ysk-server-core 1.0.0

package/dist/hosting/real-ip/providers.js

@@ -0,0 +1,237 @@
+/**
+ * CDN / edge provider catalog + bundled CIDR snapshots.
+ * Snapshots are best-effort; use refresh() for up-to-date lists.
+ */
+/** Cloudflare IPv4 (snapshot; matches prior YSK hardcode + common ranges). */
+const CF_V4 = [
+    '173.245.48.0/20',
+    '103.21.244.0/22',
+    '103.22.200.0/22',
+    '103.31.4.0/22',
+    '141.101.64.0/18',
+    '108.162.192.0/18',
+    '190.93.240.0/20',
+    '188.114.96.0/20',
+    '197.234.240.0/22',
+    '198.41.128.0/17',
+    '162.158.0.0/15',
+    '104.16.0.0/13',
+    '104.24.0.0/14',
+    '172.64.0.0/13',
+    '131.0.72.0/22',
+];
+const CF_V6 = [
+    '2400:cb00::/32',
+    '2606:4700::/32',
+    '2803:f800::/32',
+    '2405:b500::/32',
+    '2405:8100::/32',
+    '2a06:98c0::/29',
+    '2c0f:f248::/32',
+];
+/** Fastly public IP ranges (snapshot sample — refresh for full list). */
+const FASTLY_V4 = [
+    '23.235.32.0/20',
+    '43.249.72.0/22',
+    '103.244.50.0/24',
+    '103.245.222.0/23',
+    '103.245.224.0/24',
+    '104.156.80.0/20',
+    '140.248.64.0/18',
+    '146.75.0.0/17',
+    '151.101.0.0/16',
+    '157.52.64.0/18',
+    '167.82.0.0/17',
+    '167.82.128.0/20',
+    '167.82.160.0/20',
+    '167.82.224.0/20',
+    '172.111.64.0/18',
+    '185.31.16.0/22',
+    '199.27.72.0/21',
+    '199.232.0.0/16',
+];
+const FASTLY_V6 = ['2a04:4e40::/32', '2a04:4e42::/32'];
+/** BunnyCDN (snapshot). */
+const BUNNY_V4 = [
+    '84.17.32.0/19',
+    '89.187.160.0/19',
+    '103.233.192.0/22',
+    '107.181.160.0/19',
+    '185.93.0.0/22',
+    '185.152.64.0/22',
+    '185.234.100.0/22',
+    '193.37.0.0/22',
+];
+/** CloudFront — common prefixes (full list via Amazon ip-ranges refresh). */
+const CLOUDFRONT_V4 = [
+    '13.32.0.0/15',
+    '13.35.0.0/16',
+    '13.224.0.0/14',
+    '13.249.0.0/16',
+    '18.64.0.0/14',
+    '18.68.0.0/16',
+    '52.46.0.0/18',
+    '52.84.0.0/15',
+    '52.222.128.0/17',
+    '54.182.0.0/16',
+    '54.192.0.0/16',
+    '54.230.0.0/16',
+    '54.239.128.0/18',
+    '64.252.64.0/18',
+    '70.132.0.0/18',
+    '71.152.0.0/17',
+    '99.84.0.0/16',
+    '99.86.0.0/16',
+    '143.204.0.0/16',
+    '204.246.164.0/22',
+    '204.246.168.0/22',
+    '205.251.192.0/19',
+    '205.251.249.0/24',
+    '205.251.250.0/23',
+    '205.251.252.0/23',
+    '205.251.254.0/24',
+    '216.137.32.0/19',
+];
+const AZURE_FD_V4 = [
+    '13.73.248.16/29',
+    '20.21.37.40/29',
+    '20.36.120.104/29',
+    '20.37.156.216/29',
+    '20.37.195.96/27',
+    '20.38.85.152/29',
+    '20.39.13.96/27',
+    '20.41.6.0/24',
+    '20.42.4.208/28',
+    '20.42.37.40/29',
+    '20.43.54.0/27',
+    '20.43.65.128/27',
+    '20.43.130.80/28',
+    '20.49.102.0/24',
+    '20.150.160.0/23',
+    '20.189.107.0/24',
+    '40.67.48.80/28',
+    '40.90.136.208/29',
+    '51.12.73.136/29',
+    '51.104.28.0/24',
+    '51.137.160.152/29',
+    '52.149.104.0/21',
+    '52.150.136.80/29',
+    '52.159.212.184/29',
+    '52.228.80.128/25',
+    '147.243.0.0/16',
+];
+const GCORE_V4 = [
+    '92.223.0.0/17',
+    '92.223.128.0/18',
+    '138.124.184.0/21',
+    '152.89.248.0/21',
+    '185.59.220.0/22',
+    '213.156.152.0/21',
+];
+export const REAL_IP_PROVIDERS = [
+    {
+        id: 'none',
+        label: 'None (direct origin)',
+        clientIpHeader: '',
+        snapshotIpv4: [],
+        snapshotIpv6: [],
+    },
+    {
+        id: 'cloudflare',
+        label: 'Cloudflare',
+        clientIpHeader: 'CF-Connecting-IP',
+        cidrSources: {
+            ipv4: 'https://www.cloudflare.com/ips-v4',
+            ipv6: 'https://www.cloudflare.com/ips-v6',
+        },
+        snapshotIpv4: CF_V4,
+        snapshotIpv6: CF_V6,
+    },
+    {
+        id: 'fastly',
+        label: 'Fastly',
+        clientIpHeader: 'Fastly-Client-IP',
+        cidrSources: {
+            ipv4: 'https://api.fastly.com/public-ip-list',
+        },
+        snapshotIpv4: FASTLY_V4,
+        snapshotIpv6: FASTLY_V6,
+    },
+    {
+        id: 'bunny',
+        label: 'Bunny CDN',
+        clientIpHeader: 'X-Forwarded-For',
+        snapshotIpv4: BUNNY_V4,
+        snapshotIpv6: [],
+    },
+    {
+        id: 'cloudfront',
+        label: 'AWS CloudFront',
+        clientIpHeader: 'X-Forwarded-For',
+        cidrSources: {
+            ipv4: 'https://ip-ranges.amazonaws.com/ip-ranges.json',
+        },
+        snapshotIpv4: CLOUDFRONT_V4,
+        snapshotIpv6: [],
+    },
+    {
+        id: 'azure_frontdoor',
+        label: 'Azure Front Door',
+        clientIpHeader: 'X-Azure-ClientIP',
+        snapshotIpv4: AZURE_FD_V4,
+        snapshotIpv6: [],
+    },
+    {
+        id: 'gcore',
+        label: 'Gcore CDN',
+        clientIpHeader: 'X-Forwarded-For',
+        snapshotIpv4: GCORE_V4,
+        snapshotIpv6: [],
+    },
+    {
+        id: 'custom',
+        label: 'Custom proxies',
+        clientIpHeader: 'X-Forwarded-For',
+        snapshotIpv4: [],
+        snapshotIpv6: [],
+    },
+];
+export function getRealIpProvider(id) {
+    return REAL_IP_PROVIDERS.find((p) => p.id === id) ?? REAL_IP_PROVIDERS[0];
+}
+export function listRealIpProviders() {
+    return REAL_IP_PROVIDERS.map((p) => ({ ...p }));
+}
+/** Loose CIDR / IP validation for config input. */
+export function isValidCidrOrIp(s) {
+    const t = s.trim();
+    if (!t || t.length > 64)
+        return false;
+    // IPv4 or IPv4/prefix
+    if (/^(\d{1,3}\.){3}\d{1,3}(\/\d{1,2})?$/.test(t))
+        return true;
+    // IPv6 rough
+    if (/^[0-9a-fA-F:]+(\/\d{1,3})?$/.test(t) && t.includes(':'))
+        return true;
+    return false;
+}
+export function normalizeCidrList(list) {
+    const out = [];
+    const seen = new Set();
+    for (const raw of list) {
+        const t = raw.trim();
+        if (!t || t.startsWith('#'))
+            continue;
+        if (!isValidCidrOrIp(t))
+            continue;
+        if (seen.has(t))
+            continue;
+        // Reject trust-all
+        if (t === '0.0.0.0/0' || t === '::/0')
+            continue;
+        seen.add(t);
+        out.push(t);
+    }
+    return out;
+}
+//# sourceMappingURL=providers.js.map

package/dist/hosting/real-ip/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../../../src/hosting/real-ip/providers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,8EAA8E;AAC9E,MAAM,KAAK,GAAG;IACZ,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,eAAe;IACf,eAAe;IACf,eAAe;CAChB,CAAC;AAEF,MAAM,KAAK,GAAG;IACZ,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;CACjB,CAAC;AAEF,yEAAyE;AACzE,MAAM,SAAS,GAAG;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;CACjB,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;AAEvD,2BAA2B;AAC3B,MAAM,QAAQ,GAAG;IACf,eAAe;IACf,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;IACf,iBAAiB;IACjB,kBAAkB;IAClB,eAAe;CAChB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,aAAa,GAAG;IACpB,cAAc;IACd,cAAc;IACd,eAAe;IACf,eAAe;IACf,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,iBAAiB;IACjB,eAAe;IACf,eAAe;IACf,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,eAAe;IACf,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;CAClB,CAAC;AAEF,MAAM,WAAW,GAAG;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;IAChB,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,mBAAmB;IACnB,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;CACjB,CAAC;AAEF,MAAM,QAAQ,GAAG;IACf,eAAe;IACf,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,kBAAkB;CACnB,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAwB;IACpD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,sBAAsB;QAC7B,cAAc,EAAE,EAAE;QAClB,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,EAAE;KACjB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,YAAY;QACnB,cAAc,EAAE,kBAAkB;QAClC,WAAW,EAAE;YACX,IAAI,EAAE,mCAAmC;YACzC,IAAI,EAAE,mCAAmC;SAC1C;QACD,YAAY,EAAE,KAAK;QACnB,YAAY,EAAE,KAAK;KACpB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,cAAc,EAAE,kBAAkB;QAClC,WAAW,EAAE;YACX,IAAI,EAAE,uCAAuC;SAC9C;QACD,YAAY,EAAE,SAAS;QACvB,YAAY,EAAE,SAAS;KACxB;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,WAAW;QAClB,cAAc,EAAE,iBAAiB;QACjC,YAAY,EAAE,QAAQ;QACtB,YAAY,EAAE,EAAE;KACjB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,gBAAgB;QACvB,cAAc,EAAE,iBAAiB;QACjC,WAAW,EAAE;YACX,IAAI,EAAE,gDAAgD;SACvD;QACD,YAAY,EAAE,aAAa;QAC3B,YAAY,EAAE,EAAE;KACjB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,kBAAkB;QACzB,cAAc,EAAE,kBAAkB;QAClC,YAAY,EAAE,WAAW;QACzB,YAAY,EAAE,EAAE;KACjB;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,WAAW;QAClB,cAAc,EAAE,iBAAiB;QACjC,YAAY,EAAE,QAAQ;QACtB,YAAY,EAAE,EAAE;KACjB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,gBAAgB;QACvB,cAAc,EAAE,iBAAiB;QACjC,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,EAAE;KACjB;CACF,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,EAAoB;IACpD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACtC,sBAAsB;IACtB,IAAI,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,aAAa;IACb,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAc;IAC9C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;YAAE,SAAS;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC1B,mBAAmB;QACnB,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,MAAM;YAAE,SAAS;QAChD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/hosting/real-ip/refresh.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Refresh CDN CIDR lists from official sources (best-effort).
+ */
+import type { HostExecutor } from '../../host/executor.js';
+import type { RealIpHostConfig, RealIpProviderId } from './types.js';
+export declare function refreshRealIpCidrs(input: {
+    dataDir: string;
+    host?: HostExecutor;
+    /** Limit which providers to refresh */
+    providers?: RealIpProviderId[];
+}): Promise<{
+    ok: boolean;
+    config: RealIpHostConfig;
+    notes: string[];
+    updated: RealIpProviderId[];
+}>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/hosting/real-ip/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/hosting/real-ip/refresh.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAG3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAqDrE,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,uCAAuC;IACvC,SAAS,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAChC,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,gBAAgB,EAAE,CAAC;CAC7B,CAAC,CA8DD"}

package/dist/hosting/real-ip/refresh.js

@@ -0,0 +1,113 @@
+/**
+ * Refresh CDN CIDR lists from official sources (best-effort).
+ */
+import { getRealIpProvider, normalizeCidrList } from './providers.js';
+import { loadRealIpConfig, saveRealIpConfig } from './store.js';
+async function fetchText(url, timeoutMs = 20_000) {
+    const ctrl = new AbortController();
+    const t = setTimeout(() => ctrl.abort(), timeoutMs);
+    try {
+        const res = await fetch(url, {
+            signal: ctrl.signal,
+            headers: { 'User-Agent': 'ysk-server-real-ip/1.0' },
+        });
+        if (!res.ok)
+            throw new Error(`HTTP ${res.status}`);
+        return await res.text();
+    }
+    finally {
+        clearTimeout(t);
+    }
+}
+function parseLines(body) {
+    return normalizeCidrList(body
+        .split(/\r?\n/)
+        .map((l) => l.trim())
+        .filter((l) => l && !l.startsWith('#')));
+}
+function parseFastlyJson(body) {
+    try {
+        const j = JSON.parse(body);
+        return {
+            ipv4: normalizeCidrList(j.addresses ?? []),
+            ipv6: normalizeCidrList(j.ipv6_addresses ?? []),
+        };
+    }
+    catch {
+        return { ipv4: [], ipv6: [] };
+    }
+}
+function parseAwsCloudFront(body) {
+    try {
+        const j = JSON.parse(body);
+        return normalizeCidrList((j.prefixes ?? [])
+            .filter((p) => p.service === 'CLOUDFRONT' && p.ip_prefix)
+            .map((p) => p.ip_prefix));
+    }
+    catch {
+        return [];
+    }
+}
+export async function refreshRealIpCidrs(input) {
+    const notes = [];
+    const cfg = loadRealIpConfig(input.dataDir);
+    const want = input.providers?.length
+        ? input.providers
+        : cfg.enabledProviders.filter((p) => p !== 'custom' && p !== 'none');
+    const cached = { ...(cfg.cachedCidrs ?? {}) };
+    const updated = [];
+    for (const id of want) {
+        if (id === 'none' || id === 'custom')
+            continue;
+        const def = getRealIpProvider(id);
+        if (!def.cidrSources?.ipv4 && !def.cidrSources?.ipv6) {
+            notes.push(`${id}: no remote source — keep snapshot`);
+            continue;
+        }
+        try {
+            let ipv4 = [];
+            let ipv6 = [];
+            if (id === 'fastly' && def.cidrSources?.ipv4) {
+                const body = await fetchText(def.cidrSources.ipv4);
+                const p = parseFastlyJson(body);
+                ipv4 = p.ipv4;
+                ipv6 = p.ipv6;
+            }
+            else if (id === 'cloudfront' && def.cidrSources?.ipv4) {
+                const body = await fetchText(def.cidrSources.ipv4);
+                ipv4 = parseAwsCloudFront(body);
+            }
+            else {
+                if (def.cidrSources?.ipv4) {
+                    ipv4 = parseLines(await fetchText(def.cidrSources.ipv4));
+                }
+                if (def.cidrSources?.ipv6) {
+                    ipv6 = parseLines(await fetchText(def.cidrSources.ipv6));
+                }
+            }
+            if (ipv4.length === 0 && ipv6.length === 0) {
+                notes.push(`${id}: empty fetch — keep previous/snapshot`);
+                continue;
+            }
+            cached[id] = { ipv4, ipv6 };
+            updated.push(id);
+            notes.push(`${id}: refreshed v4=${ipv4.length} v6=${ipv6.length}`);
+        }
+        catch (e) {
+            notes.push(`${id}: refresh failed — ${e instanceof Error ? e.message : String(e)} (using snapshot)`);
+        }
+    }
+    const next = {
+        ...cfg,
+        cachedCidrs: cached,
+        lastRefreshAt: new Date().toISOString(),
+    };
+    saveRealIpConfig(input.dataDir, next);
+    return {
+        ok: updated.length > 0 || want.length === 0,
+        config: next,
+        notes,
+        updated,
+    };
+}
+//# sourceMappingURL=refresh.js.map

package/dist/hosting/real-ip/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../../src/hosting/real-ip/refresh.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGhE,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,SAAS,GAAG,MAAM;IACtD,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,EAAE,YAAY,EAAE,wBAAwB,EAAE;SACpD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,iBAAiB,CACtB,IAAI;SACD,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwD,CAAC;QAClF,OAAO;YACL,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;YAC1C,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC;SAChD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAExB,CAAC;QACF,OAAO,iBAAiB,CACtB,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,SAAS,CAAC;aACxD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAU,CAAC,CAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAKxC;IAMC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,MAAM;QAClC,CAAC,CAAC,KAAK,CAAC,SAAS;QACjB,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC;IAEvE,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,QAAQ;YAAE,SAAS;QAC/C,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,IAAI,IAAI,GAAa,EAAE,CAAC;YACxB,IAAI,IAAI,GAAa,EAAE,CAAC;YACxB,IAAI,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBACnD,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACd,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;YAChB,CAAC;iBAAM,IAAI,EAAE,KAAK,YAAY,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;gBACxD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;oBAC1B,IAAI,GAAG,UAAU,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3D,CAAC;gBACD,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;oBAC1B,IAAI,GAAG,UAAU,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3C,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CACR,GAAG,EAAE,sBAAsB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAqB;QAC7B,GAAG,GAAG;QACN,WAAW,EAAE,MAAM;QACnB,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACxC,CAAC;IACF,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAC3C,MAAM,EAAE,IAAI;QACZ,KAAK;QACL,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/hosting/real-ip/render.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Render Nginx real_ip + Apache RemoteIP snippets.
+ */
+import type { RealIpHostConfig, RealIpProviderId } from './types.js';
+export interface ResolveRealIpInput {
+    /** Explicit provider (project override). */
+    provider?: RealIpProviderId | 'inherit' | null;
+    /** Host config; default none. */
+    host?: RealIpHostConfig;
+    /**
+     * Legacy flag from older callers.
+     * true → cloudflare when provider unset; false → none.
+     */
+    cloudflareRealIp?: boolean;
+}
+/**
+ * Resolve effective provider for a site.
+ */
+export declare function resolveRealIpProvider(input: ResolveRealIpInput): RealIpProviderId;
+/**
+ * Nginx server-context snippet: set_real_ip_from + real_ip_header.
+ * Empty string when provider is none.
+ */
+export declare function renderNginxRealIpBlock(input: ResolveRealIpInput): string;
+/**
+ * Apache RemoteIP for PHP backend behind local Nginx.
+ * Trusts only loopback (Nginx on same host).
+ */
+export declare function renderApacheRemoteIpConf(opts?: {
+    /** Extra internal proxies (e.g. other local nginx). */
+    internalProxies?: string[];
+}): string;
+export declare function realIpProviderSummary(): Array<{
+    id: RealIpProviderId;
+    label: string;
+    clientIpHeader: string;
+    snapshotCount: number;
+}>;
+//# sourceMappingURL=render.d.ts.map

package/dist/hosting/real-ip/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../../src/hosting/real-ip/render.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAGpB,MAAM,WAAW,kBAAkB;IACjC,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,gBAAgB,GAAG,SAAS,GAAG,IAAI,CAAC;IAC/C,iCAAiC;IACjC,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,kBAAkB,GAAG,gBAAgB,CAcjF;AAkBD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAyDxE;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,CAAC,EAAE;IAC9C,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,GAAG,MAAM,CAcT;AAED,wBAAgB,qBAAqB,IAAI,KAAK,CAAC;IAC7C,EAAE,EAAE,gBAAgB,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC,CAOD"}

package/dist/hosting/real-ip/render.js

@@ -0,0 +1,132 @@
+/**
+ * Render Nginx real_ip + Apache RemoteIP snippets.
+ */
+import { getRealIpProvider, listRealIpProviders, normalizeCidrList, } from './providers.js';
+import { DEFAULT_REAL_IP_CONFIG } from './types.js';
+/**
+ * Resolve effective provider for a site.
+ */
+export function resolveRealIpProvider(input) {
+    const host = input.host ?? DEFAULT_REAL_IP_CONFIG;
+    if (input.provider && input.provider !== 'inherit') {
+        return input.provider;
+    }
+    if (input.cloudflareRealIp === false)
+        return 'none';
+    if (input.provider === 'inherit' || input.provider == null) {
+        if (input.cloudflareRealIp === true && host.defaultProvider === 'none') {
+            // Legacy publish always passed cloudflareRealIp:true — keep CF when host still default none
+            return 'cloudflare';
+        }
+        return host.defaultProvider;
+    }
+    return host.defaultProvider;
+}
+function cidrsForProvider(id, host) {
+    if (id === 'none')
+        return { ipv4: [], ipv6: [] };
+    if (id === 'custom') {
+        return { ipv4: normalizeCidrList(host.customCidrs), ipv6: [] };
+    }
+    const def = getRealIpProvider(id);
+    const cached = host.cachedCidrs?.[id];
+    return {
+        ipv4: normalizeCidrList(cached?.ipv4?.length ? cached.ipv4 : def.snapshotIpv4),
+        ipv6: normalizeCidrList(cached?.ipv6?.length ? cached.ipv6 : def.snapshotIpv6),
+    };
+}
+/**
+ * Nginx server-context snippet: set_real_ip_from + real_ip_header.
+ * Empty string when provider is none.
+ */
+export function renderNginxRealIpBlock(input) {
+    const host = input.host ?? DEFAULT_REAL_IP_CONFIG;
+    const provider = resolveRealIpProvider(input);
+    if (provider === 'none')
+        return '';
+    let header;
+    let ipv4 = [];
+    let ipv6 = [];
+    if (host.trustMode === 'xff_merged') {
+        header = 'X-Forwarded-For';
+        const ids = new Set([
+            ...host.enabledProviders,
+            ...(provider !== 'custom' ? [provider] : []),
+        ]);
+        for (const id of ids) {
+            if (id === 'none' || id === 'custom')
+                continue;
+            const c = cidrsForProvider(id, host);
+            ipv4.push(...c.ipv4);
+            ipv6.push(...c.ipv6);
+        }
+        ipv4.push(...normalizeCidrList(host.customCidrs));
+    }
+    else {
+        const def = getRealIpProvider(provider);
+        header =
+            provider === 'custom'
+                ? host.customHeader?.trim() || 'X-Forwarded-For'
+                : def.clientIpHeader;
+        if (!header)
+            return '';
+        const c = cidrsForProvider(provider, host);
+        ipv4 = c.ipv4;
+        ipv6 = c.ipv6;
+        if (provider === 'custom') {
+            ipv4 = normalizeCidrList([...host.customCidrs, ...ipv4]);
+        }
+        else {
+            ipv4 = normalizeCidrList([...ipv4, ...host.customCidrs]);
+        }
+    }
+    ipv4 = normalizeCidrList(ipv4);
+    ipv6 = normalizeCidrList(ipv6);
+    if (ipv4.length === 0 && ipv6.length === 0) {
+        // custom with no CIDRs — refuse (would trust nothing useful or everything)
+        if (provider === 'custom')
+            return '';
+    }
+    const lines = [
+        `# YSK real_ip — provider=${provider} mode=${host.trustMode}`,
+    ];
+    for (const c of ipv4)
+        lines.push(`set_real_ip_from ${c};`);
+    for (const c of ipv6)
+        lines.push(`set_real_ip_from ${c};`);
+    // Safe header name: alnum + hyphen only
+    const safeHeader = header.replace(/[^A-Za-z0-9-]/g, '');
+    if (!safeHeader)
+        return '';
+    lines.push(`real_ip_header ${safeHeader};`);
+    lines.push('real_ip_recursive on;');
+    return lines.join('\n');
+}
+/**
+ * Apache RemoteIP for PHP backend behind local Nginx.
+ * Trusts only loopback (Nginx on same host).
+ */
+export function renderApacheRemoteIpConf(opts) {
+    const proxies = normalizeCidrList([
+        '127.0.0.1',
+        '::1',
+        ...(opts?.internalProxies ?? []),
+    ]);
+    const lines = [
+        '# YSK RemoteIP — Nginx (local) already restored client IP into X-Forwarded-For',
+        'RemoteIPHeader X-Forwarded-For',
+    ];
+    for (const p of proxies) {
+        lines.push(`RemoteIPInternalProxy ${p}`);
+    }
+    return lines.join('\n') + '\n';
+}
+export function realIpProviderSummary() {
+    return listRealIpProviders().map((p) => ({
+        id: p.id,
+        label: p.label,
+        clientIpHeader: p.clientIpHeader,
+        snapshotCount: p.snapshotIpv4.length + p.snapshotIpv6.length,
+    }));
+}
+//# sourceMappingURL=render.js.map

package/dist/hosting/real-ip/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../../../src/hosting/real-ip/render.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAcpD;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAyB;IAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,sBAAsB,CAAC;IAClD,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC3D,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,IAAI,IAAI,CAAC,eAAe,KAAK,MAAM,EAAE,CAAC;YACvE,4FAA4F;YAC5F,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC,eAAe,CAAC;AAC9B,CAAC;AAED,SAAS,gBAAgB,CACvB,EAAoB,EACpB,IAAsB;IAEtB,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjD,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;IACtC,OAAO;QACL,IAAI,EAAE,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QAC9E,IAAI,EAAE,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAyB;IAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,sBAAsB,CAAC;IAClD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAEnC,IAAI,MAAc,CAAC;IACnB,IAAI,IAAI,GAAa,EAAE,CAAC;IACxB,IAAI,IAAI,GAAa,EAAE,CAAC;IAExB,IAAI,IAAI,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;QACpC,MAAM,GAAG,iBAAiB,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAmB;YACpC,GAAG,IAAI,CAAC,gBAAgB;YACxB,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;QACH,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,QAAQ;gBAAE,SAAS;YAC/C,MAAM,CAAC,GAAG,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM;YACJ,QAAQ,KAAK,QAAQ;gBACnB,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,iBAAiB;gBAChD,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;QACzB,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACd,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACd,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,GAAG,iBAAiB,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,iBAAiB,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,2EAA2E;QAC3E,IAAI,QAAQ,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,KAAK,GAAa;QACtB,4BAA4B,QAAQ,SAAS,IAAI,CAAC,SAAS,EAAE;KAC9D,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC3D,wCAAwC;IACxC,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,kBAAkB,UAAU,GAAG,CAAC,CAAC;IAC5C,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAGxC;IACC,MAAM,OAAO,GAAG,iBAAiB,CAAC;QAChC,WAAW;QACX,KAAK;QACL,GAAG,CAAC,IAAI,EAAE,eAAe,IAAI,EAAE,CAAC;KACjC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,gFAAgF;QAChF,gCAAgC;KACjC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,qBAAqB;IAMnC,OAAO,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,aAAa,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM;KAC7D,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/hosting/real-ip/store.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Persist host real-ip config under dataDir.
+ */
+import { type RealIpHostConfig } from './types.js';
+export declare function loadRealIpConfig(dataDir: string): RealIpHostConfig;
+export declare function saveRealIpConfig(dataDir: string, cfg: RealIpHostConfig): string;
+export declare function normalizeRealIpConfig(raw: Partial<RealIpHostConfig>): RealIpHostConfig;
+export declare function patchRealIpConfig(dataDir: string, patch: Partial<RealIpHostConfig>): RealIpHostConfig;
+//# sourceMappingURL=store.d.ts.map

package/dist/hosting/real-ip/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/hosting/real-ip/store.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAEL,KAAK,gBAAgB,EAGtB,MAAM,YAAY,CAAC;AAkBpB,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CASlE;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAM/E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAsBtF;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAC/B,gBAAgB,CAKlB"}

package/dist/hosting/real-ip/store.js

@@ -0,0 +1,66 @@
+/**
+ * Persist host real-ip config under dataDir.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { DEFAULT_REAL_IP_CONFIG, } from './types.js';
+import { normalizeCidrList } from './providers.js';
+const VALID_PROVIDERS = new Set([
+    'none',
+    'cloudflare',
+    'fastly',
+    'bunny',
+    'cloudfront',
+    'azure_frontdoor',
+    'gcore',
+    'custom',
+]);
+function configPath(dataDir) {
+    return join(dataDir, 'config', 'real-ip.json');
+}
+export function loadRealIpConfig(dataDir) {
+    const path = configPath(dataDir);
+    if (!existsSync(path))
+        return { ...DEFAULT_REAL_IP_CONFIG };
+    try {
+        const raw = JSON.parse(readFileSync(path, 'utf8'));
+        return normalizeRealIpConfig(raw);
+    }
+    catch {
+        return { ...DEFAULT_REAL_IP_CONFIG };
+    }
+}
+export function saveRealIpConfig(dataDir, cfg) {
+    const path = configPath(dataDir);
+    mkdirSync(join(dataDir, 'config'), { recursive: true });
+    const clean = normalizeRealIpConfig(cfg);
+    writeFileSync(path, JSON.stringify(clean, null, 2) + '\n', 'utf8');
+    return path;
+}
+export function normalizeRealIpConfig(raw) {
+    const defaultProvider = VALID_PROVIDERS.has(raw.defaultProvider)
+        ? raw.defaultProvider
+        : DEFAULT_REAL_IP_CONFIG.defaultProvider;
+    const trustMode = raw.trustMode === 'xff_merged' ? 'xff_merged' : 'single_provider';
+    const enabledProviders = (raw.enabledProviders ?? DEFAULT_REAL_IP_CONFIG.enabledProviders)
+        .filter((p) => VALID_PROVIDERS.has(p) && p !== 'none')
+        .filter((p, i, a) => a.indexOf(p) === i);
+    return {
+        defaultProvider,
+        trustMode,
+        enabledProviders: enabledProviders.length > 0 ? enabledProviders : [...DEFAULT_REAL_IP_CONFIG.enabledProviders],
+        customCidrs: normalizeCidrList(raw.customCidrs ?? []),
+        customHeader: typeof raw.customHeader === 'string' && raw.customHeader.trim()
+            ? raw.customHeader.trim().slice(0, 64)
+            : undefined,
+        lastRefreshAt: typeof raw.lastRefreshAt === 'string' ? raw.lastRefreshAt : undefined,
+        cachedCidrs: raw.cachedCidrs && typeof raw.cachedCidrs === 'object' ? raw.cachedCidrs : undefined,
+    };
+}
+export function patchRealIpConfig(dataDir, patch) {
+    const prev = loadRealIpConfig(dataDir);
+    const next = normalizeRealIpConfig({ ...prev, ...patch });
+    saveRealIpConfig(dataDir, next);
+    return next;
+}
+//# sourceMappingURL=store.js.map

package/dist/hosting/real-ip/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/hosting/real-ip/store.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,sBAAsB,GAIvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAmB;IAChD,MAAM;IACN,YAAY;IACZ,QAAQ;IACR,OAAO;IACP,YAAY;IACZ,iBAAiB;IACjB,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,GAAG,sBAAsB,EAAE,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA8B,CAAC;QAChF,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,sBAAsB,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,GAAqB;IACrE,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACzC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAA8B;IAClE,MAAM,eAAe,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,eAAmC,CAAC;QAClF,CAAC,CAAE,GAAG,CAAC,eAAoC;QAC3C,CAAC,CAAC,sBAAsB,CAAC,eAAe,CAAC;IAC3C,MAAM,SAAS,GACb,GAAG,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACpE,MAAM,gBAAgB,GAAG,CAAC,GAAG,CAAC,gBAAgB,IAAI,sBAAsB,CAAC,gBAAgB,CAAC;SACvF,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAqB,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC;SAChG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,OAAO;QACL,eAAe;QACf,SAAS;QACT,gBAAgB,EACd,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,sBAAsB,CAAC,gBAAgB,CAAC;QAC/F,WAAW,EAAE,iBAAiB,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;QACrD,YAAY,EACV,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE;YAC7D,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACtC,CAAC,CAAC,SAAS;QACf,aAAa,EAAE,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QACpF,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;KAClG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,KAAgC;IAEhC,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC1D,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC"}