@actuate-media/cms-core 0.83.0 → 0.84.0

package/dist/__tests__/security/sanitize.test.js

@@ -1,75 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { sanitizeHtml, stripHtml } from '../../security/sanitize.js';
-describe('sanitizeHtml', () => {
-    it('strips script tags', () => {
-        const input = '<p>Hello</p><script>alert("xss")</script>';
-        const result = sanitizeHtml(input);
-        expect(result).not.toContain('<script');
-        expect(result).toContain('<p>Hello</p>');
-    });
-    it('strips onerror attributes', () => {
-        const input = '<img src="x" onerror="alert(1)" alt="test" />';
-        const result = sanitizeHtml(input);
-        expect(result).not.toContain('onerror');
-        expect(result).toContain('alt="test"');
-    });
-    it('strips javascript: URLs from hrefs', () => {
-        const input = '<a href="javascript:alert(1)">click</a>';
-        const result = sanitizeHtml(input);
-        expect(result).not.toContain('javascript:');
-    });
-    it('preserves safe HTML', () => {
-        const input = '<h1>Title</h1><p>Text with <strong>bold</strong> and <a href="https://example.com">link</a></p>';
-        const result = sanitizeHtml(input);
-        expect(result).toContain('<h1>');
-        expect(result).toContain('<strong>bold</strong>');
-        expect(result).toContain('href="https://example.com"');
-    });
-    it('preserves image tags with allowed attributes', () => {
-        const input = '<img src="https://example.com/img.jpg" alt="photo" width="100" />';
-        const result = sanitizeHtml(input);
-        expect(result).toContain('src="https://example.com/img.jpg"');
-        expect(result).toContain('alt="photo"');
-    });
-    it('preserves tables', () => {
-        const input = '<table><thead><tr><th>Header</th></tr></thead><tbody><tr><td>Cell</td></tr></tbody></table>';
-        const result = sanitizeHtml(input);
-        expect(result).toContain('<table>');
-        expect(result).toContain('<th>Header</th>');
-        expect(result).toContain('<td>Cell</td>');
-    });
-    it('strips everything with stripAll option', () => {
-        const input = '<p>Hello <strong>world</strong></p>';
-        const result = sanitizeHtml(input, { stripAll: true });
-        expect(result).toBe('Hello world');
-    });
-    it('strips style tags', () => {
-        const input = '<style>body{display:none}</style><p>visible</p>';
-        const result = sanitizeHtml(input);
-        expect(result).not.toContain('<style');
-        expect(result).toContain('<p>visible</p>');
-    });
-    it('strips iframe tags', () => {
-        const input = '<iframe src="https://evil.com"></iframe><p>safe</p>';
-        const result = sanitizeHtml(input);
-        expect(result).not.toContain('<iframe');
-        expect(result).toContain('<p>safe</p>');
-    });
-});
-describe('stripHtml', () => {
-    it('returns plain text from HTML', () => {
-        const input = '<p>Hello <strong>world</strong></p>';
-        expect(stripHtml(input)).toBe('Hello world');
-    });
-    it('handles empty string', () => {
-        expect(stripHtml('')).toBe('');
-    });
-    it('strips nested tags', () => {
-        const input = '<div><ul><li>Item 1</li><li>Item 2</li></ul></div>';
-        const result = stripHtml(input);
-        expect(result).toContain('Item 1');
-        expect(result).toContain('Item 2');
-        expect(result).not.toContain('<');
-    });
-});
-//# sourceMappingURL=sanitize.test.js.map

package/dist/__tests__/security/sanitize.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitize.test.js","sourceRoot":"","sources":["../../../src/__tests__/security/sanitize.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEpE,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,KAAK,GAAG,2CAA2C,CAAA;QACzD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACvC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,KAAK,GAAG,+CAA+C,CAAA;QAC7D,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACvC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,KAAK,GAAG,yCAAyC,CAAA;QACvD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,KAAK,GACT,iGAAiG,CAAA;QACnG,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAChC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,KAAK,GAAG,mEAAmE,CAAA;QACjF,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAA;QAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC1B,MAAM,KAAK,GACT,6FAA6F,CAAA;QAC/F,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACnC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,KAAK,GAAG,qCAAqC,CAAA;QACnD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,KAAK,GAAG,iDAAiD,CAAA;QAC/D,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,KAAK,GAAG,qDAAqD,CAAA;QACnE,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACvC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,KAAK,GAAG,qCAAqC,CAAA;QACnD,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,KAAK,GAAG,oDAAoD,CAAA;QAClE,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/security/secret-storage.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=secret-storage.test.d.ts.map

package/dist/__tests__/security/secret-storage.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"secret-storage.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/security/secret-storage.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/security/secret-storage.test.js

@@ -1,42 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { encryptSecret, decryptSecret, isEncrypted, encryptStringArray, decryptStringArray, } from '../../security/secret-storage.js';
-const KEY = 'a'.repeat(64); // 32 bytes hex
-describe('secret-storage', () => {
-    it('round-trips a secret when CMS_ENCRYPTION_KEY is set', async () => {
-        process.env.CMS_ENCRYPTION_KEY = KEY;
-        const ciphertext = await encryptSecret('totp-seed-12345');
-        expect(ciphertext.startsWith('enc:v1:')).toBe(true);
-        expect(isEncrypted(ciphertext)).toBe(true);
-        expect(await decryptSecret(ciphertext)).toBe('totp-seed-12345');
-    });
-    it('passes plaintext through unchanged when CMS_ENCRYPTION_KEY is unset', async () => {
-        delete process.env.CMS_ENCRYPTION_KEY;
-        const out = await encryptSecret('plain-secret');
-        expect(out).toBe('plain-secret');
-        expect(isEncrypted(out)).toBe(false);
-        // Reads of plaintext values that were never encrypted return as-is.
-        expect(await decryptSecret('plain-secret')).toBe('plain-secret');
-    });
-    it('encryptStringArray + decryptStringArray round-trip', async () => {
-        process.env.CMS_ENCRYPTION_KEY = KEY;
-        const codes = ['abc-123', 'def-456', 'ghi-789'];
-        const enc = await encryptStringArray(codes);
-        expect(enc.every(isEncrypted)).toBe(true);
-        expect(await decryptStringArray(enc)).toEqual(codes);
-    });
-    it('decryptSecret refuses encrypted values without a key', async () => {
-        process.env.CMS_ENCRYPTION_KEY = KEY;
-        const ciphertext = await encryptSecret('shh');
-        delete process.env.CMS_ENCRYPTION_KEY;
-        await expect(decryptSecret(ciphertext)).rejects.toThrow(/CMS_ENCRYPTION_KEY/);
-    });
-    it('round-trip data is non-deterministic (random IV)', async () => {
-        process.env.CMS_ENCRYPTION_KEY = KEY;
-        const a = await encryptSecret('same');
-        const b = await encryptSecret('same');
-        expect(a).not.toBe(b);
-        expect(await decryptSecret(a)).toBe('same');
-        expect(await decryptSecret(b)).toBe('same');
-    });
-});
-//# sourceMappingURL=secret-storage.test.js.map

package/dist/__tests__/security/secret-storage.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"secret-storage.test.js","sourceRoot":"","sources":["../../../src/__tests__/security/secret-storage.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,aAAa,EACb,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kCAAkC,CAAA;AAEzC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA,CAAC,eAAe;AAE1C,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAA;QACpC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC,CAAA;QACzD,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnD,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1C,MAAM,CAAC,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAA;QACrC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,cAAc,CAAC,CAAA;QAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAChC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpC,oEAAoE;QACpE,MAAM,CAAC,MAAM,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAA;QACpC,MAAM,KAAK,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;QAC/C,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAC3C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,CAAC,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAA;QACpC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAA;QAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAA;QACrC,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAA;QACpC,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAA;QACrC,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAA;QACrC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACrB,MAAM,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC3C,MAAM,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/security/ssrf.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=ssrf.test.d.ts.map

package/dist/__tests__/security/ssrf.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ssrf.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/security/ssrf.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/security/ssrf.test.js

@@ -1,209 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { canonicalizeHostname, isPrivateAddress } from '../../security/ip-canon.js';
-import { resolveAndCheck, validateWebhookUrl } from '../../security/webhook.js';
-describe('canonicalizeHostname — IPv4 encodings', () => {
-    it.each([
-        ['127.0.0.1', '127.0.0.1'],
-        ['10.0.0.1', '10.0.0.1'],
-        ['192.168.1.1', '192.168.1.1'],
-        // Decimal: 127*2^24 = 2130706432 → 127.0.0.0; +1 = 127.0.0.1
-        ['2130706433', '127.0.0.1'],
-        // Octal (0177 = 127, 0 = 0, 0 = 0, 01 = 1)
-        ['0177.0.0.1', '127.0.0.1'],
-        ['0177.0.0.01', '127.0.0.1'],
-        // Hex
-        ['0x7f.0.0.1', '127.0.0.1'],
-        ['0x7f000001', '127.0.0.1'],
-        // Short forms
-        ['127.1', '127.0.0.1'],
-        ['10.1', '10.0.0.1'],
-        ['127.0.1', '127.0.0.1'],
-    ])('canonicalizes %s → %s', (input, expected) => {
-        const c = canonicalizeHostname(input);
-        expect(c.isHostname).toBe(false);
-        expect(c.ipv4).toBe(expected);
-    });
-    it('rejects malformed IPv4 (out-of-range octet)', () => {
-        const c = canonicalizeHostname('256.0.0.1');
-        expect(c.isHostname).toBe(true); // falls through to "treat as hostname"
-    });
-    it('rejects malformed octal (digit 8 is invalid)', () => {
-        const c = canonicalizeHostname('0888.0.0.1');
-        expect(c.isHostname).toBe(true);
-    });
-});
-describe('canonicalizeHostname — IPv6 encodings', () => {
-    it.each([
-        ['::1', '::ffff:127.0.0.1 OR plain'], // checked separately below
-    ])('detects IPv6 forms', () => {
-        expect(canonicalizeHostname('::1').isHostname).toBe(false);
-    });
-    it('canonicalizes ::ffff:127.0.0.1 to underlying IPv4', () => {
-        const c = canonicalizeHostname('::ffff:127.0.0.1');
-        expect(c.ipv4).toBe('127.0.0.1');
-    });
-    it('canonicalizes ::ffff:7f00:1 (hex form) to underlying IPv4', () => {
-        const c = canonicalizeHostname('::ffff:7f00:1');
-        expect(c.ipv4).toBe('127.0.0.1');
-    });
-    it('canonicalizes ::127.0.0.1 (deprecated IPv4-compatible) to underlying IPv4', () => {
-        const c = canonicalizeHostname('::127.0.0.1');
-        expect(c.ipv4).toBe('127.0.0.1');
-    });
-    it('handles bracketed IPv6 (URL form)', () => {
-        const c = canonicalizeHostname('[::1]');
-        expect(c.ipv6).toBeDefined();
-    });
-    it('rejects IPv6 with multiple :: compressions', () => {
-        const c = canonicalizeHostname('::1::1');
-        expect(c.isHostname).toBe(false);
-        expect(c.isValidIp).toBe(false); // <- Bugbot #3: explicit malformed flag
-        expect(c.ipv6).toBeUndefined();
-        expect(c.ipv4).toBeUndefined();
-    });
-});
-describe('canonicalizeHostname — malformed IP literals', () => {
-    // Bugbot review #1/#2/#3 (PR #40): every input that looks like an IP
-    // literal but doesn't parse must be flagged with `isValidIp: false` so
-    // SSRF gates can fail closed instead of misreading "no IP returned" as
-    // "no private IP found".
-    it.each([
-        '::1::1', // multiple :: compressions
-        '::garbage', // non-hex hextet
-        'fe80:::1', // triple colon
-        '::1:gg::', // bad chars + multiple ::
-        '1:2:3:4:5:6:7:8:9', // too many groups
-        'abcd::1234::5678', // multiple ::
-    ])('marks %s as a non-hostname AND non-valid IP', (input) => {
-        const c = canonicalizeHostname(input);
-        expect(c.isHostname).toBe(false);
-        expect(c.isValidIp).toBe(false);
-        expect(c.ipv4).toBeUndefined();
-        expect(c.ipv6).toBeUndefined();
-    });
-    it('isPrivateAddress fails closed on the malformed shape', () => {
-        // Defense in depth: even if a caller forgets to check `isValidIp`,
-        // calling `isPrivateAddress` on a malformed shape returns a non-null
-        // reason instead of `null` (which would mean "safe to fetch").
-        const c = canonicalizeHostname('::1::1');
-        const result = isPrivateAddress(c);
-        expect(result).not.toBeNull();
-        expect(result?.reason).toMatch(/malformed/i);
-    });
-});
-describe('canonicalizeHostname — DNS hostnames pass through', () => {
-    it.each(['example.com', 'sub.example.com', 'localhost-but-not-quite.com', 'a-b-c.example'])('leaves %s as a hostname', (input) => {
-        const c = canonicalizeHostname(input);
-        expect(c.isHostname).toBe(true);
-        expect(c.ipv4).toBeUndefined();
-        expect(c.ipv6).toBeUndefined();
-    });
-});
-describe('isPrivateAddress', () => {
-    it.each([
-        '127.0.0.1',
-        '10.0.0.1',
-        '172.16.0.1',
-        '172.31.255.254',
-        '192.168.1.1',
-        '169.254.169.254', // AWS metadata
-        '100.64.0.1', // CGNAT
-        '0.0.0.0',
-        '198.18.0.1', // benchmark range
-        '224.0.0.1', // multicast
-        '255.255.255.255', // broadcast
-    ])('flags %s as private', (ip) => {
-        const c = canonicalizeHostname(ip);
-        expect(isPrivateAddress(c)).not.toBeNull();
-    });
-    it.each(['8.8.8.8', '1.1.1.1', '93.184.216.34', '203.0.0.1'])('allows public IP %s', (ip) => {
-        const c = canonicalizeHostname(ip);
-        expect(isPrivateAddress(c)).toBeNull();
-    });
-    it.each([
-        ['::1', '::1 (IPv6 loopback)'],
-        ['::', ':: (unspecified)'],
-        ['fe80::1', 'fe80::/10 (IPv6 link-local)'],
-        ['fc00::1', 'fc00::/7 (IPv6 unique local)'],
-        ['fd12::1', 'fc00::/7 (IPv6 unique local)'],
-        ['ff02::1', 'ff00::/8 (IPv6 multicast)'],
-    ])('flags IPv6 %s as private', (ip) => {
-        const c = canonicalizeHostname(ip);
-        expect(isPrivateAddress(c)).not.toBeNull();
-    });
-});
-describe('validateWebhookUrl — bypass forms', () => {
-    // These are the bypass forms the prior regex-based implementation missed.
-    // Each one would have happily POSTed to localhost / metadata IP / RFC1918.
-    it.each([
-        ['decimal IP', 'http://2130706433/'],
-        ['octal IP', 'http://0177.0.0.1/'],
-        ['hex IP', 'http://0x7f.0.0.1/'],
-        ['mixed hex flat', 'http://0x7f000001/'],
-        ['short form', 'http://127.1/'],
-        ['IPv4-mapped IPv6', 'http://[::ffff:127.0.0.1]/'],
-        ['IPv4-compatible IPv6 (deprecated)', 'http://[::127.0.0.1]/'],
-        ['bracketed IPv6 loopback', 'http://[::1]/'],
-        ['IPv6 link-local', 'http://[fe80::1]/'],
-        ['IPv6 unique-local fd00', 'http://[fd00::1]/'],
-        ['CGNAT range', 'http://100.64.0.1/'],
-        ['AWS metadata', 'http://169.254.169.254/latest/meta-data/'],
-        ['benchmark range', 'http://198.18.0.1/'],
-        ['localhost hostname', 'http://localhost/'],
-        ['metadata.google.internal', 'http://metadata.google.internal/'],
-        ['arbitrary .internal hostname', 'http://my-service.internal/'],
-    ])('rejects %s (%s)', (_label, url) => {
-        const result = validateWebhookUrl(url);
-        expect(result.valid).toBe(false);
-        expect(result.error).toBeDefined();
-    });
-    it.each([
-        ['regular https', 'https://example.com/webhook'],
-        ['public IP literal', 'http://8.8.8.8/'],
-        ['hostname with port', 'https://api.example.com:8443/hooks/123'],
-    ])('allows %s (%s)', (_label, url) => {
-        const result = validateWebhookUrl(url);
-        expect(result.valid).toBe(true);
-    });
-    it('rejects non-http(s) protocols', () => {
-        expect(validateWebhookUrl('file:///etc/passwd').valid).toBe(false);
-        expect(validateWebhookUrl('gopher://example.com/').valid).toBe(false);
-        expect(validateWebhookUrl('ftp://example.com/').valid).toBe(false);
-        expect(validateWebhookUrl('javascript:alert(1)').valid).toBe(false);
-    });
-    it('rejects malformed URLs', () => {
-        expect(validateWebhookUrl('not a url').valid).toBe(false);
-        expect(validateWebhookUrl('').valid).toBe(false);
-    });
-    // Bugbot review #1 (PR #40): malformed IP-shaped hostnames previously
-    // slipped through because canonicalizeHostname returned `{isHostname:
-    // false}` with no IP fields, and isPrivateAddress returned null —
-    // which the validator interpreted as "safe". They must fail closed.
-    it.each([
-        'http://[::1::1]/', // multi :: IPv6
-        'http://[fe80:::1]/', // triple colon
-        'http://[abcd::1234::5678]/', // multi ::
-    ])('rejects malformed IP literal in URL: %s', (url) => {
-        const result = validateWebhookUrl(url);
-        expect(result.valid).toBe(false);
-        expect(result.error).toMatch(/malformed|invalid/i);
-    });
-});
-describe('resolveAndCheck — IP literal short-circuit', () => {
-    it('rejects malformed IPv6 literal without DNS lookup', async () => {
-        // Bugbot review #2 (PR #40): the IP-literal short-circuit path also
-        // had the malformed-IP fail-open bug. Verify it now fails closed.
-        const result = await resolveAndCheck('::1::1');
-        expect(result.safe).toBe(false);
-        expect(result.error).toMatch(/malformed/i);
-    });
-    it('still allows public IP literals', async () => {
-        const result = await resolveAndCheck('8.8.8.8');
-        expect(result.safe).toBe(true);
-    });
-    it('still rejects private IP literals', async () => {
-        const result = await resolveAndCheck('127.0.0.1');
-        expect(result.safe).toBe(false);
-    });
-});
-//# sourceMappingURL=ssrf.test.js.map

package/dist/__tests__/security/ssrf.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ssrf.test.js","sourceRoot":"","sources":["../../../src/__tests__/security/ssrf.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AACnF,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAE/E,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,EAAE,CAAC,IAAI,CAAmB;QACxB,CAAC,WAAW,EAAE,WAAW,CAAC;QAC1B,CAAC,UAAU,EAAE,UAAU,CAAC;QACxB,CAAC,aAAa,EAAE,aAAa,CAAC;QAC9B,6DAA6D;QAC7D,CAAC,YAAY,EAAE,WAAW,CAAC;QAC3B,2CAA2C;QAC3C,CAAC,YAAY,EAAE,WAAW,CAAC;QAC3B,CAAC,aAAa,EAAE,WAAW,CAAC;QAC5B,MAAM;QACN,CAAC,YAAY,EAAE,WAAW,CAAC;QAC3B,CAAC,YAAY,EAAE,WAAW,CAAC;QAC3B,cAAc;QACd,CAAC,OAAO,EAAE,WAAW,CAAC;QACtB,CAAC,MAAM,EAAE,UAAU,CAAC;QACpB,CAAC,SAAS,EAAE,WAAW,CAAC;KACzB,CAAC,CAAC,uBAAuB,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QAC9C,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;QACrC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAA;QAC3C,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,uCAAuC;IACzE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAA;QAC5C,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,EAAE,CAAC,IAAI,CAAmB;QACxB,CAAC,KAAK,EAAE,2BAA2B,CAAC,EAAE,2BAA2B;KAClE,CAAC,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,CAAA;QAClD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,GAAG,oBAAoB,CAAC,eAAe,CAAC,CAAA;QAC/C,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,CAAC,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAA;QAC7C,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;QACvC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA,CAAC,wCAAwC;QACxE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAA;QAC9B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAA;IAChC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,qEAAqE;IACrE,uEAAuE;IACvE,uEAAuE;IACvE,yBAAyB;IACzB,EAAE,CAAC,IAAI,CAAC;QACN,QAAQ,EAAE,2BAA2B;QACrC,WAAW,EAAE,iBAAiB;QAC9B,UAAU,EAAE,eAAe;QAC3B,UAAU,EAAE,0BAA0B;QACtC,mBAAmB,EAAE,kBAAkB;QACvC,kBAAkB,EAAE,cAAc;KACnC,CAAC,CAAC,6CAA6C,EAAE,CAAC,KAAK,EAAE,EAAE;QAC1D,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;QACrC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAA;QAC9B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,mEAAmE;QACnE,qEAAqE;QACrE,+DAA+D;QAC/D,MAAM,CAAC,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;QAC7B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;IACjE,EAAE,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,eAAe,CAAC,CAAC,CACzF,yBAAyB,EACzB,CAAC,KAAK,EAAE,EAAE;QACR,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;QACrC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAA;QAC9B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAA;IAChC,CAAC,CACF,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,IAAI,CAAC;QACN,WAAW;QACX,UAAU;QACV,YAAY;QACZ,gBAAgB;QAChB,aAAa;QACb,iBAAiB,EAAE,eAAe;QAClC,YAAY,EAAE,QAAQ;QACtB,SAAS;QACT,YAAY,EAAE,kBAAkB;QAChC,WAAW,EAAE,YAAY;QACzB,iBAAiB,EAAE,YAAY;KAChC,CAAC,CAAC,qBAAqB,EAAE,CAAC,EAAE,EAAE,EAAE;QAC/B,MAAM,CAAC,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAA;QAClC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,EAAE,EAAE,EAAE;QAC1F,MAAM,CAAC,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAA;QAClC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,KAAK,EAAE,qBAAqB,CAAC;QAC9B,CAAC,IAAI,EAAE,kBAAkB,CAAC;QAC1B,CAAC,SAAS,EAAE,6BAA6B,CAAC;QAC1C,CAAC,SAAS,EAAE,8BAA8B,CAAC;QAC3C,CAAC,SAAS,EAAE,8BAA8B,CAAC;QAC3C,CAAC,SAAS,EAAE,2BAA2B,CAAC;KACzC,CAAC,CAAC,0BAA0B,EAAE,CAAC,EAAE,EAAE,EAAE;QACpC,MAAM,CAAC,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAA;QAClC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;IAC5C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,0EAA0E;IAC1E,2EAA2E;IAC3E,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,YAAY,EAAE,oBAAoB,CAAC;QACpC,CAAC,UAAU,EAAE,oBAAoB,CAAC;QAClC,CAAC,QAAQ,EAAE,oBAAoB,CAAC;QAChC,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;QACxC,CAAC,YAAY,EAAE,eAAe,CAAC;QAC/B,CAAC,kBAAkB,EAAE,4BAA4B,CAAC;QAClD,CAAC,mCAAmC,EAAE,uBAAuB,CAAC;QAC9D,CAAC,yBAAyB,EAAE,eAAe,CAAC;QAC5C,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QACxC,CAAC,wBAAwB,EAAE,mBAAmB,CAAC;QAC/C,CAAC,aAAa,EAAE,oBAAoB,CAAC;QACrC,CAAC,cAAc,EAAE,0CAA0C,CAAC;QAC5D,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;QACzC,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;QAC3C,CAAC,0BAA0B,EAAE,kCAAkC,CAAC;QAChE,CAAC,8BAA8B,EAAE,6BAA6B,CAAC;KAChE,CAAC,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,eAAe,EAAE,6BAA6B,CAAC;QAChD,CAAC,mBAAmB,EAAE,iBAAiB,CAAC;QACxC,CAAC,oBAAoB,EAAE,wCAAwC,CAAC;KACjE,CAAC,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClE,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrE,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClE,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzD,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,sEAAsE;IACtE,sEAAsE;IACtE,kEAAkE;IAClE,oEAAoE;IACpE,EAAE,CAAC,IAAI,CAAC;QACN,kBAAkB,EAAE,gBAAgB;QACpC,oBAAoB,EAAE,eAAe;QACrC,4BAA4B,EAAE,WAAW;KAC1C,CAAC,CAAC,yCAAyC,EAAE,CAAC,GAAG,EAAE,EAAE;QACpD,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,oEAAoE;QACpE,kEAAkE;QAClE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAA;QAC/C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAA;QACjD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/security/upload-magic.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=upload-magic.test.d.ts.map

package/dist/__tests__/security/upload-magic.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"upload-magic.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/security/upload-magic.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/security/upload-magic.test.js

@@ -1,55 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { validateMimeType, checkMagicBytes } from '../../security/upload.js';
-describe('validateMimeType', () => {
-    it('accepts an allowlisted type', () => {
-        expect(validateMimeType('image/png', ['image/png'])).toBe(true);
-    });
-    it('rejects a non-allowlisted type', () => {
-        expect(validateMimeType('text/html', ['image/png'])).toBe(false);
-    });
-    it('accepts both Set and Array allowlists', () => {
-        expect(validateMimeType('image/jpeg', new Set(['image/jpeg']))).toBe(true);
-    });
-});
-describe('checkMagicBytes', () => {
-    function buf(bytes) {
-        return new Uint8Array(bytes);
-    }
-    it('accepts a real PNG header for image/png', () => {
-        const png = buf([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 0]);
-        expect(checkMagicBytes(png, 'image/png').valid).toBe(true);
-    });
-    it('rejects a JPEG buffer claiming to be PNG', () => {
-        const jpeg = buf([0xff, 0xd8, 0xff, 0xe0, 0, 0x10, 0x4a, 0x46, 0x49, 0x46]);
-        const result = checkMagicBytes(jpeg, 'image/png');
-        expect(result.valid).toBe(false);
-        expect(result.detectedMimeType).toBe('image/jpeg');
-    });
-    it('rejects a WAV file claiming to be WebP (both share the RIFF header)', () => {
-        const wav = buf([0x52, 0x49, 0x46, 0x46, 0, 0, 0, 0, 0x57, 0x41, 0x56, 0x45]);
-        const result = checkMagicBytes(wav, 'image/webp');
-        expect(result.valid).toBe(false);
-        expect(result.detectedMimeType).toBe('audio/wav');
-    });
-    it('accepts a real WebP buffer for image/webp', () => {
-        const webp = buf([0x52, 0x49, 0x46, 0x46, 0, 0, 0, 0, 0x57, 0x45, 0x42, 0x50]);
-        expect(checkMagicBytes(webp, 'image/webp').valid).toBe(true);
-    });
-    it('accepts a full GIF89a header but rejects a "GIF" prefix only', () => {
-        const valid = buf([0x47, 0x49, 0x46, 0x38, 0x39, 0x61, 0, 0, 0, 0]);
-        expect(checkMagicBytes(valid, 'image/gif').valid).toBe(true);
-        const fake = buf([0x47, 0x49, 0x46, 0x00, 0x00, 0x00, 0, 0, 0, 0]);
-        // Without the full signature we can't detect the type, but we also won't lie.
-        const result = checkMagicBytes(fake, 'image/gif');
-        expect(result.valid).toBe(true); // unknown signature => accept (mime allowlist already gated this)
-    });
-    it('detects SVG by inspecting XML content', () => {
-        const svg = new TextEncoder().encode('<?xml version="1.0"?><svg xmlns="http://www.w3.org/2000/svg"/>');
-        expect(checkMagicBytes(svg, 'image/svg+xml').valid).toBe(true);
-    });
-    it('detects AVIF using the ftyp brand', () => {
-        const avif = buf([0, 0, 0, 0x20, 0x66, 0x74, 0x79, 0x70, 0x61, 0x76, 0x69, 0x66]);
-        expect(checkMagicBytes(avif, 'image/avif').valid).toBe(true);
-    });
-});
-//# sourceMappingURL=upload-magic.test.js.map

package/dist/__tests__/security/upload-magic.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"upload-magic.test.js","sourceRoot":"","sources":["../../../src/__tests__/security/upload-magic.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAE5E,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,gBAAgB,CAAC,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,SAAS,GAAG,CAAC,KAAe;QAC1B,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;IAED,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC7E,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QAC3E,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QAC7E,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;QACjD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QAC9E,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACnE,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAClE,8EAA8E;QAC9E,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,kEAAkE;IACpG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAClC,gEAAgE,CACjE,CAAA;QACD,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QACjF,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/seo/ai-bots.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=ai-bots.test.d.ts.map

package/dist/__tests__/seo/ai-bots.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ai-bots.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/seo/ai-bots.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/seo/ai-bots.test.js

@@ -1,92 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { buildAiBotRobotsLines, detectAiBot, AI_TRAINING_BOTS, AI_RETRIEVAL_BOTS, } from '../../seo/ai-bots.js';
-function uaSet(lines) {
-    return new Set(lines.filter((l) => l.startsWith('User-agent: ')).map((l) => l.replace('User-agent: ', '')));
-}
-describe('buildAiBotRobotsLines', () => {
-    it('emits nothing when no policy and no legacy flag', () => {
-        expect(buildAiBotRobotsLines(undefined, undefined)).toEqual([]);
-        expect(buildAiBotRobotsLines({}, false)).toEqual([]);
-    });
-    it('blocks only training bots when training=block, retrieval=allow', () => {
-        const lines = buildAiBotRobotsLines({ training: 'block', retrieval: 'allow' }, undefined);
-        const uas = uaSet(lines);
-        expect(uas.has('GPTBot')).toBe(true);
-        expect(uas.has('CCBot')).toBe(true);
-        // Retrieval bots stay allowed (absent from the disallow list).
-        expect(uas.has('PerplexityBot')).toBe(false);
-        expect(uas.has('OAI-SearchBot')).toBe(false);
-    });
-    it('blocks only retrieval bots when retrieval=block, training=allow', () => {
-        const lines = buildAiBotRobotsLines({ training: 'allow', retrieval: 'block' }, undefined);
-        const uas = uaSet(lines);
-        expect(uas.has('PerplexityBot')).toBe(true);
-        expect(uas.has('ChatGPT-User')).toBe(true);
-        expect(uas.has('GPTBot')).toBe(false);
-    });
-    it('blocks both groups when both are set to block', () => {
-        const lines = buildAiBotRobotsLines({ training: 'block', retrieval: 'block' }, undefined);
-        const uas = uaSet(lines);
-        expect(uas.size).toBe(AI_TRAINING_BOTS.length + AI_RETRIEVAL_BOTS.length);
-    });
-    it('legacy blockAIBots=true blocks both groups (back-compat)', () => {
-        const lines = buildAiBotRobotsLines(undefined, true);
-        const uas = uaSet(lines);
-        expect(uas.has('GPTBot')).toBe(true);
-        expect(uas.has('PerplexityBot')).toBe(true);
-    });
-    it('a set aiPolicy overrides the legacy flag', () => {
-        // Operator opted into nuance: training blocked, retrieval allowed — even
-        // though the legacy flag is also on, the nuanced policy wins.
-        const lines = buildAiBotRobotsLines({ training: 'block', retrieval: 'allow' }, true);
-        const uas = uaSet(lines);
-        expect(uas.has('GPTBot')).toBe(true);
-        expect(uas.has('PerplexityBot')).toBe(false);
-    });
-    it('every blocked bot gets a Disallow: / line', () => {
-        const lines = buildAiBotRobotsLines({ training: 'block' }, undefined);
-        const uaCount = lines.filter((l) => l.startsWith('User-agent: ')).length;
-        const disallowCount = lines.filter((l) => l === 'Disallow: /').length;
-        expect(disallowCount).toBe(uaCount);
-    });
-});
-describe('detectAiBot', () => {
-    it('returns null for empty / human user agents', () => {
-        expect(detectAiBot(null)).toBeNull();
-        expect(detectAiBot(undefined)).toBeNull();
-        expect(detectAiBot('')).toBeNull();
-        expect(detectAiBot('Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120')).toBeNull();
-    });
-    it('classifies a training crawler', () => {
-        expect(detectAiBot('Mozilla/5.0 (compatible; GPTBot/1.1; +https://openai.com/gptbot)')).toEqual({ token: 'GPTBot', category: 'training' });
-        expect(detectAiBot('CCBot/2.0 (https://commoncrawl.org/faq/)')).toEqual({
-            token: 'CCBot',
-            category: 'training',
-        });
-    });
-    it('classifies a retrieval / answer-engine crawler', () => {
-        expect(detectAiBot('Mozilla/5.0 (compatible; PerplexityBot/1.0)')).toEqual({
-            token: 'PerplexityBot',
-            category: 'retrieval',
-        });
-        expect(detectAiBot('Mozilla/5.0 ... ChatGPT-User/1.0')).toEqual({
-            token: 'ChatGPT-User',
-            category: 'retrieval',
-        });
-    });
-    it('prefers the more specific *-Extended training token over its search namesake', () => {
-        expect(detectAiBot('Mozilla/5.0 (compatible; Applebot-Extended/0.1)')).toEqual({
-            token: 'Applebot-Extended',
-            category: 'training',
-        });
-        // Plain Applebot (search/Siri) is retrieval, not training.
-        expect(detectAiBot('Mozilla/5.0 (compatible; Applebot/0.1)')).toEqual({
-            token: 'Applebot',
-            category: 'retrieval',
-        });
-    });
-    it('is case-insensitive', () => {
-        expect(detectAiBot('something gptbot something')?.token).toBe('GPTBot');
-    });
-});
-//# sourceMappingURL=ai-bots.test.js.map

package/dist/__tests__/seo/ai-bots.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ai-bots.test.js","sourceRoot":"","sources":["../../../src/__tests__/seo/ai-bots.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,sBAAsB,CAAA;AAE7B,SAAS,KAAK,CAAC,KAAe;IAC5B,OAAO,IAAI,GAAG,CACZ,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAC5F,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC/D,MAAM,CAAC,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;QACzF,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;QACxB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnC,+DAA+D;QAC/D,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;QACzF,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;QACxB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;QACzF,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;QACxB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QACpD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;QACxB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,CAAC,CAAA;QACpF,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;QACxB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;QACrE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAA;QACxE,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,MAAM,CAAA;QACrE,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QACpC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QACzC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAClC,MAAM,CACJ,WAAW,CAAC,yEAAyE,CAAC,CACvF,CAAC,QAAQ,EAAE,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,WAAW,CAAC,kEAAkE,CAAC,CAAC,CAAC,OAAO,CAC7F,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,CAC1C,CAAA;QACD,MAAM,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC,CAAC,OAAO,CAAC;YACtE,KAAK,EAAE,OAAO;YACd,QAAQ,EAAE,UAAU;SACrB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,WAAW,CAAC,6CAA6C,CAAC,CAAC,CAAC,OAAO,CAAC;YACzE,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAA;QACF,MAAM,CAAC,WAAW,CAAC,kCAAkC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9D,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,MAAM,CAAC,WAAW,CAAC,iDAAiD,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7E,KAAK,EAAE,mBAAmB;YAC1B,QAAQ,EAAE,UAAU;SACrB,CAAC,CAAA;QACF,2DAA2D;QAC3D,MAAM,CAAC,WAAW,CAAC,wCAAwC,CAAC,CAAC,CAAC,OAAO,CAAC;YACpE,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,WAAW,CAAC,4BAA4B,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/seo/alt-text.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=alt-text.test.d.ts.map

package/dist/__tests__/seo/alt-text.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"alt-text.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/seo/alt-text.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/seo/alt-text.test.js

@@ -1,47 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { analyzeImageAlts, countMissingAltImages, isDecorativeImgTag } from '../../seo/alt-text.js';
-describe('isDecorativeImgTag', () => {
-    it('treats an explicit empty alt as decorative', () => {
-        expect(isDecorativeImgTag('<img src="x.jpg" alt="">')).toBe(true);
-        expect(isDecorativeImgTag('<img src="x.jpg" alt="   ">')).toBe(true);
-    });
-    it('treats role=presentation / none / aria-hidden as decorative when alt is absent', () => {
-        expect(isDecorativeImgTag('<img src="x.jpg" role="presentation">')).toBe(true);
-        expect(isDecorativeImgTag('<img src="x.jpg" role="none">')).toBe(true);
-        expect(isDecorativeImgTag('<img src="x.jpg" aria-hidden="true">')).toBe(true);
-    });
-    it('is not decorative when it has descriptive alt', () => {
-        expect(isDecorativeImgTag('<img src="x.jpg" alt="A cat" role="presentation">')).toBe(false);
-        expect(isDecorativeImgTag('<img src="x.jpg" alt="A cat">')).toBe(false);
-    });
-    it('a bare img with no alt and no role is not decorative (it is missing)', () => {
-        expect(isDecorativeImgTag('<img src="x.jpg">')).toBe(false);
-    });
-});
-describe('analyzeImageAlts', () => {
-    it('classifies images into withAlt / decorative / missing', () => {
-        const html = [
-            '<img src="a.jpg" alt="A photo">', // withAlt
-            '<img src="b.jpg" alt="">', // decorative (intentional empty)
-            '<img src="c.jpg" role="presentation">', // decorative (marked)
-            '<img src="d.jpg">', // missing
-        ].join('');
-        const r = analyzeImageAlts(html);
-        expect(r).toMatchObject({ total: 4, withAlt: 1, decorative: 2, missing: 1 });
-        expect(r.altTexts).toEqual(['A photo']);
-    });
-    it('does not mistake hyphenated attributes for alt', () => {
-        expect(analyzeImageAlts('<img src="x.jpg" data-default-alt="hi">').missing).toBe(1);
-    });
-    it('handles empty / non-HTML input', () => {
-        expect(analyzeImageAlts('').total).toBe(0);
-        expect(analyzeImageAlts(null).missing).toBe(0);
-    });
-});
-describe('countMissingAltImages', () => {
-    it('counts only non-decorative images that lack alt', () => {
-        const html = '<img src="a.jpg" alt="A"><img src="b.jpg" alt=""><img src="c.jpg"><img src="d.jpg" aria-hidden="true">';
-        expect(countMissingAltImages(html)).toBe(1);
-    });
-});
-//# sourceMappingURL=alt-text.test.js.map

package/dist/__tests__/seo/alt-text.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"alt-text.test.js","sourceRoot":"","sources":["../../../src/__tests__/seo/alt-text.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAEnG,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjE,MAAM,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,CAAC,kBAAkB,CAAC,uCAAuC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9E,MAAM,CAAC,kBAAkB,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtE,MAAM,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,kBAAkB,CAAC,mDAAmD,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3F,MAAM,CAAC,kBAAkB,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,IAAI,GAAG;YACX,iCAAiC,EAAE,UAAU;YAC7C,0BAA0B,EAAE,iCAAiC;YAC7D,uCAAuC,EAAE,sBAAsB;YAC/D,mBAAmB,EAAE,UAAU;SAChC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;QAChC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAA;QAC5E,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,gBAAgB,CAAC,yCAAyC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC1C,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,IAAI,GACR,wGAAwG,CAAA;QAC1G,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/seo/analysis-markdown.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=analysis-markdown.test.d.ts.map