6 defense layers. Every bypass vector closed. Ghost events caught. Slow-burn nukes tracked. Built by someone who's been stopping nukers since 2015.

---

⚡ What changed in v2.0.0

v2.0.0 is a complete ground-up rewrite. The old single-file approach is gone. Every known anti-nuke bypass vector is now explicitly handled across 6 independent defense layers named after Mahabharata military formations.

What was broken before	What v2.0.0 does
Whitelisted users had full bypass	Levels 1–2 get relaxed limits, not zero limits
No role-based whitelist	Full role + user whitelist with level inheritance
@everyone perm escalation not caught	Makara Vyuha detects and auto-reverts it
Webhook created but never deleted	Padma Vyuha deletes the webhook before punishing
Rogue bot added but never kicked	Padma Vyuha kicks the bot before punishing the adder
Slow-burn nukes evaded rate limits	Vajra Vyuha tracks weighted scores over 1 hour
Ghost events (token nukes) undetected	Garuda Vyuha escalates to ChakraView on 3+ ghost events
ChakraView broke server permanently	SnapshotManager saves and restores full guild state
No per-guild configuration	Full /setup, /limits, /bypass, /status commands

---

📦 Install

npm install @intruder214/torque-antinuke

Requirements:

• Node.js >= 16.11.0
• discord.js ^14.14.1
• Bot permissions: View Audit Log, Ban Members, Manage Roles, Manage Channels, Moderate Members

---

🚀 Quick Start

const { Client, GatewayIntentBits } = require('discord.js');
const TorqueAntiNuke = require('@intruder214/torque-antinuke');

const client = new Client({
  intents: [
    GatewayIntentBits.Guilds,
    GatewayIntentBits.GuildMembers,
    GatewayIntentBits.GuildModeration,
    GatewayIntentBits.GuildWebhooks,
    GatewayIntentBits.GuildEmojisAndStickers,
    GatewayIntentBits.GuildMessages,
  ],
});

client.once('ready', () => {
  new TorqueAntiNuke({ client });
  console.log(`Online as ${client.user.tag}`);
});

client.login('YOUR_BOT_TOKEN');

Zero config required. All 6 layers activate automatically with sane defaults.

---

🔧 Full Configuration

const antinuke = new TorqueAntiNuke({
  client,

  // Path to the persistent JSON database (default: torque-data.json)
  dbPath: './data/torque.json',
});

// Per-guild settings (also configurable via slash commands)
antinuke.setSetting('GUILD_ID', 'logChannel', 'CHANNEL_ID');
antinuke.setSetting('GUILD_ID', 'punishment', 'ban');   // ban | kick | strip | quarantine
antinuke.setSetting('GUILD_ID', 'window', 10000);       // rolling window in ms

// Custom per-action limits
antinuke.setSetting('GUILD_ID', 'limits', {
  channelDelete:       2,
  channelCreate:       3,
  roleDelete:          2,
  roleCreate:          3,
  roleDangerousUpdate: 1,
  memberBan:           2,
  memberKick:          3,
  webhookCreate:       2,
  botAdd:              1,
  guildUpdate:         1,
  emojiDelete:         4,
});

---

🏛️ The 6-Layer Vyuha Defense System

Each layer is named after a military formation from the Mahabharata. They operate in sequence — every event passes through all relevant layers.

---

🦅 L1 — Krauncha Vyuha (Entry Gate)

The first thing every gateway event hits. Runs a true rolling window rate limiter using timestamp arrays (not counters) so there's no reset-timer gaming.

The bypass fix: Whitelisted users are NOT fully bypassed here. They get relaxed limits:

• Level 1 (Mod): 2× base limit on ban/kick actions
• Level 2 (Admin): 2× base limit on structural actions
• Level 3 (Immune): only true bypass — and Vajra still watches them

A compromised Level 2 admin can still nuke if fully bypassed. Krauncha closes that hole.

---

🦅 L2 — Garuda Vyuha (Audit Sentinel)

Reconciles every gateway event against the Discord Audit Log to find the true executor.

Ghost event detection: If an action fires (channel deleted) but no fresh audit log entry exists within 3.5 seconds, Garuda flags it as a ghost event. This is the signature of token nukes and self-bot API abuse that bypasses the audit log entirely.

If 3+ ghost events fire on the same guild within 15 seconds, Garuda automatically escalates to ChakraView lockdown.

---

🐊 L3 — Makara Vyuha (Crocodile Grip)

Handles the most dangerous bypass vectors that basic anti-nukes completely miss.

What it catches:

• Any role gaining Administrator, ManageGuild, ManageRoles, ManageChannels, BanMembers, KickMembers, ManageWebhooks, MentionEveryone
• @everyone being given Administrator (flagged as CRITICAL — force ban regardless of punishment setting)
• Vanity URL changes
• Verification level drops (opens server to raids)

Auto-revert: Makara reverts the role's permissions before punishing. If the revert fails, it still punishes. The damage is undone first.

---

🪷 L4 — Padma Vyuha (Lotus Formation)

Handles integration-based nuke vectors — the ones that make the attacker's account look clean.

Webhook nukes: Attacker creates a webhook, uses it to spam NSFW/raid content without touching their own token. Padma fetches and deletes the webhook immediately, then punishes the creator.

Bot-add nukes: Attacker adds a pre-built nuke bot. The bot does the damage, the attacker looks innocent. Padma kicks the bot immediately, then punishes the adder.

Level 2+ users can add bots and create webhooks freely (they're trusted admins).

---

⚡ L5 — Vajra Vyuha (Thunderbolt)

Catches what every other layer misses: the slow-burn nuke.

A sophisticated attacker spaces actions out — delete one channel every 3 minutes, delete one role every 5 minutes. No single rate limit is hit. Over an hour, the server is destroyed.

Vajra tracks weighted action scores over a 1-hour rolling window:

Action	Weight
roleDangerousUpdate	5
botAdd	5
channelDelete	4
roleDelete	4
guildUpdate	4
memberBan	3
webhookCreate	3
memberKick	2
channelCreate	1
roleCreate	1
emojiDelete	1

When a user's weighted score hits 30 within 1 hour, they're quarantined.

Level 2 admins are NOT exempt from Vajra. Only Level 3 (Immune/Owner) bypasses it.

---

🔴 L6 — ChakraView (Ultimate Fortress)

The last resort. Named after the Chakravyuha — the inescapable spiral formation from the Mahabharata. Once engaged, there is no way out until the owner lifts it.

Engages automatically when:

• Garuda detects 3+ ghost events in 15 seconds
• Server owner runs /chakraview engage

What it does:

1. Takes a full snapshot of all role permissions and channel overwrites
2. Strips all dangerous permissions from @everyone
3. Applies deny overwrites on every channel (no view, no send, no connect)
4. Sends an emergency alert to the system channel

On disengage: Restores the exact pre-attack snapshot. The server returns to its precise state before the lockdown. No manual permission restoration needed.

---

⚔️ Punishment Modes

punishment: 'ban'        // Permanent ban, deletes 7 days of messages (default)
punishment: 'kick'       // Kick — they can rejoin
punishment: 'strip'      // Strips ALL roles (not just admin ones)
punishment: 'quarantine' // 28-day timeout (max Discord allows)

---

🛡️ Whitelist Levels

Level	Name	What it bypasses
0	None	Nothing — full protection applies
1	Moderator	2× rate limit on memberBan, memberKick
2	Admin	2× rate limit on structural actions — Vajra still watches
3	Immune	Bypasses L1/L3/L4 — Garuda and Vajra still watch

Both users and roles can be whitelisted. User level takes precedence over role level if higher.

@everyone cannot be whitelisted — that would bypass protection for the entire server.

---

🔌 Runtime API

const antinuke = new TorqueAntiNuke({ client });

// User whitelist
antinuke.setUserWhitelist('GUILD_ID', 'USER_ID', 2);   // set level
antinuke.removeWhitelist('GUILD_ID', 'USER_ID');        // remove

// Role whitelist
antinuke.setRoleWhitelist('GUILD_ID', 'ROLE_ID', 1);

// Effective level check (accounts for role inheritance)
antinuke.getWhitelistLevel('GUILD_ID', 'USER_ID', member.roles.cache);

// Per-guild settings
antinuke.setSetting('GUILD_ID', 'logChannel', 'CHANNEL_ID');
antinuke.setSetting('GUILD_ID', 'punishment', 'ban');
antinuke.setSetting('GUILD_ID', 'window', 10000);

// Manual ChakraView control
await antinuke.activateChakraView(guild, 'reason');
await antinuke.disableChakraView(guild);

---

🤖 Bot Commands

The bot/ directory contains a ready-to-use Discord bot that exposes all anti-nuke controls as slash commands.

Setup

# 1. Copy the example env file
cp bot/.env.example bot/.env

# 2. Fill in your values
DISCORD_TOKEN=your_bot_token
CLIENT_ID=your_client_id
GUILD_ID=your_dev_guild_id   # optional — leave blank for global deploy

# 3. Deploy slash commands
npm run deploy

# 4. Start the bot
npm start

Commands

Command	Description	Who can use
/antinuke	View the full Vyuha architecture overview	Everyone
/status	Full system status — all layers, config, whitelist count	Manage Guild
/setup logs	Set the log channel for anti-nuke alerts	Owner
/setup punishment	Set default punishment mode	Owner
/setup window	Set the rolling rate-limit window	Owner
/setup view	View current server configuration	Owner
/limits set	Set the threshold for a specific action	Owner
/limits view	View all limits vs defaults	Owner
/limits reset	Reset all limits to defaults	Owner
/whitelist user	Set whitelist level for a user	Owner
/whitelist role	Set whitelist level for a role	Owner
/whitelist list	List all whitelisted users and roles	Owner
/bypass add	Grant a role bypass clearance	Owner
/bypass remove	Remove bypass clearance from a role	Owner
/bypass list	List all roles with bypass clearance	Owner
/bypass check	Check a user's effective bypass level	Owner
/reset	Clear rate-limit counters for a user or all users	Owner
/chakraview engage	Manually trigger total server lockdown	Owner
/chakraview disengage	Lift lockdown and restore permissions	Owner
/chakraview status	Check if lockdown is active	Owner

---

🔒 Security Guarantees

• Guild owner is always immune — hardcoded, cannot be overridden
• The bot itself is always immune
• Role hierarchy is respected — bot won't attempt to punish someone above it
• Audit log freshness — entries older than 3.5 seconds are ignored
• Ghost event escalation — 3+ untracked events in 15s triggers ChakraView automatically
• Auto-revert before punish — Makara reverts dangerous permission changes before executing punishment
• Snapshot restore — ChakraView saves full guild state and restores it exactly on disengage
• Graceful failures — every punishment and log send is wrapped in try/catch
• No event loop blocking — all validation runs through an async queue (EventManager)
• Persistent state — Vajra's slow-burn tracker and whitelist data survive bot restarts

---

📁 Project Structure

@intruder214/torque-antinuke
├── index.js                    # Main entry point
├── update-check.js             # Startup version notifier
├── src/
│   ├── layers/
│   │   ├── KraunchaVyuha.js    # L1 — Rolling rate limiter
│   │   ├── GarudaVyuha.js      # L2 — Audit log sentinel + ghost detection
│   │   ├── MakaraVyuha.js      # L3 — Permission escalation guard
│   │   ├── PadmaVyuha.js       # L4 — Webhook + bot integration shield
│   │   ├── VajraVyuha.js       # L5 — Slow-burn weighted anomaly tracker
│   │   └── ChakraView.js       # L6 — Total lockdown + snapshot restore
│   └── managers/
│       ├── DatabaseManager.js  # In-memory + disk-synced persistent store
│       ├── EventManager.js     # Async queue pipeline
│       ├── LogManager.js       # Rich embed log system
│       ├── PunishmentManager.js# Punishment execution with fallback
│       ├── SnapshotManager.js  # Guild state save/restore for ChakraView
│       └── WhitelistManager.js # User + role multi-tier whitelist
└── bot/
    ├── index.js                # Bot entry point
    ├── deploy.js               # Slash command deployment
    ├── config.json             # Client ID, Guild ID, Developer IDs
    ├── .env.example            # Environment variable template
    ├── handlers/
    │   └── SlashHandler.js     # Auto-loads all commands
    ├── structures/
    │   └── SecureCommand.js    # Abstract base with lockdown + DM guards
    └── commands/antinuke/
        ├── antinuke.js         # Architecture overview
        ├── bypass.js           # Role bypass management
        ├── limits.js           # Per-action threshold config
        ├── lockdown.js         # ChakraView engage/disengage
        ├── reset.js            # Counter reset
        ├── setup.js            # Server configuration
        ├── status.js           # System status
        └── whitelist.js        # User + role whitelist management

---

🔔 Update Notifications

Torque checks npm for newer versions on startup:

[TorqueAntiNuke] update available 2.0.0 → 2.1.0
  npm install @intruder214/torque-antinuke@latest

Silent, non-blocking, zero dependencies (uses Node's built-in https://www.npmjs.com/package/@intruder214/torque-antinuke).

📄 License

MIT © Jlaj Jain