@flaxia/node 0.3.7 → 0.5.1

package/dist/assets/egress-guard.js

@@ -0,0 +1,174 @@
+var e = 256 * 1024 * 1024, t = [443], n = [
+	".local",
+	".internal",
+	".localhost",
+	".home.arpa"
+], r = ["localhost"];
+function i(e) {
+	throw Error(`Egress blocked: ${e}`);
+}
+function a(e) {
+	(e.username || e.password) && i(`credentials in URL are not allowed (${e.protocol}//${e.hostname})`);
+}
+function o(e) {
+	let t = e.split(".");
+	if (t.length !== 4) return !1;
+	let n = [];
+	for (let e of t) {
+		if (!/^\d{1,3}$/.test(e)) return !1;
+		let t = Number(e);
+		if (t > 255) return !1;
+		n.push(t);
+	}
+	let [r, i, a] = n;
+	return r === 0 || r === 10 || r === 127 || r === 169 && i === 254 || r === 172 && i >= 16 && i <= 31 || r === 192 && i === 168 || r === 192 && i === 0 && a === 0 || r === 192 && i === 0 && a === 2 || r === 198 && (i === 18 || i === 19) || r === 198 && i === 51 && a === 100 || r === 203 && i === 0 && a === 113 || r === 100 && i >= 64 && i <= 127 || r >= 224;
+}
+function s(e) {
+	let t = e.trim().toLowerCase();
+	if (t.startsWith("[") && t.endsWith("]") && (t = t.slice(1, -1)), !t.includes(":") || t.includes("%")) return null;
+	let n = t, r = "", i = t.indexOf("::");
+	if (i !== -1) {
+		if (t.indexOf("::", i + 1) !== -1) return null;
+		n = t.slice(0, i), r = t.slice(i + 2);
+	}
+	let a = (e) => {
+		if (e === "") return [];
+		let t = [], n = e.split(":");
+		for (let e = 0; e < n.length; e++) {
+			let r = n[e];
+			if (r.includes(".")) {
+				if (e !== n.length - 1) return null;
+				let i = r.split(".");
+				if (i.length !== 4) return null;
+				let a = [];
+				for (let e of i) {
+					if (!/^\d{1,3}$/.test(e)) return null;
+					let t = Number(e);
+					if (t > 255) return null;
+					a.push(t);
+				}
+				t.push(a[0] << 8 | a[1], a[2] << 8 | a[3]);
+				continue;
+			}
+			if (!/^[0-9a-f]{1,4}$/.test(r)) return null;
+			t.push(parseInt(r, 16));
+		}
+		return t;
+	}, o = a(n), s = a(r);
+	if (o === null || s === null) return null;
+	if (i === -1) return o.length === 8 ? o : null;
+	let c = 8 - o.length - s.length;
+	return c < 1 ? null : [
+		...o,
+		...Array(c).fill(0),
+		...s
+	];
+}
+function c(e) {
+	let t = s(e);
+	if (!t) return !1;
+	let [n, r] = t;
+	return !!(t.every((e) => e === 0) || n === 0 && r === 0 && t.slice(2, 7).every((e) => e === 0) && t[7] === 1 || n === 0 && r === 0 && t.slice(2, 5).every((e) => e === 0) && (t[5] === 0 || t[5] === 65535) || (n & 65024) == 64512 || (n & 65472) == 65152 || (n & 65280) == 65280);
+}
+function l(e, t = {}) {
+	let a = e.trim().toLowerCase();
+	a || i("empty hostname"), r.includes(a) && i(`host blocked: ${a}`);
+	for (let e of n) a.endsWith(e) && i(`host blocked: ${a}`);
+	if (a.startsWith("[") || a.includes(":")) {
+		s(a) || i(`invalid IPv6 literal: ${a}`), c(a) && i(`IPv6 address blocked: ${a}`);
+		return;
+	}
+	/^\d{1,3}(\.\d{1,3}){3}$/.test(a) && o(a) && i(`IPv4 address blocked: ${a}`), /^[a-z0-9.-]+$/.test(a) || i(`host is not a plain DNS name or IP literal: ${a}`);
+}
+function u(e, n = {}) {
+	let r;
+	if (e instanceof URL) r = new URL(e.toString());
+	else try {
+		r = new URL(e);
+	} catch {
+		i(`invalid URL: ${String(e)}`);
+	}
+	(n.allowInsecure ? ["https:", "http:"] : ["https:"]).includes(r.protocol) || i(`protocol not allowed: ${r.protocol}`), a(r);
+	let o = n.allowedPorts ?? t;
+	return r.port && !o.includes(Number(r.port)) && i(`port not allowed: ${r.port}`), l(r.hostname, n), r;
+}
+function d(e) {
+	return e ? e.split(";")[0].trim().toLowerCase() : "";
+}
+function f(e, t) {
+	if (t.length === 0) return !1;
+	for (let n of t) {
+		let t = n.toLowerCase();
+		if (t.endsWith("/*")) {
+			if (e.startsWith(t.slice(0, -1))) return !0;
+		} else if (e === t) return !0;
+	}
+	return !1;
+}
+function p(e, t) {
+	try {
+		return new URL(e, t).toString();
+	} catch {
+		i(`invalid redirect location: ${e}`);
+	}
+}
+async function m(e, t, n) {
+	let r = Number(e.headers.get("content-length"));
+	Number.isFinite(r) && r > t && i(`response too large: ${n} declares ${r} bytes (cap ${t})`);
+	let a = e.body;
+	if (!a || typeof a.getReader != "function") {
+		let r = new Uint8Array(await e.arrayBuffer());
+		return r.byteLength > t && i(`response too large: ${n} returned ${r.byteLength} bytes (cap ${t})`), r;
+	}
+	let o = a.getReader(), s = [], c = 0, l = !1;
+	try {
+		for (;;) {
+			let { done: e, value: r } = await o.read();
+			if (e) break;
+			r && (c += r.byteLength, c > t && (l = !0, await o.cancel().catch(() => void 0), i(`response too large: ${n} exceeded ${t} bytes`)), s.push(r));
+		}
+	} finally {
+		l || o.releaseLock?.();
+	}
+	let u = new Uint8Array(c), d = 0;
+	for (let e of s) u.set(e, d), d += e.byteLength;
+	return u;
+}
+async function h(t, n = {}) {
+	typeof t.url != "string" && !(t.url instanceof URL) && i("url must be a string or URL"), (!Array.isArray(t.allowContentTypes) || t.allowContentTypes.length === 0) && i("no Content-Type allowlist configured");
+	let r = Math.min(Math.max(1, Math.floor(t.maxBytes ?? 8388608)), e), a = Math.max(1, Math.floor(t.timeoutMs ?? 3e4)), o = t.method ?? "GET", s = u(t.url, n), c = 0;
+	for (;;) {
+		let e;
+		try {
+			e = await fetch(s.toString(), {
+				method: o,
+				headers: t.headers,
+				redirect: "manual",
+				credentials: "omit",
+				referrerPolicy: "no-referrer",
+				signal: AbortSignal.timeout(a)
+			});
+		} catch (e) {
+			i(`request failed: ${s.toString()} (${e instanceof Error ? e.message : String(e)})`);
+		}
+		if (e.type === "opaqueredirect" || e.status >= 300 && e.status < 400) {
+			(e.status === 0 || e.type === "opaqueredirect") && i(`redirect could not be validated: ${s.toString()}`);
+			let t = e.headers.get("location");
+			t || i(`redirect without Location: ${s.toString()}`), c >= 3 && i("too many redirects (>3)"), c++, s = u(p(t, s), n);
+			continue;
+		}
+		let l = d(e.headers.get("content-type"));
+		f(l, t.allowContentTypes) || i(`content-type not allowed: ${l || "(missing)"} for ${s.toString()}`);
+		let h = e.ok && o !== "HEAD" ? await m(e, r, s.toString()) : new Uint8Array();
+		return {
+			url: s.toString(),
+			status: e.status,
+			ok: e.ok,
+			contentType: l,
+			bytes: h,
+			byteLength: h.byteLength
+		};
+	}
+}
+//#endregion
+export { h as n, u as t };

package/dist/assets/image-process.js

@@ -1,23 +1,188 @@
 //#region src/workloads/image-process.ts
-var e = async (e) => {
-	let { operation: t, imageBase64: n, mimeType: r, options: i } = e, a = performance.now(), o = Math.round(n.length * .75), s = await (await fetch(`data:${r};base64,${n}`)).blob(), c = await createImageBitmap(s), l = new OffscreenCanvas(i.width || c.width, i.height || c.height), u = l.getContext("2d");
-	if (!u) throw Error("Failed to get OffscreenCanvas context");
-	t === "grayscale" && (u.filter = "grayscale(100%)"), u.drawImage(c, 0, 0, l.width, l.height);
-	let d = i.outputFormat || r.split("/")[1], f = `image/${d}`, p = await l.convertToBlob({
-		type: f,
-		quality: i.quality || .8
-	}), m = new FileReader(), h = await new Promise((e, t) => {
-		m.onloadend = () => {
-			let t = m.result.split(",")[1];
-			e(t);
-		}, m.onerror = t, m.readAsDataURL(p);
-	});
-	return console.log(`[flaxia-node] image-process: done operation=${t} output=${d} inputBytes=${o} resultBytes=${p.size} durationMs=${Math.round(performance.now() - a)}`), {
-		imageBase64: h,
-		mimeType: f,
-		originalSizeBytes: s.size,
-		resultSizeBytes: p.size
+var e = 8192, t = 32 * 1024 * 1024, n = 16 * 1024 * 1024;
+function r(e, t) {
+	return e[t] * 16777216 + (e[t + 1] << 16) + (e[t + 2] << 8) + e[t + 3] >>> 0;
+}
+function i(e, t) {
+	return e[t] + e[t + 1] * 256 + e[t + 2] * 65536 + e[t + 3] * 16777216 >>> 0;
+}
+function a(e, t) {
+	return e[t] * 256 + e[t + 1];
+}
+function o(e, t, n) {
+	return t + n.length <= e.length && n.every((n, r) => e[t + r] === n);
+}
+function s() {
+	throw Error("image-process: unknown, truncated or inconsistent image header");
+}
+function c(e) {
+	if (o(e, 0, [
+		137,
+		80,
+		78,
+		71,
+		13,
+		10,
+		26,
+		10
+	])) return (e.length < 33 || r(e, 8) !== 13 || !o(e, 12, [
+		73,
+		72,
+		68,
+		82
+	]) || !(e[25] === 0 && [
+		1,
+		2,
+		4,
+		8,
+		16
+	].includes(e[24]) || e[25] === 2 && [8, 16].includes(e[24]) || e[25] === 3 && [
+		1,
+		2,
+		4,
+		8
+	].includes(e[24]) || [4, 6].includes(e[25]) && [8, 16].includes(e[24])) || e[26] !== 0 || e[27] !== 0 || e[28] > 1) && s(), {
+		width: r(e, 16),
+		height: r(e, 20),
+		format: "png"
 	};
+	if (o(e, 0, [255, 216])) {
+		let t = 2;
+		for (; t < e.length;) {
+			for (e[t++] !== 255 && s(); t < e.length && e[t] === 255;) t++;
+			t >= e.length && s();
+			let n = e[t++];
+			if ((n === 0 || n === 216 || n === 217 || n === 218) && s(), n === 1 || n >= 208 && n <= 215) continue;
+			t + 2 > e.length && s();
+			let r = a(e, t);
+			if ((r < 2 || t + r > e.length) && s(), [
+				192,
+				193,
+				194,
+				195,
+				197,
+				198,
+				199,
+				201,
+				202,
+				203,
+				205,
+				206,
+				207
+			].includes(n)) return (r < 8 || e[t + 2] === 0 || e[t + 7] === 0 || r !== 8 + e[t + 7] * 3) && s(), {
+				width: a(e, t + 5),
+				height: a(e, t + 3),
+				format: "jpeg"
+			};
+			t += r;
+		}
+		s();
+	}
+	if (o(e, 0, [
+		82,
+		73,
+		70,
+		70
+	]) && o(e, 8, [
+		87,
+		69,
+		66,
+		80
+	])) {
+		(e.length < 20 || i(e, 4) !== e.length - 8) && s();
+		let t = i(e, 16);
+		if ((t > e.length - 20 || t % 2 + t + 20 > e.length) && s(), o(e, 12, [
+			86,
+			80,
+			56,
+			88
+		])) return (t !== 10 || e[20] & 193 || e[21] !== 0 || e[22] !== 0 || e[23] !== 0) && s(), {
+			width: 1 + e[24] + (e[25] << 8) + (e[26] << 16),
+			height: 1 + e[27] + (e[28] << 8) + (e[29] << 16),
+			format: "webp"
+		};
+		if (o(e, 12, [
+			86,
+			80,
+			56,
+			76
+		])) {
+			(t < 5 || e[20] !== 47 || e[24] & 240) && s();
+			let n = i(e, 21);
+			return {
+				width: (n & 16383) + 1,
+				height: (n >>> 14 & 16383) + 1,
+				format: "webp"
+			};
+		}
+		if (o(e, 12, [
+			86,
+			80,
+			56,
+			32
+		])) return (t < 10 || e[20] & 1 || !o(e, 23, [
+			157,
+			1,
+			42
+		])) && s(), {
+			width: (e[27] << 8 | e[26]) & 16383,
+			height: (e[29] << 8 | e[28]) & 16383,
+			format: "webp"
+		};
+		s();
+	}
+	s();
+}
+function l({ width: n, height: r }) {
+	if (!Number.isSafeInteger(n) || !Number.isSafeInteger(r) || n < 1 || r < 1 || n > 8192 || r > 8192 || n * r > 33554432) throw Error(`image-process: source dimensions ${n}x${r} exceed image limits (${e}px side, ${t} pixels)`);
+}
+function u(t, n) {
+	if (t == null) return null;
+	if (typeof t != "number" || !Number.isInteger(t) || t <= 0) throw Error(`image-process: options.${n} must be a positive integer, got ${JSON.stringify(t)}`);
+	if (t > 8192) throw Error(`image-process: options.${n} ${t} exceeds the ${e}px limit`);
+	return t;
+}
+function d(e, n) {
+	let r = u(e.width, "width") ?? n.width, i = u(e.height, "height") ?? n.height, a = {
+		width: Math.max(1, Math.min(r, n.width)),
+		height: Math.max(1, Math.min(i, n.height))
+	};
+	if (a.width * a.height > 33554432) throw Error(`image-process: canvas ${a.width}x${a.height} exceeds the ${t} pixel limit`);
+	return a;
+}
+var f = async (e) => {
+	let { operation: t, imageBase64: r, mimeType: i, options: a } = e, o = performance.now();
+	if (typeof r != "string" || r.length > 22369624 || !/^[A-Za-z0-9+/]*={0,2}$/.test(r) || r.length % 4 != 0) throw Error(`image-process: invalid base64 or image exceeds ${n} byte limit`);
+	let s = r.endsWith("==") ? 2 : +!!r.endsWith("="), u = r.length / 4 * 3 - s;
+	if (u > 16777216) throw Error(`image-process: image exceeds ${n} byte limit`);
+	let f = await (await fetch(`data:${i};base64,${r}`)).blob();
+	if (f.size > 16777216) throw Error(`image-process: image exceeds ${n} byte limit`);
+	let p = c(new Uint8Array(await f.arrayBuffer()));
+	if (l(p), i !== `image/${p.format}`) throw Error(`image-process: declared MIME ${i} does not match ${p.format} image`);
+	let m = await createImageBitmap(f);
+	try {
+		if (m.width !== p.width || m.height !== p.height) throw Error("image-process: decoded image dimensions differ from image header");
+		let e = d(a, m), n = new OffscreenCanvas(e.width, e.height), r = n.getContext("2d");
+		if (!r) throw Error("Failed to get OffscreenCanvas context");
+		t === "grayscale" && (r.filter = "grayscale(100%)"), r.drawImage(m, 0, 0, n.width, n.height);
+		let s = a.outputFormat || i.split("/")[1], c = `image/${s}`, l = await n.convertToBlob({
+			type: c,
+			quality: a.quality || .8
+		}), h = new FileReader(), g = await new Promise((e, t) => {
+			h.onloadend = () => {
+				let t = h.result.split(",")[1];
+				e(t);
+			}, h.onerror = t, h.readAsDataURL(l);
+		});
+		return console.log(`[flaxia-node] image-process: done operation=${t} output=${s} size=${e.width}x${e.height} inputBytes=${u} resultBytes=${l.size} durationMs=${Math.round(performance.now() - o)}`), {
+			imageBase64: g,
+			mimeType: c,
+			originalSizeBytes: f.size,
+			resultSizeBytes: l.size
+		};
+	} finally {
+		m.close();
+	}
 };
 //#endregion
-export { e as handleImageProcess };
+export { f as handleImageProcess };

package/dist/assets/nudenet.js

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/dist/assets/nudenet.js
-size: 70463194 bytes
-sha256: bbc5f432cdf3f9d1e1d0308b42ebae1d4e3cfd345bdb2f9a09679fd7e98d3f70
+size: 70464329 bytes
+sha256: d6b0662a4da0668cefa3583cd693e3652bec3a34a59cc459b7a66bb01a2060b0