ysk-server-core 1.0.0

package/dist/hosting/defense/cf-ufw.js

@@ -0,0 +1,108 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * UFW "Cloudflare only" profile — origin only accepts CF edge ranges + SSH.
+ * Static lists from https://www.cloudflare.com/ips-v4 and ips-v6 (refresh periodically).
+ * Last reviewed: 2026-07.
+ */
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+/** Cloudflare published IPv4 ranges (origin-facing). */
+export const CLOUDFLARE_IPV4_RANGES = [
+    '173.245.48.0/20',
+    '103.21.244.0/22',
+    '103.22.200.0/22',
+    '103.31.4.0/22',
+    '141.101.64.0/18',
+    '108.162.192.0/18',
+    '190.93.240.0/20',
+    '188.114.96.0/20',
+    '197.234.240.0/22',
+    '198.41.128.0/17',
+    '162.158.0.0/15',
+    '104.16.0.0/13',
+    '104.24.0.0/14',
+    '172.64.0.0/13',
+    '131.0.72.0/22',
+];
+/** Cloudflare published IPv6 ranges — https://www.cloudflare.com/ips-v6 */
+export const CLOUDFLARE_IPV6_RANGES = [
+    '2400:cb00::/32',
+    '2606:4700::/32',
+    '2803:f800::/32',
+    '2405:b500::/32',
+    '2405:8100::/32',
+    '2a06:98c0::/29',
+    '2c0f:f248::/32',
+];
+export function renderCfOnlyUfwScript(opts) {
+    const ports = (opts?.keepTcpPorts?.length ? opts.keepTcpPorts : [22]).filter((p) => Number.isInteger(p) && p > 0 && p < 65536);
+    const cfAllow = (cidr, v6) => [
+        `ufw allow from ${cidr} to any port 80 proto tcp comment 'ysk-cf-80${v6 ? '-v6' : ''}'`,
+        `ufw allow from ${cidr} to any port 443 proto tcp comment 'ysk-cf-443${v6 ? '-v6' : ''}'`,
+    ];
+    const lines = [
+        '#!/usr/bin/env bash',
+        '# Generated by YSK Defense — Cloudflare-only origin profile (IPv4 + IPv6)',
+        '# Review before running. Keeps SSH + CF edge ranges; denies other WAN ingress.',
+        '# Requires /etc/default/ufw IPV6=yes for dual-stack rules to stick.',
+        'set -euo pipefail',
+        'ufw --force reset || true',
+        'ufw default deny incoming',
+        'ufw default allow outgoing',
+        ...ports.map((p) => `ufw allow ${p}/tcp comment 'ysk-keep'`),
+        ...CLOUDFLARE_IPV4_RANGES.flatMap((cidr) => cfAllow(cidr, false)),
+        ...CLOUDFLARE_IPV6_RANGES.flatMap((cidr) => cfAllow(cidr, true)),
+        'ufw --force enable',
+        'ufw status numbered || true',
+        '',
+    ];
+    return lines.join('\n');
+}
+/**
+ * Write managed script under dataDir; optionally run when EXECUTE+root.
+ */
+export async function writeAndMaybeApplyCfOnlyUfw(input) {
+    const dir = join(input.dataDir, 'firewall');
+    mkdirSync(dir, { recursive: true });
+    const scriptPath = join(dir, 'ufw-cf-only.sh');
+    const body = renderCfOnlyUfwScript({ keepTcpPorts: input.keepTcpPorts });
+    writeFileSync(scriptPath, body, 'utf8');
+    const notes = [
+        tl('notes.auto.t0523', { v0: (scriptPath) }),
+        tl('notes.auto.t0524', { v0: ((input.keepTcpPorts ?? [22]).join(',')) }),
+        tl('notes.auto.t0525', { v0: (CLOUDFLARE_IPV4_RANGES.length) }),
+        tl('notes.auto.t0526', { v0: (CLOUDFLARE_IPV6_RANGES.length) }),
+        tl('notes.auto.n1423'),
+    ];
+    if (!input.apply) {
+        // Plan / written only — not blocked (operator chose not to apply)
+        return {
+            ok: true,
+            written: [scriptPath],
+            notes: [...notes, tl('notes.auto.n1225')],
+        };
+    }
+    if (!input.host.executeEnabled()) {
+        return {
+            ok: false,
+            written: [scriptPath],
+            notes: [...notes, tl('notes.auto.n1539')],
+            blocked: true,
+        };
+    }
+    if (!input.host.isRoot()) {
+        return {
+            ok: false,
+            written: [scriptPath],
+            notes: [...notes, tl('notes.auto.n1548')],
+            blocked: true,
+        };
+    }
+    const r = await input.host.runCommand(['bash', scriptPath], { timeoutMs: 60_000 });
+    const ok = r.exitCode === 0;
+    notes.push(ok
+        ? tl('notes.auto.n0753')
+        : tl('notes.auto.t0527', { v0: ((r.stderr || r.stdout || '').slice(0, 300)) }));
+    return { ok, written: [scriptPath], notes };
+}
+//# sourceMappingURL=cf-ufw.js.map

package/dist/hosting/defense/cf-ufw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cf-ufw.js","sourceRoot":"","sources":["../../../src/hosting/defense/cf-ufw.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,wDAAwD;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,eAAe;IACf,eAAe;IACf,eAAe;CACP,CAAC;AAEX,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;CACR,CAAC;AAEX,MAAM,UAAU,qBAAqB,CAAC,IAErC;IACC,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAC1E,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CACjD,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAW,EAAE,EAAE,CAAC;QAC7C,kBAAkB,IAAI,+CAA+C,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG;QACvF,kBAAkB,IAAI,iDAAiD,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG;KAC1F,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,qBAAqB;QACrB,2EAA2E;QAC3E,gFAAgF;QAChF,qEAAqE;QACrE,mBAAmB;QACnB,2BAA2B;QAC3B,2BAA2B;QAC3B,4BAA4B;QAC5B,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,yBAAyB,CAAC;QAC5D,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjE,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChE,oBAAoB;QACpB,6BAA6B;QAC7B,EAAE;KACH,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAKjD;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5C,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IACzE,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG;QACZ,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACxE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,EAAE,CAAC,kBAAkB,CAAC;KACvB,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,kEAAkE;QAClE,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,CAAC,UAAU,CAAC;YACrB,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAC1C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,CAAC,UAAU,CAAC;YACrB,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;YACzC,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,CAAC,UAAU,CAAC;YACrB,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;YACzC,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACnF,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC5B,KAAK,CAAC,IAAI,CACR,EAAE;QACA,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;QACxB,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CACjF,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC"}

package/dist/hosting/defense/cloudflare-ua.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Cloudflare Under Attack / security level API (Phase B).
+ * Uses CF_API_TOKEN — fail-closed when missing or API fails.
+ */
+export type CfSecurityLevel = 'off' | 'essentially_off' | 'low' | 'medium' | 'high' | 'under_attack';
+export type CfUnderAttackResult = {
+    ok: boolean;
+    dryRun: boolean;
+    requiresToken: boolean;
+    zone?: string;
+    zoneId?: string;
+    previousLevel?: string;
+    level?: CfSecurityLevel;
+    notes: string[];
+    errors: string[];
+};
+type CfFetch = (url: string, init?: {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    json: () => Promise<unknown>;
+}>;
+/**
+ * Set Cloudflare zone security_level (e.g. under_attack).
+ */
+export declare function setCloudflareSecurityLevel(input: {
+    zone: string;
+    level: CfSecurityLevel;
+    token?: string;
+    dryRun?: boolean;
+    fetchImpl?: CfFetch;
+}): Promise<CfUnderAttackResult>;
+/** Enable Under Attack mode for one or more zones. */
+export declare function enableCloudflareUnderAttack(input: {
+    zones: string[];
+    token?: string;
+    dryRun?: boolean;
+}): Promise<{
+    ok: boolean;
+    results: CfUnderAttackResult[];
+    notes: string[];
+}>;
+export declare function disableCloudflareUnderAttack(input: {
+    zones: string[];
+    /** restore level, default high */
+    level?: CfSecurityLevel;
+    token?: string;
+    dryRun?: boolean;
+}): Promise<{
+    ok: boolean;
+    results: CfUnderAttackResult[];
+    notes: string[];
+}>;
+export {};
+//# sourceMappingURL=cloudflare-ua.d.ts.map

package/dist/hosting/defense/cloudflare-ua.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-ua.d.ts","sourceRoot":"","sources":["../../../src/hosting/defense/cloudflare-ua.ts"],"names":[],"mappings":"AACA;;;GAGG;AAEH,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,iBAAiB,GACjB,KAAK,GACL,QAAQ,GACR,MAAM,GACN,cAAc,CAAC;AAEnB,MAAM,MAAM,mBAAmB,GAAG;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,KAAK,OAAO,GAAG,CACb,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KACxE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAAC;AAmC5E;;GAEG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAsH/B;AAED,sDAAsD;AACtD,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CAiBD;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kCAAkC;IAClC,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAkB5E"}

package/dist/hosting/defense/cloudflare-ua.js

@@ -0,0 +1,167 @@
+import { tl } from 'ysk-server-shared';
+const defaultFetch = async (url, init) => {
+    const res = await fetch(url, init);
+    return { ok: res.ok, status: res.status, json: () => res.json() };
+};
+function tokenFrom(explicit) {
+    return explicit?.trim() || process.env.CF_API_TOKEN?.trim() || undefined;
+}
+async function resolveZoneId(zoneName, token, fetchImpl) {
+    const url = `https://api.cloudflare.com/client/v4/zones?name=${encodeURIComponent(zoneName)}`;
+    const res = await fetchImpl(url, {
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+    });
+    const body = (await res.json());
+    if (!res.ok || !body.success || !body.result?.[0]?.id) {
+        return {
+            error: body.errors?.[0]?.message ||
+                tl('notes.auto.t0542', { v0: (zoneName), v1: (res.status) }),
+        };
+    }
+    return { zoneId: body.result[0].id };
+}
+/**
+ * Set Cloudflare zone security_level (e.g. under_attack).
+ */
+export async function setCloudflareSecurityLevel(input) {
+    const notes = [];
+    const zone = input.zone.trim().toLowerCase();
+    if (!zone) {
+        return {
+            ok: false,
+            dryRun: Boolean(input.dryRun),
+            requiresToken: true,
+            notes: [],
+            errors: [tl('notes.auto.n1576')],
+        };
+    }
+    const token = tokenFrom(input.token);
+    if (!token) {
+        return {
+            ok: false,
+            dryRun: true,
+            requiresToken: true,
+            zone,
+            level: input.level,
+            notes: [
+                tl('notes.auto.n0979'),
+                tl('notes.auto.t0543', { v0: (zone), v1: (input.level) }),
+            ],
+            errors: ['missing CF_API_TOKEN'],
+        };
+    }
+    if (input.dryRun) {
+        return {
+            ok: true,
+            dryRun: true,
+            requiresToken: false,
+            zone,
+            level: input.level,
+            notes: [tl('notes.auto.t0544', { v0: (zone), v1: (input.level) })],
+            errors: [],
+        };
+    }
+    const fetchImpl = input.fetchImpl ?? defaultFetch;
+    try {
+        const z = await resolveZoneId(zone, token, fetchImpl);
+        if (!z.zoneId) {
+            return {
+                ok: false,
+                dryRun: false,
+                requiresToken: false,
+                zone,
+                notes,
+                errors: [z.error || tl('notes.auto.n0485')],
+            };
+        }
+        // read current
+        let previousLevel;
+        try {
+            const cur = await fetchImpl(`https://api.cloudflare.com/client/v4/zones/${z.zoneId}/settings/security_level`, { headers: { Authorization: `Bearer ${token}` } });
+            const cj = (await cur.json());
+            previousLevel = cj.result?.value;
+        }
+        catch {
+            /* ignore */
+        }
+        const res = await fetchImpl(`https://api.cloudflare.com/client/v4/zones/${z.zoneId}/settings/security_level`, {
+            method: 'PATCH',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ value: input.level }),
+        });
+        const body = (await res.json());
+        if (!res.ok || !body.success) {
+            const msg = body.errors?.[0]?.message || `HTTP ${res.status}`;
+            return {
+                ok: false,
+                dryRun: false,
+                requiresToken: false,
+                zone,
+                zoneId: z.zoneId,
+                previousLevel,
+                notes,
+                errors: [msg],
+            };
+        }
+        notes.push(`Cloudflare ${zone}: security_level ${previousLevel ?? '?'} → ${body.result?.value ?? input.level}`);
+        return {
+            ok: true,
+            dryRun: false,
+            requiresToken: false,
+            zone,
+            zoneId: z.zoneId,
+            previousLevel,
+            level: body.result?.value || input.level,
+            notes,
+            errors: [],
+        };
+    }
+    catch (e) {
+        return {
+            ok: false,
+            dryRun: false,
+            requiresToken: false,
+            zone,
+            notes,
+            errors: [e instanceof Error ? e.message : String(e)],
+        };
+    }
+}
+/** Enable Under Attack mode for one or more zones. */
+export async function enableCloudflareUnderAttack(input) {
+    const results = [];
+    for (const zone of input.zones.slice(0, 20)) {
+        results.push(await setCloudflareSecurityLevel({
+            zone,
+            level: 'under_attack',
+            token: input.token,
+            dryRun: input.dryRun,
+        }));
+    }
+    return {
+        ok: results.some((r) => r.ok),
+        results,
+        notes: results.flatMap((r) => [...r.notes, ...r.errors.map((e) => `err: ${e}`)]).slice(0, 20),
+    };
+}
+export async function disableCloudflareUnderAttack(input) {
+    const level = input.level ?? 'high';
+    const results = [];
+    for (const zone of input.zones.slice(0, 20)) {
+        results.push(await setCloudflareSecurityLevel({
+            zone,
+            level,
+            token: input.token,
+            dryRun: input.dryRun,
+        }));
+    }
+    return {
+        ok: results.some((r) => r.ok),
+        results,
+        notes: results.flatMap((r) => r.notes).slice(0, 20),
+    };
+}
+//# sourceMappingURL=cloudflare-ua.js.map

package/dist/hosting/defense/cloudflare-ua.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-ua.js","sourceRoot":"","sources":["../../../src/hosting/defense/cloudflare-ua.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AA+BvC,MAAM,YAAY,GAAY,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,EAAsB,EAAE,CAAC;AACxF,CAAC,CAAC;AAEF,SAAS,SAAS,CAAC,QAAiB;IAClC,OAAO,QAAQ,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AAC3E,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAgB,EAChB,KAAa,EACb,SAAkB;IAElB,MAAM,GAAG,GAAG,mDAAmD,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC9F,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAClF,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;QACtD,OAAO;YACL,KAAK,EACH,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO;gBACzB,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;SAC/D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAMhD;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YAC7B,aAAa,EAAE,IAAI;YACnB,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SACjC,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI;YACZ,aAAa,EAAE,IAAI;YACnB,IAAI;YACJ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE;gBACL,EAAE,CAAC,kBAAkB,CAAC;gBACtB,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;aAC1D;YACD,MAAM,EAAE,CAAC,sBAAsB,CAAC;SACjC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,IAAI;YACZ,aAAa,EAAE,KAAK;YACpB,IAAI;YACJ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClE,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,YAAY,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,KAAK;gBACb,aAAa,EAAE,KAAK;gBACpB,IAAI;gBACJ,KAAK;gBACL,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,kBAAkB,CAAC,CAAC;aAC5C,CAAC;QACJ,CAAC;QACD,eAAe;QACf,IAAI,aAAiC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,8CAA8C,CAAC,CAAC,MAAM,0BAA0B,EAChF,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAClD,CAAC;YACF,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoC,CAAC;YACjE,aAAa,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,8CAA8C,CAAC,CAAC,MAAM,0BAA0B,EAChF;YACE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;SAC7C,CACF,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YAC9D,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,KAAK;gBACb,aAAa,EAAE,KAAK;gBACpB,IAAI;gBACJ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,aAAa;gBACb,KAAK;gBACL,MAAM,EAAE,CAAC,GAAG,CAAC;aACd,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CACR,cAAc,IAAI,oBAAoB,aAAa,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,CACpG,CAAC;QACF,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,KAAK;YACb,aAAa,EAAE,KAAK;YACpB,IAAI;YACJ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,aAAa;YACb,KAAK,EAAG,IAAI,CAAC,MAAM,EAAE,KAAyB,IAAI,KAAK,CAAC,KAAK;YAC7D,KAAK;YACL,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK;YACb,aAAa,EAAE,KAAK;YACpB,IAAI;YACJ,KAAK;YACL,MAAM,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SACrD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IAKC,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,MAAM,0BAA0B,CAAC;YAC/B,IAAI;YACJ,KAAK,EAAE,cAAc;YACrB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,OAAO;QACP,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;KAC9F,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAMlD;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC;IACpC,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,MAAM,0BAA0B,CAAC;YAC/B,IAAI;YACJ,KAAK;YACL,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,OAAO;QACP,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC"}

package/dist/hosting/defense/defense-service.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Defense Center service — status, presets, ban/unban.
+ */
+import type { HostExecutor } from '../../host/executor.js';
+import type { JsonStore } from '../../db/store.js';
+import type { DefenseApplyResult, DefensePresetId, DefenseStatus, BanEntry } from './types.js';
+export declare function listDefenseTimeline(db: JsonStore, hours?: number): Array<{
+    at: string;
+    kind: string;
+    title: string;
+    detail?: string;
+}>;
+export declare function getDefenseStatus(input: {
+    host: HostExecutor;
+    db: JsonStore;
+    dataDir: string;
+    requestCountLastMinute?: number;
+}): Promise<DefenseStatus>;
+export declare function applyDefensePreset(input: {
+    host: HostExecutor;
+    db: JsonStore;
+    dataDir: string;
+    preset: DefensePresetId;
+    /** false = preview only (still writes nothing if false) */
+    apply: boolean;
+    confirm?: string;
+    systemNginx?: boolean;
+    /** When true (default for hardened+), align auto-ban with preset suggestion */
+    enableAutoBan?: boolean;
+}): Promise<DefenseApplyResult>;
+export declare function defenseBanIp(input: {
+    host: HostExecutor;
+    db: JsonStore;
+    ip: string;
+    reason?: string;
+    method?: 'fail2ban' | 'ufw' | 'both';
+    jail?: string;
+    /**
+     * When false: dry-run plan only (CLI default).
+     * When true/undefined: attempt host ban (panel default = true path via omit or true).
+     * CLI should pass execute: true only with --execute.
+     */
+    execute?: boolean;
+}): Promise<{
+    ok: boolean;
+    notes: string[];
+    blocked?: boolean;
+    dryRun?: boolean;
+    plan?: string[];
+}>;
+export declare function defenseUnbanIp(input: {
+    host: HostExecutor;
+    db: JsonStore;
+    ip: string;
+    method?: 'fail2ban' | 'ufw' | 'both';
+    jail?: string;
+    /** false = dry-run (CLI default); omit/true = apply (panel) */
+    execute?: boolean;
+}): Promise<{
+    ok: boolean;
+    notes: string[];
+    blocked?: boolean;
+    dryRun?: boolean;
+    plan?: string[];
+}>;
+export declare function listDefenseBans(input: {
+    host: HostExecutor;
+    db: JsonStore;
+}): Promise<{
+    items: BanEntry[];
+    notes: string[];
+}>;
+/**
+ * One-shot stack apply: UFW plan + fail2ban jails for current defense preset.
+ * Honest: each step may block without YSK_EXECUTE/root; aggregate ok only if all executed ok.
+ */
+export declare function applyDefenseStack(input: {
+    host: HostExecutor;
+    db: JsonStore;
+    dataDir: string;
+    execute?: boolean;
+    actor?: string;
+}): Promise<{
+    ok: boolean;
+    executed: boolean;
+    blocked?: boolean;
+    notes: string[];
+    steps: Array<{
+        id: string;
+        ok: boolean;
+        notes: string[];
+    }>;
+    requiresExecute: boolean;
+    requiresRoot: boolean;
+}>;
+//# sourceMappingURL=defense-service.d.ts.map

package/dist/hosting/defense/defense-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defense-service.d.ts","sourceRoot":"","sources":["../../../src/hosting/defense/defense-service.ts"],"names":[],"mappings":"AACA;;GAEG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAenD,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,QAAQ,EAAE,MAAM,YAAY,CAAC;AAgC/B,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,SAAS,EACb,KAAK,SAAK,GACT,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAUrE;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,SAAS,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC,GAAG,OAAO,CAAC,aAAa,CAAC,CA0HzB;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,SAAS,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,eAAe,CAAC;IACxB,2DAA2D;IAC3D,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA+I9B;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE;IACxC,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,SAAS,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CAyED;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,SAAS,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,UAAU,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CAyDD;AAqBD,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,SAAS,CAAC;CACf,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA0BlD;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,SAAS,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC3D,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC,CAwFD"}