yusufkhon-guard 1.0.0

package/src/modules/adaptiveRateLimiter.js

@@ -0,0 +1,154 @@
+'use strict';
+
+/**
+ * @file adaptiveRateLimiter.js
+ * @description Aqlli (xatti-harakatga asoslangan) rate-limiting. Oddiy sonli
+ *              cheklovdan tashqari, IP'ning xatti-harakatini kuzatadi va anomaliya
+ *              sezilsa limitni AVTOMAT qattiqlashtiradi.
+ *
+ *              Kuzatiladigan signallar:
+ *                • so'rov tezligi (velocity) — juda tez ketma-ket so'rovlar;
+ *                • xatolik ulushi (4xx/401/403) — brute-force belgisi;
+ *                • himoyalangan yo'llarga (masalan, /login) urinishlar zichligi.
+ * @module modules/adaptiveRateLimiter
+ */
+
+const { defaultLogger } = require('../utils/logger');
+const { defaultKeyGenerator } = require('./rateLimiter');
+
+/**
+ * @typedef {Object} BehaviorRecord
+ * @property {number[]} timestamps - So'nggi so'rovlar vaqtlari (ms).
+ * @property {number} errors - Oynadagi xato javoblar soni.
+ * @property {number} sensitiveHits - Himoyalangan yo'llarga urinishlar.
+ * @property {number} penalty - To'plangan jarima (limitni pasaytiradi).
+ * @property {number} windowStart - Oyna boshi.
+ */
+
+/**
+ * @typedef {Object} AdaptiveOptions
+ * @property {number} [windowMs=60000] - Kuzatuv oynasi.
+ * @property {number} [baseMax=100] - Boshlang'ich (normal) limit.
+ * @property {number} [minMax=10] - Eng past (jazolangan) limit.
+ * @property {number} [burstThreshold=10] - 1 soniyada shu sonli so'rovdan oshsa — burst.
+ * @property {number} [errorRatioThreshold=0.5] - Xato ulushi shu qiymatdan oshsa — jazo.
+ * @property {RegExp} [sensitivePaths] - Himoyalangan yo'llar (masalan /login).
+ * @property {number} [statusCode=429] - Bloklash status kodi.
+ * @property {import('./firewall').Firewall} [firewall] - Jiddiy holatda strike qo'shish uchun.
+ * @property {import('../utils/logger').Logger} [logger=defaultLogger] - Logger.
+ */
+
+/** @type {AdaptiveOptions} */
+const DEFAULTS = {
+  windowMs: 60 * 1000,
+  baseMax: 100,
+  minMax: 10,
+  burstThreshold: 10,
+  errorRatioThreshold: 0.5,
+  sensitivePaths: /\/(login|signin|auth|admin|password|token|otp)/i,
+  statusCode: 429,
+};
+
+/**
+ * Aqlli rate-limiting middleware'ini yaratadi.
+ *
+ * @example
+ * const { adaptiveRateLimiter } = require('yusufkhon-guard');
+ * app.use(adaptiveRateLimiter({ baseMax: 120, minMax: 15 }));
+ *
+ * @param {AdaptiveOptions} [userOptions={}]
+ * @returns {import('express').RequestHandler}
+ */
+function adaptiveRateLimiter(userOptions = {}) {
+  const opts = { ...DEFAULTS, ...userOptions };
+  const logger = opts.logger || defaultLogger;
+  const keyGen = opts.keyGenerator || defaultKeyGenerator;
+
+  /** @type {Map<string, BehaviorRecord>} */
+  const store = new Map();
+
+  const cleanup = setInterval(() => {
+    const now = Date.now();
+    for (const [k, r] of store.entries()) {
+      if (now - r.windowStart > opts.windowMs * 3) store.delete(k);
+    }
+  }, opts.windowMs);
+  if (typeof cleanup.unref === 'function') cleanup.unref();
+
+  /**
+   * IP uchun joriy dinamik limitni hisoblaydi (jarimaga qarab pasayadi).
+   * @param {BehaviorRecord} rec
+   * @returns {number}
+   */
+  function currentLimit(rec) {
+    const reduced = Math.round(opts.baseMax / (1 + rec.penalty));
+    return Math.max(opts.minMax, reduced);
+  }
+
+  /**
+   * @param {import('express').Request} req
+   * @param {import('express').Response} res
+   * @param {import('express').NextFunction} next
+   */
+  return function adaptiveMiddleware(req, res, next) {
+    const key = keyGen(req);
+    const now = Date.now();
+
+    let rec = store.get(key);
+    if (!rec || now - rec.windowStart > opts.windowMs) {
+      rec = { timestamps: [], errors: 0, sensitiveHits: 0, penalty: rec ? Math.max(0, rec.penalty - 1) : 0, windowStart: now };
+      store.set(key, rec);
+    }
+
+    rec.timestamps.push(now);
+    // So'nggi 1 soniyadagi so'rovlarni sanaymiz (burst tahlili).
+    const lastSecond = rec.timestamps.filter((t) => now - t <= 1000).length;
+
+    // Himoyalangan yo'lga urinish.
+    const path = req.originalUrl || req.url || '';
+    if (opts.sensitivePaths.test(path)) rec.sensitiveHits += 1;
+
+    // --- Anomaliya baholovchi jarimalar ---
+    if (lastSecond > opts.burstThreshold) {
+      rec.penalty += 2;
+      logger.warn(`Adaptive: burst aniqlandi ${key} (${lastSecond}/s)`, { path });
+    }
+    if (opts.sensitivePaths.test(path) && rec.sensitiveHits > 5) {
+      rec.penalty += 1;
+    }
+    const total = rec.timestamps.length;
+    if (total >= 10 && rec.errors / total >= opts.errorRatioThreshold) {
+      rec.penalty += 2;
+      logger.warn(`Adaptive: yuqori xato ulushi ${key}`, { errors: rec.errors, total });
+    }
+
+    const limit = currentLimit(rec);
+    res.setHeader('RateLimit-Limit', limit);
+    res.setHeader('RateLimit-Remaining', Math.max(0, limit - total));
+
+    // Xato javoblarni kuzatish uchun `res.finish`ga ulanamiz.
+    res.on('finish', () => {
+      if (res.statusCode >= 400 && res.statusCode !== 429) rec.errors += 1;
+    });
+
+    if (total > limit) {
+      const retry = Math.ceil((rec.windowStart + opts.windowMs - now) / 1000);
+      res.setHeader('Retry-After', retry);
+      logger.blocked(key, 'Adaptive rate limit', { limit, total, penalty: rec.penalty, path });
+
+      // Og'ir jarima -> firewall'ga strike (avtomat ban tomon).
+      if (opts.firewall && rec.penalty >= 6) {
+        opts.firewall.blocker.addStrike(key, 40, 'Adaptive: og\'ir anomaliya');
+      }
+
+      return res.status
+        ? res.status(opts.statusCode).json({ success: false, error: 'Too Many Requests (adaptive)', retryAfter: retry, limit })
+        : (res.statusCode = opts.statusCode, res.end('Too Many Requests'));
+    }
+
+    next();
+  };
+}
+
+module.exports = adaptiveRateLimiter;
+module.exports.adaptiveRateLimiter = adaptiveRateLimiter;

package/src/modules/alerts.js

@@ -0,0 +1,168 @@
+'use strict';
+
+/**
+ * @file alerts.js
+ * @description Real vaqtli ogohlantirishlar (Real-Time Alerting). Hujum sodir
+ *              bo'lganda yoki yuqori xavfli IP bloklanganda server adminiga
+ *              Telegram, Discord yoki ixtiyoriy Webhook orqali darhol xabar
+ *              yuboradi. Node 18+ global `fetch` dan foydalanadi (zero-dep).
+ *
+ *              Spamning oldini olish uchun ogohlantirishlar "throttle" qilinadi.
+ * @module modules/alerts
+ */
+
+const { defaultLogger } = require('../utils/logger');
+
+/**
+ * @typedef {Object} AlertOptions
+ * @property {string} [telegramBotToken] - Telegram bot tokeni.
+ * @property {string|number} [telegramChatId] - Telegram chat ID.
+ * @property {string} [discordWebhookUrl] - Discord webhook URL.
+ * @property {string} [webhookUrl] - Ixtiyoriy umumiy webhook (JSON POST).
+ * @property {number} [throttleMs=15000] - Bir xil turdagi xabarlar orasidagi minimal vaqt.
+ * @property {import('../utils/logger').Logger} [logger=defaultLogger] - Logger.
+ */
+
+/**
+ * Ogohlantirishlarni turli kanallarga yuboruvchi dispetcher.
+ * @class
+ */
+class Alerter {
+  /**
+   * @param {AlertOptions} [options={}]
+   */
+  constructor(options = {}) {
+    this.options = options;
+    this.logger = options.logger || defaultLogger;
+    this.throttleMs = options.throttleMs != null ? options.throttleMs : 15000;
+    /** @type {Map<string, number>} */
+    this._lastSent = new Map();
+  }
+
+  /**
+   * Xabar throttle (bosilgan) holatidami?
+   * @private
+   * @param {string} key
+   * @returns {boolean}
+   */
+  _throttled(key) {
+    const now = Date.now();
+    const last = this._lastSent.get(key) || 0;
+    if (now - last < this.throttleMs) return true;
+    this._lastSent.set(key, now);
+    return false;
+  }
+
+  /**
+   * Telegram orqali yuboradi.
+   * @private
+   * @param {string} text
+   * @returns {Promise<boolean>}
+   */
+  async _telegram(text) {
+    const { telegramBotToken, telegramChatId } = this.options;
+    if (!telegramBotToken || !telegramChatId) return false;
+    const url = `https://api.telegram.org/bot${telegramBotToken}/sendMessage`;
+    const res = await fetch(url, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ chat_id: telegramChatId, text, parse_mode: 'HTML' }),
+    });
+    return res.ok;
+  }
+
+  /**
+   * Discord webhook orqali yuboradi.
+   * @private
+   * @param {string} text
+   * @returns {Promise<boolean>}
+   */
+  async _discord(text) {
+    if (!this.options.discordWebhookUrl) return false;
+    const res = await fetch(this.options.discordWebhookUrl, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ content: text }),
+    });
+    return res.ok;
+  }
+
+  /**
+   * Umumiy webhook orqali yuboradi (to'liq hodisa JSON'i bilan).
+   * @private
+   * @param {Object} payload
+   * @returns {Promise<boolean>}
+   */
+  async _webhook(payload) {
+    if (!this.options.webhookUrl) return false;
+    const res = await fetch(this.options.webhookUrl, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(payload),
+    });
+    return res.ok;
+  }
+
+  /**
+   * Ogohlantirish yuboradi (barcha sozlangan kanallarga).
+   *
+   * @param {Object} alert
+   * @param {string} alert.title - Sarlavha.
+   * @param {string} alert.message - Xabar matni.
+   * @param {string} [alert.severity='high'] - Jiddiylik darajasi.
+   * @param {Object} [alert.meta] - Qo'shimcha ma'lumot (webhook uchun).
+   * @returns {Promise<{ sent: string[], throttled: boolean }>}
+   */
+  async send(alert) {
+    const key = `${alert.title}:${alert.severity || 'high'}`;
+    if (this._throttled(key)) {
+      return { sent: [], throttled: true };
+    }
+
+    const emoji = { critical: '🟥', high: '🟧', medium: '🟨', low: '🟦' }[alert.severity] || '🛡️';
+    const text = `${emoji} <b>${alert.title}</b>\n${alert.message}`;
+    const sent = [];
+
+    const tasks = [
+      this._telegram(text).then((ok) => ok && sent.push('telegram')),
+      this._discord(`${emoji} **${alert.title}**\n${alert.message}`).then((ok) => ok && sent.push('discord')),
+      this._webhook({ ...alert, at: new Date().toISOString() }).then((ok) => ok && sent.push('webhook')),
+    ];
+
+    try {
+      await Promise.allSettled(tasks);
+    } catch (e) {
+      this.logger.error(`Alert yuborishda xato: ${e.message}`);
+    }
+
+    if (sent.length) this.logger.info(`Ogohlantirish yuborildi: ${sent.join(', ')}`);
+    return { sent, throttled: false };
+  }
+
+  /**
+   * Firewall (va boshqa EventEmitter) hodisalariga obuna bo'lib, avtomat
+   * ogohlantirish yuboradi.
+   *
+   * @param {import('events').EventEmitter} emitter - Masalan, firewall nusxasi.
+   * @param {Object} [opts]
+   * @param {string} [opts.minSeverity='high'] - Shu darajadan past tahdidlar e'tiborsiz qoldiriladi.
+   * @returns {void}
+   */
+  attach(emitter, opts = {}) {
+    const order = ['low', 'medium', 'high', 'critical'];
+    const min = order.indexOf(opts.minSeverity || 'high');
+
+    emitter.on('ban', ({ ip, reason }) => {
+      this.send({ title: 'Yangi IP bloklandi', message: `IP: ${ip}\nSabab: ${reason}`, severity: 'high', meta: { ip, reason } });
+    });
+
+    emitter.on('threat', ({ ip, report }) => {
+      const sev = report && report.severity;
+      if (order.indexOf(sev) >= min) {
+        this.send({ title: `Tahdid: ${sev}`, message: `IP: ${ip}\nBall: ${report.score}`, severity: sev, meta: { ip, score: report.score } });
+      }
+    });
+  }
+}
+
+module.exports = { Alerter };

package/src/modules/bodyLimit.js

@@ -0,0 +1,106 @@
+'use strict';
+
+/**
+ * @file bodyLimit.js
+ * @description Payload (so'rov tanasi) hajmi cheklovi — DoS himoyasi. Serverga
+ *              birdaniga katta hajmli zararli JSON/fayl yuborib uni qotirib
+ *              qo'yish urinishlarining oldini oladi.
+ *
+ *              Ikki bosqichli tekshiruv:
+ *                1) `Content-Length` sarlavhasi bo'yicha oldindan rad etish;
+ *                2) haqiqiy oqim (stream) hajmini kuzatib, chegaradan oshsa uzish.
+ * @module modules/bodyLimit
+ */
+
+const { defaultLogger } = require('../utils/logger');
+
+/**
+ * "10kb", "2mb", "1gb" kabi qatorlarni baytga o'giradi.
+ * @param {string|number} value
+ * @returns {number} Baytlar soni.
+ */
+function parseSize(value) {
+  if (typeof value === 'number') return value;
+  const m = String(value).trim().toLowerCase().match(/^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb)?$/);
+  if (!m) return NaN;
+  const n = parseFloat(m[1]);
+  const unit = m[2] || 'b';
+  const mult = { b: 1, kb: 1024, mb: 1024 ** 2, gb: 1024 ** 3 }[unit];
+  return Math.round(n * mult);
+}
+
+/**
+ * @typedef {Object} BodyLimitOptions
+ * @property {string|number} [maxBodySize='1mb'] - Ruxsat etilgan maksimal hajm.
+ * @property {number} [statusCode=413] - Payload Too Large status kodi.
+ * @property {import('./firewall').Firewall} [firewall] - Berilsa, oshirib yuborgan IP'ga strike qo'shadi.
+ * @property {import('../utils/logger').Logger} [logger=defaultLogger] - Logger.
+ */
+
+/**
+ * Payload hajmi cheklovi middleware'ini yaratadi.
+ * Diqqat: uni `express.json()` dan OLDIN ulang.
+ *
+ * @example
+ * const { bodyLimit } = require('yusufkhon-guard');
+ * app.use(bodyLimit({ maxBodySize: '512kb' }));
+ * app.use(express.json());
+ *
+ * @param {BodyLimitOptions} [options={}]
+ * @returns {import('express').RequestHandler}
+ */
+function bodyLimit(options = {}) {
+  const logger = options.logger || defaultLogger;
+  const maxBytes = parseSize(options.maxBodySize || '1mb');
+  const statusCode = options.statusCode || 413;
+
+  /**
+   * @param {import('express').Request} req
+   * @param {import('express').Response} res
+   * @param {import('express').NextFunction} next
+   */
+  return function bodyLimitMiddleware(req, res, next) {
+    const reject = (bytes) => {
+      // `next()` chaqirilib parallel kuzatilgani uchun, downstream handler
+      // allaqachon javob bergan bo'lishi mumkin. Bunday holda ikkinchi javob
+      // "headers already sent" xatosini keltirib chiqaradi — shu bois skip qilamiz.
+      // (Oqim baribir chaqiruvchi tomonda `req.destroy()` bilan to'xtatiladi.)
+      if (res.headersSent) return;
+      logger.blocked(req.ip || 'unknown', 'Payload hajmi chegaradan oshdi', {
+        path: req.originalUrl || req.url, bytes, max: maxBytes,
+      });
+      if (options.firewall) options.firewall.blocker.addStrike(req.ip || 'unknown', 25, 'Oversized payload');
+      if (res.status) res.status(statusCode).json({ success: false, error: 'Payload Too Large', maxBytes });
+      else { res.statusCode = statusCode; res.end('Payload Too Large'); }
+    };
+
+    // 1. Content-Length bo'yicha oldindan tekshiruv.
+    const declared = Number(req.headers['content-length']);
+    if (!Number.isNaN(declared) && declared > maxBytes) {
+      return reject(declared);
+    }
+
+    // 2. Haqiqiy oqim hajmini kuzatamiz.
+    let received = 0;
+    let aborted = false;
+    const onData = (chunk) => {
+      if (aborted) return;
+      received += chunk.length;
+      if (received > maxBytes) {
+        aborted = true;
+        req.removeListener('data', onData);
+        reject(received);
+        // Oqimni to'xtatamiz.
+        if (typeof req.destroy === 'function') req.destroy();
+      }
+    };
+    req.on('data', onData);
+    req.on('end', () => req.removeListener('data', onData));
+
+    next();
+  };
+}
+
+module.exports = bodyLimit;
+module.exports.bodyLimit = bodyLimit;
+module.exports.parseSize = parseSize;

package/src/modules/botDetector.js

@@ -0,0 +1,144 @@
+'use strict';
+
+/**
+ * @file botDetector.js
+ * @description HTTP darajasidagi bot/skript aniqlash (fingerprinting). So'rov
+ *              haqiqiy brauzerdan yoki avtomatik vositadan (curl, python-requests,
+ *              wget, go-http, axios va h.k.) kelayotganini sarlavhalar tahlili
+ *              orqali baholaydi.
+ *
+ *              Ixtiyoriy ravishda JA3 (TLS) barmoq izi bilan birga ishlaydi:
+ *              agar so'rov soketiga `ja3Hash` biriktirilgan bo'lsa, u ham
+ *              hisobga olinadi.
+ * @module modules/botDetector
+ */
+
+const { defaultLogger } = require('../utils/logger');
+
+/**
+ * Aniq skript/kutubxona User-Agent belgilari.
+ * @type {RegExp}
+ */
+const SCRIPT_AGENTS = /(curl|wget|python-requests|python-urllib|go-http-client|libwww-perl|java\/|okhttp|axios\/|node-fetch|got\/|httpie|postmanruntime|scrapy|aiohttp|guzzlehttp|winhttp|powershell)/i;
+
+/**
+ * Haqiqiy brauzer belgilari (Chrome/Firefox/Safari/Edge).
+ * @type {RegExp}
+ */
+const BROWSER_AGENTS = /(mozilla\/5\.0.*(chrome|firefox|safari|edg|opr)\/)/i;
+
+/**
+ * @typedef {Object} BotReport
+ * @property {number} score - Bot ehtimoli balli (0..100, yuqori — bot).
+ * @property {boolean} isBot - Chegaradan oshdimi.
+ * @property {string[]} reasons - Aniqlangan belgilar.
+ * @property {string|null} ja3 - JA3 hash (mavjud bo'lsa).
+ */
+
+/**
+ * So'rovni tahlil qilib, bot-hisobotini qaytaradi (middleware'siz, alohida ham ishlatiladi).
+ * @param {import('express').Request} req
+ * @returns {BotReport}
+ */
+function analyzeRequest(req) {
+  const h = req.headers || {};
+  const ua = String(h['user-agent'] || '');
+  const reasons = [];
+  let score = 0;
+
+  // 1. User-Agent umuman yo'q.
+  if (!ua) { score += 40; reasons.push('user-agent yo\'q'); }
+
+  // 2. Aniq skript kutubxonasi.
+  if (SCRIPT_AGENTS.test(ua)) { score += 55; reasons.push('skript user-agent'); }
+
+  // 3. Brauzerga o'xshamaydi (lekin UA bor).
+  if (ua && !BROWSER_AGENTS.test(ua) && !SCRIPT_AGENTS.test(ua)) {
+    score += 20; reasons.push('brauzer bo\'lmagan user-agent');
+  }
+
+  // 4. Brauzerlar odatda yuboradigan sarlavhalarning yo'qligi.
+  if (!h['accept']) { score += 15; reasons.push('accept yo\'q'); }
+  if (!h['accept-language']) { score += 15; reasons.push('accept-language yo\'q'); }
+  if (!h['accept-encoding']) { score += 10; reasons.push('accept-encoding yo\'q'); }
+
+  // 5. Zamonaviy Chrome yuboradigan sec-* sarlavhalari (brauzer da'vo qilsa, lekin yo'q bo'lsa).
+  const claimsChrome = /chrome\/|edg\//i.test(ua);
+  if (claimsChrome && !h['sec-fetch-site'] && !h['sec-ch-ua']) {
+    score += 25; reasons.push('Chrome da\'vo qiladi, lekin sec-* sarlavhalari yo\'q (soxta UA)');
+  }
+
+  // 6. JA3 (TLS) — agar soketga biriktirilgan bo'lsa.
+  const ja3 = (req.socket && req.socket.ja3Hash) || null;
+
+  score = Math.min(100, score);
+  return { score, isBot: false, reasons, ja3 };
+}
+
+/**
+ * @typedef {Object} BotDetectorOptions
+ * @property {number} [threshold=50] - Shu balldan oshsa "bot" deb hisoblanadi.
+ * @property {boolean} [block=false] - Bot aniqlansa so'rovni bloklash (aks holda faqat belgilaydi).
+ * @property {number} [statusCode=403] - Bloklashda status kodi.
+ * @property {string[]} [allowedBots] - Ruxsat etilgan botlar (masalan, 'googlebot','bingbot').
+ * @property {import('./firewall').Firewall} [firewall] - Berilsa, bot IP'ga strike qo'shadi.
+ * @property {import('../utils/logger').Logger} [logger=defaultLogger] - Logger.
+ */
+
+/**
+ * Bot aniqlash middleware'ini yaratadi. Natija `req.botScore` va `req.isBot`
+ * sifatida keyingi middleware'larga uzatiladi.
+ *
+ * @param {BotDetectorOptions} [options={}]
+ * @returns {import('express').RequestHandler}
+ */
+function botDetector(options = {}) {
+  const threshold = options.threshold != null ? options.threshold : 50;
+  const block = !!options.block;
+  const statusCode = options.statusCode || 403;
+  const allowed = (options.allowedBots || []).map((b) => b.toLowerCase());
+  const logger = options.logger || defaultLogger;
+
+  /**
+   * @param {import('express').Request} req
+   * @param {import('express').Response} res
+   * @param {import('express').NextFunction} next
+   */
+  return function botDetectorMiddleware(req, res, next) {
+    const ua = String((req.headers && req.headers['user-agent']) || '').toLowerCase();
+
+    // Ruxsat etilgan botlar (masalan, qidiruv tizimlari) o'tkaziladi.
+    if (allowed.some((b) => ua.includes(b))) {
+      req.isBot = false;
+      req.botScore = 0;
+      return next();
+    }
+
+    const report = analyzeRequest(req);
+    report.isBot = report.score >= threshold;
+
+    req.botScore = report.score;
+    req.isBot = report.isBot;
+    req.botReport = report;
+
+    if (report.isBot && block) {
+      const ip = req.ip || 'unknown';
+      logger.blocked(ip, 'Bot/skript aniqlandi', {
+        score: report.score,
+        reasons: report.reasons,
+        ja3: report.ja3,
+      });
+      if (options.firewall) options.firewall.blocker.addStrike(ip, 50, 'Bot fingerprint');
+      return res.status
+        ? res.status(statusCode).json({ success: false, error: 'Avtomatlashtirilgan so\'rovlar cheklangan.' })
+        : (res.statusCode = statusCode, res.end('Forbidden'));
+    }
+
+    next();
+  };
+}
+
+module.exports = botDetector;
+module.exports.botDetector = botDetector;
+module.exports.analyzeRequest = analyzeRequest;
+module.exports.SCRIPT_AGENTS = SCRIPT_AGENTS;