {
+        this.o = o;
+        /** Keys pinned on first use (allowUnpinned only). */
+        this.tofu = [];
+        this.warned = new Set();
+        this.stopped = false;
+        this.base = o.url.replace(/\/+$/, '');
+    }
+    /** The keys a config must verify against right now. */
+    trusted() {
+        return this.o.pinned.length ? this.o.pinned : this.o.allowUnpinned ? this.tofu : [];
+    }
+    nowMs() {
+        return (this.o.now ?? Date.now)();
+    }
+    cacheFile() {
+        return (0, path_1.join)(this.o.cacheDir, `${this.o.app.replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 128) || 'default'}.json`);
+    }
+    warn(reason) {
+        if (this.warned.has(reason))
+            return;
+        this.warned.add(reason);
+        try {
+            this.o.onWarning?.(reason);
+        }
+        catch {
+            // never
+        }
+    }
+    apply(claims) {
+        // A stopped client (RASP re-initialized for another app or key) never
+        // applies anything: a poll still in flight when it stopped is dropped.
+        if (this.stopped)
+            return;
+        this.current = claims;
+        try {
+            this.o.onConfig(claims);
+        }
+        catch {
+            // fail open
+        }
+    }
+    /** Loads the cached config and re-verifies it. Pinned keys are never read from the cache. */
+    loadCache() {
+        try {
+            const saved = JSON.parse(readFile(this.cacheFile(), 'utf8'));
+            if (!this.o.pinned.length && this.o.allowUnpinned && !this.tofu.length)
+                this.tofu = parsePublicKeys({ keys: saved.tofu ?? [] });
+            const r = verifyConfigJws(saved.config, this.trusted(), this.o.app, this.nowMs() / 1000);
+            if (!r.ok)
+                return false;
+            this.apply(r.claims);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    saveCache(config) {
+        if (this.stopped)
+            return;
+        try {
+            mkdir(this.o.cacheDir, { recursive: true, mode: 0o700 });
+            const body = { config };
+            if (!this.o.pinned.length && this.tofu.length)
+                body.tofu = this.tofu.map((k) => ({ kty: 'OKP', crv: 'Ed25519', x: k.x, ...(k.kid ? { kid: k.kid } : {}) }));
+            const file = this.cacheFile();
+            const tmp = `${file}.${process.pid}.tmp`;
+            writeFile(tmp, JSON.stringify(body), { mode: 0o600 });
+            rename(tmp, file);
+        }
+        catch {
+            // the cache is best effort
+        }
+    }
+    /** Drops the config in force once it has expired (the platform could not be reached for its whole lifetime). */
+    expire() {
+        if (this.current && this.current.exp + exports.SKEW_S <= this.nowMs() / 1000) {
+            this.etag = undefined;
+            this.apply(undefined);
+        }
+    }
+    /** One poll. Never throws. */
+    async poll() {
+        const result = await this.fetchOnce();
+        this.expire();
+        return result;
+    }
+    async fetchOnce() {
+        try {
+            if (!this.o.pinned.length && !this.o.allowUnpinned) {
+                this.warn('unpinned');
+                return 'rejected';
+            }
+            const send = this.o.fetchImpl ?? globalThis.fetch;
+            const headers = { Authorization: `Bearer ${this.o.apiKey}`, Accept: 'application/json' };
+            if (this.etag && this.current)
+                headers['If-None-Match'] = this.etag;
+            const init = { headers };
+            if (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function')
+                init.signal = AbortSignal.timeout(FETCH_TIMEOUT_MS);
+            const res = await send(`${this.base}/api/rasp/config?app=${encodeURIComponent(this.o.app)}`, init);
+            if (res.status === 304)
+                return 'unchanged';
+            if (!res.ok)
+                return 'failed';
+            const body = (await res.json());
+            const token = typeof body?.config === 'string' ? body.config : '';
+            if (!this.o.pinned.length && this.o.allowUnpinned && !this.tofu.length) {
+                // Trust on first use (development only): pin the key the response names.
+                const kid = jwsKid(token);
+                const offered = parsePublicKeys({ keys: Array.isArray(body?.keys) ? body.keys : [] });
+                const first = offered.find((k) => k.kid === kid) ?? (offered.length === 1 ? offered[0] : undefined);
+                if (first) {
+                    this.tofu = [first];
+                    this.warn('trust_on_first_use');
+                }
+            }
+            const r = verifyConfigJws(token, this.trusted(), this.o.app, this.nowMs() / 1000);
+            if (!r.ok) {
+                this.warn(r.reason);
+                return 'rejected';
+            }
+            this.etag = res.headers.get('etag') ?? undefined;
+            this.apply(r.claims);
+            this.saveCache(token);
+            return 'updated';
+        }
+        catch {
+            return 'failed';
+        }
+    }
+    /** The delay before the next poll after a result. */
+    nextDelay(r) {
+        if (r === 'failed' || r === 'rejected')
+            return exports.BACKOFF_MS;
+        const random = this.o.random ?? Math.random;
+        return exports.POLL_MS + Math.round((random() * 2 - 1) * exports.JITTER_MS);
+    }
+    start() {
+        this.loadCache();
+        const loop = async () => {
+            if (this.stopped)
+                return;
+            const r = await this.poll();
+            if (this.stopped)
+                return;
+            this.timer = setTimeout(() => void loop(), this.nextDelay(r));
+            this.timer.unref?.();
+        };
+        // Off the start-up path.
+        this.timer = setTimeout(() => void loop(), 0);
+        this.timer.unref?.();
+    }
+    stop() {
+        this.stopped = true;
+        if (this.timer)
+            clearTimeout(this.timer);
+    }
+}
+exports.RaspConfigClient = RaspConfigClient;
+//# sourceMappingURL=config-client.js.map

package/dist/rasp/config-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-client.js","sourceRoot":"","sources":["../../src/rasp/config-client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiFA,0CAqBC;AAcD,wBAGC;AAQD,0CAyBC;AAxJD;;;;;;;;;;;;;;;;GAgBG;AACH,mCAA4E;AAC5E,uCAAyB;AACzB,+BAA4B;AAIf,QAAA,QAAQ,GAAG,oBAAoB,CAAC;AAChC,QAAA,MAAM,GAAG,EAAE,CAAC;AACZ,QAAA,OAAO,GAAG,KAAM,CAAC;AACjB,QAAA,SAAS,GAAG,KAAM,CAAC;AACnB,QAAA,UAAU,GAAG,CAAC,GAAG,KAAM,CAAC;AACrC,MAAM,gBAAgB,GAAG,KAAM,CAAC;AAChC,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC;AAE7B,0EAA0E;AAC1E,qBAAqB;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC1C,MAAM,SAAS,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5C,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACpC,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AA2BtC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC7F,MAAM,MAAM,GAAG,kBAAkB,CAAC;AAElC,SAAS,OAAO,CAAC,GAAY;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,GAAU,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC3I,MAAM,GAAG,GAAG,IAAA,wBAAe,EAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5F,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,KAAyC;IACvE,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC7C,IAAI,KAAK,GAAY,KAAK,CAAC;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACxD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAE,KAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,KAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpL,OAAO,IAAI;SACR,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,GAAG,CAAC,OAAO,CAAC;SACZ,MAAM,CAAC,CAAC,CAAC,EAAkB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAC/C,CAAC;AAID,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+CAA+C;AAC/C,SAAgB,MAAM,CAAC,KAAa;IAClC,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,KAAc,EAAE,IAAiB,EAAE,GAAW,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;IACtG,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACrG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACzG,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAClD,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3D,IAAI,CAAC,CAAC,GAAG,KAAK,gBAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,IAAI,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,UAAU,CAAC,MAAM;YAAE,UAAU,GAAG,IAAI,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,eAAY,EAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC/G,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAe,CAAC;QAC3E,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACrG,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC5D,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,cAAM,IAAI,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC3G,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACnG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AAwBD,MAAa,gBAAgB;IAU3B,YAA6B,CAAsB;QAAtB,MAAC,GAAD,CAAC,CAAqB;QANnD,qDAAqD;QAC7C,SAAI,GAAgB,EAAE,CAAC;QACd,WAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QAE5C,YAAO,GAAG,KAAK,CAAC;QAGd,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,uDAAuD;IAC/C,OAAO;QACb,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,CAAC;IAEO,KAAK;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,CAAC;IAED,SAAS;QACP,OAAO,IAAA,WAAI,EAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,SAAS,OAAO,CAAC,CAAC;IACjH,CAAC;IAEO,IAAI,CAAC,MAAc;QACzB,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO;QACpC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ;QACV,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAA8B;QAC1C,sEAAsE;QACtE,uEAAuE;QACvE,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,SAAS;QACP,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAc,CAAC;YAC1E,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;YAChI,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;YACzF,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,MAAc;QAC9B,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,MAAM,IAAI,GAAc,EAAE,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5J,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YACzC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;IAED,gHAAgH;IACxG,MAAM;QACZ,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,cAAM,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;YACrE,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;YACtB,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;gBACnD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACtB,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;YAClD,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YACjH,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;YACpE,MAAM,IAAI,GAAgB,EAAE,OAAO,EAAE,CAAC;YACtC,IAAI,OAAO,WAAW,KAAK,WAAW,IAAI,OAAO,WAAW,CAAC,OAAO,KAAK,UAAU;gBAAE,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YACzI,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,wBAAwB,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACnG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,WAAW,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,QAAQ,CAAC;YAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyC,CAAC;YACxE,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvE,yEAAyE;gBACzE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1B,MAAM,OAAO,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,IAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjG,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACpG,IAAI,KAAK,EAAE,CAAC;oBACV,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;oBACpB,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;YAClF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACrB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,SAAS,CAAC,CAAa;QACrB,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,UAAU;YAAE,OAAO,kBAAU,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QAC5C,OAAO,eAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,iBAAS,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK;QACH,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;YACzB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;YACzB,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACvB,CAAC,CAAC;QACF,yBAAyB;QACzB,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;CACF;AA9JD,4CA8JC"}

package/dist/rasp/context.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The RASP context of the request (or worker job) being served, kept in
+ * AsyncLocalStorage. Inputs live here, in memory, for the life of the
+ * request only; nothing in this file sends or stores them anywhere else.
+ */
+import { AsyncLocalStorage } from 'async_hooks';
+import type { CustomRuleState } from './custom-rules';
+import type { RaspInput } from './types';
+import type { VpRequest } from './vpatch';
+export type RaspContext = {
+    inputs: RaspInput[];
+    /** Parsed body and query trees (for nosql_injection). */
+    trees: unknown[];
+    inRequest: boolean;
+    method?: string;
+    path?: string;
+    /** The route template when the framework knows it. */
+    route?: string;
+    framework?: string;
+    /** The client address as the framework reports it (custom rules' `request.ip`). */
+    ip?: string;
+    /** Custom-rule state for this request (custom-rules.ts). */
+    rules?: CustomRuleState;
+    /** How many of `inputs` were known before the body (set when the body is captured): head rules see only these. */
+    headInputs?: number;
+    /** Virtual-patch state: the request as the rules see it. */
+    vp?: {
+        req: VpRequest;
+        bodyKnown: boolean;
+        ranHead: boolean;
+        ranBody: boolean;
+    };
+    /**
+     * Captures a body that a parser set after the middleware ran (Express or
+     * Koa with the body parser registered later). Called when a sink reads
+     * the inputs, until it reports the body was found (returns other than false).
+     */
+    late?: () => boolean | void;
+    /** SHIELD: set on the context the zero-code `http` capture (shield360/register) made. */
+    auto?: boolean;
+    /** SHIELD: deception already ran for this request (the zero-code capture runs it first), so middleware skips it. */
+    deception?: boolean;
+};
+export declare const storage: AsyncLocalStorage<RaspContext>;
+export declare function currentContext(): RaspContext | undefined;
+export declare function newContext(init?: Partial<RaspContext>): RaspContext;
+/**
+ * The context's inputs, after any late body capture. Sinks call this rather
+ * than reading `inputs` directly. A virtual patch matched by the late body
+ * throws the block error from here.
+ */
+export declare function inputsOf(ctx: RaspContext): RaspInput[];
+/** Runs fn in a fresh context that is not a request (a worker acting on a model's answer). */
+export declare function runInRaspScope<T>(fn: () => T): T;
+/** Runs fn with a context holding the given inputs (workers, tests). */
+export declare function runWithInputs<T>(inputs: RaspInput[], fn: () => T, extra?: Partial<RaspContext>): T;
+/** Route fallback: all-digit, UUID and hex (8+, with a digit) segments become `:id`. */
+export declare function routeOf(path: string): string;
+/**
+ * The route every event carries when the framework gave no template (README
+ * "Event route"): the route fallback, then every segment that is not a short
+ * lower-case word (or an API version such as `v2`) becomes `:id`, so a token,
+ * name or other value in the path never reaches an event.
+ */
+export declare function eventRouteOf(path: string): string;

package/dist/rasp/context.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.storage = void 0;
+exports.currentContext = currentContext;
+exports.newContext = newContext;
+exports.inputsOf = inputsOf;
+exports.runInRaspScope = runInRaspScope;
+exports.runWithInputs = runWithInputs;
+exports.routeOf = routeOf;
+exports.eventRouteOf = eventRouteOf;
+/**
+ * The RASP context of the request (or worker job) being served, kept in
+ * AsyncLocalStorage. Inputs live here, in memory, for the life of the
+ * request only; nothing in this file sends or stores them anywhere else.
+ */
+const async_hooks_1 = require("async_hooks");
+exports.storage = new async_hooks_1.AsyncLocalStorage();
+function currentContext() {
+    return exports.storage.getStore();
+}
+function newContext(init = {}) {
+    return { inputs: [], trees: [], inRequest: false, ...init };
+}
+/**
+ * The context's inputs, after any late body capture. Sinks call this rather
+ * than reading `inputs` directly. A virtual patch matched by the late body
+ * throws the block error from here.
+ */
+function inputsOf(ctx) {
+    const late = ctx.late;
+    if (late) {
+        ctx.late = undefined;
+        if (late() === false)
+            ctx.late = late;
+    }
+    return ctx.inputs;
+}
+/** Runs fn in a fresh context that is not a request (a worker acting on a model's answer). */
+function runInRaspScope(fn) {
+    return exports.storage.run(newContext(), fn);
+}
+/** Runs fn with a context holding the given inputs (workers, tests). */
+function runWithInputs(inputs, fn, extra = {}) {
+    return exports.storage.run(newContext({ inputs: [...inputs], ...extra }), fn);
+}
+const ID_SEGMENT = /^(\d+|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|(?=[0-9a-f]*\d)[0-9a-f]{8,})$/i;
+/** Route fallback: all-digit, UUID and hex (8+, with a digit) segments become `:id`. */
+function routeOf(path) {
+    return path
+        .split('?')[0]
+        .split('/')
+        .map((s) => (ID_SEGMENT.test(s) ? ':id' : s))
+        .join('/');
+}
+const KEPT_SEGMENT = /^(?:[a-z][a-z_.-]{0,15}|v\d{1,2})$/;
+/**
+ * The route every event carries when the framework gave no template (README
+ * "Event route"): the route fallback, then every segment that is not a short
+ * lower-case word (or an API version such as `v2`) becomes `:id`, so a token,
+ * name or other value in the path never reaches an event.
+ */
+function eventRouteOf(path) {
+    return routeOf(path)
+        .split('/')
+        .map((seg) => (seg === '' || seg === ':id' || KEPT_SEGMENT.test(seg) ? seg : ':id'))
+        .join('/');
+}
+//# sourceMappingURL=context.js.map

package/dist/rasp/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/rasp/context.ts"],"names":[],"mappings":";;;AA0CA,wCAEC;AAED,gCAEC;AAOD,4BAOC;AAGD,wCAEC;AAGD,sCAEC;AAKD,0BAMC;AAUD,oCAKC;AAlGD;;;;GAIG;AACH,6CAAgD;AAmCnC,QAAA,OAAO,GAAG,IAAI,+BAAiB,EAAe,CAAC;AAE5D,SAAgB,cAAc;IAC5B,OAAO,eAAO,CAAC,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,SAAgB,UAAU,CAAC,OAA6B,EAAE;IACxD,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAgB,QAAQ,CAAC,GAAgB;IACvC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,IAAI,EAAE,CAAC;QACT,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC;QACrB,IAAI,IAAI,EAAE,KAAK,KAAK;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,8FAA8F;AAC9F,SAAgB,cAAc,CAAI,EAAW;IAC3C,OAAO,eAAO,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,wEAAwE;AACxE,SAAgB,aAAa,CAAI,MAAmB,EAAE,EAAW,EAAE,QAA8B,EAAE;IACjG,OAAO,eAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,GAAG,mGAAmG,CAAC;AAEvH,wFAAwF;AACxF,SAAgB,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACb,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAE1D;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,IAAY;IACvC,OAAO,OAAO,CAAC,IAAI,CAAC;SACjB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;SACnF,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC"}

package/dist/rasp/custom-rules.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Custom rules (README "Custom rules"): the organization's own rules, written
+ * in the expression language of rule-expr.ts and delivered inside the signed
+ * config (`customRules`). They are data: each expression is parsed and
+ * type-checked when the config arrives and evaluated against the request (or
+ * a built-in finding) as a value. An invalid rule is skipped with one
+ * warning and never breaks the config; evaluation fails open.
+ *
+ * This file turns rules and the request context into the language's terms;
+ * the engine and capture decide what a match does.
+ */
+import { type RaspContext } from './context';
+import { type CompiledRuleExpr, type RuleBudget, type RuleSubject } from './rule-expr';
+import type { Finding, RaspInput, RaspMode } from './types';
+export declare const MAX_CUSTOM_RULES = 64;
+export declare const MAX_RULE_APPS = 32;
+/** Lower-case, so the event rule `custom.<id>` fits the platform's rule shape. */
+export declare const CUSTOM_RULE_ID: RegExp;
+export declare const CUSTOM_RULE_PREFIX = "custom.";
+export declare const CUSTOM_RULE_ACTIONS: readonly ["block", "monitor", "alert"];
+export type CustomRuleAction = (typeof CUSTOM_RULE_ACTIONS)[number];
+export type CustomRule = {
+    id: string;
+    name: string;
+    action: CustomRuleAction;
+    apps?: string[];
+    expr: CompiledRuleExpr;
+};
+export type SkippedRule = {
+    index: number;
+    id?: string;
+    reason: string;
+};
+/** Tests only: lets the once-per-rule warnings fire again. */
+export declare function resetCustomRuleWarnings(): void;
+/**
+ * The rules of a signed config that apply to this app: invalid rules are
+ * skipped (one warning per rule and reason, per process), disabled rules and
+ * rules scoped to other apps are left out silently. At most 64.
+ */
+export declare function parseCustomRules(raw: unknown, app: string, warn?: (s: SkippedRule) => void): CustomRule[];
+/** The most a rule does: `alert` reports like `monitor` (the platform raises the alert). */
+export declare function actionMode(a: CustomRuleAction): RaspMode;
+/** The finding a matched rule reports (attack type `custom_rule`, rule `custom.<id>`). */
+export declare function customFinding(rule: CustomRule, input?: RaspInput): Finding;
+/** The request as the language sees it (README "Custom rules: fields"). */
+export declare function requestSubject(ctx: RaspContext | undefined, app: string, inputs?: RaspInput[]): RuleSubject;
+/** Per-request evaluation state, kept on the context. */
+export type CustomRuleState = {
+    matched: Set<string>;
+    budget: RuleBudget;
+    ranHead: boolean;
+    ranBody: boolean;
+};
+export declare function ruleState(ctx: RaspContext): CustomRuleState;
+export type RuleMatch = {
+    rule: CustomRule;
+    input?: RaspInput;
+};
+/**
+ * The request rules to judge in a phase, matched in order. `head`: every
+ * request rule that does not read the body. `body`: rules that read the body,
+ * and rules reading `input.*` that did not match at `head` (the body added
+ * inputs). A rule matches at most once per request.
+ */
+export declare function matchRequestRules(rules: CustomRule[], ctx: RaspContext, phase: 'head' | 'body', subject: RuleSubject): RuleMatch[];
+/** The finding rules a built-in finding matches, in order. */
+export declare function matchFindingRules(rules: CustomRule[], subject: RuleSubject, budget: RuleBudget): RuleMatch[];