@raidiant/notifai 10.1.0 → 10.1.2

package/src/ui/theme.ts

@@ -1,265 +0,0 @@
-/**
- * One visual language for every human-facing surface: help, `config show`,
- * `doctor`, and the interactive app.
- *
- * Two rules hold everything here together.
- *
- * Colour is decoration, never information. Every state that colour marks also
- * carries a glyph and a word, because the output is read through pipes, on
- * monochrome terminals, by screen readers, and by people who cannot separate
- * red from green. `picocolors` resolves to identity functions when stdout is
- * not a TTY or `NO_COLOR` is set, so the plain path is the same code, not a
- * second implementation that can drift.
- *
- * And an agent's bytes are not ours to restyle. Machine-readable output
- * (`--json`) never routes through this module, and every non-TTY invocation
- * lands on the uncoloured branch by construction.
- */
-import pc from 'picocolors'
-
-/** True when the terminal can render the box-drawing and status glyphs below. */
-export const unicode: boolean =
-  process.platform !== 'win32' ||
-  process.env['WT_SESSION'] !== undefined ||
-  process.env['TERM_PROGRAM'] === 'vscode' ||
-  process.env['ConEmuTask'] === '{cmd::Cmder}'
-
-/** True when 24-bit colour is available, which the banner gradient needs. */
-function supportsTrueColor(env: NodeJS.ProcessEnv = process.env): boolean {
-  if (!pc.isColorSupported) return false
-  const colorterm = env['COLORTERM'] ?? ''
-  if (/^(truecolor|24bit)$/i.test(colorterm)) return true
-  return env['TERM_PROGRAM'] === 'iTerm.app' || env['TERM_PROGRAM'] === 'vscode'
-}
-
-export const color = pc
-
-/**
- * Brand ramp, shared with the companion app icon: pink → coral → rose →
- * magenta. Used for the wordmark and for accenting the surfaces a human sees.
- */
-export const BRAND_RAMP = ['#FF9EC0', '#FF816B', '#EC5A73', '#B84E93'] as const
-
-interface Rgb {
-  r: number
-  g: number
-  b: number
-}
-
-function hexToRgb(hex: string): Rgb {
-  const value = Number.parseInt(hex.slice(1), 16)
-  return { r: (value >> 16) & 255, g: (value >> 8) & 255, b: value & 255 }
-}
-
-function mix(a: Rgb, b: Rgb, t: number): Rgb {
-  return {
-    r: Math.round(a.r + (b.r - a.r) * t),
-    g: Math.round(a.g + (b.g - a.g) * t),
-    b: Math.round(a.b + (b.b - a.b) * t),
-  }
-}
-
-/**
- * Sample the brand ramp at `t` in [0, 1]. Multi-stop so the gradient keeps the
- * icon's coral midtones instead of washing straight from pink to magenta.
- */
-function rampAt(t: number, ramp: readonly string[] = BRAND_RAMP): string {
-  const clamped = Math.min(1, Math.max(0, t))
-  const span = ramp.length - 1
-  const scaled = clamped * span
-  const index = Math.min(span - 1, Math.floor(scaled))
-  const { r, g, b } = mix(hexToRgb(ramp[index]!), hexToRgb(ramp[index + 1]!), scaled - index)
-  return `[38;2;${r};${g};${b}m`
-}
-
-const RESET = ''
-
-/**
- * SGR escape sequences, in the three shapes the helpers below need: stripping
- * them to measure, splitting around them to slice, and recognising one on its
- * own. Kept together so a change to what counts as an escape lands once.
- */
-const ANSI_GLOBAL = /\[[0-9;]*m/g
-const ANSI_SPLIT = /(\[[0-9;]*m)/
-const ANSI_ONLY = /^\[[0-9;]*m$/
-
-
-/**
- * Paint each line of a block so the gradient runs left-to-right across the
- * whole block rather than restarting per line. The wordmark is one image, and
- * per-line gradients make it read as several.
- */
-export function gradientBlock(lines: readonly string[], ramp: readonly string[] = BRAND_RAMP): string[] {
-  if (!pc.isColorSupported) return [...lines]
-  const width = Math.max(1, ...lines.map((line) => [...line].length))
-  if (!supportsTrueColor()) return lines.map((line) => pc.magenta(line))
-  return lines.map((line) =>
-    [...line]
-      .map((char, i) => (char === ' ' ? char : `${rampAt(i / Math.max(1, width - 1), ramp)}${char}`))
-      .join('') + RESET,
-  )
-}
-
-// ---------------------------------------------------------------------------
-// Semantic styles
-// ---------------------------------------------------------------------------
-
-export const style = {
-  /** A heading that opens a section. */
-  heading: (text: string): string => pc.bold(text),
-  /** The brand voice — command names, the product name, the selected thing. */
-  accent: (text: string): string => pc.magenta(text),
-  /** Secondary text: hints, provenance, units, defaults. */
-  dim: (text: string): string => pc.dim(text),
-  /** Something the reader can type. */
-  code: (text: string): string => pc.cyan(text),
-  ok: (text: string): string => pc.green(text),
-  warn: (text: string): string => pc.yellow(text),
-  bad: (text: string): string => pc.red(text),
-  /** A value as it currently stands. */
-  value: (text: string): string => pc.bold(pc.white(text)),
-  /** A value that is not set, or is inherited rather than chosen. */
-  unset: (text: string): string => pc.dim(pc.italic(text)),
-} as const
-
-/**
- * Status marks. The glyph and the colour say the same thing twice on purpose;
- * either alone is enough to read the line.
- */
-export const glyph = {
-  ok: unicode ? '●' : '*',
-  warn: unicode ? '▲' : '!',
-  bad: unicode ? '✕' : 'x',
-  pending: unicode ? '○' : 'o',
-  bullet: unicode ? '•' : '-',
-  arrow: unicode ? '→' : '->',
-  chevron: unicode ? '›' : '>',
-  bar: unicode ? '│' : '|',
-} as const
-
-export type Tone = 'ok' | 'warn' | 'bad' | 'pending'
-
-/** A coloured glyph for a tone; the caller supplies the words. */
-export function mark(tone: Tone): string {
-  switch (tone) {
-    case 'ok':
-      return style.ok(glyph.ok)
-    case 'warn':
-      return style.warn(glyph.warn)
-    case 'bad':
-      return style.bad(glyph.bad)
-    case 'pending':
-      return style.dim(glyph.pending)
-  }
-}
-
-/** Visible width, ignoring ANSI escapes, for alignment maths. */
-export function width(text: string): number {
-  return [...text.replace(ANSI_GLOBAL, '')].length
-}
-
-/** Pad to `size` using visible width, so colour never breaks a column. */
-export function pad(text: string, size: number): string {
-  return text + ' '.repeat(Math.max(0, size - width(text)))
-}
-
-/**
- * Usable terminal width: the real one, capped so paragraphs do not run to 200
- * characters on a maximised window.
- *
- * No lower clamp. Raising a narrow terminal to a comfortable minimum sounds
- * harmless and is not — every box drawn to that invented width overflows the
- * real one and wraps, which looks far worse than a cramped box that fits.
- */
-export function terminalWidth(fallback = 80): number {
-  const columns = process.stdout.columns
-  if (typeof columns !== 'number' || columns <= 0) return fallback
-  return Math.min(100, columns)
-}
-
-/**
- * A titled box around `rows`.
- *
- * Hand-drawn rather than delegated, because the obvious library call sizes
- * itself from `process.stdout.columns` and divides by it — a pty that reports
- * zero columns (some CI runners, some `script` invocations) makes the padding
- * negative and throws, taking the whole screen down with it. A status card is
- * decoration; it may degrade, but it must never be what crashes the app.
- *
- * Rows are measured with `width`, so colour inside them does not skew the
- * border, and anything too wide for the terminal is clipped rather than
- * wrapped — a status line that wraps stops being a status line.
- */
-export function card(title: string, rows: readonly string[], columns = terminalWidth()): string[] {
-  const [tl, tr, bl, br, h, v] = unicode
-    ? ['╭', '╮', '╰', '╯', '─', '│']
-    : ['+', '+', '+', '+', '-', '|']
-  const inner = Math.max(20, columns - 4)
-  const content = rows.map((row) => (width(row) > inner ? clip(row, inner) : row))
-  const bodyWidth = Math.max(width(title) + 4, ...content.map((row) => width(row)))
-  const boxWidth = Math.min(inner, bodyWidth)
-  const heading = `${h} ${style.heading(title)} `
-  const lines: string[] = []
-  lines.push(style.dim(tl) + heading + style.dim(h!.repeat(Math.max(0, boxWidth - width(heading) + 2))) + style.dim(tr))
-  for (const row of content) {
-    lines.push(`${style.dim(v)} ${pad(row, boxWidth)} ${style.dim(v)}`)
-  }
-  lines.push(style.dim(bl! + h!.repeat(boxWidth + 2) + br))
-  return lines
-}
-
-/**
- * Truncate to a visible width, carrying escape sequences through untouched.
- *
- * Counting only printable characters is the whole point: slicing a coloured
- * string by `String.length` cuts through an escape sequence and spills raw
- * `[38;2` into the terminal.
- */
-export function clip(text: string, limit: number): string {
-  if (width(text) <= limit) return text
-  const parts = text.split(ANSI_SPLIT)
-  let out = ''
-  let visible = 0
-  for (const part of parts) {
-    if (part === undefined || part === '') continue
-    if (ANSI_ONLY.test(part)) {
-      out += part
-      continue
-    }
-    for (const char of part) {
-      if (visible >= limit - 1) return `${out}\u2026${RESET}`
-      out += char
-      visible += 1
-    }
-  }
-  return `${out}${RESET}`
-}
-
-/**
- * Wrap `text` to `columns`, returning bare lines.
- *
- * Indentation is the caller's, deliberately: an earlier version indented
- * continuation lines itself, callers indented every line as well, and each
- * wrapped paragraph stepped further right down the page.
- */
-export function wrap(text: string, columns: number): string[] {
-  // Honour the width asked for. A floor here would silently ignore small
-  // values and hand back lines wider than the caller reserved room for; a
-  // width of zero or less is the only nonsense, and that falls back.
-  const limit = columns > 0 ? columns : 80
-  const words = text.split(/\s+/).filter(Boolean)
-  if (words.length === 0) return ['']
-  const lines: string[] = []
-  let line = ''
-  for (const word of words) {
-    const candidate = line === '' ? word : `${line} ${word}`
-    if (width(candidate) > limit && line !== '') {
-      lines.push(line)
-      line = word
-    } else {
-      line = candidate
-    }
-  }
-  if (line !== '') lines.push(line)
-  return lines
-}

package/src/url-policy.ts

@@ -1,399 +0,0 @@
-import { lookup as dnsLookup } from 'node:dns/promises'
-import { request as httpRequest, type IncomingMessage } from 'node:http'
-import { request as httpsRequest } from 'node:https'
-import { BlockList, isIP } from 'node:net'
-import { Readable } from 'node:stream'
-
-/**
- * The URL trust policy: which network destinations this CLI will touch on
- * input it did not author. `docs/TRUST.md` is the written policy; this module
- * is its enforcement, and the two must change together.
- *
- * The threat is not a hostile user — it is hostile *input* reaching a
- * trusted user's CLI: a cloned repository, a compromised server response, or
- * an agent following text it found in a working tree. Every rule here is
- * therefore fail-closed, and every escape hatch resolves only from
- * configuration layers the User owns — never from a repository.
- */
-
-/** The one dashboard origin the shipped service uses for pairing approval. */
-export const CANONICAL_DASHBOARD_ORIGIN = 'https://app.notifai.sh'
-
-/** Redirect hops a remote image fetch may follow, each re-validated. */
-export const MEDIA_REDIRECT_LIMIT = 3
-
-/** One address attempt must not hold an agent command indefinitely. */
-export const MEDIA_FETCH_TIMEOUT_MS = 15_000
-
-export type UrlRefusal = { ok: false; reason: string }
-
-/**
- * Normalize one configured origin entry to `scheme://host[:port]`, or null
- * when the entry is not a bare http(s) origin. Paths, queries, fragments, and
- * userinfo are rejected rather than stripped: a config entry that carries
- * them says the author expected them to matter, and silently ignoring parts
- * of a trust rule is how allowlists rot.
- */
-export function normalizeOrigin(entry: string): string | null {
-  let url: URL
-  try {
-    url = new URL(entry)
-  } catch {
-    return null
-  }
-  if (url.protocol !== 'https:' && url.protocol !== 'http:') return null
-  if (url.username !== '' || url.password !== '') return null
-  if (url.pathname !== '/' || url.search !== '' || url.hash !== '') return null
-  // `https://*.example` parses, and would then match exactly one impossible
-  // host while reading like a wildcard. Refusing it is how someone finds out
-  // that origins are exact before they trust one that never matches.
-  if (!/^(?:[a-z0-9-]+(?:\.[a-z0-9-]+)*|\[[0-9a-f:.]+\])$/i.test(url.hostname)) return null
-  return url.origin
-}
-
-/**
- * Addresses that are not publicly routable: loopback, RFC 1918, link-local
- * (including cloud metadata at 169.254.169.254), CGNAT, benchmark,
- * documentation, multicast, and reserved space; for IPv6 also unspecified,
- * unique-local, site-local, and discard prefixes. IPv4-mapped IPv6 addresses
- * are classified as the IPv4 address they carry.
- */
-const NON_PUBLIC = new BlockList()
-const PUBLIC_IPV6 = new BlockList()
-PUBLIC_IPV6.addSubnet('2000::', 3, 'ipv6')
-for (const [subnet, prefix] of [
-  ['0.0.0.0', 8],
-  ['10.0.0.0', 8],
-  ['100.64.0.0', 10],
-  ['127.0.0.0', 8],
-  ['169.254.0.0', 16],
-  ['172.16.0.0', 12],
-  ['192.0.0.0', 24],
-  ['192.0.2.0', 24],
-  ['192.88.99.0', 24],
-  ['192.168.0.0', 16],
-  ['198.18.0.0', 15],
-  ['198.51.100.0', 24],
-  ['203.0.113.0', 24],
-  ['224.0.0.0', 4],
-  ['240.0.0.0', 4],
-] as const) {
-  NON_PUBLIC.addSubnet(subnet, prefix, 'ipv4')
-}
-for (const [subnet, prefix] of [
-  ['::', 128],
-  ['::1', 128],
-  ['64:ff9b::', 96], // NAT64 — fail closed rather than trust the embedded address
-  ['64:ff9b:1::', 48],
-  ['100::', 64],
-  ['2001::', 32], // Teredo embeds an IPv4 destination
-  ['2001:2::', 48],
-  ['2001:10::', 28],
-  ['2001:20::', 28],
-  ['2001:db8::', 32],
-  ['2002::', 16], // 6to4 embeds an IPv4 address; fail closed
-  ['3fff::', 20],
-  ['fc00::', 7],
-  ['fe80::', 10],
-  ['fec0::', 10],
-  ['ff00::', 8],
-  // Deliberately no `::ffff:0:0/96` rule: Node checks an IPv4 address against
-  // IPv6 rules through its own IPv4-mapped form, so that entry would classify
-  // every address on the internet as private. `mappedIpv4` handles the mapped
-  // spellings instead.
-] as const) {
-  NON_PUBLIC.addSubnet(subnet, prefix, 'ipv6')
-}
-
-/**
- * The IPv4 address an IPv4-mapped IPv6 address carries, in either spelling:
- * `::ffff:127.0.0.1` and `::ffff:7f00:1` are the same address, and only the
- * first would survive being classified as IPv6.
- */
-function mappedIpv4(address: string): string | null {
-  const lower = address.toLowerCase()
-  if (!lower.startsWith('::ffff:')) return null
-  const rest = lower.slice('::ffff:'.length)
-  if (isIP(rest) === 4) return rest
-  const hex = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(rest)
-  if (hex === null) return null
-  const high = Number.parseInt(hex[1]!, 16)
-  const low = Number.parseInt(hex[2]!, 16)
-  return `${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`
-}
-
-/** Whether one IP literal is publicly routable. */
-export function isPublicAddress(address: string): boolean {
-  const candidate = mappedIpv4(address) ?? address
-  const family = isIP(candidate)
-  if (family === 0) return false
-  // Fail closed outside the currently allocated global-unicast block. This
-  // catches reserved IPv6 space without depending on an inevitably stale
-  // enumeration; explicit exclusions below then carve special-use prefixes
-  // out of global unicast itself.
-  if (family === 6 && !PUBLIC_IPV6.check(candidate, 'ipv6')) return false
-  return !NON_PUBLIC.check(candidate, family === 6 ? 'ipv6' : 'ipv4')
-}
-
-/** A URL hostname as an address-or-name: IPv6 hosts arrive bracketed. */
-function hostnameAddress(hostname: string): string {
-  return hostname.startsWith('[') && hostname.endsWith(']')
-    ? hostname.slice(1, -1)
-    : hostname
-}
-
-export function isLoopbackHostname(hostname: string): boolean {
-  const host = hostnameAddress(hostname).toLowerCase()
-  if (host === 'localhost' || host.endsWith('.localhost')) return true
-  const family = isIP(host)
-  if (family === 4) return host.startsWith('127.')
-  if (family === 6) return host === '::1' || /^::ffff:127\./.test(host)
-  return false
-}
-
-export interface MediaUrlPolicy {
-  /**
-   * Extra origins remote media may use beyond public HTTPS — the self-host
-   * and intranet escape hatch. Entries are normalized origins from
-   * User-owned configuration (`media_origins`); a repository cannot supply
-   * them.
-   */
-  allowOrigins: readonly string[]
-  /** Test seam; production resolves with the system resolver. */
-  lookup?: (hostname: string) => Promise<string[]>
-}
-
-type MediaUrlApproval = { ok: true; addresses: readonly string[] }
-
-async function resolveAddresses(
-  hostname: string,
-  policy: MediaUrlPolicy,
-): Promise<string[] | null> {
-  if (policy.lookup !== undefined) {
-    try {
-      return await policy.lookup(hostname)
-    } catch {
-      return null
-    }
-  }
-  try {
-    const results = await dnsLookup(hostname, { all: true, verbatim: true })
-    return results.map((entry) => entry.address)
-  } catch {
-    return null
-  }
-}
-
-/**
- * Whether one URL is a destination remote media may be fetched from.
- *
- * Default policy: `https` to a host every resolved address of which is
- * publicly routable. A User-allowed origin skips the scheme and address
- * checks — the User said that exact origin is theirs to trust — but nothing
- * skips the userinfo refusal, and every redirect hop is checked again.
- *
- * The approved addresses come back with the verdict rather than being
- * rediscovered later: `fetchMediaUrl` connects to one of exactly these, so a
- * resolver that would answer differently on a second lookup cannot rebind the
- * request onto a private address between the check and the connection.
- */
-export async function checkMediaUrl(
-  target: URL,
-  policy: MediaUrlPolicy,
-): Promise<MediaUrlApproval | UrlRefusal> {
-  if (target.username !== '' || target.password !== '') {
-    return { ok: false, reason: 'Image URLs with embedded credentials are never fetched.' }
-  }
-  if (target.protocol !== 'https:' && target.protocol !== 'http:') {
-    return { ok: false, reason: `Only http(s) image URLs are supported, not ${target.protocol.replace(/:$/, '')}.` }
-  }
-  const userAllowed = policy.allowOrigins.includes(target.origin)
-  const escapeHatch =
-    'Remote images use public HTTPS; for a self-hosted or intranet image server, allow its exact origin with `notifai config set media_origins <origin>`.'
-  if (!userAllowed && target.protocol !== 'https:') {
-    return { ok: false, reason: `${target.origin} is http. ${escapeHatch}` }
-  }
-  const literal = hostnameAddress(target.hostname)
-  if (isIP(literal) !== 0) {
-    return userAllowed || isPublicAddress(literal)
-      ? { ok: true, addresses: [literal] }
-      : { ok: false, reason: `${target.hostname} is not a public address. ${escapeHatch}` }
-  }
-  const addresses = await resolveAddresses(target.hostname, policy)
-  if (addresses === null || addresses.length === 0) {
-    return { ok: false, reason: `Could not resolve ${target.hostname}.` }
-  }
-  if (addresses.some((address) => isIP(address) === 0)) {
-    return { ok: false, reason: `${target.hostname} resolved to an invalid address.` }
-  }
-  if (!userAllowed && !addresses.every((address) => isPublicAddress(address))) {
-    return { ok: false, reason: `${target.hostname} resolves to a non-public address. ${escapeHatch}` }
-  }
-  return { ok: true, addresses }
-}
-
-const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308])
-
-function responseHeaders(response: IncomingMessage): Headers {
-  const headers = new Headers()
-  for (const [name, value] of Object.entries(response.headers)) {
-    if (Array.isArray(value)) {
-      for (const entry of value) headers.append(name, entry)
-    } else if (value !== undefined) {
-      headers.set(name, value)
-    }
-  }
-  return headers
-}
-
-/**
- * Fetch through one already-vetted address while retaining the URL hostname
- * for Host and TLS verification. This closes the DNS-rebinding gap between
- * policy resolution and the connection: the request cannot resolve the name
- * a second time to a private address.
- */
-async function fetchPinned(target: URL, addresses: readonly string[]): Promise<Response> {
-  let lastError: unknown = new Error(`No address was available for ${target.hostname}.`)
-  for (const address of addresses) {
-    try {
-      return await new Promise<Response>((resolve, reject) => {
-        const family = isIP(address)
-        const request = (target.protocol === 'https:' ? httpsRequest : httpRequest)(
-          target,
-          {
-            method: 'GET',
-            headers: { 'accept-encoding': 'identity' },
-            signal: AbortSignal.timeout(MEDIA_FETCH_TIMEOUT_MS),
-            // Node asks for every address at once when it is racing address
-            // families, and for a single one otherwise. Answering in the wrong
-            // shape throws inside the connect path rather than failing the
-            // request, so both forms are answered explicitly.
-            lookup: (_hostname, options, callback) => {
-              if (options.all === true) {
-                callback(null, [{ address, family }])
-                return
-              }
-              callback(null, address, family)
-            },
-          },
-          (incoming) => {
-            const status = incoming.statusCode ?? 500
-            const hasBody = ![101, 204, 205, 304].includes(status)
-            const body = hasBody
-              ? (Readable.toWeb(incoming) as ReadableStream<Uint8Array>)
-              : null
-            resolve(
-              new Response(body, {
-                status,
-                ...(incoming.statusMessage === undefined
-                  ? {}
-                  : { statusText: incoming.statusMessage }),
-                headers: responseHeaders(incoming),
-              }),
-            )
-          },
-        )
-        request.once('error', reject)
-        request.end()
-      })
-    } catch (error) {
-      lastError = error
-    }
-  }
-  throw lastError
-}
-
-/**
- * Fetch a remote image under the media URL policy, following at most
- * `MEDIA_REDIRECT_LIMIT` redirects and re-validating every hop — a public
- * HTTPS URL redirecting into an intranet is the exact attack the per-hop
- * check exists for.
- */
-export async function fetchMediaUrl(
-  source: string,
-  policy: MediaUrlPolicy,
-  fetchImpl?: typeof fetch,
-): Promise<{ ok: true; response: Response } | UrlRefusal> {
-  let target: URL
-  try {
-    target = new URL(source)
-  } catch {
-    return { ok: false, reason: `"${source}" is not a valid URL.` }
-  }
-  for (let hop = 0; ; hop += 1) {
-    const allowed = await checkMediaUrl(target, policy)
-    if (!allowed.ok) return allowed
-    const response =
-      fetchImpl === undefined
-        ? await fetchPinned(target, allowed.addresses)
-        : await fetchImpl(target, { redirect: 'manual' })
-    if (!REDIRECT_STATUSES.has(response.status)) return { ok: true, response }
-    const location = response.headers.get('location')
-    await response.body?.cancel()
-    if (location === null) {
-      return { ok: false, reason: `${target.origin} redirected without a destination.` }
-    }
-    if (hop >= MEDIA_REDIRECT_LIMIT) {
-      return { ok: false, reason: `${source} redirected more than ${MEDIA_REDIRECT_LIMIT} times.` }
-    }
-    try {
-      target = new URL(location, target)
-    } catch {
-      return { ok: false, reason: `${target.origin} redirected to an invalid URL.` }
-    }
-  }
-}
-
-/**
- * Whether a server-supplied pairing approval URL may be shown and opened.
- *
- * The server chooses `approve_url`, so a compromised or misconfigured one
- * must not be able to drive this machine's browser to an arbitrary
- * destination. Allowed: the canonical dashboard, the exact origin the user
- * pointed this pairing at, loopback for local development, and origins the
- * User allowed (`approve_origins`) for a self-host whose dashboard lives on
- * a different origin than its API.
- */
-export function checkApproveUrl(
-  raw: string,
-  baseUrl: string,
-  allowOrigins: readonly string[],
-): { ok: true } | UrlRefusal {
-  let target: URL
-  try {
-    target = new URL(raw)
-  } catch {
-    return { ok: false, reason: `the server sent an invalid approval URL.` }
-  }
-  if (target.protocol !== 'https:' && target.protocol !== 'http:') {
-    return {
-      ok: false,
-      reason: `the server sent a ${target.protocol.replace(/:$/, '')} approval URL; only http(s) is ever opened.`,
-    }
-  }
-  if (target.username !== '' || target.password !== '') {
-    return { ok: false, reason: 'the server sent an approval URL with embedded credentials.' }
-  }
-  if (target.origin === CANONICAL_DASHBOARD_ORIGIN) return { ok: true }
-  if (isLoopbackHostname(target.hostname)) return { ok: true }
-  let pairingOrigin: string | null = null
-  try {
-    pairingOrigin = new URL(baseUrl).origin
-  } catch {
-    pairingOrigin = null
-  }
-  if (allowOrigins.includes(target.origin)) return { ok: true }
-  if (
-    pairingOrigin !== null &&
-    target.origin === pairingOrigin &&
-    target.protocol === 'https:'
-  ) {
-    return { ok: true }
-  }
-  return {
-    ok: false,
-    reason:
-      `the server sent an approval URL on ${target.origin}, which is not the Notifai dashboard, ` +
-      'the origin being paired with, loopback, or an origin in `approve_origins`.',
-  }
-}

package/tsconfig.json

@@ -1,10 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "outDir": "dist",
-    "rootDir": "src",
-    "types": ["node"]
-  },
-  "include": ["src"],
-  "exclude": ["src/**/*.test.ts"]
-}