ysk-server-core 1.0.0

package/dist/hosting/defense/geoip/providers.d.ts

@@ -0,0 +1,30 @@
+/**
+ * GeoIP / ASN database providers — free-tier max = city lite (region + city).
+ */
+export type GeoipProviderId = 'sapics' | 'ipinfo' | 'dbip';
+export type GeoipDbKind = 'country' | 'asn' | 'lite' | 'city';
+export type GeoipSource = {
+    provider: GeoipProviderId;
+    kind: GeoipDbKind;
+    filename: string;
+    url: string;
+    license: string;
+    updateHint: string;
+    attribution: string;
+    /** Response may be gzip */
+    gzip?: boolean;
+};
+declare const DBIP_ATTR = "IP Geolocation by DB-IP (https://db-ip.com) \u00B7 CC BY 4.0";
+export declare function sapicsSources(): GeoipSource[];
+/** DB-IP City Lite — free, no key; country + state/prov + city + coords */
+export declare function dbipCityLiteSources(env?: NodeJS.ProcessEnv): GeoipSource[];
+export declare function ipinfoLiteSource(token: string): GeoipSource;
+/**
+ * Free max stack: sapics country+asn + DB-IP city lite (+ optional IPinfo lite).
+ */
+export declare function resolveGeoipSources(env?: NodeJS.ProcessEnv): {
+    provider: string;
+    sources: GeoipSource[];
+};
+export { DBIP_ATTR };
+//# sourceMappingURL=providers.d.ts.map

package/dist/hosting/defense/geoip/providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../../../src/hosting/defense/geoip/providers.ts"],"names":[],"mappings":"AACA;;GAEG;AAEH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE3D,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9D,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,2BAA2B;IAC3B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAKF,QAAA,MAAM,SAAS,iEAC4C,CAAC;AAE5D,wBAAgB,aAAa,IAAI,WAAW,EAAE,CAmB7C;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,EAAE,CAqCvF;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAU3D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB,CAwBA;AAED,OAAO,EAAE,SAAS,EAAE,CAAC"}

package/dist/hosting/defense/geoip/providers.js

@@ -0,0 +1,98 @@
+import { tl } from 'ysk-server-shared';
+const SAPICS_BASE = 'https://github.com/sapics/ip-location-db/releases/download/latest';
+const DBIP_ATTR = 'IP Geolocation by DB-IP (https://db-ip.com) · CC BY 4.0';
+export function sapicsSources() {
+    return [
+        {
+            provider: 'sapics',
+            kind: 'country',
+            filename: 'user-country.mmdb',
+            url: `${SAPICS_BASE}/user-country.mmdb`,
+            license: 'PDDL-1.0',
+            updateHint: tl('notes.auto.n0045'),
+            attribution: ''
+        },
+        {
+            provider: 'sapics',
+            kind: 'asn',
+            filename: 'origin-asn.mmdb',
+            url: `${SAPICS_BASE}/origin-asn.mmdb`,
+            license: 'PDDL-1.0',
+            updateHint: tl('notes.auto.n0045'),
+            attribution: ''
+        },
+    ];
+}
+/** DB-IP City Lite — free, no key; country + state/prov + city + coords */
+export function dbipCityLiteSources(env = process.env) {
+    const override = env.YSK_GEOIP_CITY_URL?.trim();
+    const now = new Date();
+    const y = now.getUTCFullYear();
+    const m = now.getUTCMonth() + 1; // 1-12
+    const ym = `${y}-${String(m).padStart(2, '0')}`;
+    const prev = m === 1 ? `${y - 1}-12` : `${y}-${String(m - 1).padStart(2, '0')}`;
+    const url = override ||
+        `https://download.db-ip.com/free/dbip-city-lite-${ym}.mmdb.gz`;
+    return [
+        {
+            provider: 'dbip',
+            kind: 'city',
+            filename: 'dbip-city-lite.mmdb',
+            url,
+            license: 'CC-BY-4.0',
+            updateHint: tl('notes.auto.t0772', { v0: (ym) }),
+            attribution: DBIP_ATTR,
+            gzip: !override || /\.gz(\?|$)/i.test(override),
+            // stash fallback month in url via custom field — handled in downloader
+        },
+        // Soft fallback source attempted only if primary fails (same dest file)
+        {
+            provider: 'dbip',
+            kind: 'city',
+            filename: 'dbip-city-lite.mmdb',
+            url: env.YSK_GEOIP_CITY_URL_FALLBACK?.trim() ||
+                `https://download.db-ip.com/free/dbip-city-lite-${prev}.mmdb.gz`,
+            license: 'CC-BY-4.0',
+            updateHint: tl('notes.auto.t0773', { v0: (prev) }),
+            attribution: DBIP_ATTR,
+            gzip: true
+        },
+    ];
+}
+export function ipinfoLiteSource(token) {
+    const t = encodeURIComponent(token.trim());
+    return {
+        provider: 'ipinfo',
+        kind: 'lite',
+        filename: 'ipinfo_lite.mmdb',
+        url: `https://ipinfo.io/data/ipinfo_lite.mmdb?token=${t}`,
+        license: 'CC-BY-SA-4.0',
+        updateHint: tl('notes.auto.n1045'),
+        attribution: 'IP address data powered by IPinfo (https://ipinfo.io)'
+    };
+}
+/**
+ * Free max stack: sapics country+asn + DB-IP city lite (+ optional IPinfo lite).
+ */
+export function resolveGeoipSources(env = process.env) {
+    const profile = (env.YSK_GEOIP_PROFILE || 'city_lite').toLowerCase();
+    const token = env.IPINFO_TOKEN?.trim() || env.YSK_IPINFO_TOKEN?.trim() || '';
+    const sources = [...sapicsSources()];
+    if (profile !== 'country_asn') {
+        // Only one city file: downloader will try primary then skip duplicate filename if ok
+        sources.push(...dbipCityLiteSources(env));
+    }
+    if (token) {
+        sources.push(ipinfoLiteSource(token));
+    }
+    const provider = profile === 'country_asn'
+        ? token
+            ? 'sapics+ipinfo'
+            : 'sapics'
+        : token
+            ? 'sapics+dbip+ipinfo'
+            : 'sapics+dbip';
+    return { provider, sources };
+}
+export { DBIP_ATTR };
+//# sourceMappingURL=providers.js.map

package/dist/hosting/defense/geoip/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../../../../src/hosting/defense/geoip/providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAqBvC,MAAM,WAAW,GACf,mEAAmE,CAAC;AAEtE,MAAM,SAAS,GACb,yDAAyD,CAAC;AAE5D,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL;YACE,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,mBAAmB;YAC7B,GAAG,EAAE,GAAG,WAAW,oBAAoB;YACvC,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAClC,WAAW,EAAE,EAAE;SAAE;QACnB;YACE,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,iBAAiB;YAC3B,GAAG,EAAE,GAAG,WAAW,kBAAkB;YACrC,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAClC,WAAW,EAAE,EAAE;SAAE;KACpB,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,CAAC,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC;IAC/B,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO;IACxC,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAEhF,MAAM,GAAG,GACP,QAAQ;QACR,kDAAkD,EAAE,UAAU,CAAC;IAEjE,OAAO;QACL;YACE,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,qBAAqB;YAC/B,GAAG;YACH,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;YAChD,WAAW,EAAE,SAAS;YACtB,IAAI,EAAE,CAAC,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC/C,uEAAuE;SACxE;QACD,wEAAwE;QACxE;YACE,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,qBAAqB;YAC/B,GAAG,EACD,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE;gBACvC,kDAAkD,IAAI,UAAU;YAClE,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,WAAW,EAAE,SAAS;YACtB,IAAI,EAAE,IAAI;SAAE;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,kBAAkB;QAC5B,GAAG,EAAE,iDAAiD,CAAC,EAAE;QACzD,OAAO,EAAE,cAAc;QACvB,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC;QAClC,WAAW,EAAE,uDAAuD;KAAE,CAAC;AAC3E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAItE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC7E,MAAM,OAAO,GAAkB,CAAC,GAAG,aAAa,EAAE,CAAC,CAAC;IAEpD,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,qFAAqF;QACrF,OAAO,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,QAAQ,GACZ,OAAO,KAAK,aAAa;QACvB,CAAC,CAAC,KAAK;YACL,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,QAAQ;QACZ,CAAC,CAAC,KAAK;YACL,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,aAAa,CAAC;IAEtB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,OAAO,EAAE,SAAS,EAAE,CAAC"}

package/dist/hosting/defense/geoip/types.d.ts

@@ -0,0 +1,102 @@
+/**
+ * GeoIP access policy + lookup types.
+ * Free tier max: country + region (province/state) + optional city + ASN.
+ */
+export type IpAccessMode = 'deny_list' | 'allow_list';
+export type IpAccessPolicy = {
+    enabled: boolean;
+    mode: IpAccessMode;
+    /** ISO 3166-1 alpha-2 */
+    countries: string[];
+    /** Continent codes: AS EU NA AF SA OC AN */
+    continents: string[];
+    /** Region keys: "CN-GD", "US-CA" */
+    regions: string[];
+    /**
+     * City keys: "CN|Guangzhou" (country|city). Only evaluated when cityPolicyEnabled.
+     */
+    cities: string[];
+    /** Default false — city is enrich-only unless user opts in */
+    cityPolicyEnabled: boolean;
+    /** ASN as "AS13335" or "13335" */
+    asns: string[];
+    enforce: {
+        autoBan: boolean;
+        nginx: boolean;
+        ufw: boolean;
+    };
+    autoUpdate: boolean;
+    updatedAt?: string;
+};
+export type GeoLookupResult = {
+    ip: string;
+    country?: string;
+    countryName?: string;
+    continent?: string;
+    continentName?: string;
+    regionCode?: string;
+    regionName?: string;
+    /** Policy key e.g. CN-GD */
+    regionKey?: string;
+    city?: string;
+    /** Policy key e.g. CN|Guangzhou */
+    cityKey?: string;
+    latitude?: number;
+    longitude?: number;
+    accuracyRadiusKm?: number;
+    asn?: string;
+    asName?: string;
+    asDomain?: string;
+    source?: string;
+    ok: boolean;
+    notes: string[];
+    confidenceHint?: 'country' | 'region' | 'city';
+};
+export type GeoipMetaFile = {
+    provider: string;
+    files: Array<{
+        filename: string;
+        url: string;
+        downloadedAt: string;
+        bytes: number;
+        etag?: string;
+        ok: boolean;
+        error?: string;
+    }>;
+    lastAttemptAt?: string;
+    lastSuccessAt?: string;
+    lastError?: string;
+    attribution?: string;
+};
+export type GeoipStatus = {
+    provider: string;
+    dir: string;
+    ready: boolean;
+    stale: boolean;
+    cityReady: boolean;
+    maxGranularity: 'country' | 'region' | 'city';
+    meta: GeoipMetaFile | null;
+    sources: Array<{
+        filename: string;
+        url: string;
+        license: string;
+        updateHint: string;
+        present: boolean;
+        mtime?: string;
+        bytes?: number;
+    }>;
+    attribution: string[];
+    policy: IpAccessPolicy;
+    notes: string[];
+};
+export declare const DEFAULT_IP_ACCESS_POLICY: IpAccessPolicy;
+export declare function normalizeAsn(raw: string): string;
+export declare function normalizeCountry(raw: string): string;
+export declare function normalizeContinent(raw: string): string;
+/** CN-GD / US-CA */
+export declare function normalizeRegionKey(raw: string): string;
+/** CN|Guangzhou */
+export declare function normalizeCityKey(raw: string): string;
+export declare function makeRegionKey(country?: string, regionCode?: string, regionName?: string): string | undefined;
+export declare function makeCityKey(country?: string, city?: string): string | undefined;
+//# sourceMappingURL=types.d.ts.map

package/dist/hosting/defense/geoip/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/hosting/defense/geoip/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,YAAY,CAAC;AAEtD,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IACnB,yBAAyB;IACzB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,oCAAoC;IACpC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;OAEG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8DAA8D;IAC9D,iBAAiB,EAAE,OAAO,CAAC;IAC3B,kCAAkC;IAClC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,EAAE;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,KAAK,EAAE,OAAO,CAAC;QACf,GAAG,EAAE,OAAO,CAAC;KACd,CAAC;IACF,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,EAAE,MAAM,CAAC;QACZ,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,EAAE,EAAE,OAAO,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,KAAK,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,cAetC,CAAC;AAEF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIhD;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIpD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAItD;AAED,oBAAoB;AACpB,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAKtD;AAED,mBAAmB;AACnB,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOpD;AAED,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAoB5G;AAED,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK/E"}

package/dist/hosting/defense/geoip/types.js

@@ -0,0 +1,89 @@
+/**
+ * GeoIP access policy + lookup types.
+ * Free tier max: country + region (province/state) + optional city + ASN.
+ */
+export const DEFAULT_IP_ACCESS_POLICY = {
+    enabled: false,
+    mode: 'deny_list',
+    countries: [],
+    continents: [],
+    regions: [],
+    cities: [],
+    cityPolicyEnabled: false,
+    asns: [],
+    enforce: {
+        autoBan: true,
+        nginx: true,
+        ufw: false,
+    },
+    autoUpdate: true,
+};
+export function normalizeAsn(raw) {
+    const s = raw.trim().toUpperCase().replace(/^AS/, '');
+    if (!/^\d+$/.test(s))
+        return '';
+    return `AS${s}`;
+}
+export function normalizeCountry(raw) {
+    const s = raw.trim().toUpperCase();
+    if (!/^[A-Z]{2}$/.test(s))
+        return '';
+    return s;
+}
+export function normalizeContinent(raw) {
+    const s = raw.trim().toUpperCase();
+    if (!/^[A-Z]{2}$/.test(s))
+        return '';
+    return s;
+}
+/** CN-GD / US-CA */
+export function normalizeRegionKey(raw) {
+    const s = raw.trim().toUpperCase().replace(/_/g, '-');
+    const m = /^([A-Z]{2})-([A-Z0-9]{1,8})$/.exec(s);
+    if (!m)
+        return '';
+    return `${m[1]}-${m[2]}`;
+}
+/** CN|Guangzhou */
+export function normalizeCityKey(raw) {
+    const s = raw.trim();
+    const m = /^([A-Za-z]{2})\|(.+)$/.exec(s);
+    if (!m)
+        return '';
+    const city = m[2].trim().replace(/\s+/g, ' ');
+    if (!city || city.length > 80)
+        return '';
+    return `${m[1].toUpperCase()}|${city}`;
+}
+export function makeRegionKey(country, regionCode, regionName) {
+    const cc = country ? normalizeCountry(country) : '';
+    if (!cc)
+        return undefined;
+    if (regionCode) {
+        const code = regionCode
+            .trim()
+            .toUpperCase()
+            .replace(/[^A-Z0-9]/g, '')
+            .slice(0, 8);
+        if (code)
+            return `${cc}-${code}`;
+    }
+    if (regionName) {
+        const slug = regionName
+            .trim()
+            .toUpperCase()
+            .replace(/[^A-Z0-9]+/g, '')
+            .slice(0, 12);
+        if (slug)
+            return `${cc}-${slug}`;
+    }
+    return undefined;
+}
+export function makeCityKey(country, city) {
+    const cc = country ? normalizeCountry(country) : '';
+    const c = city?.trim().replace(/\s+/g, ' ');
+    if (!cc || !c)
+        return undefined;
+    return `${cc}|${c}`;
+}
+//# sourceMappingURL=types.js.map

package/dist/hosting/defense/geoip/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/hosting/defense/geoip/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA8FH,MAAM,CAAC,MAAM,wBAAwB,GAAmB;IACtD,OAAO,EAAE,KAAK;IACd,IAAI,EAAE,WAAW;IACjB,SAAS,EAAE,EAAE;IACb,UAAU,EAAE,EAAE;IACd,OAAO,EAAE,EAAE;IACX,MAAM,EAAE,EAAE;IACV,iBAAiB,EAAE,KAAK;IACxB,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,GAAG,EAAE,KAAK;KACX;IACD,UAAU,EAAE,IAAI;CACjB,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,KAAK,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oBAAoB;AACpB,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3B,CAAC;AAED,mBAAmB;AACnB,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAgB,EAAE,UAAmB,EAAE,UAAmB;IACtF,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1B,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,UAAU;aACpB,IAAI,EAAE;aACN,WAAW,EAAE;aACb,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;aACzB,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACf,IAAI,IAAI;YAAE,OAAO,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,UAAU;aACpB,IAAI,EAAE;aACN,WAAW,EAAE;aACb,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;aAC1B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChB,IAAI,IAAI;YAAE,OAAO,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAgB,EAAE,IAAa;IACzD,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,CAAC,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;AACtB,CAAC"}

package/dist/hosting/defense/index.d.ts

@@ -0,0 +1,12 @@
+export * from './types.js';
+export * from './presets.js';
+export * from './nginx-limits.js';
+export * from './signals.js';
+export * from './defense-service.js';
+export * from './auto-ban.js';
+export * from './automation.js';
+export * from './cloudflare-ua.js';
+export * from './intel.js';
+export * from './cf-ufw.js';
+export * from './geoip/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/hosting/defense/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/hosting/defense/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC"}

package/dist/hosting/defense/index.js

@@ -0,0 +1,12 @@
+export * from './types.js';
+export * from './presets.js';
+export * from './nginx-limits.js';
+export * from './signals.js';
+export * from './defense-service.js';
+export * from './auto-ban.js';
+export * from './automation.js';
+export * from './cloudflare-ua.js';
+export * from './intel.js';
+export * from './cf-ufw.js';
+export * from './geoip/index.js';
+//# sourceMappingURL=index.js.map

package/dist/hosting/defense/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/hosting/defense/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC"}

package/dist/hosting/defense/intel.d.ts

@@ -0,0 +1,26 @@
+export type TopIpRow = {
+    ip: string;
+    hits: number;
+    s429: number;
+    scan: number;
+    score: number;
+};
+export type VhostDefenseRow = {
+    name: string;
+    path: string;
+    hasDefenseMarker: boolean;
+    bytes: number;
+};
+/** Parse sshd/auth failures into IP hit map extras (IPv4 + IPv6). */
+export declare function parseAuthFailIps(content: string): Map<string, number>;
+export declare function collectTopIps(dataDir: string, limit?: number): {
+    items: TopIpRow[];
+    notes: string[];
+};
+/** List managed nginx confs and whether YSK_DEFENSE marker is present. */
+export declare function listVhostDefenseMarkers(dataDir: string): {
+    items: VhostDefenseRow[];
+    withLimit: number;
+    total: number;
+};
+//# sourceMappingURL=intel.d.ts.map

package/dist/hosting/defense/intel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intel.d.ts","sourceRoot":"","sources":["../../../src/hosting/defense/intel.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,QAAQ,GAAG;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,OAAO,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAgDF,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAqBrE;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG;IAC1D,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAkCA;AAED,0EAA0E;AAC1E,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG;IACxD,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf,CAkBA"}

package/dist/hosting/defense/intel.js

@@ -0,0 +1,148 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Defense intel — top IPs, vhosts with rate-limit markers, richer log sources.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { parseAccessLogSuspects } from './auto-ban.js';
+import { extractIpsFromText, isPrivateOrLocalIp, isValidIp, normalizeIp } from '../../net/ip.js';
+function scoreFrom(hits, s429, scan) {
+    let s = 0;
+    if (hits >= 200)
+        s += 35;
+    else if (hits >= 100)
+        s += 25;
+    else if (hits >= 50)
+        s += 15;
+    else if (hits >= 20)
+        s += 8;
+    if (s429 >= 50)
+        s += 40;
+    else if (s429 >= 20)
+        s += 28;
+    else if (s429 >= 8)
+        s += 15;
+    if (scan >= 20)
+        s += 30;
+    else if (scan >= 8)
+        s += 18;
+    else if (scan >= 3)
+        s += 10;
+    return Math.min(100, s);
+}
+function readLogChunks(dataDir) {
+    const chunks = [];
+    for (const dir of [join(dataDir, 'nginx', 'logs'), '/var/log/nginx']) {
+        if (!existsSync(dir))
+            continue;
+        try {
+            for (const f of readdirSync(dir).filter((n) => n.includes('access')).slice(0, 10)) {
+                const p = join(dir, f);
+                try {
+                    if (!statSync(p).isFile())
+                        continue;
+                    const buf = readFileSync(p);
+                    chunks.push(buf.slice(Math.max(0, buf.length - 200_000)).toString('utf8'));
+                }
+                catch {
+                    /* */
+                }
+            }
+        }
+        catch {
+            /* */
+        }
+    }
+    for (const p of ['/var/log/nginx/access.log', '/var/log/auth.log', '/var/log/secure']) {
+        if (!existsSync(p))
+            continue;
+        try {
+            const buf = readFileSync(p);
+            chunks.push(buf.slice(Math.max(0, buf.length - 120_000)).toString('utf8'));
+        }
+        catch {
+            /* */
+        }
+    }
+    return chunks.join('\n');
+}
+/** Parse sshd/auth failures into IP hit map extras (IPv4 + IPv6). */
+export function parseAuthFailIps(content) {
+    const map = new Map();
+    for (const line of content.split('\n')) {
+        if (!/Failed password|Invalid user|authentication failure|Connection closed by/i.test(line))
+            continue;
+        // Prefer "from <ip>" then fall back to any public IP on the line
+        const fromM = line.match(/\bfrom\s+(\S+)/i) ||
+            line.match(/\brhost=(\S+)/i);
+        let ip = null;
+        if (fromM) {
+            const cand = fromM[1].replace(/[\[\],;]+$/g, '');
+            ip = normalizeIp(cand);
+        }
+        if (!ip) {
+            ip = extractIpsFromText(line).find((x) => !isPrivateOrLocalIp(x)) ?? null;
+        }
+        if (!ip || !isValidIp(ip) || isPrivateOrLocalIp(ip))
+            continue;
+        map.set(ip, (map.get(ip) ?? 0) + 1);
+    }
+    return map;
+}
+export function collectTopIps(dataDir, limit = 30) {
+    const notes = [];
+    const content = readLogChunks(dataDir);
+    if (!content.trim()) {
+        return { items: [], notes: [tl('notes.auto.n1097')] };
+    }
+    const fromAccess = parseAccessLogSuspects(content);
+    const fromAuth = parseAuthFailIps(content);
+    if (fromAuth.size)
+        notes.push(tl('notes.auto.t0528', { v0: (fromAuth.size) }));
+    const merged = new Map();
+    for (const [ip, a] of fromAccess) {
+        merged.set(ip, { hits: a.hits, s429: a.s429, scan: a.scan });
+    }
+    for (const [ip, n] of fromAuth) {
+        const cur = merged.get(ip) ?? { hits: 0, s429: 0, scan: 0 };
+        cur.hits += n;
+        cur.scan += Math.min(n, 20); // treat auth fails as scan-ish pressure
+        merged.set(ip, cur);
+    }
+    const items = [...merged.entries()]
+        .map(([ip, a]) => ({
+        ip,
+        hits: a.hits,
+        s429: a.s429,
+        scan: a.scan,
+        score: scoreFrom(a.hits, a.s429, a.scan),
+    }))
+        .sort((x, y) => y.score - x.score || y.hits - x.hits)
+        .slice(0, limit);
+    notes.push(tl('notes.auto.t0529', { v0: (items.length) }));
+    return { items, notes };
+}
+/** List managed nginx confs and whether YSK_DEFENSE marker is present. */
+export function listVhostDefenseMarkers(dataDir) {
+    const dir = join(dataDir, 'nginx', 'conf.d');
+    const items = [];
+    if (!existsSync(dir))
+        return { items: [], withLimit: 0, total: 0 };
+    for (const name of readdirSync(dir).filter((f) => f.endsWith('.conf'))) {
+        if (name.startsWith('00-ysk-defense'))
+            continue;
+        const path = join(dir, name);
+        try {
+            const raw = readFileSync(path, 'utf8');
+            const bytes = Buffer.byteLength(raw);
+            const hasDefenseMarker = raw.includes('BEGIN YSK_DEFENSE');
+            items.push({ name, path, hasDefenseMarker, bytes });
+        }
+        catch {
+            /* */
+        }
+    }
+    const withLimit = items.filter((i) => i.hasDefenseMarker).length;
+    return { items: items.slice(0, 100), withLimit, total: items.length };
+}
+//# sourceMappingURL=intel.js.map

package/dist/hosting/defense/intel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intel.js","sourceRoot":"","sources":["../../../src/hosting/defense/intel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAiBjG,SAAS,SAAS,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY;IACzD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,IAAI,IAAI,GAAG;QAAE,CAAC,IAAI,EAAE,CAAC;SACpB,IAAI,IAAI,IAAI,GAAG;QAAE,CAAC,IAAI,EAAE,CAAC;SACzB,IAAI,IAAI,IAAI,EAAE;QAAE,CAAC,IAAI,EAAE,CAAC;SACxB,IAAI,IAAI,IAAI,EAAE;QAAE,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,IAAI,IAAI,EAAE;QAAE,CAAC,IAAI,EAAE,CAAC;SACnB,IAAI,IAAI,IAAI,EAAE;QAAE,CAAC,IAAI,EAAE,CAAC;SACxB,IAAI,IAAI,IAAI,CAAC;QAAE,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,IAAI,IAAI,EAAE;QAAE,CAAC,IAAI,EAAE,CAAC;SACnB,IAAI,IAAI,IAAI,CAAC;QAAE,CAAC,IAAI,EAAE,CAAC;SACvB,IAAI,IAAI,IAAI,CAAC;QAAE,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/B,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;gBAClF,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACvB,IAAI,CAAC;oBACH,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE;wBAAE,SAAS;oBACpC,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC5B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC7E,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,KAAK;QACP,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACtF,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,KAAK;QACP,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,2EAA2E,CAAC,IAAI,CAAC,IAAI,CAAC;YACzF,SAAS;QACX,iEAAiE;QACjE,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC/B,IAAI,EAAE,GAAkB,IAAI,CAAC;QAC7B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YACjD,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC;YAAE,SAAS;QAC9D,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,KAAK,GAAG,EAAE;IAIvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAE/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwD,CAAC;IAC/E,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,wCAAwC;QACrE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,KAAK,GAAe,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SAC5C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjB,EAAE;QACF,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;KACzC,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;SACpD,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAEnB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB,CAAC,OAAe;IAKrD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;YAAE,SAAS;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,gBAAgB,GAAG,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;YAC3D,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,KAAK;QACP,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC;IACjE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AACxE,CAAC"}

package/dist/hosting/defense/nginx-limits.d.ts

@@ -0,0 +1,39 @@
+import type { NginxLimitSpec } from './types.js';
+export declare function defenseNginxConfPath(dataDir: string): string;
+export declare function defenseLimitsIncludePath(dataDir: string): string;
+export declare function sanitizeRate(rate: string): string;
+export declare function renderDefenseNginxConf(spec: NginxLimitSpec): string;
+/** Server-context snippet included by managed vhosts (after zones exist). */
+export declare function renderDefenseLimitsInclude(spec: NginxLimitSpec): string;
+/**
+ * Marker block inside each managed server { }.
+ * Uses relative include so re-applying a preset only rewrites the .inc.
+ */
+export declare function renderDefenseLimitsMarkerBlock(_spec?: NginxLimitSpec): string;
+/**
+ * Insert or replace YSK_DEFENSE marker block after first `server_name` line.
+ * Skips zone conf and non-server files.
+ */
+export declare function injectDefenseLimitsIntoConf(content: string, spec?: NginxLimitSpec): string;
+/**
+ * Inject limits into all managed vhost .conf under dataDir (except zone file).
+ */
+export declare function injectDefenseLimitsIntoManagedVhosts(dataDir: string, spec: NginxLimitSpec): {
+    updated: string[];
+    notes: string[];
+};
+/**
+ * Write zone drop-in, server include, and inject into managed vhosts.
+ */
+export declare function writeDefenseNginxLimits(dataDir: string, spec: NginxLimitSpec): {
+    written: string[];
+    confPath: string;
+    includePath: string;
+    vhostsUpdated: string[];
+};
+export declare function readActiveNginxLimitNotes(dataDir: string): {
+    exists: boolean;
+    confPath: string;
+    snippet?: string;
+};
+//# sourceMappingURL=nginx-limits.d.ts.map

package/dist/hosting/defense/nginx-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nginx-limits.d.ts","sourceRoot":"","sources":["../../../src/hosting/defense/nginx-limits.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKjD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAWnE;AAED,6EAA6E;AAC7E,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAQvE;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,MAAM,CAI7E;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,cAAc,GACpB,MAAM,CAmBR;AAED;;GAEG;AACH,wBAAgB,oCAAoC,CAClD,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,cAAc,GACnB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CA+BxC;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,cAAc,GACnB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,EAAE,CAAA;CAAE,CAqBvF;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG;IAC1D,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAQA"}