@c9up/ream 0.2.28 → 0.2.30

package/dist/http-client/HttpClient.js

@@ -0,0 +1,386 @@
+/**
+ * Outbound HTTP for server code that calls a URL it does not fully control —
+ * a customer's domain, a webhook target, a CMS the user pointed the app at.
+ *
+ * `fetch` connects wherever DNS says. A domain that resolves to `10.0.0.5`,
+ * `127.0.0.1` or `169.254.169.254` makes the server read its own network on
+ * the attacker's behalf (SSRF). Checking the address before the call is not
+ * enough: a DNS answer can change between the check and the connection
+ * (rebinding). So the check runs AT CONNECT TIME, inside the `lookup` of the
+ * client's own agents — the address that is checked is the address the
+ * socket connects to. The agents belong to this client alone, so a pooled
+ * socket opened by other code is never reused.
+ *
+ * Also bounded: one deadline for the whole exchange (redirects included), a
+ * maximum response size, and a few redirects, to the same host by default.
+ * Every failure is an {@link HttpClientError} with a `reason`.
+ *
+ * No AdonisJS counterpart: the framework ships no outbound client.
+ */
+import { lookup as dnsLookup } from 'node:dns';
+import http from 'node:http';
+import https from 'node:https';
+import { isIP } from 'node:net';
+import { ReamError } from '../errors/ReamError.js';
+import { isPublicAddress } from './addresses.js';
+const CODES = {
+    invalidUrl: 'E_HTTP_CLIENT_INVALID_URL',
+    privateAddress: 'E_HTTP_CLIENT_PRIVATE_ADDRESS',
+    unreachable: 'E_HTTP_CLIENT_UNREACHABLE',
+    timedOut: 'E_HTTP_CLIENT_TIMED_OUT',
+    tooLarge: 'E_HTTP_CLIENT_TOO_LARGE',
+    redirect: 'E_HTTP_CLIENT_REDIRECT_REFUSED',
+};
+/**
+ * A failed outbound request. A `ReamError`, not an HTTP `Exception`: left
+ * uncaught in a handler it answers a generic 500 and its message, which names
+ * hosts and addresses, never reaches the client.
+ */
+export class HttpClientError extends ReamError {
+    reason;
+    /** The target, without its query string (which may carry credentials). */
+    url;
+    constructor(reason, url, message, cause) {
+        const shown = describeUrl(url);
+        super(CODES[reason], message, { context: { url: shown } });
+        this.name = 'HttpClientError';
+        this.reason = reason;
+        this.url = shown;
+        if (cause !== undefined)
+            this.cause = cause;
+    }
+}
+/** A complete response, its body read and bounded. */
+export class HttpResponse {
+    status;
+    headers;
+    /** The URL that answered, after redirects. */
+    url;
+    body;
+    constructor(status, headers, url, body) {
+        this.status = status;
+        this.headers = headers;
+        this.url = url;
+        this.body = body;
+    }
+    /** A 2xx status. */
+    get ok() {
+        return this.status >= 200 && this.status < 300;
+    }
+    /** A header's first value; names are case-insensitive. */
+    header(name) {
+        const value = this.headers[name.toLowerCase()];
+        return Array.isArray(value) ? value[0] : value;
+    }
+    text() {
+        return this.body.toString('utf8');
+    }
+    /** The body parsed as JSON — `unknown` until the caller validates it. */
+    json() {
+        return JSON.parse(this.text());
+    }
+}
+const DEFAULT_TIMEOUT = 10_000;
+const DEFAULT_MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
+const DEFAULT_MAX_REDIRECTS = 3;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/** Headers that must not follow a redirect to another host. */
+const CREDENTIAL_HEADERS = ['authorization', 'cookie', 'proxy-authorization'];
+export class HttpClient {
+    #timeout;
+    #maxResponseBytes;
+    #maxRedirects;
+    #crossHostRedirects;
+    #headers;
+    #allowHosts;
+    #guardedAgents;
+    #exemptAgents;
+    constructor(options = {}) {
+        this.#timeout = options.timeout ?? DEFAULT_TIMEOUT;
+        this.#maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
+        this.#maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
+        this.#crossHostRedirects = options.crossHostRedirects ?? false;
+        this.#headers = {
+            'user-agent': options.userAgent ?? '@c9up/ream',
+            ...lowercaseKeys(options.headers ?? {}),
+        };
+        this.#allowHosts = new Set((options.allowHosts ?? []).map((entry) => entry.toLowerCase()));
+    }
+    get(url, options = {}) {
+        return this.request(url, { ...options, method: 'GET' });
+    }
+    post(url, options = {}) {
+        return this.request(url, { ...options, method: 'POST' });
+    }
+    put(url, options = {}) {
+        return this.request(url, { ...options, method: 'PUT' });
+    }
+    patch(url, options = {}) {
+        return this.request(url, { ...options, method: 'PATCH' });
+    }
+    delete(url, options = {}) {
+        return this.request(url, { ...options, method: 'DELETE' });
+    }
+    /** Send a request, following redirects within the client's rules. */
+    async request(input, options = {}) {
+        let url = parseTarget(input);
+        let method = (options.method ?? 'GET').toUpperCase();
+        let headers = {
+            ...this.#headers,
+            ...lowercaseKeys(options.headers ?? {}),
+        };
+        let body = encodeBody(options, headers);
+        const maxResponseBytes = options.maxResponseBytes ?? this.#maxResponseBytes;
+        const timeout = options.timeout ?? this.#timeout;
+        const deadline = new AbortController();
+        const timer = setTimeout(() => {
+            deadline.abort(new HttpClientError('timedOut', url, `No complete response within ${timeout} ms.`));
+        }, timeout);
+        const signal = options.signal
+            ? AbortSignal.any([deadline.signal, options.signal])
+            : deadline.signal;
+        try {
+            for (let redirects = 0;; redirects++) {
+                this.#assertAddressLiteralAllowed(url);
+                if (body !== undefined)
+                    headers['content-length'] = String(body.length);
+                const response = await this.send({ url, method, headers, body, signal, maxResponseBytes });
+                if (response.body.length > maxResponseBytes) {
+                    throw new HttpClientError('tooLarge', url, `Response exceeds ${maxResponseBytes} bytes.`);
+                }
+                const location = response.header('location');
+                if (!REDIRECT_STATUSES.has(response.status) || location === undefined)
+                    return response;
+                if (this.#maxRedirects === 0)
+                    return response;
+                if (redirects >= this.#maxRedirects) {
+                    throw new HttpClientError('redirect', url, `More than ${this.#maxRedirects} redirects.`);
+                }
+                const next = parseTarget(location, url);
+                if (url.protocol === 'https:' && next.protocol === 'http:') {
+                    throw new HttpClientError('redirect', next, 'Refused a redirect from https to http.');
+                }
+                if (next.host !== url.host) {
+                    if (!this.#crossHostRedirects) {
+                        throw new HttpClientError('redirect', next, `Refused a redirect from ${url.host} to another host (${next.host}).`);
+                    }
+                    headers = withoutKeys(headers, CREDENTIAL_HEADERS);
+                }
+                // What browsers and fetch do: a 303 always becomes a GET, and a
+                // 301/302 does when it answered a POST. 307/308 keep method and body.
+                const becomesGet = response.status === 303 ||
+                    ((response.status === 301 || response.status === 302) && method === 'POST');
+                if (becomesGet && method !== 'HEAD') {
+                    method = 'GET';
+                    body = undefined;
+                    headers = withoutKeys(headers, ['content-type', 'content-length']);
+                }
+                url = next;
+            }
+        }
+        catch (error) {
+            // An abort from the deadline surfaces as whatever the transport threw;
+            // the deadline's own error says what happened.
+            if (deadline.signal.aborted && deadline.signal.reason instanceof HttpClientError) {
+                throw deadline.signal.reason;
+            }
+            throw error;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    /**
+     * Put one request on the wire and read its response, bounded. Redirects are
+     * not followed here. Overridden by the test fake.
+     */
+    send(request) {
+        const { url, method, headers, body, signal, maxResponseBytes } = request;
+        const agents = this.#agentsFor(url);
+        const transport = url.protocol === 'https:' ? https : http;
+        const agent = url.protocol === 'https:' ? agents.https : agents.http;
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            const fail = (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                signal.removeEventListener('abort', onAbort);
+                req.destroy();
+                reject(toClientError(error, url, signal));
+            };
+            const onAbort = () => fail(signal.reason);
+            const req = transport.request(url, { method, headers, agent }, (res) => {
+                const declared = Number(res.headers['content-length']);
+                if (Number.isFinite(declared) && declared > maxResponseBytes) {
+                    fail(new HttpClientError('tooLarge', url, `Response exceeds ${maxResponseBytes} bytes.`));
+                    return;
+                }
+                const chunks = [];
+                let received = 0;
+                res.on('data', (chunk) => {
+                    received += chunk.length;
+                    if (received > maxResponseBytes) {
+                        fail(new HttpClientError('tooLarge', url, `Response exceeds ${maxResponseBytes} bytes.`));
+                        return;
+                    }
+                    chunks.push(chunk);
+                });
+                res.on('error', fail);
+                res.on('close', () => {
+                    if (!res.complete)
+                        fail(new Error('The response was cut short.'));
+                });
+                res.on('end', () => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    signal.removeEventListener('abort', onAbort);
+                    resolve(new HttpResponse(res.statusCode ?? 0, copyHeaders(res.headers), url.href, Buffer.concat(chunks)));
+                });
+            });
+            req.on('error', fail);
+            if (signal.aborted) {
+                fail(signal.reason);
+                return;
+            }
+            signal.addEventListener('abort', onAbort, { once: true });
+            req.end(body);
+        });
+    }
+    /** Release the pooled connections. The client stays usable; new ones are opened on demand. */
+    close() {
+        for (const agents of [this.#guardedAgents, this.#exemptAgents]) {
+            agents?.http.destroy();
+            agents?.https.destroy();
+        }
+        this.#guardedAgents = undefined;
+        this.#exemptAgents = undefined;
+    }
+    #isExempt(url) {
+        if (this.#allowHosts.size === 0)
+            return false;
+        const port = url.port || (url.protocol === 'https:' ? '443' : '80');
+        const hostname = url.hostname.toLowerCase();
+        return this.#allowHosts.has(hostname) || this.#allowHosts.has(`${hostname}:${port}`);
+    }
+    /**
+     * An address written in the URL is never looked up, so the connect-time
+     * check does not see it: it is judged here, on every hop.
+     */
+    #assertAddressLiteralAllowed(url) {
+        const address = url.hostname.replace(/^\[|\]$/g, '');
+        if (isIP(address) === 0 || this.#isExempt(url))
+            return;
+        if (!isPublicAddress(address)) {
+            throw new HttpClientError('privateAddress', url, `${address} is not a public address.`);
+        }
+    }
+    #agentsFor(url) {
+        if (this.#isExempt(url)) {
+            this.#exemptAgents ??= {
+                http: new http.Agent({ keepAlive: true }),
+                https: new https.Agent({ keepAlive: true }),
+            };
+            return this.#exemptAgents;
+        }
+        this.#guardedAgents ??= {
+            http: new http.Agent({ keepAlive: true, lookup: publicOnlyLookup }),
+            https: new https.Agent({ keepAlive: true, lookup: publicOnlyLookup }),
+        };
+        return this.#guardedAgents;
+    }
+}
+/**
+ * `dns.lookup`, refusing the connection when ANY address the name resolves
+ * to is not public — a name that answers both a public and a private address
+ * is a rebinding setup, not a choice to make on the attacker's behalf.
+ */
+const publicOnlyLookup = (hostname, options, callback) => {
+    dnsLookup(hostname, { ...options, all: true }, (error, addresses) => {
+        if (error) {
+            callback(error, '');
+            return;
+        }
+        const refused = addresses.find((entry) => !isPublicAddress(entry.address));
+        const [first] = addresses;
+        if (refused !== undefined || first === undefined) {
+            callback(new HttpClientError('privateAddress', `http://${hostname}`, `${hostname} resolves to ${refused?.address ?? 'no address'}, which is not a public address.`), '');
+            return;
+        }
+        if (options.all)
+            callback(null, addresses);
+        else
+            callback(null, first.address, first.family);
+    });
+};
+function parseTarget(input, base) {
+    let url;
+    try {
+        url = new URL(input, base);
+    }
+    catch (error) {
+        throw new HttpClientError('invalidUrl', String(input), 'Not a valid URL.', error);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new HttpClientError('invalidUrl', url, `Only http and https URLs are allowed, not ${url.protocol}`);
+    }
+    if (url.username !== '' || url.password !== '') {
+        throw new HttpClientError('invalidUrl', url, 'Credentials in the URL are refused; send a header.');
+    }
+    return url;
+}
+function encodeBody(options, headers) {
+    if (options.json !== undefined) {
+        headers['content-type'] ??= 'application/json';
+        return Buffer.from(JSON.stringify(options.json), 'utf8');
+    }
+    if (options.body === undefined)
+        return undefined;
+    return typeof options.body === 'string'
+        ? Buffer.from(options.body, 'utf8')
+        : Buffer.from(options.body);
+}
+function toClientError(error, url, signal) {
+    if (error instanceof HttpClientError)
+        return error;
+    // An abort the caller asked for is theirs to recognise: hand back its reason.
+    if (signal.aborted && error === signal.reason)
+        return error;
+    const message = error instanceof Error ? error.message : String(error);
+    return new HttpClientError('unreachable', url, `Could not reach ${url.host}: ${message}`, error);
+}
+function lowercaseKeys(headers) {
+    const out = {};
+    for (const [name, value] of Object.entries(headers))
+        out[name.toLowerCase()] = value;
+    return out;
+}
+function withoutKeys(headers, names) {
+    const out = {};
+    for (const [name, value] of Object.entries(headers)) {
+        if (!names.includes(name))
+            out[name] = value;
+    }
+    return out;
+}
+function copyHeaders(headers) {
+    const out = {};
+    for (const [name, value] of Object.entries(headers)) {
+        if (value !== undefined)
+            out[name] = value;
+    }
+    return out;
+}
+function describeUrl(url) {
+    if (typeof url === 'string') {
+        try {
+            return describeUrl(new URL(url));
+        }
+        catch {
+            return url.split('?')[0] ?? url;
+        }
+    }
+    return `${url.origin}${url.pathname}`;
+}
+//# sourceMappingURL=HttpClient.js.map

package/dist/http-client/HttpClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpClient.js","sourceRoot":"","sources":["../../src/http-client/HttpClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,KAAK,MAAM,YAAY,CAAA;AAC9B,OAAO,EAAE,IAAI,EAAuB,MAAM,UAAU,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAWhD,MAAM,KAAK,GAAsC;IAC/C,UAAU,EAAE,2BAA2B;IACvC,cAAc,EAAE,+BAA+B;IAC/C,WAAW,EAAE,2BAA2B;IACxC,QAAQ,EAAE,yBAAyB;IACnC,QAAQ,EAAE,yBAAyB;IACnC,QAAQ,EAAE,gCAAgC;CAC3C,CAAA;AAED;;;;GAIG;AACH,MAAM,OAAO,eAAgB,SAAQ,SAAS;IACnC,MAAM,CAAmB;IAClC,0EAA0E;IACjE,GAAG,CAAQ;IAEpB,YAAY,MAAyB,EAAE,GAAiB,EAAE,OAAe,EAAE,KAAe;QACxF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC9B,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;QAC1D,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,GAAG,GAAG,KAAK,CAAA;QAChB,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IAC7C,CAAC;CACF;AAgDD,sDAAsD;AACtD,MAAM,OAAO,YAAY;IACd,MAAM,CAAQ;IACd,OAAO,CAA6C;IAC7D,8CAA8C;IACrC,GAAG,CAAQ;IACX,IAAI,CAAQ;IAErB,YACE,MAAc,EACd,OAA0C,EAC1C,GAAW,EACX,IAAY;QAEZ,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;IAED,oBAAoB;IACpB,IAAI,EAAE;QACJ,OAAO,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,CAAA;IAChD,CAAC;IAED,0DAA0D;IAC1D,MAAM,CAAC,IAAY;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;QAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAChD,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC;IAED,yEAAyE;IACzE,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IAChC,CAAC;CACF;AAED,MAAM,eAAe,GAAG,MAAM,CAAA;AAC9B,MAAM,0BAA0B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAClD,MAAM,qBAAqB,GAAG,CAAC,CAAA;AAC/B,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;AAC5D,+DAA+D;AAC/D,MAAM,kBAAkB,GAAG,CAAC,eAAe,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAA;AAE7E,MAAM,OAAO,UAAU;IACZ,QAAQ,CAAQ;IAChB,iBAAiB,CAAQ;IACzB,aAAa,CAAQ;IACrB,mBAAmB,CAAS;IAC5B,QAAQ,CAAwB;IAChC,WAAW,CAAqB;IACzC,cAAc,CAA2C;IACzD,aAAa,CAA2C;IAExD,YAAY,UAA6B,EAAE;QACzC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,eAAe,CAAA;QAClD,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAA;QAC/E,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAA;QAClE,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,IAAI,KAAK,CAAA;QAC9D,IAAI,CAAC,QAAQ,GAAG;YACd,YAAY,EAAE,OAAO,CAAC,SAAS,IAAI,YAAY;YAC/C,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;SACxC,CAAA;QACD,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IAC5F,CAAC;IAED,GAAG,CAAC,GAAiB,EAAE,UAA8C,EAAE;QACrE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IACzD,CAAC;IAED,IAAI,CAAC,GAAiB,EAAE,UAA8C,EAAE;QACtE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,GAAG,CAAC,GAAiB,EAAE,UAA8C,EAAE;QACrE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IACzD,CAAC;IAED,KAAK,CACH,GAAiB,EACjB,UAA8C,EAAE;QAEhD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IAC3D,CAAC;IAED,MAAM,CACJ,GAAiB,EACjB,UAA8C,EAAE;QAEhD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,OAAO,CAAC,KAAmB,EAAE,UAA8B,EAAE;QACjE,IAAI,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QAC5B,IAAI,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;QACpD,IAAI,OAAO,GAA2B;YACpC,GAAG,IAAI,CAAC,QAAQ;YAChB,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;SACxC,CAAA;QACD,IAAI,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvC,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,iBAAiB,CAAA;QAE3E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAA;QAChD,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,CAAC,KAAK,CACZ,IAAI,eAAe,CAAC,UAAU,EAAE,GAAG,EAAE,+BAA+B,OAAO,MAAM,CAAC,CACnF,CAAA;QACH,CAAC,EAAE,OAAO,CAAC,CAAA;QACX,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM;YAC3B,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACpD,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAA;QAEnB,IAAI,CAAC;YACH,KAAK,IAAI,SAAS,GAAG,CAAC,GAAI,SAAS,EAAE,EAAE,CAAC;gBACtC,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAA;gBACtC,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;gBACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAA;gBAC1F,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;oBAC5C,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,GAAG,EAAE,oBAAoB,gBAAgB,SAAS,CAAC,CAAA;gBAC3F,CAAC;gBAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;gBAC5C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO,QAAQ,CAAA;gBACtF,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC;oBAAE,OAAO,QAAQ,CAAA;gBAC7C,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;oBACpC,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,GAAG,EAAE,aAAa,IAAI,CAAC,aAAa,aAAa,CAAC,CAAA;gBAC1F,CAAC;gBAED,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;gBACvC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;oBAC3D,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAA;gBACvF,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;oBAC3B,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;wBAC9B,MAAM,IAAI,eAAe,CACvB,UAAU,EACV,IAAI,EACJ,2BAA2B,GAAG,CAAC,IAAI,qBAAqB,IAAI,CAAC,IAAI,IAAI,CACtE,CAAA;oBACH,CAAC;oBACD,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;gBACpD,CAAC;gBACD,gEAAgE;gBAChE,sEAAsE;gBACtE,MAAM,UAAU,GACd,QAAQ,CAAC,MAAM,KAAK,GAAG;oBACvB,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,MAAM,KAAK,MAAM,CAAC,CAAA;gBAC7E,IAAI,UAAU,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACpC,MAAM,GAAG,KAAK,CAAA;oBACd,IAAI,GAAG,SAAS,CAAA;oBAChB,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAA;gBACpE,CAAC;gBACD,GAAG,GAAG,IAAI,CAAA;YACZ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,+CAA+C;YAC/C,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,YAAY,eAAe,EAAE,CAAC;gBACjF,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAA;YAC9B,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IAED;;;OAGG;IACO,IAAI,CAAC,OAAwB;QACrC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAA;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QACnC,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;QAEpE,OAAO,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnD,IAAI,OAAO,GAAG,KAAK,CAAA;YACnB,MAAM,IAAI,GAAG,CAAC,KAAc,EAAQ,EAAE;gBACpC,IAAI,OAAO;oBAAE,OAAM;gBACnB,OAAO,GAAG,IAAI,CAAA;gBACd,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBAC5C,GAAG,CAAC,OAAO,EAAE,CAAA;gBACb,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;YAC3C,CAAC,CAAA;YACD,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAE/C,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;gBACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAA;gBACtD,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,gBAAgB,EAAE,CAAC;oBAC7D,IAAI,CAAC,IAAI,eAAe,CAAC,UAAU,EAAE,GAAG,EAAE,oBAAoB,gBAAgB,SAAS,CAAC,CAAC,CAAA;oBACzF,OAAM;gBACR,CAAC;gBACD,MAAM,MAAM,GAAa,EAAE,CAAA;gBAC3B,IAAI,QAAQ,GAAG,CAAC,CAAA;gBAChB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC/B,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAA;oBACxB,IAAI,QAAQ,GAAG,gBAAgB,EAAE,CAAC;wBAChC,IAAI,CACF,IAAI,eAAe,CAAC,UAAU,EAAE,GAAG,EAAE,oBAAoB,gBAAgB,SAAS,CAAC,CACpF,CAAA;wBACD,OAAM;oBACR,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACpB,CAAC,CAAC,CAAA;gBACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBACrB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACnB,IAAI,CAAC,GAAG,CAAC,QAAQ;wBAAE,IAAI,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAA;gBACnE,CAAC,CAAC,CAAA;gBACF,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,IAAI,OAAO;wBAAE,OAAM;oBACnB,OAAO,GAAG,IAAI,CAAA;oBACd,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;oBAC5C,OAAO,CACL,IAAI,YAAY,CACd,GAAG,CAAC,UAAU,IAAI,CAAC,EACnB,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EACxB,GAAG,CAAC,IAAI,EACR,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CACtB,CACF,CAAA;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACrB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBACnB,OAAM;YACR,CAAC;YACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACzD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,8FAA8F;IAC9F,KAAK;QACH,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/D,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;YACtB,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;QACzB,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,SAAS,CAAA;QAC/B,IAAI,CAAC,aAAa,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,SAAS,CAAC,GAAQ;QAChB,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACnE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;QAC3C,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAA;IACtF,CAAC;IAED;;;OAGG;IACH,4BAA4B,CAAC,GAAQ;QACnC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;QACpD,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;YAAE,OAAM;QACtD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,OAAO,2BAA2B,CAAC,CAAA;QACzF,CAAC;IACH,CAAC;IAED,UAAU,CAAC,GAAQ;QACjB,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,aAAa,KAAK;gBACrB,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;gBACzC,KAAK,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;aAC5C,CAAA;YACD,OAAO,IAAI,CAAC,aAAa,CAAA;QAC3B,CAAC;QACD,IAAI,CAAC,cAAc,KAAK;YACtB,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;YACnE,KAAK,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;SACtE,CAAA;QACD,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,gBAAgB,GAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;IACvE,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QAClE,IAAI,KAAK,EAAE,CAAC;YACV,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YACnB,OAAM;QACR,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QAC1E,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAA;QACzB,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACjD,QAAQ,CACN,IAAI,eAAe,CACjB,gBAAgB,EAChB,UAAU,QAAQ,EAAE,EACpB,GAAG,QAAQ,gBAAgB,OAAO,EAAE,OAAO,IAAI,YAAY,kCAAkC,CAC9F,EACD,EAAE,CACH,CAAA;YACD,OAAM;QACR,CAAC;QACD,IAAI,OAAO,CAAC,GAAG;YAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;;YACrC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,SAAS,WAAW,CAAC,KAAmB,EAAE,IAAU;IAClD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAA;IACnF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,eAAe,CACvB,YAAY,EACZ,GAAG,EACH,6CAA6C,GAAG,CAAC,QAAQ,EAAE,CAC5D,CAAA;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,eAAe,CACvB,YAAY,EACZ,GAAG,EACH,oDAAoD,CACrD,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,UAAU,CACjB,OAA2B,EAC3B,OAA+B;IAE/B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,CAAC,cAAc,CAAC,KAAK,kBAAkB,CAAA;QAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAChD,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QACrC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;QACnC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,GAAQ,EAAE,MAAmB;IAClE,IAAI,KAAK,YAAY,eAAe;QAAE,OAAO,KAAK,CAAA;IAClD,8EAA8E;IAC9E,IAAI,MAAM,CAAC,OAAO,IAAI,KAAK,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAC3D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtE,OAAO,IAAI,eAAe,CAAC,aAAa,EAAE,GAAG,EAAE,mBAAmB,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,EAAE,KAAK,CAAC,CAAA;AAClG,CAAC;AAED,SAAS,aAAa,CAAC,OAA+B;IACpD,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAA;IACpF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,WAAW,CAClB,OAA+B,EAC/B,KAAwB;IAExB,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;IAC9C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,OAAiC;IACpD,MAAM,GAAG,GAAsC,EAAE,CAAA;IACjD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;IAC5C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,GAAiB;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAA;QACjC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvC,CAAC"}

package/dist/http-client/addresses.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Which addresses an outbound request may connect to.
+ *
+ * Everything that is not a globally routable unicast address is refused:
+ * loopback, private and shared ranges, link-local (the cloud metadata
+ * endpoint `169.254.169.254` lives there), documentation and benchmarking
+ * ranges, multicast, and the IPv6 transition prefixes that tunnel to an IPv4
+ * address (IPv4-compatible, NAT64, 6to4, Teredo) — through those, a "public" IPv6 address can
+ * still reach `10.0.0.5`. An IPv4-mapped IPv6 address (`::ffff:10.0.0.5`) is
+ * judged by the IPv4 rules.
+ */
+/** True for a globally routable unicast address; false for anything else, including a non-address. */
+export declare function isPublicAddress(address: string): boolean;
+//# sourceMappingURL=addresses.d.ts.map

package/dist/http-client/addresses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"addresses.d.ts","sourceRoot":"","sources":["../../src/http-client/addresses.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA0CH,sGAAsG;AACtG,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAIxD"}

package/dist/http-client/addresses.js

@@ -0,0 +1,57 @@
+/**
+ * Which addresses an outbound request may connect to.
+ *
+ * Everything that is not a globally routable unicast address is refused:
+ * loopback, private and shared ranges, link-local (the cloud metadata
+ * endpoint `169.254.169.254` lives there), documentation and benchmarking
+ * ranges, multicast, and the IPv6 transition prefixes that tunnel to an IPv4
+ * address (IPv4-compatible, NAT64, 6to4, Teredo) — through those, a "public" IPv6 address can
+ * still reach `10.0.0.5`. An IPv4-mapped IPv6 address (`::ffff:10.0.0.5`) is
+ * judged by the IPv4 rules.
+ */
+import { BlockList, isIP } from 'node:net';
+const NON_PUBLIC_V4 = [
+    ['0.0.0.0', 8], // "this network"
+    ['10.0.0.0', 8], // private
+    ['100.64.0.0', 10], // carrier-grade NAT
+    ['127.0.0.0', 8], // loopback
+    ['169.254.0.0', 16], // link-local, cloud metadata
+    ['172.16.0.0', 12], // private
+    ['192.0.0.0', 24], // IETF protocol assignments
+    ['192.0.2.0', 24], // TEST-NET-1
+    ['192.88.99.0', 24], // 6to4 relay anycast
+    ['192.168.0.0', 16], // private
+    ['198.18.0.0', 15], // benchmarking
+    ['198.51.100.0', 24], // TEST-NET-2
+    ['203.0.113.0', 24], // TEST-NET-3
+    ['224.0.0.0', 4], // multicast
+    ['240.0.0.0', 4], // reserved, broadcast
+];
+const NON_PUBLIC_V6 = [
+    ['::', 128], // unspecified
+    ['::1', 128], // loopback
+    ['::', 96], // IPv4-compatible (deprecated), embeds an IPv4 address
+    ['64:ff9b::', 96], // NAT64, embeds an IPv4 address
+    ['64:ff9b:1::', 48], // local-use NAT64
+    ['100::', 64], // discard
+    ['2001::', 23], // IETF protocol assignments, Teredo included
+    ['2001:db8::', 32], // documentation
+    ['2002::', 16], // 6to4, embeds an IPv4 address
+    ['fc00::', 7], // unique local
+    ['fe80::', 10], // link-local
+    ['fec0::', 10], // site-local (deprecated)
+    ['ff00::', 8], // multicast
+];
+const nonPublic = new BlockList();
+for (const [network, prefix] of NON_PUBLIC_V4)
+    nonPublic.addSubnet(network, prefix, 'ipv4');
+for (const [network, prefix] of NON_PUBLIC_V6)
+    nonPublic.addSubnet(network, prefix, 'ipv6');
+/** True for a globally routable unicast address; false for anything else, including a non-address. */
+export function isPublicAddress(address) {
+    const family = isIP(address);
+    if (family === 0)
+        return false;
+    return !nonPublic.check(address, family === 4 ? 'ipv4' : 'ipv6');
+}
+//# sourceMappingURL=addresses.js.map

package/dist/http-client/addresses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"addresses.js","sourceRoot":"","sources":["../../src/http-client/addresses.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE1C,MAAM,aAAa,GAA6C;IAC9D,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,iBAAiB;IACjC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,UAAU;IAC3B,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,oBAAoB;IACxC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,WAAW;IAC7B,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,6BAA6B;IAClD,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,UAAU;IAC9B,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,4BAA4B;IAC/C,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,aAAa;IAChC,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,qBAAqB;IAC1C,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,UAAU;IAC/B,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,eAAe;IACnC,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,aAAa;IACnC,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,aAAa;IAClC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,YAAY;IAC9B,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,sBAAsB;CACzC,CAAA;AAED,MAAM,aAAa,GAA6C;IAC9D,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,cAAc;IAC3B,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,WAAW;IACzB,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,uDAAuD;IACnE,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,gCAAgC;IACnD,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,kBAAkB;IACvC,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,UAAU;IACzB,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,6CAA6C;IAC7D,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,gBAAgB;IACpC,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,+BAA+B;IAC/C,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,eAAe;IAC9B,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,aAAa;IAC7B,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,0BAA0B;IAC1C,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,YAAY;CAC5B,CAAA;AAED,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAA;AACjC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,aAAa;IAAE,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;AAC3F,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,aAAa;IAAE,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;AAE3F,sGAAsG;AACtG,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5B,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9B,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAClE,CAAC"}

package/dist/http-client/fake.d.ts

@@ -0,0 +1,50 @@
+/**
+ * An {@link HttpClient} that never touches the network, for tests.
+ *
+ * It is a real client with the transport swapped: URL validation, the
+ * address-literal rule, the size limit and the redirect policy all still
+ * apply, so a test sees the same refusals production would. Only the wire is
+ * replaced — canned responses in, recorded requests out.
+ *
+ *   const http = fakeHttp()
+ *   http.on('GET', 'https://cms.example.com/api/posts', { json: [{ id: 1 }] })
+ *   await new CmsReader(http).posts()
+ *   expect(http.requests).toHaveLength(1)
+ */
+import { HttpClient, type HttpClientOptions, HttpResponse, type OutgoingRequest } from './HttpClient.js';
+/** What a faked endpoint answers. */
+export interface FakeResponse {
+    /** Default 200. */
+    status?: number;
+    headers?: Record<string, string | string[]>;
+    body?: string | Uint8Array;
+    /** Serialised as the body, with `content-type: application/json`. */
+    json?: unknown;
+}
+/** A request the fake received. */
+export interface RecordedRequest {
+    method: string;
+    url: string;
+    headers: Readonly<Record<string, string>>;
+    body: Buffer | undefined;
+}
+/** An exact URL (with or without its query string), a pattern, or a predicate. */
+export type FakeMatcher = string | RegExp | ((request: RecordedRequest) => boolean);
+export declare class FakeHttpClient extends HttpClient {
+    #private;
+    /** Every request sent, in order — redirect hops included. */
+    readonly requests: RecordedRequest[];
+    /**
+     * Answer `method` + `match` with `response`. The most recent matching
+     * registration wins, so a test can override a default set up earlier.
+     */
+    on(method: string, match: FakeMatcher, response: FakeResponse | ((request: RecordedRequest) => FakeResponse)): this;
+    /** Answer `match` whatever the method. */
+    onAny(match: FakeMatcher, response: FakeResponse | ((request: RecordedRequest) => FakeResponse)): this;
+    /** Forget the registered responses and the recorded requests. */
+    reset(): void;
+    protected send(request: OutgoingRequest): Promise<HttpResponse>;
+}
+/** A fresh {@link FakeHttpClient}, with the same options a real client takes. */
+export declare function fakeHttp(options?: HttpClientOptions): FakeHttpClient;
+//# sourceMappingURL=fake.d.ts.map

package/dist/http-client/fake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake.d.ts","sourceRoot":"","sources":["../../src/http-client/fake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,UAAU,EAEV,KAAK,iBAAiB,EACtB,YAAY,EACZ,KAAK,eAAe,EACrB,MAAM,iBAAiB,CAAA;AAExB,qCAAqC;AACrC,MAAM,WAAW,YAAY;IAC3B,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;IAC3C,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;IAC1B,qEAAqE;IACrE,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED,mCAAmC;AACnC,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACzC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CACzB;AAED,kFAAkF;AAClF,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,CAAA;AAQnF,qBAAa,cAAe,SAAQ,UAAU;;IAC5C,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAK;IAGzC;;;OAGG;IACH,EAAE,CACA,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,YAAY,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,KAAK,YAAY,CAAC,GACpE,IAAI;IAKP,0CAA0C;IAC1C,KAAK,CACH,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,YAAY,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,KAAK,YAAY,CAAC,GACpE,IAAI;IAKP,iEAAiE;IACjE,KAAK,IAAI,IAAI;cAKY,IAAI,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC;CA+C/E;AAQD,iFAAiF;AACjF,wBAAgB,QAAQ,CAAC,OAAO,GAAE,iBAAsB,GAAG,cAAc,CAExE"}

package/dist/http-client/fake.js

@@ -0,0 +1,95 @@
+/**
+ * An {@link HttpClient} that never touches the network, for tests.
+ *
+ * It is a real client with the transport swapped: URL validation, the
+ * address-literal rule, the size limit and the redirect policy all still
+ * apply, so a test sees the same refusals production would. Only the wire is
+ * replaced — canned responses in, recorded requests out.
+ *
+ *   const http = fakeHttp()
+ *   http.on('GET', 'https://cms.example.com/api/posts', { json: [{ id: 1 }] })
+ *   await new CmsReader(http).posts()
+ *   expect(http.requests).toHaveLength(1)
+ */
+import { HttpClient, HttpClientError, HttpResponse, } from './HttpClient.js';
+export class FakeHttpClient extends HttpClient {
+    /** Every request sent, in order — redirect hops included. */
+    requests = [];
+    #routes = [];
+    /**
+     * Answer `method` + `match` with `response`. The most recent matching
+     * registration wins, so a test can override a default set up earlier.
+     */
+    on(method, match, response) {
+        this.#routes.push({ method: method.toUpperCase(), match, respond: response });
+        return this;
+    }
+    /** Answer `match` whatever the method. */
+    onAny(match, response) {
+        this.#routes.push({ method: undefined, match, respond: response });
+        return this;
+    }
+    /** Forget the registered responses and the recorded requests. */
+    reset() {
+        this.#routes.length = 0;
+        this.requests.length = 0;
+    }
+    async send(request) {
+        const recorded = {
+            method: request.method,
+            url: request.url.href,
+            headers: { ...request.headers },
+            body: request.body,
+        };
+        this.requests.push(recorded);
+        const route = this.#latestRoute(recorded, request.url);
+        if (route === undefined) {
+            throw new HttpClientError('unreachable', request.url, `No fake response for ${recorded.method} ${recorded.url}.`);
+        }
+        const answer = typeof route.respond === 'function' ? route.respond(recorded) : route.respond;
+        const headers = {};
+        const given = answer.headers ?? {};
+        for (const [name, value] of Object.entries(given)) {
+            headers[name.toLowerCase()] = value;
+        }
+        let body;
+        if (answer.json !== undefined) {
+            headers['content-type'] ??= 'application/json';
+            body = Buffer.from(JSON.stringify(answer.json), 'utf8');
+        }
+        else if (answer.body === undefined) {
+            body = Buffer.alloc(0);
+        }
+        else {
+            body =
+                typeof answer.body === 'string'
+                    ? Buffer.from(answer.body, 'utf8')
+                    : Buffer.from(answer.body);
+        }
+        return new HttpResponse(answer.status ?? 200, headers, request.url.href, body);
+    }
+    #latestRoute(request, url) {
+        for (let i = this.#routes.length - 1; i >= 0; i--) {
+            const candidate = this.#routes[i];
+            if (candidate === undefined)
+                continue;
+            if (candidate.method !== undefined && candidate.method !== request.method)
+                continue;
+            if (matches(candidate.match, request, url))
+                return candidate;
+        }
+        return undefined;
+    }
+}
+function matches(match, request, url) {
+    if (typeof match === 'function')
+        return match(request);
+    if (match instanceof RegExp)
+        return match.test(request.url);
+    return match === url.href || match === `${url.origin}${url.pathname}`;
+}
+/** A fresh {@link FakeHttpClient}, with the same options a real client takes. */
+export function fakeHttp(options = {}) {
+    return new FakeHttpClient(options);
+}
+//# sourceMappingURL=fake.js.map

package/dist/http-client/fake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake.js","sourceRoot":"","sources":["../../src/http-client/fake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,UAAU,EACV,eAAe,EAEf,YAAY,GAEb,MAAM,iBAAiB,CAAA;AA6BxB,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC5C,6DAA6D;IACpD,QAAQ,GAAsB,EAAE,CAAA;IAChC,OAAO,GAAgB,EAAE,CAAA;IAElC;;;OAGG;IACH,EAAE,CACA,MAAc,EACd,KAAkB,EAClB,QAAqE;QAErE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC7E,OAAO,IAAI,CAAA;IACb,CAAC;IAED,0CAA0C;IAC1C,KAAK,CACH,KAAkB,EAClB,QAAqE;QAErE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;QAClE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,iEAAiE;IACjE,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAA;QACvB,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IAC1B,CAAC;IAEkB,KAAK,CAAC,IAAI,CAAC,OAAwB;QACpD,MAAM,QAAQ,GAAoB;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;YACrB,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE;YAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAA;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAE5B,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;QACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,eAAe,CACvB,aAAa,EACb,OAAO,CAAC,GAAG,EACX,wBAAwB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,GAAG,CAC3D,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;QAC5F,MAAM,OAAO,GAAsC,EAAE,CAAA;QACrD,MAAM,KAAK,GAAsC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAA;QACrE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAA;QACrC,CAAC;QACD,IAAI,IAAY,CAAA;QAChB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,CAAC,cAAc,CAAC,KAAK,kBAAkB,CAAA;YAC9C,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;QACzD,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACxB,CAAC;aAAM,CAAC;YACN,IAAI;gBACF,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;oBAC7B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;oBAClC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAChC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAChF,CAAC;IAED,YAAY,CAAC,OAAwB,EAAE,GAAQ;QAC7C,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;YACjC,IAAI,SAAS,KAAK,SAAS;gBAAE,SAAQ;YACrC,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;gBAAE,SAAQ;YACnF,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAA;QAC9D,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;CACF;AAED,SAAS,OAAO,CAAC,KAAkB,EAAE,OAAwB,EAAE,GAAQ;IACrE,IAAI,OAAO,KAAK,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAA;IACtD,IAAI,KAAK,YAAY,MAAM;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3D,OAAO,KAAK,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,QAAQ,CAAC,UAA6B,EAAE;IACtD,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,CAAA;AACpC,CAAC"}

package/dist/http-client/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `@c9up/ream/http-client` — outbound HTTP with an SSRF guard, and its test fake.
+ */
+export { isPublicAddress } from './addresses.js';
+export { FakeHttpClient, type FakeMatcher, type FakeResponse, fakeHttp, type RecordedRequest, } from './fake.js';
+export { HttpClient, HttpClientError, type HttpClientFailure, type HttpClientOptions, type HttpRequestOptions, HttpResponse, type OutgoingRequest, } from './HttpClient.js';
+//# sourceMappingURL=index.d.ts.map