ysk-server-core 1.0.0

package/dist/hosting/defense/automation.d.ts

@@ -0,0 +1,104 @@
+import type { HostExecutor } from '../../host/executor.js';
+import type { JsonStore } from '../../db/store.js';
+import type { AutoBanMode, BanMethod, DefensePresetId } from './types.js';
+import { type SignalWeights } from './signals.js';
+export type DefenseAutomation = {
+    /** Master switch */
+    enabled: boolean;
+    autoPreset: {
+        enabled: boolean;
+        /** Also drives display threatLevel elevatedAt */
+        escalateToHardenedAt: number;
+        /** Also drives display underAttackAt */
+        escalateToUnderAttackAt: number;
+        /** Score at which we only *suggest* emergency — never auto-apply */
+        suggestEmergencyAt: number;
+        /** Display critical band (default derived near 70) */
+        criticalAt: number;
+        deescalateEnabled: boolean;
+        deescalateToDailyBelow: number;
+        holdMinutes: number;
+    };
+    autoBan: {
+        enabled: boolean;
+        mode: AutoBanMode | 'custom';
+        method: BanMethod;
+        minScore: number;
+        minHits: number;
+        min429: number;
+        minScan: number;
+        cooldownMinutes: number;
+        maxAutoBansPerHour: number;
+        /** Scheduler interval 30–600s */
+        intervalSeconds: number;
+        whitelist: string[];
+        /** also write fail2ban ignoreip when whitelist changes */
+        syncFail2banIgnoreip: boolean;
+    };
+    /** Signal point multipliers (0–3) */
+    signalWeights: SignalWeights;
+    /** Cloudflare zones for Under Attack when escalating to under_attack */
+    cloudflare: {
+        enabled: boolean;
+        zones: string[];
+        /** also call CF when auto-preset escalates */
+        onAutoEscalate: boolean;
+        /**
+         * When applying under_attack: write UFW rules that only allow CF IP ranges
+         * (+ SSH/optional admin). Requires EXECUTE+root to apply.
+         */
+        ufwAllowOnlyCf: boolean;
+        /** Always keep these TCP ports open even in CF-only mode (default 22) */
+        ufwKeepTcpPorts: number[];
+    };
+    lastTickAt?: string;
+    lastTickNotes?: string[];
+    lastPresetChangeAt?: string;
+    lastPresetId?: DefensePresetId;
+    suggestEmergency?: boolean;
+};
+export declare const DEFAULT_AUTOMATION: DefenseAutomation;
+export declare function loadDefenseAutomation(db: JsonStore): DefenseAutomation;
+export declare function saveDefenseAutomation(db: JsonStore, policy: DefenseAutomation): DefenseAutomation;
+/** Write defense whitelist into fail2ban ignoreip.txt under dataDir. */
+export declare function syncWhitelistToFail2banIgnore(dataDir: string, whitelist: string[]): string;
+export declare function updateDefenseAutomation(db: JsonStore, patch: Partial<DefenseAutomation> & {
+    autoPreset?: Partial<DefenseAutomation['autoPreset']>;
+    autoBan?: Partial<DefenseAutomation['autoBan']>;
+    signalWeights?: Partial<SignalWeights>;
+    cloudflare?: Partial<DefenseAutomation['cloudflare']>;
+}): DefenseAutomation;
+/**
+ * Desired preset from score (never returns emergency).
+ */
+export declare function desiredPresetFromScore(score: number, ap: DefenseAutomation['autoPreset']): DefensePresetId;
+/**
+ * Full automation tick: signals → optional preset change → auto-ban.
+ */
+export declare function runDefenseAutomationTick(input: {
+    host: HostExecutor;
+    db: JsonStore;
+    dataDir: string;
+    requestCountLastMinute?: number;
+}): Promise<{
+    ok: boolean;
+    notes: string[];
+    score: number;
+    threatLevel: string;
+    preset?: DefensePresetId;
+    presetChanged?: boolean;
+    banned: string[];
+    suggestEmergency?: boolean;
+    automation: DefenseAutomation;
+}>;
+/**
+ * Mechanism table for UI — resolved at request time (never module-load tl freeze).
+ */
+export declare function getAutomationMechanismRows(): Array<{
+    step: string;
+    mechanism: string;
+    tunable: string;
+}>;
+/** @deprecated alias — prefer getAutomationMechanismRows() at request time */
+export declare const AUTOMATION_MECHANISM_ROWS: typeof getAutomationMechanismRows;
+//# sourceMappingURL=automation.d.ts.map

package/dist/hosting/defense/automation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"automation.d.ts","sourceRoot":"","sources":["../../../src/hosting/defense/automation.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAiB,SAAS,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AASzF,OAAO,EAIL,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAS3C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oBAAoB;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE;QACV,OAAO,EAAE,OAAO,CAAC;QACjB,iDAAiD;QACjD,oBAAoB,EAAE,MAAM,CAAC;QAC7B,wCAAwC;QACxC,uBAAuB,EAAE,MAAM,CAAC;QAChC,oEAAoE;QACpE,kBAAkB,EAAE,MAAM,CAAC;QAC3B,sDAAsD;QACtD,UAAU,EAAE,MAAM,CAAC;QACnB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,sBAAsB,EAAE,MAAM,CAAC;QAC/B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,OAAO,EAAE;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAC;QAC7B,MAAM,EAAE,SAAS,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,eAAe,EAAE,MAAM,CAAC;QACxB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,iCAAiC;QACjC,eAAe,EAAE,MAAM,CAAC;QACxB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,0DAA0D;QAC1D,oBAAoB,EAAE,OAAO,CAAC;KAC/B,CAAC;IACF,qCAAqC;IACrC,aAAa,EAAE,aAAa,CAAC;IAC7B,wEAAwE;IACxE,UAAU,EAAE;QACV,OAAO,EAAE,OAAO,CAAC;QACjB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,8CAA8C;QAC9C,cAAc,EAAE,OAAO,CAAC;QACxB;;;WAGG;QACH,cAAc,EAAE,OAAO,CAAC;QACxB,yEAAyE;QACzE,eAAe,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC;IACF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,iBA8BJ,CAAC;AAM9B,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,SAAS,GAAG,iBAAiB,CA2FtE;AAWD,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,iBAAiB,GACxB,iBAAiB,CAkCnB;AAED,wEAAwE;AACxE,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAS1F;AAED,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,SAAS,EACb,KAAK,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG;IAClC,UAAU,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;IAChD,aAAa,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;CACvD,GACA,iBAAiB,CASnB;AA0CD;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,iBAAiB,CAAC,YAAY,CAAC,GAClC,eAAe,CAKjB;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,SAAS,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,UAAU,EAAE,iBAAiB,CAAC;CAC/B,CAAC,CA6JD;AAED;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,KAAK,CAAC;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC,CAsCD;AAED,8EAA8E;AAC9E,eAAO,MAAM,yBAAyB,mCAA6B,CAAC"}

package/dist/hosting/defense/automation.js

@@ -0,0 +1,475 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Defense automation — auto preset escalate/de-escalate + auto-ban (user-tunable).
+ * Emergency preset is NEVER applied automatically.
+ */
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { loadAutoBanPolicy, modeThresholds, runAutoBanTick, saveAutoBanPolicy, updateAutoBanPolicy } from './auto-ban.js';
+import { applyDefensePreset } from './defense-service.js';
+import { getDefensePreset } from './presets.js';
+import { collectDefenseSignals, DEFAULT_SIGNAL_WEIGHTS, threatThresholdsFromAutoPreset } from './signals.js';
+import { enableCloudflareUnderAttack } from './cloudflare-ua.js';
+import { writeAndMaybeApplyCfOnlyUfw } from './cf-ufw.js';
+const AUTO_KEY = 'defense_automation';
+const TIMELINE_KEY = 'defense_timeline';
+const PRESET_KEY = 'defense_active_preset';
+const HOLD_KEY = 'defense_auto_preset_hold';
+export const DEFAULT_AUTOMATION = {
+    enabled: false,
+    autoPreset: {
+        enabled: false,
+        escalateToHardenedAt: 20,
+        escalateToUnderAttackAt: 45,
+        suggestEmergencyAt: 85,
+        criticalAt: 70,
+        deescalateEnabled: true,
+        deescalateToDailyBelow: 10,
+        holdMinutes: 15
+    },
+    autoBan: {
+        enabled: false,
+        mode: 'soft',
+        method: 'fail2ban',
+        minScore: 55,
+        minHits: 100,
+        min429: 50,
+        minScan: 20,
+        cooldownMinutes: 60,
+        maxAutoBansPerHour: 40,
+        intervalSeconds: 120,
+        whitelist: ['127.0.0.1', '::1'],
+        syncFail2banIgnoreip: true
+    },
+    signalWeights: { ...DEFAULT_SIGNAL_WEIGHTS },
+    cloudflare: {
+        enabled: false,
+        zones: [],
+        onAutoEscalate: true,
+        ufwAllowOnlyCf: false,
+        ufwKeepTcpPorts: [22]
+    }
+};
+function clamp(n, lo, hi) {
+    return Math.max(lo, Math.min(hi, n));
+}
+export function loadDefenseAutomation(db) {
+    // Migrate / merge from legacy auto-ban policy
+    const legacy = loadAutoBanPolicy(db);
+    try {
+        const raw = db.snapshot.settings?.[AUTO_KEY];
+        if (!raw) {
+            return {
+                ...DEFAULT_AUTOMATION,
+                enabled: legacy.enabled,
+                autoBan: {
+                    ...DEFAULT_AUTOMATION.autoBan,
+                    enabled: legacy.enabled,
+                    mode: legacy.mode === 'off' ? 'soft' : legacy.mode,
+                    method: legacy.method,
+                    cooldownMinutes: legacy.cooldownMinutes,
+                    maxAutoBansPerHour: legacy.maxAutoBansPerHour,
+                    whitelist: [...legacy.whitelist],
+                    ...thresholdsFromMode(legacy.mode === 'off' ? 'soft' : legacy.mode)
+                },
+                lastTickAt: legacy.lastTickAt,
+                lastTickNotes: legacy.lastTickNotes
+            };
+        }
+        const p = JSON.parse(raw);
+        const ab = p.autoBan ?? {};
+        const ap = p.autoPreset ?? {};
+        const mode = ab.mode || 'soft';
+        const th = mode === 'custom'
+            ? {
+                minScore: Number(ab.minScore) || 40,
+                minHits: Number(ab.minHits) || 60,
+                min429: Number(ab.min429) || 30,
+                minScan: Number(ab.minScan) || 12
+            }
+            : thresholdsFromMode(mode === 'off' ? 'soft' : mode);
+        return {
+            enabled: Boolean(p.enabled),
+            autoPreset: {
+                enabled: Boolean(ap.enabled),
+                escalateToHardenedAt: clamp(Number(ap.escalateToHardenedAt) || 20, 1, 99),
+                escalateToUnderAttackAt: clamp(Number(ap.escalateToUnderAttackAt) || 45, 1, 99),
+                suggestEmergencyAt: clamp(Number(ap.suggestEmergencyAt) || 85, 50, 100),
+                criticalAt: clamp(Number(ap.criticalAt) || 70, 30, 100),
+                deescalateEnabled: ap.deescalateEnabled !== false,
+                deescalateToDailyBelow: clamp(Number(ap.deescalateToDailyBelow) || 10, 0, 50),
+                holdMinutes: clamp(Number(ap.holdMinutes) || 15, 1, 240)
+            },
+            autoBan: {
+                enabled: Boolean(ab.enabled ?? legacy.enabled),
+                mode: mode === 'off' ? 'soft' : mode,
+                method: ab.method === 'ufw' || ab.method === 'both' ? ab.method : 'fail2ban',
+                minScore: clamp(Number(ab.minScore) || th.minScore, 1, 100),
+                minHits: clamp(Number(ab.minHits) || th.minHits, 1, 10_000),
+                min429: clamp(Number(ab.min429) || th.min429, 1, 10_000),
+                minScan: clamp(Number(ab.minScan) || th.minScan, 1, 10_000),
+                cooldownMinutes: clamp(Number(ab.cooldownMinutes) || legacy.cooldownMinutes || 60, 5, 24 * 60),
+                maxAutoBansPerHour: clamp(Number(ab.maxAutoBansPerHour) || legacy.maxAutoBansPerHour || 40, 1, 500),
+                intervalSeconds: clamp(Number(ab.intervalSeconds) || 120, 30, 600),
+                whitelist: Array.isArray(ab.whitelist)
+                    ? ab.whitelist.map(String).filter(Boolean).slice(0, 200)
+                    : [...legacy.whitelist],
+                syncFail2banIgnoreip: ab.syncFail2banIgnoreip !== false
+            },
+            signalWeights: {
+                ...DEFAULT_SIGNAL_WEIGHTS,
+                ...(p.signalWeights ?? {})
+            },
+            cloudflare: {
+                enabled: Boolean(p.cloudflare?.enabled),
+                zones: Array.isArray(p.cloudflare?.zones)
+                    ? p.cloudflare.zones.map(String).filter(Boolean).slice(0, 20)
+                    : [],
+                onAutoEscalate: p.cloudflare?.onAutoEscalate !== false,
+                ufwAllowOnlyCf: Boolean(p.cloudflare?.ufwAllowOnlyCf),
+                ufwKeepTcpPorts: Array.isArray(p.cloudflare?.ufwKeepTcpPorts)
+                    ? p.cloudflare.ufwKeepTcpPorts
+                        .map(Number)
+                        .filter((n) => Number.isInteger(n) && n > 0 && n < 65536)
+                        .slice(0, 20)
+                    : [22]
+            },
+            lastTickAt: p.lastTickAt,
+            lastTickNotes: p.lastTickNotes,
+            lastPresetChangeAt: p.lastPresetChangeAt,
+            lastPresetId: p.lastPresetId,
+            suggestEmergency: p.suggestEmergency
+        };
+    }
+    catch {
+        return {
+            ...DEFAULT_AUTOMATION,
+            autoBan: { ...DEFAULT_AUTOMATION.autoBan },
+            signalWeights: { ...DEFAULT_SIGNAL_WEIGHTS },
+            cloudflare: { ...DEFAULT_AUTOMATION.cloudflare }
+        };
+    }
+}
+function thresholdsFromMode(mode) {
+    return modeThresholds(mode);
+}
+export function saveDefenseAutomation(db, policy) {
+    const next = {
+        ...policy,
+        autoBan: {
+            ...policy.autoBan,
+            whitelist: (policy.autoBan.whitelist ?? []).map((s) => s.trim()).filter(Boolean).slice(0, 200),
+            intervalSeconds: clamp(policy.autoBan.intervalSeconds, 30, 600),
+            syncFail2banIgnoreip: policy.autoBan.syncFail2banIgnoreip !== false
+        },
+        signalWeights: { ...DEFAULT_SIGNAL_WEIGHTS, ...policy.signalWeights },
+        cloudflare: {
+            enabled: Boolean(policy.cloudflare?.enabled),
+            zones: (policy.cloudflare?.zones ?? []).map(String).filter(Boolean).slice(0, 20),
+            onAutoEscalate: policy.cloudflare?.onAutoEscalate !== false,
+            ufwAllowOnlyCf: Boolean(policy.cloudflare?.ufwAllowOnlyCf),
+            ufwKeepTcpPorts: (policy.cloudflare?.ufwKeepTcpPorts ?? [22])
+                .map(Number)
+                .filter((n) => Number.isInteger(n) && n > 0 && n < 65536)
+                .slice(0, 20)
+        }
+    };
+    // When mode is preset, sync numeric thresholds for UI clarity
+    if (next.autoBan.mode !== 'custom') {
+        const th = thresholdsFromMode(next.autoBan.mode === 'off' ? 'soft' : next.autoBan.mode);
+        next.autoBan = { ...next.autoBan, ...th };
+    }
+    db.snapshot.settings[AUTO_KEY] = JSON.stringify(next);
+    // Keep legacy auto-ban key in sync for old readers
+    updateAutoBanPolicy(db, {
+        enabled: next.enabled && next.autoBan.enabled,
+        mode: next.autoBan.mode === 'custom' ? 'normal' : next.autoBan.mode,
+        method: next.autoBan.method,
+        cooldownMinutes: next.autoBan.cooldownMinutes,
+        maxAutoBansPerHour: next.autoBan.maxAutoBansPerHour,
+        whitelist: next.autoBan.whitelist
+    });
+    db.persist();
+    return next;
+}
+/** Write defense whitelist into fail2ban ignoreip.txt under dataDir. */
+export function syncWhitelistToFail2banIgnore(dataDir, whitelist) {
+    const dir = join(dataDir, 'fail2ban');
+    mkdirSync(dir, { recursive: true });
+    const path = join(dir, 'ignoreip.txt');
+    const list = [
+        ...new Set(['127.0.0.1', '::1', ...whitelist.map((s) => s.trim()).filter(Boolean)]),
+    ];
+    writeFileSync(path, list.join('\n') + (list.length ? '\n' : ''), 'utf8');
+    return path;
+}
+export function updateDefenseAutomation(db, patch) {
+    const cur = loadDefenseAutomation(db);
+    return saveDefenseAutomation(db, {
+        ...cur,
+        ...patch,
+        autoPreset: { ...cur.autoPreset, ...patch.autoPreset },
+        autoBan: { ...cur.autoBan, ...patch.autoBan },
+        signalWeights: { ...cur.signalWeights, ...patch.signalWeights },
+        cloudflare: { ...cur.cloudflare, ...patch.cloudflare }
+    });
+}
+function loadPresetId(db) {
+    const v = db.snapshot.settings?.[PRESET_KEY];
+    if (v === 'hardened' || v === 'under_attack' || v === 'emergency' || v === 'daily')
+        return v;
+    return 'daily';
+}
+function pushTimeline(db, entry) {
+    let list = [];
+    try {
+        const raw = db.snapshot.settings?.[TIMELINE_KEY];
+        if (raw)
+            list = JSON.parse(raw);
+    }
+    catch {
+        list = [];
+    }
+    list.unshift(entry);
+    db.snapshot.settings[TIMELINE_KEY] = JSON.stringify(list.slice(0, 200));
+    db.persist();
+}
+function holdActive(db, holdMinutes) {
+    try {
+        const raw = db.snapshot.settings?.[HOLD_KEY];
+        if (!raw)
+            return false;
+        const h = JSON.parse(raw);
+        return Date.now() - new Date(h.at).getTime() < holdMinutes * 60_000;
+    }
+    catch {
+        return false;
+    }
+}
+function setHold(db, preset) {
+    db.snapshot.settings[HOLD_KEY] = JSON.stringify({
+        at: new Date().toISOString(),
+        preset
+    });
+    db.persist();
+}
+/**
+ * Desired preset from score (never returns emergency).
+ */
+export function desiredPresetFromScore(score, ap) {
+    if (score >= ap.escalateToUnderAttackAt)
+        return 'under_attack';
+    if (score >= ap.escalateToHardenedAt)
+        return 'hardened';
+    if (ap.deescalateEnabled && score < ap.deescalateToDailyBelow)
+        return 'daily';
+    return 'daily';
+}
+/**
+ * Full automation tick: signals → optional preset change → auto-ban.
+ */
+export async function runDefenseAutomationTick(input) {
+    const notes = [];
+    let automation = loadDefenseAutomation(input.db);
+    const threatThresholds = threatThresholdsFromAutoPreset(automation.autoPreset);
+    const sig = await collectDefenseSignals({
+        host: input.host,
+        requestCountLastMinute: input.requestCountLastMinute,
+        weights: automation.signalWeights,
+        threatThresholds
+    });
+    notes.push(tl('notes.auto.t0530', { v0: (sig.score), v1: (sig.threatLevel) }));
+    let presetChanged = false;
+    let preset = loadPresetId(input.db);
+    let suggestEmergency = false;
+    if (automation.enabled && automation.autoPreset.enabled) {
+        if (sig.score >= automation.autoPreset.suggestEmergencyAt) {
+            suggestEmergency = true;
+            notes.push(tl('notes.auto.n0596'));
+            pushTimeline(input.db, {
+                at: new Date().toISOString(),
+                kind: 'auto_suggest',
+                title: tl('notes.auto.n0824'),
+                detail: `score=${sig.score}`
+            });
+        }
+        const desired = desiredPresetFromScore(sig.score, automation.autoPreset);
+        const current = loadPresetId(input.db);
+        const rank = {
+            daily: 0,
+            hardened: 1,
+            under_attack: 2,
+            emergency: 3
+        };
+        // Escalate always if higher; de-escalate only if enabled and not in hold
+        const wantUp = rank[desired] > rank[current] && current !== 'emergency';
+        const wantDown = automation.autoPreset.deescalateEnabled &&
+            rank[desired] < rank[current] &&
+            current !== 'emergency' &&
+            !holdActive(input.db, automation.autoPreset.holdMinutes);
+        if (wantUp || wantDown) {
+            // Never auto emergency
+            const target = desired === 'emergency' ? 'under_attack' : desired;
+            if (target !== current) {
+                const r = await applyDefensePreset({
+                    host: input.host,
+                    db: input.db,
+                    dataDir: input.dataDir,
+                    preset: target,
+                    apply: true,
+                    enableAutoBan: false, // don't clobber automation policy
+                });
+                presetChanged = true;
+                preset = target;
+                setHold(input.db, target);
+                const appliedTag = r.applied
+                    ? tl('notes.auto.appliedTag')
+                    : r.blocked
+                        ? tl('notes.auto.writtenTag')
+                        : '';
+                notes.push(tl('notes.auto.t0531', { v0: getDefensePreset(target).label, v1: appliedTag }));
+                pushTimeline(input.db, {
+                    at: new Date().toISOString(),
+                    kind: 'auto_preset',
+                    title: tl('notes.auto.t0532', { v0: getDefensePreset(target).label }),
+                    detail: tl('notes.auto.tScoreFrom', {
+                        score: sig.score,
+                        from: getDefensePreset(current).label,
+                    }),
+                });
+                // Cloudflare Under Attack + optional CF-only UFW on escalate
+                if (target === 'under_attack' && wantUp && automation.cloudflare.enabled) {
+                    if (automation.cloudflare.onAutoEscalate && automation.cloudflare.zones.length) {
+                        const cf = await enableCloudflareUnderAttack({
+                            zones: automation.cloudflare.zones,
+                            dryRun: !input.host.executeEnabled()
+                        });
+                        notes.push(...cf.notes.slice(0, 4));
+                        pushTimeline(input.db, {
+                            at: new Date().toISOString(),
+                            kind: 'cloudflare_ua',
+                            title: cf.ok ? tl('notes.auto.n0089') : tl('notes.auto.n0088'),
+                            detail: cf.notes.slice(0, 2).join('; ')
+                        });
+                    }
+                    if (automation.cloudflare.ufwAllowOnlyCf) {
+                        const u = await writeAndMaybeApplyCfOnlyUfw({
+                            dataDir: input.dataDir,
+                            host: input.host,
+                            keepTcpPorts: automation.cloudflare.ufwKeepTcpPorts,
+                            apply: Boolean(input.host.executeEnabled() && input.host.isRoot())
+                        });
+                        notes.push(...u.notes.slice(0, 4));
+                    }
+                }
+            }
+        }
+        else if (holdActive(input.db, automation.autoPreset.holdMinutes) && wantDown === false) {
+            notes.push(tl('notes.auto.n1526'));
+        }
+    }
+    else if (!automation.enabled) {
+        notes.push(tl('notes.auto.n1333'));
+    }
+    let banned = [];
+    if (automation.enabled && automation.autoBan.enabled) {
+        // Apply custom thresholds into modeThresholds path via temporary policy
+        const legacy = {
+            enabled: true,
+            mode: automation.autoBan.mode === 'custom'
+                ? 'normal'
+                : automation.autoBan.mode === 'off'
+                    ? 'soft'
+                    : automation.autoBan.mode,
+            method: automation.autoBan.method,
+            cooldownMinutes: automation.autoBan.cooldownMinutes,
+            maxAutoBansPerHour: automation.autoBan.maxAutoBansPerHour,
+            whitelist: automation.autoBan.whitelist
+        };
+        saveAutoBanPolicy(input.db, {
+            ...loadAutoBanPolicy(input.db),
+            ...legacy,
+            enabled: true
+        });
+        // Monkey-patch: run tick with custom thresholds by temporarily overriding
+        // We inject custom thresholds via settings flag for runAutoBanTick
+        input.db.snapshot.settings.defense_auto_ban_custom_th = JSON.stringify({
+            minScore: automation.autoBan.minScore,
+            minHits: automation.autoBan.minHits,
+            min429: automation.autoBan.min429,
+            minScan: automation.autoBan.minScan
+        });
+        input.db.persist();
+        const banR = await runAutoBanTick({
+            host: input.host,
+            db: input.db,
+            dataDir: input.dataDir
+        });
+        banned = banR.banned;
+        notes.push(...banR.notes.slice(0, 6));
+    }
+    automation = saveDefenseAutomation(input.db, {
+        ...loadDefenseAutomation(input.db),
+        lastTickAt: new Date().toISOString(),
+        lastTickNotes: notes.slice(0, 16),
+        lastPresetChangeAt: presetChanged ? new Date().toISOString() : automation.lastPresetChangeAt,
+        lastPresetId: preset,
+        suggestEmergency
+    });
+    return {
+        ok: true,
+        notes,
+        score: sig.score,
+        threatLevel: sig.threatLevel,
+        preset,
+        presetChanged,
+        banned,
+        suggestEmergency,
+        automation
+    };
+}
+/**
+ * Mechanism table for UI — resolved at request time (never module-load tl freeze).
+ */
+export function getAutomationMechanismRows() {
+    return [
+        {
+            step: tl('notes.probe'),
+            mechanism: tl('notes.tpl.probeMech'),
+            tunable: tl('notes.tpl.probeTunable'),
+        },
+        {
+            step: tl('notes.auto.n1375'),
+            mechanism: tl('notes.auto.n1354'),
+            tunable: tl('notes.auto.n1519'),
+        },
+        {
+            step: tl('notes.auto.n1531'),
+            mechanism: tl('notes.auto.n1525'),
+            tunable: tl('notes.auto.n1332'),
+        },
+        {
+            step: tl('notes.auto.n1325'),
+            mechanism: 'fail2ban banip',
+            tunable: tl('notes.auto.n0906'),
+        },
+        {
+            step: tl('notes.auto.n1046'),
+            mechanism: 'UFW deny from',
+            tunable: 'method=ufw/both',
+        },
+        {
+            step: tl('notes.auto.n1202'),
+            mechanism: tl('notes.auto.n1044'),
+            tunable: 'maxAutoBansPerHour',
+        },
+        {
+            step: tl('notes.auto.n0030'),
+            mechanism: tl('notes.tpl.autoNever'),
+            tunable: tl('notes.tpl.autoManualEmergency'),
+        },
+    ];
+}
+/** @deprecated alias — prefer getAutomationMechanismRows() at request time */
+export const AUTOMATION_MECHANISM_ROWS = getAutomationMechanismRows;
+//# sourceMappingURL=automation.js.map

package/dist/hosting/defense/automation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"automation.js","sourceRoot":"","sources":["../../../src/hosting/defense/automation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,8BAA8B,EACV,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,QAAQ,GAAG,oBAAoB,CAAC;AACtC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AACxC,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAC3C,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AA0D5C,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,OAAO,EAAE,KAAK;IACd,UAAU,EAAE;QACV,OAAO,EAAE,KAAK;QACd,oBAAoB,EAAE,EAAE;QACxB,uBAAuB,EAAE,EAAE;QAC3B,kBAAkB,EAAE,EAAE;QACtB,UAAU,EAAE,EAAE;QACd,iBAAiB,EAAE,IAAI;QACvB,sBAAsB,EAAE,EAAE;QAC1B,WAAW,EAAE,EAAE;KAAE;IACnB,OAAO,EAAE;QACP,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,GAAG;QACZ,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,EAAE;QACX,eAAe,EAAE,EAAE;QACnB,kBAAkB,EAAE,EAAE;QACtB,eAAe,EAAE,GAAG;QACpB,SAAS,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC;QAC/B,oBAAoB,EAAE,IAAI;KAAE;IAC9B,aAAa,EAAE,EAAE,GAAG,sBAAsB,EAAE;IAC5C,UAAU,EAAE;QACV,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,EAAE;QACT,cAAc,EAAE,IAAI;QACpB,cAAc,EAAE,KAAK;QACrB,eAAe,EAAE,CAAC,EAAE,CAAC;KAAE;CAAE,CAAC;AAE9B,SAAS,KAAK,CAAC,CAAS,EAAE,EAAU,EAAE,EAAU;IAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,EAAa;IACjD,8CAA8C;IAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,GAAG,kBAAkB;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE;oBACP,GAAG,kBAAkB,CAAC,OAAO;oBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI;oBAClD,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,eAAe,EAAE,MAAM,CAAC,eAAe;oBACvC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;oBAC7C,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;oBAChC,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;iBAAE;gBACvE,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;aAAE,CAAC;QAC1C,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA+B,CAAC;QACxD,MAAM,EAAE,GAA0C,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;QAClE,MAAM,EAAE,GAA6C,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;QACxE,MAAM,IAAI,GAAI,EAAE,CAAC,IAA+B,IAAI,MAAM,CAAC;QAC3D,MAAM,EAAE,GACN,IAAI,KAAK,QAAQ;YACf,CAAC,CAAC;gBACE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE;gBACnC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE;gBACjC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE;gBAC/B,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE;aAAE;YACvC,CAAC,CAAC,kBAAkB,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzD,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3B,UAAU,EAAE;gBACV,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC;gBAC5B,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBACzE,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/E,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC;gBACvE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC;gBACvD,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,KAAK,KAAK;gBACjD,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7E,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC;aAAE;YAC5D,OAAO,EAAE;gBACP,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;gBAC9C,IAAI,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;gBACpC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,KAAK,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU;gBAC5E,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC;gBAC3D,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC;gBAC3D,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC;gBACxD,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC;gBAC3D,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;gBAC9F,kBAAkB,EAAE,KAAK,CACvB,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,kBAAkB,IAAI,EAAE,EAChE,CAAC,EACD,GAAG,CACJ;gBACD,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC;gBAClE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC;oBACpC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACxD,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;gBACzB,oBAAoB,EAAE,EAAE,CAAC,oBAAoB,KAAK,KAAK;aAAE;YAC3D,aAAa,EAAE;gBACb,GAAG,sBAAsB;gBACzB,GAAG,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC;aAAE;YAC9B,UAAU,EAAE;gBACV,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC;gBACvC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC;oBACvC,CAAC,CAAC,CAAC,CAAC,UAAW,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBAC9D,CAAC,CAAC,EAAE;gBACN,cAAc,EAAE,CAAC,CAAC,UAAU,EAAE,cAAc,KAAK,KAAK;gBACtD,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,cAAc,CAAC;gBACrD,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,eAAe,CAAC;oBAC3D,CAAC,CAAC,CAAC,CAAC,UAAW,CAAC,eAAe;yBAC1B,GAAG,CAAC,MAAM,CAAC;yBACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;yBACxD,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBACjB,CAAC,CAAC,CAAC,EAAE,CAAC;aAAE;YACZ,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;YACxC,YAAY,EAAE,CAAC,CAAC,YAA2C;YAC3D,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;SAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,GAAG,kBAAkB;YACrB,OAAO,EAAE,EAAE,GAAG,kBAAkB,CAAC,OAAO,EAAE;YAC1C,aAAa,EAAE,EAAE,GAAG,sBAAsB,EAAE;YAC5C,UAAU,EAAE,EAAE,GAAG,kBAAkB,CAAC,UAAU,EAAE;SAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAiB;IAM3C,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,EAAa,EACb,MAAyB;IAEzB,MAAM,IAAI,GAAsB;QAC9B,GAAG,MAAM;QACT,OAAO,EAAE;YACP,GAAG,MAAM,CAAC,OAAO;YACjB,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YAC9F,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,EAAE,GAAG,CAAC;YAC/D,oBAAoB,EAAE,MAAM,CAAC,OAAO,CAAC,oBAAoB,KAAK,KAAK;SAAE;QACvE,aAAa,EAAE,EAAE,GAAG,sBAAsB,EAAE,GAAG,MAAM,CAAC,aAAa,EAAE;QACrE,UAAU,EAAE;YACV,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC;YAC5C,KAAK,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAChF,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,cAAc,KAAK,KAAK;YAC3D,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC;YAC1D,eAAe,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,eAAe,IAAI,CAAC,EAAE,CAAC,CAAC;iBAC1D,GAAG,CAAC,MAAM,CAAC;iBACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;iBACxD,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SAAE;KAAE,CAAC;IACxB,8DAA8D;IAC9D,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;IAC5C,CAAC;IACD,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtD,mDAAmD;IACnD,mBAAmB,CAAC,EAAE,EAAE;QACtB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO;QAC7C,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;QACnE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;QAC3B,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe;QAC7C,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB;QACnD,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;KAAE,CAAC,CAAC;IACvC,EAAE,CAAC,OAAO,EAAE,CAAC;IACb,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,6BAA6B,CAAC,OAAe,EAAE,SAAmB;IAChF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACtC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG;QACX,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;KACpF,CAAC;IACF,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,EAAa,EACb,KAKC;IAED,MAAM,GAAG,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;IACtC,OAAO,qBAAqB,CAAC,EAAE,EAAE;QAC/B,GAAG,GAAG;QACN,GAAG,KAAK;QACR,UAAU,EAAE,EAAE,GAAG,GAAG,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,UAAU,EAAE;QACtD,OAAO,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE;QAC7C,aAAa,EAAE,EAAE,GAAG,GAAG,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,aAAa,EAAE;QAC/D,UAAU,EAAE,EAAE,GAAG,GAAG,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,UAAU,EAAE;KAAE,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,YAAY,CAAC,EAAa;IACjC,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,cAAc,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IAC7F,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CACnB,EAAa,EACb,KAAmE;IAEnE,IAAI,IAAI,GAAmC,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,GAAG;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACxE,EAAE,CAAC,OAAO,EAAE,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,EAAa,EAAE,WAAmB;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmC,CAAC;QAC5D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,WAAW,GAAG,MAAM,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,EAAa,EAAE,MAAuB;IACrD,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9C,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM;KAAE,CAAC,CAAC;IACZ,EAAE,CAAC,OAAO,EAAE,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAa,EACb,EAAmC;IAEnC,IAAI,KAAK,IAAI,EAAE,CAAC,uBAAuB;QAAE,OAAO,cAAc,CAAC;IAC/D,IAAI,KAAK,IAAI,EAAE,CAAC,oBAAoB;QAAE,OAAO,UAAU,CAAC;IACxD,IAAI,EAAE,CAAC,iBAAiB,IAAI,KAAK,GAAG,EAAE,CAAC,sBAAsB;QAAE,OAAO,OAAO,CAAC;IAC9E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAK9C;IAWC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjD,MAAM,gBAAgB,GAAG,8BAA8B,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC;QACtC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,OAAO,EAAE,UAAU,CAAC,aAAa;QACjC,gBAAgB;KAAE,CAAC,CAAC;IACtB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAE/E,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpC,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,IAAI,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxD,IAAI,GAAG,CAAC,KAAK,IAAI,UAAU,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;YAC1D,gBAAgB,GAAG,IAAI,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;YACnC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE;gBACrB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,IAAI,EAAE,cAAc;gBACpB,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;gBAC7B,MAAM,EAAE,SAAS,GAAG,CAAC,KAAK,EAAE;aAAE,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,IAAI,GAAoC;YAC5C,KAAK,EAAE,CAAC;YACR,QAAQ,EAAE,CAAC;YACX,YAAY,EAAE,CAAC;YACf,SAAS,EAAE,CAAC;SAAE,CAAC;QAEjB,yEAAyE;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,WAAW,CAAC;QACxE,MAAM,QAAQ,GACZ,UAAU,CAAC,UAAU,CAAC,iBAAiB;YACvC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;YAC7B,OAAO,KAAK,WAAW;YACvB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAE3D,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;YACvB,uBAAuB;YACvB,MAAM,MAAM,GAAG,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;YAClE,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC;oBACjC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,MAAM,EAAE,MAAM;oBACd,KAAK,EAAE,IAAI;oBACX,aAAa,EAAE,KAAK,EAAE,kCAAkC;iBACzD,CAAC,CAAC;gBACH,aAAa,GAAG,IAAI,CAAC;gBACrB,MAAM,GAAG,MAAM,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBAC1B,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO;oBAC1B,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC;oBAC7B,CAAC,CAAC,CAAC,CAAC,OAAO;wBACT,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC;wBAC7B,CAAC,CAAC,EAAE,CAAC;gBACT,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;gBAC3F,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE;oBACrB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC5B,IAAI,EAAE,aAAa;oBACnB,KAAK,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;oBACrE,MAAM,EAAE,EAAE,CAAC,uBAAuB,EAAE;wBAClC,KAAK,EAAE,GAAG,CAAC,KAAK;wBAChB,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK;qBACtC,CAAC;iBACH,CAAC,CAAC;gBACH,6DAA6D;gBAC7D,IAAI,MAAM,KAAK,cAAc,IAAI,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;oBACzE,IAAI,UAAU,CAAC,UAAU,CAAC,cAAc,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;wBAC/E,MAAM,EAAE,GAAG,MAAM,2BAA2B,CAAC;4BAC3C,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,KAAK;4BAClC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE;yBAAE,CAAC,CAAC;wBAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;wBACpC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE;4BACrB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;4BAC5B,IAAI,EAAE,eAAe;4BACrB,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;4BAC9D,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;yBAAE,CAAC,CAAC;oBAC/C,CAAC;oBACD,IAAI,UAAU,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;wBACzC,MAAM,CAAC,GAAG,MAAM,2BAA2B,CAAC;4BAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;4BACtB,IAAI,EAAE,KAAK,CAAC,IAAI;4BAChB,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,eAAe;4BACnD,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;yBAAE,CAAC,CAAC;wBACxE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBACrC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACzF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,IAAI,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrD,wEAAwE;QACxE,MAAM,MAAM,GAAkB;YAC5B,OAAO,EAAE,IAAI;YACb,IAAI,EACF,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAClC,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK;oBACjC,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI;YAC/B,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM;YACjC,eAAe,EAAE,UAAU,CAAC,OAAO,CAAC,eAAe;YACnD,kBAAkB,EAAE,UAAU,CAAC,OAAO,CAAC,kBAAkB;YACzD,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS;SAAE,CAAC;QAC5C,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE;YAC1B,GAAG,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,GAAG,MAAM;YACT,OAAO,EAAE,IAAI;SAAE,CAAC,CAAC;QAEnB,0EAA0E;QAC1E,mEAAmE;QACnE,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,0BAA0B,GAAG,IAAI,CAAC,SAAS,CAAC;YACrE,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ;YACrC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO;YACnC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM;YACjC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO;SAAE,CAAC,CAAC;QACzC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAEnB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC;YAChC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO;SAAE,CAAC,CAAC;QAC5B,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,EAAE,EAAE;QAC3C,GAAG,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACjC,kBAAkB,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,kBAAkB;QAC5F,YAAY,EAAE,MAAM;QACpB,gBAAgB;KAAE,CAAC,CAAC;IAEtB,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,MAAM;QACN,aAAa;QACb,MAAM;QACN,gBAAgB;QAChB,UAAU;KAAE,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B;IAKxC,OAAO;QACL;YACE,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC;YACvB,SAAS,EAAE,EAAE,CAAC,qBAAqB,CAAC;YACpC,OAAO,EAAE,EAAE,CAAC,wBAAwB,CAAC;SACtC;QACD;YACE,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC5B,SAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC;YACjC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC;SAChC;QACD;YACE,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC5B,SAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC;YACjC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC;SAChC;QACD;YACE,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC5B,SAAS,EAAE,gBAAgB;YAC3B,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC;SAChC;QACD;YACE,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC5B,SAAS,EAAE,eAAe;YAC1B,OAAO,EAAE,iBAAiB;SAC3B;QACD;YACE,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC5B,SAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC;YACjC,OAAO,EAAE,oBAAoB;SAC9B;QACD;YACE,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC5B,SAAS,EAAE,EAAE,CAAC,qBAAqB,CAAC;YACpC,OAAO,EAAE,EAAE,CAAC,+BAA+B,CAAC;SAC7C;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,yBAAyB,GAAG,0BAA0B,CAAC"}

package/dist/hosting/defense/cf-ufw.d.ts

@@ -0,0 +1,23 @@
+import type { HostExecutor } from '../../host/executor.js';
+/** Cloudflare published IPv4 ranges (origin-facing). */
+export declare const CLOUDFLARE_IPV4_RANGES: readonly ["173.245.48.0/20", "103.21.244.0/22", "103.22.200.0/22", "103.31.4.0/22", "141.101.64.0/18", "108.162.192.0/18", "190.93.240.0/20", "188.114.96.0/20", "197.234.240.0/22", "198.41.128.0/17", "162.158.0.0/15", "104.16.0.0/13", "104.24.0.0/14", "172.64.0.0/13", "131.0.72.0/22"];
+/** Cloudflare published IPv6 ranges — https://www.cloudflare.com/ips-v6 */
+export declare const CLOUDFLARE_IPV6_RANGES: readonly ["2400:cb00::/32", "2606:4700::/32", "2803:f800::/32", "2405:b500::/32", "2405:8100::/32", "2a06:98c0::/29", "2c0f:f248::/32"];
+export declare function renderCfOnlyUfwScript(opts?: {
+    keepTcpPorts?: number[];
+}): string;
+/**
+ * Write managed script under dataDir; optionally run when EXECUTE+root.
+ */
+export declare function writeAndMaybeApplyCfOnlyUfw(input: {
+    dataDir: string;
+    host: HostExecutor;
+    keepTcpPorts?: number[];
+    apply: boolean;
+}): Promise<{
+    ok: boolean;
+    written: string[];
+    notes: string[];
+    blocked?: boolean;
+}>;
+//# sourceMappingURL=cf-ufw.d.ts.map

package/dist/hosting/defense/cf-ufw.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cf-ufw.d.ts","sourceRoot":"","sources":["../../../src/hosting/defense/cf-ufw.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3D,wDAAwD;AACxD,eAAO,MAAM,sBAAsB,+RAgBzB,CAAC;AAEX,2EAA2E;AAC3E,eAAO,MAAM,sBAAsB,yIAQzB,CAAC;AAEX,wBAAgB,qBAAqB,CAAC,IAAI,CAAC,EAAE;IAC3C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB,GAAG,MAAM,CAyBT;AAED;;GAEG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA6ClF"}