squidcloudctl 1.3.0 → 3.0.1

package/dist/lib/crypto/encrypt-file.js

@@ -0,0 +1,64 @@
+import { gcm } from '@noble/ciphers/aes.js';
+import { randomBytes } from '@noble/hashes/utils.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex } from './ssp.js';
+function deriveRawKey(key) {
+    return new TextEncoder().encode(key.slice(0, 32).padEnd(32, '0'));
+}
+function uint8ArrayToBase64(bytes) {
+    return Buffer.from(bytes).toString('base64');
+}
+function base64ToUint8Array(b64) {
+    return new Uint8Array(Buffer.from(b64, 'base64'));
+}
+function generateEncryptionKey() {
+    return Buffer.from(randomBytes(32)).toString('hex');
+}
+const CHUNK_SIZE_SMALL = 1.5 * 1024 * 1024;
+const CHUNK_SIZE_MEDIUM = 2 * 1024 * 1024;
+const CHUNK_SIZE_LARGE = 2.5 * 1024 * 1024;
+function determineChunkSize(fileSize) {
+    if (fileSize > 100 * 1024 * 1024)
+        return CHUNK_SIZE_LARGE;
+    if (fileSize > 10 * 1024 * 1024)
+        return CHUNK_SIZE_MEDIUM;
+    return CHUNK_SIZE_SMALL;
+}
+export function encryptFile(data, fileName, fileType, encryptionKey) {
+    const key = encryptionKey || generateEncryptionKey();
+    const keyBytes = deriveRawKey(key);
+    const chunkSize = determineChunkSize(data.length);
+    const totalChunks = Math.ceil(data.length / chunkSize);
+    const chunks = [];
+    const timestamp = Date.now();
+    for (let i = 0; i < totalChunks; i++) {
+        const offset = i * chunkSize;
+        const end = Math.min(offset + chunkSize, data.length);
+        const plaintext = data.subarray(offset, end);
+        const iv = randomBytes(12);
+        const ad = new TextEncoder().encode(`res54-v2-${timestamp}`);
+        const aes = gcm(keyBytes, iv, ad);
+        const encrypted = aes.encrypt(plaintext);
+        const combined = new Uint8Array(4 + ad.length + iv.length + encrypted.length);
+        const view = new DataView(combined.buffer, 0, 4);
+        view.setUint32(0, ad.length, true);
+        combined.set(ad, 4);
+        combined.set(iv, 4 + ad.length);
+        combined.set(encrypted, 4 + ad.length + iv.length);
+        chunks.push({
+            index: i,
+            totalChunks,
+            size: plaintext.length,
+            offset,
+            sha256: bytesToHex(sha256(plaintext)),
+            encryptedBase64: uint8ArrayToBase64(combined),
+        });
+    }
+    return {
+        encryptionKey: key,
+        fileName,
+        fileType,
+        fileSize: data.length,
+        chunks,
+    };
+}

package/dist/lib/crypto/index.js

@@ -1,2 +1,2 @@
-export{m as bytesToHex,d as computeDeviceFingerprint,l as computeHMAC,e as computeSignPayload,i as decryptSession,g as deriveEncryptionKey,f as deriveSharedSecret,h as encryptSession,a as generateKeypair,b as generateNonce,c as hashPassword,n as hexToBytes,k as signPayload,j as verifyServerSignature}from'../../chunk-6VDGYAGT.js';var m=/[\u001b\u009b][[\]()#;?]*(?:(?:(?:;[0-9a-fA-F]{1,4})*(?:;[0-9a-fA-F]{0,4})?)?[0-9A-PRZcf-nq-uy=><~])/g;function x(e){return e.replace(m,"")}function v(e){return e.replace(/[<>:"/\\|?*\x00-\x1f]/g,"_").trim()}function z(e){e.fill(0);}function A(e){if(typeof e=="string"){let r=e.length;e.valueOf=()=>"";for(let n=0;n<r;n++)e=(e[n]===e[n].charAt(0),"");}}export{v as sanitizeFilename,x as sanitizeForTerminal,z as zeroBuffer,A as zeroString};//# sourceMappingURL=index.js.map
-//# sourceMappingURL=index.js.map
+export { sanitizeForTerminal, sanitizeFilename, zeroBuffer, zeroString } from './sanitize.js';
+export { generateKeypair, generateNonce, hashPassword, computeDeviceFingerprint, computeSignPayload, deriveSharedSecret, deriveEncryptionKey, encryptSession, decryptSession, verifyServerSignature, signPayload, computeHMAC, bytesToHex, hexToBytes, } from './ssp.js';

package/dist/lib/crypto/sanitize.js

@@ -0,0 +1,19 @@
+const ANSI_PATTERN = /[\u001b\u009b][[\]()#;?]*(?:(?:(?:;[0-9a-fA-F]{1,4})*(?:;[0-9a-fA-F]{0,4})?)?[0-9A-PRZcf-nq-uy=><~])/g;
+export function sanitizeForTerminal(input) {
+    return input.replace(ANSI_PATTERN, '');
+}
+export function sanitizeFilename(input) {
+    return input.replace(/[<>:"/\\|?*\x00-\x1f]/g, '_').trim();
+}
+export function zeroBuffer(buf) {
+    buf.fill(0);
+}
+export function zeroString(str) {
+    if (typeof str === 'string') {
+        const len = str.length;
+        str.valueOf = () => '';
+        for (let i = 0; i < len; i++) {
+            str = str[i] === str[i].charAt(0) ? '' : '';
+        }
+    }
+}

package/dist/lib/crypto/ssp.js

@@ -0,0 +1,80 @@
+import { getPublicKey, sign, verify, etc, utils as edUtils } from '@noble/ed25519';
+import { x25519 } from '@noble/curves/ed25519.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { sha512 } from '@noble/hashes/sha2.js';
+import { hmac } from '@noble/hashes/hmac.js';
+import { hkdf } from '@noble/hashes/hkdf.js';
+import { blake3 } from '@noble/hashes/blake3.js';
+import { randomBytes, concatBytes } from '@noble/hashes/utils.js';
+import { gcm } from '@noble/ciphers/aes.js';
+import { pbkdf2Sync } from 'node:crypto';
+import { hostname, platform, arch } from 'node:os';
+etc.sha512Sync = (...msgs) => sha512(concatBytes(...msgs));
+const HKDF_INFO = 'squidcloud-session-v1';
+export function generateKeypair() {
+    const priv = edUtils.randomPrivateKey();
+    const pub = getPublicKey(priv);
+    return { pub, priv };
+}
+export function generateNonce() {
+    return randomBytes(32);
+}
+export function hashPassword(password, email) {
+    const salt = Buffer.from(email.slice(0, 32).padEnd(32, '\x00'));
+    return pbkdf2Sync(password, salt, 100000, 32, 'sha512');
+}
+export function computeDeviceFingerprint(machineId) {
+    const data = `${machineId}:${hostname()}:${platform()}:${arch()}`;
+    return Buffer.from(blake3(new TextEncoder().encode(data))).toString('hex');
+}
+export function computeSignPayload(clientNonce, serverNonce, clientPub, timestamp) {
+    const payload = new Uint8Array(clientNonce.length + serverNonce.length + clientPub.length + 8);
+    payload.set(clientNonce, 0);
+    payload.set(serverNonce, clientNonce.length);
+    payload.set(clientPub, clientNonce.length + serverNonce.length);
+    const tsBuf = new Uint8Array(8);
+    new DataView(tsBuf.buffer).setBigUint64(0, BigInt(timestamp), false);
+    payload.set(tsBuf, clientNonce.length + serverNonce.length + clientPub.length);
+    return blake3(payload);
+}
+export function deriveSharedSecret(pub, priv) {
+    return x25519.getSharedSecret(priv, pub);
+}
+export function deriveEncryptionKey(ecdhSecret, clientNonce, serverNonce) {
+    const salt = new Uint8Array(clientNonce.length + serverNonce.length);
+    salt.set(clientNonce, 0);
+    salt.set(serverNonce, clientNonce.length);
+    return hkdf(sha256, ecdhSecret, salt, new TextEncoder().encode(HKDF_INFO), 32);
+}
+export function encryptSession(session, key) {
+    const iv = randomBytes(12);
+    const plaintext = new TextEncoder().encode(JSON.stringify(session));
+    const aes = gcm(key, iv);
+    const encrypted = aes.encrypt(plaintext);
+    const ciphertext = encrypted.slice(0, -16);
+    const tag = encrypted.slice(-16);
+    return { ciphertext, iv, tag };
+}
+export function decryptSession(encrypted, iv, tag, key) {
+    const combined = new Uint8Array(encrypted.length + tag.length);
+    combined.set(encrypted, 0);
+    combined.set(tag, encrypted.length);
+    const aes = gcm(key, iv);
+    const plaintext = aes.decrypt(combined);
+    return JSON.parse(new TextDecoder().decode(plaintext));
+}
+export function verifyServerSignature(signature, payload, serverPub) {
+    return verify(signature, payload, serverPub);
+}
+export function signPayload(priv, payload) {
+    return sign(payload, priv);
+}
+export function computeHMAC(key, data) {
+    return Buffer.from(hmac(sha256, key, new TextEncoder().encode(data))).toString('hex');
+}
+export function bytesToHex(buf) {
+    return Buffer.from(buf).toString('hex');
+}
+export function hexToBytes(hex) {
+    return new Uint8Array(Buffer.from(hex, 'hex'));
+}

package/dist/lib/deploy/allowlist.js

@@ -0,0 +1,16 @@
+const ALLOWED_EXTENSIONS = new Set([
+    '.html', '.css', '.js', '.mjs', '.json', '.svg',
+    '.png', '.jpg', '.jpeg', '.gif', '.webp', '.avif', '.ico',
+    '.woff', '.woff2', '.ttf', '.otf', '.eot',
+    '.mp4', '.webm', '.ogg', '.mp3', '.wav',
+    '.pdf', '.txt', '.xml', '.map',
+]);
+export function isAllowedFile(filePath) {
+    const ext = filePath.toLowerCase().slice(filePath.lastIndexOf('.'));
+    if (!ext)
+        return false;
+    return ALLOWED_EXTENSIONS.has(ext);
+}
+export function getAllowedExtensions() {
+    return [...ALLOWED_EXTENSIONS];
+}

package/dist/lib/deploy/detector.js

@@ -0,0 +1,53 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export async function detectProject(targetPath) {
+    const resolved = path.resolve(targetPath);
+    const stat = fs.statSync(resolved);
+    if (stat.isFile()) {
+        const ext = path.extname(resolved).toLowerCase();
+        if (ext === '.html') {
+            return {
+                type: 'single-file',
+                rootPath: resolved,
+                hasIndexHtml: true,
+                htmlFiles: [resolved],
+                totalFiles: 1,
+            };
+        }
+        return { type: 'invalid', rootPath: resolved, hasIndexHtml: false, htmlFiles: [], totalFiles: 0 };
+    }
+    if (stat.isDirectory()) {
+        const htmlFiles = [];
+        let totalFiles = 0;
+        function walk(dir) {
+            const entries = fs.readdirSync(dir, { withFileTypes: true });
+            for (const entry of entries) {
+                const fullPath = path.join(dir, entry.name);
+                if (entry.isDirectory()) {
+                    if (!entry.name.startsWith('.') && entry.name !== 'node_modules') {
+                        walk(fullPath);
+                    }
+                }
+                else if (entry.isFile()) {
+                    totalFiles++;
+                    if (entry.name.endsWith('.html')) {
+                        htmlFiles.push(fullPath);
+                    }
+                }
+            }
+        }
+        walk(resolved);
+        if (htmlFiles.length === 0) {
+            return { type: 'invalid', rootPath: resolved, hasIndexHtml: false, htmlFiles: [], totalFiles };
+        }
+        const hasIndexHtml = htmlFiles.some(f => path.basename(f).toLowerCase() === 'index.html');
+        return {
+            type: 'codebase',
+            rootPath: resolved,
+            hasIndexHtml,
+            htmlFiles,
+            totalFiles,
+        };
+    }
+    return { type: 'invalid', rootPath: resolved, hasIndexHtml: false, htmlFiles: [], totalFiles: 0 };
+}

package/dist/lib/deploy/index.js

@@ -1,2 +1,2 @@
-export{a as detectProject}from'../../chunk-NKPRDJXY.js';export{b as getAllowedExtensions,a as isAllowedFile}from'../../chunk-F6Z2OAHW.js';//# sourceMappingURL=index.js.map
-//# sourceMappingURL=index.js.map
+export { isAllowedFile, getAllowedExtensions } from './allowlist.js';
+export { detectProject } from './detector.js';

package/dist/lib/deploy/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}
+{"version":3,"sources":["../../../src/lib/deploy/allowlist.ts","../../../src/lib/deploy/detector.ts"],"names":["ALLOWED_EXTENSIONS","isAllowedFile","filePath","ext","getAllowedExtensions","detectProject","targetPath","resolved","path","stat","fs","walk","dir","entries","entry","fullPath","totalFiles","htmlFiles","hasIndexHtml","f"],"mappings":"sCAAA,IAAMA,CAAAA,CAAqB,IAAI,GAAA,CAAI,CACjC,OAAA,CAAS,MAAA,CAAQ,KAAA,CAAO,MAAA,CAAQ,OAAA,CAAS,MAAA,CACzC,MAAA,CAAQ,MAAA,CAAQ,OAAA,CAAS,MAAA,CAAQ,OAAA,CAAS,OAAA,CAAS,MAAA,CACnD,OAAA,CAAS,QAAA,CAAU,MAAA,CAAQ,MAAA,CAAQ,MAAA,CACnC,MAAA,CAAQ,OAAA,CAAS,MAAA,CAAQ,MAAA,CAAQ,MAAA,CACjC,MAAA,CAAQ,MAAA,CAAQ,MAAA,CAAQ,MAC1B,CAAC,CAAA,CAEM,SAASC,CAAAA,CAAcC,CAAAA,CAA2B,CACvD,IAAMC,CAAAA,CAAMD,CAAAA,CAAS,WAAA,EAAY,CAAE,KAAA,CAAMA,CAAAA,CAAS,WAAA,CAAY,GAAG,CAAC,CAAA,CAClE,OAAKC,CAAAA,CACEH,CAAAA,CAAmB,GAAA,CAAIG,CAAG,CAAA,CADhB,KAEnB,CAEO,SAASC,CAAAA,EAAiC,CAC/C,OAAO,CAAC,GAAGJ,CAAkB,CAC/B,CCHA,eAAsBK,CAAAA,CAAcC,CAAAA,CAA8C,CAChF,IAAMC,CAAAA,CAAWC,CAAAA,CAAK,OAAA,CAAQF,CAAU,CAAA,CAClCG,CAAAA,CAAOC,CAAAA,CAAG,QAAA,CAASH,CAAQ,CAAA,CAEjC,GAAIE,CAAAA,CAAK,MAAA,EAAO,CAEd,OADYD,CAAAA,CAAK,OAAA,CAAQD,CAAQ,CAAA,CAAE,WAAA,EAAY,GACnC,OAAA,CACH,CACL,IAAA,CAAM,aAAA,CACN,QAAA,CAAUA,CAAAA,CACV,YAAA,CAAc,IAAA,CACd,SAAA,CAAW,CAACA,CAAQ,CAAA,CACpB,UAAA,CAAY,CACd,CAAA,CAEK,CAAE,IAAA,CAAM,SAAA,CAAW,QAAA,CAAUA,CAAAA,CAAU,YAAA,CAAc,KAAA,CAAO,SAAA,CAAW,EAAC,CAAG,UAAA,CAAY,CAAE,CAAA,CAGlG,GAAIE,CAAAA,CAAK,WAAA,EAAY,CAAG,CAItB,IAASE,CAAAA,CAAT,SAAcC,CAAAA,CAAmB,CAC/B,IAAMC,CAAAA,CAAUH,CAAAA,CAAG,WAAA,CAAYE,CAAAA,CAAK,CAAE,aAAA,CAAe,IAAK,CAAC,CAAA,CAC3D,IAAA,IAAWE,CAAAA,IAASD,CAAAA,CAAS,CAC3B,IAAME,CAAAA,CAAWP,CAAAA,CAAK,IAAA,CAAKI,CAAAA,CAAKE,CAAAA,CAAM,IAAI,CAAA,CACtCA,CAAAA,CAAM,WAAA,EAAY,CAChB,CAACA,CAAAA,CAAM,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAKA,CAAAA,CAAM,IAAA,GAAS,cAAA,EAChDH,CAAAA,CAAKI,CAAQ,CAAA,CAEND,CAAAA,CAAM,MAAA,EAAO,GACtBE,CAAAA,EAAAA,CACIF,CAAAA,CAAM,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA,EAC7BG,CAAAA,CAAU,IAAA,CAAKF,CAAQ,CAAA,EAG7B,CACF,CAAA,CAlBME,CAAAA,CAAsB,EAAC,CACzBD,CAAAA,CAAa,CAAA,CAqBjB,GAFAL,CAAAA,CAAKJ,CAAQ,CAAA,CAETU,CAAAA,CAAU,MAAA,GAAW,CAAA,CACvB,OAAO,CAAE,IAAA,CAAM,SAAA,CAAW,QAAA,CAAUV,CAAAA,CAAU,YAAA,CAAc,KAAA,CAAO,SAAA,CAAW,EAAC,CAAG,UAAA,CAAAS,CAAW,CAAA,CAG/F,IAAME,CAAAA,CAAeD,CAAAA,CAAU,IAAA,CAAKE,CAAAA,EAAKX,CAAAA,CAAK,QAAA,CAASW,CAAC,CAAA,CAAE,WAAA,EAAY,GAAM,YAAY,CAAA,CAExF,OAAO,CACL,IAAA,CAAM,UAAA,CACN,QAAA,CAAUZ,CAAAA,CACV,YAAA,CAAAW,CAAAA,CACA,SAAA,CAAAD,CAAAA,CACA,UAAA,CAAAD,CACF,CACF,CAEA,OAAO,CAAE,IAAA,CAAM,SAAA,CAAW,QAAA,CAAUT,CAAAA,CAAU,YAAA,CAAc,KAAA,CAAO,SAAA,CAAW,EAAC,CAAG,UAAA,CAAY,CAAE,CAClG","file":"index.js","sourcesContent":["const ALLOWED_EXTENSIONS = new Set([\n  '.html', '.css', '.js', '.mjs', '.json', '.svg',\n  '.png', '.jpg', '.jpeg', '.gif', '.webp', '.avif', '.ico',\n  '.woff', '.woff2', '.ttf', '.otf', '.eot',\n  '.mp4', '.webm', '.ogg', '.mp3', '.wav',\n  '.pdf', '.txt', '.xml', '.map',\n])\n\nexport function isAllowedFile(filePath: string): boolean {\n  const ext = filePath.toLowerCase().slice(filePath.lastIndexOf('.'))\n  if (!ext) return false\n  return ALLOWED_EXTENSIONS.has(ext)\n}\n\nexport function getAllowedExtensions(): string[] {\n  return [...ALLOWED_EXTENSIONS]\n}\n","import fs from 'node:fs'\nimport path from 'node:path'\n\nexport type DeployType = 'single-file' | 'codebase' | 'invalid'\n\nexport interface DetectedProject {\n  type: DeployType\n  rootPath: string\n  hasIndexHtml: boolean\n  htmlFiles: string[]\n  totalFiles: number\n}\n\nexport async function detectProject(targetPath: string): Promise<DetectedProject> {\n  const resolved = path.resolve(targetPath)\n  const stat = fs.statSync(resolved)\n\n  if (stat.isFile()) {\n    const ext = path.extname(resolved).toLowerCase()\n    if (ext === '.html') {\n      return {\n        type: 'single-file',\n        rootPath: resolved,\n        hasIndexHtml: true,\n        htmlFiles: [resolved],\n        totalFiles: 1,\n      }\n    }\n    return { type: 'invalid', rootPath: resolved, hasIndexHtml: false, htmlFiles: [], totalFiles: 0 }\n  }\n\n  if (stat.isDirectory()) {\n    const htmlFiles: string[] = []\n    let totalFiles = 0\n\n    function walk(dir: string): void {\n      const entries = fs.readdirSync(dir, { withFileTypes: true })\n      for (const entry of entries) {\n        const fullPath = path.join(dir, entry.name)\n        if (entry.isDirectory()) {\n          if (!entry.name.startsWith('.') && entry.name !== 'node_modules') {\n            walk(fullPath)\n          }\n        } else if (entry.isFile()) {\n          totalFiles++\n          if (entry.name.endsWith('.html')) {\n            htmlFiles.push(fullPath)\n          }\n        }\n      }\n    }\n\n    walk(resolved)\n\n    if (htmlFiles.length === 0) {\n      return { type: 'invalid', rootPath: resolved, hasIndexHtml: false, htmlFiles: [], totalFiles }\n    }\n\n    const hasIndexHtml = htmlFiles.some(f => path.basename(f).toLowerCase() === 'index.html')\n\n    return {\n      type: 'codebase',\n      rootPath: resolved,\n      hasIndexHtml,\n      htmlFiles,\n      totalFiles,\n    }\n  }\n\n  return { type: 'invalid', rootPath: resolved, hasIndexHtml: false, htmlFiles: [], totalFiles: 0 }\n}\n"]}

package/dist/lib/forms/index.js

@@ -0,0 +1 @@
+export default {};

package/dist/lib/host/microredis.js

@@ -0,0 +1,191 @@
+import net from 'node:net';
+export class MicroRedis {
+    store = new Map();
+    server = null;
+    get(key) {
+        const e = this.store.get(key);
+        if (!e)
+            return null;
+        if (e.expiresAt && e.expiresAt <= Date.now()) {
+            this.store.delete(key);
+            return null;
+        }
+        return e.value;
+    }
+    set(key, value, ttlMs) {
+        this.store.set(key, { value, expiresAt: ttlMs ? Date.now() + ttlMs : undefined });
+    }
+    setNx(key, value, ttlMs) {
+        if (this.get(key) !== null)
+            return false;
+        this.set(key, value, ttlMs);
+        return true;
+    }
+    del(...keys) {
+        let n = 0;
+        for (const k of keys)
+            if (this.store.delete(k))
+                n++;
+        return n;
+    }
+    incr(key) {
+        const v = Number(this.get(key) ?? '0') + 1;
+        this.set(key, String(v));
+        return v;
+    }
+    expire(key, ttlMs) {
+        const e = this.store.get(key);
+        if (!e)
+            return false;
+        e.expiresAt = Date.now() + ttlMs;
+        return true;
+    }
+    ttl(key) {
+        const e = this.store.get(key);
+        if (!e)
+            return -2;
+        if (!e.expiresAt)
+            return -1;
+        return Math.max(0, Math.ceil((e.expiresAt - Date.now()) / 1000));
+    }
+    keys(pattern) {
+        const re = new RegExp('^' + pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*').replace(/\?/g, '.') + '$');
+        return [...this.store.keys()].filter((k) => re.test(k));
+    }
+    flushAll() {
+        this.store.clear();
+    }
+    /* ── programmatic helpers used by the security layer ── */
+    hitRate(bucket, limit, windowMs) {
+        const now = Date.now();
+        const winKey = `${bucket}:${Math.floor(now / windowMs)}`;
+        const count = this.incr(winKey);
+        this.expire(winKey, windowMs);
+        return {
+            ok: count <= limit,
+            remaining: Math.max(0, limit - count),
+            resetSec: Math.ceil((windowMs - (now % windowMs)) / 1000),
+        };
+    }
+    /** Replay guard: true on first sight of the nonce within its TTL. */
+    seenNonce(nonce, ttlMs) {
+        return this.setNx(`nonce:${nonce}`, '1', ttlMs);
+    }
+    sweep() {
+        const now = Date.now();
+        for (const [k, e] of this.store)
+            if (e.expiresAt && e.expiresAt <= now)
+                this.store.delete(k);
+    }
+    size() {
+        return this.store.size;
+    }
+    /* ── RESP server ── */
+    listen(port, host = '127.0.0.1') {
+        return new Promise((resolve, reject) => {
+            const server = net.createServer((socket) => {
+                let buf = '';
+                let respMode = null;
+                const flushLine = (line) => {
+                    if (respMode?.active) {
+                        // RESP bulk-string lines arrive as "$len" then payload
+                        if (line.startsWith('$'))
+                            return;
+                        respMode.parts.push(line);
+                        if (respMode.parts.length >= respMode.count) {
+                            try {
+                                socket.write(this.executeArray(respMode.parts));
+                            }
+                            catch {
+                                socket.write('-ERR internal\r\n');
+                            }
+                            respMode = null;
+                        }
+                        return;
+                    }
+                    if (line.startsWith('*')) {
+                        const n = Number(line.slice(1));
+                        if (!Number.isNaN(n)) {
+                            respMode = { active: true, count: n, parts: [] };
+                            // A RESP array of N elements has N "$len" header lines we skip,
+                            // so total scanned lines is handled lazily above.
+                            return;
+                        }
+                    }
+                    if (line.trim().length === 0)
+                        return;
+                    try {
+                        socket.write(this.executeInline(line));
+                    }
+                    catch {
+                        socket.write('-ERR internal\r\n');
+                    }
+                };
+                socket.on('data', (chunk) => {
+                    buf += chunk.toString('utf8');
+                    let idx;
+                    while ((idx = buf.indexOf('\r\n')) !== -1) {
+                        const line = buf.slice(0, idx);
+                        buf = buf.slice(idx + 2);
+                        flushLine(line);
+                    }
+                });
+            });
+            server.on('error', reject);
+            server.listen(port, host, () => {
+                this.server = server;
+                resolve(port);
+            });
+        });
+    }
+    close() {
+        this.server?.close();
+        this.server = null;
+    }
+    /** Inline protocol: "CMD arg arg" */
+    executeInline(raw) {
+        return this.run(raw.trim().split(/\s+/));
+    }
+    /** RESP array (values only, bulk headers already stripped). */
+    executeArray(parts) {
+        return this.run(parts.map(String));
+    }
+    run(parts) {
+        if (!parts || parts.length === 0)
+            return '-ERR empty\r\n';
+        const cmd = (parts[0] || '').toUpperCase();
+        const args = parts.slice(1).map(String);
+        switch (cmd) {
+            case 'PING': return '+PONG\r\n';
+            case 'ECHO': return `$${args[0]?.length ?? 0}\r\n${args[0] ?? ''}\r\n`;
+            case 'SET':
+                if (args.length < 2)
+                    return '-ERR wrong arity\r\n';
+                this.set(args[0], args.slice(1).join(' '));
+                return '+OK\r\n';
+            case 'GET': {
+                const v = this.get(args[0]);
+                return v === null ? '$-1\r\n' : `$${Buffer.byteLength(v)}\r\n${v}\r\n`;
+            }
+            case 'DEL': return `:${this.del(...args)}\r\n`;
+            case 'INCR': return `:${this.incr(args[0])}\r\n`;
+            case 'EXPIRE': {
+                const ok = this.expire(args[0], Number(args[1]) * 1000);
+                return ok ? ':1\r\n' : ':0\r\n';
+            }
+            case 'TTL': return `:${this.ttl(args[0])}\r\n`;
+            case 'KEYS': {
+                const ks = this.keys(args[0] ?? '*');
+                let out = `*${ks.length}\r\n`;
+                for (const k of ks)
+                    out += `$${k.length}\r\n${k}\r\n`;
+                return out;
+            }
+            case 'DBSIZE': return `:${this.size()}\r\n`;
+            case 'FLUSHALL':
+                this.flushAll();
+                return '+OK\r\n';
+            default: return `-ERR unknown command '${cmd}'\r\n`;
+        }
+    }
+}

package/dist/lib/host/security.js

@@ -0,0 +1,142 @@
+import crypto from 'node:crypto';
+const PROFILES = {
+    standard: {
+        requireKey: false, requireHmac: false, requireTimestamp: false,
+        maxBodyBytes: 512 * 1024 * 1024, rpsPerKey: 50, burstPerKey: 100,
+        allowIps: ['127.0.0.1', '::1'], nonceTtlMs: 60_000,
+        lockoutThreshold: 25, lockoutMs: 60_000, cacheTtlMs: 5_000,
+    },
+    hardened: {
+        requireKey: true, requireHmac: false, requireTimestamp: true,
+        maxBodyBytes: 512 * 1024 * 1024, rpsPerKey: 120, burstPerKey: 240,
+        allowIps: ['127.0.0.1', '::1'], nonceTtlMs: 300_000,
+        lockoutThreshold: 10, lockoutMs: 300_000, cacheTtlMs: 15_000,
+    },
+    paranoid: {
+        requireKey: true, requireHmac: true, requireTimestamp: true,
+        maxBodyBytes: 64 * 1024 * 1024, rpsPerKey: 200, burstPerKey: 400,
+        allowIps: ['127.0.0.1', '::1'], nonceTtlMs: 600_000,
+        lockoutThreshold: 3, lockoutMs: 900_000, cacheTtlMs: 30_000,
+    },
+};
+export function resolveProfile(profileName, overrides = {}) {
+    const base = PROFILES[profileName in PROFILES ? profileName : 'standard'];
+    const cfg = {
+        profile: profileName in PROFILES ? profileName : 'standard',
+        ...base,
+    };
+    if (overrides.mode === 'open')
+        cfg.requireKey = false;
+    if (overrides.mode === 'keyed')
+        cfg.requireKey = true;
+    if (overrides.hmac)
+        cfg.requireHmac = true;
+    if (overrides.rps)
+        cfg.rpsPerKey = overrides.rps;
+    if (overrides.maxBody) {
+        const m = overrides.maxBody.match(/^(\d+)([kmg]?)b?$/i);
+        if (m) {
+            const mult = m[2]?.toLowerCase() === 'g' ? 1024 ** 3 : m[2]?.toLowerCase() === 'm' ? 1024 ** 2 : m[2]?.toLowerCase() === 'k' ? 1024 : 1;
+            cfg.maxBodyBytes = Number(m[1]) * mult;
+        }
+    }
+    if (overrides.ips && overrides.ips.length > 0)
+        cfg.allowIps = overrides.ips;
+    return cfg;
+}
+/** Local API keys — sk_live-…, stored hashed inside MicroRedis. */
+export function generateApiKey() {
+    const raw = crypto.randomBytes(24).toString('hex');
+    const key = `sk_local-${raw}`;
+    return { key, hash: sha256(key), prefix: key.slice(0, 14) };
+}
+export function sha256(input) {
+    return crypto.createHash('sha256').update(input).digest('hex');
+}
+export function hmacSignature(secret, method, path, timestamp, bodyHash) {
+    return crypto.createHmac('sha256', secret).update(`${method.toUpperCase()}|${path}|${timestamp}|${bodyHash}`).digest('hex');
+}
+export function authenticateRequest(req, cfg, redis, bodyBuffer) {
+    const ip = normalizeIp(req.socket.remoteAddress);
+    // IP pinning — loopback unless explicitly widened.
+    if (!cfg.allowIps.some((a) => a === '*' || a === ip)) {
+        return { ok: false, status: 403, error: `IP ${ip} is not allowed by this profile` };
+    }
+    const hdr = (n) => {
+        const v = req.headers[n];
+        return Array.isArray(v) ? v[0] ?? '' : v ?? '';
+    };
+    const authHeader = hdr('authorization');
+    let keyId = 'anonymous';
+    if (cfg.requireKey) {
+        const token = authHeader.replace(/^Bearer\s+/i, '');
+        if (!token.startsWith('sk_local-')) {
+            return { ok: false, status: 401, error: 'Missing or malformed local key (expected: Authorization: Bearer sk_local-…)' };
+        }
+        const hash = sha256(token);
+        if (!redis.get(`key:${hash}`)) {
+            // Brute-force lockout per IP.
+            const fails = redis.incr(`fail:${ip}`);
+            redis.expire(`fail:${ip}`, cfg.lockoutMs);
+            if (fails >= cfg.lockoutThreshold) {
+                redis.set(`lock:${ip}`, '1', cfg.lockoutMs);
+            }
+            return { ok: false, status: 401, error: 'Invalid local key' };
+        }
+        if (redis.get(`lock:${ip}`)) {
+            return { ok: false, status: 429, error: 'Locked out — too many invalid keys from this IP' };
+        }
+        keyId = redis.get(`key:${hash}`) || 'local';
+        // Per-key rate bucket.
+        const bucket = `rate:${hash}`;
+        const win = Math.max(1, cfg.burstPerKey > cfg.rpsPerKey ? 1000 : 1000);
+        const rate = redis.hitRate(bucket, cfg.rpsPerKey * (win / 1000), win);
+        if (!rate.ok) {
+            return { ok: false, status: 429, error: `Local rate limit exceeded (${cfg.rpsPerKey} req/s/key)` };
+        }
+    }
+    else {
+        // Open mode still gets an anonymous bucket so one runaway client cannot
+        // hammer SquidCloud through the host.
+        const rate = redis.hitRate(`anon:${ip}`, cfg.rpsPerKey, 1000);
+        if (!rate.ok)
+            return { ok: false, status: 429, error: `Rate limit exceeded (${cfg.rpsPerKey} req/s)` };
+    }
+    // Timestamp + replay guard.
+    if (cfg.requireTimestamp) {
+        const ts = Number(hdr('x-timestamp'));
+        if (!ts || Math.abs(Date.now() - ts) > 60_000) {
+            return { ok: false, status: 401, error: 'Missing/stale X-Timestamp (±60s window)' };
+        }
+        const nonce = hdr('x-nonce') || `${ts}:${bodyHashOf(bodyBuffer)}`;
+        if (!redis.seenNonce(nonce, cfg.nonceTtlMs)) {
+            return { ok: false, status: 409, error: 'Replayed request (nonce already seen)' };
+        }
+    }
+    // HMAC request signing (paranoid / opt-in).
+    if (cfg.requireHmac) {
+        const secret = process.env.SQUIDCLOUD_HOST_HMAC_SECRET || redis.get('host:hmac-secret') || '';
+        if (!secret)
+            return { ok: false, status: 500, error: 'HMAC required but no secret configured (--hmac-secret)' };
+        const sig = hdr('x-signature');
+        const ts = hdr('x-timestamp') || String(Date.now());
+        const expected = hmacSignature(secret, req.method || '', (req.url || '/').split('?')[0], ts, bodyHashOf(bodyBuffer));
+        if (!sig || !safeEqual(sig, expected)) {
+            return { ok: false, status: 401, error: 'Invalid X-Signature' };
+        }
+    }
+    return { ok: true, keyId };
+}
+function bodyHashOf(buf) {
+    return buf && buf.length > 0 ? crypto.createHash('sha256').update(buf).digest('hex') : 'empty';
+}
+function safeEqual(a, b) {
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    return ab.length === bb.length && crypto.timingSafeEqual(ab, bb);
+}
+function normalizeIp(ip) {
+    if (!ip)
+        return '';
+    return ip.replace(/^::ffff:/, '');
+}