@chrischall/mcp-utils 2.15.1 → 3.0.0

package/dist/http/url-safety.d.ts

@@ -0,0 +1,142 @@
+/**
+ * URL-safety atoms: confine where a credential-bearing request can go.
+ *
+ * Fleet audit 2026-09, clusters 5 and 6.
+ *
+ * Cluster 5 (alltrails, compass, eventbrite, flightaware, freshbooks, homes,
+ * redfin, zillow): a tool argument interpolated into an API path steered an
+ * authenticated GET somewhere else on the same host. The shared root cause is
+ * that `encodeURIComponent('..') === '..'`, and URL normalisation then
+ * resolves the dot segment — so even a repo that encoded every value (and
+ * eventbrite forgot to on three tools) was exposed. {@link apiPath} encodes
+ * each value AND refuses a value that is a dot segment; `createApiClient`
+ * refuses any path that normalisation would rewrite ({@link findPathHazard}),
+ * so a consumer that never adopts `apiPath` is covered too.
+ *
+ * Cluster 6 (groupon, ioffice, myhotlunchbox, schoolpass, workday,
+ * accessoticketing, housecallpro, infinitecampus, flightaware, thumbtack,
+ * gemini): a base-URL env override or a link taken from a tool / the upstream
+ * was used without checking its scheme or host, so a session cookie or a
+ * password could be sent over http or to any host. {@link readOriginEnv} and
+ * {@link assertAllowedUrl} are the one check; `createApiClient`'s
+ * `redirect: 'same-origin'` keeps a redirect from carrying the bearer off the
+ * base origin.
+ *
+ * Errors here are value-free where the value could be a secret (an env var)
+ * and name only the host where the value is a link (whose path and query may
+ * carry a token).
+ */
+import { McpToolError } from '../errors/index.js';
+import type { EnvSource } from '../config/index.js';
+/**
+ * Why URL normalisation would rewrite the path portion of `path` (everything
+ * before the first `?` or `#`), or `undefined` when it would not: a dot
+ * segment (`.`, `..`, `%2e%2e` and the mixed spellings), a backslash (which
+ * special schemes treat as `/`), a C0 control character (U+0000-U+001F) or
+ * DEL, or a trailing space. The WHATWG URL parser deletes tab, LF and CR
+ * anywhere, and strips leading and trailing C0 controls and spaces from the
+ * whole URL, before it resolves dot segments — so `.\t.` becomes `..`, and
+ * `/x/.. ` (with no query after it) resolves to the parent. The query and
+ * fragment are not judged.
+ *
+ * `createApiClient` refuses a path for which this returns a reason; exported
+ * for hand-rolled clients that build URLs themselves.
+ */
+export declare function findPathHazard(path: string): 'dot segment' | 'backslash' | 'control character' | 'trailing space' | undefined;
+/** A value {@link apiPath} accepts as one path segment. */
+export type ApiPathValue = string | number | bigint;
+/**
+ * Tagged template that builds an API path from trusted literal text and
+ * untrusted values, encoding each value as exactly ONE path segment:
+ *
+ * ```ts
+ * api.fetchJson('GET', apiPath`/trails/${id}/reviews`);
+ * ```
+ *
+ * Each value goes through `encodeURIComponent` (so `/`, `?`, `#`, `\` and `%`
+ * cannot add structure), and a value that is empty, `.` or `..` throws a
+ * `TypeError` — `encodeURIComponent` leaves dots alone, so `..` would
+ * otherwise survive encoding and be resolved by the URL parser. Only strings,
+ * finite numbers and bigints are accepted; anything else is a programming
+ * error and throws.
+ *
+ * The literal parts are not touched: they are the author's own.
+ */
+export declare function apiPath(strings: TemplateStringsArray, ...values: ApiPathValue[]): string;
+/**
+ * Thrown by {@link readOriginEnv} and {@link assertAllowedUrl} when a URL is
+ * refused. `reason` is a stable code for branching; the message never quotes
+ * an env value, and for a link names only its host.
+ */
+export declare class UrlNotAllowedError extends McpToolError {
+    readonly reason: 'invalid' | 'scheme' | 'insecure' | 'userinfo' | 'not-origin' | 'host';
+    constructor(message: string, reason: UrlNotAllowedError['reason']);
+}
+/**
+ * A host allowlist entry: an exact hostname (case-insensitive), `*.suffix`
+ * for any subdomain of `suffix` (not `suffix` itself), or a RegExp tested
+ * against the lower-case hostname — anchor it (`/^eu\d\.example\.com$/`).
+ */
+export type AllowedHost = string | RegExp;
+/** Scheme rules shared by {@link readOriginEnv} and {@link assertAllowedUrl}. */
+export interface SchemeRules {
+    /** Require `https:`. Default `true`. `false` allows `http:` to any host. */
+    requireHttps?: boolean;
+    /** With `requireHttps`, still allow `http:` to `localhost`, `127.0.0.0/8` and `[::1]` (local dev). Default `false`. */
+    allowHttpLoopback?: boolean;
+}
+/** Options for {@link readOriginEnv}. */
+export interface ReadOriginEnvOptions extends SchemeRules {
+    /** The source to read from. Defaults to `process.env`. */
+    env?: EnvSource;
+    /** Used when the variable is unset; checked by the same rules. */
+    default?: string;
+    /** When set, the host must match one of these. */
+    allowHosts?: readonly AllowedHost[];
+}
+/**
+ * Read a base-URL override from the environment and return its origin
+ * (`https://host[:port]`, lower-cased, no trailing slash), hardened like
+ * {@link readEnvVar} (blank / `'null'` / `${...}` placeholders are unset).
+ *
+ * Accepts a bare `host[:port]` (https is assumed) or an origin URL. Refuses
+ * with {@link UrlNotAllowedError} — naming only the variable, never its value —
+ * a value that:
+ *  - is not http(s), or is `http:` while `requireHttps` (default `true`) holds
+ *    (loopback excepted under `allowHttpLoopback`);
+ *  - carries userinfo;
+ *  - has a path, query or fragment (so a mangled `https://https://host` is
+ *    refused instead of becoming host `https`);
+ *  - names a host outside `allowHosts`, when given.
+ *
+ * Returns `opts.default` (checked by the same rules) or `undefined` when
+ * unset.
+ */
+export declare function readOriginEnv(key: string, opts: ReadOriginEnvOptions & {
+    default: string;
+}): string;
+export declare function readOriginEnv(key: string, opts?: ReadOriginEnvOptions): string | undefined;
+/** Options for {@link assertAllowedUrl}. */
+export interface AssertAllowedUrlOptions extends SchemeRules {
+    /** Hosts the URL may point at. Must be non-empty. */
+    allowHosts: readonly AllowedHost[];
+}
+/**
+ * Check a URL that came from a tool argument or an upstream response before
+ * sending anything — a cookie, a token, a password — to it. Returns the
+ * parsed `URL`; throws {@link UrlNotAllowedError} (naming the host, never the
+ * path or query) when it is not http(s), is `http:` while `requireHttps`
+ * (default `true`) holds, carries userinfo, or its host is not in
+ * `allowHosts`. Re-check every redirect hop you follow by hand.
+ */
+export declare function assertAllowedUrl(url: string | URL, opts: AssertAllowedUrlOptions): URL;
+/**
+ * Thrown by `createApiClient({ redirect: 'same-origin' })` when a redirect
+ * points off the base origin (or adds userinfo), or the hop limit is reached.
+ * Nothing is sent to the refused target. The message names only the target's
+ * origin.
+ */
+export declare class RedirectRefusedError extends McpToolError {
+    constructor(message: string);
+}
+//# sourceMappingURL=url-safety.d.ts.map

package/dist/http/url-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-safety.d.ts","sourceRoot":"","sources":["../../src/http/url-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAkBpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,GACX,aAAa,GAAG,WAAW,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,SAAS,CAOlF;AAED,2DAA2D;AAC3D,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAgBxF;AAMD;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,YAAY;IAClD,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,MAAM,CAAC;IAExF,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAIhE;CACF;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,CAAC;AAE1C,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,uHAAuH;IACvH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAsCD,yCAAyC;AACzC,MAAM,WAAW,oBAAqB,SAAQ,WAAW;IACvD,0DAA0D;IAC1D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,UAAU,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC;AACrG,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS,CAAC;AAuB5F,4CAA4C;AAC5C,MAAM,WAAW,uBAAwB,SAAQ,WAAW;IAC1D,qDAAqD;IACrD,UAAU,EAAE,SAAS,WAAW,EAAE,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,uBAAuB,GAAG,GAAG,CAUtF;AAMD;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,YAAY;IACpD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF"}

package/dist/http/url-safety.js

@@ -0,0 +1,211 @@
+/**
+ * URL-safety atoms: confine where a credential-bearing request can go.
+ *
+ * Fleet audit 2026-09, clusters 5 and 6.
+ *
+ * Cluster 5 (alltrails, compass, eventbrite, flightaware, freshbooks, homes,
+ * redfin, zillow): a tool argument interpolated into an API path steered an
+ * authenticated GET somewhere else on the same host. The shared root cause is
+ * that `encodeURIComponent('..') === '..'`, and URL normalisation then
+ * resolves the dot segment — so even a repo that encoded every value (and
+ * eventbrite forgot to on three tools) was exposed. {@link apiPath} encodes
+ * each value AND refuses a value that is a dot segment; `createApiClient`
+ * refuses any path that normalisation would rewrite ({@link findPathHazard}),
+ * so a consumer that never adopts `apiPath` is covered too.
+ *
+ * Cluster 6 (groupon, ioffice, myhotlunchbox, schoolpass, workday,
+ * accessoticketing, housecallpro, infinitecampus, flightaware, thumbtack,
+ * gemini): a base-URL env override or a link taken from a tool / the upstream
+ * was used without checking its scheme or host, so a session cookie or a
+ * password could be sent over http or to any host. {@link readOriginEnv} and
+ * {@link assertAllowedUrl} are the one check; `createApiClient`'s
+ * `redirect: 'same-origin'` keeps a redirect from carrying the bearer off the
+ * base origin.
+ *
+ * Errors here are value-free where the value could be a secret (an env var)
+ * and name only the host where the value is a link (whose path and query may
+ * carry a token).
+ */
+import { McpToolError } from '../errors/index.js';
+import { readEnvVar } from '../config/index.js';
+// ---------------------------------------------------------------------------
+// Dot segments
+// ---------------------------------------------------------------------------
+/** True for a WHATWG single- or double-dot path segment, in any `%2e` spelling. */
+function isDotSegment(segment) {
+    const s = segment.replace(/%2e/gi, '.');
+    return s === '.' || s === '..';
+}
+/** `path` up to (not including) the first `?` or `#`. */
+function pathPartOf(path) {
+    const end = path.search(/[?#]/);
+    return end === -1 ? path : path.slice(0, end);
+}
+/**
+ * Why URL normalisation would rewrite the path portion of `path` (everything
+ * before the first `?` or `#`), or `undefined` when it would not: a dot
+ * segment (`.`, `..`, `%2e%2e` and the mixed spellings), a backslash (which
+ * special schemes treat as `/`), a C0 control character (U+0000-U+001F) or
+ * DEL, or a trailing space. The WHATWG URL parser deletes tab, LF and CR
+ * anywhere, and strips leading and trailing C0 controls and spaces from the
+ * whole URL, before it resolves dot segments — so `.\t.` becomes `..`, and
+ * `/x/.. ` (with no query after it) resolves to the parent. The query and
+ * fragment are not judged.
+ *
+ * `createApiClient` refuses a path for which this returns a reason; exported
+ * for hand-rolled clients that build URLs themselves.
+ */
+export function findPathHazard(path) {
+    const pathPart = pathPartOf(path);
+    if (/[\x00-\x1f\x7f]/.test(pathPart))
+        return 'control character';
+    if (pathPart.endsWith(' '))
+        return 'trailing space';
+    if (pathPart.includes('\\'))
+        return 'backslash';
+    if (pathPart.split('/').some(isDotSegment))
+        return 'dot segment';
+    return undefined;
+}
+/**
+ * Tagged template that builds an API path from trusted literal text and
+ * untrusted values, encoding each value as exactly ONE path segment:
+ *
+ * ```ts
+ * api.fetchJson('GET', apiPath`/trails/${id}/reviews`);
+ * ```
+ *
+ * Each value goes through `encodeURIComponent` (so `/`, `?`, `#`, `\` and `%`
+ * cannot add structure), and a value that is empty, `.` or `..` throws a
+ * `TypeError` — `encodeURIComponent` leaves dots alone, so `..` would
+ * otherwise survive encoding and be resolved by the URL parser. Only strings,
+ * finite numbers and bigints are accepted; anything else is a programming
+ * error and throws.
+ *
+ * The literal parts are not touched: they are the author's own.
+ */
+export function apiPath(strings, ...values) {
+    let out = strings[0] ?? '';
+    for (let i = 0; i < values.length; i += 1) {
+        const v = values[i];
+        let text;
+        if (typeof v === 'string')
+            text = v;
+        else if ((typeof v === 'number' && Number.isFinite(v)) || typeof v === 'bigint')
+            text = String(v);
+        else
+            throw new TypeError(`apiPath: value ${i + 1} must be a string, a finite number or a bigint.`);
+        if (text === '' || text === '.' || text === '..') {
+            throw new TypeError(`apiPath: value ${i + 1} is ${text === '' ? 'empty' : `the dot segment "${text}"`}, which cannot be a path segment.`);
+        }
+        out += encodeURIComponent(text) + (strings[i + 1] ?? '');
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Origins and allowed hosts
+// ---------------------------------------------------------------------------
+/**
+ * Thrown by {@link readOriginEnv} and {@link assertAllowedUrl} when a URL is
+ * refused. `reason` is a stable code for branching; the message never quotes
+ * an env value, and for a link names only its host.
+ */
+export class UrlNotAllowedError extends McpToolError {
+    reason;
+    constructor(message, reason) {
+        super(message);
+        this.name = 'UrlNotAllowedError';
+        this.reason = reason;
+    }
+}
+function isLoopback(hostname) {
+    return hostname === 'localhost' || hostname === '[::1]' || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(hostname);
+}
+function hostAllowed(hostname, allowHosts) {
+    const host = hostname.toLowerCase();
+    return allowHosts.some((entry) => {
+        if (entry instanceof RegExp) {
+            entry.lastIndex = 0;
+            return entry.test(host);
+        }
+        const e = entry.toLowerCase();
+        if (e.startsWith('*.'))
+            return host.endsWith(e.slice(1)) && host.length > e.length - 1;
+        return host === e;
+    });
+}
+/**
+ * The checks both entry points share, on an already-parsed URL. `subject`
+ * names what was checked in the message (the env key, or the link's host).
+ */
+function checkUrl(u, subject, rules) {
+    if (u.protocol !== 'https:' && u.protocol !== 'http:') {
+        throw new UrlNotAllowedError(`${subject} must be an http(s) URL.`, 'scheme');
+    }
+    if (u.protocol === 'http:' && (rules.requireHttps ?? true) && !(rules.allowHttpLoopback && isLoopback(u.hostname))) {
+        throw new UrlNotAllowedError(`${subject} must use https.`, 'insecure');
+    }
+    if (u.username !== '' || u.password !== '') {
+        throw new UrlNotAllowedError(`${subject} must not carry credentials (userinfo) in the URL.`, 'userinfo');
+    }
+    if (rules.allowHosts !== undefined && !hostAllowed(u.hostname, rules.allowHosts)) {
+        throw new UrlNotAllowedError(`${subject} is not an allowed host for this service.`, 'host');
+    }
+}
+export function readOriginEnv(key, opts = {}) {
+    const raw = readEnvVar(key, opts.env ? { env: opts.env } : {});
+    const value = raw ?? opts.default;
+    if (value === undefined)
+        return undefined;
+    const subject = raw === undefined ? `The default for ${key}` : `The environment variable ${key}`;
+    const withScheme = /^[a-z][a-z0-9+.-]*:/i.test(value) && !/^[^:/]+:\d+$/.test(value) ? value : `https://${value}`;
+    let u;
+    try {
+        u = new URL(withScheme);
+    }
+    catch {
+        throw new UrlNotAllowedError(`${subject} is not a valid URL or host.`, 'invalid');
+    }
+    checkUrl(u, subject, opts);
+    if (u.pathname !== '/' || u.search !== '' || u.hash !== '' || /[?#]$/.test(value)) {
+        throw new UrlNotAllowedError(`${subject} must be an origin (scheme://host[:port]) with no path, query or fragment.`, 'not-origin');
+    }
+    return u.origin;
+}
+/**
+ * Check a URL that came from a tool argument or an upstream response before
+ * sending anything — a cookie, a token, a password — to it. Returns the
+ * parsed `URL`; throws {@link UrlNotAllowedError} (naming the host, never the
+ * path or query) when it is not http(s), is `http:` while `requireHttps`
+ * (default `true`) holds, carries userinfo, or its host is not in
+ * `allowHosts`. Re-check every redirect hop you follow by hand.
+ */
+export function assertAllowedUrl(url, opts) {
+    if (opts.allowHosts.length === 0)
+        throw new TypeError('assertAllowedUrl: allowHosts must not be empty.');
+    let u;
+    try {
+        u = new URL(String(url));
+    }
+    catch {
+        throw new UrlNotAllowedError('The link is not a valid URL.', 'invalid');
+    }
+    checkUrl(u, `The link to ${u.host || u.protocol}`, opts);
+    return u;
+}
+// ---------------------------------------------------------------------------
+// Redirects
+// ---------------------------------------------------------------------------
+/**
+ * Thrown by `createApiClient({ redirect: 'same-origin' })` when a redirect
+ * points off the base origin (or adds userinfo), or the hop limit is reached.
+ * Nothing is sent to the refused target. The message names only the target's
+ * origin.
+ */
+export class RedirectRefusedError extends McpToolError {
+    constructor(message) {
+        super(message);
+        this.name = 'RedirectRefusedError';
+    }
+}
+//# sourceMappingURL=url-safety.js.map

package/dist/http/url-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-safety.js","sourceRoot":"","sources":["../../src/http/url-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,mFAAmF;AACnF,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;AACjC,CAAC;AAED,yDAAyD;AACzD,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY;IAEZ,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,mBAAmB,CAAC;IACjE,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACpD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC;IAChD,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,aAAa,CAAC;IACjE,OAAO,SAAS,CAAC;AACnB,CAAC;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,OAAO,CAAC,OAA6B,EAAE,GAAG,MAAsB;IAC9E,IAAI,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAY,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,IAAY,CAAC;QACjB,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,IAAI,GAAG,CAAC,CAAC;aAC/B,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;;YAC7F,MAAM,IAAI,SAAS,CAAC,kBAAkB,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;QACnG,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACjD,MAAM,IAAI,SAAS,CACjB,kBAAkB,CAAC,GAAG,CAAC,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,IAAI,GAAG,mCAAmC,CACrH,CAAC;QACJ,CAAC;QACD,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,YAAY;IACzC,MAAM,CAAyE;IAExF,YAAY,OAAe,EAAE,MAAoC;QAC/D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAiBD,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,IAAI,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,UAAkC;IACvE,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/B,IAAI,KAAK,YAAY,MAAM,EAAE,CAAC;YAC5B,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YACpB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACvF,OAAO,IAAI,KAAK,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,CAAM,EAAE,OAAe,EAAE,KAA4D;IACrG,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACtD,MAAM,IAAI,kBAAkB,CAAC,GAAG,OAAO,0BAA0B,EAAE,QAAQ,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,iBAAiB,IAAI,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACnH,MAAM,IAAI,kBAAkB,CAAC,GAAG,OAAO,kBAAkB,EAAE,UAAU,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,kBAAkB,CAAC,GAAG,OAAO,oDAAoD,EAAE,UAAU,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,kBAAkB,CAAC,GAAG,OAAO,2CAA2C,EAAE,MAAM,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAgCD,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,IAAI,GAAyB,EAAE;IACxE,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC,CAAC,4BAA4B,GAAG,EAAE,CAAC;IACjG,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC;IAClH,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,GAAG,OAAO,8BAA8B,EAAE,SAAS,CAAC,CAAC;IACpF,CAAC;IACD,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,kBAAkB,CAC1B,GAAG,OAAO,4EAA4E,EACtF,YAAY,CACb,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC;AAClB,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAiB,EAAE,IAA6B;IAC/E,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACzG,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,8BAA8B,EAAE,SAAS,CAAC,CAAC;IAC1E,CAAC;IACD,QAAQ,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;IACzD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,YAAY;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF"}

package/dist/netguard/index.d.ts

@@ -0,0 +1,196 @@
+/**
+ * SSRF guard for fetching a URL somebody else chose — a link from a tool
+ * argument, an email click-tracker, an `images_url`, every redirect any of
+ * them issue — so it can only reach the public internet.
+ *
+ * Fleet audit 2026-09-24 (chrischall/fleet-audit#1150). Three repos had grown
+ * three copies of the same table and none closed the gap the audit named:
+ *
+ *  - accessoticketing-mcp `src/netguard.ts` resolved the name, checked every
+ *    address, then let `fetch` resolve it AGAIN — so a DNS-rebinding name
+ *    could answer public at check time and `169.254.169.254` at connect time
+ *    (its own header comment said so) — and its redirect loop ran
+ *    `hops <= MAX_REDIRECTS`, i.e. eleven requests for a limit of ten;
+ *  - gemini-mcp `src/fetch-image.ts` judged only IP LITERALS ("closing
+ *    [rebinding] needs resolve-then-pin, which neither Node's nor workerd's
+ *    fetch exposes"), so any name pointing inward passed;
+ *  - mcp-host `packages/core/src/egress.ts` had the most complete table, and
+ *    the pin, but inside its own CONNECT proxy.
+ *
+ * This module is the one table and the pin:
+ *
+ *  - {@link isPublicAddress} — one IPv4 + IPv6 block table (private,
+ *    loopback, link-local / cloud metadata, CGNAT, ULA, multicast, reserved,
+ *    documentation, and the forms that EMBED an IPv4 judged by that IPv4).
+ *    Hand-parsed rather than `node:net`, and FAILS CLOSED on anything it
+ *    cannot parse.
+ *  - {@link createPublicOnlyDispatcher} — an undici `Agent` whose connector
+ *    resolves the name itself (injectable resolver), refuses the connection
+ *    with `UrlNotAllowedError` when ANY address is not public, and hands the
+ *    socket exactly the addresses it vetted. There is no second resolution,
+ *    so there is no lookup-to-connect window to rebind in. An IP-literal host
+ *    (which Node never looks up) is judged directly.
+ *  - {@link fetchPublic} — `fetch` through that dispatcher with MANUAL
+ *    redirects: `assertAllowedUrl` on the first URL and on every hop, at most
+ *    `maxRedirects` follow-up requests (so `maxRedirects + 1` requests in
+ *    all), credential headers dropped on a cross-origin hop, one deadline
+ *    over the whole exchange, and an optional byte cap.
+ *
+ * A SUBPATH (`@chrischall/mcp-utils/netguard`), never the root barrel: it
+ * imports `undici` (an optional peer), and only the few servers that fetch
+ * third-party URLs should have to install it.
+ *
+ * TLS still validates the certificate against the NAME (undici sets SNI /
+ * `servername` from the URL host), so pinning the address costs no
+ * certificate checking.
+ */
+import { Agent, buildConnector, Headers } from 'undici';
+import type { Dispatcher, RequestInit as UndiciRequestInit } from 'undici';
+import { type AllowedHost } from '../http/index.js';
+/**
+ * Is this textual IP address one the public internet routes?
+ *
+ * `false` for everything else — and for anything that is not a well-formed
+ * IPv4 dotted quad or IPv6 literal (a bracketed `[::1]`, a zone id
+ * `fe80::1%eth0`, the `127.1` shorthand): a guard that admits what it does not
+ * understand is the wrong default for this control.
+ *
+ * The ranges:
+ *
+ *   IPv4  0/8 this-network, 10/8 + 172.16/12 + 192.168/16 RFC 1918,
+ *         100.64/10 CGNAT, 127/8 loopback, 169.254/16 link-local (the cloud
+ *         metadata service), 192.0.0/24 protocol assignments, 192.0.2/24 +
+ *         198.51.100/24 + 203.0.113/24 TEST-NET, 192.88.99/24 6to4 relay
+ *         anycast, 198.18/15 benchmarking, 224/4 multicast, 240/4 reserved
+ *         including broadcast.
+ *   IPv6  ::/96 (unspecified, loopback, and the deprecated IPv4-compatible
+ *         form — refused WHOLE, even around a public IPv4), 64:ff9b:1::/48
+ *         local-use NAT64, 100::/64 discard, 2001::/32 Teredo, 2001:2::/48
+ *         benchmarking, 2001:10::/28 + 2001:20::/28 ORCHID, 2001:db8::/32 +
+ *         3fff::/20 documentation, 5f00::/16 SRv6, fc00::/7 ULA (Fly's 6PN
+ *         `fdaa::/16` lives here), fe80::/10 link-local, fec0::/10
+ *         site-local, ff00::/8 multicast.
+ *   Embedded IPv4 — `::ffff:a.b.c.d` (mapped, what a dual-stack resolver
+ *         returns for an A record), `::ffff:0:a.b.c.d` (SIIT), 64:ff9b::/96
+ *         (NAT64) and 2002::/16 (6to4) — judged by the IPv4 they carry, so
+ *         `::ffff:7f00:1` is loopback and `::ffff:8.8.8.8` is public.
+ *
+ * Consolidates accessoticketing-mcp `isPrivateAddress`, gemini-mcp
+ * `isPrivateIpv4`/`isPrivateIpv6` and mcp-host `isPublicAddress`.
+ */
+export declare function isPublicAddress(ip: string): boolean;
+/**
+ * Resolves a hostname to every address it has. Injectable so tests never
+ * touch DNS (the same shape as accessoticketing-mcp's `Lookup`).
+ */
+export type Resolver = (hostname: string) => Promise<string[]>;
+/** The default {@link Resolver}: the OS resolver, every address, in resolver order. */
+export declare const systemResolver: Resolver;
+/** Options for {@link createPublicOnlyDispatcher}. */
+export interface PublicOnlyDispatcherOptions {
+    /** How a name becomes addresses. Default {@link systemResolver}. */
+    resolve?: Resolver;
+    /**
+     * Which addresses may be connected to. Default {@link isPublicAddress}.
+     * Widen it only deliberately (a test server on loopback; an allowlisted
+     * internal range) — every address a name resolves to must pass.
+     */
+    isAllowedAddress?: (ip: string) => boolean;
+    /** Passed through to undici's `Agent` (timeouts, pool sizes, …). `connect` is owned by this function. */
+    agent?: Omit<Agent.Options, 'connect'>;
+    /** Passed through to undici's `buildConnector` (TLS options, connect timeout, …). `lookup` is owned by this function. */
+    connect?: Omit<buildConnector.BuildOptions, 'lookup'>;
+}
+/**
+ * An undici `Agent` that can only connect to public addresses.
+ *
+ * Its connector resolves each new connection's host with `resolve`, refuses
+ * the connection with `UrlNotAllowedError` (reason `'host'`, naming the host —
+ * never the address it resolved to) when the name resolves to nothing or ANY
+ * address fails `isAllowedAddress`, and gives the socket exactly the addresses
+ * it checked. Node never resolves the name a second time, which closes the
+ * lookup-to-connect DNS-rebinding window a check-then-`fetch` guard leaves
+ * open. An IP-literal host is judged as itself and never resolved.
+ *
+ * Use it as the `dispatcher` of undici's `fetch`/`request` (or via
+ * {@link fetchPublic}). Close it (`await agent.close()`) when done.
+ */
+export declare function createPublicOnlyDispatcher(opts?: PublicOnlyDispatcherOptions): Agent;
+/** Options for {@link fetchPublic}: undici `RequestInit` (minus what it owns) plus the guard's own. */
+export interface FetchPublicOptions extends Omit<UndiciRequestInit, 'redirect' | 'dispatcher' | 'signal' | 'window'>, Pick<PublicOnlyDispatcherOptions, 'resolve' | 'isAllowedAddress'> {
+    /**
+     * Redirect follow-ups allowed — at most this many requests after the first,
+     * so `maxRedirects + 1` in all. A redirect past the limit is refused
+     * (`RedirectRefusedError`) without being requested. Default 10; 0 refuses
+     * every redirect.
+     */
+    maxRedirects?: number;
+    /** One deadline over every hop and the body read. Omit for none. Throws `RequestTimeoutError`. */
+    timeoutMs?: number;
+    /** Byte cap on the final body; over it throws `ResponseTooLargeError`. Omit for none. */
+    maxBytes?: number;
+    /** The caller's cancellation; an abort rejects with its reason. */
+    signal?: AbortSignal;
+    /**
+     * The dispatcher to send through. Default: a fresh
+     * {@link createPublicOnlyDispatcher} built from `resolve` /
+     * `isAllowedAddress`, destroyed when the call settles. One you pass is used
+     * as-is and left open — it must be public-only itself.
+     */
+    dispatcher?: Dispatcher;
+    /** Require `https:` on the first URL and every hop. Default `true` (as `assertAllowedUrl`). */
+    requireHttps?: boolean;
+    /** When given, every hop's host must match (as `assertAllowedUrl`'s `allowHosts`). */
+    allowHosts?: readonly AllowedHost[];
+    /**
+     * Asked about the first URL and every redirect target BEFORE it is
+     * requested; `true` returns `{ stopped: true, url, hops }` without fetching
+     * it — e.g. a click-tracker resolver stopping at the first link on its own
+     * service. The target has already passed `assertAllowedUrl`.
+     */
+    stopBefore?: (url: URL) => boolean;
+}
+/** A {@link fetchPublic} that ran to a final response. */
+export interface PublicFetchResponse {
+    stopped: false;
+    /** The URL of the final response (after redirects). */
+    url: string;
+    /** Redirects followed. */
+    hops: number;
+    status: number;
+    headers: Headers;
+    body: Uint8Array;
+}
+/** A {@link fetchPublic} that `stopBefore` ended before requesting `url`. */
+export interface PublicFetchStopped {
+    stopped: true;
+    /** The URL `stopBefore` stopped at — not requested. */
+    url: string;
+    /** Redirects followed to reach it. */
+    hops: number;
+}
+/**
+ * `fetch` a URL somebody else chose, reaching only public addresses.
+ *
+ * Every request goes through a {@link createPublicOnlyDispatcher} (so a name
+ * that resolves — or REBINDS — inward is refused at connect), redirects are
+ * followed by hand with `assertAllowedUrl` on each target and at most
+ * `maxRedirects` follow-ups, and credential headers (`authorization`,
+ * `cookie`, `proxy-authorization`) are dropped once a hop leaves the
+ * original origin. 303 (and 301/302 after a POST) becomes a body-less GET, as
+ * in the Fetch standard; 307/308 resend the method and body (a stream body
+ * cannot be resent — pass bytes or a string if the target may 307).
+ *
+ * Returns the final response's status, headers and body bytes (capped by
+ * `maxBytes`). A 3xx with no `Location` is a final response. Throws
+ * `UrlNotAllowedError` for a refused URL or address, `RedirectRefusedError`
+ * past the limit, `RequestTimeoutError` past `timeoutMs`,
+ * `ResponseTooLargeError` past `maxBytes`, the caller's abort reason, and an
+ * `McpToolError` of kind `'transport'` (naming only the host) when the host
+ * cannot be reached.
+ */
+export declare function fetchPublic(url: string | URL, opts: FetchPublicOptions & {
+    stopBefore: (url: URL) => boolean;
+}): Promise<PublicFetchResponse | PublicFetchStopped>;
+export declare function fetchPublic(url: string | URL, opts?: Omit<FetchPublicOptions, 'stopBefore'>): Promise<PublicFetchResponse>;
+//# sourceMappingURL=index.d.ts.map

package/dist/netguard/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/netguard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAIH,OAAO,EAAE,KAAK,EAAE,cAAc,EAAwB,OAAO,EAAE,MAAM,QAAQ,CAAC;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,IAAI,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAE3E,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAO1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAMnD;AA2GD;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAE/D,uFAAuF;AACvF,eAAO,MAAM,cAAc,EAAE,QACqD,CAAC;AAEnF,sDAAsD;AACtD,MAAM,WAAW,2BAA2B;IAC1C,oEAAoE;IACpE,OAAO,CAAC,EAAE,QAAQ,CAAC;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,yGAAyG;IACzG,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvC,yHAAyH;IACzH,OAAO,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;CACvD;AASD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,GAAE,2BAAgC,GAAG,KAAK,CAkCxF;AAMD,uGAAuG;AACvG,MAAM,WAAW,kBACf,SAAQ,IAAI,CAAC,iBAAiB,EAAE,UAAU,GAAG,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAC9E,IAAI,CAAC,2BAA2B,EAAE,SAAS,GAAG,kBAAkB,CAAC;IACnE;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kGAAkG;IAClG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,+FAA+F;IAC/F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,sFAAsF;IACtF,UAAU,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IACpC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC;CACpC;AAED,0DAA0D;AAC1D,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,KAAK,CAAC;IACf,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,IAAI,CAAC;IACd,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;CACd;AAcD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,GAAG,GAAG,EACjB,IAAI,EAAE,kBAAkB,GAAG;IAAE,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAA;CAAE,GAC/D,OAAO,CAAC,mBAAmB,GAAG,kBAAkB,CAAC,CAAC;AACrD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC"}