@moxon/api 6.0.0-pre → 6.2.0

package/dist/utils/helpers.d.ts

@@ -10,6 +10,24 @@
  * @throws Error if rate limit is exceeded
  */
 export declare function checkRateLimit(rateLimits: Record<string, number[]>, userId: string, timestamp: number, window?: number, limit?: number): boolean;
+/**
+ * Throws when a client value is an object or longer than the given limit.
+ *
+ * Numbers and booleans pass, measured as text, since the stores only compare them and use them as keys.
+ *
+ * @param value - The client value, skipped when empty so the caller's own missing-field error applies
+ * @param name - Field name used in the error messages (e.g. "session ID")
+ * @param max - Maximum length in characters
+ * @throws Error if the value is an object, an array or a function, or exceeds the limit
+ */
+export declare function checkString(value: unknown, name: string, max: number): void;
+/**
+ * Checks that a client-supplied timestamp can be stored as it was sent.
+ *
+ * @param value - The client value, in any format the client chose
+ * @returns true for a finite number, a boolean or a string up to MAX_TIMESTAMP_LENGTH characters
+ */
+export declare function isTimestamp(value: unknown): boolean;
 /**
  * Parses a space-separated environment variable into an array.
  *

package/dist/utils/helpers.js

@@ -1,3 +1,4 @@
+import { MAX_TIMESTAMP_LENGTH } from '../constants.js';
 /**
  * Tracks requests per user and throws if the rate limit is exceeded.
  *
@@ -15,7 +16,7 @@ export function checkRateLimit(rateLimits, userId, timestamp, window = 10000, li
             delete rateLimits[key];
         }
     }
-    rateLimits[userId] = (rateLimits[userId] ?? []).filter((ts) => timestamp - ts < window);
+    rateLimits[userId] = (Object.hasOwn(rateLimits, userId) ? rateLimits[userId] : []).filter((ts) => timestamp - ts < window);
     if (rateLimits[userId].length >= limit) {
         const remainingTime = Math.ceil((rateLimits[userId][0] + window - timestamp) / 1000);
         throw new Error(`Rate limit exceeded. Try again in ${remainingTime} seconds.`);
@@ -23,6 +24,39 @@ export function checkRateLimit(rateLimits, userId, timestamp, window = 10000, li
     rateLimits[userId].push(timestamp);
     return false;
 }
+/**
+ * Throws when a client value is an object or longer than the given limit.
+ *
+ * Numbers and booleans pass, measured as text, since the stores only compare them and use them as keys.
+ *
+ * @param value - The client value, skipped when empty so the caller's own missing-field error applies
+ * @param name - Field name used in the error messages (e.g. "session ID")
+ * @param max - Maximum length in characters
+ * @throws Error if the value is an object, an array or a function, or exceeds the limit
+ */
+export function checkString(value, name, max) {
+    if (!value)
+        return;
+    if (typeof value !== 'string' && typeof value !== 'number' && typeof value !== 'boolean') {
+        throw new Error(`Please provide a valid ${name}`);
+    }
+    const label = name.charAt(0).toUpperCase() + name.slice(1);
+    if (String(value).length > max)
+        throw new Error(`${label} cannot exceed ${max} characters`);
+}
+/**
+ * Checks that a client-supplied timestamp can be stored as it was sent.
+ *
+ * @param value - The client value, in any format the client chose
+ * @returns true for a finite number, a boolean or a string up to MAX_TIMESTAMP_LENGTH characters
+ */
+export function isTimestamp(value) {
+    if (typeof value === 'number')
+        return Number.isFinite(value);
+    if (typeof value === 'boolean')
+        return true;
+    return typeof value === 'string' && value.length <= MAX_TIMESTAMP_LENGTH;
+}
 /**
  * Parses a space-separated environment variable into an array.
  *

package/dist/utils/helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../src/utils/helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC1B,UAAoC,EACpC,MAAc,EACd,SAAiB,EACjB,MAAM,GAAG,KAAK,EACd,KAAK,GAAG,EAAE;IAEV,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,IAAI,GAAG,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;YAC5E,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;IACL,CAAC;IAED,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;IAExF,IAAI,UAAU,CAAC,MAAM,CAAE,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;QACtC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAE,CAAC,CAAC,CAAE,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,qCAAqC,aAAa,WAAW,CAAC,CAAC;IACnF,CAAC;IAED,UAAU,CAAC,MAAM,CAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,GAAW;IAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAU;IACjC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,iBAAiB,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACtG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,KAAK;IACjB,OAAO,GAAG,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAI,GAAQ;IAC9B,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAE,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,GAAW;IACjD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,OAAe,EAAE,GAAW;IAC9C,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC;AACrD,CAAC"}
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../src/utils/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC1B,UAAoC,EACpC,MAAc,EACd,SAAiB,EACjB,MAAM,GAAG,KAAK,EACd,KAAK,GAAG,EAAE;IAEV,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,IAAI,GAAG,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;YAC5E,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;IACL,CAAC;IAED,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CACtF,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,GAAG,EAAE,GAAG,MAAM,CAClC,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,CAAE,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;QACtC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAE,CAAC,CAAC,CAAE,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,qCAAqC,aAAa,WAAW,CAAC,CAAC;IACnF,CAAC;IAED,UAAU,CAAC,MAAM,CAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,IAAY,EAAE,GAAW;IACjE,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kBAAkB,GAAG,aAAa,CAAC,CAAC;AAChG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,oBAAoB,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,GAAW;IAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAU;IACjC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,iBAAiB,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACtG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,KAAK;IACjB,OAAO,GAAG,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAI,GAAQ;IAC9B,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAE,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,GAAW;IACjD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,OAAe,EAAE,GAAW;IAC9C,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC;AACrD,CAAC"}

package/dist/utils/remote.d.ts

@@ -0,0 +1,42 @@
+import type { LookupAddress } from 'node:dns';
+import type { ClientRequest, IncomingMessage, RequestOptions } from 'node:http';
+import { BlockList } from 'node:net';
+export type RemoteFailure = 'blocked' | 'protocol' | 'size' | 'network' | 'timeout';
+export interface RemoteHead {
+    status: number;
+    ok: boolean;
+    contentType: string;
+}
+export interface RemoteOptions {
+    maxBytes: number;
+    timeout: number;
+    redirects?: number;
+    check?: (head: RemoteHead) => void;
+    messages?: Partial<Record<RemoteFailure, string>>;
+    blocklist?: BlockList;
+    resolve?: (hostname: string) => Promise<LookupAddress[]>;
+    request?: (url: URL, options: RequestOptions, callback: (response: IncomingMessage) => void) => ClientRequest;
+}
+export type RemoteFetcher = (url: string, options: RemoteOptions) => Promise<Buffer>;
+/**
+ * Tells whether an IP address belongs to a private, loopback or otherwise internal range.
+ *
+ * @param address - IPv4 or IPv6 address, optionally with an IPv6 zone index
+ * @param blocklist - Ranges to reject, the internal ranges by default
+ * @returns true when the address must not be contacted
+ */
+export declare function isPrivateAddress(address: string, blocklist?: BlockList): boolean;
+/**
+ * Fetches an HTTPS resource without letting the caller reach internal hosts.
+ *
+ * The host is resolved once, every address is checked against the internal ranges, and the
+ * socket connects to those vetted addresses only. Redirects are followed by hand with the same
+ * checks on each hop, the body is streamed and cut past maxBytes, and the whole exchange,
+ * redirects and body included, must finish within the timeout.
+ *
+ * @param url - HTTPS URL to fetch
+ * @param options - Size limit, timeout, response check and test seams
+ * @returns The decoded response body
+ * @throws Error if the URL is invalid or internal, the transfer fails, times out or is too large, or check throws
+ */
+export declare function fetchRemote(url: string, options: RemoteOptions): Promise<Buffer>;

package/dist/utils/remote.js

@@ -0,0 +1,313 @@
+import { lookup } from 'node:dns/promises';
+import { Agent, request as httpsRequest } from 'node:https';
+import { BlockList, isIP } from 'node:net';
+import { pipeline } from 'node:stream';
+import { constants, createBrotliDecompress, createGunzip, createInflate } from 'node:zlib';
+import { MAX_REMOTE_REDIRECTS } from '../constants.js';
+// Default messages; network and timeout keep the wording fetch() used before this helper
+const MESSAGES = {
+    blocked: 'Access to private/internal hosts is not allowed.',
+    protocol: 'Only HTTPS URLs are allowed.',
+    size: 'Response body is too large.',
+    network: 'fetch failed',
+    timeout: 'The operation was aborted due to timeout',
+};
+// Same request headers as Node's built-in fetch, so remote servers answer as before
+const HEADERS = {
+    accept: '*/*',
+    'accept-language': '*',
+    'sec-fetch-mode': 'cors',
+    'user-agent': 'node',
+    'accept-encoding': 'gzip, deflate',
+};
+const BLOCKED_HOSTS = new Set(['localhost', 'metadata.google.internal']);
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+// Shared so repeated fetches reuse a socket; a pooled socket only ever connected to a vetted address
+const AGENT = new Agent({ keepAlive: true });
+// Loopback, private, link-local, CGNAT, unspecified, multicast, documentation, relay and reserved ranges
+const PRIVATE_RANGES = new BlockList();
+for (const [network, prefix] of [
+    ['0.0.0.0', 8],
+    ['10.0.0.0', 8],
+    ['100.64.0.0', 10],
+    ['127.0.0.0', 8],
+    ['169.254.0.0', 16],
+    ['172.16.0.0', 12],
+    ['192.0.0.0', 24],
+    ['192.0.2.0', 24],
+    ['192.88.99.0', 24],
+    ['192.168.0.0', 16],
+    ['198.18.0.0', 15],
+    ['198.51.100.0', 24],
+    ['203.0.113.0', 24],
+    ['224.0.0.0', 4],
+    ['240.0.0.0', 4],
+]) {
+    PRIVATE_RANGES.addSubnet(network, prefix, 'ipv4');
+}
+// 6to4 and Teredo embed an IPv4 address reached through a relay, so they are refused as a whole
+for (const [network, prefix] of [
+    ['::', 96],
+    ['::ffff:0:0:0', 96],
+    ['64:ff9b:1::', 48],
+    ['100::', 64],
+    ['2001::', 32],
+    ['2001:db8::', 32],
+    ['2002::', 16],
+    ['fc00::', 7],
+    ['fe80::', 10],
+    ['fec0::', 10],
+    ['ff00::', 8],
+]) {
+    PRIVATE_RANGES.addSubnet(network, prefix, 'ipv6');
+}
+/**
+ * Tells whether an IP address belongs to a private, loopback or otherwise internal range.
+ *
+ * @param address - IPv4 or IPv6 address, optionally with an IPv6 zone index
+ * @param blocklist - Ranges to reject, the internal ranges by default
+ * @returns true when the address must not be contacted
+ */
+export function isPrivateAddress(address, blocklist = PRIVATE_RANGES) {
+    const bare = address.split('%')[0];
+    const family = isIP(bare);
+    if (family === 0)
+        return true;
+    if (family === 4)
+        return blocklist.check(bare, 'ipv4');
+    if (blocklist.check(bare, 'ipv6'))
+        return true;
+    // IPv4-mapped addresses are matched by BlockList itself, NAT64 ones are not
+    const nat64 = /^\[64:ff9b::(?:([0-9a-f]{1,4}):)?([0-9a-f]{1,4})?\]$/.exec(new URL(`http://[${bare}]`).hostname);
+    if (!nat64)
+        return false;
+    const value = (parseInt(nat64[1] ?? '0', 16) << 16) | parseInt(nat64[2] ?? '0', 16);
+    const embedded = [24, 16, 8, 0].map((shift) => (value >>> shift) & 255).join('.');
+    return blocklist.check(embedded, 'ipv4');
+}
+/**
+ * Builds the error thrown for a failed remote fetch.
+ *
+ * @param kind - Failure category
+ * @param messages - Caller overrides for the user-facing messages
+ * @returns Error carrying the caller's message, or the default one for that category
+ */
+function failure(kind, messages) {
+    return new Error(messages?.[kind] ?? MESSAGES[kind]);
+}
+/**
+ * Parses a URL to fetch and enforces HTTPS without credentials.
+ *
+ * @param url - Absolute URL, or a redirect location relative to base
+ * @param messages - Caller overrides for the user-facing messages
+ * @param base - URL of the response that redirected, if any
+ * @returns Parsed URL
+ */
+function parse(url, messages, base) {
+    let parsed;
+    try {
+        parsed = new URL(url, base);
+    }
+    catch {
+        throw base ? failure('network', messages) : new Error(`Failed to parse URL from ${url}`);
+    }
+    if (parsed.protocol !== 'https:')
+        throw failure('protocol', messages);
+    if (parsed.username || parsed.password) {
+        throw base
+            ? failure('network', messages)
+            : new Error(`Request cannot be constructed from a URL that includes credentials: ${url}`);
+    }
+    return parsed;
+}
+/**
+ * Resolves a hostname with the system resolver, returning every address.
+ *
+ * @param hostname - Hostname to resolve
+ * @returns All addresses the hostname resolves to
+ */
+function resolveHost(hostname) {
+    return lookup(hostname, { all: true });
+}
+/**
+ * Resolves the URL host once and rejects it when any of its addresses is internal.
+ *
+ * @param url - URL about to be fetched
+ * @param options - Fetch options holding the blocklist, resolver and messages
+ * @returns The vetted addresses, which are the only ones the connection may use
+ */
+async function vet(url, options) {
+    const host = url.hostname.replace(/^\[|\]$/g, '').replace(/\.$/, '');
+    if (BLOCKED_HOSTS.has(host) || host.endsWith('.localhost'))
+        throw failure('blocked', options.messages);
+    const family = isIP(host);
+    let addresses;
+    if (family) {
+        addresses = [{ address: host, family }];
+    }
+    else {
+        try {
+            addresses = await (options.resolve ?? resolveHost)(host);
+        }
+        catch {
+            throw failure('network', options.messages);
+        }
+    }
+    const blocklist = options.blocklist ?? PRIVATE_RANGES;
+    if (!addresses.length || addresses.some(({ address }) => isPrivateAddress(address, blocklist))) {
+        throw failure('blocked', options.messages);
+    }
+    return addresses;
+}
+/**
+ * Sends one GET request whose socket can only connect to the vetted addresses.
+ *
+ * @param url - URL to request
+ * @param addresses - Addresses returned by vet()
+ * @param options - Fetch options holding the transport and messages
+ * @param signal - Signal aborting the request on timeout
+ * @returns The response, before its body is read
+ */
+function send(url, addresses, options, signal) {
+    // Pinning the lookup stops a second DNS answer (rebinding) from changing the target
+    const pinned = (_hostname, lookupOptions, callback) => {
+        if (lookupOptions.all)
+            callback(null, addresses);
+        else
+            callback(null, addresses[0].address, addresses[0].family);
+    };
+    return new Promise((resolve, reject) => {
+        const req = (options.request ?? httpsRequest)(url, { method: 'GET', headers: HEADERS, lookup: pinned, agent: AGENT, signal }, resolve);
+        req.on('error', () => reject(failure('network', options.messages)));
+        req.end();
+    });
+}
+/**
+ * Builds the decompression stages for a Content-Encoding header, like fetch() does.
+ *
+ * @param header - Content-Encoding header value
+ * @returns Decoders to apply in order, or none when an encoding is unknown
+ */
+function decoders(header) {
+    const codings = (header ?? '')
+        .toLowerCase()
+        .split(',')
+        .map((c) => c.trim())
+        .filter(Boolean);
+    const zlib = { flush: constants.Z_SYNC_FLUSH, finishFlush: constants.Z_SYNC_FLUSH };
+    const brotli = { flush: constants.BROTLI_OPERATION_FLUSH, finishFlush: constants.BROTLI_OPERATION_FLUSH };
+    const stages = [];
+    for (const coding of codings.reverse()) {
+        if (coding === 'gzip' || coding === 'x-gzip')
+            stages.push(createGunzip(zlib));
+        else if (coding === 'deflate')
+            stages.push(createInflate(zlib));
+        else if (coding === 'br')
+            stages.push(createBrotliDecompress(brotli));
+        else
+            return [];
+    }
+    return stages;
+}
+/**
+ * Reads a decoded response body and aborts as soon as it grows past the limit.
+ *
+ * @param response - Response to read
+ * @param maxBytes - Largest decoded body accepted
+ * @param messages - Caller overrides for the user-facing messages
+ * @returns The decoded body
+ */
+async function readBody(response, maxBytes, messages) {
+    const stages = decoders(response.headers['content-encoding']);
+    const stream = stages.length ? pipeline([response, ...stages], () => { }) : response;
+    const chunks = [];
+    let size = 0;
+    try {
+        for await (const chunk of stream) {
+            size += chunk.length;
+            if (size > maxBytes)
+                break;
+            chunks.push(chunk);
+        }
+    }
+    catch {
+        throw failure('network', messages);
+    }
+    finally {
+        response.destroy();
+    }
+    if (size > maxBytes)
+        throw failure('size', messages);
+    return Buffer.concat(chunks);
+}
+/**
+ * Follows the redirect chain by hand, vetting every hop, then reads the final body.
+ *
+ * @param url - URL to fetch
+ * @param options - Fetch options
+ * @param signal - Signal aborted on timeout
+ * @returns The decoded body of the final response
+ */
+async function download(url, options, signal) {
+    const redirects = options.redirects ?? MAX_REMOTE_REDIRECTS;
+    let target = parse(url, options.messages);
+    for (let hop = 0;; hop++) {
+        const addresses = await vet(target, options);
+        if (signal.aborted)
+            throw failure('timeout', options.messages);
+        const response = await send(target, addresses, options, signal);
+        const status = response.statusCode ?? 0;
+        const location = response.headers.location;
+        if (REDIRECT_STATUSES.has(status) && location) {
+            response.destroy();
+            if (hop >= redirects)
+                throw failure('network', options.messages);
+            target = parse(location, options.messages, target);
+            continue;
+        }
+        try {
+            options.check?.({
+                status,
+                ok: status >= 200 && status <= 299,
+                contentType: response.headers['content-type'] ?? '',
+            });
+        }
+        catch (err) {
+            response.destroy();
+            throw err;
+        }
+        return readBody(response, options.maxBytes, options.messages);
+    }
+}
+/**
+ * Fetches an HTTPS resource without letting the caller reach internal hosts.
+ *
+ * The host is resolved once, every address is checked against the internal ranges, and the
+ * socket connects to those vetted addresses only. Redirects are followed by hand with the same
+ * checks on each hop, the body is streamed and cut past maxBytes, and the whole exchange,
+ * redirects and body included, must finish within the timeout.
+ *
+ * @param url - HTTPS URL to fetch
+ * @param options - Size limit, timeout, response check and test seams
+ * @returns The decoded response body
+ * @throws Error if the URL is invalid or internal, the transfer fails, times out or is too large, or check throws
+ */
+export async function fetchRemote(url, options) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), options.timeout).unref();
+    const expired = new Promise((_, reject) => {
+        controller.signal.addEventListener('abort', () => reject(failure('timeout', options.messages)), {
+            once: true,
+        });
+    });
+    try {
+        return await Promise.race([download(url, options, controller.signal), expired]);
+    }
+    catch (err) {
+        throw controller.signal.aborted ? failure('timeout', options.messages) : err;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=remote.js.map

package/dist/utils/remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../src/utils/remote.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAiC,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAuBvD,yFAAyF;AACzF,MAAM,QAAQ,GAAkC;IAC5C,OAAO,EAAE,kDAAkD;IAC3D,QAAQ,EAAE,8BAA8B;IACxC,IAAI,EAAE,6BAA6B;IACnC,OAAO,EAAE,cAAc;IACvB,OAAO,EAAE,0CAA0C;CACtD,CAAC;AAEF,oFAAoF;AACpF,MAAM,OAAO,GAAG;IACZ,MAAM,EAAE,KAAK;IACb,iBAAiB,EAAE,GAAG;IACtB,gBAAgB,EAAE,MAAM;IACxB,YAAY,EAAE,MAAM;IACpB,iBAAiB,EAAE,eAAe;CACrC,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC,CAAC;AACzE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE7D,qGAAqG;AACrG,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAE7C,yGAAyG;AACzG,MAAM,cAAc,GAAG,IAAI,SAAS,EAAE,CAAC;AACvC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC5B,CAAC,SAAS,EAAE,CAAC,CAAC;IACd,CAAC,UAAU,EAAE,CAAC,CAAC;IACf,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,WAAW,EAAE,CAAC,CAAC;IAChB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,cAAc,EAAE,EAAE,CAAC;IACpB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,WAAW,EAAE,CAAC,CAAC;IAChB,CAAC,WAAW,EAAE,CAAC,CAAC;CACV,EAAE,CAAC;IACT,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,gGAAgG;AAChG,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC5B,CAAC,IAAI,EAAE,EAAE,CAAC;IACV,CAAC,cAAc,EAAE,EAAE,CAAC;IACpB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,OAAO,EAAE,EAAE,CAAC;IACb,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,CAAC,CAAC;IACb,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,CAAC,CAAC;CACP,EAAE,CAAC;IACT,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,YAAuB,cAAc;IACnF,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,4EAA4E;IAC5E,MAAM,KAAK,GAAG,sDAAsD,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChH,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClF,OAAO,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,IAAmB,EAAE,QAAmC;IACrE,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,KAAK,CAAC,GAAW,EAAE,QAAmC,EAAE,IAAU;IACvE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI;YACN,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC;YAC9B,CAAC,CAAC,IAAI,KAAK,CAAC,uEAAuE,GAAG,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,QAAgB;IACjC,OAAO,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,GAAG,CAAC,GAAQ,EAAE,OAAsB;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,MAAM,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEvG,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,SAA0B,CAAC;IAC/B,IAAI,MAAM,EAAE,CAAC;QACT,SAAS,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACJ,IAAI,CAAC;YACD,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC;IACtD,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,IAAI,CACT,GAAQ,EACR,SAA0B,EAC1B,OAAsB,EACtB,MAAmB;IAEnB,oFAAoF;IACpF,MAAM,MAAM,GAAG,CACX,SAAiB,EACjB,aAA4B,EAC5B,QAAyG,EAC3G,EAAE;QACA,IAAI,aAAa,CAAC,GAAG;YAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;;YAC5C,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC,CAAC;IAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,YAAY,CAAC,CACzC,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EACzE,OAAO,CACV,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACpE,GAAG,CAAC,GAAG,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,MAA0B;IACxC,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;SACzB,WAAW,EAAE;SACb,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,YAAY,EAAE,WAAW,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC;IACpF,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,sBAAsB,EAAE,WAAW,EAAE,SAAS,CAAC,sBAAsB,EAAE,CAAC;IAC1G,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;aACzE,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;aAC3D,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;;YACjE,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,QAAQ,CACnB,QAAyB,EACzB,QAAgB,EAChB,QAAmC;IAEnC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7G,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,IAAI,CAAC;QACD,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAA+B,EAAE,CAAC;YACxD,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,QAAQ;gBAAE,MAAM;YAC3B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACP,QAAQ,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,IAAI,GAAG,QAAQ;QAAE,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,OAAsB,EAAE,MAAmB;IAC5E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,oBAAoB,CAAC;IAC5D,IAAI,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE1C,KAAK,IAAI,GAAG,GAAG,CAAC,GAAI,GAAG,EAAE,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;QAE3C,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YAC5C,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,GAAG,IAAI,SAAS;gBAAE,MAAM,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjE,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACnD,SAAS;QACb,CAAC;QAED,IAAI,CAAC;YACD,OAAO,CAAC,KAAK,EAAE,CAAC;gBACZ,MAAM;gBACN,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,MAAM,IAAI,GAAG;gBAClC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE;aACtD,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,GAAG,CAAC;QACd,CAAC;QACD,OAAO,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAsB;IACjE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC7C,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE;YAC5F,IAAI,EAAE,IAAI;SACb,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACD,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACjF,CAAC;YAAS,CAAC;QACP,YAAY,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;AACL,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
-    "version": "6.0.0-pre",
+    "version": "6.2.0",
     "name": "@moxon/api",
-    "description": "Node.js API with multiple features. Check the documentation at https://docs.sylvain.sh",
+    "description": "Node.js API with 40+ utilities, usable as a library or over HTTP. Documentation at https://moxon.dev",
     "main": "./dist/modules/v6.js",
     "types": "./dist/modules/v6.d.ts",
     "type": "module",
@@ -27,6 +27,10 @@
             "types": "./dist/app.d.ts",
             "default": "./dist/app.js"
         },
+        "./manifest": {
+            "types": "./dist/manifest.d.ts",
+            "default": "./dist/manifest.js"
+        },
         "./v4": {
             "types": "./dist/modules/v4.d.ts",
             "default": "./dist/modules/v4.js"
@@ -72,19 +76,35 @@
     },
     "repository": {
         "type": "git",
-        "url": "git+https://github.com/20syldev/moxon.git"
+        "url": "git+https://github.com/moxondev/api.git"
     },
     "keywords": [
         "api",
+        "barcode",
+        "base64",
+        "captcha",
+        "chart",
+        "crypto",
+        "csv",
+        "encryption",
         "express",
-        "utility",
+        "jwt",
+        "levenshtein",
         "math",
-        "typescript"
+        "pow",
+        "proof-of-work",
+        "qrcode",
+        "svg",
+        "totp",
+        "typescript",
+        "utilities",
+        "uuid",
+        "validation"
     ],
     "author": "Sylvain L.",
-    "license": "BSD 3-Clause",
+    "license": "BSD-3-Clause",
     "bugs": {
-        "url": "https://github.com/20syldev/moxon/issues"
+        "url": "https://github.com/moxondev/api/issues"
     },
-    "homepage": "https://api.sylvain.sh"
+    "homepage": "https://moxon.dev"
 }