@kernhq/module-quire 0.15.0 → 0.16.1

package/dist/server/services/unfurl.js

@@ -0,0 +1,593 @@
+/**
+ * The server fetching a URL somebody typed into a page.
+ *
+ * This is the most dangerous thing in the module, and it is worth saying why before anything else.
+ * Core listens on :4000 and Postgres on :5432 **on the same host as this process**, and a cloud
+ * instance sits behind a metadata service at 169.254.169.254 that hands out credentials to anyone
+ * who asks. A fetcher that will retrieve any address a user supplies is a way to make Kern read all
+ * of that on the attacker's behalf and hand back what it found — which is what "unfurl this link"
+ * would be, written the obvious way.
+ *
+ * So the defences come first and the feature second. In order, and every one of them is load-bearing:
+ *
+ *   1. **Scheme.** `http:` and `https:` only. `file:`, `gopher:` and `data:` are not addresses on
+ *      the web, and a redirect to one is a redirect out of this function's assumptions.
+ *   2. **No credentials in the URL.** `http://user:pass@host/` sends those to the host, and a URL
+ *      with them in is either an accident or a way to reach something that asked for them.
+ *   3. **Resolve, then judge.** The hostname is resolved and *every* address it answers with has to
+ *      be public. `evil.example` resolving to 127.0.0.1 is the ordinary way past a name-based check,
+ *      and a name-based check is the only kind that can run before DNS.
+ *   4. **Then the allow-list**, on the hostname, *after* the address check rather than instead of
+ *      it. Order matters: an allow-list entry must never be a way *past* the address rule, so a host
+ *      an administrator allowed which today resolves into private space is still refused.
+ *   5. **The connection is pinned to the addresses that were checked.** The guard is installed as
+ *      the socket's own `lookup`, so there is no second resolution between the check and the
+ *      connection for a DNS rebind to win — which is why this uses `node:http` rather than `fetch`,
+ *      whose dispatcher cannot be given one without pulling undici in.
+ *   6. **Every redirect is a new request and gets the whole check again.** The first response is
+ *      public and the second one is the loopback interface: that is the entire trick, and it is why
+ *      redirects are followed here by hand rather than by the HTTP client.
+ *   7. **A ceiling on the body, the time and the number of hops**, because a fetcher with none is a
+ *      way to hold a worker open on a socket that trickles bytes for ever.
+ *
+ * **The allow-list is empty by default, and every unfurl is refused until an operator sets one.**
+ * That is deliberate rather than unfinished. Fetching arbitrary addresses on a user's say-so is a
+ * capability an instance's operator should have to grant on purpose, and a self-hosted Kern sitting
+ * inside somebody's private network is exactly the deployment where granting it by default would be
+ * worst. `QUIRE_EMBED_HOSTS` is the switch; the procedure says so when it refuses, so an
+ * administrator reads a sentence about a setting rather than "something went wrong".
+ *
+ * What this file is **not** for: Kern's own objects. A page, an issue or a channel is named by
+ * reference and resolved through `objectTypes`/`resolvers` against whoever is reading — see
+ * `objects.ts`. Unfurling our own URL would point this fetcher at core, and would freeze a
+ * permission question into a stored answer.
+ */
+import { lookup as dnsLookup } from 'node:dns';
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { isIP } from 'node:net';
+import { KernError } from '@kernhq/kernel';
+import { PAGE_EMBED_MAX_DESCRIPTION, PAGE_EMBED_MAX_SITE, PAGE_EMBED_MAX_TITLE, PAGE_EMBED_MAX_URL, } from '@kernhq/ui/editor/page-doc';
+/* ---------------------------------------------------------------------------------------------- */
+/* Refusals                                                                                         */
+/* ---------------------------------------------------------------------------------------------- */
+/**
+ * Why an address was not fetched.
+ *
+ * Named rather than free text, because the caller has to be able to tell an operator's problem
+ * ("nobody has allowed any host") from a writer's ("that address is not one of them") from the
+ * site's ("it never answered"), and because the tests assert on them: a refusal for the wrong
+ * reason is a check that happened to catch something the *next* URL will walk past.
+ */
+export const UNFURL_REFUSALS = [
+    'no_allowlist',
+    'not_allowed',
+    'private_address',
+    'unresolvable',
+    'bad_url',
+    'too_many_redirects',
+    'unreachable',
+    'not_readable',
+];
+export class UnfurlRefused extends Error {
+    refusal;
+    constructor(refusal) {
+        super(refusal);
+        this.refusal = refusal;
+        this.name = 'UnfurlRefused';
+    }
+}
+/* ---------------------------------------------------------------------------------------------- */
+/* Address space                                                                                    */
+/* ---------------------------------------------------------------------------------------------- */
+function ipv4Parts(ip) {
+    const parts = ip.split('.');
+    if (parts.length !== 4)
+        return null;
+    const out = [];
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part))
+            return null;
+        const value = Number(part);
+        if (value > 255)
+            return null;
+        out.push(value);
+    }
+    return out;
+}
+/**
+ * Everything IPv4 reserves, refused.
+ *
+ * Written out rather than reduced to "not 10/8, 172.16/12, 192.168/16", because the ones people
+ * forget are the ones that matter here: `169.254.169.254` is a cloud metadata service, `0.0.0.0` is
+ * *this host* on Linux, and `100.64/10` is a carrier's inside. A decimal or hex-encoded address —
+ * `http://2130706433/` — never reaches this function looking like one: the WHATWG URL parser
+ * normalises a special-scheme host to dotted quad before anything here sees it.
+ */
+function publicV4(parts) {
+    const [a = 0, b = 0, c = 0] = parts;
+    if (a === 0)
+        return false; // 0.0.0.0/8 — "this network", and 0.0.0.0 is every local interface
+    if (a === 10)
+        return false;
+    if (a === 127)
+        return false; // loopback
+    if (a === 100 && b >= 64 && b <= 127)
+        return false; // 100.64/10, carrier-grade NAT
+    if (a === 169 && b === 254)
+        return false; // link-local, which is where the metadata service lives
+    if (a === 172 && b >= 16 && b <= 31)
+        return false;
+    if (a === 192 && b === 0 && (c === 0 || c === 2))
+        return false; // IETF protocol assignments, TEST-NET-1
+    if (a === 192 && b === 168)
+        return false;
+    if (a === 198 && (b === 18 || b === 19))
+        return false; // benchmarking
+    if (a === 198 && b === 51 && c === 100)
+        return false; // TEST-NET-2
+    if (a === 203 && b === 0 && c === 113)
+        return false; // TEST-NET-3
+    if (a >= 224)
+        return false; // multicast, reserved, and 255.255.255.255
+    return true;
+}
+/**
+ * The same, for IPv6, and the four traps that make it harder.
+ *
+ * `::1` is loopback and everybody checks it. What gets missed is that IPv6 has three separate ways
+ * to *carry* an IPv4 address — `::ffff:127.0.0.1` (mapped), `64:ff9b::7f00:1` (NAT64) and
+ * `2002::/16` (6to4) — and a check that only refuses `fc00::/7` and `fe80::/10` lets every one of
+ * them through to the loopback interface. So an embedded address is unwrapped and judged as IPv4.
+ */
+function publicV6(groups) {
+    const [g0 = 0, g1 = 0, g2 = 0, g3 = 0, g4 = 0, g5 = 0, g6 = 0, g7 = 0] = groups;
+    const embedded = (high, low) => [high >> 8, high & 0xff, low >> 8, low & 0xff];
+    // `::`, `::1`, and the deprecated `::a.b.c.d` — the first six groups zero means an embedded v4.
+    if (g0 === 0 && g1 === 0 && g2 === 0 && g3 === 0 && g4 === 0) {
+        if (g5 === 0xffff)
+            return publicV4(embedded(g6, g7)); // IPv4-mapped
+        if (g5 === 0) {
+            if (g6 === 0 && g7 <= 1)
+                return false; // :: and ::1
+            return publicV4(embedded(g6, g7)); // IPv4-compatible
+        }
+    }
+    if (g0 === 0x0064 && g1 === 0xff9b)
+        return publicV4(embedded(g6, g7)); // NAT64 well-known prefix
+    if (g0 === 0x2002)
+        return publicV4(embedded(g1, g2)); // 6to4
+    if (g0 === 0x0100 && g1 === 0 && g2 === 0 && g3 === 0)
+        return false; // discard-only
+    if ((g0 & 0xfe00) === 0xfc00)
+        return false; // unique local
+    if ((g0 & 0xffc0) === 0xfe80)
+        return false; // link-local
+    if ((g0 & 0xff00) === 0xff00)
+        return false; // multicast
+    if (g0 === 0x2001 && g1 === 0x0db8)
+        return false; // documentation
+    return true;
+}
+function ipv6Groups(ip) {
+    let text = (ip.split('%')[0] ?? '').toLowerCase();
+    if (text.startsWith('[') && text.endsWith(']'))
+        text = text.slice(1, -1);
+    if (!text.includes(':'))
+        return null;
+    // A trailing dotted quad is two groups written the other way round.
+    const dotted = /(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(text);
+    if (dotted) {
+        const quad = ipv4Parts(dotted[1]);
+        if (!quad)
+            return null;
+        const high = ((quad[0] << 8) | quad[1]).toString(16);
+        const low = ((quad[2] << 8) | quad[3]).toString(16);
+        text = `${text.slice(0, dotted.index)}${high}:${low}`;
+    }
+    const halves = text.split('::');
+    if (halves.length > 2)
+        return null;
+    const head = halves[0] ? halves[0].split(':') : [];
+    const tail = halves.length === 2 && halves[1] ? halves[1].split(':') : [];
+    let parts;
+    if (halves.length === 1) {
+        if (head.length !== 8)
+            return null;
+        parts = head;
+    }
+    else {
+        const missing = 8 - head.length - tail.length;
+        if (missing < 0)
+            return null;
+        parts = [...head, ...Array.from({ length: missing }, () => '0'), ...tail];
+    }
+    const groups = [];
+    for (const part of parts) {
+        if (!/^[0-9a-f]{1,4}$/.test(part))
+            return null;
+        groups.push(Number.parseInt(part, 16));
+    }
+    return groups;
+}
+/**
+ * Is this address one the public internet can route to?
+ *
+ * **Anything this function cannot parse is not public.** That is the direction the default has to
+ * fall: an address shape nobody here anticipated is exactly the one an attacker went looking for.
+ */
+export function isPublicAddress(ip) {
+    const trimmed = ip.trim();
+    const v4 = ipv4Parts(trimmed);
+    if (v4)
+        return publicV4(v4);
+    const v6 = ipv6Groups(trimmed);
+    if (v6)
+        return publicV6(v6);
+    return false;
+}
+/* ---------------------------------------------------------------------------------------------- */
+/* The allow-list                                                                                   */
+/* ---------------------------------------------------------------------------------------------- */
+/**
+ * `QUIRE_EMBED_HOSTS`, as a list.
+ *
+ * `example.com` allows exactly that host. `.example.com` allows it and everything under it — spelled
+ * with a leading dot rather than inferred, because "allow github.com" and "allow every host anybody
+ * can create under github.io" are different decisions and an operator should have to make the second
+ * one on purpose.
+ */
+export function parseHostAllowlist(raw) {
+    return (raw ?? '')
+        .split(/[\s,]+/)
+        .map((entry) => entry.trim().toLowerCase().replace(/\.$/, ''))
+        .filter((entry) => entry.length > 0 && /^\.?[a-z0-9.-]+$/.test(entry));
+}
+export function hostAllowed(hostname, allowlist) {
+    const host = hostname.trim().toLowerCase().replace(/\.$/, '');
+    if (!host)
+        return false;
+    for (const entry of allowlist) {
+        if (entry.startsWith('.')) {
+            if (host === entry.slice(1) || host.endsWith(entry))
+                return true;
+        }
+        else if (host === entry)
+            return true;
+    }
+    return false;
+}
+const DEFAULT_REDIRECTS = 3;
+const DEFAULT_TIMEOUT_MS = 5_000;
+const DEFAULT_MAX_BYTES = 128 * 1024;
+const resolveWithDns = (hostname) => new Promise((resolve, reject) => {
+    dnsLookup(hostname, { all: true, verbatim: true }, (err, addresses) => {
+        if (err)
+            reject(new UnfurlRefused('unresolvable'));
+        else
+            resolve(addresses.map((a) => a.address));
+    });
+});
+/**
+ * Everything that has to be true before a request is made, in the order it has to be true in.
+ *
+ * Returns the addresses, because the connection is then pinned to exactly these — checking an
+ * address and then letting the socket resolve the name again is checking a different address from
+ * the one that gets connected to.
+ */
+export async function checkTarget(url, policy) {
+    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+        throw new UnfurlRefused('bad_url');
+    if (url.username || url.password)
+        throw new UnfurlRefused('bad_url');
+    if (url.href.length > PAGE_EMBED_MAX_URL)
+        throw new UnfurlRefused('bad_url');
+    if (policy.allowHosts.length === 0)
+        throw new UnfurlRefused('no_allowlist');
+    const hostname = url.hostname.replace(/^\[|\]$/g, '');
+    /*
+     * A literal address is its own resolution, so there is nothing to look up — and it is checked
+     * before the allow-list for the reason given at the top of this file: the allow-list must never
+     * be a way past the address rule.
+     */
+    const addresses = isIP(hostname) ? [hostname] : await (policy.resolve ?? resolveWithDns)(hostname);
+    if (addresses.length === 0)
+        throw new UnfurlRefused('unresolvable');
+    for (const address of addresses)
+        if (!isPublicAddress(address))
+            throw new UnfurlRefused('private_address');
+    if (!hostAllowed(hostname, policy.allowHosts))
+        throw new UnfurlRefused('not_allowed');
+    return addresses;
+}
+/* ---------------------------------------------------------------------------------------------- */
+/* One request                                                                                      */
+/* ---------------------------------------------------------------------------------------------- */
+/**
+ * One HTTP request that does not follow redirects, capped in bytes and in time.
+ *
+ * `node:http` rather than `fetch`, and the reason is the `lookup` below: it is the only place a
+ * resolution can be pinned to addresses that have already been judged, and Node's `fetch` gives no
+ * way to install one without adding undici as a dependency. `agent: false` because a pooled socket
+ * is keyed on host and port and *not* on the lookup, so pooling would happily hand back a connection
+ * that was opened under someone else's guard.
+ */
+export async function httpHop(url, addresses, policy) {
+    const send = url.protocol === 'https:' ? httpsRequest : httpRequest;
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const done = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            fn();
+        };
+        const req = send(url, {
+            method: 'GET',
+            agent: false,
+            // Pinned. The socket connects to an address this request has already had judged, and there
+            // is no second resolution between the check and the connection.
+            lookup: (_hostname, options, callback) => {
+                const chosen = addresses.map((address) => ({
+                    address,
+                    family: isIP(address) === 6 ? 6 : 4,
+                }));
+                if (typeof options === 'object' && options?.all)
+                    callback(null, chosen);
+                else {
+                    const first = chosen[0];
+                    callback(null, first.address, first.family);
+                }
+            },
+            headers: {
+                accept: 'text/html,application/xhtml+xml;q=0.9,*/*;q=0.1',
+                'accept-language': 'en',
+                'user-agent': 'Kern (+https://kernaio.com)',
+            },
+        }, (res) => {
+            const status = res.statusCode ?? 0;
+            const contentType = (res.headers['content-type'] ?? null);
+            const location = (res.headers.location ?? null);
+            /*
+             * A redirect and a non-HTML body are both answered without reading anything: there is no
+             * metadata in a 3 GB video, and reading one is how a fetcher becomes a way to make the
+             * server download things.
+             */
+            if (status >= 300 && status < 400) {
+                res.destroy();
+                return done(() => resolve({ status, location, contentType, body: '' }));
+            }
+            if (contentType && !/^\s*(text\/html|application\/xhtml\+xml|text\/plain)/i.test(contentType)) {
+                res.destroy();
+                return done(() => resolve({ status, location: null, contentType, body: '' }));
+            }
+            let size = 0;
+            const chunks = [];
+            res.on('data', (chunk) => {
+                size += chunk.length;
+                chunks.push(chunk);
+                // Enough to hold a `<head>`; the rest of the page is not metadata and is not read.
+                if (size >= policy.maxBytes)
+                    res.destroy();
+            });
+            const finish = () => done(() => resolve({
+                status,
+                location: null,
+                contentType,
+                body: Buffer.concat(chunks).subarray(0, policy.maxBytes).toString('utf8'),
+            }));
+            res.on('end', finish);
+            // A destroyed response is the cap doing its job, not a failure: keep what was read.
+            res.on('close', finish);
+            res.on('error', finish);
+        });
+        const timer = setTimeout(() => {
+            req.destroy();
+            done(() => reject(new UnfurlRefused('unreachable')));
+        }, policy.timeoutMs);
+        timer.unref?.();
+        req.on('error', () => done(() => reject(new UnfurlRefused('unreachable'))));
+        req.on('close', () => clearTimeout(timer));
+        req.end();
+    });
+}
+/* ---------------------------------------------------------------------------------------------- */
+/* Reading the metadata                                                                             */
+/* ---------------------------------------------------------------------------------------------- */
+const ENTITIES = {
+    amp: '&',
+    lt: '<',
+    gt: '>',
+    quot: '"',
+    apos: "'",
+    nbsp: ' ',
+    '#39': "'",
+    '#x27': "'",
+};
+/**
+ * Enough entity decoding to read a headline, and no more.
+ *
+ * The result is escaped again by the renderer before it reaches a page, so this is about the words
+ * being right rather than about safety — `AT&amp;T` should be stored as `AT&T` and not as five
+ * characters of markup somebody has to read past.
+ */
+function decodeEntities(text) {
+    return text.replace(/&(#x?[0-9a-f]+|[a-z]+);/gi, (whole, name) => {
+        const key = name.toLowerCase();
+        const known = ENTITIES[key];
+        if (known)
+            return known;
+        if (key.startsWith('#x')) {
+            const code = Number.parseInt(key.slice(2), 16);
+            return Number.isFinite(code) && code > 0 && code < 0x110000 ? String.fromCodePoint(code) : whole;
+        }
+        if (key.startsWith('#')) {
+            const code = Number.parseInt(key.slice(1), 10);
+            return Number.isFinite(code) && code > 0 && code < 0x110000 ? String.fromCodePoint(code) : whole;
+        }
+        return whole;
+    });
+}
+const clean = (text, max) => {
+    if (!text)
+        return null;
+    const out = decodeEntities(text).replace(/\s+/g, ' ').trim().slice(0, max);
+    return out || null;
+};
+/** `<meta property="og:title" content="…">`, either attribute order, either quote. */
+function metaContent(html, key) {
+    const named = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const patterns = [
+        new RegExp(`<meta[^>]+(?:property|name)\\s*=\\s*["']${named}["'][^>]*?content\\s*=\\s*["']([^"']*)["']`, 'i'),
+        new RegExp(`<meta[^>]+content\\s*=\\s*["']([^"']*)["'][^>]*?(?:property|name)\\s*=\\s*["']${named}["']`, 'i'),
+    ];
+    for (const pattern of patterns) {
+        const found = pattern.exec(html);
+        if (found?.[1])
+            return found[1];
+    }
+    return null;
+}
+/**
+ * What an HTML page says about itself.
+ *
+ * Open Graph first because it is what a page puts there deliberately, `<title>` and the description
+ * meta as the fallback, and the hostname as the site of last resort — a card with an address and
+ * nothing else is still a card, and it is what the renderer draws when there is no title at all.
+ */
+export function metadataFrom(html, url) {
+    const head = html.split(/<\/head\s*>/i)[0] ?? html;
+    const titleTag = /<title[^>]*>([\s\S]{0,400}?)<\/title\s*>/i.exec(head)?.[1] ?? null;
+    return {
+        url: url.href,
+        title: clean(metaContent(head, 'og:title'), PAGE_EMBED_MAX_TITLE) ??
+            clean(metaContent(head, 'twitter:title'), PAGE_EMBED_MAX_TITLE) ??
+            clean(titleTag?.replace(/<[^>]*>/g, ''), PAGE_EMBED_MAX_TITLE),
+        description: clean(metaContent(head, 'og:description'), PAGE_EMBED_MAX_DESCRIPTION) ??
+            clean(metaContent(head, 'description'), PAGE_EMBED_MAX_DESCRIPTION),
+        siteName: clean(metaContent(head, 'og:site_name'), PAGE_EMBED_MAX_SITE) ??
+            clean(url.hostname, PAGE_EMBED_MAX_SITE),
+    };
+}
+/* ---------------------------------------------------------------------------------------------- */
+/* The whole thing                                                                                  */
+/* ---------------------------------------------------------------------------------------------- */
+/**
+ * Fetch a URL and read what it says about itself, or refuse and say which rule refused it.
+ *
+ * The redirect loop is the part worth reading. Every hop — including the first — goes through
+ * `checkTarget` *before* it is requested, so a 302 from a public site to `http://127.0.0.1:4000` is
+ * refused at the second check, with the second request never made. That is the only arrangement
+ * that works: an HTTP client following redirects on its own has already made the request by the
+ * time anything here could look at where it went.
+ */
+export async function unfurl(rawUrl, policy) {
+    const full = {
+        allowHosts: policy.allowHosts,
+        maxRedirects: policy.maxRedirects ?? DEFAULT_REDIRECTS,
+        timeoutMs: policy.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+        maxBytes: policy.maxBytes ?? DEFAULT_MAX_BYTES,
+        resolve: policy.resolve ?? resolveWithDns,
+        hop: policy.hop ?? httpHop,
+    };
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new UnfurlRefused('bad_url');
+    }
+    const deadline = Date.now() + full.timeoutMs;
+    for (let redirects = 0; redirects <= full.maxRedirects; redirects++) {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0)
+            throw new UnfurlRefused('unreachable');
+        const addresses = await checkTarget(url, full);
+        const answer = await full.hop(url, addresses, { ...full, timeoutMs: remaining });
+        if (answer.status >= 300 && answer.status < 400 && answer.location) {
+            let next;
+            try {
+                next = new URL(answer.location, url);
+            }
+            catch {
+                throw new UnfurlRefused('bad_url');
+            }
+            url = next;
+            continue;
+        }
+        if (answer.status < 200 || answer.status >= 300)
+            throw new UnfurlRefused('not_readable');
+        if (!answer.body) {
+            // Nothing to read, but the address answered: a card with the URL on it is still honest.
+            return { url: url.href, title: null, description: null, siteName: url.hostname };
+        }
+        return metadataFrom(answer.body, url);
+    }
+    throw new UnfurlRefused('too_many_redirects');
+}
+/* ---------------------------------------------------------------------------------------------- */
+/* The service                                                                                      */
+/* ---------------------------------------------------------------------------------------------- */
+/** How long an answer is kept. A headline does not change in ten minutes, and a page render is hot. */
+const CACHE_TTL_MS = 10 * 60_000;
+const CACHE_MAX = 500;
+/**
+ * The words a refusal is reported with.
+ *
+ * Two of the eight are an *operator's* problem rather than the writer's, and they get their own
+ * sentence: somebody pasting a link into a page cannot be expected to work out that an environment
+ * variable is empty, and "that address is not allowed" would send them looking for a typo.
+ */
+const REFUSAL_MESSAGES = {
+    no_allowlist: 'No sites have been allowed for embedding on this instance. An administrator sets QUIRE_EMBED_HOSTS.',
+    not_allowed: 'This site is not one of the sites allowed for embedding on this instance.',
+    private_address: 'That address is on a private network, so it will not be fetched.',
+    unresolvable: 'That address could not be resolved.',
+    bad_url: 'That is not a web address that can be embedded.',
+    too_many_redirects: 'That address redirected too many times.',
+    unreachable: 'That site did not answer.',
+    not_readable: 'That page could not be read.',
+};
+export function quireUnfurl(kernel) {
+    const cache = new Map();
+    /*
+     * Read on every call rather than at boot, so an operator who sets the variable and restarts one
+     * process does not have to wonder which of them picked it up — and so a test can set it.
+     */
+    const allowHosts = () => parseHostAllowlist(process.env.QUIRE_EMBED_HOSTS);
+    return {
+        allowHosts,
+        /**
+         * Unfurl one address, refusing with a sentence rather than a stack trace.
+         *
+         * Cached by the URL the writer typed. The cache is per process and small: it exists so that a
+         * page whose writer pastes the same link twice is one request, not so that an unfurl is free.
+         */
+        async get(rawUrl) {
+            const key = rawUrl.trim();
+            const hit = cache.get(key);
+            if (hit && Date.now() - hit.at < CACHE_TTL_MS)
+                return hit.value;
+            try {
+                const value = await unfurl(key, { allowHosts: allowHosts() });
+                if (cache.size >= CACHE_MAX)
+                    cache.clear();
+                cache.set(key, { at: Date.now(), value });
+                return value;
+            }
+            catch (err) {
+                if (err instanceof UnfurlRefused) {
+                    /*
+                     * Logged at info rather than warn: a refusal is this working, and a workspace with a
+                     * strict allow-list would otherwise fill an operator's log with warnings about the
+                     * feature behaving exactly as configured.
+                     */
+                    kernel.log.info({ refusal: err.refusal }, 'quire: refused to unfurl an address');
+                    throw new KernError('BAD_REQUEST', REFUSAL_MESSAGES[err.refusal]);
+                }
+                throw err;
+            }
+        },
+    };
+}
+//# sourceMappingURL=unfurl.js.map

package/dist/server/services/unfurl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unfurl.js","sourceRoot":"","sources":["../../../src/server/services/unfurl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,MAAM,IAAI,SAAS,EAAsB,MAAM,UAAU,CAAA;AAClE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,SAAS,EAAe,MAAM,gBAAgB,CAAA;AACvD,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,4BAA4B,CAAA;AAEnC,oGAAoG;AACpG,sGAAsG;AACtG,oGAAoG;AAEpG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,cAAc;IACd,aAAa;IACb,iBAAiB;IACjB,cAAc;IACd,SAAS;IACT,oBAAoB;IACpB,aAAa;IACb,cAAc;CACN,CAAA;AAGV,MAAM,OAAO,aAAc,SAAQ,KAAK;IACjB;IAArB,YAAqB,OAAsB;QACzC,KAAK,CAAC,OAAO,CAAC,CAAA;QADK,YAAO,GAAP,OAAO,CAAe;QAEzC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;IAC7B,CAAC;CACF;AAED,oGAAoG;AACpG,sGAAsG;AACtG,oGAAoG;AAEpG,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QAC1B,IAAI,KAAK,GAAG,GAAG;YAAE,OAAO,IAAI,CAAA;QAC5B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACjB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,QAAQ,CAAC,KAAe;IAC/B,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAA;IACnC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA,CAAC,mEAAmE;IAC7F,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,KAAK,CAAA;IAC1B,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA,CAAC,WAAW;IACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,KAAK,CAAA,CAAC,+BAA+B;IAClF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA,CAAC,wDAAwD;IACjG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAA;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA,CAAC,wCAAwC;IACvG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,KAAK,CAAA,CAAC,eAAe;IACrE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA,CAAC,aAAa;IAClE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA,CAAC,aAAa;IACjE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,KAAK,CAAA,CAAC,2CAA2C;IACtE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,MAAgB;IAChC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,MAAM,CAAA;IAC/E,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,CAAA;IAE9F,gGAAgG;IAChG,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7D,IAAI,EAAE,KAAK,MAAM;YAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA,CAAC,cAAc;QACnE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YACb,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAA,CAAC,aAAa;YACnD,OAAO,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA,CAAC,kBAAkB;QACtD,CAAC;IACH,CAAC;IACD,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA,CAAC,0BAA0B;IAChG,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA,CAAC,OAAO;IAC5D,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA,CAAC,eAAe;IACnF,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA,CAAC,eAAe;IAC1D,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA,CAAC,aAAa;IACxD,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA,CAAC,YAAY;IACvD,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA,CAAC,gBAAgB;IACjE,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IACjD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACxE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAEpC,oEAAoE;IACpE,MAAM,MAAM,GAAG,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAW,CAAC,CAAA;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,MAAM,IAAI,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC,CAAY,IAAI,CAAC,CAAC,GAAI,IAAI,CAAC,CAAC,CAAY,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAC5E,MAAM,GAAG,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC,CAAY,IAAI,CAAC,CAAC,GAAI,IAAI,CAAC,CAAC,CAAY,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAC3E,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAA;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,CAAC,CAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,CAAC,CAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrF,IAAI,KAAe,CAAA;IACnB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAClC,KAAK,GAAG,IAAI,CAAA;IACd,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QAC7C,IAAI,OAAO,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAC5B,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAC9C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,EAAE,CAAA;IACzB,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAC7B,IAAI,EAAE;QAAE,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC3B,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IAC9B,IAAI,EAAE;QAAE,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC3B,OAAO,KAAK,CAAA;AACd,CAAC;AAED,oGAAoG;AACpG,sGAAsG;AACtG,oGAAoG;AAEpG;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAA8B;IAC/D,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;SACf,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;SAC7D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;AAC1E,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,SAA4B;IACxE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC7D,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;QAClE,CAAC;aAAM,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,CAAA;IACxC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AA+BD,MAAM,iBAAiB,GAAG,CAAC,CAAA;AAC3B,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAChC,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAA;AAEpC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAqB,EAAE,CAC7D,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAA0B,EAAE,EAAE;QACrF,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,aAAa,CAAC,cAAc,CAAC,CAAC,CAAA;;YAC7C,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAQ,EAAE,MAAoB;IAC9D,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAC7F,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IACpE,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,kBAAkB;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAC5E,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,cAAc,CAAC,CAAA;IAE3E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAErD;;;;OAIG;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,QAAQ,CAAC,CAAA;IAClG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,cAAc,CAAC,CAAA;IACnE,KAAK,MAAM,OAAO,IAAI,SAAS;QAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,CAAC,CAAA;IAE1G,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,aAAa,CAAC,CAAA;IACrF,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,oGAAoG;AACpG,sGAAsG;AACtG,oGAAoG;AAEpG;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAQ,EAAE,SAAmB,EAAE,MAA8B;IACzF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;IACnE,OAAO,IAAI,OAAO,CAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,MAAM,IAAI,GAAG,CAAC,EAAc,EAAE,EAAE;YAC9B,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,EAAE,EAAE,CAAA;QACN,CAAC,CAAA;QAED,MAAM,GAAG,GAAG,IAAI,CACd,GAAG,EACH;YACE,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;YACZ,2FAA2F;YAC3F,gEAAgE;YAChE,MAAM,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;gBACvC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACzC,OAAO;oBACP,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;iBACpC,CAAC,CAAC,CAAA;gBACH,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,GAAG;oBAC5C,QAAqD,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;qBACjE,CAAC;oBACJ,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAwC,CAAA;oBAC9D,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;gBAC7C,CAAC;YACH,CAAC;YACD,OAAO,EAAE;gBACP,MAAM,EAAE,iDAAiD;gBACzD,iBAAiB,EAAE,IAAI;gBACvB,YAAY,EAAE,6BAA6B;aAC5C;SACF,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAA;YAClC,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,IAAI,CAAkB,CAAA;YAC1E,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAkB,CAAA;YAChE;;;;eAIG;YACH,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBAClC,GAAG,CAAC,OAAO,EAAE,CAAA;gBACb,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;YACzE,CAAC;YACD,IAAI,WAAW,IAAI,CAAC,uDAAuD,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9F,GAAG,CAAC,OAAO,EAAE,CAAA;gBACb,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;YAC/E,CAAC;YACD,IAAI,IAAI,GAAG,CAAC,CAAA;YACZ,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAA;gBACpB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAClB,mFAAmF;gBACnF,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ;oBAAE,GAAG,CAAC,OAAO,EAAE,CAAA;YAC5C,CAAC,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,GAAG,EAAE,CAClB,IAAI,CAAC,GAAG,EAAE,CACR,OAAO,CAAC;gBACN,MAAM;gBACN,QAAQ,EAAE,IAAI;gBACd,WAAW;gBACX,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;aAC1E,CAAC,CACH,CAAA;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YACrB,oFAAoF;YACpF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YACvB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzB,CAAC,CACF,CAAA;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,GAAG,CAAC,OAAO,EAAE,CAAA;YACb,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;QACtD,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;QACpB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;QAEf,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3E,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA;QAC1C,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,oGAAoG;AACpG,sGAAsG;AACtG,oGAAoG;AAEpG,MAAM,QAAQ,GAA2B;IACvC,GAAG,EAAE,GAAG;IACR,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,GAAG;IACP,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,GAAG;IACT,KAAK,EAAE,GAAG;IACV,MAAM,EAAE,GAAG;CACZ,CAAA;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,OAAO,CAAC,2BAA2B,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,KAAK;YAAE,OAAO,KAAK,CAAA;QACvB,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAClG,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAClG,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,IAA+B,EAAE,GAAW,EAAiB,EAAE;IAC5E,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC1E,OAAO,GAAG,IAAI,IAAI,CAAA;AACpB,CAAC,CAAA;AAED,sFAAsF;AACtF,SAAS,WAAW,CAAC,IAAY,EAAE,GAAW;IAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;IACxD,MAAM,QAAQ,GAAG;QACf,IAAI,MAAM,CACR,2CAA2C,KAAK,4CAA4C,EAC5F,GAAG,CACJ;QACD,IAAI,MAAM,CACR,iFAAiF,KAAK,MAAM,EAC5F,GAAG,CACJ;KACF,CAAA;IACD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,GAAQ;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IAClD,MAAM,QAAQ,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IACpF,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,IAAI;QACb,KAAK,EACH,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,oBAAoB,CAAC;YAC1D,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,oBAAoB,CAAC;YAC/D,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,oBAAoB,CAAC;QAChE,WAAW,EACT,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;YACtE,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,0BAA0B,CAAC;QACrE,QAAQ,EACN,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,mBAAmB,CAAC;YAC7D,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,CAAC;KAC3C,CAAA;AACH,CAAC;AAED,oGAAoG;AACpG,sGAAsG;AACtG,oGAAoG;AAEpG;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,MAAoB;IAC/D,MAAM,IAAI,GAA2B;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,iBAAiB;QACtD,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,kBAAkB;QACjD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,iBAAiB;QAC9C,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,cAAc;QACzC,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,OAAO;KAC3B,CAAA;IAED,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IACpC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAA;IAC5C,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,IAAI,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,EAAE,CAAC;QACpE,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACvC,IAAI,SAAS,IAAI,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,aAAa,CAAC,CAAA;QAC1D,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAA;QAEhF,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACnE,IAAI,IAAS,CAAA;YACb,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;YACpC,CAAC;YACD,GAAG,GAAG,IAAI,CAAA;YACV,SAAQ;QACV,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG;YAAE,MAAM,IAAI,aAAa,CAAC,cAAc,CAAC,CAAA;QACxF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,wFAAwF;YACxF,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAA;QAClF,CAAC;QACD,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,oBAAoB,CAAC,CAAA;AAC/C,CAAC;AAED,oGAAoG;AACpG,sGAAsG;AACtG,oGAAoG;AAEpG,uGAAuG;AACvG,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAA;AAChC,MAAM,SAAS,GAAG,GAAG,CAAA;AAOrB;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAkC;IACtD,YAAY,EACV,qGAAqG;IACvG,WAAW,EAAE,2EAA2E;IACxF,eAAe,EAAE,kEAAkE;IACnF,YAAY,EAAE,qCAAqC;IACnD,OAAO,EAAE,iDAAiD;IAC1D,kBAAkB,EAAE,yCAAyC;IAC7D,WAAW,EAAE,2BAA2B;IACxC,YAAY,EAAE,8BAA8B;CAC7C,CAAA;AAED,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAA;IAE3C;;;OAGG;IACH,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IAE1E,OAAO;QACL,UAAU;QAEV;;;;;WAKG;QACH,KAAK,CAAC,GAAG,CAAC,MAAc;YACtB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;YACzB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC1B,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,YAAY;gBAAE,OAAO,GAAG,CAAC,KAAK,CAAA;YAE/D,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;gBAC7D,IAAI,KAAK,CAAC,IAAI,IAAI,SAAS;oBAAE,KAAK,CAAC,KAAK,EAAE,CAAA;gBAC1C,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;gBACzC,OAAO,KAAK,CAAA;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;oBACjC;;;;uBAIG;oBACH,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,qCAAqC,CAAC,CAAA;oBAChF,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;gBACnE,CAAC;gBACD,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kernhq/module-quire",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "Kern Quire: collaborative documents, spaces and page trees",
   "homepage": "https://github.com/KernAIO/module-quire#readme",
   "license": "AGPL-3.0-only",
@@ -53,15 +53,12 @@
   },
   "peerDependencies": {
     "@kernhq/contracts": "^0.7.0",
-    "@kernhq/kernel": "^0.8.0",
-    "@kernhq/ui": "^0.13.0",
+    "@kernhq/kernel": "^0.9.0",
+    "@kernhq/ui": "^0.14.0",
     "@tanstack/svelte-query": "^6.1.0",
     "svelte": "^5.46.0"
   },
   "peerDependenciesMeta": {
-    "@kernhq/ui": {
-      "optional": true
-    },
     "@tanstack/svelte-query": {
       "optional": true
     },
@@ -73,9 +70,9 @@
     "@biomejs/biome": "^2.0.0",
     "@changesets/cli": "^2.27.0",
     "@kernhq/contracts": "^0.7.0",
-    "@kernhq/kernel": "^0.8.0",
+    "@kernhq/kernel": "^0.9.0",
     "@kernhq/tsconfig": "^0.1.0",
-    "@kernhq/ui": "^0.13.0",
+    "@kernhq/ui": "^0.14.0",
     "@tanstack/svelte-query": "^6.1.0",
     "@types/node": "^24.0.0",
     "@types/pg": "^8.15.0",