@medialane/sdk 0.105.0 → 0.107.0

package/dist/index.d.cts

@@ -497,12 +497,60 @@ declare const ALLOWED_IMAGE_CONTENT_TYPES: Set<string>;
 declare const MAX_IMAGE_REDIRECTS = 5;
 declare const MAX_IMAGE_PROXY_BYTES: number;
 declare function isPrivateHost(hostname: string): boolean;
-declare function validateUrl(raw: string): {
+/**
+ * Validates a URL before it is fetched server-side. `requireHttps` is on by
+ * default; callers that legitimately accept plain http (a metadata URI already
+ * committed on chain, say) opt out explicitly rather than the guard being
+ * lenient for everyone.
+ */
+declare function validateUrl(raw: string, options?: {
+    requireHttps?: boolean;
+}): {
     url: URL;
 } | {
     error: string;
     status: number;
 };
+/** Convenience for callers that only need a yes/no, mirroring the backend's prior helper. */
+declare function isPrivateOrInsecureUrl(raw: string, requireHttps?: boolean): boolean;
+
+/**
+ * Proxies a remote image, which means fetching a URL an untrusted caller chose
+ * — the classic SSRF shape. Guarded in four places, each of which has to hold:
+ *
+ *   1. the URL is https, credential-free and not a private host
+ *   2. the hostname's *resolved* addresses are re-checked, since a public name
+ *      can resolve to a private address
+ *   3. redirects are followed manually, re-validating each hop, because a
+ *      permitted host can redirect into the private range
+ *   4. the response must be an allowed image type and is read under a byte cap
+ *
+ * This existed as a byte-identical copy in each app, so a fix to one would not
+ * have reached the other. DNS resolution is injected rather than imported: it
+ * is runtime-specific, and this package stays isomorphic.
+ *
+ * Note the remaining exposure: between resolving a hostname and fetching it,
+ * the name could resolve differently (DNS rebinding). Closing that needs the
+ * fetch pinned to the address already checked, which the platform fetch does
+ * not expose. The content-type allowlist and byte cap bound what an attacker
+ * gets if they win that race.
+ */
+interface ImageProxyConfig {
+    checkRateLimit: (ip: string) => boolean;
+    /** Returns every address a hostname resolves to. Injected; see above. */
+    resolveHostname: (hostname: string) => Promise<string[]>;
+    fetchImpl?: typeof fetch;
+    userAgent?: string;
+}
+interface CappedBody {
+    ok: boolean;
+    body?: Uint8Array;
+    error?: string;
+    status?: number;
+}
+/** Reads a response body, refusing anything past `maxBytes` rather than buffering it. */
+declare function readBodyWithCap(res: Response, maxBytes: number): Promise<CappedBody>;
+declare function createImageProxyHandler(config: ImageProxyConfig): (req: Request) => Promise<Response>;
 
 interface BackendMetadataConfig {
     backendUrl: string;
@@ -525,8 +573,20 @@ declare function uploadDirectoryToBackend(config: BackendMetadataConfig, files:
 declare function getBackendSignedUrl(config: BackendMetadataConfig, kind?: "image" | "document" | "media"): Promise<string>;
 
 declare function createRateLimiter(windowMs: number, max: number): (key: string) => boolean;
+declare const TRUSTED_APP_IP_HEADER = "x-medialane-client-ip";
 declare function requestIp(req: Request): string;
 
+/**
+ * Same-origin guard for server routes. A missing `Origin` header is allowed,
+ * because same-origin navigations and server-to-server calls do not send one;
+ * a present `Origin` must match `Host`.
+ *
+ * Read that carefully before relying on it: this blocks cross-site *browser*
+ * abuse, and nothing else. A non-browser client simply omits `Origin` and
+ * passes. It is not a substitute for authentication, and on a route that
+ * spends money or credits it must be paired with a rate limit and, where the
+ * route touches a paid resource, real auth.
+ */
 declare function isSameOrigin(req: Request): boolean;
 
 declare const IDENTITY_TTL_SECONDS = 86400;
@@ -596,4 +656,4 @@ declare const IPFS_SAFE_CONTENT_TYPE_PREFIXES: readonly ["image/jpeg", "image/pn
 declare function resolveSafeImageContentType(contentType: string): string;
 declare const MAX_IPFS_GATEWAY_RESPONSE_BYTES: number;
 
-export { ACCOUNT_SESSION_TTL_SECONDS, ALLOWED_IMAGE_CONTENT_TYPES, type AssetAttribute, type AssetMetadata, type BackendMetadataConfig, type BackendProxyConfig, type BackendUploadResult, type BuildAssetMetadataInput, type CanonicalHash, Chain, DEFAULT_CURRENCY, type FailoverFetchOptions, type FeeEnv, IDENTITY_TTL_SECONDS, IPFS_SAFE_CONTENT_TYPE_PREFIXES, MAX_IMAGE_PROXY_BYTES, MAX_IMAGE_REDIRECTS, MAX_IPFS_GATEWAY_RESPONSE_BYTES, PAID_UPSTREAM_MARKERS, POLICY_REFUSAL_CODES, PUBLIC_RPC_FALLBACKS, RESERVED_TRAITS, type RemixPolicy, type RemixPolicyInput, ResolvedFeeConfig, type RpcProxyConfig, STARKNET_COLLECTION_1155_CLASS_HASH, STARKNET_COLLECTION_1155_CONTRACT, STARKNET_COLLECTION_1155_FACTORY_CLASS_HASH, STARKNET_COLLECTION_1155_START_BLOCK, STARKNET_COLLECTION_721_CONTRACT, STARKNET_COLLECTION_721_START_BLOCK, STARKNET_CREATOR_COIN_CLASS_HASH, STARKNET_CREATOR_COIN_EKUBO_LAUNCHER, STARKNET_CREATOR_COIN_FACTORY_CLASS_HASH, STARKNET_CREATOR_COIN_FACTORY_CONTRACT, STARKNET_CREATOR_COIN_START_BLOCK, STARKNET_DROP_COLLECTION_CLASS_HASH, STARKNET_DROP_FACTORY_CONTRACT, STARKNET_EKUBO_CORE, STARKNET_GENESIS_MINT_BR_CONTRACT, STARKNET_GENESIS_MINT_GLOBAL_CONTRACT, STARKNET_GENESIS_MINT_LAUNCH_CONTRACT, STARKNET_IPCOLLECTION_CLASS_HASH, STARKNET_IPNFT_CLASS_HASH, STARKNET_IP_CLUB_COLLECTION_CLASS_HASH, STARKNET_IP_CLUB_FACTORY_CONTRACT, STARKNET_IP_SPONSORSHIP_CLASS_HASH, STARKNET_IP_SPONSORSHIP_CONTRACT, STARKNET_IP_TICKETS_FACTORY_CONTRACT, STARKNET_IP_TICKET_COLLECTION_CLASS_HASH, STARKNET_MARKETPLACE_1155_CLASS_HASH, STARKNET_MARKETPLACE_1155_CONTRACT, STARKNET_MARKETPLACE_1155_START_BLOCK, STARKNET_MARKETPLACE_721_CLASS_HASH, STARKNET_MARKETPLACE_721_CONTRACT, STARKNET_MARKETPLACE_721_START_BLOCK, STARKNET_NFTCOMMENTS_CONTRACT, STARKNET_POP_COLLECTION_CLASS_HASH, STARKNET_POP_FACTORY_CONTRACT, SUPPORTED_TOKENS, SUPPORTED_URL_CHAINS, ServiceCapability, ServiceDefinition, type ServiceId, type SiwsIdentity, type SupportedToken, type SupportedTokenSymbol, assetHref, buildAssetMetadata, chainFromSlug, chainSlug, coinHref, collectionHref, createBackendProxyHandler, createFailoverFetch, createRateLimiter, createRpcProxyHandler, encodeU256, formatAmount, getBackendSignedUrl, getDerivativesTerm, getListableTokens, getService, getServicesByCapability, getTokenByAddress, getTokenBySymbol, hasCapability, isPolicyRefusal, isPrivateHost, isSameOrigin, isServiceId, isTransientRpcError, isValidIpfsCidPath, issueAccountSessionToken, issueSiwsToken, listServices, normalizeAddress, normalizeHash, parseAmount, requestIp, resolveAppFeeConfig, resolveRemixPolicy, resolveSafeImageContentType, shortenAddress, stringifyBigInts, u256ToBigInt, uploadDirectoryToBackend, uploadFileToBackend, uploadJsonToBackend, validateUrl, verifyAccountSessionToken, verifySiwsToken };
+export { ACCOUNT_SESSION_TTL_SECONDS, ALLOWED_IMAGE_CONTENT_TYPES, type AssetAttribute, type AssetMetadata, type BackendMetadataConfig, type BackendProxyConfig, type BackendUploadResult, type BuildAssetMetadataInput, type CanonicalHash, type CappedBody, Chain, DEFAULT_CURRENCY, type FailoverFetchOptions, type FeeEnv, IDENTITY_TTL_SECONDS, IPFS_SAFE_CONTENT_TYPE_PREFIXES, type ImageProxyConfig, MAX_IMAGE_PROXY_BYTES, MAX_IMAGE_REDIRECTS, MAX_IPFS_GATEWAY_RESPONSE_BYTES, PAID_UPSTREAM_MARKERS, POLICY_REFUSAL_CODES, PUBLIC_RPC_FALLBACKS, RESERVED_TRAITS, type RemixPolicy, type RemixPolicyInput, ResolvedFeeConfig, type RpcProxyConfig, STARKNET_COLLECTION_1155_CLASS_HASH, STARKNET_COLLECTION_1155_CONTRACT, STARKNET_COLLECTION_1155_FACTORY_CLASS_HASH, STARKNET_COLLECTION_1155_START_BLOCK, STARKNET_COLLECTION_721_CONTRACT, STARKNET_COLLECTION_721_START_BLOCK, STARKNET_CREATOR_COIN_CLASS_HASH, STARKNET_CREATOR_COIN_EKUBO_LAUNCHER, STARKNET_CREATOR_COIN_FACTORY_CLASS_HASH, STARKNET_CREATOR_COIN_FACTORY_CONTRACT, STARKNET_CREATOR_COIN_START_BLOCK, STARKNET_DROP_COLLECTION_CLASS_HASH, STARKNET_DROP_FACTORY_CONTRACT, STARKNET_EKUBO_CORE, STARKNET_GENESIS_MINT_BR_CONTRACT, STARKNET_GENESIS_MINT_GLOBAL_CONTRACT, STARKNET_GENESIS_MINT_LAUNCH_CONTRACT, STARKNET_IPCOLLECTION_CLASS_HASH, STARKNET_IPNFT_CLASS_HASH, STARKNET_IP_CLUB_COLLECTION_CLASS_HASH, STARKNET_IP_CLUB_FACTORY_CONTRACT, STARKNET_IP_SPONSORSHIP_CLASS_HASH, STARKNET_IP_SPONSORSHIP_CONTRACT, STARKNET_IP_TICKETS_FACTORY_CONTRACT, STARKNET_IP_TICKET_COLLECTION_CLASS_HASH, STARKNET_MARKETPLACE_1155_CLASS_HASH, STARKNET_MARKETPLACE_1155_CONTRACT, STARKNET_MARKETPLACE_1155_START_BLOCK, STARKNET_MARKETPLACE_721_CLASS_HASH, STARKNET_MARKETPLACE_721_CONTRACT, STARKNET_MARKETPLACE_721_START_BLOCK, STARKNET_NFTCOMMENTS_CONTRACT, STARKNET_POP_COLLECTION_CLASS_HASH, STARKNET_POP_FACTORY_CONTRACT, SUPPORTED_TOKENS, SUPPORTED_URL_CHAINS, ServiceCapability, ServiceDefinition, type ServiceId, type SiwsIdentity, type SupportedToken, type SupportedTokenSymbol, TRUSTED_APP_IP_HEADER, assetHref, buildAssetMetadata, chainFromSlug, chainSlug, coinHref, collectionHref, createBackendProxyHandler, createFailoverFetch, createImageProxyHandler, createRateLimiter, createRpcProxyHandler, encodeU256, formatAmount, getBackendSignedUrl, getDerivativesTerm, getListableTokens, getService, getServicesByCapability, getTokenByAddress, getTokenBySymbol, hasCapability, isPolicyRefusal, isPrivateHost, isPrivateOrInsecureUrl, isSameOrigin, isServiceId, isTransientRpcError, isValidIpfsCidPath, issueAccountSessionToken, issueSiwsToken, listServices, normalizeAddress, normalizeHash, parseAmount, readBodyWithCap, requestIp, resolveAppFeeConfig, resolveRemixPolicy, resolveSafeImageContentType, shortenAddress, stringifyBigInts, u256ToBigInt, uploadDirectoryToBackend, uploadFileToBackend, uploadJsonToBackend, validateUrl, verifyAccountSessionToken, verifySiwsToken };

package/dist/index.d.ts

@@ -497,12 +497,60 @@ declare const ALLOWED_IMAGE_CONTENT_TYPES: Set<string>;
 declare const MAX_IMAGE_REDIRECTS = 5;
 declare const MAX_IMAGE_PROXY_BYTES: number;
 declare function isPrivateHost(hostname: string): boolean;
-declare function validateUrl(raw: string): {
+/**
+ * Validates a URL before it is fetched server-side. `requireHttps` is on by
+ * default; callers that legitimately accept plain http (a metadata URI already
+ * committed on chain, say) opt out explicitly rather than the guard being
+ * lenient for everyone.
+ */
+declare function validateUrl(raw: string, options?: {
+    requireHttps?: boolean;
+}): {
     url: URL;
 } | {
     error: string;
     status: number;
 };
+/** Convenience for callers that only need a yes/no, mirroring the backend's prior helper. */
+declare function isPrivateOrInsecureUrl(raw: string, requireHttps?: boolean): boolean;
+
+/**
+ * Proxies a remote image, which means fetching a URL an untrusted caller chose
+ * — the classic SSRF shape. Guarded in four places, each of which has to hold:
+ *
+ *   1. the URL is https, credential-free and not a private host
+ *   2. the hostname's *resolved* addresses are re-checked, since a public name
+ *      can resolve to a private address
+ *   3. redirects are followed manually, re-validating each hop, because a
+ *      permitted host can redirect into the private range
+ *   4. the response must be an allowed image type and is read under a byte cap
+ *
+ * This existed as a byte-identical copy in each app, so a fix to one would not
+ * have reached the other. DNS resolution is injected rather than imported: it
+ * is runtime-specific, and this package stays isomorphic.
+ *
+ * Note the remaining exposure: between resolving a hostname and fetching it,
+ * the name could resolve differently (DNS rebinding). Closing that needs the
+ * fetch pinned to the address already checked, which the platform fetch does
+ * not expose. The content-type allowlist and byte cap bound what an attacker
+ * gets if they win that race.
+ */
+interface ImageProxyConfig {
+    checkRateLimit: (ip: string) => boolean;
+    /** Returns every address a hostname resolves to. Injected; see above. */
+    resolveHostname: (hostname: string) => Promise<string[]>;
+    fetchImpl?: typeof fetch;
+    userAgent?: string;
+}
+interface CappedBody {
+    ok: boolean;
+    body?: Uint8Array;
+    error?: string;
+    status?: number;
+}
+/** Reads a response body, refusing anything past `maxBytes` rather than buffering it. */
+declare function readBodyWithCap(res: Response, maxBytes: number): Promise<CappedBody>;
+declare function createImageProxyHandler(config: ImageProxyConfig): (req: Request) => Promise<Response>;
 
 interface BackendMetadataConfig {
     backendUrl: string;
@@ -525,8 +573,20 @@ declare function uploadDirectoryToBackend(config: BackendMetadataConfig, files:
 declare function getBackendSignedUrl(config: BackendMetadataConfig, kind?: "image" | "document" | "media"): Promise<string>;
 
 declare function createRateLimiter(windowMs: number, max: number): (key: string) => boolean;
+declare const TRUSTED_APP_IP_HEADER = "x-medialane-client-ip";
 declare function requestIp(req: Request): string;
 
+/**
+ * Same-origin guard for server routes. A missing `Origin` header is allowed,
+ * because same-origin navigations and server-to-server calls do not send one;
+ * a present `Origin` must match `Host`.
+ *
+ * Read that carefully before relying on it: this blocks cross-site *browser*
+ * abuse, and nothing else. A non-browser client simply omits `Origin` and
+ * passes. It is not a substitute for authentication, and on a route that
+ * spends money or credits it must be paired with a rate limit and, where the
+ * route touches a paid resource, real auth.
+ */
 declare function isSameOrigin(req: Request): boolean;
 
 declare const IDENTITY_TTL_SECONDS = 86400;
@@ -596,4 +656,4 @@ declare const IPFS_SAFE_CONTENT_TYPE_PREFIXES: readonly ["image/jpeg", "image/pn
 declare function resolveSafeImageContentType(contentType: string): string;
 declare const MAX_IPFS_GATEWAY_RESPONSE_BYTES: number;
 
-export { ACCOUNT_SESSION_TTL_SECONDS, ALLOWED_IMAGE_CONTENT_TYPES, type AssetAttribute, type AssetMetadata, type BackendMetadataConfig, type BackendProxyConfig, type BackendUploadResult, type BuildAssetMetadataInput, type CanonicalHash, Chain, DEFAULT_CURRENCY, type FailoverFetchOptions, type FeeEnv, IDENTITY_TTL_SECONDS, IPFS_SAFE_CONTENT_TYPE_PREFIXES, MAX_IMAGE_PROXY_BYTES, MAX_IMAGE_REDIRECTS, MAX_IPFS_GATEWAY_RESPONSE_BYTES, PAID_UPSTREAM_MARKERS, POLICY_REFUSAL_CODES, PUBLIC_RPC_FALLBACKS, RESERVED_TRAITS, type RemixPolicy, type RemixPolicyInput, ResolvedFeeConfig, type RpcProxyConfig, STARKNET_COLLECTION_1155_CLASS_HASH, STARKNET_COLLECTION_1155_CONTRACT, STARKNET_COLLECTION_1155_FACTORY_CLASS_HASH, STARKNET_COLLECTION_1155_START_BLOCK, STARKNET_COLLECTION_721_CONTRACT, STARKNET_COLLECTION_721_START_BLOCK, STARKNET_CREATOR_COIN_CLASS_HASH, STARKNET_CREATOR_COIN_EKUBO_LAUNCHER, STARKNET_CREATOR_COIN_FACTORY_CLASS_HASH, STARKNET_CREATOR_COIN_FACTORY_CONTRACT, STARKNET_CREATOR_COIN_START_BLOCK, STARKNET_DROP_COLLECTION_CLASS_HASH, STARKNET_DROP_FACTORY_CONTRACT, STARKNET_EKUBO_CORE, STARKNET_GENESIS_MINT_BR_CONTRACT, STARKNET_GENESIS_MINT_GLOBAL_CONTRACT, STARKNET_GENESIS_MINT_LAUNCH_CONTRACT, STARKNET_IPCOLLECTION_CLASS_HASH, STARKNET_IPNFT_CLASS_HASH, STARKNET_IP_CLUB_COLLECTION_CLASS_HASH, STARKNET_IP_CLUB_FACTORY_CONTRACT, STARKNET_IP_SPONSORSHIP_CLASS_HASH, STARKNET_IP_SPONSORSHIP_CONTRACT, STARKNET_IP_TICKETS_FACTORY_CONTRACT, STARKNET_IP_TICKET_COLLECTION_CLASS_HASH, STARKNET_MARKETPLACE_1155_CLASS_HASH, STARKNET_MARKETPLACE_1155_CONTRACT, STARKNET_MARKETPLACE_1155_START_BLOCK, STARKNET_MARKETPLACE_721_CLASS_HASH, STARKNET_MARKETPLACE_721_CONTRACT, STARKNET_MARKETPLACE_721_START_BLOCK, STARKNET_NFTCOMMENTS_CONTRACT, STARKNET_POP_COLLECTION_CLASS_HASH, STARKNET_POP_FACTORY_CONTRACT, SUPPORTED_TOKENS, SUPPORTED_URL_CHAINS, ServiceCapability, ServiceDefinition, type ServiceId, type SiwsIdentity, type SupportedToken, type SupportedTokenSymbol, assetHref, buildAssetMetadata, chainFromSlug, chainSlug, coinHref, collectionHref, createBackendProxyHandler, createFailoverFetch, createRateLimiter, createRpcProxyHandler, encodeU256, formatAmount, getBackendSignedUrl, getDerivativesTerm, getListableTokens, getService, getServicesByCapability, getTokenByAddress, getTokenBySymbol, hasCapability, isPolicyRefusal, isPrivateHost, isSameOrigin, isServiceId, isTransientRpcError, isValidIpfsCidPath, issueAccountSessionToken, issueSiwsToken, listServices, normalizeAddress, normalizeHash, parseAmount, requestIp, resolveAppFeeConfig, resolveRemixPolicy, resolveSafeImageContentType, shortenAddress, stringifyBigInts, u256ToBigInt, uploadDirectoryToBackend, uploadFileToBackend, uploadJsonToBackend, validateUrl, verifyAccountSessionToken, verifySiwsToken };
+export { ACCOUNT_SESSION_TTL_SECONDS, ALLOWED_IMAGE_CONTENT_TYPES, type AssetAttribute, type AssetMetadata, type BackendMetadataConfig, type BackendProxyConfig, type BackendUploadResult, type BuildAssetMetadataInput, type CanonicalHash, type CappedBody, Chain, DEFAULT_CURRENCY, type FailoverFetchOptions, type FeeEnv, IDENTITY_TTL_SECONDS, IPFS_SAFE_CONTENT_TYPE_PREFIXES, type ImageProxyConfig, MAX_IMAGE_PROXY_BYTES, MAX_IMAGE_REDIRECTS, MAX_IPFS_GATEWAY_RESPONSE_BYTES, PAID_UPSTREAM_MARKERS, POLICY_REFUSAL_CODES, PUBLIC_RPC_FALLBACKS, RESERVED_TRAITS, type RemixPolicy, type RemixPolicyInput, ResolvedFeeConfig, type RpcProxyConfig, STARKNET_COLLECTION_1155_CLASS_HASH, STARKNET_COLLECTION_1155_CONTRACT, STARKNET_COLLECTION_1155_FACTORY_CLASS_HASH, STARKNET_COLLECTION_1155_START_BLOCK, STARKNET_COLLECTION_721_CONTRACT, STARKNET_COLLECTION_721_START_BLOCK, STARKNET_CREATOR_COIN_CLASS_HASH, STARKNET_CREATOR_COIN_EKUBO_LAUNCHER, STARKNET_CREATOR_COIN_FACTORY_CLASS_HASH, STARKNET_CREATOR_COIN_FACTORY_CONTRACT, STARKNET_CREATOR_COIN_START_BLOCK, STARKNET_DROP_COLLECTION_CLASS_HASH, STARKNET_DROP_FACTORY_CONTRACT, STARKNET_EKUBO_CORE, STARKNET_GENESIS_MINT_BR_CONTRACT, STARKNET_GENESIS_MINT_GLOBAL_CONTRACT, STARKNET_GENESIS_MINT_LAUNCH_CONTRACT, STARKNET_IPCOLLECTION_CLASS_HASH, STARKNET_IPNFT_CLASS_HASH, STARKNET_IP_CLUB_COLLECTION_CLASS_HASH, STARKNET_IP_CLUB_FACTORY_CONTRACT, STARKNET_IP_SPONSORSHIP_CLASS_HASH, STARKNET_IP_SPONSORSHIP_CONTRACT, STARKNET_IP_TICKETS_FACTORY_CONTRACT, STARKNET_IP_TICKET_COLLECTION_CLASS_HASH, STARKNET_MARKETPLACE_1155_CLASS_HASH, STARKNET_MARKETPLACE_1155_CONTRACT, STARKNET_MARKETPLACE_1155_START_BLOCK, STARKNET_MARKETPLACE_721_CLASS_HASH, STARKNET_MARKETPLACE_721_CONTRACT, STARKNET_MARKETPLACE_721_START_BLOCK, STARKNET_NFTCOMMENTS_CONTRACT, STARKNET_POP_COLLECTION_CLASS_HASH, STARKNET_POP_FACTORY_CONTRACT, SUPPORTED_TOKENS, SUPPORTED_URL_CHAINS, ServiceCapability, ServiceDefinition, type ServiceId, type SiwsIdentity, type SupportedToken, type SupportedTokenSymbol, TRUSTED_APP_IP_HEADER, assetHref, buildAssetMetadata, chainFromSlug, chainSlug, coinHref, collectionHref, createBackendProxyHandler, createFailoverFetch, createImageProxyHandler, createRateLimiter, createRpcProxyHandler, encodeU256, formatAmount, getBackendSignedUrl, getDerivativesTerm, getListableTokens, getService, getServicesByCapability, getTokenByAddress, getTokenBySymbol, hasCapability, isPolicyRefusal, isPrivateHost, isPrivateOrInsecureUrl, isSameOrigin, isServiceId, isTransientRpcError, isValidIpfsCidPath, issueAccountSessionToken, issueSiwsToken, listServices, normalizeAddress, normalizeHash, parseAmount, readBodyWithCap, requestIp, resolveAppFeeConfig, resolveRemixPolicy, resolveSafeImageContentType, shortenAddress, stringifyBigInts, u256ToBigInt, uploadDirectoryToBackend, uploadFileToBackend, uploadJsonToBackend, validateUrl, verifyAccountSessionToken, verifySiwsToken };

package/dist/index.js

@@ -1375,8 +1375,19 @@ function createRateLimiter(windowMs, max) {
     return true;
   };
 }
+var TRUSTED_APP_IP_HEADER = "x-medialane-client-ip";
 function requestIp(req) {
-  return req.headers.get("x-forwarded-for")?.split(",")[0].trim() ?? "unknown";
+  const fromApp = req.headers.get(TRUSTED_APP_IP_HEADER)?.trim();
+  if (fromApp) return fromApp;
+  const fromEdge = req.headers.get("x-vercel-forwarded-for")?.split(",")[0]?.trim();
+  if (fromEdge) return fromEdge;
+  const forwarded = req.headers.get("x-forwarded-for");
+  if (forwarded) {
+    const hops = forwarded.split(",").map((hop) => hop.trim()).filter(Boolean);
+    const nearest = hops[hops.length - 1];
+    if (nearest) return nearest;
+  }
+  return "unknown";
 }
 
 // src/server/origin.ts
@@ -1465,43 +1476,135 @@ var ALLOWED_IMAGE_CONTENT_TYPES = /* @__PURE__ */ new Set([
 ]);
 var MAX_IMAGE_REDIRECTS = 5;
 var MAX_IMAGE_PROXY_BYTES = 15 * 1024 * 1024;
+function parseIpv4(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  const bytes = [];
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return null;
+    const n = Number(part);
+    if (n > 255) return null;
+    bytes.push(n);
+  }
+  return bytes;
+}
+function isPrivateIpv4(bytes) {
+  const a = bytes[0];
+  const b = bytes[1];
+  const c = bytes[2];
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 0 && c === 0) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a >= 224) return true;
+  return false;
+}
+function expandIpv6(rawIp) {
+  let ip = rawIp;
+  let embeddedV4 = null;
+  const v4Tail = ip.match(/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+  if (v4Tail && ip.includes(":")) {
+    embeddedV4 = parseIpv4(v4Tail[1]);
+    if (!embeddedV4) return null;
+    ip = ip.slice(0, ip.length - v4Tail[1].length) + "0:0";
+  }
+  const sides = ip.split("::");
+  if (sides.length > 2) return null;
+  const head = sides[0] ? sides[0].split(":").filter(Boolean) : [];
+  const tail = sides.length === 2 && sides[1] ? sides[1].split(":").filter(Boolean) : [];
+  let groups;
+  if (sides.length === 1) {
+    groups = head;
+    if (groups.length !== 8) return null;
+  } else {
+    const missing = 8 - head.length - tail.length;
+    if (missing < 0) return null;
+    groups = [...head, ...Array(missing).fill("0"), ...tail];
+  }
+  if (groups.length !== 8) return null;
+  const bytes = [];
+  for (const group of groups) {
+    if (!/^[0-9a-fA-F]{1,4}$/.test(group)) return null;
+    const n = parseInt(group, 16);
+    bytes.push(n >> 8 & 255, n & 255);
+  }
+  if (embeddedV4) {
+    bytes[12] = embeddedV4[0];
+    bytes[13] = embeddedV4[1];
+    bytes[14] = embeddedV4[2];
+    bytes[15] = embeddedV4[3];
+  }
+  return bytes;
+}
+function isPrivateIpv6(bytes) {
+  if (bytes.every((b) => b === 0)) return true;
+  if (bytes.slice(0, 15).every((b) => b === 0) && bytes[15] === 1) return true;
+  if ((bytes[0] & 254) === 252) return true;
+  if (bytes[0] === 254 && (bytes[1] & 192) === 128) return true;
+  if (bytes.slice(0, 10).every((b) => b === 0) && bytes[10] === 255 && bytes[11] === 255) {
+    return isPrivateIpv4(bytes.slice(12));
+  }
+  return false;
+}
+function parseNumber(part) {
+  if (/^0x[0-9a-f]+$/i.test(part)) return parseInt(part.slice(2), 16);
+  if (/^0[0-7]+$/.test(part)) return parseInt(part, 8);
+  if (/^\d+$/.test(part)) return parseInt(part, 10);
+  return null;
+}
+function normalizeNumericHostname(host) {
+  const parts = host.trim().split(".");
+  if (parts.length < 1 || parts.length > 4) return null;
+  const values = [];
+  for (const part of parts) {
+    const value = parseNumber(part);
+    if (value === null || value < 0) return null;
+    values.push(value);
+  }
+  const leading = values.slice(0, -1);
+  if (leading.some((v) => v > 255)) return null;
+  const tail = values[values.length - 1];
+  const tailBytes = 4 - leading.length;
+  if (tail > 2 ** (8 * tailBytes) - 1) return null;
+  const bytes = [...leading];
+  for (let i = tailBytes - 1; i >= 0; i--) bytes.push(tail >>> 8 * i & 255);
+  return bytes.join(".");
+}
+var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
+  "localhost",
+  "metadata.google.internal",
+  "metadata.azure.internal"
+]);
 function isPrivateHost(hostname) {
-  const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  if (h === "localhost" || h === "127.0.0.1" || h === "0.0.0.0") return true;
-  if (/^\d+$/.test(h)) {
-    const n = parseInt(h, 10);
-    if (n === 2130706433 || n === 0 || n >= 2886729728 && n <= 2887778303 || n >= 3232235520 && n <= 3232301055 || n >= 167772160 && n <= 184549375 || n >= 2851995648 && n <= 2852061183) return true;
-  }
-  if (/^0x[0-9a-f]+$/i.test(h)) {
-    const n = parseInt(h, 16);
-    if (n === 2130706433 || n === 0 || n >= 2886729728 && n <= 2887778303 || n >= 3232235520 && n <= 3232301055 || n >= 167772160 && n <= 184549375 || n >= 2851995648 && n <= 2852061183) return true;
-  }
-  if (/^0\d+\.\d+\.\d+\.\d+$/.test(h)) return true;
-  if (h === "::1" || /^0*:0*:0*:0*:0*:0*:0*:0*1$/.test(h)) return true;
-  const v4mapped = h.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
-  if (v4mapped) return isPrivateHost(v4mapped[1]);
-  if (/^10\./.test(h)) return true;
-  if (/^172\.(1[6-9]|2\d|3[01])\./.test(h)) return true;
-  if (/^192\.168\./.test(h)) return true;
-  if (/^169\.254\./.test(h)) return true;
-  if (/^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./.test(h)) return true;
-  if (/^fe80:/i.test(h)) return true;
-  if (/^f[cd][0-9a-f]{2}:/i.test(h)) return true;
-  if (h.endsWith(".local")) return true;
-  if (h === "metadata.google.internal") return true;
-  if (h === "metadata.azure.internal") return true;
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (BLOCKED_HOSTNAMES.has(host)) return true;
+  if (host.endsWith(".local") || host.endsWith(".internal")) return true;
+  const candidate = normalizeNumericHostname(host) ?? host;
+  const v4 = parseIpv4(candidate);
+  if (v4) return isPrivateIpv4(v4);
+  const v6 = expandIpv6(candidate);
+  if (v6) return isPrivateIpv6(v6);
   return false;
 }
-function validateUrl(raw) {
+function validateUrl(raw, options = {}) {
+  const requireHttps = options.requireHttps ?? true;
   let parsed;
   try {
     parsed = new URL(raw);
   } catch {
     return { error: "Invalid url", status: 400 };
   }
-  if (parsed.protocol !== "https:") {
+  if (requireHttps && parsed.protocol !== "https:") {
     return { error: "Only https URLs allowed", status: 400 };
   }
+  if (!requireHttps && parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    return { error: "Only http and https URLs allowed", status: 400 };
+  }
   if (parsed.username || parsed.password) {
     return { error: "URL credentials not allowed", status: 400 };
   }
@@ -1510,6 +1613,111 @@ function validateUrl(raw) {
   }
   return { url: parsed };
 }
+function isPrivateOrInsecureUrl(raw, requireHttps = true) {
+  return "error" in validateUrl(raw, { requireHttps });
+}
+
+// src/server/image-proxy.ts
+var DEFAULT_USER_AGENT = "Mozilla/5.0 (compatible; Medialane/1.0; +https://www.medialane.io)";
+function jsonError(message, status) {
+  return Response.json({ error: message }, { status });
+}
+async function readBodyWithCap(res, maxBytes) {
+  const declared = Number(res.headers.get("content-length") ?? 0);
+  if (declared > maxBytes) {
+    return { ok: false, error: "Image too large", status: 413 };
+  }
+  const reader = res.body?.getReader();
+  if (!reader) return { ok: false, error: "Empty response body", status: 502 };
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!value) continue;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel().catch(() => {
+      });
+      return { ok: false, error: "Image too large", status: 413 };
+    }
+    chunks.push(value);
+  }
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return { ok: true, body };
+}
+function createImageProxyHandler(config) {
+  const doFetch = config.fetchImpl ?? fetch;
+  const userAgent = config.userAgent ?? DEFAULT_USER_AGENT;
+  async function resolvesToPrivateHost(hostname) {
+    try {
+      const addresses = await config.resolveHostname(hostname);
+      if (addresses.length === 0) return true;
+      return addresses.some((address) => isPrivateHost(address));
+    } catch {
+      return true;
+    }
+  }
+  async function safeFetch(url, hopsLeft) {
+    if (hopsLeft < 0) throw new Error("Too many redirects");
+    if (await resolvesToPrivateHost(url.hostname)) {
+      throw new Error("Blocked: hostname resolves to a private address");
+    }
+    const res = await doFetch(url.toString(), {
+      redirect: "manual",
+      headers: { "User-Agent": userAgent }
+    });
+    if (res.status >= 300 && res.status < 400) {
+      const location = res.headers.get("location");
+      if (!location) throw new Error("Redirect with no Location header");
+      const next = new URL(location, url);
+      const validated = validateUrl(next.toString());
+      if ("error" in validated) throw new Error(`Redirect blocked: ${validated.error}`);
+      return safeFetch(validated.url, hopsLeft - 1);
+    }
+    return res;
+  }
+  return async function handleImageProxy(req) {
+    if (!config.checkRateLimit(requestIp(req))) {
+      return jsonError("Too many requests", 429);
+    }
+    const raw = new URL(req.url).searchParams.get("url");
+    if (!raw) return jsonError("Missing url", 400);
+    const validated = validateUrl(raw);
+    if ("error" in validated) return jsonError(validated.error, validated.status);
+    let upstream;
+    try {
+      upstream = await safeFetch(validated.url, MAX_IMAGE_REDIRECTS);
+    } catch {
+      return jsonError("Failed to fetch image", 502);
+    }
+    if (!upstream.ok) {
+      return jsonError(`Upstream returned ${upstream.status}`, upstream.status);
+    }
+    const contentType = upstream.headers.get("content-type") ?? "";
+    const baseType = contentType.split(";")[0].trim().toLowerCase();
+    if (!ALLOWED_IMAGE_CONTENT_TYPES.has(baseType)) {
+      return jsonError("Not an image", 400);
+    }
+    const capped = await readBodyWithCap(upstream, MAX_IMAGE_PROXY_BYTES);
+    if (!capped.ok) return jsonError(capped.error, capped.status);
+    return new Response(capped.body, {
+      status: 200,
+      headers: {
+        "Content-Type": contentType,
+        "X-Content-Type-Options": "nosniff",
+        "Content-Security-Policy": "default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'; sandbox",
+        "Cache-Control": "public, max-age=86400, s-maxage=86400, stale-while-revalidate=604800",
+        "Access-Control-Allow-Origin": "*"
+      }
+    });
+  };
+}
 
 // src/server/backend-metadata.ts
 function endpoint(config, path) {
@@ -1728,6 +1936,6 @@ function resolveSafeImageContentType(contentType) {
 }
 var MAX_IPFS_GATEWAY_RESPONSE_BYTES = 25 * 1024 * 1024;
 
-export { ACCOUNT_SESSION_TTL_SECONDS, ALLOWED_IMAGE_CONTENT_TYPES, ApiClient, CHAINS, DEFAULT_CHAIN, DEFAULT_CURRENCY, FeeConfigSchema, IDENTITY_TTL_SECONDS, IPFS_SAFE_CONTENT_TYPE_PREFIXES, MAX_IMAGE_PROXY_BYTES, MAX_IMAGE_REDIRECTS, MAX_IPFS_GATEWAY_RESPONSE_BYTES, MedialaneApiError, OPEN_LICENSES, PAID_UPSTREAM_MARKERS, POLICY_REFUSAL_CODES, PUBLIC_RPC_FALLBACKS, RESERVED_TRAITS, STARKNET_COLLECTION_1155_CLASS_HASH, STARKNET_COLLECTION_1155_CONTRACT, STARKNET_COLLECTION_1155_FACTORY_CLASS_HASH, STARKNET_COLLECTION_1155_START_BLOCK, STARKNET_COLLECTION_721_CONTRACT, STARKNET_COLLECTION_721_START_BLOCK, STARKNET_CREATOR_COIN_CLASS_HASH, STARKNET_CREATOR_COIN_EKUBO_LAUNCHER, STARKNET_CREATOR_COIN_FACTORY_CLASS_HASH, STARKNET_CREATOR_COIN_FACTORY_CONTRACT, STARKNET_CREATOR_COIN_START_BLOCK, STARKNET_DROP_COLLECTION_CLASS_HASH, STARKNET_DROP_FACTORY_CONTRACT, STARKNET_EKUBO_CORE, STARKNET_GENESIS_MINT_BR_CONTRACT, STARKNET_GENESIS_MINT_GLOBAL_CONTRACT, STARKNET_GENESIS_MINT_LAUNCH_CONTRACT, STARKNET_IPCOLLECTION_CLASS_HASH, STARKNET_IPNFT_CLASS_HASH, STARKNET_IP_CLUB_COLLECTION_CLASS_HASH, STARKNET_IP_CLUB_FACTORY_CONTRACT, STARKNET_IP_SPONSORSHIP_CLASS_HASH, STARKNET_IP_SPONSORSHIP_CONTRACT, STARKNET_IP_TICKETS_FACTORY_CONTRACT, STARKNET_IP_TICKET_COLLECTION_CLASS_HASH, STARKNET_MARKETPLACE_1155_CLASS_HASH, STARKNET_MARKETPLACE_1155_CONTRACT, STARKNET_MARKETPLACE_1155_START_BLOCK, STARKNET_MARKETPLACE_721_CLASS_HASH, STARKNET_MARKETPLACE_721_CONTRACT, STARKNET_MARKETPLACE_721_START_BLOCK, STARKNET_NFTCOMMENTS_CONTRACT, STARKNET_POP_COLLECTION_CLASS_HASH, STARKNET_POP_FACTORY_CONTRACT, SUPPORTED_TOKENS, SUPPORTED_URL_CHAINS, assetHref, buildAssetMetadata, chainFromSlug, chainSlug, coinHref, collectionHref, createBackendProxyHandler, createFailoverFetch, createRateLimiter, createRpcProxyHandler, encodeU256, formatAmount, getBackendSignedUrl, getCoordinates, getDerivativesTerm, getListableTokens, getService, getServicesByCapability, getStarknetCoordinates, getTokenByAddress, getTokenBySymbol, hasCapability, isPolicyRefusal, isPrivateHost, isSameOrigin, isServiceId, isTransientRpcError, isValidIpfsCidPath, issueAccountSessionToken, issueSiwsToken, listServices, normalizeAddress, normalizeHash, parseAmount, requestIp, resolveAppFeeConfig, resolveConfig, resolveFeeConfig, resolveRemixPolicy, resolveSafeImageContentType, shortenAddress, stringifyBigInts, u256ToBigInt, uploadDirectoryToBackend, uploadFileToBackend, uploadJsonToBackend, validateUrl, verifyAccountSessionToken, verifySiwsToken };
+export { ACCOUNT_SESSION_TTL_SECONDS, ALLOWED_IMAGE_CONTENT_TYPES, ApiClient, CHAINS, DEFAULT_CHAIN, DEFAULT_CURRENCY, FeeConfigSchema, IDENTITY_TTL_SECONDS, IPFS_SAFE_CONTENT_TYPE_PREFIXES, MAX_IMAGE_PROXY_BYTES, MAX_IMAGE_REDIRECTS, MAX_IPFS_GATEWAY_RESPONSE_BYTES, MedialaneApiError, OPEN_LICENSES, PAID_UPSTREAM_MARKERS, POLICY_REFUSAL_CODES, PUBLIC_RPC_FALLBACKS, RESERVED_TRAITS, STARKNET_COLLECTION_1155_CLASS_HASH, STARKNET_COLLECTION_1155_CONTRACT, STARKNET_COLLECTION_1155_FACTORY_CLASS_HASH, STARKNET_COLLECTION_1155_START_BLOCK, STARKNET_COLLECTION_721_CONTRACT, STARKNET_COLLECTION_721_START_BLOCK, STARKNET_CREATOR_COIN_CLASS_HASH, STARKNET_CREATOR_COIN_EKUBO_LAUNCHER, STARKNET_CREATOR_COIN_FACTORY_CLASS_HASH, STARKNET_CREATOR_COIN_FACTORY_CONTRACT, STARKNET_CREATOR_COIN_START_BLOCK, STARKNET_DROP_COLLECTION_CLASS_HASH, STARKNET_DROP_FACTORY_CONTRACT, STARKNET_EKUBO_CORE, STARKNET_GENESIS_MINT_BR_CONTRACT, STARKNET_GENESIS_MINT_GLOBAL_CONTRACT, STARKNET_GENESIS_MINT_LAUNCH_CONTRACT, STARKNET_IPCOLLECTION_CLASS_HASH, STARKNET_IPNFT_CLASS_HASH, STARKNET_IP_CLUB_COLLECTION_CLASS_HASH, STARKNET_IP_CLUB_FACTORY_CONTRACT, STARKNET_IP_SPONSORSHIP_CLASS_HASH, STARKNET_IP_SPONSORSHIP_CONTRACT, STARKNET_IP_TICKETS_FACTORY_CONTRACT, STARKNET_IP_TICKET_COLLECTION_CLASS_HASH, STARKNET_MARKETPLACE_1155_CLASS_HASH, STARKNET_MARKETPLACE_1155_CONTRACT, STARKNET_MARKETPLACE_1155_START_BLOCK, STARKNET_MARKETPLACE_721_CLASS_HASH, STARKNET_MARKETPLACE_721_CONTRACT, STARKNET_MARKETPLACE_721_START_BLOCK, STARKNET_NFTCOMMENTS_CONTRACT, STARKNET_POP_COLLECTION_CLASS_HASH, STARKNET_POP_FACTORY_CONTRACT, SUPPORTED_TOKENS, SUPPORTED_URL_CHAINS, TRUSTED_APP_IP_HEADER, assetHref, buildAssetMetadata, chainFromSlug, chainSlug, coinHref, collectionHref, createBackendProxyHandler, createFailoverFetch, createImageProxyHandler, createRateLimiter, createRpcProxyHandler, encodeU256, formatAmount, getBackendSignedUrl, getCoordinates, getDerivativesTerm, getListableTokens, getService, getServicesByCapability, getStarknetCoordinates, getTokenByAddress, getTokenBySymbol, hasCapability, isPolicyRefusal, isPrivateHost, isPrivateOrInsecureUrl, isSameOrigin, isServiceId, isTransientRpcError, isValidIpfsCidPath, issueAccountSessionToken, issueSiwsToken, listServices, normalizeAddress, normalizeHash, parseAmount, readBodyWithCap, requestIp, resolveAppFeeConfig, resolveConfig, resolveFeeConfig, resolveRemixPolicy, resolveSafeImageContentType, shortenAddress, stringifyBigInts, u256ToBigInt, uploadDirectoryToBackend, uploadFileToBackend, uploadJsonToBackend, validateUrl, verifyAccountSessionToken, verifySiwsToken };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map