@melra/policy-core 0.3.0-alpha.11 → 0.3.0-alpha.13

package/dist/network-policy.d.ts

@@ -1,3 +1,4 @@
+import { type LookupFunction } from "node:net";
 export declare function isPrivateAddress(address: string): boolean;
 export interface NetworkPolicy {
     allowedDomains: string[];
@@ -19,10 +20,19 @@ export interface NetworkPolicy {
  */
 export interface SafeDestination {
     url: URL;
-    /** The literal address to open the socket to: the host itself when it was
-     * already an IP, otherwise the resolver answer this check accepted. */
-    address: string;
+    /** The host to connect to: the name, or an IP literal without brackets. */
+    host: string;
+    /**
+     * A `lookup` for `net`/`http`/`https` that answers only with the addresses
+     * this check accepted, so the socket never resolves the name again. Every
+     * answer is offered, not just the first, so Node can fall back between them:
+     * `localhost` answering `::1` first must still reach a server that listens
+     * only on 127.0.0.1.
+     */
+    lookup: LookupFunction;
 }
+/** The URL's host, lowercased, with an IPv6 literal's brackets removed. */
+export declare function hostOf(url: URL): string;
 export declare function assertSafeDestination(rawUrl: string, policy: NetworkPolicy): Promise<SafeDestination>;
 export declare function assertSafeUrl(rawUrl: string, policy: NetworkPolicy): Promise<URL>;
 //# sourceMappingURL=network-policy.d.ts.map

package/dist/network-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network-policy.d.ts","sourceRoot":"","sources":["../src/network-policy.ts"],"names":[],"mappings":"AAqCA,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAkCzD;AASD,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAWD;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,GAAG,CAAC;IACT;2EACuE;IACvE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,eAAe,CAAC,CA0C1B;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,GAAG,CAAC,CAEd"}
+{"version":3,"file":"network-policy.d.ts","sourceRoot":"","sources":["../src/network-policy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAQ,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAmErD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAsCzD;AASD,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAWD;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,GAAG,CAAC;IACT,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,cAAc,CAAC;CACxB;AAcD,2EAA2E;AAC3E,wBAAgB,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAEvC;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,eAAe,CAAC,CA8C1B;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,GAAG,CAAC,CAEd"}

package/dist/network-policy.js

@@ -1,6 +1,7 @@
 // Copyright 2026 XAGI Labs Private Limited
 // SPDX-License-Identifier: Apache-2.0
 import { isIP } from "node:net";
+import { lookup as dnsLookup } from "node:dns";
 import { lookup } from "node:dns/promises";
 function ipv4Number(address) {
     return address
@@ -32,6 +33,40 @@ function mappedIpv4Address(address) {
         low & 0xff,
     ].join(".");
 }
+/** The eight 16-bit groups of an IPv6 address, an embedded IPv4 tail included. */
+function ipv6Groups(address) {
+    let text = address.toLowerCase();
+    // The dotted tail, if any, found without a regular expression: one that
+    // backtracks on long digit runs is a way to stall the destination check.
+    const tail = text.slice(text.lastIndexOf(":") + 1);
+    if (isIP(tail) === 4) {
+        const [a, b, c, d] = tail.split(".").map(Number);
+        text = `${text.slice(0, -tail.length)}${((a << 8) | b).toString(16)}:${((c << 8) | d).toString(16)}`;
+    }
+    const [head = "", rest] = text.split("::");
+    const left = head === "" ? [] : head.split(":");
+    const right = rest === undefined || rest === "" ? [] : rest.split(":");
+    const missing = 8 - left.length - right.length;
+    if (missing < 0 || (rest === undefined && missing !== 0))
+        return undefined;
+    return [...left, ...Array(missing).fill("0"), ...right].map((group) => Number.parseInt(group, 16));
+}
+/**
+ * The IPv4 address a NAT64 address stands for, or whether it is a local-use
+ * translation (RFC 8215 `64:ff9b:1::/48`), which only ever reaches a private
+ * network. `64:ff9b::a00:5` is 10.0.0.5 on a host behind NAT64.
+ */
+function nat64(address) {
+    const groups = ipv6Groups(address);
+    if (groups === undefined || groups[0] !== 0x64 || groups[1] !== 0xff9b)
+        return undefined;
+    if (groups[2] === 1)
+        return { localUse: true };
+    if (groups.slice(2, 6).some((group) => group !== 0))
+        return undefined;
+    const [high, low] = [groups[6], groups[7]];
+    return { ipv4: [high >>> 8, high & 0xff, low >>> 8, low & 0xff].join("."), localUse: false };
+}
 export function isPrivateAddress(address) {
     const version = isIP(address);
     if (version === 4) {
@@ -54,6 +89,10 @@ export function isPrivateAddress(address) {
         const mapped = mappedIpv4Address(normalized);
         if (mapped !== undefined)
             return isPrivateAddress(mapped);
+        const translated = nat64(normalized);
+        if (translated !== undefined) {
+            return translated.localUse || isPrivateAddress(translated.ipv4);
+        }
         return (normalized === "::" ||
             normalized === "::1" ||
             normalized.startsWith("fc") ||
@@ -78,19 +117,42 @@ function domainAllowed(host, allowed) {
         host === entry.toLowerCase() ||
         host.endsWith(`.${entry.toLowerCase()}`));
 }
+function pinnedLookup(addresses) {
+    const answers = addresses.map((address) => ({ address, family: isIP(address) }));
+    return (_hostname, options, callback) => {
+        const family = { IPv4: 4, IPv6: 6 }[String(options.family)] ?? options.family;
+        const wanted = answers.filter((answer) => !family || answer.family === family);
+        if (wanted.length === 0) {
+            callback(Object.assign(new Error("destination_no_address"), { code: "ENOTFOUND" }), "", 0);
+        }
+        else if (options.all)
+            callback(null, wanted);
+        else
+            callback(null, wanted[0].address, wanted[0].family);
+    };
+}
+/** The URL's host, lowercased, with an IPv6 literal's brackets removed. */
+export function hostOf(url) {
+    return url.hostname.toLowerCase().replace(/^\[(.*)\]$/, "$1");
+}
 export async function assertSafeDestination(rawUrl, policy) {
     const url = new URL(rawUrl);
     // Unhinged mode still parses the URL — a value the browser cannot navigate to
     // is a bug either way — but asserts nothing about where it points.
     if (policy.unhinged)
-        return { url, address: url.hostname };
+        return { url, host: hostOf(url), lookup: dnsLookup };
     if (!["http:", "https:"].includes(url.protocol)) {
         throw new Error("destination_protocol_not_allowed");
     }
     if (url.username !== "" || url.password !== "") {
         throw new Error("destination_credentials_not_allowed");
     }
-    const host = url.hostname.toLowerCase();
+    // WHATWG URL keeps an IPv6 literal's brackets in `hostname` ("[::1]"), and
+    // `isIP("[::1]")` is 0, so without this an IPv6 address was treated as a name:
+    // the private-range check below never ran, and the request only failed because
+    // DNS cannot resolve a bracketed string. Strip them so it is checked as the
+    // address it is.
+    const host = hostOf(url);
     const localName = host === "localhost" || host.endsWith(".localhost");
     if (localName && !policy.allowLocalhost) {
         throw new Error("destination_private_blocked");
@@ -103,7 +165,7 @@ export async function assertSafeDestination(rawUrl, policy) {
             !(policy.allowLocalhost && isLoopbackAddress(host))) {
             throw new Error("destination_private_blocked");
         }
-        return { url, address: host };
+        return { url, host, lookup: pinnedLookup([host]) };
     }
     const addresses = await lookup(host, { all: true, verbatim: true });
     if (addresses.length === 0 ||
@@ -111,9 +173,8 @@ export async function assertSafeDestination(rawUrl, policy) {
             !(policy.allowLocalhost && isLoopbackAddress(item.address)))) {
         throw new Error("destination_private_blocked");
     }
-    // Every answer passed, so any of them is safe to pin; the first is the one the
-    // resolver preferred.
-    return { url, address: addresses[0].address };
+    // Every answer passed, so all of them are safe to pin, in the resolver's order.
+    return { url, host, lookup: pinnedLookup(addresses.map((item) => item.address)) };
 }
 export async function assertSafeUrl(rawUrl, policy) {
     return (await assertSafeDestination(rawUrl, policy)).url;

package/dist/network-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"network-policy.js","sourceRoot":"","sources":["../src/network-policy.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,MAAM,CAAC;SACX,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY,EAAE,IAAY;IAC9D,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAClF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO;QACL,IAAI,KAAK,CAAC;QACV,IAAI,GAAG,IAAI;QACX,GAAG,KAAK,CAAC;QACT,GAAG,GAAG,IAAI;KACX,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO;YACL,CAAC,SAAS,EAAE,CAAC,CAAC;YACd,CAAC,UAAU,EAAE,CAAC,CAAC;YACf,CAAC,YAAY,EAAE,EAAE,CAAC;YAClB,CAAC,WAAW,EAAE,CAAC,CAAC;YAChB,CAAC,aAAa,EAAE,EAAE,CAAC;YACnB,CAAC,YAAY,EAAE,EAAE,CAAC;YAClB,CAAC,WAAW,EAAE,EAAE,CAAC;YACjB,CAAC,aAAa,EAAE,EAAE,CAAC;YACnB,CAAC,YAAY,EAAE,EAAE,CAAC;YAClB,CAAC,WAAW,EAAE,CAAC,CAAC;YAChB,CAAC,WAAW,EAAE,CAAC,CAAC;SACjB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,IAAc,EAAE,IAAc,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC1D,OAAO,CACL,UAAU,KAAK,IAAI;YACnB,UAAU,KAAK,KAAK;YACpB,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;YAC3B,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;YAC3B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC5B,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC7C,OAAO,UAAU,KAAK,KAAK,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;AACrF,CAAC;AAaD,SAAS,aAAa,CAAC,IAAY,EAAE,OAAiB;IACpD,OAAO,OAAO,CAAC,IAAI,CACjB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,KAAK,GAAG;QACb,IAAI,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5B,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAC3C,CAAC;AACJ,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,MAAqB;IAErB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,8EAA8E;IAC9E,mEAAmE;IACnE,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC3D,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACtE,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACf,IACE,gBAAgB,CAAC,IAAI,CAAC;YACtB,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,EACnD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,IACE,SAAS,CAAC,MAAM,KAAK,CAAC;QACtB,SAAS,CAAC,IAAI,CACZ,CAAC,IAAI,EAAE,EAAE,CACP,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAC9B,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAC9D,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,+EAA+E;IAC/E,sBAAsB;IACtB,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,MAAqB;IAErB,OAAO,CAAC,MAAM,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"network-policy.js","sourceRoot":"","sources":["../src/network-policy.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,IAAI,EAAuB,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,MAAM,CAAC;SACX,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY,EAAE,IAAY;IAC9D,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAClF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO;QACL,IAAI,KAAK,CAAC;QACV,IAAI,GAAG,IAAI;QACX,GAAG,KAAK,CAAC;QACT,GAAG,GAAG,IAAI;KACX,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACjC,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAqC,CAAC;QACrF,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;IACvG,CAAC;IACD,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC/C,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3E,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAS,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED;;;;GAIG;AACH,SAAS,KAAK,CAAC,OAAe;IAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACzF,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7C,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO;YACL,CAAC,SAAS,EAAE,CAAC,CAAC;YACd,CAAC,UAAU,EAAE,CAAC,CAAC;YACf,CAAC,YAAY,EAAE,EAAE,CAAC;YAClB,CAAC,WAAW,EAAE,CAAC,CAAC;YAChB,CAAC,aAAa,EAAE,EAAE,CAAC;YACnB,CAAC,YAAY,EAAE,EAAE,CAAC;YAClB,CAAC,WAAW,EAAE,EAAE,CAAC;YACjB,CAAC,aAAa,EAAE,EAAE,CAAC;YACnB,CAAC,YAAY,EAAE,EAAE,CAAC;YAClB,CAAC,WAAW,EAAE,CAAC,CAAC;YAChB,CAAC,WAAW,EAAE,CAAC,CAAC;SACjB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,IAAc,EAAE,IAAc,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,UAAU,CAAC,QAAQ,IAAI,gBAAgB,CAAC,UAAU,CAAC,IAAK,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,CACL,UAAU,KAAK,IAAI;YACnB,UAAU,KAAK,KAAK;YACpB,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;YAC3B,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;YAC3B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC5B,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC7C,OAAO,UAAU,KAAK,KAAK,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;AACrF,CAAC;AAaD,SAAS,aAAa,CAAC,IAAY,EAAE,OAAiB;IACpD,OAAO,OAAO,CAAC,IAAI,CACjB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,KAAK,GAAG;QACb,IAAI,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5B,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAC3C,CAAC;AACJ,CAAC;AAwBD,SAAS,YAAY,CAAC,SAA4B;IAChD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC;QAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC/E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7F,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;;YAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,MAAM,CAAC,GAAQ;IAC7B,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,MAAqB;IAErB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,8EAA8E;IAC9E,mEAAmE;IACnE,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1E,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,2EAA2E;IAC3E,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,iBAAiB;IACjB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACtE,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACf,IACE,gBAAgB,CAAC,IAAI,CAAC;YACtB,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,EACnD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,IACE,SAAS,CAAC,MAAM,KAAK,CAAC;QACtB,SAAS,CAAC,IAAI,CACZ,CAAC,IAAI,EAAE,EAAE,CACP,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAC9B,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAC9D,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,gFAAgF;IAChF,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,MAAqB;IAErB,OAAO,CAAC,MAAM,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;AAC3D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melra/policy-core",
-  "version": "0.3.0-alpha.11",
+  "version": "0.3.0-alpha.13",
   "description": "Policy evaluation and scoped approval primitives for MELRA.",
   "license": "Apache-2.0",
   "repository": {
@@ -21,12 +21,12 @@
     "dist"
   ],
   "dependencies": {
-    "@melra/protocol": "0.3.0-alpha.11"
+    "@melra/protocol": "0.3.0-alpha.13"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "clean": "rm -rf dist",
     "test": "vitest run",
-    "typecheck": "tsc -p tsconfig.json --noEmit"
+    "typecheck": "tsc -p tsconfig.test.json"
   }
 }

package/dist/credentials.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=credentials.test.d.ts.map

package/dist/credentials.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.test.d.ts","sourceRoot":"","sources":["../src/credentials.test.ts"],"names":[],"mappings":""}

package/dist/credentials.test.js

@@ -1,103 +0,0 @@
-// Copyright 2026 XAGI Labs Private Limited
-// SPDX-License-Identifier: Apache-2.0
-import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterAll, describe, expect, it } from "vitest";
-import { CredentialsSchema } from "@melra/protocol";
-import { CredentialBroker } from "./credentials.js";
-const roots = [];
-afterAll(async () => {
-    for (const root of roots)
-        await rm(root, { recursive: true, force: true });
-});
-async function secretFile(mode) {
-    const root = await mkdtemp(join(tmpdir(), "melra-credentials-"));
-    roots.push(root);
-    const path = join(root, "stripe.key");
-    await writeFile(path, "sk_live_from_a_file\n");
-    await chmod(path, mode);
-    return path;
-}
-const stripe = {
-    stripe: {
-        source: { env: "MELRA_TEST_STRIPE_KEY" },
-        inject: { header: "Authorization", scheme: "Bearer" },
-        hosts: ["api.stripe.com"],
-        capability: "http.post:https://api.stripe.com/v1/refunds*",
-    },
-};
-const broker = (definitions = stripe, environment = { MELRA_TEST_STRIPE_KEY: "sk_live_secret" }) => new CredentialBroker(CredentialsSchema.parse(definitions), environment);
-describe("credential broker", () => {
-    it("injects the secret for an operation the delegation covers", async () => {
-        const { headers, used } = await broker().headersFor({
-            host: "api.stripe.com",
-            capability: "http.post",
-            target: "https://api.stripe.com/v1/refunds",
-        });
-        expect(headers.authorization).toBe("Bearer sk_live_secret");
-        // The names are what a caller may see. The values are what it may not.
-        expect(used).toEqual(["stripe"]);
-    });
-    it("sends a request to another host unauthenticated rather than refusing it", async () => {
-        const { headers, used } = await broker().headersFor({
-            host: "api.example.com",
-            capability: "http.post",
-            target: "https://api.example.com/v1/refunds",
-        });
-        expect(headers).toEqual({});
-        expect(used).toEqual([]);
-    });
-    it("refuses an operation outside the delegation without reading the secret", async () => {
-        // The source points at a file that does not exist. A `credential_source_*`
-        // or `ENOENT` here would mean the broker read first and checked second —
-        // the refusal has to land before the plaintext is anywhere near the process.
-        const refusing = broker({
-            stripe: {
-                ...stripe.stripe,
-                source: { file: join(tmpdir(), "melra-nonexistent-credential") },
-            },
-        });
-        await expect(refusing.headersFor({
-            host: "api.stripe.com",
-            capability: "http.delete",
-            target: "https://api.stripe.com/v1/customers/cus_1",
-        })).rejects.toThrow("credential_capability_not_covered:stripe");
-    });
-    it("reads a mode-0600 file and refuses a permissive one", async () => {
-        const path = await secretFile(0o600);
-        const request = {
-            host: "api.stripe.com",
-            capability: "http.post",
-            target: "https://api.stripe.com/v1/refunds",
-        };
-        const definitions = {
-            stripe: { ...stripe.stripe, source: { file: path } },
-        };
-        const { headers } = await broker(definitions).headersFor(request);
-        expect(headers.authorization).toBe("Bearer sk_live_from_a_file");
-        await chmod(path, 0o644);
-        const permissive = broker(definitions).headersFor(request);
-        if (process.platform === "win32") {
-            // Windows does not carry the mode bits this checks, so the guard cannot
-            // fire there. Asserting it would only test the platform.
-            await expect(permissive).resolves.toBeDefined();
-        }
-        else {
-            await expect(permissive).rejects.toThrow("credential_file_permissions_too_open");
-        }
-    });
-    it("fails loudly when the source names nothing", async () => {
-        await expect(broker(stripe, {}).headersFor({
-            host: "api.stripe.com",
-            capability: "http.post",
-            target: "https://api.stripe.com/v1/refunds",
-        })).rejects.toThrow("credential_source_missing:stripe");
-    });
-    it("rejects an unknown field in a definition", () => {
-        expect(() => CredentialsSchema.parse({
-            stripe: { ...stripe.stripe, allowRedirects: true },
-        })).toThrow();
-    });
-});
-//# sourceMappingURL=credentials.test.js.map

package/dist/credentials.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.test.js","sourceRoot":"","sources":["../src/credentials.test.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,KAAK,GAAa,EAAE,CAAC;AAE3B,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7E,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACtC,MAAM,SAAS,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC/C,MAAM,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,MAAM,GAAG;IACb,MAAM,EAAE;QACN,MAAM,EAAE,EAAE,GAAG,EAAE,uBAAuB,EAAE;QACxC,MAAM,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE;QACrD,KAAK,EAAE,CAAC,gBAAgB,CAAC;QACzB,UAAU,EAAE,8CAA8C;KAC3D;CACF,CAAC;AAEF,MAAM,MAAM,GAAG,CACb,cAAuB,MAAM,EAC7B,cAAiC,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,EAC1D,EAAE,CACpB,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;AAE1E,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC,UAAU,CAAC;YAClD,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,WAAW;YACvB,MAAM,EAAE,mCAAmC;SAC5C,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC5D,uEAAuE;QACvE,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC,UAAU,CAAC;YAClD,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,WAAW;YACvB,MAAM,EAAE,oCAAoC;SAC7C,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,2EAA2E;QAC3E,yEAAyE;QACzE,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC;YACtB,MAAM,EAAE;gBACN,GAAG,MAAM,CAAC,MAAM;gBAChB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,8BAA8B,CAAC,EAAE;aACjE;SACF,CAAC,CAAC;QACH,MAAM,MAAM,CACV,QAAQ,CAAC,UAAU,CAAC;YAClB,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,aAAa;YACzB,MAAM,EAAE,2CAA2C;SACpD,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,WAAW;YACvB,MAAM,EAAE,mCAAmC;SAC5C,CAAC;QACF,MAAM,WAAW,GAAG;YAClB,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;SACrD,CAAC;QACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAClE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAEjE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,wEAAwE;YACxE,yDAAyD;YACzD,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,CACtC,sCAAsC,CACvC,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,MAAM,CACV,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC;YAC5B,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,WAAW;YACvB,MAAM,EAAE,mCAAmC;SAC5C,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,GAAG,EAAE,CACV,iBAAiB,CAAC,KAAK,CAAC;YACtB,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE;SACnD,CAAC,CACH,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=index.test.d.ts.map

package/dist/index.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.test.d.ts","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":""}