@smthrs/std 0.0.0-stage → 1.0.0-rc.12

package/dist/cjs/internal/Html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Html.d.ts","sourceRoot":"","sources":["../../../src/internal/Html.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgDH;;;;;GAKG;AACH,eAAO,MAAM,MAAM,GAAI,MAAM,MAAM,KAAG,MAEiF,CAAA;AAEvH;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,KAAG,MAkBzC,CAAA"}

package/dist/cjs/internal/Html.js

@@ -0,0 +1,81 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var Html_exports = {};
+__export(Html_exports, {
+  toMarkdown: () => toMarkdown,
+  toText: () => toText
+});
+module.exports = __toCommonJS(Html_exports);
+const comments = /<!--[\s\S]*?-->/g;
+const entities = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " " };
+const dropSkipped = (html) => {
+  const lower = html.replace(/[A-Z]/g, (letter) => letter.toLowerCase());
+  const opening = /<(head|script|style|noscript|iframe|object|embed)\b/gi;
+  let output = "";
+  let cursor = 0;
+  let match;
+  while ((match = opening.exec(html)) !== null) {
+    output += html.slice(cursor, match.index);
+    const marker = `</${match[1].toLowerCase()}`;
+    let close = lower.indexOf(marker, opening.lastIndex);
+    while (close !== -1) {
+      let end = close + marker.length;
+      while (/\s/.test(lower[end] ?? "")) end++;
+      if (lower[end] === ">") {
+        cursor = end + 1;
+        opening.lastIndex = cursor;
+        break;
+      }
+      close = lower.indexOf(marker, close + marker.length);
+    }
+    if (close === -1) return output;
+  }
+  return output + html.slice(cursor);
+};
+const decode = (value) => value.replace(/&(#x[\da-f]+|#\d+|[a-z]+);/gi, (match, entity) => {
+  if (entity[0] === "#") {
+    const number = Number.parseInt(
+      entity.slice(entity[1].toLowerCase() === "x" ? 2 : 1),
+      entity[1].toLowerCase() === "x" ? 16 : 10
+    );
+    return number <= 1114111 && !(number >= 55296 && number <= 57343) ? String.fromCodePoint(number) : match;
+  }
+  const key = entity.toLowerCase();
+  return Object.hasOwn(entities, key) ? entities[key] : match;
+});
+const source = (html) => dropSkipped(html.replace(comments, ""));
+const toText = (html) => decode(source(html).replace(/<(br|\/p|\/div|\/li|\/h[1-6]|\/tr)\b[^>]*>/gi, "\n").replace(/<[^>]*>/g, " ")).replace(/[ \t]+\n/g, "\n").replace(/\n[ \t]+/g, "\n").replace(/\n{3,}/g, "\n\n").replace(/[ \t]{2,}/g, " ").trim();
+const toMarkdown = (html) => {
+  const markdown = source(html).replace(
+    /<h([1-6])\b[^>]*>([\s\S]*?)<\/h\1>/gi,
+    (_all, level, text) => `
+
+${"#".repeat(Number(level))} ${toText(text)}
+
+`
+  ).replace(/<(strong|b)\b[^>]*>([\s\S]*?)<\/\1>/gi, "**$2**").replace(/<(em|i)\b[^>]*>([\s\S]*?)<\/\1>/gi, "*$2*").replace(
+    /<a\b[^>]*href=["']([^"']+)["'][^>]*>([\s\S]*?)<\/a>/gi,
+    (_all, href, text) => `[${toText(text)}](${href})`
+  ).replace(/<li\b[^>]*>/gi, "\n- ").replace(
+    /<\/?(ul|ol|p|div|section|article|main|blockquote|pre|tr)\b[^>]*>/gi,
+    "\n"
+  ).replace(/<br\b[^>]*>/gi, "\n").replace(/<[^>]*>/g, "");
+  return decode(markdown).replace(/[ \t]+\n/g, "\n").replace(/\n{3,}/g, "\n\n").trim();
+};
+//# sourceMappingURL=Html.js.map

package/dist/cjs/internal/Html.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/internal/Html.ts"],
+  "sourcesContent": ["/**\n * Small, dependency-free HTML renderers for web retrieval.\n *\n * @since 1.0.0\n */\n\nconst comments = /<!--[\\s\\S]*?-->/g\nconst entities: Readonly<Record<string, string>> = { amp: \"&\", lt: \"<\", gt: \">\", quot: \"\\\"\", apos: \"'\", nbsp: \" \" }\n\nconst dropSkipped = (html: string): string => {\n  const lower = html.replace(/[A-Z]/g, (letter) => letter.toLowerCase())\n  const opening = /<(head|script|style|noscript|iframe|object|embed)\\b/gi\n  let output = \"\"\n  let cursor = 0\n  let match: RegExpExecArray | null\n  while ((match = opening.exec(html)) !== null) {\n    output += html.slice(cursor, match.index)\n    const marker = `</${match[1]!.toLowerCase()}`\n    let close = lower.indexOf(marker, opening.lastIndex)\n    while (close !== -1) {\n      let end = close + marker.length\n      while (/\\s/.test(lower[end] ?? \"\")) end++\n      if (lower[end] === \">\") {\n        cursor = end + 1\n        opening.lastIndex = cursor\n        break\n      }\n      close = lower.indexOf(marker, close + marker.length)\n    }\n    if (close === -1) return output\n  }\n  return output + html.slice(cursor)\n}\n\nconst decode = (value: string): string =>\n  value.replace(/&(#x[\\da-f]+|#\\d+|[a-z]+);/gi, (match, entity: string) => {\n    if (entity[0] === \"#\") {\n      const number = Number.parseInt(\n        entity.slice(entity[1]!.toLowerCase() === \"x\" ? 2 : 1),\n        entity[1]!.toLowerCase() === \"x\" ? 16 : 10\n      )\n      return number <= 0x10ffff\n          && !(number >= 0xd800 && number <= 0xdfff)\n        ? String.fromCodePoint(number)\n        : match\n    }\n    const key = entity.toLowerCase()\n    return Object.hasOwn(entities, key) ? entities[key]! : match\n  })\n\nconst source = (html: string): string => dropSkipped(html.replace(comments, \"\"))\n\n/**\n * Extracts readable text while dropping executable and presentation-only elements.\n *\n * @category rendering\n * @since 1.0.0\n */\nexport const toText = (html: string): string =>\n  decode(source(html).replace(/<(br|\\/p|\\/div|\\/li|\\/h[1-6]|\\/tr)\\b[^>]*>/gi, \"\\n\").replace(/<[^>]*>/g, \" \"))\n    .replace(/[ \\t]+\\n/g, \"\\n\").replace(/\\n[ \\t]+/g, \"\\n\").replace(/\\n{3,}/g, \"\\n\\n\").replace(/[ \\t]{2,}/g, \" \").trim()\n\n/**\n * Converts a conservative subset of HTML into readable Markdown.\n *\n * @category rendering\n * @since 1.0.0\n */\nexport const toMarkdown = (html: string): string => {\n  const markdown = source(html)\n    .replace(\n      /<h([1-6])\\b[^>]*>([\\s\\S]*?)<\\/h\\1>/gi,\n      (_all, level: string, text: string) => `\\n\\n${\"#\".repeat(Number(level))} ${toText(text)}\\n\\n`\n    )\n    .replace(/<(strong|b)\\b[^>]*>([\\s\\S]*?)<\\/\\1>/gi, \"**$2**\")\n    .replace(/<(em|i)\\b[^>]*>([\\s\\S]*?)<\\/\\1>/gi, \"*$2*\")\n    .replace(\n      /<a\\b[^>]*href=[\"']([^\"']+)[\"'][^>]*>([\\s\\S]*?)<\\/a>/gi,\n      (_all, href: string, text: string) => `[${toText(text)}](${href})`\n    )\n    .replace(/<li\\b[^>]*>/gi, \"\\n- \").replace(\n      /<\\/?(ul|ol|p|div|section|article|main|blockquote|pre|tr)\\b[^>]*>/gi,\n      \"\\n\"\n    )\n    .replace(/<br\\b[^>]*>/gi, \"\\n\").replace(/<[^>]*>/g, \"\")\n  return decode(markdown).replace(/[ \\t]+\\n/g, \"\\n\").replace(/\\n{3,}/g, \"\\n\\n\").trim()\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,MAAM,WAAW;AACjB,MAAM,WAA6C,EAAE,KAAK,KAAK,IAAI,KAAK,IAAI,KAAK,MAAM,KAAM,MAAM,KAAK,MAAM,IAAI;AAElH,MAAM,cAAc,CAAC,SAAyB;AAC5C,QAAM,QAAQ,KAAK,QAAQ,UAAU,CAAC,WAAW,OAAO,YAAY,CAAC;AACrE,QAAM,UAAU;AAChB,MAAI,SAAS;AACb,MAAI,SAAS;AACb,MAAI;AACJ,UAAQ,QAAQ,QAAQ,KAAK,IAAI,OAAO,MAAM;AAC5C,cAAU,KAAK,MAAM,QAAQ,MAAM,KAAK;AACxC,UAAM,SAAS,KAAK,MAAM,CAAC,EAAG,YAAY,CAAC;AAC3C,QAAI,QAAQ,MAAM,QAAQ,QAAQ,QAAQ,SAAS;AACnD,WAAO,UAAU,IAAI;AACnB,UAAI,MAAM,QAAQ,OAAO;AACzB,aAAO,KAAK,KAAK,MAAM,GAAG,KAAK,EAAE,EAAG;AACpC,UAAI,MAAM,GAAG,MAAM,KAAK;AACtB,iBAAS,MAAM;AACf,gBAAQ,YAAY;AACpB;AAAA,MACF;AACA,cAAQ,MAAM,QAAQ,QAAQ,QAAQ,OAAO,MAAM;AAAA,IACrD;AACA,QAAI,UAAU,GAAI,QAAO;AAAA,EAC3B;AACA,SAAO,SAAS,KAAK,MAAM,MAAM;AACnC;AAEA,MAAM,SAAS,CAAC,UACd,MAAM,QAAQ,gCAAgC,CAAC,OAAO,WAAmB;AACvE,MAAI,OAAO,CAAC,MAAM,KAAK;AACrB,UAAM,SAAS,OAAO;AAAA,MACpB,OAAO,MAAM,OAAO,CAAC,EAAG,YAAY,MAAM,MAAM,IAAI,CAAC;AAAA,MACrD,OAAO,CAAC,EAAG,YAAY,MAAM,MAAM,KAAK;AAAA,IAC1C;AACA,WAAO,UAAU,WACV,EAAE,UAAU,SAAU,UAAU,SACnC,OAAO,cAAc,MAAM,IAC3B;AAAA,EACN;AACA,QAAM,MAAM,OAAO,YAAY;AAC/B,SAAO,OAAO,OAAO,UAAU,GAAG,IAAI,SAAS,GAAG,IAAK;AACzD,CAAC;AAEH,MAAM,SAAS,CAAC,SAAyB,YAAY,KAAK,QAAQ,UAAU,EAAE,CAAC;AAQxE,MAAM,SAAS,CAAC,SACrB,OAAO,OAAO,IAAI,EAAE,QAAQ,gDAAgD,IAAI,EAAE,QAAQ,YAAY,GAAG,CAAC,EACvG,QAAQ,aAAa,IAAI,EAAE,QAAQ,aAAa,IAAI,EAAE,QAAQ,WAAW,MAAM,EAAE,QAAQ,cAAc,GAAG,EAAE,KAAK;AAQ/G,MAAM,aAAa,CAAC,SAAyB;AAClD,QAAM,WAAW,OAAO,IAAI,EACzB;AAAA,IACC;AAAA,IACA,CAAC,MAAM,OAAe,SAAiB;AAAA;AAAA,EAAO,IAAI,OAAO,OAAO,KAAK,CAAC,CAAC,IAAI,OAAO,IAAI,CAAC;AAAA;AAAA;AAAA,EACzF,EACC,QAAQ,yCAAyC,QAAQ,EACzD,QAAQ,qCAAqC,MAAM,EACnD;AAAA,IACC;AAAA,IACA,CAAC,MAAM,MAAc,SAAiB,IAAI,OAAO,IAAI,CAAC,KAAK,IAAI;AAAA,EACjE,EACC,QAAQ,iBAAiB,MAAM,EAAE;AAAA,IAChC;AAAA,IACA;AAAA,EACF,EACC,QAAQ,iBAAiB,IAAI,EAAE,QAAQ,YAAY,EAAE;AACxD,SAAO,OAAO,QAAQ,EAAE,QAAQ,aAAa,IAAI,EAAE,QAAQ,WAAW,MAAM,EAAE,KAAK;AACrF;",
+  "names": []
+}

package/dist/cjs/internal/Http.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Shared HTTP response limits, error mapping, and request deadlines.
+ *
+ * @since 1.0.0
+ */
+import type { GrantStore } from "@smthrs/kernel/GrantStore";
+import * as HttpClient from "@smthrs/kernel/HttpClient";
+import * as Effect from "effect/Effect";
+import * as HttpClientRequest from "effect/http/HttpClientRequest";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as StdError from "../StdError.ts";
+/**
+ * Maximum captured response bytes before decoding.
+ *
+ * @category http
+ * @since 1.0.0
+ */
+export declare const MAX_RESPONSE_BYTES: number;
+/**
+ * Reads a response up to the shared byte limit and finalizes the stream on failure.
+ *
+ * @category http
+ * @since 1.0.0
+ */
+export declare const readBounded: <E, R>(stream: Stream.Stream<Uint8Array, E, R>, url: string) => Effect.Effect<Uint8Array, E | StdError.StdError, R>;
+/**
+ * Maps transport failures while preserving standard HTTP failure codes.
+ *
+ * @category http
+ * @since 1.0.0
+ */
+export declare const requestError: (url: string, error: unknown) => StdError.StdError;
+/**
+ * Looks up a response header without depending on transport normalization.
+ *
+ * @category http
+ * @since 1.0.0
+ */
+export declare const header: (headers: Readonly<Record<string, string | undefined>>, name: string) => string | undefined;
+/**
+ * Seconds; the runtime caps valid overrides at 120.
+ *
+ * @category http
+ * @since 1.0.0
+ */
+export declare const Timeout: Schema.Number;
+/**
+ * Bounds the entire request and body read with one timer. Interruption reaches
+ * HttpClient.execute and response.stream so Effect aborts the transport and
+ * finalizes the body reader before returning the timeout failure.
+ * `timeoutError` preserves a tool's own timeout message while sharing the
+ * validation, duration cap, and interruption behavior.
+ *
+ * @category http
+ * @since 1.0.0
+ */
+export declare const withDeadline: <A, E, R>(effect: Effect.Effect<A, E, R>, url: string, timeout?: number, timeoutError?: (seconds: number) => StdError.StdError) => Effect.Effect<A, E | StdError.StdError, R>;
+/**
+ * Keeps the head of rendered response text within the shared output budget and
+ * discloses the cut.
+ *
+ * @since 1.0.0
+ * @private
+ */
+export declare const capOutput: (text: string) => {
+    readonly text: string;
+    readonly truncated: boolean;
+    readonly notice?: string;
+};
+/** Shared response contract for the GET and POST tools.
+ * @since 1.0.0
+ * @private
+ */
+export declare const Response: Schema.Struct<{
+    readonly status: Schema.Number;
+    readonly body: Schema.String;
+    readonly truncated: Schema.Boolean;
+    readonly notice: Schema.optional<Schema.String>;
+}>;
+/** Validate, execute, and render one bounded HTTP request.
+ * @since 1.0.0
+ * @private
+ */
+export declare const execute: (input: {
+    readonly url: string;
+    readonly headers?: Readonly<Record<string, string>> | undefined;
+    readonly timeout?: number | undefined;
+}, makeRequest: (url: string) => HttpClientRequest.HttpClientRequest) => Effect.Effect<{
+    readonly status: number;
+    readonly body: string;
+    readonly truncated: boolean;
+    readonly notice?: string | undefined;
+}, StdError.StdError, GrantStore | HttpClient.HttpClient>;
+//# sourceMappingURL=Http.d.ts.map

package/dist/cjs/internal/Http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Http.d.ts","sourceRoot":"","sources":["../../../src/internal/Http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,KAAK,UAAU,MAAM,2BAA2B,CAAA;AACvD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,iBAAiB,MAAM,+BAA+B,CAAA;AAClE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAK1C;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAkB,CAAA;AAOjD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,EAAE,CAAC,EAC9B,QAAQ,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,EACvC,KAAK,MAAM,KACV,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,CA6BlD,CAAA;AAEH;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,EAAE,OAAO,OAAO,KAAG,QAAQ,CAAC,QAIhE,CAAA;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,MAAM,GAAI,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,MAAM,KAAG,MAAM,GAAG,SAGrG,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,OAAO,eAAkE,CAAA;AAEtF;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAClC,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAC9B,KAAK,MAAM,EACX,gBAAY,EACZ,eAAe,CAAC,OAAO,EAAE,MAAM,KAAK,QAAQ,CAAC,QAAQ,KACpD,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAsB3C,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,GACpB,MAAM,MAAM,KACX;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAShF,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,QAAQ;;;;;EAKnB,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,OAAO;kBAEF,MAAM;uBACD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS;uBAC5C,MAAM,GAAG,SAAS;sBAEpB,MAAM,KAAK,iBAAiB,CAAC,iBAAiB;;;;;yDA2BjE,CAAA"}

package/dist/cjs/internal/Http.js

@@ -0,0 +1,153 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var Http_exports = {};
+__export(Http_exports, {
+  MAX_RESPONSE_BYTES: () => MAX_RESPONSE_BYTES,
+  Response: () => Response,
+  Timeout: () => Timeout,
+  capOutput: () => capOutput,
+  execute: () => execute,
+  header: () => header,
+  readBounded: () => readBounded,
+  requestError: () => requestError,
+  withDeadline: () => withDeadline
+});
+module.exports = __toCommonJS(Http_exports);
+var HttpClient = __toESM(require("@smthrs/kernel/HttpClient"), 1);
+var Effect = __toESM(require("effect/Effect"), 1);
+var HttpClientRequest = __toESM(require("effect/http/HttpClientRequest"), 1);
+var Schema = __toESM(require("effect/Schema"), 1);
+var Stream = __toESM(require("effect/Stream"), 1);
+var StdError = __toESM(require("../StdError.js"), 1);
+var import_HttpNetwork = require("./HttpNetwork.js");
+var import_Text = require("./Text.js");
+var import_Url = require("./Url.js");
+const MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
+const readBounded = (stream, url) => Stream.runFoldEffect(
+  stream,
+  () => ({ chunks: [], size: 0 }),
+  (state, chunk) => {
+    const size = state.size + chunk.byteLength;
+    if (size > MAX_RESPONSE_BYTES) {
+      return Effect.fail(
+        new StdError.StdError({
+          code: "response_too_large",
+          message: "Response exceeds the 5 MiB limit",
+          path: url
+        })
+      );
+    }
+    state.chunks.push(chunk);
+    state.size = size;
+    return Effect.succeed(state);
+  }
+).pipe(
+  Effect.map((state) => {
+    const output = new Uint8Array(state.size);
+    let offset = 0;
+    for (const chunk of state.chunks) {
+      output.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return output;
+  })
+);
+const requestError = (url, error) => error instanceof StdError.StdError ? error : (0, import_HttpNetwork.refusal)(error) ?? new StdError.StdError({
+  code: "request_failed",
+  message: `Request failed: ${url}${error instanceof Error ? ` (${error.message})` : ""}`
+});
+const header = (headers, name) => {
+  const lower = name.toLowerCase();
+  return Object.entries(headers).find(([key]) => key.toLowerCase() === lower)?.[1];
+};
+const Timeout = Schema.Number.check(Schema.isFinite(), Schema.isGreaterThan(0));
+const withDeadline = (effect, url, timeout = 30, timeoutError) => {
+  if (!Schema.is(Timeout)(timeout)) {
+    return Effect.fail(
+      new StdError.StdError({
+        code: "invalid_input",
+        message: "Timeout must be a finite number greater than zero seconds",
+        path: url
+      })
+    );
+  }
+  const seconds = Math.min(timeout, 120);
+  return Effect.timeoutOrElse(effect, {
+    duration: seconds * 1e3,
+    orElse: () => Effect.fail(
+      timeoutError?.(seconds) ?? new StdError.StdError({
+        code: "timeout",
+        message: `Request timed out after ${seconds} seconds`,
+        path: url
+      })
+    )
+  });
+};
+const capOutput = (text) => {
+  const rendered = (0, import_Text.truncateBytes)(text, import_Text.MAX_OUTPUT_BYTES, { keep: "head" });
+  return {
+    text: rendered.text,
+    truncated: rendered.truncated,
+    ...rendered.truncated ? { notice: (0, import_Text.notice)("bytes", rendered.keptBytes, rendered.keptBytes + rendered.droppedBytes) } : {}
+  };
+};
+const Response = Schema.Struct({
+  status: Schema.Number.annotate({ description: "HTTP status code, including error statuses" }),
+  body: Schema.String.annotate({ description: "Response body as text" }),
+  truncated: Schema.Boolean.annotate({ description: "Whether the body exceeded the display budget" }),
+  notice: Schema.optional(Schema.String.annotate({ description: "Truncation disclosure" }))
+});
+const execute = Effect.fn("Http.execute")(function* (input, makeRequest) {
+  const url = (0, import_Url.parseHttpUrl)(input.url);
+  if (url === void 0) {
+    return yield* Effect.fail(
+      new StdError.StdError({
+        code: "invalid_input",
+        message: `URL must use http or https without user information: ${input.url}`,
+        path: input.url
+      })
+    );
+  }
+  const client = (0, import_HttpNetwork.guarded)(yield* HttpClient.HttpClient);
+  const request = makeRequest(url.toString());
+  const { status, bytes } = yield* withDeadline(
+    Effect.gen(function* () {
+      const response = yield* client.execute(
+        input.headers === void 0 ? request : HttpClientRequest.setHeaders(request, input.headers)
+      );
+      const bytes2 = yield* readBounded(response.stream, input.url);
+      return { status: response.status, bytes: bytes2 };
+    }).pipe(Effect.mapError((error) => requestError(input.url, error))),
+    input.url,
+    input.timeout
+  );
+  const { text, ...disclosure } = capOutput(new TextDecoder().decode(bytes));
+  return { status, body: text, ...disclosure };
+});
+//# sourceMappingURL=Http.js.map

package/dist/cjs/internal/Http.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/internal/Http.ts"],
+  "sourcesContent": ["/**\n * Shared HTTP response limits, error mapping, and request deadlines.\n *\n * @since 1.0.0\n */\n\nimport type { GrantStore } from \"@smthrs/kernel/GrantStore\"\nimport * as HttpClient from \"@smthrs/kernel/HttpClient\"\nimport * as Effect from \"effect/Effect\"\nimport * as HttpClientRequest from \"effect/http/HttpClientRequest\"\nimport * as Schema from \"effect/Schema\"\nimport * as Stream from \"effect/Stream\"\nimport * as StdError from \"../StdError.ts\"\nimport { guarded, refusal } from \"./HttpNetwork.ts\"\nimport { MAX_OUTPUT_BYTES, notice, truncateBytes } from \"./Text.ts\"\nimport { parseHttpUrl } from \"./Url.ts\"\n\n/**\n * Maximum captured response bytes before decoding.\n *\n * @category http\n * @since 1.0.0\n */\nexport const MAX_RESPONSE_BYTES = 5 * 1024 * 1024\n\ninterface BodyState {\n  readonly chunks: Array<Uint8Array>\n  size: number\n}\n\n/**\n * Reads a response up to the shared byte limit and finalizes the stream on failure.\n *\n * @category http\n * @since 1.0.0\n */\nexport const readBounded = <E, R>(\n  stream: Stream.Stream<Uint8Array, E, R>,\n  url: string\n): Effect.Effect<Uint8Array, E | StdError.StdError, R> =>\n  Stream.runFoldEffect(\n    stream,\n    (): BodyState => ({ chunks: [], size: 0 }),\n    (state, chunk) => {\n      const size = state.size + chunk.byteLength\n      if (size > MAX_RESPONSE_BYTES) {\n        return Effect.fail(\n          new StdError.StdError({\n            code: \"response_too_large\",\n            message: \"Response exceeds the 5 MiB limit\",\n            path: url\n          })\n        )\n      }\n      state.chunks.push(chunk)\n      state.size = size\n      return Effect.succeed(state)\n    }\n  ).pipe(\n    Effect.map((state) => {\n      const output = new Uint8Array(state.size)\n      let offset = 0\n      for (const chunk of state.chunks) {\n        output.set(chunk, offset)\n        offset += chunk.byteLength\n      }\n      return output\n    })\n  )\n\n/**\n * Maps transport failures while preserving standard HTTP failure codes.\n *\n * @category http\n * @since 1.0.0\n */\nexport const requestError = (url: string, error: unknown): StdError.StdError =>\n  error instanceof StdError.StdError ? error : refusal(error) ?? new StdError.StdError({\n    code: \"request_failed\",\n    message: `Request failed: ${url}${error instanceof Error ? ` (${error.message})` : \"\"}`\n  })\n\n/**\n * Looks up a response header without depending on transport normalization.\n *\n * @category http\n * @since 1.0.0\n */\nexport const header = (headers: Readonly<Record<string, string | undefined>>, name: string): string | undefined => {\n  const lower = name.toLowerCase()\n  return Object.entries(headers).find(([key]) => key.toLowerCase() === lower)?.[1]\n}\n\n/**\n * Seconds; the runtime caps valid overrides at 120.\n *\n * @category http\n * @since 1.0.0\n */\nexport const Timeout = Schema.Number.check(Schema.isFinite(), Schema.isGreaterThan(0))\n\n/**\n * Bounds the entire request and body read with one timer. Interruption reaches\n * HttpClient.execute and response.stream so Effect aborts the transport and\n * finalizes the body reader before returning the timeout failure.\n * `timeoutError` preserves a tool's own timeout message while sharing the\n * validation, duration cap, and interruption behavior.\n *\n * @category http\n * @since 1.0.0\n */\nexport const withDeadline = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n  url: string,\n  timeout = 30,\n  timeoutError?: (seconds: number) => StdError.StdError\n): Effect.Effect<A, E | StdError.StdError, R> => {\n  if (!Schema.is(Timeout)(timeout)) {\n    return Effect.fail(\n      new StdError.StdError({\n        code: \"invalid_input\",\n        message: \"Timeout must be a finite number greater than zero seconds\",\n        path: url\n      })\n    )\n  }\n  const seconds = Math.min(timeout, 120)\n  return Effect.timeoutOrElse(effect, {\n    duration: seconds * 1_000,\n    orElse: () =>\n      Effect.fail(\n        timeoutError?.(seconds) ?? new StdError.StdError({\n          code: \"timeout\",\n          message: `Request timed out after ${seconds} seconds`,\n          path: url\n        })\n      )\n  })\n}\n\n/**\n * Keeps the head of rendered response text within the shared output budget and\n * discloses the cut.\n *\n * @since 1.0.0\n * @private\n */\nexport const capOutput = (\n  text: string\n): { readonly text: string; readonly truncated: boolean; readonly notice?: string } => {\n  const rendered = truncateBytes(text, MAX_OUTPUT_BYTES, { keep: \"head\" })\n  return {\n    text: rendered.text,\n    truncated: rendered.truncated,\n    ...(rendered.truncated\n      ? { notice: notice(\"bytes\", rendered.keptBytes, rendered.keptBytes + rendered.droppedBytes) }\n      : {})\n  }\n}\n\n/** Shared response contract for the GET and POST tools.\n * @since 1.0.0\n * @private\n */\nexport const Response = Schema.Struct({\n  status: Schema.Number.annotate({ description: \"HTTP status code, including error statuses\" }),\n  body: Schema.String.annotate({ description: \"Response body as text\" }),\n  truncated: Schema.Boolean.annotate({ description: \"Whether the body exceeded the display budget\" }),\n  notice: Schema.optional(Schema.String.annotate({ description: \"Truncation disclosure\" }))\n})\n\n/** Validate, execute, and render one bounded HTTP request.\n * @since 1.0.0\n * @private\n */\nexport const execute = Effect.fn(\"Http.execute\")(function*(\n  input: {\n    readonly url: string\n    readonly headers?: Readonly<Record<string, string>> | undefined\n    readonly timeout?: number | undefined\n  },\n  makeRequest: (url: string) => HttpClientRequest.HttpClientRequest\n): Effect.fn.Return<typeof Response.Type, StdError.StdError, HttpClient.HttpClient | GrantStore> {\n  const url = parseHttpUrl(input.url)\n  if (url === undefined) {\n    return yield* Effect.fail(\n      new StdError.StdError({\n        code: \"invalid_input\",\n        message: `URL must use http or https without user information: ${input.url}`,\n        path: input.url\n      })\n    )\n  }\n  const client = guarded(yield* HttpClient.HttpClient)\n  const request = makeRequest(url.toString())\n  const { status, bytes } = yield* withDeadline(\n    Effect.gen(function*() {\n      const response = yield* client.execute(\n        input.headers === undefined ? request : HttpClientRequest.setHeaders(request, input.headers)\n      )\n      const bytes = yield* readBounded(response.stream, input.url)\n      return { status: response.status, bytes }\n    }).pipe(Effect.mapError((error) => requestError(input.url, error))),\n    input.url,\n    input.timeout\n  )\n  const { text, ...disclosure } = capOutput(new TextDecoder().decode(bytes))\n  return { status, body: text, ...disclosure }\n})\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,iBAA4B;AAC5B,aAAwB;AACxB,wBAAmC;AACnC,aAAwB;AACxB,aAAwB;AACxB,eAA0B;AAC1B,yBAAiC;AACjC,kBAAwD;AACxD,iBAA6B;AAQtB,MAAM,qBAAqB,IAAI,OAAO;AAatC,MAAM,cAAc,CACzB,QACA,QAEA,OAAO;AAAA,EACL;AAAA,EACA,OAAkB,EAAE,QAAQ,CAAC,GAAG,MAAM,EAAE;AAAA,EACxC,CAAC,OAAO,UAAU;AAChB,UAAM,OAAO,MAAM,OAAO,MAAM;AAChC,QAAI,OAAO,oBAAoB;AAC7B,aAAO,OAAO;AAAA,QACZ,IAAI,SAAS,SAAS;AAAA,UACpB,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,OAAO,KAAK,KAAK;AACvB,UAAM,OAAO;AACb,WAAO,OAAO,QAAQ,KAAK;AAAA,EAC7B;AACF,EAAE;AAAA,EACA,OAAO,IAAI,CAAC,UAAU;AACpB,UAAM,SAAS,IAAI,WAAW,MAAM,IAAI;AACxC,QAAI,SAAS;AACb,eAAW,SAAS,MAAM,QAAQ;AAChC,aAAO,IAAI,OAAO,MAAM;AACxB,gBAAU,MAAM;AAAA,IAClB;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAQK,MAAM,eAAe,CAAC,KAAa,UACxC,iBAAiB,SAAS,WAAW,YAAQ,4BAAQ,KAAK,KAAK,IAAI,SAAS,SAAS;AAAA,EACnF,MAAM;AAAA,EACN,SAAS,mBAAmB,GAAG,GAAG,iBAAiB,QAAQ,KAAK,MAAM,OAAO,MAAM,EAAE;AACvF,CAAC;AAQI,MAAM,SAAS,CAAC,SAAuD,SAAqC;AACjH,QAAM,QAAQ,KAAK,YAAY;AAC/B,SAAO,OAAO,QAAQ,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,MAAM,IAAI,YAAY,MAAM,KAAK,IAAI,CAAC;AACjF;AAQO,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,SAAS,GAAG,OAAO,cAAc,CAAC,CAAC;AAY9E,MAAM,eAAe,CAC1B,QACA,KACA,UAAU,IACV,iBAC+C;AAC/C,MAAI,CAAC,OAAO,GAAG,OAAO,EAAE,OAAO,GAAG;AAChC,WAAO,OAAO;AAAA,MACZ,IAAI,SAAS,SAAS;AAAA,QACpB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,UAAU,KAAK,IAAI,SAAS,GAAG;AACrC,SAAO,OAAO,cAAc,QAAQ;AAAA,IAClC,UAAU,UAAU;AAAA,IACpB,QAAQ,MACN,OAAO;AAAA,MACL,eAAe,OAAO,KAAK,IAAI,SAAS,SAAS;AAAA,QAC/C,MAAM;AAAA,QACN,SAAS,2BAA2B,OAAO;AAAA,QAC3C,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACJ,CAAC;AACH;AASO,MAAM,YAAY,CACvB,SACqF;AACrF,QAAM,eAAW,2BAAc,MAAM,8BAAkB,EAAE,MAAM,OAAO,CAAC;AACvE,SAAO;AAAA,IACL,MAAM,SAAS;AAAA,IACf,WAAW,SAAS;AAAA,IACpB,GAAI,SAAS,YACT,EAAE,YAAQ,oBAAO,SAAS,SAAS,WAAW,SAAS,YAAY,SAAS,YAAY,EAAE,IAC1F,CAAC;AAAA,EACP;AACF;AAMO,MAAM,WAAW,OAAO,OAAO;AAAA,EACpC,QAAQ,OAAO,OAAO,SAAS,EAAE,aAAa,6CAA6C,CAAC;AAAA,EAC5F,MAAM,OAAO,OAAO,SAAS,EAAE,aAAa,wBAAwB,CAAC;AAAA,EACrE,WAAW,OAAO,QAAQ,SAAS,EAAE,aAAa,+CAA+C,CAAC;AAAA,EAClG,QAAQ,OAAO,SAAS,OAAO,OAAO,SAAS,EAAE,aAAa,wBAAwB,CAAC,CAAC;AAC1F,CAAC;AAMM,MAAM,UAAU,OAAO,GAAG,cAAc,EAAE,WAC/C,OAKA,aAC+F;AAC/F,QAAM,UAAM,yBAAa,MAAM,GAAG;AAClC,MAAI,QAAQ,QAAW;AACrB,WAAO,OAAO,OAAO;AAAA,MACnB,IAAI,SAAS,SAAS;AAAA,QACpB,MAAM;AAAA,QACN,SAAS,wDAAwD,MAAM,GAAG;AAAA,QAC1E,MAAM,MAAM;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,aAAS,4BAAQ,OAAO,WAAW,UAAU;AACnD,QAAM,UAAU,YAAY,IAAI,SAAS,CAAC;AAC1C,QAAM,EAAE,QAAQ,MAAM,IAAI,OAAO;AAAA,IAC/B,OAAO,IAAI,aAAY;AACrB,YAAM,WAAW,OAAO,OAAO;AAAA,QAC7B,MAAM,YAAY,SAAY,UAAU,kBAAkB,WAAW,SAAS,MAAM,OAAO;AAAA,MAC7F;AACA,YAAMA,SAAQ,OAAO,YAAY,SAAS,QAAQ,MAAM,GAAG;AAC3D,aAAO,EAAE,QAAQ,SAAS,QAAQ,OAAAA,OAAM;AAAA,IAC1C,CAAC,EAAE,KAAK,OAAO,SAAS,CAAC,UAAU,aAAa,MAAM,KAAK,KAAK,CAAC,CAAC;AAAA,IAClE,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AACA,QAAM,EAAE,MAAM,GAAG,WAAW,IAAI,UAAU,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AACzE,SAAO,EAAE,QAAQ,MAAM,MAAM,GAAG,WAAW;AAC7C,CAAC;",
+  "names": ["bytes"]
+}

package/dist/cjs/internal/HttpNetwork.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Destination policy shared by the web tools, including every redirect hop.
+ *
+ * @since 1.0.0
+ */
+import { GrantStore } from "@smthrs/kernel/GrantStore";
+import { Context, Effect } from "effect";
+import * as HttpClient from "effect/http/HttpClient";
+import * as HttpClientError from "effect/http/HttpClientError";
+import * as StdError from "../StdError.ts";
+/** Resolver seam: all addresses must be public before an unprivileged request.
+ * @since 1.0.0
+ * @private
+ */
+export declare const ResolveHost: Context.Reference<(hostname: string) => Effect.Effect<ReadonlyArray<string>, unknown>>;
+/** Decorates the supplied client before following redirects through the guard.
+ * The transport must honor manual redirects, as required by the kernel client.
+ * @since 1.0.0
+ * @private
+ */
+export declare const guarded: (client: HttpClient.HttpClient, follow?: boolean) => HttpClient.HttpClient.With<HttpClientError.HttpClientError, GrantStore>;
+/** Recovers the typed refusal carried through Effect's HTTP error channel.
+ * @since 1.0.0
+ * @private
+ */
+export declare const refusal: (error: unknown) => StdError.StdError | undefined;
+//# sourceMappingURL=HttpNetwork.d.ts.map

package/dist/cjs/internal/HttpNetwork.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpNetwork.d.ts","sourceRoot":"","sources":["../../../src/internal/HttpNetwork.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAOtD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAA;AAEhD,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAA;AACpD,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAA;AAG9D,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAG1C;;;GAGG;AACH,eAAO,MAAM,WAAW,+BACX,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAInE,CAAA;AAwEF;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAClB,QAAQ,UAAU,CAAC,UAAU,EAC7B,gBAAa,KACZ,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,eAAe,EAAE,UAAU,CAuBxE,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,OAAO,GAAI,OAAO,OAAO,KAAG,QAAQ,CAAC,QAAQ,GAAG,SAW5D,CAAA"}

package/dist/cjs/internal/HttpNetwork.js

@@ -0,0 +1,146 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var HttpNetwork_exports = {};
+__export(HttpNetwork_exports, {
+  ResolveHost: () => ResolveHost,
+  guarded: () => guarded,
+  refusal: () => refusal
+});
+module.exports = __toCommonJS(HttpNetwork_exports);
+var Capability = __toESM(require("@smthrs/capability/Capability"), 1);
+var import_GrantStore = require("@smthrs/kernel/GrantStore");
+var import_HttpClient = require("@smthrs/kernel/HttpClient");
+var import_effect = require("effect");
+var FetchHttpClient = __toESM(require("effect/http/FetchHttpClient"), 1);
+var HttpClient = __toESM(require("effect/http/HttpClient"), 1);
+var HttpClientError = __toESM(require("effect/http/HttpClientError"), 1);
+var import_promises = require("node:dns/promises");
+var import_node_net = require("node:net");
+var StdError = __toESM(require("../StdError.js"), 1);
+var import_Url = require("./Url.js");
+const ResolveHost = import_effect.Context.Reference("@smthrs/std/HttpNetwork/ResolveHost", {
+  defaultValue: () => (hostname) => import_effect.Effect.tryPromise(async () => (await (0, import_promises.lookup)(hostname, { all: true })).map((a) => a.address))
+});
+const blocked = new import_node_net.BlockList();
+for (const [address, prefix] of [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.168.0.0", 16],
+  ["192.0.0.0", 24],
+  ["100.64.0.0", 10],
+  ["198.18.0.0", 15],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4]
+]) blocked.addSubnet(address, prefix, "ipv4");
+const publicV6 = new import_node_net.BlockList();
+publicV6.addSubnet("2000::", 3, "ipv6");
+publicV6.addSubnet("::ffff:0:0", 96, "ipv6");
+blocked.addSubnet("2002::", 16, "ipv6");
+blocked.addSubnet("2001::", 32, "ipv6");
+const isPublic = (address) => {
+  const family = (0, import_node_net.isIP)(address);
+  if (family === 4) return !blocked.check(address, "ipv4");
+  return family === 6 && publicV6.check(address, "ipv6") && !blocked.check(address, "ipv6");
+};
+const failure = (code, message, path) => new StdError.StdError({ code, message, path });
+const check = import_effect.Effect.fn("HttpNetwork.check")(function* (value, client) {
+  const url = (0, import_Url.parseHttpUrl)(value);
+  if (url === void 0) {
+    return yield* import_effect.Effect.fail(failure("invalid_input", "URL must use http or https without user information", value));
+  }
+  if (!(0, import_HttpClient.supportsDestinationPinning)(client)) {
+    return yield* import_effect.Effect.fail(failure("unsupported", "HTTP host must support destination pinning", value));
+  }
+  const hostname = url.hostname.replace(/^\[|\]$/g, "");
+  const local = hostname.replace(/\.$/, "").toLowerCase();
+  const literal = (0, import_node_net.isIP)(hostname) !== 0;
+  const localhost = local === "localhost" || local.endsWith(".localhost");
+  const resolve = yield* ResolveHost;
+  const privateGrant = import_effect.Effect.gen(function* () {
+    const store = yield* import_GrantStore.GrantStore;
+    const capability = yield* import_effect.Effect.try({
+      try: () => Capability.make("net:private", url.origin),
+      catch: () => failure("invalid_input", "Private HTTP origin exceeds the capability resource limit", value)
+    });
+    yield* store.check(capability).pipe(
+      import_effect.Effect.mapError(
+        () => failure("permission_denied", "Private HTTP destination requires a net:private grant", value)
+      )
+    );
+  });
+  if (localhost) yield* privateGrant;
+  const addresses = literal ? [hostname] : [
+    ...yield* resolve(hostname).pipe(
+      import_effect.Effect.mapError(() => failure("request_failed", "Could not resolve HTTP destination", value))
+    )
+  ];
+  if (addresses.length === 0 || addresses.some((address) => (0, import_node_net.isIP)(address) === 0)) {
+    return yield* import_effect.Effect.fail(failure("request_failed", "HTTP destination has no valid addresses", value));
+  }
+  if (!localhost && !addresses.every(isPublic)) yield* privateGrant;
+  return Object.freeze({ origin: url.origin, addresses: Object.freeze(addresses) });
+});
+const guarded = (client, follow = true) => {
+  const checked = HttpClient.transform(
+    client,
+    (execute, request) => (0, import_HttpClient.authorizePreflight)(
+      request,
+      check(request.url, client).pipe(
+        import_effect.Effect.mapError(
+          (cause) => new HttpClientError.HttpClientError({
+            reason: new HttpClientError.TransportError({ request, cause, description: cause.message })
+          })
+        ),
+        import_effect.Effect.flatMap(
+          (destination) => import_effect.Effect.updateContext(execute, (context) => import_effect.Context.add(import_effect.Context.add(context, import_HttpClient.Destination, destination), FetchHttpClient.RequestInit, {
+            ...import_effect.Context.getOrUndefined(context, FetchHttpClient.RequestInit),
+            redirect: "manual"
+          }))
+        )
+      )
+    )
+  );
+  return follow ? HttpClient.followRedirects(checked) : checked;
+};
+const refusal = (error) => {
+  if (!(error instanceof HttpClientError.HttpClientError) || error.reason._tag !== "TransportError") return void 0;
+  if (error.reason.cause instanceof StdError.StdError) return error.reason.cause;
+  if (import_effect.Option.isSome((0, import_HttpClient.fromHttpClientError)(error))) {
+    return failure(
+      "permission_denied",
+      error.reason.description ?? "HTTP permission was refused",
+      error.reason.request.url
+    );
+  }
+  return void 0;
+};
+//# sourceMappingURL=HttpNetwork.js.map

package/dist/cjs/internal/HttpNetwork.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/internal/HttpNetwork.ts"],
+  "sourcesContent": ["/**\n * Destination policy shared by the web tools, including every redirect hop.\n *\n * @since 1.0.0\n */\n\nimport * as Capability from \"@smthrs/capability/Capability\"\nimport { GrantStore } from \"@smthrs/kernel/GrantStore\"\nimport {\n  authorizePreflight,\n  Destination,\n  fromHttpClientError,\n  supportsDestinationPinning\n} from \"@smthrs/kernel/HttpClient\"\nimport { Context, Effect, Option } from \"effect\"\nimport * as FetchHttpClient from \"effect/http/FetchHttpClient\"\nimport * as HttpClient from \"effect/http/HttpClient\"\nimport * as HttpClientError from \"effect/http/HttpClientError\"\nimport { lookup } from \"node:dns/promises\"\nimport { BlockList, isIP } from \"node:net\"\nimport * as StdError from \"../StdError.ts\"\nimport { parseHttpUrl } from \"./Url.ts\"\n\n/** Resolver seam: all addresses must be public before an unprivileged request.\n * @since 1.0.0\n * @private\n */\nexport const ResolveHost = Context.Reference<\n  (hostname: string) => Effect.Effect<ReadonlyArray<string>, unknown>\n>(\"@smthrs/std/HttpNetwork/ResolveHost\", {\n  defaultValue: () => (hostname) =>\n    Effect.tryPromise(async () => (await lookup(hostname, { all: true })).map((a) => a.address))\n})\n\nconst blocked = new BlockList()\nfor (\n  const [address, prefix] of [\n    [\"0.0.0.0\", 8],\n    [\"10.0.0.0\", 8],\n    [\"127.0.0.0\", 8],\n    [\"169.254.0.0\", 16],\n    [\"172.16.0.0\", 12],\n    [\"192.168.0.0\", 16],\n    [\"192.0.0.0\", 24],\n    [\"100.64.0.0\", 10],\n    [\"198.18.0.0\", 15],\n    [\"224.0.0.0\", 4],\n    [\"240.0.0.0\", 4]\n  ] as const\n) blocked.addSubnet(address, prefix, \"ipv4\")\n// Allow global IPv6 and mapped IPv4 only, excluding transition tunnels.\nconst publicV6 = new BlockList()\npublicV6.addSubnet(\"2000::\", 3, \"ipv6\")\npublicV6.addSubnet(\"::ffff:0:0\", 96, \"ipv6\")\nblocked.addSubnet(\"2002::\", 16, \"ipv6\")\nblocked.addSubnet(\"2001::\", 32, \"ipv6\")\n\nconst isPublic = (address: string): boolean => {\n  const family = isIP(address)\n  if (family === 4) return !blocked.check(address, \"ipv4\")\n  return family === 6 && publicV6.check(address, \"ipv6\") && !blocked.check(address, \"ipv6\")\n}\n\nconst failure = (code: StdError.Code, message: string, path: string) => new StdError.StdError({ code, message, path })\n\nconst check = Effect.fn(\"HttpNetwork.check\")(function*(value: string, client: HttpClient.HttpClient) {\n  const url = parseHttpUrl(value)\n  if (url === undefined) {\n    return yield* Effect.fail(failure(\"invalid_input\", \"URL must use http or https without user information\", value))\n  }\n  if (!supportsDestinationPinning(client)) {\n    return yield* Effect.fail(failure(\"unsupported\", \"HTTP host must support destination pinning\", value))\n  }\n  const hostname = url.hostname.replace(/^\\[|\\]$/g, \"\")\n  const local = hostname.replace(/\\.$/, \"\").toLowerCase()\n  const literal = isIP(hostname) !== 0\n  const localhost = local === \"localhost\" || local.endsWith(\".localhost\")\n  const resolve = yield* ResolveHost\n  // Refuse localhost before DNS unless the origin is explicitly authorized.\n  const privateGrant = Effect.gen(function*() {\n    const store = yield* GrantStore\n    const capability = yield* Effect.try({\n      try: () => Capability.make(\"net:private\", url.origin),\n      catch: () => failure(\"invalid_input\", \"Private HTTP origin exceeds the capability resource limit\", value)\n    })\n    yield* store.check(capability).pipe(\n      Effect.mapError(() =>\n        failure(\"permission_denied\", \"Private HTTP destination requires a net:private grant\", value)\n      )\n    )\n  })\n  if (localhost) yield* privateGrant\n  const addresses = literal ? [hostname] : [\n    ...yield* resolve(hostname).pipe(\n      Effect.mapError(() => failure(\"request_failed\", \"Could not resolve HTTP destination\", value))\n    )\n  ]\n  if (addresses.length === 0 || addresses.some((address) => isIP(address) === 0)) {\n    return yield* Effect.fail(failure(\"request_failed\", \"HTTP destination has no valid addresses\", value))\n  }\n  if (!localhost && !addresses.every(isPublic)) yield* privateGrant\n  return Object.freeze({ origin: url.origin, addresses: Object.freeze(addresses) })\n})\n\n/** Decorates the supplied client before following redirects through the guard.\n * The transport must honor manual redirects, as required by the kernel client.\n * @since 1.0.0\n * @private\n */\nexport const guarded = (\n  client: HttpClient.HttpClient,\n  follow = true\n): HttpClient.HttpClient.With<HttpClientError.HttpClientError, GrantStore> => {\n  const checked = HttpClient.transform(\n    client,\n    (execute, request) =>\n      authorizePreflight(\n        request,\n        check(request.url, client).pipe(\n          Effect.mapError((cause) =>\n            new HttpClientError.HttpClientError({\n              reason: new HttpClientError.TransportError({ request, cause, description: cause.message })\n            })\n          ),\n          Effect.flatMap((destination) =>\n            Effect.updateContext(execute, (context: Context.Context<never>) =>\n              Context.add(Context.add(context, Destination, destination), FetchHttpClient.RequestInit, {\n                ...Context.getOrUndefined(context, FetchHttpClient.RequestInit),\n                redirect: \"manual\"\n              }))\n          )\n        )\n      )\n  )\n  return follow ? HttpClient.followRedirects(checked) : checked\n}\n\n/** Recovers the typed refusal carried through Effect's HTTP error channel.\n * @since 1.0.0\n * @private\n */\nexport const refusal = (error: unknown): StdError.StdError | undefined => {\n  if (!(error instanceof HttpClientError.HttpClientError) || error.reason._tag !== \"TransportError\") return undefined\n  if (error.reason.cause instanceof StdError.StdError) return error.reason.cause\n  if (Option.isSome(fromHttpClientError(error))) {\n    return failure(\n      \"permission_denied\",\n      error.reason.description ?? \"HTTP permission was refused\",\n      error.reason.request.url\n    )\n  }\n  return undefined\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,iBAA4B;AAC5B,wBAA2B;AAC3B,wBAKO;AACP,oBAAwC;AACxC,sBAAiC;AACjC,iBAA4B;AAC5B,sBAAiC;AACjC,sBAAuB;AACvB,sBAAgC;AAChC,eAA0B;AAC1B,iBAA6B;AAMtB,MAAM,cAAc,sBAAQ,UAEjC,uCAAuC;AAAA,EACvC,cAAc,MAAM,CAAC,aACnB,qBAAO,WAAW,aAAa,UAAM,wBAAO,UAAU,EAAE,KAAK,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,IAAI,0BAAU;AAC9B,WACQ,CAAC,SAAS,MAAM,KAAK;AAAA,EACzB,CAAC,WAAW,CAAC;AAAA,EACb,CAAC,YAAY,CAAC;AAAA,EACd,CAAC,aAAa,CAAC;AAAA,EACf,CAAC,eAAe,EAAE;AAAA,EAClB,CAAC,cAAc,EAAE;AAAA,EACjB,CAAC,eAAe,EAAE;AAAA,EAClB,CAAC,aAAa,EAAE;AAAA,EAChB,CAAC,cAAc,EAAE;AAAA,EACjB,CAAC,cAAc,EAAE;AAAA,EACjB,CAAC,aAAa,CAAC;AAAA,EACf,CAAC,aAAa,CAAC;AACjB,EACA,SAAQ,UAAU,SAAS,QAAQ,MAAM;AAE3C,MAAM,WAAW,IAAI,0BAAU;AAC/B,SAAS,UAAU,UAAU,GAAG,MAAM;AACtC,SAAS,UAAU,cAAc,IAAI,MAAM;AAC3C,QAAQ,UAAU,UAAU,IAAI,MAAM;AACtC,QAAQ,UAAU,UAAU,IAAI,MAAM;AAEtC,MAAM,WAAW,CAAC,YAA6B;AAC7C,QAAM,aAAS,sBAAK,OAAO;AAC3B,MAAI,WAAW,EAAG,QAAO,CAAC,QAAQ,MAAM,SAAS,MAAM;AACvD,SAAO,WAAW,KAAK,SAAS,MAAM,SAAS,MAAM,KAAK,CAAC,QAAQ,MAAM,SAAS,MAAM;AAC1F;AAEA,MAAM,UAAU,CAAC,MAAqB,SAAiB,SAAiB,IAAI,SAAS,SAAS,EAAE,MAAM,SAAS,KAAK,CAAC;AAErH,MAAM,QAAQ,qBAAO,GAAG,mBAAmB,EAAE,WAAU,OAAe,QAA+B;AACnG,QAAM,UAAM,yBAAa,KAAK;AAC9B,MAAI,QAAQ,QAAW;AACrB,WAAO,OAAO,qBAAO,KAAK,QAAQ,iBAAiB,uDAAuD,KAAK,CAAC;AAAA,EAClH;AACA,MAAI,KAAC,8CAA2B,MAAM,GAAG;AACvC,WAAO,OAAO,qBAAO,KAAK,QAAQ,eAAe,8CAA8C,KAAK,CAAC;AAAA,EACvG;AACA,QAAM,WAAW,IAAI,SAAS,QAAQ,YAAY,EAAE;AACpD,QAAM,QAAQ,SAAS,QAAQ,OAAO,EAAE,EAAE,YAAY;AACtD,QAAM,cAAU,sBAAK,QAAQ,MAAM;AACnC,QAAM,YAAY,UAAU,eAAe,MAAM,SAAS,YAAY;AACtE,QAAM,UAAU,OAAO;AAEvB,QAAM,eAAe,qBAAO,IAAI,aAAY;AAC1C,UAAM,QAAQ,OAAO;AACrB,UAAM,aAAa,OAAO,qBAAO,IAAI;AAAA,MACnC,KAAK,MAAM,WAAW,KAAK,eAAe,IAAI,MAAM;AAAA,MACpD,OAAO,MAAM,QAAQ,iBAAiB,6DAA6D,KAAK;AAAA,IAC1G,CAAC;AACD,WAAO,MAAM,MAAM,UAAU,EAAE;AAAA,MAC7B,qBAAO;AAAA,QAAS,MACd,QAAQ,qBAAqB,yDAAyD,KAAK;AAAA,MAC7F;AAAA,IACF;AAAA,EACF,CAAC;AACD,MAAI,UAAW,QAAO;AACtB,QAAM,YAAY,UAAU,CAAC,QAAQ,IAAI;AAAA,IACvC,GAAG,OAAO,QAAQ,QAAQ,EAAE;AAAA,MAC1B,qBAAO,SAAS,MAAM,QAAQ,kBAAkB,sCAAsC,KAAK,CAAC;AAAA,IAC9F;AAAA,EACF;AACA,MAAI,UAAU,WAAW,KAAK,UAAU,KAAK,CAAC,gBAAY,sBAAK,OAAO,MAAM,CAAC,GAAG;AAC9E,WAAO,OAAO,qBAAO,KAAK,QAAQ,kBAAkB,2CAA2C,KAAK,CAAC;AAAA,EACvG;AACA,MAAI,CAAC,aAAa,CAAC,UAAU,MAAM,QAAQ,EAAG,QAAO;AACrD,SAAO,OAAO,OAAO,EAAE,QAAQ,IAAI,QAAQ,WAAW,OAAO,OAAO,SAAS,EAAE,CAAC;AAClF,CAAC;AAOM,MAAM,UAAU,CACrB,QACA,SAAS,SACmE;AAC5E,QAAM,UAAU,WAAW;AAAA,IACzB;AAAA,IACA,CAAC,SAAS,gBACR;AAAA,MACE;AAAA,MACA,MAAM,QAAQ,KAAK,MAAM,EAAE;AAAA,QACzB,qBAAO;AAAA,UAAS,CAAC,UACf,IAAI,gBAAgB,gBAAgB;AAAA,YAClC,QAAQ,IAAI,gBAAgB,eAAe,EAAE,SAAS,OAAO,aAAa,MAAM,QAAQ,CAAC;AAAA,UAC3F,CAAC;AAAA,QACH;AAAA,QACA,qBAAO;AAAA,UAAQ,CAAC,gBACd,qBAAO,cAAc,SAAS,CAAC,YAC7B,sBAAQ,IAAI,sBAAQ,IAAI,SAAS,+BAAa,WAAW,GAAG,gBAAgB,aAAa;AAAA,YACvF,GAAG,sBAAQ,eAAe,SAAS,gBAAgB,WAAW;AAAA,YAC9D,UAAU;AAAA,UACZ,CAAC,CAAC;AAAA,QACN;AAAA,MACF;AAAA,IACF;AAAA,EACJ;AACA,SAAO,SAAS,WAAW,gBAAgB,OAAO,IAAI;AACxD;AAMO,MAAM,UAAU,CAAC,UAAkD;AACxE,MAAI,EAAE,iBAAiB,gBAAgB,oBAAoB,MAAM,OAAO,SAAS,iBAAkB,QAAO;AAC1G,MAAI,MAAM,OAAO,iBAAiB,SAAS,SAAU,QAAO,MAAM,OAAO;AACzE,MAAI,qBAAO,WAAO,uCAAoB,KAAK,CAAC,GAAG;AAC7C,WAAO;AAAA,MACL;AAAA,MACA,MAAM,OAAO,eAAe;AAAA,MAC5B,MAAM,OAAO,QAAQ;AAAA,IACvB;AAAA,EACF;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/cjs/internal/Ignore.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Root-scoped gitignore rules, compiled once per visited directory.
+ *
+ * @since 1.0.0
+ */
+interface Rule {
+    readonly expression: RegExp;
+    readonly directoryOnly: boolean;
+    readonly negated: boolean;
+    readonly byPath: boolean;
+}
+/**
+ * Rules belonging to one visited directory.
+ *
+ * @private
+ * @since 1.0.0
+ */
+export interface Scope {
+    readonly directory: string;
+    readonly rules: ReadonlyArray<Rule>;
+}
+/**
+ * Parses gitignore lines without widening the caller-glob grammar.
+ *
+ * @private
+ * @since 1.0.0
+ */
+export declare const parse: (directory: string, content: string) => Scope;
+/**
+ * Tests an entry before descent; deeper scopes and later rules take priority.
+ *
+ * @private
+ * @since 1.0.0
+ */
+export declare const ignored: (scopes: ReadonlyArray<Scope>, candidate: string, basename: string, directory: boolean, relative: (from: string, to: string) => string) => boolean;
+export {};
+//# sourceMappingURL=Ignore.d.ts.map

package/dist/cjs/internal/Ignore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Ignore.d.ts","sourceRoot":"","sources":["../../../src/internal/Ignore.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,UAAU,IAAI;IACZ,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,CAAA;CACpC;AAyDD;;;;;GAKG;AACH,eAAO,MAAM,KAAK,GAAI,WAAW,MAAM,EAAE,SAAS,MAAM,KAAG,KAqB1D,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,OAAO,GAClB,QAAQ,aAAa,CAAC,KAAK,CAAC,EAC5B,WAAW,MAAM,EACjB,UAAU,MAAM,EAChB,WAAW,OAAO,EAClB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,MAAM,KAC7C,OAYF,CAAA"}