@humain/terminal 0.0.2 → 0.0.3-beta.0

package/dist/humain/web-access/vendor/source-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-check.js","sourceRoot":"","sources":["../../../../src/humain/web-access/vendor/source-check.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AA+DlE,MAAM,mBAAmB,GAAG,2DAA2D,CAAC;AACxF,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAC1D,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AACvD,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AACpD,MAAM,UAAU,GAAG,iDAAiD,CAAC;AACrE,MAAM,UAAU,GAAG,aAAa,CAAC;AACjC,MAAM,WAAW,GAAG,+EAA+E,CAAC;AACpG,MAAM,WAAW,GAAG,6BAA6B,CAAC;AAClD,MAAM,UAAU,GAAG,+GAA+G,CAAC;AACnI,MAAM,UAAU,GAAG,eAAe,CAAC;AAEnC,MAAM,UAAU,cAAc,CAAC,GAAW,EAAiB;IAC1D,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;QACvB,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC;IACrD,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC;IAC7F,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC;IACvD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAClE,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IACrE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAClE,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAU;IACjD,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAAA,CAC3E;AAID,SAAS,QAAQ,CAAC,KAAa,EAAY;IAC1C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CAC/F;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,IAAY,EAAU;IACpE,MAAM,SAAS,GAAW,EAAE,CAAC;IAC7B,MAAM,eAAe,GAAG,8BAA8B,CAAC;IACvD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrD,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC;IACF,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,SAAS;SACd,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SACjI,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;SAChC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SACtD,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;AAAA,CAClC;AAED,SAAS,SAAS,CAAC,UAAkB,EAAE,KAAa,EAAU;IAC7D,OAAO,KAAK,UAAU,IAAI,KAAK,EAAE,CAAC;AAAA,CAClC;AAED,MAAM,UAAU,aAAa,CAAC,OAAyB,EAAE,OAAO,GAAuB,EAAE,EAAE,IAAI,GAAG,EAAE,EAAqB;IACxH,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACtE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC;gBACb,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrC,UAAU,EAAE,MAAM,CAAC,GAAG;gBACtB,WAAW,EAAE,MAAM,CAAC,IAAI;gBACxB,IAAI,EAAE,MAAM,CAAC,OAAO;gBACpB,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC;aACzC,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;YACnD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBACvF,QAAQ,CAAC,IAAI,CAAC;oBACb,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;oBAC7C,UAAU,EAAE,MAAM,CAAC,GAAG;oBACtB,WAAW,EAAE,MAAM,CAAC,IAAI;oBACxB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;oBACrD,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;iBACpC,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,MAAM,qBAAqB,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;AACpJ,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AAErJ,SAAS,cAAc,CAAC,KAAa,EAAE,MAAc,EAAW;IAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjI,OAAO,IAAI,MAAM,CAAC,kBAAkB,OAAO,iBAAiB,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAAA,CAC/E;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,MAAc,EAAW;IAChE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjI,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,kBAAkB,OAAO,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1F,OAAO,8CAA8C,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AAAA,CACzE;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,OAAiB,EAAE,YAAY,GAAG,KAAK,EAAW;IAC3F,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAAA,CACpH;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,QAA2B,EAAmB;IACxF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE,SAAS,EAAE,uDAAuD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACxL,CAAC;IACD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3E,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QACjE,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC1D,IAAI,MAAM,IAAI,CAAC,OAAO;YAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;aAC1D,IAAI,OAAO,IAAI,CAAC,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,mBAAmB,EAAE,EAAE,EAAE,sBAAsB,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,MAAM,oDAAoD,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,GAAG,aAAa,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;IAChQ,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,mBAAmB,EAAE,UAAU,EAAE,sBAAsB,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,MAAM,oDAAoD,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,GAAG,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;IACpP,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,UAAU,EAAE,sBAAsB,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,MAAM,mBAAmB,aAAa,CAAC,MAAM,+CAA+C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACrP,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE,SAAS,EAAE,2FAA2F,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AAAA,CAClN;AAgBD,MAAM,UAAU,qBAAqB,CAAC,KAAyB,EAAoB;IAClF,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;IACzC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC;YAC9B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC;YACnC,OAAO;YACP,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1G,OAAO;QACN,EAAE,EAAE,UAAU,EAAE;QAChB,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO;QACP,QAAQ;QACR,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,OAAO,EAAE;YACR,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,cAAc,EAAE,aAAa;YAC7B,cAAc,EAAE,aAAa;SAC7B;KACD,CAAC;AAAA,CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,QAA0B,EAAE,MAAgB,EAAoB;IACnG,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;AAAA,CAC7F;AAED,MAAM,UAAU,qBAAqB,CAAC,QAA0B,EAAQ;IACvE,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5E,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;AAAA,CACzG;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAU,EAA2B;IACxE,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1G,OAAO,IAAI,CAAC,QAA4B,CAAC;AAAA,CACzC","sourcesContent":["// Structured source checking and machine-readable research artifacts.\nimport { createHash } from \"node:crypto\";\nimport { generateId, getResult, storeResult } from \"./storage.ts\";\nimport type { SearchResult } from \"./perplexity.ts\";\nimport type { ExtractedContent } from \"./extract.ts\";\n\nexport type SourceQuality = \"official_docs\" | \"vendor_docs\" | \"repo_issue\" | \"blog\" | \"forum\" | \"news\" | \"unknown\";\nexport type ClaimStatus = \"supported\" | \"contradicted\" | \"unclear\" | \"missing-evidence\";\nexport type RecencyFilter = \"day\" | \"week\" | \"month\" | \"year\";\n\nexport interface ResearchSource {\n\trank: number;\n\turl: string;\n\ttitle: string;\n\tsnippet?: string;\n\tfetch_timestamp?: number;\n\tcontent_hash?: string;\n\tquality: SourceQuality;\n\tfetched?: boolean;\n\tfetch_error?: string;\n}\n\nexport interface ResearchPassage {\n\tpassage_id: string;\n\tsource_url: string;\n\tsource_rank: number;\n\ttext: string;\n\textraction_span?: { start: number; end: number };\n\tcontent_hash?: string;\n}\n\nexport interface ClaimAssessment {\n\tclaim: string;\n\tstatus: ClaimStatus;\n\tsupporting_passages: string[];\n\tcontradicting_passages: string[];\n\trationale: string;\n\tconfidence: number;\n}\n\nexport interface ResearchArtifact {\n\tid: string;\n\ttype: \"research\";\n\ttimestamp: number;\n\tquery: string;\n\tsources: ResearchSource[];\n\tpassages: ResearchPassage[];\n\tclaims?: ClaimAssessment[];\n\tprovider?: string;\n\tsummary?: string;\n\tcontent_hash?: string;\n\tfilters?: { recency?: RecencyFilter; domain_include?: string[]; domain_exclude?: string[] };\n\terrors?: Array<{ query: string; error: string }>;\n}\n\nexport interface ResearchSearchRequest {\n\tquery: string;\n\tnumResults: number;\n\trecencyFilter?: RecencyFilter;\n\tdomainFilter?: string[];\n}\nexport interface ResearchSearchResult { url: string; title: string; snippet: string; rank: number }\nexport interface ResearchSearchResponse { provider: string; results: ResearchSearchResult[]; summary?: string }\nexport interface ResearchProvider { name: string; search(req: ResearchSearchRequest): Promise<ResearchSearchResponse> }\n\nconst OFFICIAL_DOCS_HOSTS = /^(developers\\.|docs\\.|learn\\.|reference\\.)|\\.github\\.io$/i;\nconst OFFICIAL_DOCS_PATHS = /\\/(docs?|reference)(\\/|\\b)/i;\nconst VENDOR_DOCS_PATHS = /\\/(documentation|docs?)\\//i;\nconst REPO_ISSUE_PATHS = /\\/(issues|pull|pulls)\\//i;\nconst BLOG_HOSTS = /(medium\\.com|substack\\.com|dev\\.to|hashnode\\.)/i;\nconst BLOG_PATHS = /\\/blogs?\\//i;\nconst FORUM_HOSTS = /(stackoverflow\\.com|serverfault\\.com|superuser\\.com|discourse\\.|community\\.)/i;\nconst FORUM_PATHS = /\\/(forum|forums|threads)\\//i;\nconst NEWS_HOSTS = /(reuters\\.com|bloomberg\\.com|techcrunch\\.com|theverge\\.com|arstechnica\\.com|wired\\.com|cnet\\.com|zdnet\\.com)/i;\nconst NEWS_PATHS = /\\/news(\\/|$)/i;\n\nexport function classifySource(url: string): SourceQuality {\n\tlet host = \"\";\n\tlet path = \"\";\n\ttry {\n\t\tconst parsed = new URL(url);\n\t\thost = parsed.hostname;\n\t\tpath = parsed.pathname;\n\t} catch {\n\t\treturn \"unknown\";\n\t}\n\tif (REPO_ISSUE_PATHS.test(path)) return \"repo_issue\";\n\tif (OFFICIAL_DOCS_HOSTS.test(host) || OFFICIAL_DOCS_PATHS.test(path)) return \"official_docs\";\n\tif (VENDOR_DOCS_PATHS.test(path)) return \"vendor_docs\";\n\tif (NEWS_HOSTS.test(host) || NEWS_PATHS.test(path)) return \"news\";\n\tif (FORUM_HOSTS.test(host) || FORUM_PATHS.test(path)) return \"forum\";\n\tif (BLOG_HOSTS.test(host) || BLOG_PATHS.test(path)) return \"blog\";\n\treturn \"unknown\";\n}\n\nexport function hashContent(text: string): string {\n\treturn `sha256:${createHash(\"sha256\").update(text, \"utf8\").digest(\"hex\")}`;\n}\n\ninterface Span { text: string; start: number; end: number }\n\nfunction tokenize(value: string): string[] {\n\treturn [...new Set(value.toLowerCase().split(/[^a-z0-9]+/).filter((term) => term.length > 3))];\n}\n\nfunction extractRelevantSpans(content: string, hint: string): Span[] {\n\tconst sentences: Span[] = [];\n\tconst sentencePattern = /[^.!?]+(?:[.!?]+(?=\\s|$)|$)/g;\n\tfor (const match of content.matchAll(sentencePattern)) {\n\t\tconst raw = match[0];\n\t\tconst text = raw.trim();\n\t\tif (text.length > 0 && text.length <= 400) {\n\t\t\tconst start = (match.index ?? 0) + raw.indexOf(text);\n\t\t\tsentences.push({ text, start, end: start + text.length });\n\t\t}\n\t}\n\tconst terms = tokenize(hint);\n\tif (terms.length === 0) return [];\n\treturn sentences\n\t\t.map((sentence, index) => ({ sentence, index, score: terms.filter((term) => sentence.text.toLowerCase().includes(term)).length }))\n\t\t.filter((item) => item.score > 0)\n\t\t.sort((a, b) => b.score - a.score || a.index - b.index)\n\t\t.slice(0, 3)\n\t\t.map(({ sentence }) => sentence);\n}\n\nfunction passageId(sourceRank: number, index: number): string {\n\treturn `p-${sourceRank}-${index}`;\n}\n\nexport function buildPassages(sources: ResearchSource[], fetched: ExtractedContent[] = [], hint = \"\"): ResearchPassage[] {\n\tconst passages: ResearchPassage[] = [];\n\tconst fetchedByUrl = new Map(fetched.map((item) => [item.url, item]));\n\tfor (const source of sources) {\n\t\tif (source.snippet) {\n\t\t\tpassages.push({\n\t\t\t\tpassage_id: passageId(source.rank, 0),\n\t\t\t\tsource_url: source.url,\n\t\t\t\tsource_rank: source.rank,\n\t\t\t\ttext: source.snippet,\n\t\t\t\tcontent_hash: hashContent(source.snippet),\n\t\t\t});\n\t\t}\n\t\tconst page = fetchedByUrl.get(source.url);\n\t\tif (page && !page.error && page.content) {\n\t\t\tconst passageHint = source.snippet?.trim() || hint;\n\t\t\tfor (const [index, span] of extractRelevantSpans(page.content, passageHint).entries()) {\n\t\t\t\tpassages.push({\n\t\t\t\t\tpassage_id: passageId(source.rank, index + 1),\n\t\t\t\t\tsource_url: source.url,\n\t\t\t\t\tsource_rank: source.rank,\n\t\t\t\t\ttext: span.text,\n\t\t\t\t\textraction_span: { start: span.start, end: span.end },\n\t\t\t\t\tcontent_hash: hashContent(span.text),\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t}\n\treturn passages;\n}\n\nconst CONTRADICTION_MARKERS = [\"not true\", \"false\", \"incorrect\", \"debunked\", \"retracted\", \"no longer\", \"never\", \"denied\", \"contrary\", \"misleading\"];\nconst SUPPORT_MARKERS = [\"yes\", \"true\", \"correct\", \"confirmed\", \"according to\", \"shows that\", \"demonstrates\", \"reported\", \"verified\", \"established\"];\n\nfunction containsPhrase(value: string, phrase: string): boolean {\n\tconst escaped = phrase.trim().toLowerCase().split(/\\s+/).map((term) => term.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")).join(\"\\\\s+\");\n\treturn new RegExp(`(?:^|[^a-z0-9])${escaped}(?=$|[^a-z0-9])`, \"i\").test(value);\n}\n\nfunction markerIsNegated(value: string, marker: string): boolean {\n\tconst escaped = marker.trim().toLowerCase().split(/\\s+/).map((term) => term.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")).join(\"\\\\s+\");\n\tconst markerPattern = new RegExp(`(?:^|[^a-z0-9])${escaped}(?=$|[^a-z0-9])`, \"i\");\n\tconst match = markerPattern.exec(value);\n\tif (!match || match.index === undefined) return false;\n\tconst matchedMarker = match[0].replace(/^[^a-z0-9]+/i, \"\");\n\tconst beforeMarker = value.slice(0, match.index + match[0].length - matchedMarker.length);\n\treturn /(?:^|[^a-z0-9])(?:not|no|never|without)\\s+$/i.test(beforeMarker);\n}\n\nfunction hasPolarityMarker(value: string, markers: string[], allowNegated = false): boolean {\n\treturn markers.some((marker) => containsPhrase(value, marker) && (allowNegated || !markerIsNegated(value, marker)));\n}\n\nexport function assessClaim(claim: string, passages: ResearchPassage[]): ClaimAssessment {\n\tconst terms = tokenize(claim);\n\tif (terms.length === 0 || passages.length === 0) {\n\t\treturn { claim, status: \"missing-evidence\", supporting_passages: [], contradicting_passages: [], rationale: \"No passages available that discuss the claim's terms.\", confidence: 0.2 };\n\t}\n\tconst supporting: string[] = [];\n\tconst contradicting: string[] = [];\n\tfor (const passage of passages) {\n\t\tconst lower = passage.text.toLowerCase();\n\t\tconst overlap = terms.filter((term) => containsPhrase(lower, term)).length;\n\t\tif (overlap < Math.max(2, Math.ceil(terms.length / 4))) continue;\n\t\tconst contra = hasPolarityMarker(lower, CONTRADICTION_MARKERS);\n\t\tconst support = hasPolarityMarker(lower, SUPPORT_MARKERS);\n\t\tif (contra && !support) contradicting.push(passage.passage_id);\n\t\telse if (support && !contra) supporting.push(passage.passage_id);\n\t}\n\tif (contradicting.length > 0 && supporting.length === 0) {\n\t\treturn { claim, status: \"contradicted\", supporting_passages: [], contradicting_passages: contradicting, rationale: `${contradicting.length} passage(s) contradict the claim; none support it.`, confidence: Math.min(0.85, 0.5 + contradicting.length * 0.1) };\n\t}\n\tif (supporting.length > 0 && contradicting.length === 0) {\n\t\treturn { claim, status: \"supported\", supporting_passages: supporting, contradicting_passages: [], rationale: `${supporting.length} passage(s) support the claim; none contradict it.`, confidence: Math.min(0.85, 0.5 + supporting.length * 0.1) };\n\t}\n\tif (supporting.length > 0 || contradicting.length > 0) {\n\t\treturn { claim, status: \"unclear\", supporting_passages: supporting, contradicting_passages: contradicting, rationale: `${supporting.length} supporting and ${contradicting.length} contradicting passage(s); evidence is mixed.`, confidence: 0.4 };\n\t}\n\treturn { claim, status: \"unclear\", supporting_passages: [], contradicting_passages: [], rationale: \"Passages mention the claim's terms but contain no clear support or contradiction markers.\", confidence: 0.3 };\n}\n\ninterface RankedSearchResult extends SearchResult {\n\trank?: number;\n}\n\nexport interface BuildArtifactInput {\n\tquery: string;\n\tprovider?: string;\n\tsummary?: string;\n\tresults: RankedSearchResult[];\n\tfetched?: ExtractedContent[];\n\trecency?: RecencyFilter;\n\tdomainFilter?: string[];\n}\n\nexport function buildResearchArtifact(input: BuildArtifactInput): ResearchArtifact {\n\tconst filters = input.domainFilter ?? [];\n\tconst fetchedByUrl = new Map((input.fetched ?? []).map((page) => [page.url, page]));\n\tconst sources: ResearchSource[] = [];\n\tconst seen = new Set<string>();\n\tfor (const [index, result] of input.results.entries()) {\n\t\tif (seen.has(result.url)) continue;\n\t\tseen.add(result.url);\n\t\tconst page = fetchedByUrl.get(result.url);\n\t\tconst fetched = Boolean(page && !page.error);\n\t\tsources.push({\n\t\t\trank: result.rank ?? index + 1,\n\t\t\turl: result.url,\n\t\t\ttitle: result.title,\n\t\t\tsnippet: result.snippet,\n\t\t\tquality: classifySource(result.url),\n\t\t\tfetched,\n\t\t\t...(page ? { fetch_timestamp: Date.now() } : {}),\n\t\t\t...(page && !page.error ? { content_hash: hashContent(page.content) } : {}),\n\t\t\t...(page?.error ? { fetch_error: page.error } : {}),\n\t\t});\n\t}\n\tconst passages = buildPassages(sources, input.fetched, input.query);\n\tconst domainInclude = filters.filter((domain) => !domain.startsWith(\"-\"));\n\tconst domainExclude = filters.filter((domain) => domain.startsWith(\"-\")).map((domain) => domain.slice(1));\n\treturn {\n\t\tid: generateId(),\n\t\ttype: \"research\",\n\t\ttimestamp: Date.now(),\n\t\tquery: input.query,\n\t\tsources,\n\t\tpassages,\n\t\t...(input.provider !== undefined ? { provider: input.provider } : {}),\n\t\t...(input.summary !== undefined ? { summary: input.summary } : {}),\n\t\t...(passages.length > 0 ? { content_hash: hashContent(passages.map((passage) => passage.text).join(\"\\n\")) } : {}),\n\t\tfilters: {\n\t\t\t...(input.recency !== undefined ? { recency: input.recency } : {}),\n\t\t\tdomain_include: domainInclude,\n\t\t\tdomain_exclude: domainExclude,\n\t\t},\n\t};\n}\n\nexport function withClaimAssessment(artifact: ResearchArtifact, claims: string[]): ResearchArtifact {\n\treturn { ...artifact, claims: claims.map((claim) => assessClaim(claim, artifact.passages)) };\n}\n\nexport function storeResearchArtifact(artifact: ResearchArtifact): void {\n\tif (!artifact.id) throw new Error(\"Research artifact id must not be empty\");\n\tstoreResult(artifact.id, { id: artifact.id, type: \"research\", timestamp: artifact.timestamp, artifact });\n}\n\nexport function getResearchArtifact(id: string): ResearchArtifact | null {\n\tconst data = getResult(id);\n\tif (!data || data.type !== \"research\" || !data.artifact || typeof data.artifact !== \"object\") return null;\n\treturn data.artifact as ResearchArtifact;\n}\n"]}

package/dist/humain/web-access/vendor/ssrf-protection.d.ts

@@ -0,0 +1,50 @@
+export type LookupAddress = {
+    address: string;
+    family: number;
+};
+export type Lookup = (hostname: string) => Promise<LookupAddress[]>;
+type Fetch = typeof fetch;
+export interface SsrfConfig {
+    allowRanges: string[];
+    trustEnvProxy: boolean;
+}
+export interface DomainPolicy {
+    allow: string[];
+    deny: string[];
+}
+export declare function loadFetchContentDomainPolicy(): DomainPolicy;
+export declare function loadSsrfConfig(): SsrfConfig;
+interface ValidationOptions {
+    lookup?: Lookup;
+    /** Optional hostname policy for fetch_content target URLs. */
+    domainPolicy?: DomainPolicy;
+    /**
+     * CIDR ranges (e.g. "198.18.0.0/15") to exempt from the SSRF guard.
+     * Useful when a host runs a TUN/fake-IP proxy (Surge, Clash, Mihomo, ...)
+     * that resolves public domains into a reserved range. Entries are validated
+     * strictly; an invalid entry throws so misconfiguration is not silent.
+     */
+    allowRanges?: string[];
+    /**
+     * When true, trust an explicitly-configured HTTP(S) proxy for hostname
+     * resolution instead of performing local DNS lookups inside the sandbox.
+     * Literal IPs and localhost remain blocked, and NO_PROXY hosts still use
+     * the local SSRF preflight. This does not configure proxy transport.
+     */
+    trustEnvProxy?: boolean;
+}
+interface RedirectRequestInitArgs {
+    from: URL;
+    to: URL;
+    init: RequestInit;
+    response: Response;
+}
+interface FetchRemoteOptions extends ValidationOptions {
+    fetch?: Fetch;
+    maxRedirects?: number;
+    onRedirect?: (args: RedirectRequestInitArgs) => RequestInit;
+}
+export declare function validateRemoteUrl(rawUrl: string | URL, options?: ValidationOptions): Promise<URL>;
+export declare function fetchRemoteUrl(url: string | URL, init?: RequestInit, options?: FetchRemoteOptions): Promise<Response>;
+export {};
+//# sourceMappingURL=ssrf-protection.d.ts.map

package/dist/humain/web-access/vendor/ssrf-protection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-protection.d.ts","sourceRoot":"","sources":["../../../../src/humain/web-access/vendor/ssrf-protection.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAChE,MAAM,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;AACpE,KAAK,KAAK,GAAG,OAAO,KAAK,CAAC;AA2C1B,MAAM,WAAW,UAAU;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CACf;AAID,wBAAgB,4BAA4B,IAAI,YAAY,CAkB3D;AA2BD,wBAAgB,cAAc,IAAI,UAAU,CAwB3C;AAED,UAAU,iBAAiB;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACxB;AAQD,UAAU,uBAAuB;IAChC,IAAI,EAAE,GAAG,CAAC;IACV,EAAE,EAAE,GAAG,CAAC;IACR,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;CACnB;AAED,UAAU,kBAAmB,SAAQ,iBAAiB;IACrD,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,WAAW,CAAC;CAC5D;AAMD,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,GAAG,CAAC,CAmC3G;AAED,wBAAsB,cAAc,CACnC,GAAG,EAAE,MAAM,GAAG,GAAG,EACjB,IAAI,GAAE,WAAgB,EACtB,OAAO,GAAE,kBAAuB,GAC9B,OAAO,CAAC,QAAQ,CAAC,CAwBnB","sourcesContent":["import { lookup as dnsLookup } from \"node:dns/promises\";\nimport { existsSync, readFileSync, statSync } from \"node:fs\";\nimport net from \"node:net\";\nimport { getWebSearchConfigPath } from \"./utils.ts\";\n\nconst DEFAULT_MAX_REDIRECTS = 5;\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\n\nexport type LookupAddress = { address: string; family: number };\nexport type Lookup = (hostname: string) => Promise<LookupAddress[]>;\ntype Fetch = typeof fetch;\n\nconst WEB_SEARCH_CONFIG_PATH = getWebSearchConfigPath();\n\nlet cachedConfigRoot: { signature: string; value: Record<string, unknown> | null } | null = null;\n\nfunction loadConfigRoot(): Record<string, unknown> | null {\n\tif (!existsSync(WEB_SEARCH_CONFIG_PATH)) return null;\n\n\tlet signature: string;\n\ttry {\n\t\tconst stat = statSync(WEB_SEARCH_CONFIG_PATH);\n\t\tsignature = `${stat.mtimeMs}:${stat.size}`;\n\t} catch {\n\t\treturn null;\n\t}\n\n\tif (cachedConfigRoot?.signature === signature) return cachedConfigRoot.value;\n\n\tlet raw: string;\n\ttry {\n\t\traw = readFileSync(WEB_SEARCH_CONFIG_PATH, \"utf-8\");\n\t} catch {\n\t\t// Do not memoize read failures: a chmod fix changes neither mtime nor size,\n\t\t// so a cached failure would permanently fail-open the domain policy.\n\t\treturn null;\n\t}\n\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(raw);\n\t} catch (err) {\n\t\tconst message = err instanceof Error ? err.message : String(err);\n\t\tthrow new Error(`Failed to parse ${WEB_SEARCH_CONFIG_PATH}: ${message}`);\n\t}\n\n\tconst value = parsed && typeof parsed === \"object\" && !Array.isArray(parsed)\n\t\t? parsed as Record<string, unknown>\n\t\t: null;\n\tcachedConfigRoot = { signature, value };\n\treturn value;\n}\n\nexport interface SsrfConfig {\n\tallowRanges: string[];\n\ttrustEnvProxy: boolean;\n}\n\nexport interface DomainPolicy {\n\tallow: string[];\n\tdeny: string[];\n}\n\nconst DEFAULT_DOMAIN_POLICY: DomainPolicy = { allow: [], deny: [] };\n\nexport function loadFetchContentDomainPolicy(): DomainPolicy {\n\tconst parsed = loadConfigRoot();\n\tif (!parsed) return { ...DEFAULT_DOMAIN_POLICY };\n\tconst fetchContent = parsed.fetchContent;\n\tif (fetchContent === undefined || fetchContent === null) return { ...DEFAULT_DOMAIN_POLICY };\n\tif (typeof fetchContent !== \"object\" || Array.isArray(fetchContent)) {\n\t\tthrow new Error(`fetchContent in ${WEB_SEARCH_CONFIG_PATH} must be an object`);\n\t}\n\tconst policy = (fetchContent as { domainPolicy?: unknown }).domainPolicy;\n\tif (policy === undefined || policy === null) return { ...DEFAULT_DOMAIN_POLICY };\n\tif (typeof policy !== \"object\" || Array.isArray(policy)) {\n\t\tthrow new Error(`fetchContent.domainPolicy in ${WEB_SEARCH_CONFIG_PATH} must be an object`);\n\t}\n\tconst config = policy as { allow?: unknown; deny?: unknown };\n\treturn {\n\t\tallow: parseDomainEntries(config.allow, \"allow\"),\n\t\tdeny: parseDomainEntries(config.deny, \"deny\"),\n\t};\n}\n\nfunction parseDomainEntries(value: unknown, field: \"allow\" | \"deny\"): string[] {\n\tif (value === undefined || value === null) return [];\n\tif (!Array.isArray(value)) {\n\t\tthrow new Error(`fetchContent.domainPolicy.${field} in ${WEB_SEARCH_CONFIG_PATH} must be an array of hostnames`);\n\t}\n\treturn value.map((entry, index) => {\n\t\tif (typeof entry !== \"string\") {\n\t\t\tthrow new Error(`fetchContent.domainPolicy.${field} in ${WEB_SEARCH_CONFIG_PATH} must contain only hostnames; entry ${index + 1} is ${typeof entry}`);\n\t\t}\n\t\tconst hostname = normalizeDomainEntry(entry);\n\t\tif (!hostname) {\n\t\t\tthrow new Error(`fetchContent.domainPolicy.${field} in ${WEB_SEARCH_CONFIG_PATH} contains an invalid hostname: ${JSON.stringify(entry)}`);\n\t\t}\n\t\treturn hostname;\n\t});\n}\n\nfunction normalizeDomainEntry(entry: string): string | null {\n\tconst hostname = normalizeHostname(entry.trim());\n\tif (!hostname || /\\s|[\\\\/?:#@]/.test(hostname)) return null;\n\tif (net.isIP(hostname)) return hostname;\n\tif (hostname.length > 253 || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(hostname)) return null;\n\treturn hostname;\n}\n\nexport function loadSsrfConfig(): SsrfConfig {\n\tconst parsed = loadConfigRoot();\n\tif (!parsed) return { allowRanges: [], trustEnvProxy: false };\n\tconst ssrf = parsed.ssrf;\n\tif (ssrf === undefined || ssrf === null) return { allowRanges: [], trustEnvProxy: false };\n\tif (typeof ssrf !== \"object\" || Array.isArray(ssrf)) {\n\t\tthrow new Error(`ssrf in ${WEB_SEARCH_CONFIG_PATH} must be an object`);\n\t}\n\tconst config = ssrf as { allowRanges?: unknown; trustEnvProxy?: unknown };\n\tif (config.allowRanges !== undefined && config.allowRanges !== null && !Array.isArray(config.allowRanges)) {\n\t\tthrow new Error(`ssrf.allowRanges in ${WEB_SEARCH_CONFIG_PATH} must be an array of CIDR strings`);\n\t}\n\tif (config.trustEnvProxy !== undefined && typeof config.trustEnvProxy !== \"boolean\") {\n\t\tthrow new Error(`ssrf.trustEnvProxy in ${WEB_SEARCH_CONFIG_PATH} must be a boolean`);\n\t}\n\tconst allowRangesValue: unknown[] = Array.isArray(config.allowRanges) ? config.allowRanges : [];\n\tconst allowRanges = allowRangesValue.map((entry, index) => {\n\t\tif (typeof entry !== \"string\") {\n\t\t\tthrow new Error(`ssrf.allowRanges in ${WEB_SEARCH_CONFIG_PATH} must contain only CIDR strings; entry ${index + 1} is ${typeof entry}`);\n\t\t}\n\t\treturn entry.trim();\n\t}).filter(Boolean);\n\tparseAllowRanges(allowRanges);\n\treturn { allowRanges, trustEnvProxy: config.trustEnvProxy === true };\n}\n\ninterface ValidationOptions {\n\tlookup?: Lookup;\n\t/** Optional hostname policy for fetch_content target URLs. */\n\tdomainPolicy?: DomainPolicy;\n\t/**\n\t * CIDR ranges (e.g. \"198.18.0.0/15\") to exempt from the SSRF guard.\n\t * Useful when a host runs a TUN/fake-IP proxy (Surge, Clash, Mihomo, ...)\n\t * that resolves public domains into a reserved range. Entries are validated\n\t * strictly; an invalid entry throws so misconfiguration is not silent.\n\t */\n\tallowRanges?: string[];\n\t/**\n\t * When true, trust an explicitly-configured HTTP(S) proxy for hostname\n\t * resolution instead of performing local DNS lookups inside the sandbox.\n\t * Literal IPs and localhost remain blocked, and NO_PROXY hosts still use\n\t * the local SSRF preflight. This does not configure proxy transport.\n\t */\n\ttrustEnvProxy?: boolean;\n}\n\n/** Parsed entry from `allowRanges`: a network address (4 or 16 bytes) + prefix length. */\ninterface ParsedCidr {\n\tbytes: Uint8Array;\n\tprefix: number;\n}\n\ninterface RedirectRequestInitArgs {\n\tfrom: URL;\n\tto: URL;\n\tinit: RequestInit;\n\tresponse: Response;\n}\n\ninterface FetchRemoteOptions extends ValidationOptions {\n\tfetch?: Fetch;\n\tmaxRedirects?: number;\n\tonRedirect?: (args: RedirectRequestInitArgs) => RequestInit;\n}\n\nasync function defaultLookup(hostname: string): Promise<LookupAddress[]> {\n\treturn dnsLookup(hostname, { all: true, verbatim: true });\n}\n\nexport async function validateRemoteUrl(rawUrl: string | URL, options: ValidationOptions = {}): Promise<URL> {\n\tconst url = rawUrl instanceof URL ? rawUrl : new URL(rawUrl);\n\tif (url.protocol !== \"http:\" && url.protocol !== \"https:\") {\n\t\tthrow new Error(\"Only HTTP and HTTPS URLs can be fetched remotely\");\n\t}\n\n\tconst hostname = normalizeHostname(url.hostname);\n\tif (!hostname) throw new Error(\"URL must include a hostname\");\n\tif (hostname === \"localhost\" || hostname.endsWith(\".localhost\")) {\n\t\tthrow new Error(`Blocked internal hostname: ${hostname}`);\n\t}\n\n\tconst allowRanges = parseAllowRanges(options.allowRanges);\n\tassertDomainPolicy(hostname, options.domainPolicy);\n\n\tif (net.isIP(hostname)) {\n\t\tassertPublicAddress(hostname, hostname, allowRanges);\n\t\treturn url;\n\t}\n\n\tif (shouldTrustEnvProxy(url, options.trustEnvProxy === true)) return url;\n\n\tlet addresses: LookupAddress[];\n\ttry {\n\t\taddresses = await (options.lookup ?? defaultLookup)(hostname);\n\t} catch (err) {\n\t\tconst message = err instanceof Error ? err.message : String(err);\n\t\tthrow new Error(`Failed to resolve ${hostname}: ${message}`);\n\t}\n\n\tif (addresses.length === 0) throw new Error(`Failed to resolve ${hostname}: no addresses returned`);\n\tfor (const { address } of addresses) {\n\t\tassertPublicAddress(address, hostname, allowRanges);\n\t}\n\treturn url;\n}\n\nexport async function fetchRemoteUrl(\n\turl: string | URL,\n\tinit: RequestInit = {},\n\toptions: FetchRemoteOptions = {},\n): Promise<Response> {\n\tconst fetchImpl = options.fetch ?? fetch;\n\tconst maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS;\n\tlet current = await validateRemoteUrl(url, options);\n\tlet requestInit = init;\n\n\tfor (let redirects = 0; redirects <= maxRedirects; redirects++) {\n\t\tconst response = await fetchImpl(current, { ...requestInit, redirect: \"manual\" });\n\t\tif (!REDIRECT_STATUSES.has(response.status)) return response;\n\n\t\tconst location = response.headers.get(\"location\");\n\t\tif (!location) return response;\n\t\tif (redirects === maxRedirects) throw new Error(`Too many redirects fetching ${current.toString()}`);\n\n\t\tconst from = current;\n\t\tcurrent = await validateRemoteUrl(new URL(location, current), options);\n\t\tif (response.status === 303 || ((response.status === 301 || response.status === 302) && requestInit.method?.toUpperCase() === \"POST\")) {\n\t\t\tconst { body: _body, ...nextInit } = requestInit;\n\t\t\trequestInit = { ...nextInit, method: \"GET\" };\n\t\t}\n\t\tif (options.onRedirect) requestInit = options.onRedirect({ from, to: current, init: requestInit, response });\n\t}\n\n\tthrow new Error(`Too many redirects fetching ${current.toString()}`);\n}\n\nfunction normalizeHostname(hostname: string): string {\n\treturn hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\").replace(/\\.$/, \"\");\n}\n\nfunction assertDomainPolicy(hostname: string, policy?: DomainPolicy): void {\n\tif (!policy) return;\n\tif (policy.deny.some((entry) => domainMatches(hostname, entry))) {\n\t\tthrow new Error(`Blocked hostname by fetch_content domain policy: ${hostname}`);\n\t}\n\tif (policy.allow.length > 0 && !policy.allow.some((entry) => domainMatches(hostname, entry))) {\n\t\tthrow new Error(`Hostname not allowed by fetch_content domain policy: ${hostname}`);\n\t}\n}\n\nfunction domainMatches(hostname: string, entry: string): boolean {\n\treturn hostname === entry || hostname.endsWith(`.${entry}`);\n}\n\nfunction getProxyForProtocol(protocol: string): string {\n\tconst candidates = protocol === \"http:\"\n\t\t? [process.env.HTTP_PROXY, process.env.http_proxy, process.env.ALL_PROXY, process.env.all_proxy]\n\t\t: protocol === \"https:\"\n\t\t\t? [process.env.HTTPS_PROXY, process.env.https_proxy, process.env.HTTP_PROXY, process.env.http_proxy, process.env.ALL_PROXY, process.env.all_proxy]\n\t\t\t: [];\n\tfor (const candidate of candidates) {\n\t\tconst value = candidate?.trim();\n\t\tif (!value) continue;\n\t\ttry {\n\t\t\tconst proxyUrl = new URL(value);\n\t\t\tif ((proxyUrl.protocol === \"http:\" || proxyUrl.protocol === \"https:\") && proxyUrl.hostname) return value;\n\t\t} catch {\n\t\t\t// Invalid proxy env vars should not weaken local DNS SSRF checks.\n\t\t}\n\t}\n\treturn \"\";\n}\n\nfunction hostnameMatchesNoProxy(hostname: string, port: string, entry: string): boolean {\n\tconst trimmed = entry.trim();\n\tif (!trimmed) return false;\n\tif (trimmed === \"*\") return true;\n\n\t// NO_PROXY entries may include a port. Strip it only after handling\n\t// bracketed IPv6 literals, which can contain several colons.\n\tlet hostEntry = trimmed;\n\tlet entryPort: string | undefined;\n\tif (hostEntry.startsWith(\"[\")) {\n\t\tconst closingBracket = hostEntry.indexOf(\"]\");\n\t\tif (closingBracket >= 0) {\n\t\t\tconst suffix = hostEntry.slice(closingBracket + 1);\n\t\t\tif (/^:\\\\d+$/.test(suffix)) entryPort = suffix.slice(1);\n\t\t\thostEntry = hostEntry.slice(0, closingBracket + 1);\n\t\t}\n\t} else {\n\t\tconst colon = hostEntry.lastIndexOf(\":\");\n\t\tif (colon > -1 && /^\\d+$/.test(hostEntry.slice(colon + 1))) {\n\t\t\tentryPort = hostEntry.slice(colon + 1);\n\t\t\thostEntry = hostEntry.slice(0, colon);\n\t\t}\n\t}\n\tif (entryPort !== undefined && entryPort !== port) return false;\n\n\tconst normalizedEntry = normalizeHostname(hostEntry);\n\tif (!normalizedEntry) return false;\n\tif (normalizedEntry === hostname) return true;\n\tconst suffix = normalizedEntry.startsWith(\"*.\")\n\t\t? normalizedEntry.slice(1)\n\t\t: normalizedEntry.startsWith(\".\")\n\t\t\t? normalizedEntry\n\t\t\t: `.${normalizedEntry}`;\n\treturn hostname.endsWith(suffix);\n}\n\nfunction shouldTrustEnvProxy(url: URL, enabled: boolean): boolean {\n\tif (!enabled || !getProxyForProtocol(url.protocol)) return false;\n\tconst hostname = normalizeHostname(url.hostname);\n\tconst port = url.port || (url.protocol === \"https:\" ? \"443\" : \"80\");\n\tconst noProxy = process.env.NO_PROXY || process.env.no_proxy || \"\";\n\treturn !noProxy.split(\",\").some(entry => hostnameMatchesNoProxy(hostname, port, entry));\n}\n\nfunction assertPublicAddress(address: string, hostname: string, allowRanges: ParsedCidr[] = []): void {\n\tconst normalized = normalizeHostname(address);\n\tconst ipVersion = net.isIP(normalized);\n\tif (ipVersion === 0) throw new Error(`Resolved non-IP address for ${hostname}: ${address}`);\n\t// Explicitly-allowed ranges bypass the private/reserved checks below. This lets\n\t// users exempt synthetic ranges produced by TUN/fake-IP proxies (e.g. 198.18/15).\n\tif (isInAllowedRange(normalized, ipVersion, allowRanges)) return;\n\tif (ipVersion === 4 && isBlockedIPv4(normalized)) {\n\t\tconst hint = isFakeIpProxyAddress(normalized)\n\t\t\t? '. This address is in 198.18.0.0/15, commonly used by TUN/fake-IP proxies. If that matches your setup, configure ssrf.allowRanges with [\"198.18.0.0/15\"] in web-search.json.'\n\t\t\t: \"\";\n\t\tthrow new Error(`Blocked internal address for ${hostname}: ${normalized}${hint}`);\n\t}\n\tif (ipVersion === 6 && isBlockedIPv6(normalized)) {\n\t\tthrow new Error(`Blocked internal address for ${hostname}: ${normalized}`);\n\t}\n}\n\nfunction isFakeIpProxyAddress(address: string): boolean {\n\tconst [a, b] = address.split(\".\").map(part => Number(part));\n\treturn a === 198 && (b === 18 || b === 19);\n}\n\nfunction isBlockedIPv4(address: string): boolean {\n\tconst parts = address.split(\".\").map(part => Number(part));\n\tif (parts.length !== 4 || parts.some(part => !Number.isInteger(part) || part < 0 || part > 255)) return true;\n\tconst [a, b] = parts;\n\treturn a === 0 ||\n\t\ta === 10 ||\n\t\ta === 127 ||\n\t\t(a === 100 && b >= 64 && b <= 127) ||\n\t\t(a === 169 && b === 254) ||\n\t\t(a === 172 && b >= 16 && b <= 31) ||\n\t\t(a === 192 && b === 168) ||\n\t\tisFakeIpProxyAddress(address) ||\n\t\ta >= 224;\n}\n\nfunction isBlockedIPv6(address: string): boolean {\n\tconst groups = parseIPv6(address);\n\tif (!groups) return true;\n\n\tconst first = groups[0];\n\tif (groups.every(group => group === 0)) return true;\n\tif (groups.slice(0, 7).every(group => group === 0) && groups[7] === 1) return true;\n\tif ((first & 0xfe00) === 0xfc00) return true;\n\tif ((first & 0xffc0) === 0xfe80) return true;\n\n\tconst isMappedIPv4 = groups.slice(0, 5).every(group => group === 0) && groups[5] === 0xffff;\n\tif (isMappedIPv4) {\n\t\tconst ipv4 = [groups[6] >> 8, groups[6] & 0xff, groups[7] >> 8, groups[7] & 0xff].join(\".\");\n\t\treturn isBlockedIPv4(ipv4);\n\t}\n\n\treturn false;\n}\n\nfunction parseIPv6(address: string): number[] | null {\n\tif (address.includes(\".\")) {\n\t\tconst lastColon = address.lastIndexOf(\":\");\n\t\tconst ipv4 = address.slice(lastColon + 1);\n\t\tif (net.isIP(ipv4) !== 4) return null;\n\t\tconst octets = ipv4.split(\".\").map(part => Number(part));\n\t\taddress = `${address.slice(0, lastColon)}:${((octets[0] << 8) | octets[1]).toString(16)}:${((octets[2] << 8) | octets[3]).toString(16)}`;\n\t}\n\n\tconst pieces = address.split(\"::\");\n\tif (pieces.length > 2) return null;\n\n\tconst left = pieces[0] ? pieces[0].split(\":\") : [];\n\tconst right = pieces.length === 2 && pieces[1] ? pieces[1].split(\":\") : [];\n\tconst missing = 8 - left.length - right.length;\n\tif (pieces.length === 1 && missing !== 0) return null;\n\tif (pieces.length === 2 && missing < 0) return null;\n\n\tconst groups = [...left, ...Array(missing).fill(\"0\"), ...right].map(part => {\n\t\tif (!/^[0-9a-f]{1,4}$/i.test(part)) return -1;\n\t\treturn parseInt(part, 16);\n\t});\n\treturn groups.length === 8 && groups.every(group => group >= 0 && group <= 0xffff) ? groups : null;\n}\n\n/** Parse `allowRanges` config value into validated CIDR rules. Throws on malformed entries. */\nfunction parseAllowRanges(input: unknown): ParsedCidr[] {\n\tif (input === undefined || input === null) return [];\n\tif (!Array.isArray(input)) {\n\t\tthrow new Error(\"ssrf.allowRanges must be an array of CIDR strings\");\n\t}\n\tconst rules: ParsedCidr[] = [];\n\tfor (const entry of input) {\n\t\tif (typeof entry !== \"string\") {\n\t\t\tthrow new Error(`ssrf.allowRanges entries must be strings, got ${typeof entry}`);\n\t\t}\n\t\tconst rule = parseCidr(entry.trim());\n\t\tif (!rule) {\n\t\t\tthrow new Error(`Invalid CIDR notation in ssrf.allowRanges: \"${entry}\"`);\n\t\t}\n\t\trules.push(rule);\n\t}\n\treturn rules;\n}\n\n/** Parse a single CIDR (e.g. \"198.18.0.0/15\", \"fd00::/8\") or bare host (\"1.2.3.4\"). Returns null if invalid. */\nfunction parseCidr(raw: string): ParsedCidr | null {\n\tif (!raw) return null;\n\tconst slash = raw.lastIndexOf(\"/\");\n\tconst addrPart = slash >= 0 ? raw.slice(0, slash) : raw;\n\tconst prefixPart = slash >= 0 ? raw.slice(slash + 1) : null;\n\t// A slash must be followed by digits. Number(\"\")/Number(\" \") are 0, which\n\t// would silently turn \"198.18.0.0/\" into /0 and exempt every address.\n\tif (prefixPart !== null && !/^\\d+$/.test(prefixPart)) return null;\n\tconst version = net.isIP(addrPart);\n\n\tif (version === 4) {\n\t\tconst bytes = ipv4ToBytes(addrPart);\n\t\tif (!bytes) return null;\n\t\tconst prefix = prefixPart === null ? 32 : Number(prefixPart);\n\t\tif (!Number.isInteger(prefix) || prefix < 1 || prefix > 32) return null;\n\t\treturn { bytes, prefix };\n\t}\n\tif (version === 6) {\n\t\tconst groups = parseIPv6(addrPart);\n\t\tif (!groups) return null;\n\t\tconst prefix = prefixPart === null ? 128 : Number(prefixPart);\n\t\tif (!Number.isInteger(prefix) || prefix < 1 || prefix > 128) return null;\n\t\treturn { bytes: ipv6GroupsToBytes(groups), prefix };\n\t}\n\treturn null;\n}\n\nfunction ipv4ToBytes(address: string): Uint8Array | null {\n\tconst parts = address.split(\".\");\n\tif (parts.length !== 4) return null;\n\tconst bytes = new Uint8Array(4);\n\tfor (let i = 0; i < 4; i++) {\n\t\tconst octet = Number(parts[i]);\n\t\tif (!Number.isInteger(octet) || octet < 0 || octet > 255) return null;\n\t\tbytes[i] = octet;\n\t}\n\treturn bytes;\n}\n\nfunction ipv6GroupsToBytes(groups: number[]): Uint8Array {\n\tconst bytes = new Uint8Array(16);\n\tfor (let i = 0; i < 8; i++) {\n\t\tbytes[i * 2] = groups[i] >> 8;\n\t\tbytes[i * 2 + 1] = groups[i] & 0xff;\n\t}\n\treturn bytes;\n}\n\nfunction ipToBytes(address: string, version: number): Uint8Array | null {\n\tif (version === 4) return ipv4ToBytes(address);\n\tif (version === 6) {\n\t\tconst groups = parseIPv6(address);\n\t\treturn groups ? ipv6GroupsToBytes(groups) : null;\n\t}\n\treturn null;\n}\n\n/** True if `address` (already validated as `ipVersion`) falls within any allowed CIDR. */\nfunction isInAllowedRange(address: string, ipVersion: number, allowRanges: ParsedCidr[]): boolean {\n\tif (allowRanges.length === 0) return false;\n\tconst addrBytes = ipToBytes(address, ipVersion);\n\tif (!addrBytes) return false;\n\tfor (const rule of allowRanges) {\n\t\t// Only compare same-family rules (4-byte IPv4 vs 16-byte IPv6).\n\t\tif (rule.bytes.length !== addrBytes.length) continue;\n\t\tif (bytesMatchPrefix(addrBytes, rule.bytes, rule.prefix)) return true;\n\t}\n\treturn false;\n}\n\n/** Compare the leading `prefix` bits of two equal-length byte arrays. */\nfunction bytesMatchPrefix(addr: Uint8Array, network: Uint8Array, prefix: number): boolean {\n\tconst fullBytes = prefix >> 3;\n\tconst remBits = prefix & 7;\n\tfor (let i = 0; i < fullBytes; i++) {\n\t\tif (addr[i] !== network[i]) return false;\n\t}\n\tif (remBits > 0 && fullBytes < addr.length) {\n\t\tconst mask = (0xff << (8 - remBits)) & 0xff;\n\t\tif ((addr[fullBytes] & mask) !== (network[fullBytes] & mask)) return false;\n\t}\n\treturn true;\n}\n"]}

package/dist/humain/web-access/vendor/ssrf-protection.js

@@ -0,0 +1,466 @@
+import { lookup as dnsLookup } from "node:dns/promises";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import net from "node:net";
+import { getWebSearchConfigPath } from "./utils.js";
+const DEFAULT_MAX_REDIRECTS = 5;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+const WEB_SEARCH_CONFIG_PATH = getWebSearchConfigPath();
+let cachedConfigRoot = null;
+function loadConfigRoot() {
+    if (!existsSync(WEB_SEARCH_CONFIG_PATH))
+        return null;
+    let signature;
+    try {
+        const stat = statSync(WEB_SEARCH_CONFIG_PATH);
+        signature = `${stat.mtimeMs}:${stat.size}`;
+    }
+    catch {
+        return null;
+    }
+    if (cachedConfigRoot?.signature === signature)
+        return cachedConfigRoot.value;
+    let raw;
+    try {
+        raw = readFileSync(WEB_SEARCH_CONFIG_PATH, "utf-8");
+    }
+    catch {
+        // Do not memoize read failures: a chmod fix changes neither mtime nor size,
+        // so a cached failure would permanently fail-open the domain policy.
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Failed to parse ${WEB_SEARCH_CONFIG_PATH}: ${message}`);
+    }
+    const value = parsed && typeof parsed === "object" && !Array.isArray(parsed)
+        ? parsed
+        : null;
+    cachedConfigRoot = { signature, value };
+    return value;
+}
+const DEFAULT_DOMAIN_POLICY = { allow: [], deny: [] };
+export function loadFetchContentDomainPolicy() {
+    const parsed = loadConfigRoot();
+    if (!parsed)
+        return { ...DEFAULT_DOMAIN_POLICY };
+    const fetchContent = parsed.fetchContent;
+    if (fetchContent === undefined || fetchContent === null)
+        return { ...DEFAULT_DOMAIN_POLICY };
+    if (typeof fetchContent !== "object" || Array.isArray(fetchContent)) {
+        throw new Error(`fetchContent in ${WEB_SEARCH_CONFIG_PATH} must be an object`);
+    }
+    const policy = fetchContent.domainPolicy;
+    if (policy === undefined || policy === null)
+        return { ...DEFAULT_DOMAIN_POLICY };
+    if (typeof policy !== "object" || Array.isArray(policy)) {
+        throw new Error(`fetchContent.domainPolicy in ${WEB_SEARCH_CONFIG_PATH} must be an object`);
+    }
+    const config = policy;
+    return {
+        allow: parseDomainEntries(config.allow, "allow"),
+        deny: parseDomainEntries(config.deny, "deny"),
+    };
+}
+function parseDomainEntries(value, field) {
+    if (value === undefined || value === null)
+        return [];
+    if (!Array.isArray(value)) {
+        throw new Error(`fetchContent.domainPolicy.${field} in ${WEB_SEARCH_CONFIG_PATH} must be an array of hostnames`);
+    }
+    return value.map((entry, index) => {
+        if (typeof entry !== "string") {
+            throw new Error(`fetchContent.domainPolicy.${field} in ${WEB_SEARCH_CONFIG_PATH} must contain only hostnames; entry ${index + 1} is ${typeof entry}`);
+        }
+        const hostname = normalizeDomainEntry(entry);
+        if (!hostname) {
+            throw new Error(`fetchContent.domainPolicy.${field} in ${WEB_SEARCH_CONFIG_PATH} contains an invalid hostname: ${JSON.stringify(entry)}`);
+        }
+        return hostname;
+    });
+}
+function normalizeDomainEntry(entry) {
+    const hostname = normalizeHostname(entry.trim());
+    if (!hostname || /\s|[\\/?:#@]/.test(hostname))
+        return null;
+    if (net.isIP(hostname))
+        return hostname;
+    if (hostname.length > 253 || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(hostname))
+        return null;
+    return hostname;
+}
+export function loadSsrfConfig() {
+    const parsed = loadConfigRoot();
+    if (!parsed)
+        return { allowRanges: [], trustEnvProxy: false };
+    const ssrf = parsed.ssrf;
+    if (ssrf === undefined || ssrf === null)
+        return { allowRanges: [], trustEnvProxy: false };
+    if (typeof ssrf !== "object" || Array.isArray(ssrf)) {
+        throw new Error(`ssrf in ${WEB_SEARCH_CONFIG_PATH} must be an object`);
+    }
+    const config = ssrf;
+    if (config.allowRanges !== undefined && config.allowRanges !== null && !Array.isArray(config.allowRanges)) {
+        throw new Error(`ssrf.allowRanges in ${WEB_SEARCH_CONFIG_PATH} must be an array of CIDR strings`);
+    }
+    if (config.trustEnvProxy !== undefined && typeof config.trustEnvProxy !== "boolean") {
+        throw new Error(`ssrf.trustEnvProxy in ${WEB_SEARCH_CONFIG_PATH} must be a boolean`);
+    }
+    const allowRangesValue = Array.isArray(config.allowRanges) ? config.allowRanges : [];
+    const allowRanges = allowRangesValue.map((entry, index) => {
+        if (typeof entry !== "string") {
+            throw new Error(`ssrf.allowRanges in ${WEB_SEARCH_CONFIG_PATH} must contain only CIDR strings; entry ${index + 1} is ${typeof entry}`);
+        }
+        return entry.trim();
+    }).filter(Boolean);
+    parseAllowRanges(allowRanges);
+    return { allowRanges, trustEnvProxy: config.trustEnvProxy === true };
+}
+async function defaultLookup(hostname) {
+    return dnsLookup(hostname, { all: true, verbatim: true });
+}
+export async function validateRemoteUrl(rawUrl, options = {}) {
+    const url = rawUrl instanceof URL ? rawUrl : new URL(rawUrl);
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new Error("Only HTTP and HTTPS URLs can be fetched remotely");
+    }
+    const hostname = normalizeHostname(url.hostname);
+    if (!hostname)
+        throw new Error("URL must include a hostname");
+    if (hostname === "localhost" || hostname.endsWith(".localhost")) {
+        throw new Error(`Blocked internal hostname: ${hostname}`);
+    }
+    const allowRanges = parseAllowRanges(options.allowRanges);
+    assertDomainPolicy(hostname, options.domainPolicy);
+    if (net.isIP(hostname)) {
+        assertPublicAddress(hostname, hostname, allowRanges);
+        return url;
+    }
+    if (shouldTrustEnvProxy(url, options.trustEnvProxy === true))
+        return url;
+    let addresses;
+    try {
+        addresses = await (options.lookup ?? defaultLookup)(hostname);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Failed to resolve ${hostname}: ${message}`);
+    }
+    if (addresses.length === 0)
+        throw new Error(`Failed to resolve ${hostname}: no addresses returned`);
+    for (const { address } of addresses) {
+        assertPublicAddress(address, hostname, allowRanges);
+    }
+    return url;
+}
+export async function fetchRemoteUrl(url, init = {}, options = {}) {
+    const fetchImpl = options.fetch ?? fetch;
+    const maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
+    let current = await validateRemoteUrl(url, options);
+    let requestInit = init;
+    for (let redirects = 0; redirects <= maxRedirects; redirects++) {
+        const response = await fetchImpl(current, { ...requestInit, redirect: "manual" });
+        if (!REDIRECT_STATUSES.has(response.status))
+            return response;
+        const location = response.headers.get("location");
+        if (!location)
+            return response;
+        if (redirects === maxRedirects)
+            throw new Error(`Too many redirects fetching ${current.toString()}`);
+        const from = current;
+        current = await validateRemoteUrl(new URL(location, current), options);
+        if (response.status === 303 || ((response.status === 301 || response.status === 302) && requestInit.method?.toUpperCase() === "POST")) {
+            const { body: _body, ...nextInit } = requestInit;
+            requestInit = { ...nextInit, method: "GET" };
+        }
+        if (options.onRedirect)
+            requestInit = options.onRedirect({ from, to: current, init: requestInit, response });
+    }
+    throw new Error(`Too many redirects fetching ${current.toString()}`);
+}
+function normalizeHostname(hostname) {
+    return hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+}
+function assertDomainPolicy(hostname, policy) {
+    if (!policy)
+        return;
+    if (policy.deny.some((entry) => domainMatches(hostname, entry))) {
+        throw new Error(`Blocked hostname by fetch_content domain policy: ${hostname}`);
+    }
+    if (policy.allow.length > 0 && !policy.allow.some((entry) => domainMatches(hostname, entry))) {
+        throw new Error(`Hostname not allowed by fetch_content domain policy: ${hostname}`);
+    }
+}
+function domainMatches(hostname, entry) {
+    return hostname === entry || hostname.endsWith(`.${entry}`);
+}
+function getProxyForProtocol(protocol) {
+    const candidates = protocol === "http:"
+        ? [process.env.HTTP_PROXY, process.env.http_proxy, process.env.ALL_PROXY, process.env.all_proxy]
+        : protocol === "https:"
+            ? [process.env.HTTPS_PROXY, process.env.https_proxy, process.env.HTTP_PROXY, process.env.http_proxy, process.env.ALL_PROXY, process.env.all_proxy]
+            : [];
+    for (const candidate of candidates) {
+        const value = candidate?.trim();
+        if (!value)
+            continue;
+        try {
+            const proxyUrl = new URL(value);
+            if ((proxyUrl.protocol === "http:" || proxyUrl.protocol === "https:") && proxyUrl.hostname)
+                return value;
+        }
+        catch {
+            // Invalid proxy env vars should not weaken local DNS SSRF checks.
+        }
+    }
+    return "";
+}
+function hostnameMatchesNoProxy(hostname, port, entry) {
+    const trimmed = entry.trim();
+    if (!trimmed)
+        return false;
+    if (trimmed === "*")
+        return true;
+    // NO_PROXY entries may include a port. Strip it only after handling
+    // bracketed IPv6 literals, which can contain several colons.
+    let hostEntry = trimmed;
+    let entryPort;
+    if (hostEntry.startsWith("[")) {
+        const closingBracket = hostEntry.indexOf("]");
+        if (closingBracket >= 0) {
+            const suffix = hostEntry.slice(closingBracket + 1);
+            if (/^:\\d+$/.test(suffix))
+                entryPort = suffix.slice(1);
+            hostEntry = hostEntry.slice(0, closingBracket + 1);
+        }
+    }
+    else {
+        const colon = hostEntry.lastIndexOf(":");
+        if (colon > -1 && /^\d+$/.test(hostEntry.slice(colon + 1))) {
+            entryPort = hostEntry.slice(colon + 1);
+            hostEntry = hostEntry.slice(0, colon);
+        }
+    }
+    if (entryPort !== undefined && entryPort !== port)
+        return false;
+    const normalizedEntry = normalizeHostname(hostEntry);
+    if (!normalizedEntry)
+        return false;
+    if (normalizedEntry === hostname)
+        return true;
+    const suffix = normalizedEntry.startsWith("*.")
+        ? normalizedEntry.slice(1)
+        : normalizedEntry.startsWith(".")
+            ? normalizedEntry
+            : `.${normalizedEntry}`;
+    return hostname.endsWith(suffix);
+}
+function shouldTrustEnvProxy(url, enabled) {
+    if (!enabled || !getProxyForProtocol(url.protocol))
+        return false;
+    const hostname = normalizeHostname(url.hostname);
+    const port = url.port || (url.protocol === "https:" ? "443" : "80");
+    const noProxy = process.env.NO_PROXY || process.env.no_proxy || "";
+    return !noProxy.split(",").some(entry => hostnameMatchesNoProxy(hostname, port, entry));
+}
+function assertPublicAddress(address, hostname, allowRanges = []) {
+    const normalized = normalizeHostname(address);
+    const ipVersion = net.isIP(normalized);
+    if (ipVersion === 0)
+        throw new Error(`Resolved non-IP address for ${hostname}: ${address}`);
+    // Explicitly-allowed ranges bypass the private/reserved checks below. This lets
+    // users exempt synthetic ranges produced by TUN/fake-IP proxies (e.g. 198.18/15).
+    if (isInAllowedRange(normalized, ipVersion, allowRanges))
+        return;
+    if (ipVersion === 4 && isBlockedIPv4(normalized)) {
+        const hint = isFakeIpProxyAddress(normalized)
+            ? '. This address is in 198.18.0.0/15, commonly used by TUN/fake-IP proxies. If that matches your setup, configure ssrf.allowRanges with ["198.18.0.0/15"] in web-search.json.'
+            : "";
+        throw new Error(`Blocked internal address for ${hostname}: ${normalized}${hint}`);
+    }
+    if (ipVersion === 6 && isBlockedIPv6(normalized)) {
+        throw new Error(`Blocked internal address for ${hostname}: ${normalized}`);
+    }
+}
+function isFakeIpProxyAddress(address) {
+    const [a, b] = address.split(".").map(part => Number(part));
+    return a === 198 && (b === 18 || b === 19);
+}
+function isBlockedIPv4(address) {
+    const parts = address.split(".").map(part => Number(part));
+    if (parts.length !== 4 || parts.some(part => !Number.isInteger(part) || part < 0 || part > 255))
+        return true;
+    const [a, b] = parts;
+    return a === 0 ||
+        a === 10 ||
+        a === 127 ||
+        (a === 100 && b >= 64 && b <= 127) ||
+        (a === 169 && b === 254) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && b === 168) ||
+        isFakeIpProxyAddress(address) ||
+        a >= 224;
+}
+function isBlockedIPv6(address) {
+    const groups = parseIPv6(address);
+    if (!groups)
+        return true;
+    const first = groups[0];
+    if (groups.every(group => group === 0))
+        return true;
+    if (groups.slice(0, 7).every(group => group === 0) && groups[7] === 1)
+        return true;
+    if ((first & 0xfe00) === 0xfc00)
+        return true;
+    if ((first & 0xffc0) === 0xfe80)
+        return true;
+    const isMappedIPv4 = groups.slice(0, 5).every(group => group === 0) && groups[5] === 0xffff;
+    if (isMappedIPv4) {
+        const ipv4 = [groups[6] >> 8, groups[6] & 0xff, groups[7] >> 8, groups[7] & 0xff].join(".");
+        return isBlockedIPv4(ipv4);
+    }
+    return false;
+}
+function parseIPv6(address) {
+    if (address.includes(".")) {
+        const lastColon = address.lastIndexOf(":");
+        const ipv4 = address.slice(lastColon + 1);
+        if (net.isIP(ipv4) !== 4)
+            return null;
+        const octets = ipv4.split(".").map(part => Number(part));
+        address = `${address.slice(0, lastColon)}:${((octets[0] << 8) | octets[1]).toString(16)}:${((octets[2] << 8) | octets[3]).toString(16)}`;
+    }
+    const pieces = address.split("::");
+    if (pieces.length > 2)
+        return null;
+    const left = pieces[0] ? pieces[0].split(":") : [];
+    const right = pieces.length === 2 && pieces[1] ? pieces[1].split(":") : [];
+    const missing = 8 - left.length - right.length;
+    if (pieces.length === 1 && missing !== 0)
+        return null;
+    if (pieces.length === 2 && missing < 0)
+        return null;
+    const groups = [...left, ...Array(missing).fill("0"), ...right].map(part => {
+        if (!/^[0-9a-f]{1,4}$/i.test(part))
+            return -1;
+        return parseInt(part, 16);
+    });
+    return groups.length === 8 && groups.every(group => group >= 0 && group <= 0xffff) ? groups : null;
+}
+/** Parse `allowRanges` config value into validated CIDR rules. Throws on malformed entries. */
+function parseAllowRanges(input) {
+    if (input === undefined || input === null)
+        return [];
+    if (!Array.isArray(input)) {
+        throw new Error("ssrf.allowRanges must be an array of CIDR strings");
+    }
+    const rules = [];
+    for (const entry of input) {
+        if (typeof entry !== "string") {
+            throw new Error(`ssrf.allowRanges entries must be strings, got ${typeof entry}`);
+        }
+        const rule = parseCidr(entry.trim());
+        if (!rule) {
+            throw new Error(`Invalid CIDR notation in ssrf.allowRanges: "${entry}"`);
+        }
+        rules.push(rule);
+    }
+    return rules;
+}
+/** Parse a single CIDR (e.g. "198.18.0.0/15", "fd00::/8") or bare host ("1.2.3.4"). Returns null if invalid. */
+function parseCidr(raw) {
+    if (!raw)
+        return null;
+    const slash = raw.lastIndexOf("/");
+    const addrPart = slash >= 0 ? raw.slice(0, slash) : raw;
+    const prefixPart = slash >= 0 ? raw.slice(slash + 1) : null;
+    // A slash must be followed by digits. Number("")/Number(" ") are 0, which
+    // would silently turn "198.18.0.0/" into /0 and exempt every address.
+    if (prefixPart !== null && !/^\d+$/.test(prefixPart))
+        return null;
+    const version = net.isIP(addrPart);
+    if (version === 4) {
+        const bytes = ipv4ToBytes(addrPart);
+        if (!bytes)
+            return null;
+        const prefix = prefixPart === null ? 32 : Number(prefixPart);
+        if (!Number.isInteger(prefix) || prefix < 1 || prefix > 32)
+            return null;
+        return { bytes, prefix };
+    }
+    if (version === 6) {
+        const groups = parseIPv6(addrPart);
+        if (!groups)
+            return null;
+        const prefix = prefixPart === null ? 128 : Number(prefixPart);
+        if (!Number.isInteger(prefix) || prefix < 1 || prefix > 128)
+            return null;
+        return { bytes: ipv6GroupsToBytes(groups), prefix };
+    }
+    return null;
+}
+function ipv4ToBytes(address) {
+    const parts = address.split(".");
+    if (parts.length !== 4)
+        return null;
+    const bytes = new Uint8Array(4);
+    for (let i = 0; i < 4; i++) {
+        const octet = Number(parts[i]);
+        if (!Number.isInteger(octet) || octet < 0 || octet > 255)
+            return null;
+        bytes[i] = octet;
+    }
+    return bytes;
+}
+function ipv6GroupsToBytes(groups) {
+    const bytes = new Uint8Array(16);
+    for (let i = 0; i < 8; i++) {
+        bytes[i * 2] = groups[i] >> 8;
+        bytes[i * 2 + 1] = groups[i] & 0xff;
+    }
+    return bytes;
+}
+function ipToBytes(address, version) {
+    if (version === 4)
+        return ipv4ToBytes(address);
+    if (version === 6) {
+        const groups = parseIPv6(address);
+        return groups ? ipv6GroupsToBytes(groups) : null;
+    }
+    return null;
+}
+/** True if `address` (already validated as `ipVersion`) falls within any allowed CIDR. */
+function isInAllowedRange(address, ipVersion, allowRanges) {
+    if (allowRanges.length === 0)
+        return false;
+    const addrBytes = ipToBytes(address, ipVersion);
+    if (!addrBytes)
+        return false;
+    for (const rule of allowRanges) {
+        // Only compare same-family rules (4-byte IPv4 vs 16-byte IPv6).
+        if (rule.bytes.length !== addrBytes.length)
+            continue;
+        if (bytesMatchPrefix(addrBytes, rule.bytes, rule.prefix))
+            return true;
+    }
+    return false;
+}
+/** Compare the leading `prefix` bits of two equal-length byte arrays. */
+function bytesMatchPrefix(addr, network, prefix) {
+    const fullBytes = prefix >> 3;
+    const remBits = prefix & 7;
+    for (let i = 0; i < fullBytes; i++) {
+        if (addr[i] !== network[i])
+            return false;
+    }
+    if (remBits > 0 && fullBytes < addr.length) {
+        const mask = (0xff << (8 - remBits)) & 0xff;
+        if ((addr[fullBytes] & mask) !== (network[fullBytes] & mask))
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=ssrf-protection.js.map