@jayyuen66/dsh-plugin-shared 0.1.4 → 0.1.5-rc

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/locale.js CHANGED
@@ -1 +1 @@
1
- import{isRecord as e}from"./record.js";const t=`zh`,n=`locale`,r=`preference`;function i(e){let[t]=(typeof e==`string`?e.trim().toLowerCase():``).split(`-`);return t===`en`||t===`zh`?t:`zh`}function a(t){return i(e(t)?t[r]:void 0)}function o(e,t){return e[t]}export{t as DEFAULT_LOCALE,r as LOCALE_PREFERENCE_FIELD,n as LOCALE_SETTINGS_NAMESPACE,o as messagesFor,i as resolveLocale,a as resolveLocalePreference};
1
+ import{isRecord as e}from"./record.js";const t=`zh`,n=`locale`,r=`preference`;function i(e){let[t]=(typeof e==`string`?e.trim().toLowerCase():``).split(`-`);return t===`en`||t===`zh`?t:`zh`}function a(t){return i(e(t)&&Object.hasOwn(t,`preference`)?t[r]:void 0)}function o(e,t){return e[t]}export{t as DEFAULT_LOCALE,r as LOCALE_PREFERENCE_FIELD,n as LOCALE_SETTINGS_NAMESPACE,o as messagesFor,i as resolveLocale,a as resolveLocalePreference};
package/dist/trust.js CHANGED
@@ -1 +1 @@
1
- import{CROSS_ORIGIN_TEXT as e,sendJson as t}from"./http.js";import n from"node:os";import{isIPv4 as r,isIPv6 as i}from"node:net";const a=/* @__PURE__ */ new Set([`localhost`,`[::1]`]),o=/* @__PURE__ */ new Set([`same-origin`,`none`]);function s(e){let t=new URL(`http://[${e.split(`%`,1).join(``)}]`).hostname;return t===`[::1]`||t.startsWith(`[::ffff:7f`)}function c(e){return e===void 0?!1:r(e)?e.split(`.`,1).join(``)!==`127`:i(e)&&!s(e)}const l=`bad-origin`;function u(e,t){let n=e.headers?.[t];return n===void 0?null:Array.isArray(n)?n.length===1?n.join(``):null:n}const d=/^[A-Za-z0-9._\-[\]:%]+$/u;function f(e){if(!d.test(e))return null;try{return new URL(`http://${e}`)}catch{return null}}function p(e){let t=e.toLowerCase();if(a.has(t))return!0;let n=t.split(`.`);return n.length===4&&n[0]===`127`&&n.every(e=>/^\d{1,3}$/u.test(e)&&Number(e)<=255)}function m(){let e=[];for(let t of Object.values(n.networkInterfaces()))for(let{family:n,address:r}of t??[])e.push(n===`IPv6`?`[${r}]`:r);return e}function h(e,t){return p(e)?!0:t.servingNonLoopback===!0&&(t.localInterfaceAddresses??m()).includes(e)}function g(e){let t=u(e,`sec-fetch-site`);return t===null||o.has(t)}function _(e){let t=e.socket?.remoteAddress;if(typeof t!=`string`||t===``)return null;let n=t.replaceAll(/^\[|\]$/gu,``).replace(/^::ffff:/iu,``);return p(n)||n===`::1`}function v(e,t){let n=e.headers?.host;if(Array.isArray(n)&&n.length!==1)return`rejected`;let r=u(e,`host`);if(r===null)return _(e)===!1?`rejected`:null;let i=f(r);return i===null||!h(i.hostname,t)?`rejected`:i}function y(e,t={}){let n=v(e,t);if(n===`rejected`)return`untrusted-host`;if(!g(e))return`cross-site`;let r=u(e,`origin`);if(r===null)return`trusted`;if(r===`null`||n===null)return l;let i=f(r.replace(/^[a-z][a-z0-9+.-]*:\/\//iu,``));return i===null?l:i.host===n.host?`trusted`:l}function b(t){return t===`untrusted-host`?`untrusted host authority`:e}function x(e,n,r={}){let i=y(e,r);return i===`trusted`?!0:n.headersSent||n.writableEnded?(console.error(`[shared/trust] rejecting after headers were sent:`,i),!1):(t(n,403,{ok:!1,error:b(i)}),!1)}export{x as guardTrust,c as isNonLoopbackBindHost,y as requestTrust,b as trustRejectionText};
1
+ import{CROSS_ORIGIN_TEXT as e,sendJson as t}from"./http.js";import n from"node:os";import{isIPv4 as r,isIPv6 as i}from"node:net";const a=/* @__PURE__ */ new Set([`localhost`,`[::1]`]),o=/* @__PURE__ */ new Set([`same-origin`,`none`]),s=`[::ffff:7f`;function c(e){let t=new URL(`http://[${e.split(`%`,1).join(``)}]`).hostname;return t===`[::1]`||t.startsWith(s)}function l(e){return e===void 0?!1:r(e)?e.split(`.`,1).join(``)!==`127`:i(e)&&!c(e)}const u=`bad-origin`;function d(e,t){let n=e.headers?.[t];return n===void 0?{kind:`absent`}:Array.isArray(n)?n.length===1?{kind:`single`,value:n.join(``)}:{kind:`duplicate`}:{kind:`single`,value:n}}const f=/^[A-Za-z0-9._\-[\]:%]+$/u;function p(e){if(!f.test(e))return null;try{return new URL(`http://${e}`)}catch{return null}}function m(e){let t=e.toLowerCase();if(a.has(t)||t.startsWith(s))return!0;let n=t.split(`.`);return n.length===4&&n[0]===`127`&&n.every(e=>/^\d{1,3}$/u.test(e)&&Number(e)<=255)}function h(){let e=[];for(let t of Object.values(n.networkInterfaces()))for(let{family:n,address:r}of t??[])e.push(n===`IPv6`?`[${r}]`:r);return e}function g(e,t){return m(e)?!0:t.servingNonLoopback===!0&&(t.localInterfaceAddresses??h()).includes(e)}function _(e){let t=d(e,`sec-fetch-site`);return t.kind===`duplicate`?!1:t.kind===`absent`||o.has(t.value)}function v(e){let t=e.socket?.remoteAddress;if(typeof t!=`string`||t===``)return null;let n=t.replaceAll(/^\[|\]$/gu,``).replace(/^::ffff:/iu,``);return m(n)||n===`::1`}function y(e,t){let n=d(e,`host`);if(n.kind===`duplicate`)return`rejected`;if(n.kind===`absent`)return v(e)===!1?`rejected`:null;let r=p(n.value);return r===null||!g(r.hostname,t)?`rejected`:r}function b(e,t={}){let n=y(e,t);if(n===`rejected`)return`untrusted-host`;if(!_(e))return`cross-site`;let r=d(e,`origin`);if(r.kind===`duplicate`)return u;if(r.kind===`absent`)return`trusted`;let i=r.value;if(i===`null`||n===null)return u;let a=p(i.replace(/^[a-z][a-z0-9+.-]*:\/\//iu,``));return a===null?u:a.host===n.host?`trusted`:u}function x(t){return t===`untrusted-host`?`untrusted host authority`:e}function S(e,n,r={}){let i=b(e,r);return i===`trusted`?!0:n.headersSent||n.writableEnded?(console.error(`[shared/trust] rejecting after headers were sent:`,i),!1):(t(n,403,{ok:!1,error:x(i)}),!1)}export{S as guardTrust,l as isNonLoopbackBindHost,b as requestTrust,x as trustRejectionText};
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@jayyuen66/dsh-plugin-shared",
3
- "version": "0.1.4",
3
+ "version": "0.1.5-rc",
4
4
  "description": "dsh 自研插件的共享工具库:tool 事件流记账扫描 + webServer HTTP 样板(sendJson/CORS/CSRF/body 限制)+ 卡片 apply 骨架 + 项目键派生 + 代理对安全截断。作为库包被 import,不由用户启用",
5
5
  "keywords": [
6
6
  "cordis",