@node9/policy-engine 2.16.1 → 2.16.2

package/dist/index.d.mts

@@ -431,7 +431,25 @@ interface EgressVerdict {
 declare const DEFAULT_EGRESS_ALLOWLIST: readonly string[];
 /** Glob host match: "*" = any, "*.x" = apex x + any subdomain, else exact. */
 declare function hostMatches(host: string, pattern: string): boolean;
-/** localhost / loopback / RFC1918 / link-local-ish — never a real exfil target. */
+/**
+ * "Private" for the allowPrivate opt-in: loopback, RFC1918 and its IPv6
+ * analogue, the unspecified address, and the conventional local suffixes.
+ *
+ * The address half is classifySsrf's answer, so every spelling that file
+ * normalizes (brackets, zone id, IPv4-mapped IPv6) is one spelling here too.
+ * The old body had its own IPv4-only regexes and returned false for `[::1]`,
+ * which BLOCKED a local IPv6 dev server under allowPrivate (measured
+ * 2026-09-20; the shell extractor keeps the brackets, the declared-URL
+ * extractor strips them, and this function knew neither). Two parsers for
+ * one question is how that happens.
+ *
+ * NOT private here: link-local, multicast, the metadata endpoints. Those are
+ * the SSRF floor's tiers and allowPrivate must not be able to reach them;
+ * evaluateEgress documents that the floor runs first, and this function
+ * agrees with it rather than relying on it. CGNAT (100.64/10) is also out:
+ * a mesh-VPN peer is not everyone's private network, which is why the floor
+ * gave it its own tier; a Tailscale user lists the range in `allow`.
+ */
 declare function isPrivateHost(host: string): boolean;
 /**
  * Evaluate extracted destinations against the egress policy. Precedence per

package/dist/index.d.ts

@@ -431,7 +431,25 @@ interface EgressVerdict {
 declare const DEFAULT_EGRESS_ALLOWLIST: readonly string[];
 /** Glob host match: "*" = any, "*.x" = apex x + any subdomain, else exact. */
 declare function hostMatches(host: string, pattern: string): boolean;
-/** localhost / loopback / RFC1918 / link-local-ish — never a real exfil target. */
+/**
+ * "Private" for the allowPrivate opt-in: loopback, RFC1918 and its IPv6
+ * analogue, the unspecified address, and the conventional local suffixes.
+ *
+ * The address half is classifySsrf's answer, so every spelling that file
+ * normalizes (brackets, zone id, IPv4-mapped IPv6) is one spelling here too.
+ * The old body had its own IPv4-only regexes and returned false for `[::1]`,
+ * which BLOCKED a local IPv6 dev server under allowPrivate (measured
+ * 2026-09-20; the shell extractor keeps the brackets, the declared-URL
+ * extractor strips them, and this function knew neither). Two parsers for
+ * one question is how that happens.
+ *
+ * NOT private here: link-local, multicast, the metadata endpoints. Those are
+ * the SSRF floor's tiers and allowPrivate must not be able to reach them;
+ * evaluateEgress documents that the floor runs first, and this function
+ * agrees with it rather than relying on it. CGNAT (100.64/10) is also out:
+ * a mesh-VPN peer is not everyone's private network, which is why the floor
+ * gave it its own tier; a Tailscale user lists the range in `allow`.
+ */
 declare function isPrivateHost(host: string): boolean;
 /**
  * Evaluate extracted destinations against the egress policy. Precedence per

package/dist/index.js

@@ -3213,6 +3213,213 @@ function analyzeShellCommand(command) {
   return { actions, paths, allTokens };
 }
 
+// src/egress/ssrf.ts
+var SSRF_MAX_HOST = 253;
+function parseComponent(s) {
+  if (!s) return null;
+  if (/^0[xX][0-9a-fA-F]+$/.test(s)) return parseInt(s.slice(2), 16);
+  if (s === "0") return 0;
+  if (/^0[0-7]+$/.test(s)) return parseInt(s.slice(1), 8);
+  if (/^[1-9][0-9]*$/.test(s)) return Number(s);
+  return null;
+}
+function parseIpv4(input) {
+  let s = input;
+  if (s.endsWith(".")) s = s.slice(0, -1);
+  if (!s) return null;
+  const parts = s.split(".");
+  if (parts.length > 4) return null;
+  const vals = [];
+  for (const p of parts) {
+    const v = parseComponent(p);
+    if (v === null || !Number.isFinite(v) || v < 0) return null;
+    vals.push(v);
+  }
+  const n = vals.length;
+  for (let i = 0; i < n - 1; i++) if (vals[i] > 255) return null;
+  const last = vals[n - 1];
+  const remainingBytes = 4 - (n - 1);
+  const limit = Math.pow(256, remainingBytes);
+  if (last >= limit) return null;
+  let value = last;
+  for (let i = 0; i < n - 1; i++) value += vals[i] * Math.pow(256, 3 - i);
+  if (value > 4294967295) return null;
+  return [value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
+}
+function expandIpv6(input) {
+  const s = input.toLowerCase();
+  if (!/^[0-9a-f:.]+$/.test(s)) return null;
+  if ((s.match(/::/g) ?? []).length > 1) return null;
+  let head = s;
+  let tailV4 = null;
+  const lastColon = s.lastIndexOf(":");
+  const afterLast = s.slice(lastColon + 1);
+  if (afterLast.includes(".")) {
+    const dotted = parseIpv4(afterLast);
+    if (!dotted) return null;
+    const o = dotted.split(".").map(Number);
+    tailV4 = [o[0] << 8 | o[1], o[2] << 8 | o[3]];
+    head = s.slice(0, lastColon + 1) + "0";
+  }
+  const [lhs, rhs] = head.includes("::") ? head.split("::") : [head, null];
+  const toGroups = (part) => {
+    if (!part) return [];
+    const out = [];
+    for (const g of part.split(":")) {
+      if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+      out.push(parseInt(g, 16));
+    }
+    return out;
+  };
+  const left = toGroups(lhs);
+  if (left === null) return null;
+  let right = [];
+  if (rhs !== null) {
+    const r = toGroups(rhs);
+    if (r === null) return null;
+    right = r;
+  }
+  if (tailV4) {
+    if (rhs !== null) right = right.slice(0, -1).concat(tailV4);
+    else left.splice(left.length - 1, 1, ...tailV4);
+  }
+  const groups = rhs === null ? left : left.concat(new Array(8 - left.length - right.length).fill(0), right);
+  if (rhs === null && groups.length !== 8) return null;
+  if (rhs !== null && left.length + right.length > 8) return null;
+  if (groups.length !== 8) return null;
+  return groups;
+}
+function compressIpv6(g) {
+  let bestStart = -1;
+  let bestLen = 0;
+  let i = 0;
+  while (i < 8) {
+    if (g[i] !== 0) {
+      i++;
+      continue;
+    }
+    let j = i;
+    while (j < 8 && g[j] === 0) j++;
+    if (j - i > bestLen) {
+      bestLen = j - i;
+      bestStart = i;
+    }
+    i = j;
+  }
+  const hex = g.map((x) => x.toString(16));
+  if (bestLen < 2) return hex.join(":");
+  return hex.slice(0, bestStart).join(":") + "::" + hex.slice(bestStart + bestLen).join(":");
+}
+function normalizeIpLiteral(host) {
+  try {
+    if (typeof host !== "string") return null;
+    let s = host.trim();
+    if (!s || s.length > SSRF_MAX_HOST) return null;
+    if (s.startsWith("[") && s.endsWith("]")) s = s.slice(1, -1);
+    const zone = s.indexOf("%");
+    if (zone >= 0) s = s.slice(0, zone);
+    if (!s) return null;
+    if (s.includes(":")) {
+      const g = expandIpv6(s);
+      if (!g) return null;
+      const mapped = g.slice(0, 5).every((x) => x === 0) && g[5] === 65535;
+      if (mapped) {
+        return [g[6] >> 8 & 255, g[6] & 255, g[7] >> 8 & 255, g[7] & 255].join(".");
+      }
+      return compressIpv6(g);
+    }
+    return parseIpv4(s);
+  } catch {
+    return null;
+  }
+}
+var METADATA_ADDRESSES = /* @__PURE__ */ new Set([
+  "169.254.169.254",
+  // AWS / Azure / DigitalOcean / OpenStack IMDS
+  "169.254.170.2",
+  // AWS ECS task role
+  "168.63.129.16",
+  // Azure WireServer
+  "fd00:ec2::254",
+  // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+  // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+  // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+  // live credential endpoint. It has to be named here, above the range check,
+  // and it is the reason relaxing cgnat is safe.
+  "100.100.100.200"
+]);
+var STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
+function isStrictGatedTier(tier) {
+  return STRICT_TIERS.has(tier);
+}
+function ssrfReason(m, asWritten) {
+  return `Blocked: ${asWritten} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== asWritten ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.");
+}
+var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
+var v4Octets = (a) => {
+  const p = a.split(".");
+  return p.length === 4 ? p.map(Number) : null;
+};
+function classifySsrf(host) {
+  try {
+    if (typeof host !== "string" || !host) return null;
+    const lower = host.trim().toLowerCase().replace(/\.$/, "");
+    const ip = normalizeIpLiteral(host);
+    if (ip === null) {
+      return METADATA_HOSTNAMES.has(lower) ? { tier: "metadata", overridable: false, kind: "hostname" } : null;
+    }
+    const hit = (tier, overridable) => ({
+      tier,
+      overridable,
+      kind: "address",
+      normalized: ip
+    });
+    if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
+    const o = v4Octets(ip);
+    if (o) {
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
+      if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
+      if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
+      if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
+      if (o[0] === 127) return hit("private", true);
+      if (o[0] === 10) return hit("private", true);
+      if (o[0] === 192 && o[1] === 168) return hit("private", true);
+      if (o[0] === 172 && o[1] >= 16 && o[1] <= 31) return hit("private", true);
+      return null;
+    }
+    const g = expandIpv6(ip);
+    if (!g) return null;
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
+    if ((g[0] & 65472) === 65152) return hit("link-local", false);
+    if ((g[0] & 65280) === 65280) return hit("multicast", false);
+    if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
+    return null;
+  } catch {
+    return null;
+  }
+}
+var TIER_REASON = {
+  metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
+  "link-local": "a link-local address",
+  multicast: "a multicast address",
+  unspecified: "the unspecified address, which reaches this host",
+  cgnat: "a carrier-grade NAT address",
+  private: "a loopback or private address"
+};
+function ssrfFloor(tokens, opts = {}) {
+  const exempt = new Set(
+    (opts.ssrfAllow ?? []).map((e) => normalizeIpLiteral(e) ?? e.trim().toLowerCase())
+  );
+  for (const { token, binary } of tokens) {
+    const m = classifySsrf(token);
+    if (!m) continue;
+    if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
+    if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
+    return { ...m, host: token, binary, reason: ssrfReason(m, token) };
+  }
+  return null;
+}
+
 // src/egress/index.ts
 var DEFAULT_EGRESS_ALLOWLIST = [
   // node9's own control plane (api, app, dev-api, staging and the apex).
@@ -3252,15 +3459,20 @@ function matchesAny(host, patterns) {
   for (const p of patterns) if (hostMatches(host, p)) return true;
   return false;
 }
+var PRIVATE_HOST_SUFFIXES = [".local", ".internal", ".localhost"];
+function isUniqueLocalV6(host) {
+  const ip = normalizeIpLiteral(host);
+  if (!ip || !ip.includes(":")) return false;
+  const g = expandIpv6(ip);
+  return g !== null && (g[0] & 65024) === 64512;
+}
 function isPrivateHost(host) {
-  const h = host.toLowerCase();
-  if (h === "localhost" || h === "0.0.0.0") return true;
-  if (h.endsWith(".local") || h.endsWith(".internal") || h.endsWith(".localhost")) return true;
-  if (/^127\./.test(h)) return true;
-  if (/^10\./.test(h)) return true;
-  if (/^192\.168\./.test(h)) return true;
-  if (/^172\.(1[6-9]|2\d|3[01])\./.test(h)) return true;
-  return false;
+  const h = host.trim().toLowerCase();
+  const m = classifySsrf(h);
+  if (m) return m.kind === "address" && (m.tier === "private" || m.tier === "unspecified");
+  if (h === "localhost") return true;
+  if (PRIVATE_HOST_SUFFIXES.some((s) => h.endsWith(s))) return true;
+  return isUniqueLocalV6(h);
 }
 function evaluateEgress(dests, policy) {
   if (!policy.enabled) return null;
@@ -3614,213 +3826,6 @@ function parseAllSshHostsFromCommand(command) {
   return extractAllSshHosts(tokens.slice(1));
 }
 
-// src/egress/ssrf.ts
-var SSRF_MAX_HOST = 253;
-function parseComponent(s) {
-  if (!s) return null;
-  if (/^0[xX][0-9a-fA-F]+$/.test(s)) return parseInt(s.slice(2), 16);
-  if (s === "0") return 0;
-  if (/^0[0-7]+$/.test(s)) return parseInt(s.slice(1), 8);
-  if (/^[1-9][0-9]*$/.test(s)) return Number(s);
-  return null;
-}
-function parseIpv4(input) {
-  let s = input;
-  if (s.endsWith(".")) s = s.slice(0, -1);
-  if (!s) return null;
-  const parts = s.split(".");
-  if (parts.length > 4) return null;
-  const vals = [];
-  for (const p of parts) {
-    const v = parseComponent(p);
-    if (v === null || !Number.isFinite(v) || v < 0) return null;
-    vals.push(v);
-  }
-  const n = vals.length;
-  for (let i = 0; i < n - 1; i++) if (vals[i] > 255) return null;
-  const last = vals[n - 1];
-  const remainingBytes = 4 - (n - 1);
-  const limit = Math.pow(256, remainingBytes);
-  if (last >= limit) return null;
-  let value = last;
-  for (let i = 0; i < n - 1; i++) value += vals[i] * Math.pow(256, 3 - i);
-  if (value > 4294967295) return null;
-  return [value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
-}
-function expandIpv6(input) {
-  const s = input.toLowerCase();
-  if (!/^[0-9a-f:.]+$/.test(s)) return null;
-  if ((s.match(/::/g) ?? []).length > 1) return null;
-  let head = s;
-  let tailV4 = null;
-  const lastColon = s.lastIndexOf(":");
-  const afterLast = s.slice(lastColon + 1);
-  if (afterLast.includes(".")) {
-    const dotted = parseIpv4(afterLast);
-    if (!dotted) return null;
-    const o = dotted.split(".").map(Number);
-    tailV4 = [o[0] << 8 | o[1], o[2] << 8 | o[3]];
-    head = s.slice(0, lastColon + 1) + "0";
-  }
-  const [lhs, rhs] = head.includes("::") ? head.split("::") : [head, null];
-  const toGroups = (part) => {
-    if (!part) return [];
-    const out = [];
-    for (const g of part.split(":")) {
-      if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
-      out.push(parseInt(g, 16));
-    }
-    return out;
-  };
-  const left = toGroups(lhs);
-  if (left === null) return null;
-  let right = [];
-  if (rhs !== null) {
-    const r = toGroups(rhs);
-    if (r === null) return null;
-    right = r;
-  }
-  if (tailV4) {
-    if (rhs !== null) right = right.slice(0, -1).concat(tailV4);
-    else left.splice(left.length - 1, 1, ...tailV4);
-  }
-  const groups = rhs === null ? left : left.concat(new Array(8 - left.length - right.length).fill(0), right);
-  if (rhs === null && groups.length !== 8) return null;
-  if (rhs !== null && left.length + right.length > 8) return null;
-  if (groups.length !== 8) return null;
-  return groups;
-}
-function compressIpv6(g) {
-  let bestStart = -1;
-  let bestLen = 0;
-  let i = 0;
-  while (i < 8) {
-    if (g[i] !== 0) {
-      i++;
-      continue;
-    }
-    let j = i;
-    while (j < 8 && g[j] === 0) j++;
-    if (j - i > bestLen) {
-      bestLen = j - i;
-      bestStart = i;
-    }
-    i = j;
-  }
-  const hex = g.map((x) => x.toString(16));
-  if (bestLen < 2) return hex.join(":");
-  return hex.slice(0, bestStart).join(":") + "::" + hex.slice(bestStart + bestLen).join(":");
-}
-function normalizeIpLiteral(host) {
-  try {
-    if (typeof host !== "string") return null;
-    let s = host.trim();
-    if (!s || s.length > SSRF_MAX_HOST) return null;
-    if (s.startsWith("[") && s.endsWith("]")) s = s.slice(1, -1);
-    const zone = s.indexOf("%");
-    if (zone >= 0) s = s.slice(0, zone);
-    if (!s) return null;
-    if (s.includes(":")) {
-      const g = expandIpv6(s);
-      if (!g) return null;
-      const mapped = g.slice(0, 5).every((x) => x === 0) && g[5] === 65535;
-      if (mapped) {
-        return [g[6] >> 8 & 255, g[6] & 255, g[7] >> 8 & 255, g[7] & 255].join(".");
-      }
-      return compressIpv6(g);
-    }
-    return parseIpv4(s);
-  } catch {
-    return null;
-  }
-}
-var METADATA_ADDRESSES = /* @__PURE__ */ new Set([
-  "169.254.169.254",
-  // AWS / Azure / DigitalOcean / OpenStack IMDS
-  "169.254.170.2",
-  // AWS ECS task role
-  "168.63.129.16",
-  // Azure WireServer
-  "fd00:ec2::254",
-  // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
-  // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
-  // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
-  // live credential endpoint. It has to be named here, above the range check,
-  // and it is the reason relaxing cgnat is safe.
-  "100.100.100.200"
-]);
-var STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
-function isStrictGatedTier(tier) {
-  return STRICT_TIERS.has(tier);
-}
-function ssrfReason(m, asWritten) {
-  return `Blocked: ${asWritten} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== asWritten ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.");
-}
-var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
-var v4Octets = (a) => {
-  const p = a.split(".");
-  return p.length === 4 ? p.map(Number) : null;
-};
-function classifySsrf(host) {
-  try {
-    if (typeof host !== "string" || !host) return null;
-    const lower = host.trim().toLowerCase().replace(/\.$/, "");
-    const ip = normalizeIpLiteral(host);
-    if (ip === null) {
-      return METADATA_HOSTNAMES.has(lower) ? { tier: "metadata", overridable: false, kind: "hostname" } : null;
-    }
-    const hit = (tier, overridable) => ({
-      tier,
-      overridable,
-      kind: "address",
-      normalized: ip
-    });
-    if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
-    const o = v4Octets(ip);
-    if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
-      if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
-      if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
-      if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
-      if (o[0] === 127) return hit("private", true);
-      if (o[0] === 10) return hit("private", true);
-      if (o[0] === 192 && o[1] === 168) return hit("private", true);
-      if (o[0] === 172 && o[1] >= 16 && o[1] <= 31) return hit("private", true);
-      return null;
-    }
-    const g = expandIpv6(ip);
-    if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", true);
-    if ((g[0] & 65472) === 65152) return hit("link-local", false);
-    if ((g[0] & 65280) === 65280) return hit("multicast", false);
-    if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
-    return null;
-  } catch {
-    return null;
-  }
-}
-var TIER_REASON = {
-  metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
-  "link-local": "a link-local address",
-  multicast: "a multicast address",
-  unspecified: "the unspecified address, which reaches this host",
-  cgnat: "a carrier-grade NAT address",
-  private: "a loopback or private address"
-};
-function ssrfFloor(tokens, opts = {}) {
-  const exempt = new Set(
-    (opts.ssrfAllow ?? []).map((e) => normalizeIpLiteral(e) ?? e.trim().toLowerCase())
-  );
-  for (const { token, binary } of tokens) {
-    const m = classifySsrf(token);
-    if (!m) continue;
-    if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
-    if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
-    return { ...m, host: token, binary, reason: ssrfReason(m, token) };
-  }
-  return null;
-}
-
 // src/egress/destinations.ts
 var DESTINATION_ARGS = /* @__PURE__ */ new Map([
   ["webfetch", ["url"]],

package/dist/index.mjs

@@ -3073,6 +3073,213 @@ function analyzeShellCommand(command) {
   return { actions, paths, allTokens };
 }
 
+// src/egress/ssrf.ts
+var SSRF_MAX_HOST = 253;
+function parseComponent(s) {
+  if (!s) return null;
+  if (/^0[xX][0-9a-fA-F]+$/.test(s)) return parseInt(s.slice(2), 16);
+  if (s === "0") return 0;
+  if (/^0[0-7]+$/.test(s)) return parseInt(s.slice(1), 8);
+  if (/^[1-9][0-9]*$/.test(s)) return Number(s);
+  return null;
+}
+function parseIpv4(input) {
+  let s = input;
+  if (s.endsWith(".")) s = s.slice(0, -1);
+  if (!s) return null;
+  const parts = s.split(".");
+  if (parts.length > 4) return null;
+  const vals = [];
+  for (const p of parts) {
+    const v = parseComponent(p);
+    if (v === null || !Number.isFinite(v) || v < 0) return null;
+    vals.push(v);
+  }
+  const n = vals.length;
+  for (let i = 0; i < n - 1; i++) if (vals[i] > 255) return null;
+  const last = vals[n - 1];
+  const remainingBytes = 4 - (n - 1);
+  const limit = Math.pow(256, remainingBytes);
+  if (last >= limit) return null;
+  let value = last;
+  for (let i = 0; i < n - 1; i++) value += vals[i] * Math.pow(256, 3 - i);
+  if (value > 4294967295) return null;
+  return [value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
+}
+function expandIpv6(input) {
+  const s = input.toLowerCase();
+  if (!/^[0-9a-f:.]+$/.test(s)) return null;
+  if ((s.match(/::/g) ?? []).length > 1) return null;
+  let head = s;
+  let tailV4 = null;
+  const lastColon = s.lastIndexOf(":");
+  const afterLast = s.slice(lastColon + 1);
+  if (afterLast.includes(".")) {
+    const dotted = parseIpv4(afterLast);
+    if (!dotted) return null;
+    const o = dotted.split(".").map(Number);
+    tailV4 = [o[0] << 8 | o[1], o[2] << 8 | o[3]];
+    head = s.slice(0, lastColon + 1) + "0";
+  }
+  const [lhs, rhs] = head.includes("::") ? head.split("::") : [head, null];
+  const toGroups = (part) => {
+    if (!part) return [];
+    const out = [];
+    for (const g of part.split(":")) {
+      if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+      out.push(parseInt(g, 16));
+    }
+    return out;
+  };
+  const left = toGroups(lhs);
+  if (left === null) return null;
+  let right = [];
+  if (rhs !== null) {
+    const r = toGroups(rhs);
+    if (r === null) return null;
+    right = r;
+  }
+  if (tailV4) {
+    if (rhs !== null) right = right.slice(0, -1).concat(tailV4);
+    else left.splice(left.length - 1, 1, ...tailV4);
+  }
+  const groups = rhs === null ? left : left.concat(new Array(8 - left.length - right.length).fill(0), right);
+  if (rhs === null && groups.length !== 8) return null;
+  if (rhs !== null && left.length + right.length > 8) return null;
+  if (groups.length !== 8) return null;
+  return groups;
+}
+function compressIpv6(g) {
+  let bestStart = -1;
+  let bestLen = 0;
+  let i = 0;
+  while (i < 8) {
+    if (g[i] !== 0) {
+      i++;
+      continue;
+    }
+    let j = i;
+    while (j < 8 && g[j] === 0) j++;
+    if (j - i > bestLen) {
+      bestLen = j - i;
+      bestStart = i;
+    }
+    i = j;
+  }
+  const hex = g.map((x) => x.toString(16));
+  if (bestLen < 2) return hex.join(":");
+  return hex.slice(0, bestStart).join(":") + "::" + hex.slice(bestStart + bestLen).join(":");
+}
+function normalizeIpLiteral(host) {
+  try {
+    if (typeof host !== "string") return null;
+    let s = host.trim();
+    if (!s || s.length > SSRF_MAX_HOST) return null;
+    if (s.startsWith("[") && s.endsWith("]")) s = s.slice(1, -1);
+    const zone = s.indexOf("%");
+    if (zone >= 0) s = s.slice(0, zone);
+    if (!s) return null;
+    if (s.includes(":")) {
+      const g = expandIpv6(s);
+      if (!g) return null;
+      const mapped = g.slice(0, 5).every((x) => x === 0) && g[5] === 65535;
+      if (mapped) {
+        return [g[6] >> 8 & 255, g[6] & 255, g[7] >> 8 & 255, g[7] & 255].join(".");
+      }
+      return compressIpv6(g);
+    }
+    return parseIpv4(s);
+  } catch {
+    return null;
+  }
+}
+var METADATA_ADDRESSES = /* @__PURE__ */ new Set([
+  "169.254.169.254",
+  // AWS / Azure / DigitalOcean / OpenStack IMDS
+  "169.254.170.2",
+  // AWS ECS task role
+  "168.63.129.16",
+  // Azure WireServer
+  "fd00:ec2::254",
+  // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+  // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+  // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+  // live credential endpoint. It has to be named here, above the range check,
+  // and it is the reason relaxing cgnat is safe.
+  "100.100.100.200"
+]);
+var STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
+function isStrictGatedTier(tier) {
+  return STRICT_TIERS.has(tier);
+}
+function ssrfReason(m, asWritten) {
+  return `Blocked: ${asWritten} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== asWritten ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.");
+}
+var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
+var v4Octets = (a) => {
+  const p = a.split(".");
+  return p.length === 4 ? p.map(Number) : null;
+};
+function classifySsrf(host) {
+  try {
+    if (typeof host !== "string" || !host) return null;
+    const lower = host.trim().toLowerCase().replace(/\.$/, "");
+    const ip = normalizeIpLiteral(host);
+    if (ip === null) {
+      return METADATA_HOSTNAMES.has(lower) ? { tier: "metadata", overridable: false, kind: "hostname" } : null;
+    }
+    const hit = (tier, overridable) => ({
+      tier,
+      overridable,
+      kind: "address",
+      normalized: ip
+    });
+    if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
+    const o = v4Octets(ip);
+    if (o) {
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
+      if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
+      if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
+      if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
+      if (o[0] === 127) return hit("private", true);
+      if (o[0] === 10) return hit("private", true);
+      if (o[0] === 192 && o[1] === 168) return hit("private", true);
+      if (o[0] === 172 && o[1] >= 16 && o[1] <= 31) return hit("private", true);
+      return null;
+    }
+    const g = expandIpv6(ip);
+    if (!g) return null;
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
+    if ((g[0] & 65472) === 65152) return hit("link-local", false);
+    if ((g[0] & 65280) === 65280) return hit("multicast", false);
+    if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
+    return null;
+  } catch {
+    return null;
+  }
+}
+var TIER_REASON = {
+  metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
+  "link-local": "a link-local address",
+  multicast: "a multicast address",
+  unspecified: "the unspecified address, which reaches this host",
+  cgnat: "a carrier-grade NAT address",
+  private: "a loopback or private address"
+};
+function ssrfFloor(tokens, opts = {}) {
+  const exempt = new Set(
+    (opts.ssrfAllow ?? []).map((e) => normalizeIpLiteral(e) ?? e.trim().toLowerCase())
+  );
+  for (const { token, binary } of tokens) {
+    const m = classifySsrf(token);
+    if (!m) continue;
+    if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
+    if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
+    return { ...m, host: token, binary, reason: ssrfReason(m, token) };
+  }
+  return null;
+}
+
 // src/egress/index.ts
 var DEFAULT_EGRESS_ALLOWLIST = [
   // node9's own control plane (api, app, dev-api, staging and the apex).
@@ -3112,15 +3319,20 @@ function matchesAny(host, patterns) {
   for (const p of patterns) if (hostMatches(host, p)) return true;
   return false;
 }
+var PRIVATE_HOST_SUFFIXES = [".local", ".internal", ".localhost"];
+function isUniqueLocalV6(host) {
+  const ip = normalizeIpLiteral(host);
+  if (!ip || !ip.includes(":")) return false;
+  const g = expandIpv6(ip);
+  return g !== null && (g[0] & 65024) === 64512;
+}
 function isPrivateHost(host) {
-  const h = host.toLowerCase();
-  if (h === "localhost" || h === "0.0.0.0") return true;
-  if (h.endsWith(".local") || h.endsWith(".internal") || h.endsWith(".localhost")) return true;
-  if (/^127\./.test(h)) return true;
-  if (/^10\./.test(h)) return true;
-  if (/^192\.168\./.test(h)) return true;
-  if (/^172\.(1[6-9]|2\d|3[01])\./.test(h)) return true;
-  return false;
+  const h = host.trim().toLowerCase();
+  const m = classifySsrf(h);
+  if (m) return m.kind === "address" && (m.tier === "private" || m.tier === "unspecified");
+  if (h === "localhost") return true;
+  if (PRIVATE_HOST_SUFFIXES.some((s) => h.endsWith(s))) return true;
+  return isUniqueLocalV6(h);
 }
 function evaluateEgress(dests, policy) {
   if (!policy.enabled) return null;
@@ -3474,213 +3686,6 @@ function parseAllSshHostsFromCommand(command) {
   return extractAllSshHosts(tokens.slice(1));
 }
 
-// src/egress/ssrf.ts
-var SSRF_MAX_HOST = 253;
-function parseComponent(s) {
-  if (!s) return null;
-  if (/^0[xX][0-9a-fA-F]+$/.test(s)) return parseInt(s.slice(2), 16);
-  if (s === "0") return 0;
-  if (/^0[0-7]+$/.test(s)) return parseInt(s.slice(1), 8);
-  if (/^[1-9][0-9]*$/.test(s)) return Number(s);
-  return null;
-}
-function parseIpv4(input) {
-  let s = input;
-  if (s.endsWith(".")) s = s.slice(0, -1);
-  if (!s) return null;
-  const parts = s.split(".");
-  if (parts.length > 4) return null;
-  const vals = [];
-  for (const p of parts) {
-    const v = parseComponent(p);
-    if (v === null || !Number.isFinite(v) || v < 0) return null;
-    vals.push(v);
-  }
-  const n = vals.length;
-  for (let i = 0; i < n - 1; i++) if (vals[i] > 255) return null;
-  const last = vals[n - 1];
-  const remainingBytes = 4 - (n - 1);
-  const limit = Math.pow(256, remainingBytes);
-  if (last >= limit) return null;
-  let value = last;
-  for (let i = 0; i < n - 1; i++) value += vals[i] * Math.pow(256, 3 - i);
-  if (value > 4294967295) return null;
-  return [value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
-}
-function expandIpv6(input) {
-  const s = input.toLowerCase();
-  if (!/^[0-9a-f:.]+$/.test(s)) return null;
-  if ((s.match(/::/g) ?? []).length > 1) return null;
-  let head = s;
-  let tailV4 = null;
-  const lastColon = s.lastIndexOf(":");
-  const afterLast = s.slice(lastColon + 1);
-  if (afterLast.includes(".")) {
-    const dotted = parseIpv4(afterLast);
-    if (!dotted) return null;
-    const o = dotted.split(".").map(Number);
-    tailV4 = [o[0] << 8 | o[1], o[2] << 8 | o[3]];
-    head = s.slice(0, lastColon + 1) + "0";
-  }
-  const [lhs, rhs] = head.includes("::") ? head.split("::") : [head, null];
-  const toGroups = (part) => {
-    if (!part) return [];
-    const out = [];
-    for (const g of part.split(":")) {
-      if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
-      out.push(parseInt(g, 16));
-    }
-    return out;
-  };
-  const left = toGroups(lhs);
-  if (left === null) return null;
-  let right = [];
-  if (rhs !== null) {
-    const r = toGroups(rhs);
-    if (r === null) return null;
-    right = r;
-  }
-  if (tailV4) {
-    if (rhs !== null) right = right.slice(0, -1).concat(tailV4);
-    else left.splice(left.length - 1, 1, ...tailV4);
-  }
-  const groups = rhs === null ? left : left.concat(new Array(8 - left.length - right.length).fill(0), right);
-  if (rhs === null && groups.length !== 8) return null;
-  if (rhs !== null && left.length + right.length > 8) return null;
-  if (groups.length !== 8) return null;
-  return groups;
-}
-function compressIpv6(g) {
-  let bestStart = -1;
-  let bestLen = 0;
-  let i = 0;
-  while (i < 8) {
-    if (g[i] !== 0) {
-      i++;
-      continue;
-    }
-    let j = i;
-    while (j < 8 && g[j] === 0) j++;
-    if (j - i > bestLen) {
-      bestLen = j - i;
-      bestStart = i;
-    }
-    i = j;
-  }
-  const hex = g.map((x) => x.toString(16));
-  if (bestLen < 2) return hex.join(":");
-  return hex.slice(0, bestStart).join(":") + "::" + hex.slice(bestStart + bestLen).join(":");
-}
-function normalizeIpLiteral(host) {
-  try {
-    if (typeof host !== "string") return null;
-    let s = host.trim();
-    if (!s || s.length > SSRF_MAX_HOST) return null;
-    if (s.startsWith("[") && s.endsWith("]")) s = s.slice(1, -1);
-    const zone = s.indexOf("%");
-    if (zone >= 0) s = s.slice(0, zone);
-    if (!s) return null;
-    if (s.includes(":")) {
-      const g = expandIpv6(s);
-      if (!g) return null;
-      const mapped = g.slice(0, 5).every((x) => x === 0) && g[5] === 65535;
-      if (mapped) {
-        return [g[6] >> 8 & 255, g[6] & 255, g[7] >> 8 & 255, g[7] & 255].join(".");
-      }
-      return compressIpv6(g);
-    }
-    return parseIpv4(s);
-  } catch {
-    return null;
-  }
-}
-var METADATA_ADDRESSES = /* @__PURE__ */ new Set([
-  "169.254.169.254",
-  // AWS / Azure / DigitalOcean / OpenStack IMDS
-  "169.254.170.2",
-  // AWS ECS task role
-  "168.63.129.16",
-  // Azure WireServer
-  "fd00:ec2::254",
-  // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
-  // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
-  // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
-  // live credential endpoint. It has to be named here, above the range check,
-  // and it is the reason relaxing cgnat is safe.
-  "100.100.100.200"
-]);
-var STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
-function isStrictGatedTier(tier) {
-  return STRICT_TIERS.has(tier);
-}
-function ssrfReason(m, asWritten) {
-  return `Blocked: ${asWritten} is ${TIER_REASON[m.tier]}` + (m.normalized && m.normalized !== asWritten ? ` (${m.normalized})` : "") + (m.overridable ? "." : ". This address cannot be allowlisted.");
-}
-var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
-var v4Octets = (a) => {
-  const p = a.split(".");
-  return p.length === 4 ? p.map(Number) : null;
-};
-function classifySsrf(host) {
-  try {
-    if (typeof host !== "string" || !host) return null;
-    const lower = host.trim().toLowerCase().replace(/\.$/, "");
-    const ip = normalizeIpLiteral(host);
-    if (ip === null) {
-      return METADATA_HOSTNAMES.has(lower) ? { tier: "metadata", overridable: false, kind: "hostname" } : null;
-    }
-    const hit = (tier, overridable) => ({
-      tier,
-      overridable,
-      kind: "address",
-      normalized: ip
-    });
-    if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
-    const o = v4Octets(ip);
-    if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
-      if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
-      if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
-      if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
-      if (o[0] === 127) return hit("private", true);
-      if (o[0] === 10) return hit("private", true);
-      if (o[0] === 192 && o[1] === 168) return hit("private", true);
-      if (o[0] === 172 && o[1] >= 16 && o[1] <= 31) return hit("private", true);
-      return null;
-    }
-    const g = expandIpv6(ip);
-    if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", true);
-    if ((g[0] & 65472) === 65152) return hit("link-local", false);
-    if ((g[0] & 65280) === 65280) return hit("multicast", false);
-    if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
-    return null;
-  } catch {
-    return null;
-  }
-}
-var TIER_REASON = {
-  metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
-  "link-local": "a link-local address",
-  multicast: "a multicast address",
-  unspecified: "the unspecified address, which reaches this host",
-  cgnat: "a carrier-grade NAT address",
-  private: "a loopback or private address"
-};
-function ssrfFloor(tokens, opts = {}) {
-  const exempt = new Set(
-    (opts.ssrfAllow ?? []).map((e) => normalizeIpLiteral(e) ?? e.trim().toLowerCase())
-  );
-  for (const { token, binary } of tokens) {
-    const m = classifySsrf(token);
-    if (!m) continue;
-    if (isStrictGatedTier(m.tier) && !opts.ssrfStrict) continue;
-    if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
-    return { ...m, host: token, binary, reason: ssrfReason(m, token) };
-  }
-  return null;
-}
-
 // src/egress/destinations.ts
 var DESTINATION_ARGS = /* @__PURE__ */ new Map([
   ["webfetch", ["url"]],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/policy-engine",
-  "version": "2.16.1",
+  "version": "2.16.2",
   "description": "Shared policy evaluation engine for node9 — DLP, smart rules, AST shell parsing, shields, loop detection. Pure functions, no I/O. Used by both node9-proxy and the node9 SaaS firewall.",
   "license": "Apache-2.0",
   "homepage": "https://node9.ai",