@smthrs/std 0.0.0-stage → 1.0.0-rc.4

package/dist/esm/internal/Html.js

@@ -0,0 +1,70 @@
+/**
+ * Small, dependency-free HTML renderers for web retrieval.
+ *
+ * @since 1.0.0
+ */
+const comments = /<!--[\s\S]*?-->/g;
+const entities = { amp: "&", lt: "<", gt: ">", quot: "\"", apos: "'", nbsp: " " };
+const dropSkipped = (html) => {
+    const lower = html.replace(/[A-Z]/g, (letter) => letter.toLowerCase());
+    const opening = /<(head|script|style|noscript|iframe|object|embed)\b/gi;
+    let output = "";
+    let cursor = 0;
+    let match;
+    while ((match = opening.exec(html)) !== null) {
+        output += html.slice(cursor, match.index);
+        const marker = `</${match[1].toLowerCase()}`;
+        let close = lower.indexOf(marker, opening.lastIndex);
+        while (close !== -1) {
+            let end = close + marker.length;
+            while (/\s/.test(lower[end] ?? ""))
+                end++;
+            if (lower[end] === ">") {
+                cursor = end + 1;
+                opening.lastIndex = cursor;
+                break;
+            }
+            close = lower.indexOf(marker, close + marker.length);
+        }
+        if (close === -1)
+            return output;
+    }
+    return output + html.slice(cursor);
+};
+const decode = (value) => value.replace(/&(#x[\da-f]+|#\d+|[a-z]+);/gi, (match, entity) => {
+    if (entity[0] === "#") {
+        const number = Number.parseInt(entity.slice(entity[1].toLowerCase() === "x" ? 2 : 1), entity[1].toLowerCase() === "x" ? 16 : 10);
+        return number <= 0x10ffff
+            && !(number >= 0xd800 && number <= 0xdfff)
+            ? String.fromCodePoint(number)
+            : match;
+    }
+    const key = entity.toLowerCase();
+    return Object.hasOwn(entities, key) ? entities[key] : match;
+});
+const source = (html) => dropSkipped(html.replace(comments, ""));
+/**
+ * Extracts readable text while dropping executable and presentation-only elements.
+ *
+ * @category rendering
+ * @since 1.0.0
+ */
+export const toText = (html) => decode(source(html).replace(/<(br|\/p|\/div|\/li|\/h[1-6]|\/tr)\b[^>]*>/gi, "\n").replace(/<[^>]*>/g, " "))
+    .replace(/[ \t]+\n/g, "\n").replace(/\n[ \t]+/g, "\n").replace(/\n{3,}/g, "\n\n").replace(/[ \t]{2,}/g, " ").trim();
+/**
+ * Converts a conservative subset of HTML into readable Markdown.
+ *
+ * @category rendering
+ * @since 1.0.0
+ */
+export const toMarkdown = (html) => {
+    const markdown = source(html)
+        .replace(/<h([1-6])\b[^>]*>([\s\S]*?)<\/h\1>/gi, (_all, level, text) => `\n\n${"#".repeat(Number(level))} ${toText(text)}\n\n`)
+        .replace(/<(strong|b)\b[^>]*>([\s\S]*?)<\/\1>/gi, "**$2**")
+        .replace(/<(em|i)\b[^>]*>([\s\S]*?)<\/\1>/gi, "*$2*")
+        .replace(/<a\b[^>]*href=["']([^"']+)["'][^>]*>([\s\S]*?)<\/a>/gi, (_all, href, text) => `[${toText(text)}](${href})`)
+        .replace(/<li\b[^>]*>/gi, "\n- ").replace(/<\/?(ul|ol|p|div|section|article|main|blockquote|pre|tr)\b[^>]*>/gi, "\n")
+        .replace(/<br\b[^>]*>/gi, "\n").replace(/<[^>]*>/g, "");
+    return decode(markdown).replace(/[ \t]+\n/g, "\n").replace(/\n{3,}/g, "\n\n").trim();
+};
+//# sourceMappingURL=Html.js.map

package/dist/esm/internal/Html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Html.js","sourceRoot":"","sources":["../../../src/internal/Html.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,QAAQ,GAAG,kBAAkB,CAAA;AACnC,MAAM,QAAQ,GAAqC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;AAEnH,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IACtE,MAAM,OAAO,GAAG,uDAAuD,CAAA;IACvE,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,IAAI,KAA6B,CAAA;IACjC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;QACzC,MAAM,MAAM,GAAG,KAAK,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,CAAA;QAC7C,IAAI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QACpD,OAAO,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,IAAI,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC,MAAM,CAAA;YAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAAE,GAAG,EAAE,CAAA;YACzC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAA;gBAChB,OAAO,CAAC,SAAS,GAAG,MAAM,CAAA;gBAC1B,MAAK;YACP,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;QACtD,CAAC;QACD,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,MAAM,CAAA;IACjC,CAAC;IACD,OAAO,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;AACpC,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CACvC,KAAK,CAAC,OAAO,CAAC,8BAA8B,EAAE,CAAC,KAAK,EAAE,MAAc,EAAE,EAAE;IACtE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAC5B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACtD,MAAM,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAC3C,CAAA;QACD,OAAO,MAAM,IAAI,QAAQ;eAClB,CAAC,CAAC,MAAM,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC;YAC5C,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;YAC9B,CAAC,CAAC,KAAK,CAAA;IACX,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAE,CAAC,CAAC,CAAC,KAAK,CAAA;AAC9D,CAAC,CAAC,CAAA;AAEJ,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAA;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAC7C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,8CAA8C,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;KACxG,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;AAEvH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;SAC1B,OAAO,CACN,sCAAsC,EACtC,CAAC,IAAI,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAC9F;SACA,OAAO,CAAC,uCAAuC,EAAE,QAAQ,CAAC;SAC1D,OAAO,CAAC,mCAAmC,EAAE,MAAM,CAAC;SACpD,OAAO,CACN,uDAAuD,EACvD,CAAC,IAAI,EAAE,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CACnE;SACA,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,OAAO,CACvC,oEAAoE,EACpE,IAAI,CACL;SACA,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IACzD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;AACtF,CAAC,CAAA","sourcesContent":["/**\n * Small, dependency-free HTML renderers for web retrieval.\n *\n * @since 1.0.0\n */\n\nconst comments = /<!--[\\s\\S]*?-->/g\nconst entities: Readonly<Record<string, string>> = { amp: \"&\", lt: \"<\", gt: \">\", quot: \"\\\"\", apos: \"'\", nbsp: \" \" }\n\nconst dropSkipped = (html: string): string => {\n  const lower = html.replace(/[A-Z]/g, (letter) => letter.toLowerCase())\n  const opening = /<(head|script|style|noscript|iframe|object|embed)\\b/gi\n  let output = \"\"\n  let cursor = 0\n  let match: RegExpExecArray | null\n  while ((match = opening.exec(html)) !== null) {\n    output += html.slice(cursor, match.index)\n    const marker = `</${match[1]!.toLowerCase()}`\n    let close = lower.indexOf(marker, opening.lastIndex)\n    while (close !== -1) {\n      let end = close + marker.length\n      while (/\\s/.test(lower[end] ?? \"\")) end++\n      if (lower[end] === \">\") {\n        cursor = end + 1\n        opening.lastIndex = cursor\n        break\n      }\n      close = lower.indexOf(marker, close + marker.length)\n    }\n    if (close === -1) return output\n  }\n  return output + html.slice(cursor)\n}\n\nconst decode = (value: string): string =>\n  value.replace(/&(#x[\\da-f]+|#\\d+|[a-z]+);/gi, (match, entity: string) => {\n    if (entity[0] === \"#\") {\n      const number = Number.parseInt(\n        entity.slice(entity[1]!.toLowerCase() === \"x\" ? 2 : 1),\n        entity[1]!.toLowerCase() === \"x\" ? 16 : 10\n      )\n      return number <= 0x10ffff\n          && !(number >= 0xd800 && number <= 0xdfff)\n        ? String.fromCodePoint(number)\n        : match\n    }\n    const key = entity.toLowerCase()\n    return Object.hasOwn(entities, key) ? entities[key]! : match\n  })\n\nconst source = (html: string): string => dropSkipped(html.replace(comments, \"\"))\n\n/**\n * Extracts readable text while dropping executable and presentation-only elements.\n *\n * @category rendering\n * @since 1.0.0\n */\nexport const toText = (html: string): string =>\n  decode(source(html).replace(/<(br|\\/p|\\/div|\\/li|\\/h[1-6]|\\/tr)\\b[^>]*>/gi, \"\\n\").replace(/<[^>]*>/g, \" \"))\n    .replace(/[ \\t]+\\n/g, \"\\n\").replace(/\\n[ \\t]+/g, \"\\n\").replace(/\\n{3,}/g, \"\\n\\n\").replace(/[ \\t]{2,}/g, \" \").trim()\n\n/**\n * Converts a conservative subset of HTML into readable Markdown.\n *\n * @category rendering\n * @since 1.0.0\n */\nexport const toMarkdown = (html: string): string => {\n  const markdown = source(html)\n    .replace(\n      /<h([1-6])\\b[^>]*>([\\s\\S]*?)<\\/h\\1>/gi,\n      (_all, level: string, text: string) => `\\n\\n${\"#\".repeat(Number(level))} ${toText(text)}\\n\\n`\n    )\n    .replace(/<(strong|b)\\b[^>]*>([\\s\\S]*?)<\\/\\1>/gi, \"**$2**\")\n    .replace(/<(em|i)\\b[^>]*>([\\s\\S]*?)<\\/\\1>/gi, \"*$2*\")\n    .replace(\n      /<a\\b[^>]*href=[\"']([^\"']+)[\"'][^>]*>([\\s\\S]*?)<\\/a>/gi,\n      (_all, href: string, text: string) => `[${toText(text)}](${href})`\n    )\n    .replace(/<li\\b[^>]*>/gi, \"\\n- \").replace(\n      /<\\/?(ul|ol|p|div|section|article|main|blockquote|pre|tr)\\b[^>]*>/gi,\n      \"\\n\"\n    )\n    .replace(/<br\\b[^>]*>/gi, \"\\n\").replace(/<[^>]*>/g, \"\")\n  return decode(markdown).replace(/[ \\t]+\\n/g, \"\\n\").replace(/\\n{3,}/g, \"\\n\\n\").trim()\n}\n"]}

package/dist/esm/internal/Http.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Shared HTTP response limits, error mapping, and request deadlines.
+ *
+ * @since 1.0.0
+ */
+import type { GrantStore } from "@smthrs/kernel/GrantStore";
+import * as HttpClient from "@smthrs/kernel/HttpClient";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import * as StdError from "../StdError.ts";
+/**
+ * Maximum captured response bytes before decoding.
+ *
+ * @category http
+ * @since 1.0.0
+ */
+export declare const MAX_RESPONSE_BYTES: number;
+/**
+ * Reads a response up to the shared byte limit and finalizes the stream on failure.
+ *
+ * @category http
+ * @since 1.0.0
+ */
+export declare const readBounded: <E, R>(stream: Stream.Stream<Uint8Array, E, R>, url: string) => Effect.Effect<Uint8Array, E | StdError.StdError, R>;
+/**
+ * Maps transport failures while preserving standard HTTP failure codes.
+ *
+ * @category http
+ * @since 1.0.0
+ */
+export declare const requestError: (url: string, error: unknown) => StdError.StdError;
+/**
+ * Looks up a response header without depending on transport normalization.
+ *
+ * @category http
+ * @since 1.0.0
+ */
+export declare const header: (headers: Readonly<Record<string, string | undefined>>, name: string) => string | undefined;
+/**
+ * Seconds; the runtime caps valid overrides at 120.
+ *
+ * @category http
+ * @since 1.0.0
+ */
+export declare const Timeout: Schema.Number;
+/**
+ * Bounds the entire request and body read with one timer. Interruption reaches
+ * HttpClient.execute and response.stream so Effect aborts the transport and
+ * finalizes the body reader before returning the timeout failure.
+ * `timeoutError` preserves a tool's own timeout message while sharing the
+ * validation, duration cap, and interruption behavior.
+ *
+ * @category http
+ * @since 1.0.0
+ */
+export declare const withDeadline: <A, E, R>(effect: Effect.Effect<A, E, R>, url: string, timeout?: number, timeoutError?: (seconds: number) => StdError.StdError) => Effect.Effect<A, E | StdError.StdError, R>;
+/**
+ * Keeps the head of rendered response text within the shared output budget and
+ * discloses the cut.
+ *
+ * @since 1.0.0
+ * @private
+ */
+export declare const capOutput: (text: string) => {
+    readonly text: string;
+    readonly truncated: boolean;
+    readonly notice?: string;
+};
+/** Shared response contract for the GET and POST tools.
+ * @since 1.0.0
+ * @private
+ */
+export declare const Response: Schema.Struct<{
+    readonly status: Schema.Number;
+    readonly body: Schema.String;
+    readonly truncated: Schema.Boolean;
+    readonly notice: Schema.optional<Schema.String>;
+}>;
+/** Validate, execute, and render one bounded HTTP request.
+ * @since 1.0.0
+ * @private
+ */
+export declare const execute: (input: {
+    readonly url: string;
+    readonly headers?: Readonly<Record<string, string>> | undefined;
+    readonly timeout?: number | undefined;
+}, makeRequest: (url: string) => HttpClientRequest.HttpClientRequest) => Effect.Effect<{
+    readonly status: number;
+    readonly body: string;
+    readonly truncated: boolean;
+    readonly notice?: string | undefined;
+}, StdError.StdError, GrantStore | HttpClient.HttpClient>;
+//# sourceMappingURL=Http.d.ts.map

package/dist/esm/internal/Http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Http.d.ts","sourceRoot":"","sources":["../../../src/internal/Http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,KAAK,UAAU,MAAM,2BAA2B,CAAA;AACvD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,iBAAiB,MAAM,wCAAwC,CAAA;AAC3E,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAK1C;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAkB,CAAA;AAOjD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,EAAE,CAAC,EAC9B,QAAQ,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,EACvC,KAAK,MAAM,KACV,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,CA6BlD,CAAA;AAEH;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,EAAE,OAAO,OAAO,KAAG,QAAQ,CAAC,QAIhE,CAAA;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,MAAM,GAAI,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,MAAM,KAAG,MAAM,GAAG,SAGrG,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,OAAO,eAAkE,CAAA;AAEtF;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAClC,QAAQ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAC9B,KAAK,MAAM,EACX,gBAAY,EACZ,eAAe,CAAC,OAAO,EAAE,MAAM,KAAK,QAAQ,CAAC,QAAQ,KACpD,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAsB3C,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,GACpB,MAAM,MAAM,KACX;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAShF,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,QAAQ;;;;;EAKnB,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,OAAO;kBAEF,MAAM;uBACD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS;uBAC5C,MAAM,GAAG,SAAS;sBAEpB,MAAM,KAAK,iBAAiB,CAAC,iBAAiB;;;;;yDA2BjE,CAAA"}

package/dist/esm/internal/Http.js

@@ -0,0 +1,154 @@
+/**
+ * Shared HTTP response limits, error mapping, and request deadlines.
+ *
+ * @since 1.0.0
+ */
+import * as HttpClient from "@smthrs/kernel/HttpClient";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import * as StdError from "../StdError.js";
+import { guarded, refusal } from "./HttpNetwork.js";
+import { MAX_OUTPUT_BYTES, notice, truncateBytes } from "./Text.js";
+import { parseHttpUrl } from "./Url.js";
+/**
+ * Maximum captured response bytes before decoding.
+ *
+ * @category http
+ * @since 1.0.0
+ */
+export const MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
+/**
+ * Reads a response up to the shared byte limit and finalizes the stream on failure.
+ *
+ * @category http
+ * @since 1.0.0
+ */
+export const readBounded = (stream, url) => Stream.runFoldEffect(stream, () => ({ chunks: [], size: 0 }), (state, chunk) => {
+    const size = state.size + chunk.byteLength;
+    if (size > MAX_RESPONSE_BYTES) {
+        return Effect.fail(new StdError.StdError({
+            code: "response_too_large",
+            message: "Response exceeds the 5 MiB limit",
+            path: url
+        }));
+    }
+    state.chunks.push(chunk);
+    state.size = size;
+    return Effect.succeed(state);
+}).pipe(Effect.map((state) => {
+    const output = new Uint8Array(state.size);
+    let offset = 0;
+    for (const chunk of state.chunks) {
+        output.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return output;
+}));
+/**
+ * Maps transport failures while preserving standard HTTP failure codes.
+ *
+ * @category http
+ * @since 1.0.0
+ */
+export const requestError = (url, error) => error instanceof StdError.StdError ? error : refusal(error) ?? new StdError.StdError({
+    code: "request_failed",
+    message: `Request failed: ${url}${error instanceof Error ? ` (${error.message})` : ""}`
+});
+/**
+ * Looks up a response header without depending on transport normalization.
+ *
+ * @category http
+ * @since 1.0.0
+ */
+export const header = (headers, name) => {
+    const lower = name.toLowerCase();
+    return Object.entries(headers).find(([key]) => key.toLowerCase() === lower)?.[1];
+};
+/**
+ * Seconds; the runtime caps valid overrides at 120.
+ *
+ * @category http
+ * @since 1.0.0
+ */
+export const Timeout = Schema.Number.check(Schema.isFinite(), Schema.isGreaterThan(0));
+/**
+ * Bounds the entire request and body read with one timer. Interruption reaches
+ * HttpClient.execute and response.stream so Effect aborts the transport and
+ * finalizes the body reader before returning the timeout failure.
+ * `timeoutError` preserves a tool's own timeout message while sharing the
+ * validation, duration cap, and interruption behavior.
+ *
+ * @category http
+ * @since 1.0.0
+ */
+export const withDeadline = (effect, url, timeout = 30, timeoutError) => {
+    if (!Schema.is(Timeout)(timeout)) {
+        return Effect.fail(new StdError.StdError({
+            code: "invalid_input",
+            message: "Timeout must be a finite number greater than zero seconds",
+            path: url
+        }));
+    }
+    const seconds = Math.min(timeout, 120);
+    return Effect.timeoutOrElse(effect, {
+        duration: seconds * 1_000,
+        orElse: () => Effect.fail(timeoutError?.(seconds) ?? new StdError.StdError({
+            code: "timeout",
+            message: `Request timed out after ${seconds} seconds`,
+            path: url
+        }))
+    });
+};
+/**
+ * Keeps the head of rendered response text within the shared output budget and
+ * discloses the cut.
+ *
+ * @since 1.0.0
+ * @private
+ */
+export const capOutput = (text) => {
+    const rendered = truncateBytes(text, MAX_OUTPUT_BYTES, { keep: "head" });
+    return {
+        text: rendered.text,
+        truncated: rendered.truncated,
+        ...(rendered.truncated
+            ? { notice: notice("bytes", rendered.keptBytes, rendered.keptBytes + rendered.droppedBytes) }
+            : {})
+    };
+};
+/** Shared response contract for the GET and POST tools.
+ * @since 1.0.0
+ * @private
+ */
+export const Response = Schema.Struct({
+    status: Schema.Number.annotate({ description: "HTTP status code, including error statuses" }),
+    body: Schema.String.annotate({ description: "Response body as text" }),
+    truncated: Schema.Boolean.annotate({ description: "Whether the body exceeded the display budget" }),
+    notice: Schema.optional(Schema.String.annotate({ description: "Truncation disclosure" }))
+});
+/** Validate, execute, and render one bounded HTTP request.
+ * @since 1.0.0
+ * @private
+ */
+export const execute = Effect.fn("Http.execute")(function* (input, makeRequest) {
+    const url = parseHttpUrl(input.url);
+    if (url === undefined) {
+        return yield* Effect.fail(new StdError.StdError({
+            code: "invalid_input",
+            message: `URL must use http or https without user information: ${input.url}`,
+            path: input.url
+        }));
+    }
+    const client = guarded(yield* HttpClient.HttpClient);
+    const request = makeRequest(url.toString());
+    const { status, bytes } = yield* withDeadline(Effect.gen(function* () {
+        const response = yield* client.execute(input.headers === undefined ? request : HttpClientRequest.setHeaders(request, input.headers));
+        const bytes = yield* readBounded(response.stream, input.url);
+        return { status: response.status, bytes };
+    }).pipe(Effect.mapError((error) => requestError(input.url, error))), input.url, input.timeout);
+    const { text, ...disclosure } = capOutput(new TextDecoder().decode(bytes));
+    return { status, body: text, ...disclosure };
+});
+//# sourceMappingURL=Http.js.map

package/dist/esm/internal/Http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Http.js","sourceRoot":"","sources":["../../../src/internal/Http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,UAAU,MAAM,2BAA2B,CAAA;AACvD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,iBAAiB,MAAM,wCAAwC,CAAA;AAC3E,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAEvC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAOjD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,MAAuC,EACvC,GAAW,EAC0C,EAAE,CACvD,MAAM,CAAC,aAAa,CAClB,MAAM,EACN,GAAc,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAC1C,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;IACf,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,UAAU,CAAA;IAC1C,IAAI,IAAI,GAAG,kBAAkB,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,QAAQ,CAAC,QAAQ,CAAC;YACpB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,kCAAkC;YAC3C,IAAI,EAAE,GAAG;SACV,CAAC,CACH,CAAA;IACH,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACxB,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;IACjB,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC9B,CAAC,CACF,CAAC,IAAI,CACJ,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;IACnB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACzB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAA;IAC5B,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAC,CACH,CAAA;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,KAAc,EAAqB,EAAE,CAC7E,KAAK,YAAY,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC;IACnF,IAAI,EAAE,gBAAgB;IACtB,OAAO,EAAE,mBAAmB,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;CACxF,CAAC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAqD,EAAE,IAAY,EAAsB,EAAE;IAChH,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAClF,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;AAEtF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,MAA8B,EAC9B,GAAW,EACX,OAAO,GAAG,EAAE,EACZ,YAAqD,EACT,EAAE;IAC9C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,QAAQ,CAAC,QAAQ,CAAC;YACpB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,2DAA2D;YACpE,IAAI,EAAE,GAAG;SACV,CAAC,CACH,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACtC,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE;QAClC,QAAQ,EAAE,OAAO,GAAG,KAAK;QACzB,MAAM,EAAE,GAAG,EAAE,CACX,MAAM,CAAC,IAAI,CACT,YAAY,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC;YAC/C,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,2BAA2B,OAAO,UAAU;YACrD,IAAI,EAAE,GAAG;SACV,CAAC,CACH;KACJ,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,IAAY,EACsE,EAAE;IACpF,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACxE,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,GAAG,CAAC,QAAQ,CAAC,SAAS;YACpB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,EAAE;YAC7F,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;IAC7F,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;IACtE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;IACnG,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC,CAAC;CAC1F,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,EACxD,KAIC,EACD,WAAiE;IAEjE,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,QAAQ,CAAC,QAAQ,CAAC;YACpB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,wDAAwD,KAAK,CAAC,GAAG,EAAE;YAC5E,IAAI,EAAE,KAAK,CAAC,GAAG;SAChB,CAAC,CACH,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;IACpD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC3C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,YAAY,CAC3C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACpC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAC7F,CAAA;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5D,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAA;IAC3C,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EACnE,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,OAAO,CACd,CAAA;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,EAAE,GAAG,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IAC1E,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,UAAU,EAAE,CAAA;AAC9C,CAAC,CAAC,CAAA","sourcesContent":["/**\n * Shared HTTP response limits, error mapping, and request deadlines.\n *\n * @since 1.0.0\n */\n\nimport type { GrantStore } from \"@smthrs/kernel/GrantStore\"\nimport * as HttpClient from \"@smthrs/kernel/HttpClient\"\nimport * as Effect from \"effect/Effect\"\nimport * as Schema from \"effect/Schema\"\nimport * as Stream from \"effect/Stream\"\nimport * as HttpClientRequest from \"effect/unstable/http/HttpClientRequest\"\nimport * as StdError from \"../StdError.ts\"\nimport { guarded, refusal } from \"./HttpNetwork.ts\"\nimport { MAX_OUTPUT_BYTES, notice, truncateBytes } from \"./Text.ts\"\nimport { parseHttpUrl } from \"./Url.ts\"\n\n/**\n * Maximum captured response bytes before decoding.\n *\n * @category http\n * @since 1.0.0\n */\nexport const MAX_RESPONSE_BYTES = 5 * 1024 * 1024\n\ninterface BodyState {\n  readonly chunks: Array<Uint8Array>\n  size: number\n}\n\n/**\n * Reads a response up to the shared byte limit and finalizes the stream on failure.\n *\n * @category http\n * @since 1.0.0\n */\nexport const readBounded = <E, R>(\n  stream: Stream.Stream<Uint8Array, E, R>,\n  url: string\n): Effect.Effect<Uint8Array, E | StdError.StdError, R> =>\n  Stream.runFoldEffect(\n    stream,\n    (): BodyState => ({ chunks: [], size: 0 }),\n    (state, chunk) => {\n      const size = state.size + chunk.byteLength\n      if (size > MAX_RESPONSE_BYTES) {\n        return Effect.fail(\n          new StdError.StdError({\n            code: \"response_too_large\",\n            message: \"Response exceeds the 5 MiB limit\",\n            path: url\n          })\n        )\n      }\n      state.chunks.push(chunk)\n      state.size = size\n      return Effect.succeed(state)\n    }\n  ).pipe(\n    Effect.map((state) => {\n      const output = new Uint8Array(state.size)\n      let offset = 0\n      for (const chunk of state.chunks) {\n        output.set(chunk, offset)\n        offset += chunk.byteLength\n      }\n      return output\n    })\n  )\n\n/**\n * Maps transport failures while preserving standard HTTP failure codes.\n *\n * @category http\n * @since 1.0.0\n */\nexport const requestError = (url: string, error: unknown): StdError.StdError =>\n  error instanceof StdError.StdError ? error : refusal(error) ?? new StdError.StdError({\n    code: \"request_failed\",\n    message: `Request failed: ${url}${error instanceof Error ? ` (${error.message})` : \"\"}`\n  })\n\n/**\n * Looks up a response header without depending on transport normalization.\n *\n * @category http\n * @since 1.0.0\n */\nexport const header = (headers: Readonly<Record<string, string | undefined>>, name: string): string | undefined => {\n  const lower = name.toLowerCase()\n  return Object.entries(headers).find(([key]) => key.toLowerCase() === lower)?.[1]\n}\n\n/**\n * Seconds; the runtime caps valid overrides at 120.\n *\n * @category http\n * @since 1.0.0\n */\nexport const Timeout = Schema.Number.check(Schema.isFinite(), Schema.isGreaterThan(0))\n\n/**\n * Bounds the entire request and body read with one timer. Interruption reaches\n * HttpClient.execute and response.stream so Effect aborts the transport and\n * finalizes the body reader before returning the timeout failure.\n * `timeoutError` preserves a tool's own timeout message while sharing the\n * validation, duration cap, and interruption behavior.\n *\n * @category http\n * @since 1.0.0\n */\nexport const withDeadline = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n  url: string,\n  timeout = 30,\n  timeoutError?: (seconds: number) => StdError.StdError\n): Effect.Effect<A, E | StdError.StdError, R> => {\n  if (!Schema.is(Timeout)(timeout)) {\n    return Effect.fail(\n      new StdError.StdError({\n        code: \"invalid_input\",\n        message: \"Timeout must be a finite number greater than zero seconds\",\n        path: url\n      })\n    )\n  }\n  const seconds = Math.min(timeout, 120)\n  return Effect.timeoutOrElse(effect, {\n    duration: seconds * 1_000,\n    orElse: () =>\n      Effect.fail(\n        timeoutError?.(seconds) ?? new StdError.StdError({\n          code: \"timeout\",\n          message: `Request timed out after ${seconds} seconds`,\n          path: url\n        })\n      )\n  })\n}\n\n/**\n * Keeps the head of rendered response text within the shared output budget and\n * discloses the cut.\n *\n * @since 1.0.0\n * @private\n */\nexport const capOutput = (\n  text: string\n): { readonly text: string; readonly truncated: boolean; readonly notice?: string } => {\n  const rendered = truncateBytes(text, MAX_OUTPUT_BYTES, { keep: \"head\" })\n  return {\n    text: rendered.text,\n    truncated: rendered.truncated,\n    ...(rendered.truncated\n      ? { notice: notice(\"bytes\", rendered.keptBytes, rendered.keptBytes + rendered.droppedBytes) }\n      : {})\n  }\n}\n\n/** Shared response contract for the GET and POST tools.\n * @since 1.0.0\n * @private\n */\nexport const Response = Schema.Struct({\n  status: Schema.Number.annotate({ description: \"HTTP status code, including error statuses\" }),\n  body: Schema.String.annotate({ description: \"Response body as text\" }),\n  truncated: Schema.Boolean.annotate({ description: \"Whether the body exceeded the display budget\" }),\n  notice: Schema.optional(Schema.String.annotate({ description: \"Truncation disclosure\" }))\n})\n\n/** Validate, execute, and render one bounded HTTP request.\n * @since 1.0.0\n * @private\n */\nexport const execute = Effect.fn(\"Http.execute\")(function*(\n  input: {\n    readonly url: string\n    readonly headers?: Readonly<Record<string, string>> | undefined\n    readonly timeout?: number | undefined\n  },\n  makeRequest: (url: string) => HttpClientRequest.HttpClientRequest\n): Effect.fn.Return<typeof Response.Type, StdError.StdError, HttpClient.HttpClient | GrantStore> {\n  const url = parseHttpUrl(input.url)\n  if (url === undefined) {\n    return yield* Effect.fail(\n      new StdError.StdError({\n        code: \"invalid_input\",\n        message: `URL must use http or https without user information: ${input.url}`,\n        path: input.url\n      })\n    )\n  }\n  const client = guarded(yield* HttpClient.HttpClient)\n  const request = makeRequest(url.toString())\n  const { status, bytes } = yield* withDeadline(\n    Effect.gen(function*() {\n      const response = yield* client.execute(\n        input.headers === undefined ? request : HttpClientRequest.setHeaders(request, input.headers)\n      )\n      const bytes = yield* readBounded(response.stream, input.url)\n      return { status: response.status, bytes }\n    }).pipe(Effect.mapError((error) => requestError(input.url, error))),\n    input.url,\n    input.timeout\n  )\n  const { text, ...disclosure } = capOutput(new TextDecoder().decode(bytes))\n  return { status, body: text, ...disclosure }\n})\n"]}

package/dist/esm/internal/HttpNetwork.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Destination policy shared by the web tools, including every redirect hop.
+ *
+ * @since 1.0.0
+ */
+import { GrantStore } from "@smthrs/kernel/GrantStore";
+import { Context, Effect } from "effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientError from "effect/unstable/http/HttpClientError";
+import * as StdError from "../StdError.ts";
+/** Resolver seam: all addresses must be public before an unprivileged request.
+ * @since 1.0.0
+ * @private
+ */
+export declare const ResolveHost: Context.Reference<(hostname: string) => Effect.Effect<ReadonlyArray<string>, unknown>>;
+/** Decorates the supplied client before following redirects through the guard.
+ * The transport must honor manual redirects, as required by the kernel client.
+ * @since 1.0.0
+ * @private
+ */
+export declare const guarded: (client: HttpClient.HttpClient, follow?: boolean) => HttpClient.HttpClient.With<HttpClientError.HttpClientError, GrantStore>;
+/** Recovers the typed refusal carried through Effect's HTTP error channel.
+ * @since 1.0.0
+ * @private
+ */
+export declare const refusal: (error: unknown) => StdError.StdError | undefined;
+//# sourceMappingURL=HttpNetwork.d.ts.map

package/dist/esm/internal/HttpNetwork.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpNetwork.d.ts","sourceRoot":"","sources":["../../../src/internal/HttpNetwork.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAOtD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAA;AAEhD,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAA;AAC7D,OAAO,KAAK,eAAe,MAAM,sCAAsC,CAAA;AAGvE,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAG1C;;;GAGG;AACH,eAAO,MAAM,WAAW,+BACX,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAInE,CAAA;AAwEF;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAClB,QAAQ,UAAU,CAAC,UAAU,EAC7B,gBAAa,KACZ,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,eAAe,EAAE,UAAU,CAuBxE,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,OAAO,GAAI,OAAO,OAAO,KAAG,QAAQ,CAAC,QAAQ,GAAG,SAW5D,CAAA"}

package/dist/esm/internal/HttpNetwork.js

@@ -0,0 +1,114 @@
+/**
+ * Destination policy shared by the web tools, including every redirect hop.
+ *
+ * @since 1.0.0
+ */
+import * as Capability from "@smthrs/capability/Capability";
+import { GrantStore } from "@smthrs/kernel/GrantStore";
+import { authorizePreflight, Destination, fromHttpClientError, supportsDestinationPinning } from "@smthrs/kernel/HttpClient";
+import { Context, Effect, Option } from "effect";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientError from "effect/unstable/http/HttpClientError";
+import { lookup } from "node:dns/promises";
+import { BlockList, isIP } from "node:net";
+import * as StdError from "../StdError.js";
+import { parseHttpUrl } from "./Url.js";
+/** Resolver seam: all addresses must be public before an unprivileged request.
+ * @since 1.0.0
+ * @private
+ */
+export const ResolveHost = Context.Reference("@smthrs/std/HttpNetwork/ResolveHost", {
+    defaultValue: () => (hostname) => Effect.tryPromise(async () => (await lookup(hostname, { all: true })).map((a) => a.address))
+});
+const blocked = new BlockList();
+for (const [address, prefix] of [
+    ["0.0.0.0", 8],
+    ["10.0.0.0", 8],
+    ["127.0.0.0", 8],
+    ["169.254.0.0", 16],
+    ["172.16.0.0", 12],
+    ["192.168.0.0", 16],
+    ["192.0.0.0", 24],
+    ["100.64.0.0", 10],
+    ["198.18.0.0", 15],
+    ["224.0.0.0", 4],
+    ["240.0.0.0", 4]
+])
+    blocked.addSubnet(address, prefix, "ipv4");
+// Allow global IPv6 and mapped IPv4 only, excluding transition tunnels.
+const publicV6 = new BlockList();
+publicV6.addSubnet("2000::", 3, "ipv6");
+publicV6.addSubnet("::ffff:0:0", 96, "ipv6");
+blocked.addSubnet("2002::", 16, "ipv6");
+blocked.addSubnet("2001::", 32, "ipv6");
+const isPublic = (address) => {
+    const family = isIP(address);
+    if (family === 4)
+        return !blocked.check(address, "ipv4");
+    return family === 6 && publicV6.check(address, "ipv6") && !blocked.check(address, "ipv6");
+};
+const failure = (code, message, path) => new StdError.StdError({ code, message, path });
+const check = Effect.fn("HttpNetwork.check")(function* (value, client) {
+    const url = parseHttpUrl(value);
+    if (url === undefined) {
+        return yield* Effect.fail(failure("invalid_input", "URL must use http or https without user information", value));
+    }
+    if (!supportsDestinationPinning(client)) {
+        return yield* Effect.fail(failure("unsupported", "HTTP host must support destination pinning", value));
+    }
+    const hostname = url.hostname.replace(/^\[|\]$/g, "");
+    const local = hostname.replace(/\.$/, "").toLowerCase();
+    const literal = isIP(hostname) !== 0;
+    const localhost = local === "localhost" || local.endsWith(".localhost");
+    const resolve = yield* ResolveHost;
+    // Refuse localhost before DNS unless the origin is explicitly authorized.
+    const privateGrant = Effect.gen(function* () {
+        const store = yield* GrantStore;
+        const capability = yield* Effect.try({
+            try: () => Capability.make("net:private", url.origin),
+            catch: () => failure("invalid_input", "Private HTTP origin exceeds the capability resource limit", value)
+        });
+        yield* store.check(capability).pipe(Effect.mapError(() => failure("permission_denied", "Private HTTP destination requires a net:private grant", value)));
+    });
+    if (localhost)
+        yield* privateGrant;
+    const addresses = literal ? [hostname] : [
+        ...yield* resolve(hostname).pipe(Effect.mapError(() => failure("request_failed", "Could not resolve HTTP destination", value)))
+    ];
+    if (addresses.length === 0 || addresses.some((address) => isIP(address) === 0)) {
+        return yield* Effect.fail(failure("request_failed", "HTTP destination has no valid addresses", value));
+    }
+    if (!localhost && !addresses.every(isPublic))
+        yield* privateGrant;
+    return Object.freeze({ origin: url.origin, addresses: Object.freeze(addresses) });
+});
+/** Decorates the supplied client before following redirects through the guard.
+ * The transport must honor manual redirects, as required by the kernel client.
+ * @since 1.0.0
+ * @private
+ */
+export const guarded = (client, follow = true) => {
+    const checked = HttpClient.transform(client, (execute, request) => authorizePreflight(request, check(request.url, client).pipe(Effect.mapError((cause) => new HttpClientError.HttpClientError({
+        reason: new HttpClientError.TransportError({ request, cause, description: cause.message })
+    })), Effect.flatMap((destination) => Effect.updateContext(execute, (context) => Context.add(Context.add(context, Destination, destination), FetchHttpClient.RequestInit, {
+        ...Context.getOrUndefined(context, FetchHttpClient.RequestInit),
+        redirect: "manual"
+    }))))));
+    return follow ? HttpClient.followRedirects(checked) : checked;
+};
+/** Recovers the typed refusal carried through Effect's HTTP error channel.
+ * @since 1.0.0
+ * @private
+ */
+export const refusal = (error) => {
+    if (!(error instanceof HttpClientError.HttpClientError) || error.reason._tag !== "TransportError")
+        return undefined;
+    if (error.reason.cause instanceof StdError.StdError)
+        return error.reason.cause;
+    if (Option.isSome(fromHttpClientError(error))) {
+        return failure("permission_denied", error.reason.description ?? "HTTP permission was refused", error.reason.request.url);
+    }
+    return undefined;
+};
+//# sourceMappingURL=HttpNetwork.js.map

package/dist/esm/internal/HttpNetwork.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpNetwork.js","sourceRoot":"","sources":["../../../src/internal/HttpNetwork.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,mBAAmB,EACnB,0BAA0B,EAC3B,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAChD,OAAO,KAAK,eAAe,MAAM,sCAAsC,CAAA;AACvE,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAA;AAC7D,OAAO,KAAK,eAAe,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAEvC;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAE1C,qCAAqC,EAAE;IACvC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC/B,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;CAC/F,CAAC,CAAA;AAEF,MAAM,OAAO,GAAG,IAAI,SAAS,EAAE,CAAA;AAC/B,KACE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IACzB,CAAC,SAAS,EAAE,CAAC,CAAC;IACd,CAAC,UAAU,EAAE,CAAC,CAAC;IACf,CAAC,WAAW,EAAE,CAAC,CAAC;IAChB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,WAAW,EAAE,CAAC,CAAC;IAChB,CAAC,WAAW,EAAE,CAAC,CAAC;CACR;IACV,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;AAC5C,wEAAwE;AACxE,MAAM,QAAQ,GAAG,IAAI,SAAS,EAAE,CAAA;AAChC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;AACvC,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;AAC5C,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;AACvC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;AAEvC,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAW,EAAE;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5B,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACxD,OAAO,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;AAC3F,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,IAAmB,EAAE,OAAe,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;AAEtH,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EAAC,KAAa,EAAE,MAA6B;IACjG,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,qDAAqD,EAAE,KAAK,CAAC,CAAC,CAAA;IACnH,CAAC;IACD,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,4CAA4C,EAAE,KAAK,CAAC,CAAC,CAAA;IACxG,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpC,MAAM,SAAS,GAAG,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IACvE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAA;IAClC,0EAA0E;IAC1E,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAA;QAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACnC,GAAG,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC;YACrD,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,2DAA2D,EAAE,KAAK,CAAC;SAC1G,CAAC,CAAA;QACF,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CACjC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CACnB,OAAO,CAAC,mBAAmB,EAAE,uDAAuD,EAAE,KAAK,CAAC,CAC7F,CACF,CAAA;IACH,CAAC,CAAC,CAAA;IACF,IAAI,SAAS;QAAE,KAAK,CAAC,CAAC,YAAY,CAAA;IAClC,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC9B,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,oCAAoC,EAAE,KAAK,CAAC,CAAC,CAC9F;KACF,CAAA;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,yCAAyC,EAAE,KAAK,CAAC,CAAC,CAAA;IACxG,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,KAAK,CAAC,CAAC,YAAY,CAAA;IACjE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;AACnF,CAAC,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,MAA6B,EAC7B,MAAM,GAAG,IAAI,EAC4D,EAAE;IAC3E,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAClC,MAAM,EACN,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CACnB,kBAAkB,CAChB,OAAO,EACP,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,CAC7B,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,IAAI,eAAe,CAAC,eAAe,CAAC;QAClC,MAAM,EAAE,IAAI,eAAe,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KAC3F,CAAC,CACH,EACD,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAC7B,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,OAA+B,EAAE,EAAE,CAChE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,eAAe,CAAC,WAAW,EAAE;QACvF,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,eAAe,CAAC,WAAW,CAAC;QAC/D,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC,CACN,CACF,CACF,CACJ,CAAA;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;AAC/D,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,KAAc,EAAiC,EAAE;IACvE,IAAI,CAAC,CAAC,KAAK,YAAY,eAAe,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,SAAS,CAAA;IACnH,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,YAAY,QAAQ,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAA;IAC9E,IAAI,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO,OAAO,CACZ,mBAAmB,EACnB,KAAK,CAAC,MAAM,CAAC,WAAW,IAAI,6BAA6B,EACzD,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CACzB,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA","sourcesContent":["/**\n * Destination policy shared by the web tools, including every redirect hop.\n *\n * @since 1.0.0\n */\n\nimport * as Capability from \"@smthrs/capability/Capability\"\nimport { GrantStore } from \"@smthrs/kernel/GrantStore\"\nimport {\n  authorizePreflight,\n  Destination,\n  fromHttpClientError,\n  supportsDestinationPinning\n} from \"@smthrs/kernel/HttpClient\"\nimport { Context, Effect, Option } from \"effect\"\nimport * as FetchHttpClient from \"effect/unstable/http/FetchHttpClient\"\nimport * as HttpClient from \"effect/unstable/http/HttpClient\"\nimport * as HttpClientError from \"effect/unstable/http/HttpClientError\"\nimport { lookup } from \"node:dns/promises\"\nimport { BlockList, isIP } from \"node:net\"\nimport * as StdError from \"../StdError.ts\"\nimport { parseHttpUrl } from \"./Url.ts\"\n\n/** Resolver seam: all addresses must be public before an unprivileged request.\n * @since 1.0.0\n * @private\n */\nexport const ResolveHost = Context.Reference<\n  (hostname: string) => Effect.Effect<ReadonlyArray<string>, unknown>\n>(\"@smthrs/std/HttpNetwork/ResolveHost\", {\n  defaultValue: () => (hostname) =>\n    Effect.tryPromise(async () => (await lookup(hostname, { all: true })).map((a) => a.address))\n})\n\nconst blocked = new BlockList()\nfor (\n  const [address, prefix] of [\n    [\"0.0.0.0\", 8],\n    [\"10.0.0.0\", 8],\n    [\"127.0.0.0\", 8],\n    [\"169.254.0.0\", 16],\n    [\"172.16.0.0\", 12],\n    [\"192.168.0.0\", 16],\n    [\"192.0.0.0\", 24],\n    [\"100.64.0.0\", 10],\n    [\"198.18.0.0\", 15],\n    [\"224.0.0.0\", 4],\n    [\"240.0.0.0\", 4]\n  ] as const\n) blocked.addSubnet(address, prefix, \"ipv4\")\n// Allow global IPv6 and mapped IPv4 only, excluding transition tunnels.\nconst publicV6 = new BlockList()\npublicV6.addSubnet(\"2000::\", 3, \"ipv6\")\npublicV6.addSubnet(\"::ffff:0:0\", 96, \"ipv6\")\nblocked.addSubnet(\"2002::\", 16, \"ipv6\")\nblocked.addSubnet(\"2001::\", 32, \"ipv6\")\n\nconst isPublic = (address: string): boolean => {\n  const family = isIP(address)\n  if (family === 4) return !blocked.check(address, \"ipv4\")\n  return family === 6 && publicV6.check(address, \"ipv6\") && !blocked.check(address, \"ipv6\")\n}\n\nconst failure = (code: StdError.Code, message: string, path: string) => new StdError.StdError({ code, message, path })\n\nconst check = Effect.fn(\"HttpNetwork.check\")(function*(value: string, client: HttpClient.HttpClient) {\n  const url = parseHttpUrl(value)\n  if (url === undefined) {\n    return yield* Effect.fail(failure(\"invalid_input\", \"URL must use http or https without user information\", value))\n  }\n  if (!supportsDestinationPinning(client)) {\n    return yield* Effect.fail(failure(\"unsupported\", \"HTTP host must support destination pinning\", value))\n  }\n  const hostname = url.hostname.replace(/^\\[|\\]$/g, \"\")\n  const local = hostname.replace(/\\.$/, \"\").toLowerCase()\n  const literal = isIP(hostname) !== 0\n  const localhost = local === \"localhost\" || local.endsWith(\".localhost\")\n  const resolve = yield* ResolveHost\n  // Refuse localhost before DNS unless the origin is explicitly authorized.\n  const privateGrant = Effect.gen(function*() {\n    const store = yield* GrantStore\n    const capability = yield* Effect.try({\n      try: () => Capability.make(\"net:private\", url.origin),\n      catch: () => failure(\"invalid_input\", \"Private HTTP origin exceeds the capability resource limit\", value)\n    })\n    yield* store.check(capability).pipe(\n      Effect.mapError(() =>\n        failure(\"permission_denied\", \"Private HTTP destination requires a net:private grant\", value)\n      )\n    )\n  })\n  if (localhost) yield* privateGrant\n  const addresses = literal ? [hostname] : [\n    ...yield* resolve(hostname).pipe(\n      Effect.mapError(() => failure(\"request_failed\", \"Could not resolve HTTP destination\", value))\n    )\n  ]\n  if (addresses.length === 0 || addresses.some((address) => isIP(address) === 0)) {\n    return yield* Effect.fail(failure(\"request_failed\", \"HTTP destination has no valid addresses\", value))\n  }\n  if (!localhost && !addresses.every(isPublic)) yield* privateGrant\n  return Object.freeze({ origin: url.origin, addresses: Object.freeze(addresses) })\n})\n\n/** Decorates the supplied client before following redirects through the guard.\n * The transport must honor manual redirects, as required by the kernel client.\n * @since 1.0.0\n * @private\n */\nexport const guarded = (\n  client: HttpClient.HttpClient,\n  follow = true\n): HttpClient.HttpClient.With<HttpClientError.HttpClientError, GrantStore> => {\n  const checked = HttpClient.transform(\n    client,\n    (execute, request) =>\n      authorizePreflight(\n        request,\n        check(request.url, client).pipe(\n          Effect.mapError((cause) =>\n            new HttpClientError.HttpClientError({\n              reason: new HttpClientError.TransportError({ request, cause, description: cause.message })\n            })\n          ),\n          Effect.flatMap((destination) =>\n            Effect.updateContext(execute, (context: Context.Context<never>) =>\n              Context.add(Context.add(context, Destination, destination), FetchHttpClient.RequestInit, {\n                ...Context.getOrUndefined(context, FetchHttpClient.RequestInit),\n                redirect: \"manual\"\n              }))\n          )\n        )\n      )\n  )\n  return follow ? HttpClient.followRedirects(checked) : checked\n}\n\n/** Recovers the typed refusal carried through Effect's HTTP error channel.\n * @since 1.0.0\n * @private\n */\nexport const refusal = (error: unknown): StdError.StdError | undefined => {\n  if (!(error instanceof HttpClientError.HttpClientError) || error.reason._tag !== \"TransportError\") return undefined\n  if (error.reason.cause instanceof StdError.StdError) return error.reason.cause\n  if (Option.isSome(fromHttpClientError(error))) {\n    return failure(\n      \"permission_denied\",\n      error.reason.description ?? \"HTTP permission was refused\",\n      error.reason.request.url\n    )\n  }\n  return undefined\n}\n"]}

package/dist/esm/internal/Ignore.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Root-scoped gitignore rules, compiled once per visited directory.
+ *
+ * @since 1.0.0
+ */
+interface Rule {
+    readonly expression: RegExp;
+    readonly directoryOnly: boolean;
+    readonly negated: boolean;
+    readonly byPath: boolean;
+}
+/**
+ * Rules belonging to one visited directory.
+ *
+ * @private
+ * @since 1.0.0
+ */
+export interface Scope {
+    readonly directory: string;
+    readonly rules: ReadonlyArray<Rule>;
+}
+/**
+ * Parses gitignore lines without widening the caller-glob grammar.
+ *
+ * @private
+ * @since 1.0.0
+ */
+export declare const parse: (directory: string, content: string) => Scope;
+/**
+ * Tests an entry before descent; deeper scopes and later rules take priority.
+ *
+ * @private
+ * @since 1.0.0
+ */
+export declare const ignored: (scopes: ReadonlyArray<Scope>, candidate: string, basename: string, directory: boolean, relative: (from: string, to: string) => string) => boolean;
+export {};
+//# sourceMappingURL=Ignore.d.ts.map

package/dist/esm/internal/Ignore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Ignore.d.ts","sourceRoot":"","sources":["../../../src/internal/Ignore.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,UAAU,IAAI;IACZ,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,CAAA;CACpC;AAyDD;;;;;GAKG;AACH,eAAO,MAAM,KAAK,GAAI,WAAW,MAAM,EAAE,SAAS,MAAM,KAAG,KAqB1D,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,OAAO,GAClB,QAAQ,aAAa,CAAC,KAAK,CAAC,EAC5B,WAAW,MAAM,EACjB,UAAU,MAAM,EAChB,WAAW,OAAO,EAClB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,MAAM,KAC7C,OAYF,CAAA"}