ysk-server-core 1.0.0

package/dist/hosting/defense/nginx-limits.js

@@ -0,0 +1,142 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Generate nginx limit_req / limit_conn drop-in for defense presets.
+ * Zones → http conf.d; server limits → .inc + inject into managed vhosts.
+ */
+import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, } from 'node:fs';
+import { join } from 'node:path';
+const BEGIN = '# BEGIN YSK_DEFENSE';
+const END = '# END YSK_DEFENSE';
+export function defenseNginxConfPath(dataDir) {
+    return join(dataDir, 'nginx', 'conf.d', '00-ysk-defense.conf');
+}
+export function defenseLimitsIncludePath(dataDir) {
+    return join(dataDir, 'nginx', 'conf.d', 'ysk-defense-limits.inc');
+}
+export function sanitizeRate(rate) {
+    return rate.replace(/[^0-9a-zA-Z/]/g, '') || '10r/s';
+}
+export function renderDefenseNginxConf(spec) {
+    const rate = sanitizeRate(spec.reqRate);
+    return `# Generated by YSK Defense Center — do not hand-edit
+# limit zones (http context via conf.d include on many setups)
+# Note: limit_req_zone must be in http{} — if conf.d is server-only, use include from nginx.conf
+limit_req_zone $binary_remote_addr zone=ysk_req:10m rate=${rate};
+limit_conn_zone $binary_remote_addr zone=ysk_conn:10m;
+
+# Server-context limits live in ysk-defense-limits.inc (burst/conn from preset).
+# Dual write: zone file + limit include for managed vhosts.
+`;
+}
+/** Server-context snippet included by managed vhosts (after zones exist). */
+export function renderDefenseLimitsInclude(spec) {
+    const burst = Math.max(1, Math.min(500, Math.floor(spec.burst)));
+    const conn = Math.max(1, Math.min(1000, Math.floor(spec.connLimit)));
+    return `# YSK Defense limits (server context)
+limit_req zone=ysk_req burst=${burst} nodelay;
+limit_conn ysk_conn ${conn};
+limit_req_status 429;
+`;
+}
+/**
+ * Marker block inside each managed server { }.
+ * Uses relative include so re-applying a preset only rewrites the .inc.
+ */
+export function renderDefenseLimitsMarkerBlock(_spec) {
+    return `${BEGIN}
+  include ysk-defense-limits.inc;
+${END}`;
+}
+/**
+ * Insert or replace YSK_DEFENSE marker block after first `server_name` line.
+ * Skips zone conf and non-server files.
+ */
+export function injectDefenseLimitsIntoConf(content, spec) {
+    const block = renderDefenseLimitsMarkerBlock(spec);
+    const markerRe = new RegExp(`${BEGIN.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}[\\s\\S]*?${END.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\n?`, 'g');
+    let body = content.replace(markerRe, '');
+    // Insert after first server_name line inside a server block
+    const sn = body.match(/^(\s*server_name\s+[^\n;]+;)/m);
+    if (sn && sn.index !== undefined) {
+        const insertAt = sn.index + sn[0].length;
+        body = `${body.slice(0, insertAt)}\n${block}${body.slice(insertAt)}`;
+    }
+    else if (/server\s*\{/.test(body)) {
+        body = body.replace(/server\s*\{/, (m) => `${m}\n${block}`);
+    }
+    else {
+        // leave unchanged if not a server conf
+        return content;
+    }
+    return body;
+}
+/**
+ * Inject limits into all managed vhost .conf under dataDir (except zone file).
+ */
+export function injectDefenseLimitsIntoManagedVhosts(dataDir, spec) {
+    const confDir = join(dataDir, 'nginx', 'conf.d');
+    const updated = [];
+    const notes = [];
+    if (!existsSync(confDir)) {
+        notes.push(tl('notes.auto.n0717'));
+        return { updated, notes };
+    }
+    const files = readdirSync(confDir).filter((f) => f.endsWith('.conf') && f !== '00-ysk-defense.conf' && !f.startsWith('00-ysk-defense'));
+    for (const f of files) {
+        const path = join(confDir, f);
+        try {
+            const raw = readFileSync(path, 'utf8');
+            if (!/server\s*\{/.test(raw))
+                continue;
+            const next = injectDefenseLimitsIntoConf(raw, spec);
+            if (next !== raw) {
+                writeFileSync(path, next, 'utf8');
+                updated.push(path);
+            }
+        }
+        catch (e) {
+            notes.push(tl('notes.auto.t0558', { v0: (f), v1: (e instanceof Error ? e.message : String(e)) }));
+        }
+    }
+    notes.push(updated.length
+        ? tl('notes.auto.t0559', { v0: (updated.length) })
+        : tl('notes.auto.n1089'));
+    return { updated, notes };
+}
+/**
+ * Write zone drop-in, server include, and inject into managed vhosts.
+ */
+export function writeDefenseNginxLimits(dataDir, spec) {
+    const confDir = join(dataDir, 'nginx', 'conf.d');
+    mkdirSync(confDir, { recursive: true });
+    const confPath = join(confDir, '00-ysk-defense.conf');
+    const includePath = join(confDir, 'ysk-defense-limits.inc');
+    const rate = sanitizeRate(spec.reqRate);
+    const zoneBody = `# Generated by YSK Defense — ${new Date().toISOString()}
+# http-context zones (include conf.d from nginx.conf)
+limit_req_zone $binary_remote_addr zone=ysk_req:10m rate=${rate};
+limit_conn_zone $binary_remote_addr zone=ysk_conn:10m;
+# Server limits: ysk-defense-limits.inc + BEGIN/END YSK_DEFENSE in each vhost
+`;
+    writeFileSync(confPath, zoneBody, 'utf8');
+    writeFileSync(includePath, renderDefenseLimitsInclude(spec), 'utf8');
+    const inj = injectDefenseLimitsIntoManagedVhosts(dataDir, spec);
+    return {
+        written: [confPath, includePath, ...inj.updated],
+        confPath,
+        includePath,
+        vhostsUpdated: inj.updated,
+    };
+}
+export function readActiveNginxLimitNotes(dataDir) {
+    const confPath = defenseNginxConfPath(dataDir);
+    if (!existsSync(confPath))
+        return { exists: false, confPath };
+    try {
+        return { exists: true, confPath, snippet: readFileSync(confPath, 'utf8').slice(0, 400) };
+    }
+    catch {
+        return { exists: true, confPath };
+    }
+}
+//# sourceMappingURL=nginx-limits.js.map

package/dist/hosting/defense/nginx-limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nginx-limits.js","sourceRoot":"","sources":["../../../src/hosting/defense/nginx-limits.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;;GAGG;AAEH,OAAO,EACL,SAAS,EACT,aAAa,EACb,UAAU,EACV,YAAY,EACZ,WAAW,GACZ,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,KAAK,GAAG,qBAAqB,CAAC;AACpC,MAAM,GAAG,GAAG,mBAAmB,CAAC;AAEhC,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,OAAO,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAoB;IACzD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO;;;2DAGkD,IAAI;;;;;CAK9D,CAAC;AACF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,0BAA0B,CAAC,IAAoB;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO;+BACsB,KAAK;sBACd,IAAI;;CAEzB,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAsB;IACnE,OAAO,GAAG,KAAK;;EAEf,GAAG,EAAE,CAAC;AACR,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAe,EACf,IAAqB;IAErB,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,MAAM,CACzB,GAAG,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,aAAa,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAC5G,GAAG,CACJ,CAAC;IACF,IAAI,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzC,4DAA4D;IAC5D,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACvD,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACzC,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvE,CAAC;SAAM,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,uCAAuC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oCAAoC,CAClD,OAAe,EACf,IAAoB;IAEpB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,qBAAqB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAC7F,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YACvC,MAAM,IAAI,GAAG,2BAA2B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACpD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAClC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CACR,OAAO,CAAC,MAAM;QACZ,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAC3B,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,IAAoB;IAEpB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,gCAAgC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;;2DAEhB,IAAI;;;CAG9D,CAAC;IACA,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,aAAa,CAAC,WAAW,EAAE,0BAA0B,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,oCAAoC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAChE,OAAO;QACL,OAAO,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;QAChD,QAAQ;QACR,WAAW;QACX,aAAa,EAAE,GAAG,CAAC,OAAO;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAe;IAKvD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC9D,IAAI,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;AACH,CAAC"}

package/dist/hosting/defense/presets.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Four defense presets — static data + request-time i18n resolve.
+ * Never call tl() at module load (freezes DEFAULT_LOCALE).
+ */
+import type { DefenseAction, DefensePreset, DefensePresetId } from './types.js';
+/** @deprecated use listDefensePresets() — kept as empty proxy for type imports */
+export declare const DEFENSE_PRESETS: Record<DefensePresetId, DefensePreset>;
+export declare function listDefensePresets(): DefensePreset[];
+export declare function getDefensePreset(id: DefensePresetId): DefensePreset;
+/** Human-readable action checklist for a preset (preview before apply). */
+export declare function buildPresetActions(preset: DefensePreset): DefenseAction[];
+//# sourceMappingURL=presets.d.ts.map

package/dist/hosting/defense/presets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presets.d.ts","sourceRoot":"","sources":["../../../src/hosting/defense/presets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AA+EhF,kFAAkF;AAClF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,aAAa,CAiBlE,CAAC;AAEF,wBAAgB,kBAAkB,IAAI,aAAa,EAAE,CAEpD;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,eAAe,GAAG,aAAa,CAGnE;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,EAAE,CA2BzE"}

package/dist/hosting/defense/presets.js

@@ -0,0 +1,128 @@
+/**
+ * Four defense presets — static data + request-time i18n resolve.
+ * Never call tl() at module load (freezes DEFAULT_LOCALE).
+ */
+import { tl } from 'ysk-server-shared';
+const PRESET_DEFS = {
+    daily: {
+        id: 'daily',
+        labelKey: 'notes.auto.n0914',
+        shortKey: 'notes.auto.n1031',
+        bulletKeys: ['notes.auto.n0140', 'notes.auto.n0288', 'notes.auto.n0891'],
+        nginx: { reqRate: '20r/s', burst: 40, connLimit: 80 },
+        fail2banJails: ['sshd', 'nginx-http-auth', 'postfix', 'dovecot'],
+        protectionHint: 'normal',
+    },
+    hardened: {
+        id: 'hardened',
+        labelKey: 'notes.auto.n0606',
+        shortKey: 'notes.auto.n0944',
+        bulletKeys: ['notes.auto.n0138', 'notes.auto.n0926', 'notes.auto.n0823'],
+        nginx: { reqRate: '8r/s', burst: 16, connLimit: 40 },
+        fail2banJails: [
+            'sshd',
+            'nginx-http-auth',
+            'nginx-botsearch',
+            'nginx-badbots',
+            'postfix',
+            'dovecot',
+        ],
+        protectionHint: 'degraded',
+    },
+    under_attack: {
+        id: 'under_attack',
+        labelKey: 'notes.auto.n0608',
+        shortKey: 'notes.auto.n0126',
+        bulletKeys: ['notes.auto.n0139', 'notes.auto.n0894', 'notes.auto.n0827'],
+        nginx: { reqRate: '3r/s', burst: 8, connLimit: 20 },
+        fail2banJails: [
+            'sshd',
+            'nginx-http-auth',
+            'nginx-botsearch',
+            'nginx-badbots',
+            'nginx-limit-req',
+            'postfix',
+            'dovecot',
+        ],
+        protectionHint: 'ddos-protection',
+        danger: true,
+    },
+    emergency: {
+        id: 'emergency',
+        labelKey: 'notes.auto.n0030',
+        shortKey: 'notes.auto.n0639',
+        bulletKeys: ['notes.auto.n0930', 'notes.auto.n0892', 'notes.auto.n1553'],
+        nginx: { reqRate: '1r/s', burst: 3, connLimit: 8 },
+        fail2banJails: ['sshd', 'nginx-http-auth', 'nginx-limit-req'],
+        protectionHint: 'ddos-protection',
+        danger: true,
+        requireConfirm: 'EMERGENCY',
+    },
+};
+function resolvePreset(def) {
+    return {
+        id: def.id,
+        label: tl(def.labelKey),
+        short: tl(def.shortKey),
+        bullets: def.bulletKeys.map((k) => tl(k)),
+        nginx: def.nginx,
+        fail2banJails: def.fail2banJails,
+        protectionHint: def.protectionHint,
+        danger: def.danger,
+        requireConfirm: def.requireConfirm,
+    };
+}
+/** @deprecated use listDefensePresets() — kept as empty proxy for type imports */
+export const DEFENSE_PRESETS = new Proxy({}, {
+    get(_t, prop) {
+        if (prop in PRESET_DEFS)
+            return resolvePreset(PRESET_DEFS[prop]);
+        return undefined;
+    },
+    ownKeys() {
+        return Object.keys(PRESET_DEFS);
+    },
+    getOwnPropertyDescriptor(_t, prop) {
+        if (prop in PRESET_DEFS) {
+            return { enumerable: true, configurable: true, value: resolvePreset(PRESET_DEFS[prop]) };
+        }
+        return undefined;
+    },
+});
+export function listDefensePresets() {
+    return Object.keys(PRESET_DEFS).map((id) => resolvePreset(PRESET_DEFS[id]));
+}
+export function getDefensePreset(id) {
+    const def = PRESET_DEFS[id] ?? PRESET_DEFS.daily;
+    return resolvePreset(def);
+}
+/** Human-readable action checklist for a preset (preview before apply). */
+export function buildPresetActions(preset) {
+    return [
+        {
+            id: 'nginx',
+            kind: 'nginx_limits',
+            title: tl('notes.auto.n0674'),
+            detail: `limit_req ${preset.nginx.reqRate} burst=${preset.nginx.burst}; conn≤${preset.nginx.connLimit}`,
+        },
+        {
+            id: 'f2b',
+            kind: 'fail2ban_jails',
+            title: tl('notes.auto.n0928'),
+            detail: preset.fail2banJails.join(', '),
+        },
+        {
+            id: 'prot',
+            kind: 'protection_mode',
+            title: tl('notes.auto.n1365'),
+            detail: `protectionHint=${preset.protectionHint}`,
+        },
+        {
+            id: 'ufw',
+            kind: 'ufw_hint',
+            title: tl('notes.auto.n1523'),
+            detail: tl('notes.auto.n0555'),
+        },
+    ];
+}
+//# sourceMappingURL=presets.js.map

package/dist/hosting/defense/presets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presets.js","sourceRoot":"","sources":["../../../src/hosting/defense/presets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AASvC,MAAM,WAAW,GAAuC;IACtD,KAAK,EAAE;QACL,EAAE,EAAE,OAAO;QACX,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,kBAAkB;QAC5B,UAAU,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC;QACxE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QACrD,aAAa,EAAE,CAAC,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,SAAS,CAAC;QAChE,cAAc,EAAE,QAAQ;KACzB;IACD,QAAQ,EAAE;QACR,EAAE,EAAE,UAAU;QACd,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,kBAAkB;QAC5B,UAAU,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC;QACxE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QACpD,aAAa,EAAE;YACb,MAAM;YACN,iBAAiB;YACjB,iBAAiB;YACjB,eAAe;YACf,SAAS;YACT,SAAS;SACV;QACD,cAAc,EAAE,UAAU;KAC3B;IACD,YAAY,EAAE;QACZ,EAAE,EAAE,cAAc;QAClB,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,kBAAkB;QAC5B,UAAU,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC;QACxE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;QACnD,aAAa,EAAE;YACb,MAAM;YACN,iBAAiB;YACjB,iBAAiB;YACjB,eAAe;YACf,iBAAiB;YACjB,SAAS;YACT,SAAS;SACV;QACD,cAAc,EAAE,iBAAiB;QACjC,MAAM,EAAE,IAAI;KACb;IACD,SAAS,EAAE;QACT,EAAE,EAAE,WAAW;QACf,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,kBAAkB;QAC5B,UAAU,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC;QACxE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;QAClD,aAAa,EAAE,CAAC,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,CAAC;QAC7D,cAAc,EAAE,iBAAiB;QACjC,MAAM,EAAE,IAAI;QACZ,cAAc,EAAE,WAAW;KAC5B;CACF,CAAC;AAEF,SAAS,aAAa,CAAC,GAAc;IACnC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,cAAc,EAAE,GAAG,CAAC,cAAc;KACnC,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,eAAe,GAA2C,IAAI,KAAK,CAC9E,EAA4C,EAC5C;IACE,GAAG,CAAC,EAAE,EAAE,IAAY;QAClB,IAAI,IAAI,IAAI,WAAW;YAAE,OAAO,aAAa,CAAC,WAAW,CAAC,IAAuB,CAAC,CAAC,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC;IACD,wBAAwB,CAAC,EAAE,EAAE,IAAI;QAC/B,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC;YACxB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC,IAAuB,CAAC,CAAC,EAAE,CAAC;QAC9G,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF,CACF,CAAC;AAEF,MAAM,UAAU,kBAAkB;IAChC,OAAQ,MAAM,CAAC,IAAI,CAAC,WAAW,CAAuB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAE,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,EAAmB;IAClD,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC;IACjD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,OAAO;QACL;YACE,EAAE,EAAE,OAAO;YACX,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,MAAM,EAAE,aAAa,MAAM,CAAC,KAAK,CAAC,OAAO,UAAU,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;SACxG;QACD;YACE,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;SACxC;QACD;YACE,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,MAAM,EAAE,kBAAkB,MAAM,CAAC,cAAc,EAAE;SAClD;QACD;YACE,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC;SAC/B;KACF,CAAC;AACJ,CAAC"}

package/dist/hosting/defense/signals.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Collect host signals and score threat level.
+ */
+import type { HostExecutor } from '../../host/executor.js';
+import type { BanEntry, ThreatLevel, ThreatSignal } from './types.js';
+/** Shared with automation.autoPreset so display level matches escalate rules. */
+export type ThreatLevelThresholds = {
+    /** score ≥ this → elevated (default 20; same as escalateToHardenedAt) */
+    elevatedAt: number;
+    /** score ≥ this → under_attack (default 45) */
+    underAttackAt: number;
+    /** score ≥ this → critical (default 70) */
+    criticalAt: number;
+};
+export declare const DEFAULT_THREAT_THRESHOLDS: ThreatLevelThresholds;
+export declare function scoreToThreatLevel(score: number, thresholds?: Partial<ThreatLevelThresholds>): ThreatLevel;
+/** Build display thresholds from automation.autoPreset — same knobs as auto-escalate. */
+export declare function threatThresholdsFromAutoPreset(ap: {
+    escalateToHardenedAt: number;
+    escalateToUnderAttackAt: number;
+    suggestEmergencyAt: number;
+    criticalAt?: number;
+}): ThreatLevelThresholds;
+/** Multipliers for each signal family (1 = default). User-tunable. */
+export type SignalWeights = {
+    networkDown: number;
+    highReqRate: number;
+    ddosHeuristic: number;
+    tcpInuse: number;
+    ufwInactive: number;
+    f2bBans: number;
+};
+export declare const DEFAULT_SIGNAL_WEIGHTS: SignalWeights;
+/**
+ * Aggregate signals for defense dashboard.
+ */
+export declare function collectDefenseSignals(input: {
+    host: HostExecutor;
+    requestCountLastMinute?: number;
+    weights?: Partial<SignalWeights>;
+    /** When set, threatLevel bands match automation escalate thresholds */
+    threatThresholds?: Partial<ThreatLevelThresholds>;
+}): Promise<{
+    score: number;
+    threatLevel: ThreatLevel;
+    signals: ThreatSignal[];
+    bans: BanEntry[];
+    protectionMode?: string;
+    firewall: {
+        active?: string;
+        installed?: boolean;
+    };
+    fail2ban: {
+        active?: string;
+        installed?: boolean;
+        jails?: number;
+    };
+    notes: string[];
+}>;
+//# sourceMappingURL=signals.d.ts.map

package/dist/hosting/defense/signals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signals.d.ts","sourceRoot":"","sources":["../../../src/hosting/defense/signals.ts"],"names":[],"mappings":"AACA;;GAEG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAG3D,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEtE,iFAAiF;AACjF,MAAM,MAAM,qBAAqB,GAAG;IAClC,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,qBAIvC,CAAC;AAEF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,GAC1C,WAAW,CAcb;AAED,yFAAyF;AACzF,wBAAgB,8BAA8B,CAAC,EAAE,EAAE;IACjD,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uBAAuB,EAAE,MAAM,CAAC;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,qBAAqB,CAMxB;AAED,sEAAsE;AACtE,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,aAOpC,CAAC;AAoBF;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,IAAI,EAAE,YAAY,CAAC;IACnB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACjC,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACnD,GAAG,OAAO,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACnD,QAAQ,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CAqHD"}

package/dist/hosting/defense/signals.js

@@ -0,0 +1,176 @@
+import { tl } from 'ysk-server-shared';
+import { runProtectionProbes } from '../../services/protection-probe.js';
+import { fail2banBannedIps, probeFail2banStatus, probeFirewallStatus } from '../system-apply.js';
+export const DEFAULT_THREAT_THRESHOLDS = {
+    elevatedAt: 20,
+    underAttackAt: 45,
+    criticalAt: 70,
+};
+export function scoreToThreatLevel(score, thresholds) {
+    const t = {
+        elevatedAt: thresholds?.elevatedAt ?? DEFAULT_THREAT_THRESHOLDS.elevatedAt,
+        underAttackAt: thresholds?.underAttackAt ?? DEFAULT_THREAT_THRESHOLDS.underAttackAt,
+        criticalAt: thresholds?.criticalAt ?? DEFAULT_THREAT_THRESHOLDS.criticalAt,
+    };
+    // Ensure ordering: critical ≥ underAttack ≥ elevated
+    const elevatedAt = Math.max(1, Math.min(99, t.elevatedAt));
+    const underAttackAt = Math.max(elevatedAt, Math.min(99, t.underAttackAt));
+    const criticalAt = Math.max(underAttackAt, Math.min(100, t.criticalAt));
+    if (score >= criticalAt)
+        return 'critical';
+    if (score >= underAttackAt)
+        return 'under_attack';
+    if (score >= elevatedAt)
+        return 'elevated';
+    return 'low';
+}
+/** Build display thresholds from automation.autoPreset — same knobs as auto-escalate. */
+export function threatThresholdsFromAutoPreset(ap) {
+    const elevatedAt = ap.escalateToHardenedAt;
+    const underAttackAt = Math.max(elevatedAt, ap.escalateToUnderAttackAt);
+    let criticalAt = ap.criticalAt ?? 70;
+    if (criticalAt < underAttackAt)
+        criticalAt = Math.min(100, underAttackAt + 10);
+    return { elevatedAt, underAttackAt, criticalAt };
+}
+export const DEFAULT_SIGNAL_WEIGHTS = {
+    networkDown: 1,
+    highReqRate: 1,
+    ddosHeuristic: 1,
+    tcpInuse: 1,
+    ufwInactive: 1,
+    f2bBans: 1,
+};
+function w(weights, key) {
+    const v = weights?.[key];
+    if (typeof v !== 'number' || !Number.isFinite(v))
+        return 1;
+    return Math.max(0, Math.min(3, v));
+}
+async function readSockstat() {
+    try {
+        const { readFileSync } = await import('node:fs');
+        const raw = readFileSync('/proc/net/sockstat', 'utf8');
+        const m = raw.match(/TCP:\s+inuse\s+(\d+)/i);
+        const tcp = m ? Number(m[1]) : 0;
+        return { tcp, detail: raw.split('\n')[0] ?? '' };
+    }
+    catch {
+        return { tcp: 0, detail: 'sockstat unavailable' };
+    }
+}
+/**
+ * Aggregate signals for defense dashboard.
+ */
+export async function collectDefenseSignals(input) {
+    const weights = { ...DEFAULT_SIGNAL_WEIGHTS, ...input.weights };
+    const signals = [];
+    let score = 0;
+    const notes = [];
+    const scale = (base, key) => Math.round(base * w(weights, key));
+    const probe = await runProtectionProbes({
+        requestCountLastMinute: input.requestCountLastMinute ?? 0,
+    });
+    const netPts = probe.networkReachable ? 0 : scale(15, 'networkDown');
+    signals.push({
+        id: 'network',
+        label: tl('notes.auto.n0638'),
+        value: probe.networkReachable,
+        points: netPts,
+        detail: probe.details.join('; '),
+    });
+    score += netPts;
+    const reqPts = probe.highRequestRate ? scale(20, 'highReqRate') : 0;
+    signals.push({
+        id: 'req_rate',
+        label: tl('notes.auto.n1593'),
+        value: input.requestCountLastMinute ?? 0,
+        points: reqPts,
+        detail: probe.highRequestRate ? tl('notes.auto.n1457') : tl('notes.auto.n1030'),
+    });
+    score += reqPts;
+    if (probe.ddosSuspected) {
+        const dPts = scale(25, 'ddosHeuristic');
+        score += dPts;
+        signals.push({
+            id: 'ddos_heuristic',
+            label: tl('notes.auto.n0095'),
+            value: true,
+            points: dPts,
+            detail: tl('notes.auto.n1610'),
+        });
+    }
+    const sock = await readSockstat();
+    const tcpBase = sock.tcp > 20000 ? 25 : sock.tcp > 8000 ? 15 : sock.tcp > 3000 ? 8 : 0;
+    const tcpPoints = scale(tcpBase, 'tcpInuse');
+    score += tcpPoints;
+    signals.push({
+        id: 'tcp_inuse',
+        label: tl('notes.auto.n0194'),
+        value: sock.tcp,
+        points: tcpPoints,
+        detail: sock.detail,
+    });
+    let firewall = { active: undefined, installed: undefined };
+    let fail2ban = {
+        active: undefined,
+        installed: undefined,
+        jails: undefined,
+    };
+    let bans = [];
+    try {
+        const fw = await probeFirewallStatus(input.host);
+        firewall = { active: fw.active, installed: fw.installed };
+        const ufwPts = fw.active === 'inactive' ? scale(5, 'ufwInactive') : 0;
+        signals.push({
+            id: 'ufw',
+            label: 'UFW',
+            value: fw.active ?? 'unknown',
+            points: ufwPts,
+            detail: fw.installed ? 'installed' : 'not installed',
+        });
+        score += ufwPts;
+    }
+    catch {
+        notes.push(tl('notes.auto.n0198'));
+    }
+    try {
+        const f2b = await probeFail2banStatus(input.host);
+        fail2ban = {
+            active: f2b.active,
+            installed: f2b.installed,
+            jails: f2b.jails?.length,
+        };
+        const banned = await fail2banBannedIps(input.host);
+        bans = (banned.items ?? []).map((b) => ({
+            ip: b.ip,
+            source: 'fail2ban',
+            jail: b.jail,
+        }));
+        const banBase = bans.length > 50 ? 20 : bans.length > 15 ? 12 : bans.length > 5 ? 6 : 0;
+        const banPoints = scale(banBase, 'f2bBans');
+        score += banPoints;
+        signals.push({
+            id: 'f2b_bans',
+            label: tl('notes.auto.n0286'),
+            value: bans.length,
+            points: banPoints,
+            detail: f2b.active === 'active' ? `${f2b.jails?.length ?? 0} jails` : tl('notes.auto.n0284'),
+        });
+    }
+    catch {
+        notes.push(tl('notes.auto.n0287'));
+    }
+    score = Math.min(100, score);
+    return {
+        score,
+        threatLevel: scoreToThreatLevel(score, input.threatThresholds),
+        signals,
+        bans,
+        protectionMode: probe.protection.mode,
+        firewall,
+        fail2ban,
+        notes,
+    };
+}
+//# sourceMappingURL=signals.js.map

package/dist/hosting/defense/signals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signals.js","sourceRoot":"","sources":["../../../src/hosting/defense/signals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAMvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAajG,MAAM,CAAC,MAAM,yBAAyB,GAA0B;IAC9D,UAAU,EAAE,EAAE;IACd,aAAa,EAAE,EAAE;IACjB,UAAU,EAAE,EAAE;CACf,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,UAA2C;IAE3C,MAAM,CAAC,GAAG;QACR,UAAU,EAAE,UAAU,EAAE,UAAU,IAAI,yBAAyB,CAAC,UAAU;QAC1E,aAAa,EAAE,UAAU,EAAE,aAAa,IAAI,yBAAyB,CAAC,aAAa;QACnF,UAAU,EAAE,UAAU,EAAE,UAAU,IAAI,yBAAyB,CAAC,UAAU;KAC3E,CAAC;IACF,qDAAqD;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE,IAAI,KAAK,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAC3C,IAAI,KAAK,IAAI,aAAa;QAAE,OAAO,cAAc,CAAC;IAClD,IAAI,KAAK,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAC3C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,8BAA8B,CAAC,EAK9C;IACC,MAAM,UAAU,GAAG,EAAE,CAAC,oBAAoB,CAAC;IAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC;IACvE,IAAI,UAAU,GAAG,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC;IACrC,IAAI,UAAU,GAAG,aAAa;QAAE,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,GAAG,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;AACnD,CAAC;AAYD,MAAM,CAAC,MAAM,sBAAsB,GAAkB;IACnD,WAAW,EAAE,CAAC;IACd,WAAW,EAAE,CAAC;IACd,aAAa,EAAE,CAAC;IAChB,QAAQ,EAAE,CAAC;IACX,WAAW,EAAE,CAAC;IACd,OAAO,EAAE,CAAC;CACX,CAAC;AAEF,SAAS,CAAC,CAAC,OAAkC,EAAE,GAAwB;IACrE,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,YAAY,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAM3C;IAUC,MAAM,OAAO,GAAkB,EAAE,GAAG,sBAAsB,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IAC/E,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,GAAwB,EAAE,EAAE,CACvD,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAErC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC;QACtC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,IAAI,CAAC;KAC1D,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IACrE,OAAO,CAAC,IAAI,CAAC;QACX,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;QAC7B,KAAK,EAAE,KAAK,CAAC,gBAAgB;QAC7B,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;KACjC,CAAC,CAAC;IACH,KAAK,IAAI,MAAM,CAAC;IAEhB,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,IAAI,CAAC;QACX,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;QAC7B,KAAK,EAAE,KAAK,CAAC,sBAAsB,IAAI,CAAC;QACxC,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;KAChF,CAAC,CAAC;IACH,KAAK,IAAI,MAAM,CAAC;IAEhB,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QACxC,KAAK,IAAI,IAAI,CAAC;QACd,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,gBAAgB;YACpB,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC7C,KAAK,IAAI,SAAS,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC;QACX,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;QAC7B,KAAK,EAAE,IAAI,CAAC,GAAG;QACf,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IAEH,IAAI,QAAQ,GAAG,EAAE,MAAM,EAAE,SAA+B,EAAE,SAAS,EAAE,SAAgC,EAAE,CAAC;IACxG,IAAI,QAAQ,GAAG;QACb,MAAM,EAAE,SAA+B;QACvC,SAAS,EAAE,SAAgC;QAC3C,KAAK,EAAE,SAA+B;KACvC,CAAC;IACF,IAAI,IAAI,GAAe,EAAE,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,QAAQ,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,EAAE,CAAC,MAAM,IAAI,SAAS;YAC7B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe;SACrD,CAAC,CAAC;QACH,KAAK,IAAI,MAAM,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,QAAQ,GAAG;YACT,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM;SACzB,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,MAAM,EAAE,UAAmB;YAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC5C,KAAK,IAAI,SAAS,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,UAAU;YACd,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;SAC7F,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO;QACL,KAAK;QACL,WAAW,EAAE,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC;QAC9D,OAAO;QACP,IAAI;QACJ,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;QACrC,QAAQ;QACR,QAAQ;QACR,KAAK;KACN,CAAC;AACJ,CAAC"}