@cat-factory/kernel 0.325.0 → 0.326.0

package/dist/shared/environment-host-bridge.logic.d.ts

@@ -26,28 +26,122 @@ export declare function resolvesToLocalMachine(hostname: string): boolean;
  * replaced, for a `--add-host` the container will not honour.
  */
 export type LocalMachineHostBridge = 
-/** Not this machine. The container reaches it as written, and re-pointing it would break it. */
+/** Not this machine, and nowhere else to point it. The container reaches it as written. */
 {
     kind: 'none';
 }
-/** A NAME an added hosts-file entry re-points. `host` is what to map to the host gateway. */
+/** A NAME an added hosts-file entry re-points, and what to point it AT. */
  | {
     kind: 'bridge';
     host: string;
+    target: HostBridgeTarget;
 }
-/** This machine, and no hosts-file entry can reach it. See {@link isHostsFileAddressable}. */
+/** No hosts-file entry can make this reachable, and {@link UnbridgeableCause} says why. */
  | {
     kind: 'unbridgeable';
     host: string;
+    cause: UnbridgeableCause;
 };
 /**
- * Grade a hostname for the host-gateway bridge: leave it alone, map it, or report that it names
- * this machine and cannot be mapped.
+ * Why a name cannot be bridged, because the two causes have different remedies and a transport
+ * that reported them with one sentence would send an operator to the wrong fix.
+ *
+ *   - `local_machine`    the URL names THIS machine by a spelling no hosts entry re-points
+ *                        (`localhost`, a bare IP literal). Remedy: publish the environment on a
+ *                        name that resolves to the host, or run the step natively.
+ *   - `unusable_address` the platform PROVED the name does not carry and that an address does, and
+ *                        that address cannot be installed: it is one no bridge may name, or the
+ *                        URL's own host is a literal nothing looks up. Remedy: publish a name and
+ *                        an address a bridge may name. This one is a run heading for failure with
+ *                        a proof on the record saying the environment is reachable, which is
+ *                        evidence pointing further from the cause than no bridge at all.
+ */
+export type UnbridgeableCause = 'local_machine' | 'unusable_address';
+/**
+ * What a bridged name is mapped TO.
+ *
+ * A member on `bridge` rather than a fourth sibling `kind`, so `none` / `bridge` / `unbridgeable`
+ * keep meaning exactly what they mean: the three of them answer "what can this transport do about
+ * this name", and both targets are the same answer (re-point it) with different data.
+ *
+ *   - `host-gateway` is the container runtime's own alias for the machine it runs on, and it is
+ *     the ONLY target a local-machine name can take. It is a Docker-family token, resolved by the
+ *     runtime rather than by us, which is why it is a literal here and never an address.
+ *   - `{ ip }` is an address the ENVIRONMENT'S PROVIDER stated carries traffic for this name. It
+ *     is the remote case, and it is the case that makes a bridge target DATA for the first time.
+ *     Two rules bind it, both in {@link isBridgeableAddress} and at the caller: the address must
+ *     be one a bridge may name, and the HOST side must be a host the job was actually handed,
+ *     never a free-form string a provider chose. A provider that could re-point any name inside
+ *     the container could re-point the harness's own alias for reaching back to its host.
+ */
+export type HostBridgeTarget = 'host-gateway' | {
+    ip: string;
+};
+/**
+ * Whether an address a provider stated may be used as a bridge target.
+ *
+ * Until this existed the target was the fixed literal `host-gateway`, so the destination of every
+ * bridge was CODE. An address makes it DATA, on a path whose container is itself the trust
+ * boundary, so the rule is stated here beside the classifier rather than left to whichever
+ * adapter interpolates the string.
+ *
+ * Deliberately NOT {@link isBlockedPrivateHost}, which is the strict policy for a URL an org
+ * supplies and blocks the whole RFC1918 space. An internal load balancer on `10.x` is precisely
+ * the population this feature exists for, and refusing it would leave the feature with nothing to
+ * name. What is refused instead is the set an address bridge could only ever be ABUSED to reach:
+ *
+ *   - Anything that is not a CANONICAL literal. `decodeIpv4` accepts a bare 32-bit integer and
+ *     hex/octal octets because a URL guard must see through those encodings; a bridge target has
+ *     no reason to be spelled that way, and accepting the obfuscated forms is how `2130706433`
+ *     becomes loopback in a reader that only pattern-matched `127.`.
+ *   - LOOPBACK, which inside a container is the container's own namespace, where the harness
+ *     itself is listening. A name re-pointed there does not reach the host; it reaches us.
+ *   - LINK-LOCAL and the vendor metadata addresses, the endpoint an SSRF aims at for instance
+ *     credentials, reached here by a name the agent has every reason to fetch.
+ *   - The unspecified, multicast and broadcast addresses, which name no host at all.
+ *
+ * Every one of those classes is judged on the DECODED address rather than on how it is written.
+ * IPv6 has many spellings of one value, so a `host === '::1'` comparison admits `0::1` and
+ * `0:0:0:0:0:0:0:1`, and a `startsWith('fe80:')` test covers an eighth of `fe80::/10`; the
+ * metadata targets are read out of `isCloudMetadataHost`, the swept definition every other guard
+ * in the tree shares, rather than restated here where a vendor added there would not reach.
+ */
+export declare function isBridgeableAddress(address: string): boolean;
+/**
+ * Grade a hostname for a host bridge: leave it alone, map it (to the host gateway or to a stated
+ * address), or report that it names this machine and cannot be mapped.
  *
  * The whole rule lives here rather than beside the container runtime because more than one layer
  * has to agree about it, and because both wrong answers are silent in production: bridging a
  * remote host breaks an environment that worked, and not bridging a wildcard-DNS loopback name
  * leaves the tester on connection failures it reports as a dead environment.
+ *
+ * `address` is the address the environment's provider stated for THIS hostname, already PROVED to
+ * carry (see `EnvironmentRouteProof`); absent means the name is all anyone has. The two cases are
+ * ordered rather than combined, and the order is not arbitrary: a name that answers with this
+ * machine's own address is a dead end inside a container whatever a provider says about it, so it
+ * takes the gateway branch first and a stated address never overrides it.
+ *
+ * Note the asymmetry this leaves, which is correct. A REMOTE name with NO address is reported
+ * `none`: it reaches whatever it reaches from inside the container exactly as it does outside, and
+ * there is nothing to report. A remote name WITH one is a different fact, because an address is
+ * only ever present when the proof established that the name did not carry and the address did
+ * (`EnvironmentRouteProof.via`). Failing to install THAT is a run heading for the connection
+ * failures this mechanism exists to stop, with a proof on the record vouching for a route the
+ * container never got, so it is reported `unbridgeable` rather than passed over as `none`.
  */
-export declare function classifyLocalMachineHostBridge(hostname: string): LocalMachineHostBridge;
+export declare function classifyLocalMachineHostBridge(hostname: string, address?: string | null): LocalMachineHostBridge;
+/**
+ * The one spelling of a bridge, for comparing a needed bridge against what a running container
+ * was CREATED with and for recording it on that container's handle.
+ *
+ * Derived rather than hand-formatted at each site because the comparison is an IDENTITY: a
+ * mismatch destroys and rebuilds a warm container, so two spellings of the same bridge would
+ * replace one for nothing, and one spelling covering two different targets would leave a run
+ * wedged against a stale address in a container nothing will replace.
+ */
+export declare function hostBridgeKey(bridge: {
+    host: string;
+    target: HostBridgeTarget;
+}): string;
 //# sourceMappingURL=environment-host-bridge.logic.d.ts.map

package/dist/shared/environment-host-bridge.logic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"environment-host-bridge.logic.d.ts","sourceRoot":"","sources":["../../src/shared/environment-host-bridge.logic.ts"],"names":[],"mappings":"AA0CA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAUhE;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB;AAChC,gGAAgG;AAC9F;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;AAClB,6FAA6F;GAC3F;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAClC,8FAA8F;GAC5F;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAgC1C;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAKvF"}
+{"version":3,"file":"environment-host-bridge.logic.d.ts","sourceRoot":"","sources":["../../src/shared/environment-host-bridge.logic.ts"],"names":[],"mappings":"AAkDA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAUhE;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB;AAChC,2FAA2F;AACzF;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;AAClB,2EAA2E;GACzE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE;AAC5D,2FAA2F;GACzF;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,CAAA;AAEpE;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,iBAAiB,GAAG,eAAe,GAAG,kBAAkB,CAAA;AAEpE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAA;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAe5D;AAmDD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GACtB,sBAAsB,CAcxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG,MAAM,CAGxF"}

package/dist/shared/environment-host-bridge.logic.js

@@ -24,7 +24,7 @@
 // name to the gateway inside the container does that, and it keeps the `Host` header the ingress
 // routes on correct for free, which a rewritten authority would not.
 import { wildcardDnsSuffix, wildcardDnsWindows } from '@cat-factory/contracts';
-import { decodeIpv4, isLocalMachineHost, isLoopbackHost } from './ip-host.logic.js';
+import { decimalV4, decodeIpv4, decodeIpv6, isCloudMetadataHost, isLocalMachineHost, isLoopbackHost, mappedV4, } from './ip-host.logic.js';
 /**
  * The one spelling every rule here compares against: lower-cased, trimmed, IPv6 brackets and the
  * fully-qualified trailing dot removed. Shared rather than repeated so a hostname cannot be judged
@@ -67,6 +67,77 @@ export function resolvesToLocalMachine(hostname) {
     const [resolved] = wildcardDnsWindows(host);
     return resolved !== undefined && isLoopbackHost(resolved);
 }
+/**
+ * Whether an address a provider stated may be used as a bridge target.
+ *
+ * Until this existed the target was the fixed literal `host-gateway`, so the destination of every
+ * bridge was CODE. An address makes it DATA, on a path whose container is itself the trust
+ * boundary, so the rule is stated here beside the classifier rather than left to whichever
+ * adapter interpolates the string.
+ *
+ * Deliberately NOT {@link isBlockedPrivateHost}, which is the strict policy for a URL an org
+ * supplies and blocks the whole RFC1918 space. An internal load balancer on `10.x` is precisely
+ * the population this feature exists for, and refusing it would leave the feature with nothing to
+ * name. What is refused instead is the set an address bridge could only ever be ABUSED to reach:
+ *
+ *   - Anything that is not a CANONICAL literal. `decodeIpv4` accepts a bare 32-bit integer and
+ *     hex/octal octets because a URL guard must see through those encodings; a bridge target has
+ *     no reason to be spelled that way, and accepting the obfuscated forms is how `2130706433`
+ *     becomes loopback in a reader that only pattern-matched `127.`.
+ *   - LOOPBACK, which inside a container is the container's own namespace, where the harness
+ *     itself is listening. A name re-pointed there does not reach the host; it reaches us.
+ *   - LINK-LOCAL and the vendor metadata addresses, the endpoint an SSRF aims at for instance
+ *     credentials, reached here by a name the agent has every reason to fetch.
+ *   - The unspecified, multicast and broadcast addresses, which name no host at all.
+ *
+ * Every one of those classes is judged on the DECODED address rather than on how it is written.
+ * IPv6 has many spellings of one value, so a `host === '::1'` comparison admits `0::1` and
+ * `0:0:0:0:0:0:0:1`, and a `startsWith('fe80:')` test covers an eighth of `fe80::/10`; the
+ * metadata targets are read out of `isCloudMetadataHost`, the swept definition every other guard
+ * in the tree shares, rather than restated here where a vendor added there would not reach.
+ */
+export function isBridgeableAddress(address) {
+    const host = normalizeHostname(address);
+    if (!host)
+        return false;
+    // Link-local (169.254/16, incl. IMDS), every vendor metadata address and the metadata NAMES,
+    // across every obfuscated encoding. One definition, shared with the SSRF guards.
+    if (isCloudMetadataHost(host))
+        return false;
+    if (host.includes(':')) {
+        // IPv6. An IPv4-mapped literal is judged on the address it carries, never on its spelling.
+        const mapped = mappedV4(host);
+        if (mapped)
+            return isBridgeableV4(mapped);
+        const groups = decodeIpv6(host);
+        return groups !== null && isBridgeableV6(groups);
+    }
+    const v4 = decimalV4(host);
+    return v4 !== null && isBridgeableV4(v4);
+}
+/** The IPv4 half of {@link isBridgeableAddress}, once the literal has been decoded. */
+function isBridgeableV4(parts) {
+    const [a] = parts;
+    if (a === 0 || a === 127)
+        return false; // unspecified / loopback
+    if (a >= 224)
+        return false; // multicast, reserved, and 255.255.255.255
+    return true;
+}
+/** The IPv6 half, judged on the decoded groups so no spelling of a refused class gets through. */
+function isBridgeableV6(groups) {
+    if (groups.every((group) => group === 0))
+        return false; // unspecified, `::`
+    // Loopback, `::1` in any spelling.
+    if (groups.every((group, index) => group === (index === 7 ? 1 : 0)))
+        return false;
+    const first = groups[0] ?? 0;
+    if ((first & 0xffc0) === 0xfe80)
+        return false; // link-local, fe80::/10
+    if ((first & 0xff00) === 0xff00)
+        return false; // multicast, ff00::/8
+    return true;
+}
 /**
  * Whether mapping `host` to the container's host gateway would achieve anything.
  *
@@ -99,21 +170,57 @@ function isHostsFileAddressable(host) {
     return decodeIpv4(host) === null;
 }
 /**
- * Grade a hostname for the host-gateway bridge: leave it alone, map it, or report that it names
- * this machine and cannot be mapped.
+ * Grade a hostname for a host bridge: leave it alone, map it (to the host gateway or to a stated
+ * address), or report that it names this machine and cannot be mapped.
  *
  * The whole rule lives here rather than beside the container runtime because more than one layer
  * has to agree about it, and because both wrong answers are silent in production: bridging a
  * remote host breaks an environment that worked, and not bridging a wildcard-DNS loopback name
  * leaves the tester on connection failures it reports as a dead environment.
+ *
+ * `address` is the address the environment's provider stated for THIS hostname, already PROVED to
+ * carry (see `EnvironmentRouteProof`); absent means the name is all anyone has. The two cases are
+ * ordered rather than combined, and the order is not arbitrary: a name that answers with this
+ * machine's own address is a dead end inside a container whatever a provider says about it, so it
+ * takes the gateway branch first and a stated address never overrides it.
+ *
+ * Note the asymmetry this leaves, which is correct. A REMOTE name with NO address is reported
+ * `none`: it reaches whatever it reaches from inside the container exactly as it does outside, and
+ * there is nothing to report. A remote name WITH one is a different fact, because an address is
+ * only ever present when the proof established that the name did not carry and the address did
+ * (`EnvironmentRouteProof.via`). Failing to install THAT is a run heading for the connection
+ * failures this mechanism exists to stop, with a proof on the record vouching for a route the
+ * container never got, so it is reported `unbridgeable` rather than passed over as `none`.
  */
-export function classifyLocalMachineHostBridge(hostname) {
+export function classifyLocalMachineHostBridge(hostname, address) {
     const host = normalizeHostname(hostname);
     if (!host)
         return { kind: 'none' };
-    if (!resolvesToLocalMachine(host))
+    if (resolvesToLocalMachine(host)) {
+        return isHostsFileAddressable(host)
+            ? { kind: 'bridge', host, target: 'host-gateway' }
+            : { kind: 'unbridgeable', host, cause: 'local_machine' };
+    }
+    if (!address)
         return { kind: 'none' };
-    return isHostsFileAddressable(host) ? { kind: 'bridge', host } : { kind: 'unbridgeable', host };
+    const ip = normalizeHostname(address);
+    if (!isBridgeableAddress(ip) || !isHostsFileAddressable(host)) {
+        return { kind: 'unbridgeable', host, cause: 'unusable_address' };
+    }
+    return { kind: 'bridge', host, target: { ip } };
+}
+/**
+ * The one spelling of a bridge, for comparing a needed bridge against what a running container
+ * was CREATED with and for recording it on that container's handle.
+ *
+ * Derived rather than hand-formatted at each site because the comparison is an IDENTITY: a
+ * mismatch destroys and rebuilds a warm container, so two spellings of the same bridge would
+ * replace one for nothing, and one spelling covering two different targets would leave a run
+ * wedged against a stale address in a container nothing will replace.
+ */
+export function hostBridgeKey(bridge) {
+    const target = bridge.target === 'host-gateway' ? 'host-gateway' : bridge.target.ip;
+    return bridge.host + '=' + target;
 }
 // The URL half of this (pull the hostname out, decide whether to bridge it) is deliberately NOT
 // here: kernel compiles against `lib: ["ES2022"]` with no DOM and no Node types, so `URL` is

package/dist/shared/environment-host-bridge.logic.js.map

@@ -1 +1 @@
-{"version":3,"file":"environment-host-bridge.logic.js","sourceRoot":"","sources":["../../src/shared/environment-host-bridge.logic.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,EAAE;AACF,oGAAoG;AACpG,8FAA8F;AAC9F,8FAA8F;AAC9F,iGAAiG;AACjG,iGAAiG;AACjG,8FAA8F;AAC9F,oGAAoG;AACpG,mGAAmG;AACnG,6DAA6D;AAC7D,EAAE;AACF,iGAAiG;AACjG,oGAAoG;AACpG,2FAA2F;AAC3F,0FAA0F;AAC1F,EAAE;AACF,oGAAoG;AACpG,wFAAwF;AACxF,mGAAmG;AACnG,kGAAkG;AAClG,gGAAgG;AAChG,mGAAmG;AACnG,iGAAiG;AACjG,qEAAqE;AAErE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAC9E,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAEnF;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,QAAQ;SACZ,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACvB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACzC,+FAA+F;IAC/F,gGAAgG;IAChG,2EAA2E;IAC3E,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1C,MAAM,CAAC,QAAQ,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IAC3C,OAAO,QAAQ,KAAK,SAAS,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAA;AAC3D,CAAC;AAoBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,KAAK,CAAA;IACtC,mGAAmG;IACnG,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,CAAA;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAAgB;IAC7D,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAClC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAC1D,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAA;AACjG,CAAC;AAED,gGAAgG;AAChG,6FAA6F;AAC7F,kGAAkG;AAClG,oGAAoG;AACpG,mGAAmG;AACnG,4DAA4D"}
+{"version":3,"file":"environment-host-bridge.logic.js","sourceRoot":"","sources":["../../src/shared/environment-host-bridge.logic.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,EAAE;AACF,oGAAoG;AACpG,8FAA8F;AAC9F,8FAA8F;AAC9F,iGAAiG;AACjG,iGAAiG;AACjG,8FAA8F;AAC9F,oGAAoG;AACpG,mGAAmG;AACnG,6DAA6D;AAC7D,EAAE;AACF,iGAAiG;AACjG,oGAAoG;AACpG,2FAA2F;AAC3F,0FAA0F;AAC1F,EAAE;AACF,oGAAoG;AACpG,wFAAwF;AACxF,mGAAmG;AACnG,kGAAkG;AAClG,gGAAgG;AAChG,mGAAmG;AACnG,iGAAiG;AACjG,qEAAqE;AAErE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAC9E,OAAO,EACL,SAAS,EACT,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,QAAQ,GACT,MAAM,oBAAoB,CAAA;AAE3B;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,QAAQ;SACZ,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACvB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACzC,+FAA+F;IAC/F,gGAAgG;IAChG,2EAA2E;IAC3E,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1C,MAAM,CAAC,QAAQ,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IAC3C,OAAO,QAAQ,KAAK,SAAS,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAA;AAC3D,CAAC;AAuDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,6FAA6F;IAC7F,iFAAiF;IACjF,IAAI,mBAAmB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,2FAA2F;QAC3F,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC7B,IAAI,MAAM;YAAE,OAAO,cAAc,CAAC,MAAM,CAAC,CAAA;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;QAC/B,OAAO,MAAM,KAAK,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,CAAA;IAClD,CAAC;IACD,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC1B,OAAO,EAAE,KAAK,IAAI,IAAI,cAAc,CAAC,EAAE,CAAC,CAAA;AAC1C,CAAC;AAED,uFAAuF;AACvF,SAAS,cAAc,CAAC,KAAuC;IAC7D,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAA;IACjB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA,CAAC,yBAAyB;IAChE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,KAAK,CAAA,CAAC,2CAA2C;IACtE,OAAO,IAAI,CAAA;AACb,CAAC;AAED,kGAAkG;AAClG,SAAS,cAAc,CAAC,MAAyB;IAC/C,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA,CAAC,oBAAoB;IAC3E,mCAAmC;IACnC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IACjF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAC5B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA,CAAC,wBAAwB;IACtE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA,CAAC,sBAAsB;IACpE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,KAAK,CAAA;IACtC,mGAAmG;IACnG,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,CAAA;AAClC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAAgB,EAChB,OAAuB;IAEvB,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAClC,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,sBAAsB,CAAC,IAAI,CAAC;YACjC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE;YAClD,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;IAC5D,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACrC,MAAM,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAA;IAClE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CAAA;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,MAAkD;IAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAA;IACnF,OAAO,MAAM,CAAC,IAAI,GAAG,GAAG,GAAG,MAAM,CAAA;AACnC,CAAC;AAED,gGAAgG;AAChG,6FAA6F;AAC7F,kGAAkG;AAClG,oGAAoG;AACpG,mGAAmG;AACnG,4DAA4D"}

package/dist/shared/ip-host.logic.d.ts

@@ -12,6 +12,22 @@ export declare function mappedV4(host: string): [number, number, number, number]
  * rejects ALL numeric forms outright should use {@link isBlockedPrivateHost}.
  */
 export declare function decodeIpv4(host: string): [number, number, number, number] | null;
+/**
+ * Decode an IPv6 literal to its eight 16-bit groups, or null when it is not one.
+ *
+ * Exists because an IPv6 address has MANY spellings of one value and a rule that pattern-matches
+ * the canonical one is not a rule: `::1`, `0::1` and `0:0:0:0:0:0:0:1` are the same loopback
+ * address, and a check comparing against the literal `'::1'` admits the other two. Same for
+ * `fe80::/10`, where a `startsWith('fe80:')` test covers an eighth of the range and passes
+ * `fe90::1`. Callers that must classify an IPv6 target (link-local, multicast, loopback) decode
+ * first and judge the NUMBER, exactly as {@link decodeIpv4} exists so a guard never judges a v4
+ * spelling.
+ *
+ * Refused rather than decoded: a zone id (`fe80::1%eth0`), which names a local interface and can
+ * never be a routable target, and any group that is not 1-4 hex digits. A trailing dotted-quad is
+ * accepted, being the ordinary spelling of a mapped or translated address.
+ */
+export declare function decodeIpv6(hostname: string): number[] | null;
 /**
  * Whether a host resolves to a known cloud-metadata / link-local target — the endpoint
  * an SSRF would aim at for instance credentials. Covers the metadata hostnames plus the

package/dist/shared/ip-host.logic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ip-host.logic.d.ts","sourceRoot":"","sources":["../../src/shared/ip-host.logic.ts"],"names":[],"mappings":"AAUA,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAO5E;AAED,6EAA6E;AAC7E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAS/E;AAED,sFAAsF;AACtF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAmB9E;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAWhF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAe7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGxD;AAmBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAM5D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAiC9D"}
+{"version":3,"file":"ip-host.logic.d.ts","sourceRoot":"","sources":["../../src/shared/ip-host.logic.ts"],"names":[],"mappings":"AAUA,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAO5E;AAED,6EAA6E;AAC7E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAS/E;AAED,sFAAsF;AACtF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAmB9E;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAWhF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAY5D;AAoBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAe7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGxD;AAmBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAM5D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAiC9D"}

package/dist/shared/ip-host.logic.js

@@ -77,6 +77,58 @@ export function decodeIpv4(host) {
     }
     return null;
 }
+/**
+ * Decode an IPv6 literal to its eight 16-bit groups, or null when it is not one.
+ *
+ * Exists because an IPv6 address has MANY spellings of one value and a rule that pattern-matches
+ * the canonical one is not a rule: `::1`, `0::1` and `0:0:0:0:0:0:0:1` are the same loopback
+ * address, and a check comparing against the literal `'::1'` admits the other two. Same for
+ * `fe80::/10`, where a `startsWith('fe80:')` test covers an eighth of the range and passes
+ * `fe90::1`. Callers that must classify an IPv6 target (link-local, multicast, loopback) decode
+ * first and judge the NUMBER, exactly as {@link decodeIpv4} exists so a guard never judges a v4
+ * spelling.
+ *
+ * Refused rather than decoded: a zone id (`fe80::1%eth0`), which names a local interface and can
+ * never be a routable target, and any group that is not 1-4 hex digits. A trailing dotted-quad is
+ * accepted, being the ordinary spelling of a mapped or translated address.
+ */
+export function decodeIpv6(hostname) {
+    const host = hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    if (!host.includes(':') || host.includes('%'))
+        return null;
+    const halves = host.split('::');
+    if (halves.length > 2)
+        return null;
+    const head = expandIpv6Groups(halves[0] ?? '');
+    const tail = halves.length === 2 ? expandIpv6Groups(halves[1] ?? '') : [];
+    if (!head || !tail)
+        return null;
+    if (halves.length === 1)
+        return head.length === 8 ? head : null;
+    // `::` stands for at least one all-zero group, so a compression that saves nothing is malformed.
+    const filled = 8 - head.length - tail.length;
+    return filled >= 1 ? [...head, ...Array.from({ length: filled }, () => 0), ...tail] : null;
+}
+/** One colon-separated run of an IPv6 literal as 16-bit groups, or null when it is malformed. */
+function expandIpv6Groups(part) {
+    if (part === '')
+        return [];
+    const chunks = part.split(':');
+    const groups = [];
+    for (const [index, chunk] of chunks.entries()) {
+        if (index === chunks.length - 1 && chunk.includes('.')) {
+            const v4 = decimalV4(chunk);
+            if (!v4)
+                return null;
+            groups.push((v4[0] << 8) | v4[1], (v4[2] << 8) | v4[3]);
+            continue;
+        }
+        if (!/^[0-9a-f]{1,4}$/.test(chunk))
+            return null;
+        groups.push(parseInt(chunk, 16));
+    }
+    return groups;
+}
 /**
  * Whether a host resolves to a known cloud-metadata / link-local target — the endpoint
  * an SSRF would aim at for instance credentials. Covers the metadata hostnames plus the

package/dist/shared/ip-host.logic.js.map

@@ -1 +1 @@
-{"version":3,"file":"ip-host.logic.js","sourceRoot":"","sources":["../../src/shared/ip-host.logic.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,sFAAsF;AACtF,gFAAgF;AAChF,gFAAgF;AAChF,mFAAmF;AACnF,sFAAsF;AACtF,oFAAoF;AACpF,oFAAoF;AACpF,iDAAiD;AAEjD,oFAAoF;AACpF,MAAM,UAAU,WAAW,CAAC,KAAuC;IACjE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAA;IACpB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAA;IAChD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACpE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,IAAI,CAAA;IACzD,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;AACrB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,iBAAiB;IACjB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAA;IAChF,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAA;QACzD,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACrB,CAAC;IACD,wEAAwE;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAClE,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAA;QACtC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAA;QACtC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAA;IACnE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACtB,IAAI,CAAC,GAAG,UAAU;YAAE,OAAO,IAAI,CAAA;QAC/B,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,IAAI,IAAI,KAAK,0BAA0B;QAAE,OAAO,IAAI,CAAA;IACpD,iBAAiB;IACjB,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,IAAI,CAAA;IACzC,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;QACvB,iFAAiF;QACjF,+EAA+E;QAC/E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QACvC,0BAA0B;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;IACnE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpF,CAAC;AAED;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,6FAA6F;IAC7F,gFAAgF;IAChF,SAAS;IACT,IAAI;IACJ,+FAA+F;IAC/F,uEAAuE;IACvE,sBAAsB;IACtB,4BAA4B;IAC5B,yBAAyB;CAC1B,CAAC,CAAA;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,IAAI,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,6DAA6D;IAC7D,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IAC5B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAA;IACpE,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IAEtE,mCAAmC;IACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAChD,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAC3F,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC7B,IAAI,MAAM;YAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAA;QACtC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,wEAAwE;IACxE,gDAAgD;IAChD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA,CAAC,mBAAmB;QAChE,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA,CAAC,oCAAoC;IAC/E,CAAC;IAED,6EAA6E;IAC7E,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC1B,IAAI,EAAE;QAAE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAA;IAE9B,8EAA8E;IAC9E,wEAAwE;IACxE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAE1E,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"ip-host.logic.js","sourceRoot":"","sources":["../../src/shared/ip-host.logic.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,sFAAsF;AACtF,gFAAgF;AAChF,gFAAgF;AAChF,mFAAmF;AACnF,sFAAsF;AACtF,oFAAoF;AACpF,oFAAoF;AACpF,iDAAiD;AAEjD,oFAAoF;AACpF,MAAM,UAAU,WAAW,CAAC,KAAuC;IACjE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAA;IACpB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAA;IAChD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACpE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,IAAI,CAAA;IACzD,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;AACrB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,iBAAiB;IACjB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAA;IAChF,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAA;QACzD,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACrB,CAAC;IACD,wEAAwE;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAClE,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAA;QACtC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAA;QACtC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAA;IACnE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACtB,IAAI,CAAC,GAAG,UAAU;YAAE,OAAO,IAAI,CAAA;QAC/B,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IAC/D,iGAAiG;IACjG,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC5C,OAAO,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC5F,CAAC;AAED,iGAAiG;AACjG,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,IAAI,KAAK,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;YAC3B,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAA;YACpB,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;YACvD,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAC/C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,IAAI,IAAI,KAAK,0BAA0B;QAAE,OAAO,IAAI,CAAA;IACpD,iBAAiB;IACjB,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,IAAI,CAAA;IACzC,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;QACvB,iFAAiF;QACjF,+EAA+E;QAC/E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QACvC,0BAA0B;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;IACnE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpF,CAAC;AAED;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,6FAA6F;IAC7F,gFAAgF;IAChF,SAAS;IACT,IAAI;IACJ,+FAA+F;IAC/F,uEAAuE;IACvE,sBAAsB;IACtB,4BAA4B;IAC5B,yBAAyB;CAC1B,CAAC,CAAA;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,IAAI,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,6DAA6D;IAC7D,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IAC5B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAA;IACpE,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IAEtE,mCAAmC;IACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAChD,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAC3F,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC7B,IAAI,MAAM;YAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAA;QACtC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,wEAAwE;IACxE,gDAAgD;IAChD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA,CAAC,mBAAmB;QAChE,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA,CAAC,oCAAoC;IAC/E,CAAC;IAED,6EAA6E;IAC7E,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC1B,IAAI,EAAE;QAAE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAA;IAE9B,8EAA8E;IAC9E,wEAAwE;IACxE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAE1E,OAAO,KAAK,CAAA;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/kernel",
-  "version": "0.325.0",
+  "version": "0.326.0",
   "description": "Shared vocabulary, pure logic, and port interfaces for the Agent Architecture Board.",
   "repository": {
     "type": "git",
@@ -24,7 +24,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@cat-factory/contracts": "0.336.0",
+    "@cat-factory/contracts": "0.337.0",
     "ai": "^7.0.85",
     "yaml": "^2.9.0"
   },