@atproto-labs/fetch-node 0.3.3 → 0.3.4

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @atproto-labs/fetch-node
 
+## 0.3.4
+
+### Patch Changes
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Update TypeScript build to rely on references to composite internal projects
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Bundle only necessary files in the NPM tarball, including the `CHANGELOG.md` and `README.md` files (if present).
+
+- Updated dependencies [[`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07)]:
+  - @atproto-labs/fetch@0.3.3
+  - @atproto-labs/pipe@0.2.3
+
 ## 0.3.3
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto-labs/fetch-node",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "license": "MIT",
   "description": "SSRF protection for fetch() in Node.js",
   "keywords": [
@@ -14,6 +14,10 @@
     "url": "https://github.com/bluesky-social/atproto",
     "directory": "packages/internal/fetch-node"
   },
+  "files": [
+    "./dist",
+    "./CHANGELOG.md"
+  ],
   "type": "module",
   "exports": {
     ".": {
@@ -29,8 +33,8 @@
     "undici_v6": "npm:undici@^6.x",
     "undici_v7": "npm:undici@^7.x",
     "undici_v8": "npm:undici@^8.x",
-    "@atproto-labs/fetch": "^0.3.2",
-    "@atproto-labs/pipe": "^0.2.2"
+    "@atproto-labs/fetch": "^0.3.3",
+    "@atproto-labs/pipe": "^0.2.3"
   },
   "devDependencies": {
     "vitest": "^4.0.16"

package/src/index.ts

@@ -1,10 +0,0 @@
-export * from '@atproto-labs/fetch'
-
-export * from './safe.js'
-export * from './unicast.js'
-
-export {
-  isUnicastIpHostname,
-  /** @deprecated use {@link isUnicastIpHostname} instead */
-  isUnicastIpHostname as isUnicastIp,
-} from './util.js'

package/src/safe.ts

@@ -1,117 +0,0 @@
-import {
-  DEFAULT_FORBIDDEN_DOMAIN_NAMES,
-  Fetch,
-  asRequest,
-  explicitRedirectCheckRequestTransform,
-  fetchMaxSizeProcessor,
-  forbiddenDomainNameRequestTransform,
-  protocolCheckRequestTransform,
-  requireHostHeaderTransform,
-  timedFetch,
-} from '@atproto-labs/fetch'
-import { pipe } from '@atproto-labs/pipe'
-import { UnicastFetchWrapOptions, unicastFetchWrap } from './unicast.js'
-
-export type SafeFetchWrapOptions<C> = UnicastFetchWrapOptions<C> & {
-  responseMaxSize?: number
-  ssrfProtection?: boolean
-  allowCustomPort?: boolean
-  allowData?: boolean
-  allowHttp?: boolean
-  allowIpHost?: boolean
-  allowPrivateIps?: boolean
-  timeout?: number
-  forbiddenDomainNames?: Iterable<string>
-  /**
-   * When `false`, a {@link RequestInit['redirect']} value must be explicitly
-   * provided as second argument to the returned function or requests will fail.
-   *
-   * @default false
-   */
-  allowImplicitRedirect?: boolean
-}
-
-/**
- * Wrap a fetch function with safety checks so that it can be safely used
- * with user provided input (URL).
- *
- * @see {@link https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html}
- *
- * @note When {@link SafeFetchWrapOptions.allowImplicitRedirect} is `false`
- * (default), then the returned function **must** be called setting the second
- * argument's `redirect` property to one of the allowed values. Otherwise, if
- * the returned fetch function is called with a `Request` object (and no
- * explicit `redirect` init object), then the verification code will not be able
- * to determine if the `redirect` property was explicitly set or based on the
- * default value (`follow`), causing it to preventively block the request (throw
- * an error). For this reason, unless you set
- * {@link SafeFetchWrapOptions.allowImplicitRedirect} to `true`, you should
- * **not** wrap the returned function into another function that creates a
- * {@link Request} object before passing it to the function (as a e.g. a logging
- * function would).
- */
-export function safeFetchWrap<C>({
-  fetch = globalThis.fetch as Fetch<C>,
-  responseMaxSize = 512 * 1024, // 512kB
-  ssrfProtection = true,
-  allowCustomPort = !ssrfProtection,
-  allowData = false,
-  allowHttp = !ssrfProtection,
-  allowIpHost = true,
-  allowPrivateIps = !ssrfProtection,
-  timeout = 10e3,
-  forbiddenDomainNames = DEFAULT_FORBIDDEN_DOMAIN_NAMES as Iterable<string>,
-  allowImplicitRedirect = false,
-}: SafeFetchWrapOptions<C> = {}) {
-  return pipe(
-    /**
-     * Require explicit {@link RequestInit['redirect']} mode
-     */
-    allowImplicitRedirect ? asRequest : explicitRedirectCheckRequestTransform(),
-
-    /**
-     * Only requests that will be issued with a "Host" header are allowed.
-     */
-    allowIpHost ? asRequest : requireHostHeaderTransform(),
-
-    /**
-     * Prevent using http:, file: or data: protocols.
-     */
-    protocolCheckRequestTransform({
-      'about:': false,
-      'data:': allowData,
-      'file:': false,
-      'http:': allowHttp && { allowCustomPort },
-      'https:': { allowCustomPort },
-    }),
-
-    /**
-     * Disallow fetching from domains we know are not atproto/OIDC client
-     * implementation. Note that other domains can be blocked by providing a
-     * custom fetch function combined with another
-     * forbiddenDomainNameRequestTransform.
-     */
-    forbiddenDomainNameRequestTransform(forbiddenDomainNames),
-
-    /**
-     * Since we will be fetching from the network based on user provided
-     * input, let's mitigate resource exhaustion attacks by setting a timeout.
-     */
-    timedFetch(
-      timeout,
-
-      /**
-       * Since we will be fetching from the network based on user provided
-       * input, we need to make sure that the request is not vulnerable to SSRF
-       * attacks.
-       */
-      allowPrivateIps ? fetch : unicastFetchWrap({ fetch }),
-    ),
-
-    /**
-     * Since we will be fetching user owned data, we need to make sure that an
-     * attacker cannot force us to download a large amounts of data.
-     */
-    fetchMaxSizeProcessor(responseMaxSize),
-  ) satisfies Fetch<unknown>
-}

package/src/unicast.test.ts

@@ -1,135 +0,0 @@
-import { assert, describe, expect, it, vi } from 'vitest'
-import { unicastFetchWrap, unicastLookup } from './unicast.js'
-
-vi.mock(import('node:dns'), async (importOriginal) => {
-  const dns = await importOriginal()
-  return {
-    ...dns,
-    lookup: ((hostname, options, callback) => {
-      if (hostname === 'invalid.com') {
-        setTimeout(callback, 0, null, '127.2.2.2', 4)
-        return
-      }
-
-      if (hostname === 'valid.com') {
-        setTimeout(callback, 0, null, '1.2.3.4', 4)
-        return
-      }
-
-      // @ts-ignore
-      return dns.lookup(hostname, options, callback)
-    }) as typeof dns.lookup,
-  }
-})
-
-describe(unicastLookup, () => {
-  it('should reject hostnames that resolve to private IPs', async () => {
-    await expect(
-      new Promise((resolve, reject) => {
-        unicastLookup('invalid.com', { all: true }, (err, address, family) => {
-          if (err) {
-            reject(err)
-          } else {
-            resolve({ address, family })
-          }
-        })
-      }),
-    ).rejects.toThrow('Hostname resolved to non-unicast address')
-  })
-
-  it('should allow hostnames that resolve to public IPs', async () => {
-    await expect(
-      new Promise((resolve, reject) => {
-        unicastLookup('valid.com', { all: true }, (err, address, family) => {
-          if (err) {
-            reject(err)
-          } else {
-            resolve({ address, family })
-          }
-        })
-      }),
-    ).resolves.toEqual({ address: '1.2.3.4', family: 4 })
-  })
-})
-
-describe(unicastFetchWrap, () => {
-  describe('expected failures', () => {
-    it('should reject private IPv4 hostnames', async () => {
-      const fetch = unicastFetchWrap()
-      await expect(fetch('http://127.0.0.1/test')).rejects.toSatisfy(
-        fetchFailedErrorCauseBy('Hostname is a non-unicast address'),
-      )
-    })
-
-    it('should reject private IPv6 hostnames', async () => {
-      const fetch = unicastFetchWrap()
-      await expect(fetch('http://[::1]/test')).rejects.toSatisfy(
-        fetchFailedErrorCauseBy('Hostname is a non-unicast address'),
-      )
-    })
-
-    it('should reject hostnames that are not public domain tlds', async () => {
-      const fetch = unicastFetchWrap()
-      await expect(fetch('http://localhost/test')).rejects.toSatisfy(
-        fetchFailedErrorCauseBy('Hostname is not a public domain'),
-      )
-
-      await expect(fetch('https://printer.local')).rejects.toSatisfy(
-        fetchFailedErrorCauseBy('Hostname is not a public domain'),
-      )
-    })
-
-    it('should reject hostnames that resolve to private IPs', async () => {
-      const fetch = unicastFetchWrap()
-      await expect(fetch('http://invalid.com/test')).rejects.toSatisfy(
-        fetchFailedErrorCauseBy('Hostname resolved to non-unicast address'),
-      )
-    })
-  })
-
-  describe('expected successes', () => {
-    // Let's avoid calling actual services in tests. There is no easy way to
-    // ensure this works without a real public domain hostname that resolves to
-    // a public IP. So we skip this test for now.
-    it.skip('should allow public domain hostnames that resolve to public IPs', async () => {
-      const fetch = unicastFetchWrap()
-      await fetch('http://atproto.com/@atproto/node-fetch/test')
-    })
-  })
-
-  describe('version handling', () => {
-    it('should throw an error if undici version is too old', () => {
-      using _ = vi
-        .spyOn(process.versions, 'undici', 'get')
-        .mockReturnValue('6.11.0')
-      expect(process.versions.undici).toBe('6.11.0')
-      expect(() => unicastFetchWrap()).toThrowError()
-    })
-
-    it('should support undici version 6.11.1', () => {
-      using _ = vi
-        .spyOn(process.versions, 'undici', 'get')
-        .mockReturnValue('6.11.1')
-      expect(process.versions.undici).toBe('6.11.1')
-      expect(() => unicastFetchWrap()).not.toThrowError()
-    })
-
-    it('should throw an error if undici version is too new', () => {
-      using _ = vi
-        .spyOn(process.versions, 'undici', 'get')
-        .mockReturnValue('9.0.0')
-      expect(process.versions.undici).toBe('9.0.0')
-      expect(() => unicastFetchWrap()).toThrowError()
-    })
-  })
-})
-
-function fetchFailedErrorCauseBy(message: string) {
-  return (err: unknown) => {
-    assert(err instanceof TypeError)
-    expect(err.message).toBe('fetch failed')
-    assert(err.cause instanceof Error)
-    expect(err.cause.message).toBe(message)
-    return true
-  }
-}

package/src/unicast.ts

@@ -1,167 +0,0 @@
-import type { LookupAddress, LookupOptions } from 'node:dns'
-import { lookup } from 'node:dns'
-import type { LookupFunction } from 'node:net'
-import ipaddr from 'ipaddr.js'
-import { Agent as Undici6Agent } from 'undici_v6' // NodeJS 22
-import { Agent as Undici7Agent } from 'undici_v7' // NodeJS 24
-import { Agent as Undici8Agent } from 'undici_v8' // NodeJS 26
-import {
-  Fetch,
-  FetchContext,
-  FetchRequestError,
-  asRequest,
-  extractUrl,
-} from '@atproto-labs/fetch'
-import { compareVersions, isUnicastIpHostname, parseVersion } from './util.js'
-
-const { IPv4, IPv6 } = ipaddr
-
-export type UnicastFetchWrapOptions<C = FetchContext> = {
-  fetch?: Fetch<C>
-}
-
-/**
- * @see {@link https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/}
- */
-export function unicastFetchWrap<C = FetchContext>({
-  fetch = globalThis.fetch,
-}: UnicastFetchWrapOptions<C> = {}): Fetch<C> {
-  // @NOTE we parse here instead of top-level to allow version mocking in tests.
-  const nodeUndiciVersion = parseVersion(process.versions.undici)
-
-  if (
-    !nodeUndiciVersion ||
-    // https://github.com/nodejs/undici/pull/2928
-    compareVersions(nodeUndiciVersion, [6, 11, 1]) < 0
-  ) {
-    throw new Error('Unicast SSRF protection requires Node.js 20.6+')
-  }
-
-  // @NOTE Since major versions of undici are not guaranteed to be backwards
-  // compatible, we need to check the major version and use the appropriate
-  // Agent class for that version, to ensure that the dispatcher interface is
-  // compatible with the version of undici being used.
-  const dispatcher =
-    nodeUndiciVersion[0] === 6
-      ? new Undici6Agent({ connect: { lookup: unicastLookup } })
-      : nodeUndiciVersion[0] === 7
-        ? new Undici7Agent({ connect: { lookup: unicastLookup } })
-        : nodeUndiciVersion[0] === 8
-          ? new Undici8Agent({ connect: { lookup: unicastLookup } })
-          : null
-
-  // @NOTE Because this is a security feature, we don't want to fallback to
-  // using Agent8 to "future proof" this package. Although future version of
-  // undici may have a backwards compatible dispatcher interface, we don't want
-  // to assume that and risk a security issue.
-  if (!dispatcher) {
-    throw new Error(
-      'This version of @atproto-labs/fetch-node does not support your version of undici. Please upgrade @atproto-labs/fetch-node, and use a version of NodeJS that uses undici 6, 7, or 8 internally.',
-    )
-  }
-
-  return async function (this: C, input, init): Promise<Response> {
-    if (init != null && 'dispatcher' in init && init.dispatcher != null) {
-      const request = asRequest(input, init)
-      await request.body?.cancel()
-      const cause = new FetchRequestError(
-        request,
-        500,
-        'SSRF protection cannot be used with a custom request dispatcher',
-      )
-      // @NOTE Use Whatwg style errors so that the error is similar whether
-      // caused by this line of an error caused by the lookup function
-      throw new TypeError('fetch failed', { cause })
-    }
-
-    const url = extractUrl(input)
-
-    if (url.hostname && isUnicastIpHostname(url.hostname) === false) {
-      const request = asRequest(input, init)
-      await request.body?.cancel()
-      const cause = new FetchRequestError(
-        request,
-        400,
-        'Hostname is a non-unicast address',
-      )
-      // @NOTE Use Whatwg style errors so that the error is similar whether
-      // caused by this line of an error caused by the lookup function
-      throw new TypeError('fetch failed', { cause })
-    }
-
-    return fetch.call(this, input, {
-      ...init,
-      // @ts-ignore There is a type mismatch because of undici version
-      // differences, but we know this is safe because we are using the correct
-      // Agent class for the undici version.
-      dispatcher,
-    })
-  }
-}
-
-export function unicastLookup(
-  hostname: string,
-  options: LookupOptions,
-  callback: Parameters<LookupFunction>[2],
-) {
-  if (isLocalHostname(hostname)) {
-    callback(new Error('Hostname is not a public domain'), [])
-    return
-  }
-
-  lookup(hostname, options, (err, address, family) => {
-    if (err) {
-      callback(err, address, family)
-    } else {
-      const ips = Array.isArray(address)
-        ? address.map(parseLookupAddress)
-        : [parseLookupAddress({ address, family })]
-
-      if (ips.some(isNotUnicast)) {
-        callback(
-          new Error('Hostname resolved to non-unicast address'),
-          address,
-          family,
-        )
-      } else {
-        callback(null, address, family)
-      }
-    }
-  })
-}
-
-/**
- * @param hostname - a syntactically valid hostname
- * @returns whether the hostname is a name typically used for on locale area networks.
- * @note **DO NOT** use for security reasons. Only as heuristic.
- */
-function isLocalHostname(hostname: string): boolean {
-  const parts = hostname.split('.')
-  if (parts.length < 2) return true
-
-  const tld = parts.at(-1)!.toLowerCase()
-  return (
-    tld === 'test' ||
-    tld === 'local' ||
-    tld === 'localhost' ||
-    tld === 'invalid' ||
-    tld === 'example'
-  )
-}
-
-function isNotUnicast(ip: ipaddr.IPv4 | ipaddr.IPv6): boolean {
-  return ip.range() !== 'unicast'
-}
-
-function parseLookupAddress({
-  address,
-  family,
-}: LookupAddress): ipaddr.IPv4 | ipaddr.IPv6 {
-  const ip = family === 4 ? IPv4.parse(address) : IPv6.parse(address)
-
-  if (ip instanceof IPv6 && ip.isIPv4MappedAddress()) {
-    return ip.toIPv4Address()
-  } else {
-    return ip
-  }
-}

package/src/util.test.ts

@@ -1,108 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { compareVersions, isUnicastIpHostname, parseVersion } from './util.js'
-
-describe(isUnicastIpHostname, () => {
-  describe('IPv4', () => {
-    it('should return true for unicast IP addresses', () => {
-      expect(isUnicastIpHostname('1.1.1.1')).toBe(true)
-      expect(isUnicastIpHostname('8.8.8.8')).toBe(true)
-    })
-
-    it('should return false for Multicast IP addresses', () => {
-      // https://en.wikipedia.org/wiki/Multicast_address
-
-      expect(isUnicastIpHostname('224.0.0.0')).toBe(false)
-      expect(isUnicastIpHostname('224.0.0.255')).toBe(false)
-      expect(isUnicastIpHostname('224.0.1.0')).toBe(false)
-      expect(isUnicastIpHostname('224.0.1.255')).toBe(false)
-      expect(isUnicastIpHostname('224.0.2.0')).toBe(false)
-      expect(isUnicastIpHostname('224.0.255.255')).toBe(false)
-      expect(isUnicastIpHostname('224.1.0.0')).toBe(false)
-      expect(isUnicastIpHostname('224.1.255.255')).toBe(false)
-      expect(isUnicastIpHostname('224.2.0.0')).toBe(false)
-      expect(isUnicastIpHostname('224.2.255.255')).toBe(false)
-      expect(isUnicastIpHostname('224.3.0.0')).toBe(false)
-      expect(isUnicastIpHostname('224.4.255.255')).toBe(false)
-      expect(isUnicastIpHostname('224.5.0.0')).toBe(false)
-      expect(isUnicastIpHostname('224.255.255.255')).toBe(false)
-      expect(isUnicastIpHostname('225.0.0.0')).toBe(false)
-      expect(isUnicastIpHostname('231.255.255.255')).toBe(false)
-      expect(isUnicastIpHostname('232.0.0.0')).toBe(false)
-      expect(isUnicastIpHostname('232.255.255.255')).toBe(false)
-      expect(isUnicastIpHostname('233.0.0.0')).toBe(false)
-      expect(isUnicastIpHostname('233.251.255.255')).toBe(false)
-      expect(isUnicastIpHostname('233.252.0.0')).toBe(false)
-      expect(isUnicastIpHostname('233.255.255.255')).toBe(false)
-      expect(isUnicastIpHostname('234.0.0.0')).toBe(false)
-      expect(isUnicastIpHostname('234.255.255.255')).toBe(false)
-      expect(isUnicastIpHostname('235.0.0.0')).toBe(false)
-      expect(isUnicastIpHostname('238.255.255.255')).toBe(false)
-      expect(isUnicastIpHostname('239.0.0.0')).toBe(false)
-      expect(isUnicastIpHostname('239.255.255.255')).toBe(false)
-    })
-
-    it('should return false for loopback IP addresses', () => {
-      // https://en.wikipedia.org/wiki/Loopback
-
-      expect(isUnicastIpHostname('127.0.0.0')).toBe(false)
-      expect(isUnicastIpHostname('127.0.0.1')).toBe(false)
-      expect(isUnicastIpHostname('127.0.34.54')).toBe(false)
-      expect(isUnicastIpHostname('127.255.255.255')).toBe(false)
-    })
-
-    it('should return false for private IP addresses', () => {
-      // https://en.wikipedia.org/wiki/Private_network#Private_IPv4_address_spaces
-
-      expect(isUnicastIpHostname('10.0.0.0')).toBe(false)
-      expect(isUnicastIpHostname('10.255.255.255')).toBe(false)
-      expect(isUnicastIpHostname('172.16.0.0')).toBe(false)
-      expect(isUnicastIpHostname('172.16.0.1')).toBe(false)
-      expect(isUnicastIpHostname('172.31.255.255')).toBe(false)
-      expect(isUnicastIpHostname('192.168.0.0')).toBe(false)
-      expect(isUnicastIpHostname('192.168.1.1')).toBe(false)
-      expect(isUnicastIpHostname('192.168.255.255')).toBe(false)
-    })
-  })
-
-  it('should return undefined for non-IP hostnames', () => {
-    expect(isUnicastIpHostname('example.com')).toBeUndefined()
-    expect(isUnicastIpHostname('localhost')).toBeUndefined()
-  })
-})
-
-describe(parseVersion, () => {
-  it('should parse valid version strings', () => {
-    expect(parseVersion('1.2.3')).toEqual([1, 2, 3])
-    expect(parseVersion('0.0.1')).toEqual([0, 0, 1])
-    expect(parseVersion('10.20.30')).toEqual([10, 20, 30])
-  })
-
-  it('should return undefined for invalid version strings', () => {
-    expect(parseVersion('1.2')).toBeUndefined()
-    expect(parseVersion('1.2.3.4')).toBeUndefined()
-    expect(parseVersion('abc')).toBeUndefined()
-  })
-
-  it('should return undefined for empty or undefined input', () => {
-    expect(parseVersion('')).toBeUndefined()
-    expect(parseVersion(undefined)).toBeUndefined()
-  })
-})
-
-describe(compareVersions, () => {
-  it('should return 0 for equal versions', () => {
-    expect(compareVersions([1, 2, 3], [1, 2, 3])).toBe(0)
-  })
-
-  it('should return -1 for a < b', () => {
-    expect(compareVersions([1, 2, 3], [1, 2, 4])).toBe(-1)
-    expect(compareVersions([1, 2, 3], [1, 3, 0])).toBe(-1)
-    expect(compareVersions([1, 2, 3], [2, 0, 0])).toBe(-1)
-  })
-
-  it('should return 1 for a > b', () => {
-    expect(compareVersions([1, 2, 4], [1, 2, 3])).toBe(1)
-    expect(compareVersions([1, 3, 0], [1, 2, 3])).toBe(1)
-    expect(compareVersions([2, 0, 0], [1, 2, 3])).toBe(1)
-  })
-})

package/src/util.ts

@@ -1,37 +0,0 @@
-import ipaddr from 'ipaddr.js'
-
-const { IPv4, IPv6 } = ipaddr
-
-function parseIpHostname(
-  hostname: string,
-): ipaddr.IPv4 | ipaddr.IPv6 | undefined {
-  if (IPv4.isIPv4(hostname)) {
-    return IPv4.parse(hostname)
-  }
-
-  if (hostname.startsWith('[') && hostname.endsWith(']')) {
-    return IPv6.parse(hostname.slice(1, -1))
-  }
-
-  return undefined
-}
-
-export function isUnicastIpHostname(hostname: string): boolean | undefined {
-  const ip = parseIpHostname(hostname)
-  return ip ? ip.range() === 'unicast' : undefined
-}
-
-export type Version = [major: number, minor: number, patch: number]
-export function parseVersion(version?: string): Version | undefined {
-  const match = version?.match(/^(\d+)\.(\d+)\.(\d+)$/)
-  if (!match) return undefined
-  return [Number(match[1]), Number(match[2]), Number(match[3])]
-}
-
-export function compareVersions(a: Version, b: Version): number {
-  for (let i = 0; i < 3; i++) {
-    if (a[i] < b[i]) return -1
-    if (a[i] > b[i]) return 1
-  }
-  return 0
-}

package/tsconfig.build.json

@@ -1,9 +0,0 @@
-{
-  "extends": ["../../../tsconfig/node.json"],
-  "include": ["./src"],
-  "exclude": ["**/*.test.ts"],
-  "compilerOptions": {
-    "outDir": "dist",
-    "rootDir": "src",
-  },
-}

package/tsconfig.build.tsbuildinfo

@@ -1 +0,0 @@
-{"version":"7.0.0-dev.20260614.1","root":["./src/index.ts","./src/safe.ts","./src/unicast.ts","./src/util.ts"]}

package/tsconfig.json

@@ -1,7 +0,0 @@
-{
-  "include": [],
-  "references": [
-    { "path": "./tsconfig.build.json" },
-    { "path": "./tsconfig.test.json" },
-  ],
-}

package/tsconfig.test.json

@@ -1,8 +0,0 @@
-{
-  "extends": ["../../../tsconfig/vitest.json"],
-  "include": ["./tests", "./src/**/*.test.ts"],
-  "compilerOptions": {
-    "noImplicitAny": true,
-    "rootDir": "./",
-  },
-}

package/tsconfig.test.tsbuildinfo

@@ -1 +0,0 @@
-{"version":"7.0.0-dev.20260614.1","root":["./src/unicast.test.ts","./src/util.test.ts"]}

package/vitest.config.ts

@@ -1,5 +0,0 @@
-import { defineProject } from 'vitest/config'
-
-export default defineProject({
-  test: {},
-})