@kumwe/studio-core 0.1.0-alpha.2 → 0.1.0-alpha.3

package/dist/index.d.ts

@@ -11,5 +11,6 @@ export { compareSemanticVersions, normalizeVersionRange, parseSemanticVersion, s
 export { StudioSession, type StudioSessionOptions } from './session.js';
 export { BlockRegistry, type BlockRegistrationOptions, type ResolvedBlockRegistration, } from './registry.js';
 export { assertStudioPropertySchema, STUDIO_SCHEMA_PROFILE_LIMITS } from './schema-profile.js';
+export { STUDIO_DEFAULT_URL_POLICY, validateExternalUrl, type ExternalUrlPolicy, type ExternalUrlRejectionReason, type ExternalUrlValidationResult, } from './url-policy.js';
 export { validateBlueprint, type BlueprintValidationOptions, type BlueprintValidationResult, } from './validation.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,6BAA6B,GACnC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,GACjC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EACL,aAAa,EACb,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EACL,iBAAiB,EACjB,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,GAC/B,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,6BAA6B,GACnC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,GACjC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EACL,aAAa,EACb,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,GACjC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,iBAAiB,EACjB,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,GAC/B,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -11,5 +11,6 @@ export { compareSemanticVersions, normalizeVersionRange, parseSemanticVersion, s
 export { StudioSession } from './session.js';
 export { BlockRegistry, } from './registry.js';
 export { assertStudioPropertySchema, STUDIO_SCHEMA_PROFILE_LIMITS } from './schema-profile.js';
+export { STUDIO_DEFAULT_URL_POLICY, validateExternalUrl, } from './url-policy.js';
 export { validateBlueprint, } from './validation.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,kBAAkB,GAGnB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,GAKxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EACL,eAAe,EACf,oBAAoB,GAMrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,GAGtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,GAEtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAA6B,MAAM,cAAc,CAAC;AACxE,OAAO,EACL,aAAa,GAGd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EACL,iBAAiB,GAGlB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,kBAAkB,GAGnB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,GAKxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EACL,eAAe,EACf,oBAAoB,GAMrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,GAGtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,GAEtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAA6B,MAAM,cAAc,CAAC;AACxE,OAAO,EACL,aAAa,GAGd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAIpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,iBAAiB,GAGlB,MAAM,iBAAiB,CAAC"}

package/dist/url-policy.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Canonical policy for external resource URLs (remote media imports, embeds).
+ * Studio never fetches author-supplied URLs itself; hosts that do MUST apply
+ * this validator before any fetch. The policy is purely lexical and
+ * deterministic — it classifies the WHATWG-parsed URL without network access,
+ * DNS resolution, clocks, or locale sensitivity. DNS-rebinding defence,
+ * redirect re-validation, and response verification therefore remain host
+ * runtime obligations of the hardened fetcher.
+ */
+export type ExternalUrlRejectionReason = 'credentials-in-url' | 'host-not-allowed' | 'malformed' | 'scheme-not-allowed' | 'url-too-long';
+export type ExternalUrlValidationResult = {
+    ok: false;
+    reason: ExternalUrlRejectionReason;
+} | {
+    ok: true;
+    url: string;
+};
+export interface ExternalUrlPolicy {
+    /**
+     * Schemes admitted for fetching, compared against the parsed URL's
+     * lowercase protocol including its trailing colon (for example `https:`).
+     */
+    allowedSchemes: readonly string[];
+    /**
+     * Whether loopback, private, link-local, carrier-grade NAT, unspecified,
+     * broadcast, and special-use (`localhost`, `.local`, `.internal`,
+     * `.home.arpa`) hosts are admitted. An empty host is rejected regardless.
+     */
+    allowPrivateHosts: boolean;
+    /** Maximum accepted length of the raw candidate string, in code units. */
+    maxLength: number;
+}
+export declare const STUDIO_DEFAULT_URL_POLICY: Readonly<ExternalUrlPolicy>;
+/**
+ * Validate one external resource URL against the policy. The candidate is
+ * parsed with the WHATWG URL parser and classification operates on the parsed
+ * `hostname`, so decimal, octal, hexadecimal, and dotted-partial IPv4
+ * spellings (`2130706433`, `0x7f000001`, `017700000001`, `127.1`) are
+ * normalized before range checks and cannot smuggle a private address past
+ * the policy. Punycode and IDN hosts that name none of the disallowed ranges
+ * are accepted lexically; whether such a name ultimately resolves to a
+ * private address is a DNS-time question the host fetcher must re-check.
+ */
+export declare function validateExternalUrl(candidate: string, policy?: ExternalUrlPolicy): ExternalUrlValidationResult;
+//# sourceMappingURL=url-policy.d.ts.map

package/dist/url-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-policy.d.ts","sourceRoot":"","sources":["../src/url-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAiBH,MAAM,MAAM,0BAA0B,GACpC,oBAAoB,GAAG,kBAAkB,GAAG,WAAW,GAAG,oBAAoB,GAAG,cAAc,CAAC;AAElG,MAAM,MAAM,2BAA2B,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,0BAA0B,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,iBAAiB,CAIhE,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,iBAA6C,GACpD,2BAA2B,CAoB7B"}

package/dist/url-policy.js

@@ -0,0 +1,248 @@
+/**
+ * Canonical policy for external resource URLs (remote media imports, embeds).
+ * Studio never fetches author-supplied URLs itself; hosts that do MUST apply
+ * this validator before any fetch. The policy is purely lexical and
+ * deterministic — it classifies the WHATWG-parsed URL without network access,
+ * DNS resolution, clocks, or locale sensitivity. DNS-rebinding defence,
+ * redirect re-validation, and response verification therefore remain host
+ * runtime obligations of the hardened fetcher.
+ */
+export const STUDIO_DEFAULT_URL_POLICY = Object.freeze({
+    allowedSchemes: Object.freeze(['https:']),
+    allowPrivateHosts: false,
+    maxLength: 2_048,
+});
+/**
+ * Validate one external resource URL against the policy. The candidate is
+ * parsed with the WHATWG URL parser and classification operates on the parsed
+ * `hostname`, so decimal, octal, hexadecimal, and dotted-partial IPv4
+ * spellings (`2130706433`, `0x7f000001`, `017700000001`, `127.1`) are
+ * normalized before range checks and cannot smuggle a private address past
+ * the policy. Punycode and IDN hosts that name none of the disallowed ranges
+ * are accepted lexically; whether such a name ultimately resolves to a
+ * private address is a DNS-time question the host fetcher must re-check.
+ */
+export function validateExternalUrl(candidate, policy = STUDIO_DEFAULT_URL_POLICY) {
+    if (candidate.length > policy.maxLength) {
+        return { ok: false, reason: 'url-too-long' };
+    }
+    let parsed;
+    try {
+        parsed = new URL(candidate);
+    }
+    catch {
+        return { ok: false, reason: 'malformed' };
+    }
+    if (!policy.allowedSchemes.includes(parsed.protocol)) {
+        return { ok: false, reason: 'scheme-not-allowed' };
+    }
+    if (parsed.username.length > 0 || parsed.password.length > 0) {
+        return { ok: false, reason: 'credentials-in-url' };
+    }
+    if (!isPermittedHost(parsed.hostname, policy.allowPrivateHosts)) {
+        return { ok: false, reason: 'host-not-allowed' };
+    }
+    return { ok: true, url: parsed.href };
+}
+function isPermittedHost(hostname, allowPrivateHosts) {
+    if (hostname.length === 0) {
+        return false;
+    }
+    if (allowPrivateHosts) {
+        return true;
+    }
+    const trimmed = hostname.endsWith('.') ? hostname.slice(0, -1) : hostname;
+    if (trimmed.length === 0) {
+        return false;
+    }
+    if (trimmed.startsWith('[') && trimmed.endsWith(']')) {
+        const groups = parseIpv6Groups(trimmed.slice(1, -1));
+        return groups !== undefined && !isDisallowedIpv6(groups);
+    }
+    const host = trimmed.toLowerCase();
+    if (host === 'localhost' || host.endsWith('.localhost')) {
+        return false;
+    }
+    if (host.endsWith('.local') || host.endsWith('.internal') || host.endsWith('.home.arpa')) {
+        return false;
+    }
+    const address = parseIpv4Host(host);
+    if (address !== undefined) {
+        return !isDisallowedIpv4(address);
+    }
+    return true;
+}
+function isDisallowedIpv4(address) {
+    const octet1 = Math.floor(address / 16_777_216) % 256;
+    const octet2 = Math.floor(address / 65_536) % 256;
+    return (address === 0 || // 0.0.0.0 unspecified
+        address === 4_294_967_295 || // 255.255.255.255 broadcast
+        octet1 === 127 || // 127.0.0.0/8 loopback
+        octet1 === 10 || // 10.0.0.0/8 private
+        (octet1 === 172 && octet2 >= 16 && octet2 <= 31) || // 172.16.0.0/12 private
+        (octet1 === 192 && octet2 === 168) || // 192.168.0.0/16 private
+        (octet1 === 169 && octet2 === 254) || // 169.254.0.0/16 link-local
+        (octet1 === 100 && octet2 >= 64 && octet2 <= 127) // 100.64.0.0/10 CGNAT
+    );
+}
+function isDisallowedIpv6(groups) {
+    const group = (index) => groups[index] ?? 0;
+    if (groups.every((piece) => piece === 0)) {
+        return true; // :: unspecified
+    }
+    if (groups.slice(0, 7).every((piece) => piece === 0) && group(7) === 1) {
+        return true; // ::1 loopback
+    }
+    if ((group(0) & 0xff_c0) === 0xfe_80) {
+        return true; // fe80::/10 link-local
+    }
+    if ((group(0) & 0xfe_00) === 0xfc_00) {
+        return true; // fc00::/7 unique-local
+    }
+    if (groups.slice(0, 5).every((piece) => piece === 0) &&
+        (group(5) === 0xff_ff || group(5) === 0)) {
+        // ::ffff:0:0/96 IPv4-mapped and the deprecated ::/96 IPv4-compatible
+        // block classify as their embedded IPv4 address.
+        return isDisallowedIpv4(group(6) * 65_536 + group(7));
+    }
+    return false;
+}
+/**
+ * Interpret a hostname the way the WHATWG IPv4 host parser does: up to four
+ * dot-separated numbers in decimal, octal (leading `0`), or hexadecimal
+ * (leading `0x`), where the final number may span the remaining octets.
+ * Returns the 32-bit address, or `undefined` when the host is not an IPv4
+ * candidate and must be treated as a name.
+ */
+function parseIpv4Host(host) {
+    if (!/^[0-9A-Fa-fXx.]+$/u.test(host)) {
+        return undefined;
+    }
+    const parts = host.split('.');
+    if (parts.length > 4) {
+        return undefined;
+    }
+    const numbers = [];
+    for (const part of parts) {
+        const value = parseIpv4Number(part);
+        if (value === undefined) {
+            return undefined;
+        }
+        numbers.push(value);
+    }
+    const last = numbers[numbers.length - 1];
+    if (last === undefined) {
+        return undefined;
+    }
+    const prefix = numbers.slice(0, -1);
+    if (prefix.some((octet) => octet > 255) || last > 256 ** (4 - prefix.length) - 1) {
+        return undefined;
+    }
+    let address = last;
+    for (let index = 0; index < prefix.length; index += 1) {
+        address += (prefix[index] ?? 0) * 256 ** (3 - index);
+    }
+    return address;
+}
+function parseIpv4Number(part) {
+    if (part.length === 0) {
+        return undefined;
+    }
+    let digits = part;
+    let radix = 10;
+    if (digits.length >= 2 && (digits.startsWith('0x') || digits.startsWith('0X'))) {
+        digits = digits.slice(2);
+        radix = 16;
+        if (digits.length === 0) {
+            return 0;
+        }
+    }
+    else if (digits.length >= 2 && digits.startsWith('0')) {
+        digits = digits.slice(1);
+        radix = 8;
+    }
+    const pattern = radix === 16 ? /^[0-9A-Fa-f]+$/u : radix === 8 ? /^[0-7]+$/u : /^[0-9]+$/u;
+    if (!pattern.test(digits)) {
+        return undefined;
+    }
+    const value = Number.parseInt(digits, radix);
+    return value > 4_294_967_295 ? undefined : value;
+}
+/**
+ * Parse a bracket-stripped IPv6 literal into its eight 16-bit groups,
+ * expanding one `::` compression and accepting a trailing dotted-quad
+ * (IPv4-in-IPv6) suffix. Returns `undefined` for anything else so callers
+ * fail closed on hosts this parser cannot classify.
+ */
+function parseIpv6Groups(literal) {
+    if (literal.length === 0 || literal.includes('%')) {
+        return undefined;
+    }
+    const marker = literal.indexOf('::');
+    if (marker === -1) {
+        const pieces = parseIpv6Pieces(literal, true);
+        return pieces?.length === 8 ? pieces : undefined;
+    }
+    if (literal.includes('::', marker + 1)) {
+        return undefined;
+    }
+    const head = parseIpv6Pieces(literal.slice(0, marker), false);
+    const tail = parseIpv6Pieces(literal.slice(marker + 2), true);
+    if (head === undefined || tail === undefined) {
+        return undefined;
+    }
+    const missing = 8 - head.length - tail.length;
+    if (missing < 1) {
+        return undefined;
+    }
+    const zeros = [];
+    for (let index = 0; index < missing; index += 1) {
+        zeros.push(0);
+    }
+    return [...head, ...zeros, ...tail];
+}
+function parseIpv6Pieces(text, allowIpv4Suffix) {
+    if (text.length === 0) {
+        return [];
+    }
+    const parts = text.split(':');
+    const pieces = [];
+    for (let index = 0; index < parts.length; index += 1) {
+        const part = parts[index];
+        if (part === undefined || part.length === 0) {
+            return undefined;
+        }
+        if (allowIpv4Suffix && index === parts.length - 1 && part.includes('.')) {
+            const embedded = parseDottedQuad(part);
+            if (embedded === undefined) {
+                return undefined;
+            }
+            pieces.push(Math.floor(embedded / 65_536), embedded % 65_536);
+            continue;
+        }
+        if (!/^[0-9A-Fa-f]{1,4}$/u.test(part)) {
+            return undefined;
+        }
+        pieces.push(Number.parseInt(part, 16));
+    }
+    return pieces;
+}
+function parseDottedQuad(text) {
+    const parts = text.split('.');
+    if (parts.length !== 4) {
+        return undefined;
+    }
+    let address = 0;
+    for (const part of parts) {
+        if (!/^(?:0|[1-9][0-9]{0,2})$/u.test(part)) {
+            return undefined;
+        }
+        const octet = Number(part);
+        if (octet > 255) {
+            return undefined;
+        }
+        address = address * 256 + octet;
+    }
+    return address;
+}
+//# sourceMappingURL=url-policy.js.map

package/dist/url-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-policy.js","sourceRoot":"","sources":["../src/url-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAuCH,MAAM,CAAC,MAAM,yBAAyB,GAAgC,MAAM,CAAC,MAAM,CAAC;IAClF,cAAc,EAAE,MAAM,CAAC,MAAM,CAAW,CAAC,QAAQ,CAAC,CAAC;IACnD,iBAAiB,EAAE,KAAK;IACxB,SAAS,EAAE,KAAK;CACjB,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,SAA4B,yBAAyB;IAErD,IAAI,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,iBAA0B;IACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,OAAO,MAAM,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACzF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,UAAU,CAAC,GAAG,GAAG,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC;IAClD,OAAO,CACL,OAAO,KAAK,CAAC,IAAI,sBAAsB;QACvC,OAAO,KAAK,aAAa,IAAI,4BAA4B;QACzD,MAAM,KAAK,GAAG,IAAI,uBAAuB;QACzC,MAAM,KAAK,EAAE,IAAI,qBAAqB;QACtC,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,wBAAwB;QAC5E,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,IAAI,yBAAyB;QAC/D,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,IAAI,4BAA4B;QAClE,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,GAAG,CAAC,CAAC,sBAAsB;KACzE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAyB;IACjD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC,CAAC,iBAAiB;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC,CAAC,eAAe;IAC9B,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC,CAAC,uBAAuB;IACtC,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC,CAAC,wBAAwB;IACvC,CAAC;IACD,IACE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;QAChD,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EACxC,CAAC;QACD,qEAAqE;QACrE,iDAAiD;QACjD,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,KAAK,GAAG,EAAE,CAAC;QACX,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,KAAK,GAAG,CAAC,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;IAC3F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7C,OAAO,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9C,OAAO,MAAM,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACvC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,eAAwB;IAC7D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,eAAe,IAAI,KAAK,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxE,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC,CAAC;YAC9D,SAAS;QACX,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAG,OAAO,GAAG,GAAG,GAAG,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kumwe/studio-core",
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.3",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/kumwe/studio.git",