@decohere/http 0.0.1-dev.126 → 0.0.1-dev.5

package/commonjs/src/testing/boot-module.js

@@ -1,38 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "bootModule", {
-    enumerable: true,
-    get: function() {
-        return bootModule;
-    }
-});
-const _builder = require("../builder/builder.js");
-require("../http/http.extensions.js");
-const _fastifyprovider = require("../providers/fastify.provider.js");
-const _ssereader = require("./sse-reader.js");
-async function bootModule(options) {
-    let builder = _builder.Builder.create().withHttp(options.provider ?? _fastifyprovider.FastifyProvider).withControllers(...options.controllers);
-    if (options.services) builder = builder.withServices(options.services);
-    options.configure?.(builder);
-    const app = await builder.build();
-    await app.start({
-        port: 0,
-        host: "127.0.0.1",
-        shutdownSignals: false
-    });
-    const baseUrl = app.addresses[0];
-    if (baseUrl == null) {
-        await app.dispose();
-        throw new Error("app.start({ port: 0 }) advertised no IPv4 address");
-    }
-    const stop = ()=>app.dispose();
-    return {
-        app,
-        baseUrl,
-        readEvents: (path, readOptions)=>(0, _ssereader.readEventStream)(`${baseUrl}${path}`, readOptions),
-        stop,
-        [Symbol.asyncDispose]: stop
-    };
-}

package/commonjs/src/testing/index.js

@@ -1,20 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-function _export(target, all) {
-    for(var name in all)Object.defineProperty(target, name, {
-        enumerable: true,
-        get: Object.getOwnPropertyDescriptor(all, name).get
-    });
-}
-_export(exports, {
-    get bootModule () {
-        return _bootmodule.bootModule;
-    },
-    get readEventStream () {
-        return _ssereader.readEventStream;
-    }
-});
-const _bootmodule = require("./boot-module.js");
-const _ssereader = require("./sse-reader.js");

package/commonjs/src/testing/sse-reader.js

@@ -1,98 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "readEventStream", {
-    enumerable: true,
-    get: function() {
-        return readEventStream;
-    }
-});
-/** Incremental parser for the `text/event-stream` format. */ class SseParser {
-    buffer = "";
-    data = [];
-    current = {
-        data: ""
-    };
-    hasFields = false;
-    events = [];
-    comments = [];
-    push(chunk) {
-        this.buffer += chunk;
-        let newline;
-        while((newline = this.buffer.search(/\r\n|\r|\n/)) !== -1){
-            const line = this.buffer.slice(0, newline);
-            const eol = this.buffer.slice(newline).startsWith("\r\n") ? 2 : 1;
-            this.buffer = this.buffer.slice(newline + eol);
-            this.line(line);
-        }
-    }
-    line(line) {
-        if (line === "") {
-            if (this.hasFields) {
-                this.events.push({
-                    ...this.current,
-                    data: this.data.join("\n")
-                });
-            }
-            this.data = [];
-            this.current = {
-                data: ""
-            };
-            this.hasFields = false;
-            return;
-        }
-        if (line.startsWith(":")) {
-            this.comments.push(line.slice(1).trim());
-            return;
-        }
-        const colon = line.indexOf(":");
-        const field = colon === -1 ? line : line.slice(0, colon);
-        let value = colon === -1 ? "" : line.slice(colon + 1);
-        if (value.startsWith(" ")) value = value.slice(1);
-        this.hasFields = true;
-        if (field === "data") this.data.push(value);
-        else if (field === "event") this.current.event = value;
-        else if (field === "id") this.current.id = value;
-        else if (field === "retry") this.current.retry = Number(value);
-    }
-}
-async function readEventStream(url, options = {}) {
-    const count = options.count ?? 1;
-    const abort = new AbortController();
-    const timer = setTimeout(()=>abort.abort(new Error(`No ${count} events from ${url} in time`)), options.timeoutMs ?? 5000);
-    try {
-        const response = await fetch(url, {
-            headers: {
-                accept: "text/event-stream",
-                ...options.headers
-            },
-            signal: abort.signal
-        });
-        const parser = new SseParser();
-        let ended = false;
-        if (response.status === 200 && response.body != null) {
-            const reader = response.body.pipeThrough(new TextDecoderStream()).getReader();
-            while(parser.events.length < count){
-                const { done, value } = await reader.read();
-                if (done) {
-                    ended = true;
-                    break;
-                }
-                parser.push(value);
-            }
-            await reader.cancel();
-        } else {
-            await response.body?.cancel();
-        }
-        return {
-            status: response.status,
-            headers: response.headers,
-            events: parser.events.slice(0, count),
-            comments: parser.comments,
-            ended
-        };
-    } finally{
-        clearTimeout(timer);
-    }
-}

package/es6/src/app/app.js

@@ -1,148 +0,0 @@
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { LifetimeScopeToken } from "@decohere/crucible";
-import { inject, optional } from "@decohere/crucible/decorators";
-import { ConfigurationServiceToken } from "@decohere/core/configuration";
-import { scribe } from "@decohere/scribe";
-import { HostedServiceHostToken, HttpProviderToken } from "../const.js";
-const DEFAULT_PORT = 3000;
-const DEFAULT_SHUTDOWN_SIGNALS = [
-    "SIGTERM",
-    "SIGINT"
-];
-const DEFAULT_SHUTDOWN_TIMEOUT_MS = 10_000;
-export class ApiConfiguration {
-    port;
-}
-export class App {
-    container;
-    configurationService;
-    httpProvider;
-    hostedServices;
-    _addresses = Array.of();
-    logger = scribe.logger(App.name);
-    disposing;
-    disposingContainer = false;
-    signalHandler;
-    shutdownSignals = [];
-    constructor(container, configurationService, httpProvider, hostedServices){
-        this.container = container;
-        this.configurationService = configurationService;
-        this.httpProvider = httpProvider;
-        this.hostedServices = hostedServices;
-    }
-    get addresses() {
-        return this._addresses;
-    }
-    async start(options) {
-        this.logger.info("Starting app");
-        // Before HTTP, so a request never reaches a service that has not started.
-        await this.hostedServices?.start(this.container);
-        // The app was stopped while a hosted service was still starting.
-        if (this.disposing != null) return;
-        const hasHostedServices = this.hostedServices != null && !this.hostedServices.isEmpty;
-        if (!this.httpProvider) {
-            if (hasHostedServices) this.stopOnSignals(options);
-            return;
-        }
-        const port = await this.getPort(options);
-        this.logger.info(`Starting http on port ${port}`);
-        const startResponse = await this.httpProvider?.start({
-            port,
-            ...options?.host != null ? {
-                host: options.host
-            } : {}
-        });
-        this._addresses = [
-            ...startResponse.addresses
-        ];
-        this.logger.info("Listening on:", this._addresses);
-        this.stopOnSignals(options);
-        return startResponse;
-    }
-    [Symbol.asyncDispose]() {
-        // The container holds this App too; when stop() disposes the container it lands
-        // here, and awaiting our own shutdown would deadlock.
-        if (this.disposingContainer) return Promise.resolve();
-        return this.dispose();
-    }
-    /** Stop the app. Calling it again (or from a signal) returns the same shutdown. */ dispose() {
-        this.disposing ??= this.stop();
-        return this.disposing;
-    }
-    async stop() {
-        // Removed first, so a second Ctrl+C / SIGTERM gets Node's default: exit now.
-        this.removeSignalHandlers();
-        this.logger.info("Stopping");
-        // Hosted services hear the signal at once, so background work winds down while HTTP drains.
-        this.hostedServices?.abort();
-        try {
-            // HTTP first: in-flight requests still need the services (DB pools etc.) that
-            // disposing the container would close.
-            await this.httpProvider?.stop();
-            // Hosted services next, while what they use is still open.
-            await this.hostedServices?.stop();
-        } finally{
-            this.disposingContainer = true;
-            await this.container[Symbol.asyncDispose]();
-            await scribe.stop();
-        }
-    }
-    stopOnSignals(options) {
-        const signals = options?.shutdownSignals ?? DEFAULT_SHUTDOWN_SIGNALS;
-        const timeoutMs = options?.shutdownTimeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS;
-        if (signals === false || signals.length === 0) return;
-        this.signalHandler = (signal)=>{
-            this.logger.info(`Received ${signal}; finishing in-flight requests`);
-            // console.error, not the logger: scribe may be the thing that's stuck.
-            const timer = setTimeout(()=>{
-                console.error(`Shutdown did not finish within ${timeoutMs}ms; exiting.`);
-                process.exit(1);
-            }, timeoutMs);
-            timer.unref();
-            this.dispose().then(()=>clearTimeout(timer), (error)=>{
-                clearTimeout(timer);
-                console.error("Shutdown failed:", error);
-                process.exit(1);
-            });
-        };
-        this.shutdownSignals = signals;
-        for (const signal of signals)process.on(signal, this.signalHandler);
-    }
-    removeSignalHandlers() {
-        if (!this.signalHandler) return;
-        for (const signal of this.shutdownSignals)process.off(signal, this.signalHandler);
-    }
-    async getPort(options) {
-        const port = options?.port ?? (await this.configurationService?.get(ApiConfiguration))?.port ?? DEFAULT_PORT;
-        return port;
-    }
-}
-App = _ts_decorate([
-    _ts_param(0, inject(LifetimeScopeToken)),
-    _ts_param(1, inject(ConfigurationServiceToken)),
-    _ts_param(1, optional()),
-    _ts_param(2, inject(HttpProviderToken)),
-    _ts_param(2, optional()),
-    _ts_param(3, inject(HostedServiceHostToken)),
-    _ts_param(3, optional()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof LifetimeScope === "undefined" ? Object : LifetimeScope,
-        typeof IConfigurationService === "undefined" ? Object : IConfigurationService,
-        typeof HttpProvider === "undefined" ? Object : HttpProvider,
-        typeof HostedServiceHost === "undefined" ? Object : HostedServiceHost
-    ])
-], App);

package/es6/src/app/index.js

@@ -1,2 +0,0 @@
-export * from "./app.js";
-export * from "./module.js";

package/es6/src/app/module.js

@@ -1,7 +0,0 @@
-export class Module {
-    constructor(data){
-        Object.assign(this, data);
-    }
-    entities;
-    repositories;
-}

package/es6/src/auth/ability.js

@@ -1,45 +0,0 @@
-import { AbilityBuilder, createMongoAbility } from "@casl/ability";
-/** Root role — expands to CASL `manage`/`all` (covers every future ability). */ export const ADMIN_ROLE = "admin";
-/**
- * Default CASL ability factory.
- *
- * - `admin` role → `manage` / `all` (wildcard)
- * - otherwise map `principal.scopes` of the form `"action:Subject"` to CASL rules
- *
- * Pass a custom factory to `withAuth()` (or override the app stub) for product-specific rules.
- */ export function defineAbilitiesFor(principal) {
-    const { can, build } = new AbilityBuilder(createMongoAbility);
-    if (principal.roles?.includes(ADMIN_ROLE)) {
-        can("manage", "all");
-        return build();
-    }
-    for (const scope of principal.scopes ?? []){
-        const [action, subject] = scope.split(":");
-        if (action && subject) can(action, subject);
-    }
-    return build();
-}
-/**
- * Map a raw JWT payload → {@link Principal}.
- *
- * Merges OAuth `scope` / `scopes` with an IdP `permissions` claim (e.g. Auth0 API permissions).
- * Override via `withAuth(..., { principalMapper })` when claims differ.
- */ export function createPrincipalFromPayload(payload) {
-    const sub = typeof payload.sub === "string" ? payload.sub : "";
-    const fromScopeClaim = typeof payload.scope === "string" ? payload.scope.split(" ").filter(Boolean) : Array.isArray(payload.scopes) ? payload.scopes.filter((s)=>typeof s === "string") : [];
-    const fromPermissions = Array.isArray(payload.permissions) ? payload.permissions.filter((s)=>typeof s === "string") : [];
-    const merged = [
-        ...new Set([
-            ...fromScopeClaim,
-            ...fromPermissions
-        ])
-    ];
-    const scopes = merged.length > 0 ? merged : undefined;
-    const roles = Array.isArray(payload.roles) ? payload.roles.filter((r)=>typeof r === "string") : undefined;
-    return {
-        ...payload,
-        sub,
-        roles: roles && roles.length > 0 ? roles : undefined,
-        scopes
-    };
-}

package/es6/src/auth/auth.config.js

@@ -1,19 +0,0 @@
-/**
- * Configuration for the TokenService, read from the `auth` section of the
- * application config file. Exactly one of the discriminant fields must be set.
- *
- * Production  → use `jwksUrl`, `publicKey`, or `secret`.
- * Development → use `devStatic` (only works when NODE_ENV=development).
- */ export class AuthConfig {
-    /** OIDC discovery URL — the issuer base URL, e.g. https://accounts.google.com.
-	 *  The framework appends `/.well-known/openid-configuration` automatically.
-	 *  Use this instead of `jwksUrl` for any standard OIDC-compliant IdP.
-	 */ discoveryUrl;
-    /** JWKS endpoint URL (RS256 / ES256 via remote key set). */ jwksUrl;
-    /** PEM-encoded public key or JWK JSON string (RS256 / ES256 static key). */ publicKey;
-    algorithms;
-    /** Shared secret for HS256. */ secret;
-    /** Issuer claim to validate (all non-devStatic variants). */ issuer;
-    /** Audience claim to validate (all non-devStatic variants). */ audience;
-    /** Static principal injected for every request (development only). */ devStatic;
-}

package/es6/src/auth/auth.extensions.js

@@ -1,83 +0,0 @@
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-import { extension } from "@decohere/core/extensibility";
-import { Builder } from "../builder/builder.js";
-import { AuthorizationServiceToken, TokenServiceToken } from "../const.js";
-import { defineAbilitiesFor } from "./ability.js";
-import { AuthConfig } from "./auth.config.js";
-import { assertDevStaticAllowed, assertNonEmptyAudience } from "./auth.types.js";
-import { CaslAuthorizationService } from "./casl-authorization.service.js";
-import { TokenService } from "./token-service.js";
-export { ADMIN_ROLE, createPrincipalFromPayload, defineAbilitiesFor } from "./ability.js";
-export class BuilderExtensions {
-    static withAuth(builder, abilityFactory = defineAbilitiesFor, options) {
-        builder.registerPreBuildStep(async (configService, containerBuilder)=>{
-            const authConfig = await configService.get(AuthConfig);
-            const tokenConfig = toTokenServiceConfig(authConfig);
-            const tokenService = new TokenService(tokenConfig, options?.principalMapper);
-            containerBuilder.registerSingleton(TokenServiceToken, tokenService);
-            containerBuilder.registerSingleton(AuthorizationServiceToken, new CaslAuthorizationService(abilityFactory, tokenService));
-        });
-        return builder;
-    }
-}
-_ts_decorate([
-    extension(Builder),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof Builder === "undefined" ? Object : Builder,
-        typeof AbilityFactory === "undefined" ? Object : AbilityFactory,
-        typeof WithAuthOptions === "undefined" ? Object : WithAuthOptions
-    ]),
-    _ts_metadata("design:returntype", void 0)
-], BuilderExtensions, "withAuth", null);
-function toTokenServiceConfig(config) {
-    // Prefer real verification strategies over devStatic so a leftover
-    // development block cannot disable OIDC/JWKS in any environment.
-    if (config.discoveryUrl != null) {
-        assertNonEmptyAudience(config.audience);
-        return {
-            discoveryUrl: config.discoveryUrl,
-            audience: config.audience
-        };
-    }
-    if (config.jwksUrl != null) {
-        assertNonEmptyAudience(config.audience);
-        return {
-            jwksUrl: config.jwksUrl,
-            issuer: config.issuer,
-            audience: config.audience
-        };
-    }
-    if (config.publicKey != null) {
-        assertNonEmptyAudience(config.audience);
-        return {
-            publicKey: config.publicKey,
-            algorithms: config.algorithms,
-            issuer: config.issuer,
-            audience: config.audience
-        };
-    }
-    if (config.secret != null) {
-        assertNonEmptyAudience(config.audience);
-        return {
-            secret: config.secret,
-            issuer: config.issuer,
-            audience: config.audience
-        };
-    }
-    if (config.devStatic != null) {
-        assertDevStaticAllowed();
-        return {
-            devStatic: config.devStatic
-        };
-    }
-    throw new Error("AuthConfig must specify one of: discoveryUrl, jwksUrl, publicKey, secret, or devStatic");
-}

package/es6/src/auth/auth.types.js

@@ -1,35 +0,0 @@
-export function isDiscoveryConfig(config) {
-    return "discoveryUrl" in config;
-}
-export function isDevStaticConfig(config) {
-    return "devStatic" in config;
-}
-export function isJwksConfig(config) {
-    return "jwksUrl" in config;
-}
-export function isPublicKeyConfig(config) {
-    return "publicKey" in config;
-}
-export function isSecretConfig(config) {
-    return "secret" in config;
-}
-/** `devStatic` is only valid for local development NODE_ENV values. */ export function isDevelopmentNodeEnv(nodeEnv = process.env.NODE_ENV) {
-    const env = nodeEnv?.toLowerCase();
-    return env === "development" || env === "dev";
-}
-/**
- * Refuse `devStatic` outside development — otherwise any Bearer string is
- * accepted as the configured principal (auth bypass in production).
- */ export function assertDevStaticAllowed(nodeEnv = process.env.NODE_ENV) {
-    if (!isDevelopmentNodeEnv(nodeEnv)) {
-        throw new Error(`AuthConfig.devStatic is only allowed when NODE_ENV is "development" or "dev" (got ${JSON.stringify(nodeEnv ?? "")}).`);
-    }
-}
-/**
- * jose skips `aud` validation when `audience` is undefined or "". Require a
- * non-empty audience for every non-devStatic verification strategy.
- */ export function assertNonEmptyAudience(audience) {
-    if (typeof audience !== "string" || audience.trim().length === 0) {
-        throw new Error(`JWT audience must be a non-empty string (got ${JSON.stringify(audience)}). ` + "Empty audience disables aud validation and accepts tokens minted for other APIs.");
-    }
-}

package/es6/src/auth/casl-authorization.service.js

@@ -1,40 +0,0 @@
-import { ForbiddenError } from "../routing/anvil.types.js";
-/**
- * IAuthorizationService implementation backed by CASL.
- *
- * Register it under AuthorizationServiceToken:
- * ```ts
- * builder.withServices((c) =>
- *   c.registerSingleton(AuthorizationServiceToken, new CaslAuthorizationService((principal) => {
- *     const { can, build } = new AbilityBuilder(createMongoAbility);
- *     if (principal.roles?.includes("admin")) can("manage", "all");
- *     else can("read", "Post");
- *     return build();
- *   }))
- * );
- * ```
- */ export class CaslAuthorizationService {
-    factory;
-    tokenService;
-    constructor(factory, tokenService){
-        this.factory = factory;
-        this.tokenService = tokenService;
-    }
-    async authorizeRequest(request, action, subject) {
-        const principal = await this.authenticateRequest(request);
-        await this.authorize(principal, action, subject);
-        return principal;
-    }
-    async authenticateRequest(request) {
-        if (!this.tokenService) {
-            throw new Error("CaslAuthorizationService requires a TokenService to authenticate requests. Register it via .withAuth().");
-        }
-        return this.tokenService.verifyRequest(request);
-    }
-    async authorize(principal, action, subject) {
-        const ability = this.factory(principal);
-        if (ability.cannot(action, subject)) {
-            throw new ForbiddenError(`Cannot perform "${action}" on "${subject}"`);
-        }
-    }
-}

package/es6/src/auth/index.js

@@ -1,6 +0,0 @@
-export * from "./ability.js";
-export * from "./auth.config.js";
-export * from "./auth.types.js";
-export * from "./casl-authorization.service.js";
-export * from "./principal-provider.js";
-export * from "./token-service.js";

package/es6/src/auth/principal-provider.js

@@ -1,14 +0,0 @@
-/**
- * Concrete, request-scoped implementation. The Router sets the principal
- * after JWT verification; downstream services consume it via IPrincipalProvider.
- *
- * @internal — framework use only. Inject IPrincipalProvider, not this class.
- */ export class PrincipalProvider {
-    _principal;
-    get currentPrincipal() {
-        return this._principal;
-    }
-    setPrincipal(principal) {
-        this._principal = principal;
-    }
-}

package/es6/src/auth/safe-outbound-url.js

@@ -1,99 +0,0 @@
-import { lookup } from "node:dns/promises";
-import { BlockList, isIP } from "node:net";
-/**
- * Validate URLs used for OIDC discovery / JWKS fetches to reduce SSRF risk.
- *
- * - http(s) only; https required except loopback (local IdP tests)
- * - no credentials in the URL
- * - hostname must not resolve to private, link-local, or metadata ranges
- *   (loopback allowed only when NODE_ENV is development/dev/test)
- */ export async function assertSafeOutboundUrl(raw, label) {
-    let url;
-    try {
-        url = new URL(raw);
-    } catch  {
-        throw new Error(`Invalid ${label}: ${raw}`);
-    }
-    if (url.protocol !== "https:" && url.protocol !== "http:") {
-        throw new Error(`${label} must use http or https (got ${url.protocol})`);
-    }
-    if (url.username || url.password) {
-        throw new Error(`${label} must not include credentials`);
-    }
-    const hostname = url.hostname.replace(/^\[|\]$/g, "");
-    if (isBlockedHostname(hostname)) {
-        throw new Error(`${label} host is not allowed (${hostname})`);
-    }
-    const ips = await resolveIps(hostname);
-    const allowLoopback = isLoopbackAllowed();
-    for (const ip of ips){
-        if (isBlockedIp(ip, allowLoopback)) {
-            throw new Error(`${label} resolves to a blocked address (${ip})`);
-        }
-    }
-    if (url.protocol === "http:") {
-        const loopbackOnly = isLoopbackHostname(hostname) || ips.length > 0 && ips.every((ip)=>isLoopbackIp(ip));
-        if (!loopbackOnly || !allowLoopback) {
-            throw new Error(`${label} must use https unless targeting loopback in development/test`);
-        }
-    }
-    return url;
-}
-function isLoopbackAllowed() {
-    const env = process.env.NODE_ENV ?? "";
-    return env === "development" || env === "dev" || env === "test";
-}
-function isLoopbackHostname(hostname) {
-    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
-}
-function isBlockedHostname(hostname) {
-    const lower = hostname.toLowerCase();
-    return lower === "metadata.google.internal" || lower === "metadata" || lower.endsWith(".metadata.google.internal");
-}
-async function resolveIps(hostname) {
-    if (isIP(hostname)) {
-        return [
-            hostname
-        ];
-    }
-    const results = await lookup(hostname, {
-        all: true,
-        verbatim: true
-    });
-    return results.map((r)=>r.address);
-}
-function isLoopbackIp(ip) {
-    const list = new BlockList();
-    list.addSubnet("127.0.0.0", 8, "ipv4");
-    list.addAddress("::1", "ipv6");
-    list.addSubnet("::ffff:127.0.0.0", 104, "ipv6");
-    return list.check(ip);
-}
-function isBlockedIp(ip, allowLoopback) {
-    if (allowLoopback && isLoopbackIp(ip)) {
-        return false;
-    }
-    const list = new BlockList();
-    // IPv4 special-use / private
-    list.addSubnet("0.0.0.0", 8, "ipv4");
-    list.addSubnet("10.0.0.0", 8, "ipv4");
-    list.addSubnet("100.64.0.0", 10, "ipv4"); // shared address space
-    list.addSubnet("127.0.0.0", 8, "ipv4");
-    list.addSubnet("169.254.0.0", 16, "ipv4"); // link-local / cloud metadata
-    list.addSubnet("172.16.0.0", 12, "ipv4");
-    list.addSubnet("192.168.0.0", 16, "ipv4");
-    list.addSubnet("198.18.0.0", 15, "ipv4"); // benchmarking
-    // IPv6
-    list.addAddress("::1", "ipv6");
-    list.addSubnet("fc00::", 7, "ipv6"); // unique local
-    list.addSubnet("fe80::", 10, "ipv6"); // link-local
-    if (list.check(ip)) {
-        return true;
-    }
-    // Mapped IPv4 inside IPv6 (::ffff:a.b.c.d)
-    const mapped = ip.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
-    if (mapped) {
-        return isBlockedIp(mapped[1], allowLoopback);
-    }
-    return false;
-}