ysk-server-core 1.0.0

package/dist/hosting/defense/geoip/lookup.js

@@ -0,0 +1,320 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Offline MMDB lookup — sapics / IPinfo Lite / DB-IP City Lite.
+ */
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import maxmind from 'maxmind';
+import { isPrivateOrLocalIp, isValidIp, normalizeIp } from '../../../net/ip.js';
+import { geoipDir, listGeoipSourceStatus } from './downloader.js';
+import { makeCityKey, makeRegionKey, normalizeAsn } from './types.js';
+let countryReader = null;
+let asnReader = null;
+let liteReader = null;
+let cityReader = null;
+let openedDir = null;
+function nameEn(obj) {
+    if (!obj || typeof obj !== 'object')
+        return undefined;
+    const o = obj;
+    const names = o.names;
+    if (names) {
+        if (typeof names.en === 'string' && names.en.trim())
+            return names.en.trim();
+        if (typeof names['zh-CN'] === 'string' && names['zh-CN'].trim())
+            return String(names['zh-CN']).trim();
+    }
+    return undefined;
+}
+function pickStr(obj, keys) {
+    if (!obj)
+        return undefined;
+    for (const k of keys) {
+        const v = obj[k];
+        if (typeof v === 'string' && v.trim())
+            return v.trim();
+        if (typeof v === 'number' && Number.isFinite(v))
+            return String(v);
+        if (v && typeof v === 'object') {
+            const o = v;
+            if (typeof o.iso_code === 'string')
+                return o.iso_code;
+            if (typeof o.code === 'string')
+                return o.code;
+            const n = nameEn(o);
+            if (n)
+                return n;
+        }
+    }
+    return undefined;
+}
+function pickNum(obj, keys) {
+    if (!obj)
+        return undefined;
+    for (const k of keys) {
+        const v = obj[k];
+        if (typeof v === 'number' && Number.isFinite(v))
+            return v;
+        if (typeof v === 'string' && v.trim() && !Number.isNaN(Number(v)))
+            return Number(v);
+        // nested location: { latitude, longitude }
+        if (v && typeof v === 'object') {
+            const o = v;
+            if (k === 'location' || k === 'latitude' || k === 'longitude') {
+                /* handled below */
+            }
+            if (typeof o.latitude === 'number' && keys.includes('latitude'))
+                return o.latitude;
+            if (typeof o.longitude === 'number' && keys.includes('longitude'))
+                return o.longitude;
+        }
+    }
+    return undefined;
+}
+/** MaxMind / DB-IP nested city record */
+function parseCityStyleRecord(rec) {
+    const countryObj = rec.country;
+    const contObj = rec.continent;
+    const cityObj = rec.city;
+    const loc = rec.location;
+    const subs = rec.subdivisions;
+    const sub0 = Array.isArray(subs) && subs[0] ? subs[0] : undefined;
+    return {
+        country: (typeof countryObj?.iso_code === 'string' ? countryObj.iso_code : undefined) ||
+            pickStr(rec, ['country_code', 'country']),
+        countryName: nameEn(countryObj) || pickStr(rec, ['country_name']),
+        continent: (typeof contObj?.code === 'string' ? contObj.code : undefined) ||
+            pickStr(rec, ['continent_code', 'continent']),
+        continentName: nameEn(contObj),
+        regionCode: (typeof sub0?.iso_code === 'string' ? sub0.iso_code : undefined) ||
+            pickStr(rec, ['stateprov_code', 'region_code']),
+        regionName: nameEn(sub0) ||
+            pickStr(rec, ['stateprov', 'region', 'state', 'province']),
+        city: nameEn(cityObj) || pickStr(rec, ['city', 'city_name']),
+        latitude: typeof loc?.latitude === 'number'
+            ? loc.latitude
+            : pickNum(rec, ['latitude', 'lat']),
+        longitude: typeof loc?.longitude === 'number'
+            ? loc.longitude
+            : pickNum(rec, ['longitude', 'lon', 'lng'])
+    };
+}
+async function openReaders(dataDir) {
+    const dir = geoipDir(dataDir);
+    if (openedDir === dir &&
+        (liteReader || countryReader || asnReader || cityReader)) {
+        return;
+    }
+    countryReader = null;
+    asnReader = null;
+    liteReader = null;
+    cityReader = null;
+    openedDir = dir;
+    const paths = {
+        lite: join(dir, 'ipinfo_lite.mmdb'),
+        country: join(dir, 'user-country.mmdb'),
+        asn: join(dir, 'origin-asn.mmdb'),
+        city: join(dir, 'dbip-city-lite.mmdb')
+    };
+    try {
+        if (existsSync(paths.lite))
+            liteReader = await maxmind.open(paths.lite);
+    }
+    catch {
+        liteReader = null;
+    }
+    try {
+        if (existsSync(paths.country))
+            countryReader = await maxmind.open(paths.country);
+    }
+    catch {
+        countryReader = null;
+    }
+    try {
+        if (existsSync(paths.asn))
+            asnReader = await maxmind.open(paths.asn);
+    }
+    catch {
+        asnReader = null;
+    }
+    try {
+        if (existsSync(paths.city))
+            cityReader = await maxmind.open(paths.city);
+    }
+    catch {
+        cityReader = null;
+    }
+}
+export function resetGeoipReaders() {
+    countryReader = null;
+    asnReader = null;
+    liteReader = null;
+    cityReader = null;
+    openedDir = null;
+}
+export async function lookupIp(dataDir, ip) {
+    const notes = [];
+    const trimmed = normalizeIp(ip.trim()) ?? ip.trim();
+    if (!trimmed) {
+        return { ip: '', ok: false, notes: [tl('notes.auto.n1415')] };
+    }
+    if (!isValidIp(trimmed)) {
+        return { ip: trimmed, ok: false, notes: [tl('notes.invalidIp46')] };
+    }
+    if (isPrivateOrLocalIp(trimmed)) {
+        return {
+            ip: trimmed,
+            ok: true,
+            country: 'ZZ',
+            countryName: 'Private/Local',
+            notes: [tl('notes.auto.n1294')]
+        };
+    }
+    await openReaders(dataDir);
+    const status = listGeoipSourceStatus(dataDir);
+    if (!liteReader && !countryReader && !asnReader && !cityReader) {
+        return {
+            ip: trimmed,
+            ok: false,
+            notes: [
+                tl('notes.auto.n0702'),
+                `provider=${status.provider}`,
+            ]
+        };
+    }
+    let country;
+    let countryName;
+    let continent;
+    let continentName;
+    let regionCode;
+    let regionName;
+    let city;
+    let latitude;
+    let longitude;
+    let accuracyRadiusKm;
+    let asn;
+    let asName;
+    let asDomain;
+    let source = status.provider;
+    try {
+        if (cityReader) {
+            const rec = cityReader.get(trimmed);
+            if (rec) {
+                const c = parseCityStyleRecord(rec);
+                country = c.country ?? country;
+                countryName = c.countryName ?? countryName;
+                continent = c.continent ?? continent;
+                continentName = c.continentName ?? continentName;
+                regionCode = c.regionCode ?? regionCode;
+                regionName = c.regionName ?? regionName;
+                city = c.city ?? city;
+                latitude = c.latitude ?? latitude;
+                longitude = c.longitude ?? longitude;
+                accuracyRadiusKm = pickNum(rec, ['accuracy_radius', 'radius']);
+                source = source.includes('dbip') ? source : `${source}+dbip`;
+            }
+        }
+        if (liteReader) {
+            const rec = liteReader.get(trimmed);
+            if (rec) {
+                country =
+                    pickStr(rec, ['country_code', 'country', 'country_iso_code']) ?? country;
+                countryName = pickStr(rec, ['country_name', 'country']) ?? countryName;
+                continent =
+                    pickStr(rec, ['continent_code', 'continent']) ?? continent;
+                continentName =
+                    pickStr(rec, ['continent_name', 'continent']) ?? continentName;
+                const rawAsn = pickStr(rec, ['asn', 'as_number', 'autonomous_system_number']);
+                if (rawAsn)
+                    asn = normalizeAsn(rawAsn);
+                asName =
+                    pickStr(rec, ['as_name', 'as_org', 'autonomous_system_organization', 'name']) ??
+                        asName;
+                asDomain = pickStr(rec, ['as_domain', 'domain']) ?? asDomain;
+                if (!source.includes('ipinfo'))
+                    source = `${source}+ipinfo`;
+            }
+        }
+        if (countryReader && !country) {
+            const rec = countryReader.get(trimmed);
+            if (rec) {
+                country =
+                    pickStr(rec, ['country_code', 'country', 'country_iso_code', 'iso_code']) ??
+                        (typeof rec === 'string' ? rec : undefined);
+                if (!country) {
+                    const first = Object.values(rec).find((v) => typeof v === 'string' && /^[A-Z]{2}$/i.test(v));
+                    if (typeof first === 'string')
+                        country = first.toUpperCase();
+                }
+            }
+        }
+        if (asnReader && !asn) {
+            const rec = asnReader.get(trimmed);
+            if (rec) {
+                const rawAsn = pickStr(rec, [
+                    'autonomous_system_number',
+                    'asn',
+                    'as_number',
+                    'as',
+                ]);
+                if (rawAsn)
+                    asn = normalizeAsn(rawAsn);
+                asName =
+                    pickStr(rec, [
+                        'autonomous_system_organization',
+                        'as_name',
+                        'as_org',
+                        'organization',
+                        'name',
+                    ]) ?? asName;
+            }
+        }
+    }
+    catch (e) {
+        notes.push(e instanceof Error ? e.message : String(e));
+        return { ip: trimmed, ok: false, notes };
+    }
+    if (country)
+        country = country.toUpperCase();
+    if (continent)
+        continent = continent.toUpperCase();
+    if (regionCode)
+        regionCode = regionCode.toUpperCase().replace(/[^A-Z0-9]/g, '');
+    const regionKey = makeRegionKey(country, regionCode, regionName);
+    const cityKey = makeCityKey(country, city);
+    if (!cityReader) {
+        notes.push(tl('notes.auto.n0977'));
+    }
+    if (!country && !asn && !city && !regionName) {
+        notes.push(tl('notes.auto.n0818'));
+        return { ip: trimmed, ok: false, notes, source };
+    }
+    let confidenceHint = 'country';
+    if (city)
+        confidenceHint = 'city';
+    else if (regionKey || regionName)
+        confidenceHint = 'region';
+    return {
+        ip: trimmed,
+        country,
+        countryName,
+        continent,
+        continentName,
+        regionCode,
+        regionName,
+        regionKey,
+        city,
+        cityKey,
+        latitude,
+        longitude,
+        accuracyRadiusKm,
+        asn,
+        asName,
+        asDomain,
+        source,
+        ok: true,
+        notes,
+        confidenceHint
+    };
+}
+//# sourceMappingURL=lookup.js.map

package/dist/hosting/defense/geoip/lookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lookup.js","sourceRoot":"","sources":["../../../../src/hosting/defense/geoip/lookup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,OAAwB,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAKtE,IAAI,aAAa,GAA0B,IAAI,CAAC;AAChD,IAAI,SAAS,GAA0B,IAAI,CAAC;AAC5C,IAAI,UAAU,GAA0B,IAAI,CAAC;AAC7C,IAAI,UAAU,GAA0B,IAAI,CAAC;AAC7C,IAAI,SAAS,GAAkB,IAAI,CAAC;AAEpC,SAAS,MAAM,CAAC,GAAY;IAC1B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,CAAC,GAAG,GAAa,CAAC;IACxB,MAAM,KAAK,GAAG,CAAC,CAAC,KAA2B,CAAC;IAC5C,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC5E,IAAI,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;YAC7D,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,OAAO,CAAC,GAA8B,EAAE,IAAc;IAC7D,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAW,CAAC;YACtB,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;YACtD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,OAAO,CAAC,GAA8B,EAAE,IAAc;IAC7D,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QACpF,2CAA2C;QAC3C,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAW,CAAC;YACtB,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;gBAC9D,mBAAmB;YACrB,CAAC;YACD,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;YACnF,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,OAAO,CAAC,CAAC,SAAS,CAAC;QACxF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,yCAAyC;AACzC,SAAS,oBAAoB,CAAC,GAAW;IAWvC,MAAM,UAAU,GAAG,GAAG,CAAC,OAA6B,CAAC;IACrD,MAAM,OAAO,GAAG,GAAG,CAAC,SAA+B,CAAC;IACpD,MAAM,OAAO,GAAG,GAAG,CAAC,IAA0B,CAAC;IAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,QAA8B,CAAC;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAoC,CAAC;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9E,OAAO;QACL,OAAO,EACL,CAAC,OAAO,UAAU,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5E,OAAO,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAC3C,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;QACjE,SAAS,EACP,CAAC,OAAO,OAAO,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9D,OAAO,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAC/C,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC;QAC9B,UAAU,EACR,CAAC,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,OAAO,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QACjD,UAAU,EACR,MAAM,CAAC,IAAI,CAAC;YACZ,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAC5D,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5D,QAAQ,EACN,OAAO,GAAG,EAAE,QAAQ,KAAK,QAAQ;YAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ;YACd,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACvC,SAAS,EACP,OAAO,GAAG,EAAE,SAAS,KAAK,QAAQ;YAChC,CAAC,CAAC,GAAG,CAAC,SAAS;YACf,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;KAAE,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IACE,SAAS,KAAK,GAAG;QACjB,CAAC,UAAU,IAAI,aAAa,IAAI,SAAS,IAAI,UAAU,CAAC,EACxD,CAAC;QACD,OAAO;IACT,CAAC;IAED,aAAa,GAAG,IAAI,CAAC;IACrB,SAAS,GAAG,IAAI,CAAC;IACjB,UAAU,GAAG,IAAI,CAAC;IAClB,UAAU,GAAG,IAAI,CAAC;IAClB,SAAS,GAAG,GAAG,CAAC;IAEhB,MAAM,KAAK,GAAG;QACZ,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC;QACvC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC;QACjC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC;KAAE,CAAC;IAE3C,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAS,KAAK,CAAC,IAAI,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;YAC3B,aAAa,GAAG,MAAM,OAAO,CAAC,IAAI,CAAS,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAS,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAS,KAAK,CAAC,IAAI,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,aAAa,GAAG,IAAI,CAAC;IACrB,SAAS,GAAG,IAAI,CAAC;IACjB,UAAU,GAAG,IAAI,CAAC;IAClB,UAAU,GAAG,IAAI,CAAC;IAClB,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe,EAAE,EAAU;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,OAAO;YACX,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,eAAe;YAC5B,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAAE,CAAC;IACtC,CAAC;IAED,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/D,OAAO;YACL,EAAE,EAAE,OAAO;YACX,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,EAAE,CAAC,kBAAkB,CAAC;gBACtB,YAAY,MAAM,CAAC,QAAQ,EAAE;aAC9B;SAAE,CAAC;IACR,CAAC;IAED,IAAI,OAA2B,CAAC;IAChC,IAAI,WAA+B,CAAC;IACpC,IAAI,SAA6B,CAAC;IAClC,IAAI,aAAiC,CAAC;IACtC,IAAI,UAA8B,CAAC;IACnC,IAAI,UAA8B,CAAC;IACnC,IAAI,IAAwB,CAAC;IAC7B,IAAI,QAA4B,CAAC;IACjC,IAAI,SAA6B,CAAC;IAClC,IAAI,gBAAoC,CAAC;IACzC,IAAI,GAAuB,CAAC;IAC5B,IAAI,MAA0B,CAAC;IAC/B,IAAI,QAA4B,CAAC;IACjC,IAAI,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;IAE7B,IAAI,CAAC;QACH,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;gBACpC,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC;gBAC/B,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,WAAW,CAAC;gBAC3C,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC;gBACrC,aAAa,GAAG,CAAC,CAAC,aAAa,IAAI,aAAa,CAAC;gBACjD,UAAU,GAAG,CAAC,CAAC,UAAU,IAAI,UAAU,CAAC;gBACxC,UAAU,GAAG,CAAC,CAAC,UAAU,IAAI,UAAU,CAAC;gBACxC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC;gBACtB,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC;gBAClC,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC;gBACrC,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC/D,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO;oBACL,OAAO,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC,IAAI,OAAO,CAAC;gBAC3E,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,IAAI,WAAW,CAAC;gBACvE,SAAS;oBACP,OAAO,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,IAAI,SAAS,CAAC;gBAC7D,aAAa;oBACX,OAAO,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,IAAI,aAAa,CAAC;gBACjE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,0BAA0B,CAAC,CAAC,CAAC;gBAC9E,IAAI,MAAM;oBAAE,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;gBACvC,MAAM;oBACJ,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,gCAAgC,EAAE,MAAM,CAAC,CAAC;wBAC7E,MAAM,CAAC;gBACT,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,QAAQ,CAAC;gBAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAAE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,IAAI,aAAa,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO;oBACL,OAAO,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC;wBACzE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CACtD,CAAC;oBACF,IAAI,OAAO,KAAK,KAAK,QAAQ;wBAAE,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC/D,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE;oBAC1B,0BAA0B;oBAC1B,KAAK;oBACL,WAAW;oBACX,IAAI;iBACL,CAAC,CAAC;gBACH,IAAI,MAAM;oBAAE,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;gBACvC,MAAM;oBACJ,OAAO,CAAC,GAAG,EAAE;wBACX,gCAAgC;wBAChC,SAAS;wBACT,QAAQ;wBACR,cAAc;wBACd,MAAM;qBACP,CAAC,IAAI,MAAM,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,OAAO;QAAE,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,SAAS;QAAE,SAAS,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,UAAU;QAAE,UAAU,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAEhF,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAE3C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,cAAc,GAAsC,SAAS,CAAC;IAClE,IAAI,IAAI;QAAE,cAAc,GAAG,MAAM,CAAC;SAC7B,IAAI,SAAS,IAAI,UAAU;QAAE,cAAc,GAAG,QAAQ,CAAC;IAE5D,OAAO;QACL,EAAE,EAAE,OAAO;QACX,OAAO;QACP,WAAW;QACX,SAAS;QACT,aAAa;QACb,UAAU;QACV,UAAU;QACV,SAAS;QACT,IAAI;QACJ,OAAO;QACP,QAAQ;QACR,SAAS;QACT,gBAAgB;QAChB,GAAG;QACH,MAAM;QACN,QAAQ;QACR,MAAM;QACN,EAAE,EAAE,IAAI;QACR,KAAK;QACL,cAAc;KAAE,CAAC;AACrB,CAAC"}

package/dist/hosting/defense/geoip/nginx-geo.d.ts

@@ -0,0 +1,19 @@
+import type { IpAccessPolicy } from './types.js';
+export declare function nginxGeoConfPath(dataDir: string): string;
+/**
+ * Generate conf that sets variables from MMDB when geoip2 module exists.
+ * Actual deny is done via map on $ysk_geo_block for server blocks that include it.
+ *
+ * Country/ASN allow|deny lists are encoded as maps; full IP→country still needs geoip2.
+ */
+export declare function renderNginxGeoConf(dataDir: string, policy: IpAccessPolicy): {
+    path: string;
+    body: string;
+    notes: string[];
+};
+export declare function writeNginxGeoConf(dataDir: string, policy: IpAccessPolicy): {
+    path: string;
+    notes: string[];
+    ok: boolean;
+};
+//# sourceMappingURL=nginx-geo.d.ts.map

package/dist/hosting/defense/geoip/nginx-geo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nginx-geo.d.ts","sourceRoot":"","sources":["../../../../src/hosting/defense/geoip/nginx-geo.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAGjD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CA4EA;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,cAAc,GACrB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,OAAO,CAAA;CAAE,CAQhD"}

package/dist/hosting/defense/geoip/nginx-geo.js

@@ -0,0 +1,94 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Best-effort nginx geoip2 snippet for managed conf.d.
+ * Requires ngx_http_geoip2_module; if absent, notes explain written ≠ applied.
+ */
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { geoipDir } from './downloader.js';
+export function nginxGeoConfPath(dataDir) {
+    return join(dataDir, 'nginx', 'conf.d', '01-ysk-geoip.conf');
+}
+/**
+ * Generate conf that sets variables from MMDB when geoip2 module exists.
+ * Actual deny is done via map on $ysk_geo_block for server blocks that include it.
+ *
+ * Country/ASN allow|deny lists are encoded as maps; full IP→country still needs geoip2.
+ */
+export function renderNginxGeoConf(dataDir, policy) {
+    const dir = geoipDir(dataDir);
+    const lite = join(dir, 'ipinfo_lite.mmdb');
+    const country = join(dir, 'user-country.mmdb');
+    const asn = join(dir, 'origin-asn.mmdb');
+    const mmdb = existsSync(lite) ? lite : existsSync(country) ? country : '';
+    const asnDb = existsSync(lite) ? lite : existsSync(asn) ? asn : '';
+    const notes = [
+        tl('notes.auto.n1566'),
+        tl('notes.auto.n1122'),
+    ];
+    const denyCountries = policy.mode === 'deny_list' ? policy.countries : [];
+    const allowCountries = policy.mode === 'allow_list' ? policy.countries : [];
+    const countryMapLines = policy.mode === 'deny_list'
+        ? denyCountries.map((c) => `    ${c} 1;`).join('\n')
+        : allowCountries.length
+            ? [
+                '    default 1;',
+                ...allowCountries.map((c) => `    ${c} 0;`),
+            ].join('\n')
+            : '    default 0;';
+    const body = `# YSK GeoIP access — managed (do not edit by hand)
+# policy enabled=${policy.enabled} mode=${policy.mode}
+# updated=${policy.updatedAt ?? 'n/a'}
+
+# geoip2 loads only if module present — nginx -t will fail otherwise; wrap carefully.
+# Operators: ensure "load_module modules/ngx_http_geoip2_module.so;" in main nginx.conf when using this.
+
+${mmdb
+        ? `# geoip2 ${mmdb} {
+#     auto_reload 24h;
+#     $ysk_geo_country country iso_code;
+#     $ysk_geo_continent continent code;
+# }
+`
+        : '# (no country mmdb on disk)\n'}
+
+${asnDb && asnDb !== mmdb
+        ? `# geoip2 ${asnDb} {
+#     auto_reload 24h;
+#     $ysk_geo_asn autonomous_system_number;
+# }
+`
+        : ''}
+
+# Map country code → block flag (1 = block)
+map $ysk_geo_country $ysk_geo_country_block {
+${countryMapLines}
+}
+
+# Master switch
+map $ysk_geo_country_block $ysk_geo_block {
+    default ${policy.enabled ? '0' : '0'};
+    1 ${policy.enabled ? '1' : '0'};
+}
+
+# Usage in server {}:
+#   if ($ysk_geo_block) { return 403; }
+# Or include a snippet after real_ip for Cloudflare.
+
+# Policy snapshot (informational)
+# countries=${policy.countries.join(',') || '-'}
+# continents=${policy.continents.join(',') || '-'}
+# asns=${policy.asns.join(',') || '-'}
+`;
+    return { path: nginxGeoConfPath(dataDir), body, notes };
+}
+export function writeNginxGeoConf(dataDir, policy) {
+    const confDir = join(dataDir, 'nginx', 'conf.d');
+    mkdirSync(confDir, { recursive: true });
+    const { path, body, notes } = renderNginxGeoConf(dataDir, policy);
+    writeFileSync(path, body, 'utf8');
+    notes.push(tl('notes.email.wrotePath', { path }));
+    notes.push(tl('notes.auto.n0470'));
+    return { path, notes, ok: true };
+}
+//# sourceMappingURL=nginx-geo.js.map

package/dist/hosting/defense/geoip/nginx-geo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nginx-geo.js","sourceRoot":"","sources":["../../../../src/hosting/defense/geoip/nginx-geo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,MAAsB;IAKxE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAEnE,MAAM,KAAK,GAAa;QACtB,EAAE,CAAC,kBAAkB,CAAC;QACtB,EAAE,CAAC,kBAAkB,CAAC;KACvB,CAAC;IAEF,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5E,MAAM,eAAe,GACnB,MAAM,CAAC,IAAI,KAAK,WAAW;QACzB,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACpD,CAAC,CAAC,cAAc,CAAC,MAAM;YACrB,CAAC,CAAC;gBACE,gBAAgB;gBAChB,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;aAC5C,CAAC,IAAI,CAAC,IAAI,CAAC;YACd,CAAC,CAAC,gBAAgB,CAAC;IAEzB,MAAM,IAAI,GAAG;mBACI,MAAM,CAAC,OAAO,SAAS,MAAM,CAAC,IAAI;YACzC,MAAM,CAAC,SAAS,IAAI,KAAK;;;;;EAMnC,IAAI;QACF,CAAC,CAAC,YAAY,IAAI;;;;;CAKrB;QACG,CAAC,CAAC,+BACN;;EAGE,KAAK,IAAI,KAAK,KAAK,IAAI;QACrB,CAAC,CAAC,YAAY,KAAK;;;;CAItB;QACG,CAAC,CAAC,EACN;;;;EAIE,eAAe;;;;;cAKH,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QAChC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;;;;;;;;cAQpB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG;eAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG;SACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG;CACpC,CAAC;IAEA,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,MAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClE,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC"}

package/dist/hosting/defense/geoip/policy.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Persist IP access policy (country / continent / region / city / ASN).
+ */
+import type { JsonStore } from '../../../db/store.js';
+import { type GeoLookupResult, type IpAccessPolicy } from './types.js';
+export declare function policyPath(dataDir: string): string;
+export declare function loadIpAccessPolicy(db: JsonStore, dataDir?: string): IpAccessPolicy;
+export declare function saveIpAccessPolicy(db: JsonStore, dataDir: string, patch: Partial<IpAccessPolicy>): IpAccessPolicy;
+export declare function sanitizePolicy(p: Partial<IpAccessPolicy>): IpAccessPolicy;
+/**
+ * Evaluate whether IP is blocked by policy given a lookup result.
+ * Match order (deny: any hit blocks): city → region → country → continent → asn
+ */
+export declare function evaluateIpAccess(lookup: GeoLookupResult, policy: IpAccessPolicy, opts?: {
+    whitelisted?: boolean;
+}): {
+    blocked: boolean;
+    reason?: string;
+    matched: string[];
+};
+//# sourceMappingURL=policy.d.ts.map

package/dist/hosting/defense/geoip/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../../src/hosting/defense/geoip/policy.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAOL,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AAIpB,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,cAAc,CAyBlF;AAED,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,SAAS,EACb,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,GAC7B,cAAc,CAuBhB;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,cAAc,CA4BzE;AAwBD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,cAAc,EACtB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/B;IACD,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CA+CA"}

package/dist/hosting/defense/geoip/policy.js

@@ -0,0 +1,161 @@
+/**
+ * Persist IP access policy (country / continent / region / city / ASN).
+ */
+import { join } from 'node:path';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { DEFAULT_IP_ACCESS_POLICY, normalizeAsn, normalizeCityKey, normalizeContinent, normalizeCountry, normalizeRegionKey, } from './types.js';
+const SETTINGS_KEY = 'defense_ip_access';
+export function policyPath(dataDir) {
+    return join(dataDir, 'geoip', 'policy.json');
+}
+export function loadIpAccessPolicy(db, dataDir) {
+    try {
+        const raw = db.snapshot.settings?.[SETTINGS_KEY];
+        if (raw)
+            return sanitizePolicy(JSON.parse(raw));
+    }
+    catch {
+        /* fall through */
+    }
+    if (dataDir) {
+        try {
+            const p = policyPath(dataDir);
+            if (existsSync(p)) {
+                return sanitizePolicy(JSON.parse(readFileSync(p, 'utf8')));
+            }
+        }
+        catch {
+            /* default */
+        }
+    }
+    return {
+        ...DEFAULT_IP_ACCESS_POLICY,
+        countries: [],
+        continents: [],
+        regions: [],
+        cities: [],
+        asns: [],
+    };
+}
+export function saveIpAccessPolicy(db, dataDir, patch) {
+    const cur = loadIpAccessPolicy(db, dataDir);
+    const next = sanitizePolicy({
+        ...cur,
+        ...patch,
+        enforce: { ...cur.enforce, ...patch.enforce },
+        countries: patch.countries ?? cur.countries,
+        continents: patch.continents ?? cur.continents,
+        regions: patch.regions ?? cur.regions,
+        cities: patch.cities ?? cur.cities,
+        asns: patch.asns ?? cur.asns,
+        cityPolicyEnabled: patch.cityPolicyEnabled !== undefined
+            ? patch.cityPolicyEnabled
+            : cur.cityPolicyEnabled,
+        updatedAt: new Date().toISOString(),
+    });
+    db.snapshot.settings[SETTINGS_KEY] = JSON.stringify(next);
+    db.persist();
+    const dir = join(dataDir, 'geoip');
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(policyPath(dataDir), JSON.stringify(next, null, 2), 'utf8');
+    return next;
+}
+export function sanitizePolicy(p) {
+    return {
+        enabled: Boolean(p.enabled),
+        mode: p.mode === 'allow_list' ? 'allow_list' : 'deny_list',
+        countries: [...new Set((p.countries ?? []).map(normalizeCountry).filter(Boolean))].slice(0, 80),
+        continents: [
+            ...new Set((p.continents ?? []).map(normalizeContinent).filter(Boolean)),
+        ].slice(0, 16),
+        regions: [
+            ...new Set((p.regions ?? []).map(normalizeRegionKey).filter(Boolean)),
+        ].slice(0, 200),
+        cities: [...new Set((p.cities ?? []).map(normalizeCityKey).filter(Boolean))].slice(0, 100),
+        cityPolicyEnabled: Boolean(p.cityPolicyEnabled),
+        asns: [...new Set((p.asns ?? []).map(normalizeAsn).filter(Boolean))].slice(0, 100),
+        enforce: {
+            autoBan: p.enforce?.autoBan !== false,
+            nginx: p.enforce?.nginx !== false,
+            ufw: Boolean(p.enforce?.ufw),
+        },
+        autoUpdate: p.autoUpdate !== false,
+        updatedAt: p.updatedAt,
+    };
+}
+/** Loose region match: US-CA ↔ California / US-CALIFORNIA */
+function matchRegion(policyRegions, lookup) {
+    const key = lookup.regionKey?.toUpperCase();
+    if (key && policyRegions.includes(key))
+        return key;
+    const cc = lookup.country?.toUpperCase();
+    const name = (lookup.regionName || '')
+        .toUpperCase()
+        .replace(/[^A-Z0-9]/g, '');
+    const code = (lookup.regionCode || '').toUpperCase().replace(/[^A-Z0-9]/g, '');
+    for (const r of policyRegions) {
+        const pr = r.toUpperCase();
+        if (key && pr === key)
+            return r;
+        if (cc && pr.startsWith(`${cc}-`)) {
+            const rest = pr.slice(3);
+            if (code && rest === code)
+                return r;
+            if (name && (name === rest || name.startsWith(rest) || rest.startsWith(name.slice(0, 4))))
+                return r;
+        }
+    }
+    return null;
+}
+/**
+ * Evaluate whether IP is blocked by policy given a lookup result.
+ * Match order (deny: any hit blocks): city → region → country → continent → asn
+ */
+export function evaluateIpAccess(lookup, policy, opts) {
+    if (opts?.whitelisted) {
+        return { blocked: false, reason: 'whitelist', matched: ['whitelist'] };
+    }
+    if (!policy.enabled) {
+        return { blocked: false, reason: 'policy_disabled', matched: [] };
+    }
+    const matched = [];
+    const cc = lookup.country?.toUpperCase();
+    const cont = lookup.continent?.toUpperCase();
+    const asn = lookup.asn ? normalizeAsn(lookup.asn) : '';
+    const cityKey = lookup.cityKey;
+    const regionHit = matchRegion(policy.regions, lookup);
+    if (policy.cityPolicyEnabled && cityKey && policy.cities.includes(cityKey)) {
+        matched.push(`city:${cityKey}`);
+    }
+    if (regionHit) {
+        matched.push(`region:${regionHit}`);
+    }
+    if (cc && policy.countries.includes(cc))
+        matched.push(`country:${cc}`);
+    if (cont && policy.continents.includes(cont))
+        matched.push(`continent:${cont}`);
+    if (asn && policy.asns.includes(asn))
+        matched.push(`asn:${asn}`);
+    if (policy.mode === 'deny_list') {
+        if (matched.length === 0)
+            return { blocked: false, matched: [] };
+        return { blocked: true, reason: 'deny_list', matched };
+    }
+    const hasRules = policy.countries.length +
+        policy.continents.length +
+        policy.regions.length +
+        (policy.cityPolicyEnabled ? policy.cities.length : 0) +
+        policy.asns.length >
+        0;
+    if (!hasRules) {
+        return { blocked: false, reason: 'allow_list_empty', matched: [] };
+    }
+    if (matched.length > 0) {
+        return { blocked: false, reason: 'allow_list_match', matched };
+    }
+    if (!cc && !cont && !asn && !lookup.regionKey && !cityKey) {
+        return { blocked: true, reason: 'allow_list_unknown', matched: ['unknown'] };
+    }
+    return { blocked: true, reason: 'allow_list_miss', matched: [] };
+}
+//# sourceMappingURL=policy.js.map

package/dist/hosting/defense/geoip/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../../src/hosting/defense/geoip/policy.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7E,OAAO,EACL,wBAAwB,EACxB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,GAGnB,MAAM,YAAY,CAAC;AAEpB,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAEzC,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EAAa,EAAE,OAAgB;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,GAAG;YAAE,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClB,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;IACH,CAAC;IACD,OAAO;QACL,GAAG,wBAAwB;QAC3B,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,EAAE;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,EAAa,EACb,OAAe,EACf,KAA8B;IAE9B,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,cAAc,CAAC;QAC1B,GAAG,GAAG;QACN,GAAG,KAAK;QACR,OAAO,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE;QAC7C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS;QAC3C,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO;QACrC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM;QAClC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI;QAC5B,iBAAiB,EACf,KAAK,CAAC,iBAAiB,KAAK,SAAS;YACnC,CAAC,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,GAAG,CAAC,iBAAiB;QAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1D,EAAE,CAAC,OAAO,EAAE,CAAC;IACb,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,CAA0B;IACvD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3B,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW;QAC1D,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CACtF,CAAC,EACD,EAAE,CACH;QACD,UAAU,EAAE;YACV,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;SACzE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,EAAE;YACP,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;SACtE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QACf,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAChF,CAAC,EACD,GAAG,CACJ;QACD,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAC/C,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QAClF,OAAO,EAAE;YACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK,KAAK;YACrC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,KAAK,KAAK;YACjC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC;SAC7B;QACD,UAAU,EAAE,CAAC,CAAC,UAAU,KAAK,KAAK;QAClC,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,SAAS,WAAW,CAAC,aAAuB,EAAE,MAAuB;IACnE,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC;IAC5C,IAAI,GAAG,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACnD,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;SACnC,WAAW,EAAE;SACb,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC/E,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3B,IAAI,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO,CAAC,CAAC;QAChC,IAAI,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,CAAC,CAAC;YACpC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACvF,OAAO,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAuB,EACvB,MAAsB,EACtB,IAAgC;IAMhC,IAAI,IAAI,EAAE,WAAW,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEtD,IAAI,MAAM,CAAC,iBAAiB,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,UAAU,SAAS,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACvE,IAAI,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAChF,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IAEjE,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,QAAQ,GACZ,MAAM,CAAC,SAAS,CAAC,MAAM;QACrB,MAAM,CAAC,UAAU,CAAC,MAAM;QACxB,MAAM,CAAC,OAAO,CAAC,MAAM;QACrB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,MAAM;QACpB,CAAC,CAAC;IACJ,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACnE,CAAC"}