emdash 1.0.1 → 1.2.0

package/dist/snapshot-W36KbLmc.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"snapshot-W36KbLmc.mjs","names":[],"sources":["../src/api/handlers/snapshot.ts"],"sourcesContent":["/**\n * Snapshot handler — generates a portable database snapshot.\n *\n * Returns all content tables, schema definitions, and supporting data\n * needed to render content in an isolated preview database.\n *\n * Used by:\n * - DO preview database (EmDashPreviewDB.populateFromSnapshot)\n * - Future: CLI export, backup, site migration\n */\n\nimport type { Kysely } from \"kysely\";\nimport { sql } from \"kysely\";\n\nimport { listTableColumns, listTablesLike } from \"../../database/dialect-helpers.js\";\nimport type { Database } from \"../../database/types.js\";\n\n// ─�� Preview signature verification ──────────────────────────────\n\n/**\n * Verify HMAC-SHA256 preview signature using crypto.subtle.\n * Returns true if the signature is valid and not expired.\n */\nexport async function verifyPreviewSignature(\n\tsource: string,\n\texp: number,\n\tsig: string,\n\tsecret: string,\n): Promise<boolean> {\n\tif (exp < Date.now() / 1000) return false;\n\n\tconst encoder = new TextEncoder();\n\tconst key = await crypto.subtle.importKey(\n\t\t\"raw\",\n\t\tencoder.encode(secret),\n\t\t{ name: \"HMAC\", hash: \"SHA-256\" },\n\t\tfalse,\n\t\t[\"verify\"],\n\t);\n\n\tconst sigBytes = new Uint8Array(sig.length / 2);\n\tfor (let i = 0; i < sig.length; i += 2) {\n\t\tsigBytes[i / 2] = parseInt(sig.substring(i, i + 2), 16);\n\t}\n\n\treturn crypto.subtle.verify(\"HMAC\", key, sigBytes, encoder.encode(`${source}:${exp}`));\n}\n\n/**\n * Parse an X-Preview-Signature header value into its components.\n *\n * Format: \"source:exp:sig\" where source is a URL (contains colons),\n * exp is a unix timestamp, and sig is 64 hex chars.\n *\n * Parses from the right since source URLs contain colons.\n *\n * @returns Parsed components, or null if the format is invalid\n */\nexport function parsePreviewSignatureHeader(\n\theader: string,\n): { source: string; exp: number; sig: string } | null {\n\tconst lastColon = header.lastIndexOf(\":\");\n\tif (lastColon <= 0) return null;\n\n\tconst sig = header.substring(lastColon + 1);\n\tif (sig.length !== 64) return null;\n\n\tconst rest = header.substring(0, lastColon);\n\tconst secondLastColon = rest.lastIndexOf(\":\");\n\tif (secondLastColon <= 0) return null;\n\n\tconst source = rest.substring(0, secondLastColon);\n\tconst exp = parseInt(rest.substring(secondLastColon + 1), 10);\n\n\tif (isNaN(exp) || source.length === 0) return null;\n\n\treturn { source, exp, sig };\n}\n\n// ── Media URL rewriting ─────────────────────────────────────────\n\nconst MEDIA_FILE_PREFIX = \"/_emdash/api/media/file/\";\nconst MEDIA_FILE_SUFFIX = /[?#]/;\nconst EXTERNAL_OR_ROOT_URL = /^(?:[a-z][a-z0-9+.-]*:|\\/)/i;\n\n/**\n * Parse a JSON string value and inject `src` for local media objects.\n * Returns the original string if it's not a local media value.\n */\nfunction injectMediaSrc(jsonStr: string, origin: string): string {\n\ttry {\n\t\tconst obj = JSON.parse(jsonStr);\n\t\tif (typeof obj !== \"object\" || obj === null || Array.isArray(obj)) return jsonStr;\n\t\tif (injectMediaSrcInto(obj, origin)) {\n\t\t\treturn JSON.stringify(obj);\n\t\t}\n\t\treturn jsonStr;\n\t} catch {\n\t\treturn jsonStr;\n\t}\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * Recursively walk an object and inject `src` into local media values.\n * Returns true if any modifications were made.\n */\nfunction injectMediaSrcInto(obj: Record<string, unknown>, origin: string): boolean {\n\tlet modified = false;\n\n\t// Check if this object itself is a local media value\n\tif ((obj.provider === \"local\" || (!obj.provider && obj.id && obj.meta)) && !obj.src) {\n\t\tconst meta = isRecord(obj.meta) ? obj.meta : undefined;\n\t\tconst storageKey = meta?.storageKey ?? obj.id;\n\t\tif (typeof storageKey === \"string\" && storageKey) {\n\t\t\tobj.src = `${origin}${MEDIA_FILE_PREFIX}${storageKey}`;\n\t\t\tmodified = true;\n\t\t}\n\t}\n\n\t// Recurse into nested objects/arrays (e.g. Portable Text with image blocks)\n\tfor (const value of Object.values(obj)) {\n\t\tif (Array.isArray(value)) {\n\t\t\tfor (const item of value) {\n\t\t\t\tif (isRecord(item)) {\n\t\t\t\t\tif (injectMediaSrcInto(item, origin)) {\n\t\t\t\t\t\tmodified = true;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t} else if (isRecord(value)) {\n\t\t\tif (injectMediaSrcInto(value, origin)) {\n\t\t\t\tmodified = true;\n\t\t\t}\n\t\t}\n\t}\n\n\treturn modified;\n}\n\n// ── Snapshot generation ─────────────────────────────────────────\n\n/**\n * Safe identifier pattern for snapshot table names.\n * More permissive than validateIdentifier() — allows leading underscores\n * (needed for system tables like _emdash_collections).\n */\nconst SAFE_TABLE_NAME = /^[a-z_][a-z0-9_]*$/;\n\n/** Snapshot shape consumed by the DO preview database */\nexport interface Snapshot {\n\ttables: Record<string, Record<string, unknown>[]>;\n\tschema: Record<\n\t\tstring,\n\t\t{\n\t\t\tcolumns: string[];\n\t\t\ttypes?: Record<string, string>;\n\t\t}\n\t>;\n\tgeneratedAt: string;\n}\n\n/**\n * System tables included in snapshots.\n * Content tables (ec_*) are discovered dynamically.\n */\nconst SYSTEM_TABLES = [\n\t\"_emdash_block_types\",\n\t\"_emdash_block_type_versions\",\n\t\"_emdash_collections\",\n\t\"_emdash_fields\",\n\t\"_emdash_taxonomy_defs\",\n\t\"_emdash_taxonomy_def_groups\",\n\t\"_emdash_menus\",\n\t\"_emdash_menu_items\",\n\t\"_emdash_sections\",\n\t\"_emdash_widget_areas\",\n\t\"_emdash_widgets\",\n\t\"_emdash_seo\",\n\t\"_emdash_migrations\",\n\t\"content_taxonomies\",\n\t\"taxonomies\",\n\t\"options\",\n\t\"media\",\n\t\"revisions\",\n] as const;\n\ntype SystemTable = (typeof SYSTEM_TABLES)[number];\ntype PublishedTablePolicy = \"full\" | \"content-linked\" | \"omit\";\n\n/**\n * Published snapshots are available to preview-signature callers, so every\n * system table must be classified explicitly. Adding a snapshot table without\n * choosing a policy is a type error rather than an accidental data export.\n */\nconst PUBLISHED_TABLE_POLICIES: Record<SystemTable, PublishedTablePolicy> = {\n\t_emdash_block_types: \"full\",\n\t_emdash_block_type_versions: \"full\",\n\t_emdash_collections: \"full\",\n\t_emdash_fields: \"full\",\n\t_emdash_taxonomy_defs: \"full\",\n\t_emdash_taxonomy_def_groups: \"full\",\n\t_emdash_menus: \"full\",\n\t_emdash_menu_items: \"content-linked\",\n\t_emdash_sections: \"full\",\n\t_emdash_widget_areas: \"full\",\n\t_emdash_widgets: \"full\",\n\t_emdash_seo: \"content-linked\",\n\t_emdash_migrations: \"full\",\n\tcontent_taxonomies: \"content-linked\",\n\ttaxonomies: \"content-linked\",\n\toptions: \"content-linked\",\n\tmedia: \"content-linked\",\n\trevisions: \"omit\",\n};\n\nconst SYSTEM_TABLE_SET: ReadonlySet<string> = new Set(SYSTEM_TABLES);\n\nfunction isSystemTable(tableName: string): tableName is SystemTable {\n\treturn SYSTEM_TABLE_SET.has(tableName);\n}\n\ninterface PublishedContentReferences {\n\tids: Set<string>;\n\ttranslationGroups: Set<string>;\n}\n\ninterface PublishedProjection {\n\tcontent: Map<string, PublishedContentReferences>;\n\ttaxonomyGroups: Set<string>;\n\tmediaIds: Set<string>;\n\tmediaStorageKeys: Set<string>;\n}\n\n/**\n * Table name prefixes excluded from snapshots (auth/security data).\n */\nconst EXCLUDED_PREFIXES = [\n\t\"_emdash_api_tokens\",\n\t\"_emdash_oauth_tokens\",\n\t\"_emdash_authorization_codes\",\n\t\"_emdash_device_codes\",\n\t\"_emdash_migrations_lock\",\n\t\"_emdash_transfer_\",\n\t\"_plugin_\",\n\t\"users\",\n\t\"sessions\",\n\t\"credentials\",\n\t\"challenges\",\n];\n\n/**\n * Options key prefixes safe for inclusion in snapshots.\n *\n * The options table contains plugin secrets (plugin:*), passkey challenges\n * (emdash:passkey_pending:*), and setup state that must not leak to\n * preview databases. Only site-level rendering settings are needed.\n */\nconst SAFE_OPTIONS_PREFIXES = [\"site:\"];\n\nfunction isExcluded(tableName: string): boolean {\n\treturn EXCLUDED_PREFIXES.some((prefix) => tableName.startsWith(prefix));\n}\n\ntype SnapshotColumnType = \"TEXT\" | \"INTEGER\" | \"REAL\" | \"BLOB\" | \"JSON\";\n\nfunction normalizeColumnType(type: string): SnapshotColumnType {\n\tswitch (type.toLowerCase()) {\n\t\tcase \"smallint\":\n\t\tcase \"integer\":\n\t\tcase \"bigint\":\n\t\tcase \"boolean\":\n\t\t\treturn \"INTEGER\";\n\t\tcase \"real\":\n\t\tcase \"double precision\":\n\t\tcase \"numeric\":\n\t\tcase \"decimal\":\n\t\t\treturn \"REAL\";\n\t\tcase \"blob\":\n\t\tcase \"bytea\":\n\t\t\treturn \"BLOB\";\n\t\tcase \"json\":\n\t\tcase \"jsonb\":\n\t\t\treturn \"JSON\";\n\t\tdefault:\n\t\t\treturn \"TEXT\";\n\t}\n}\n\nfunction normalizeRows(\n\trows: Record<string, unknown>[],\n\ttypes: Record<string, SnapshotColumnType>,\n): Record<string, unknown>[] {\n\tfor (const row of rows) {\n\t\tfor (const [column, type] of Object.entries(types)) {\n\t\t\tconst value = row[column];\n\t\t\tif (type === \"JSON\" && value !== null && value !== undefined && typeof value !== \"string\") {\n\t\t\t\trow[column] = JSON.stringify(value);\n\t\t\t}\n\t\t}\n\t}\n\treturn rows;\n}\n\nfunction createPublishedProjection(): PublishedProjection {\n\treturn {\n\t\tcontent: new Map(),\n\t\ttaxonomyGroups: new Set(),\n\t\tmediaIds: new Set(),\n\t\tmediaStorageKeys: new Set(),\n\t};\n}\n\nfunction readString(value: unknown): string | null {\n\treturn typeof value === \"string\" && value.length > 0 ? value : null;\n}\n\nfunction recordPublishedContent(\n\tprojection: PublishedProjection,\n\ttableName: string,\n\trows: Record<string, unknown>[],\n): void {\n\tconst references: PublishedContentReferences = {\n\t\tids: new Set(),\n\t\ttranslationGroups: new Set(),\n\t};\n\tfor (const row of rows) {\n\t\tconst id = readString(row.id);\n\t\tconst translationGroup = readString(row.translation_group);\n\t\tif (id) references.ids.add(id);\n\t\tif (translationGroup) references.translationGroups.add(translationGroup);\n\t}\n\tprojection.content.set(tableName.slice(\"ec_\".length), references);\n}\n\nfunction isPublishedContentReference(\n\tprojection: PublishedProjection,\n\tcollection: unknown,\n\treference: unknown,\n): boolean {\n\tconst collectionName = readString(collection);\n\tconst id = readString(reference);\n\tif (!collectionName || !id) return false;\n\tconst references = projection.content.get(collectionName);\n\treturn references?.ids.has(id) === true || references?.translationGroups.has(id) === true;\n}\n\nfunction collectMediaReferences(value: unknown, projection: PublishedProjection): void {\n\tif (typeof value === \"string\") {\n\t\tif (value.startsWith(MEDIA_FILE_PREFIX)) {\n\t\t\tconst storageKey = value.slice(MEDIA_FILE_PREFIX.length).split(MEDIA_FILE_SUFFIX, 1)[0];\n\t\t\tif (storageKey) projection.mediaStorageKeys.add(storageKey);\n\t\t\treturn;\n\t\t}\n\t\tconst trimmed = value.trimStart();\n\t\tif (trimmed.startsWith(\"{\") || trimmed.startsWith(\"[\")) {\n\t\t\ttry {\n\t\t\t\tcollectMediaReferences(JSON.parse(value), projection);\n\t\t\t} catch {\n\t\t\t\t// Not structured data.\n\t\t\t}\n\t\t}\n\t\treturn;\n\t}\n\tif (Array.isArray(value)) {\n\t\tfor (const item of value) collectMediaReferences(item, projection);\n\t\treturn;\n\t}\n\tif (!isRecord(value)) return;\n\n\tconst mediaId = readString(value.mediaId);\n\tif (mediaId) projection.mediaIds.add(mediaId);\n\n\tconst provider = readString(value.provider);\n\tconst meta = isRecord(value.meta) ? value.meta : null;\n\tconst localMediaId = readString(value.id);\n\tif ((provider === \"local\" || (!provider && meta)) && localMediaId) {\n\t\tprojection.mediaIds.add(localMediaId);\n\t}\n\tconst storageKey = readString(value.storageKey) ?? readString(meta?.storageKey);\n\tif (storageKey) projection.mediaStorageKeys.add(storageKey);\n\n\tconst asset = isRecord(value.asset) ? value.asset : null;\n\tconst assetRef = readString(asset?._ref);\n\tif (assetRef) {\n\t\tprojection.mediaIds.add(assetRef);\n\t\tprojection.mediaStorageKeys.add(assetRef);\n\t}\n\n\tfor (const child of Object.values(value)) collectMediaReferences(child, projection);\n}\n\nfunction projectTaxonomyRows(\n\trows: Record<string, unknown>[],\n\tprojection: PublishedProjection,\n): Record<string, unknown>[] {\n\tconst includedGroups = new Set(projection.taxonomyGroups);\n\tconst includedIds = new Set(projection.taxonomyGroups);\n\tlet changed = true;\n\twhile (changed) {\n\t\tchanged = false;\n\t\tfor (const row of rows) {\n\t\t\tconst id = readString(row.id);\n\t\t\tconst group = readString(row.translation_group);\n\t\t\tif (!id) continue;\n\t\t\tif (includedIds.has(id) || (group && includedGroups.has(group))) {\n\t\t\t\tif (!includedIds.has(id)) {\n\t\t\t\t\tincludedIds.add(id);\n\t\t\t\t\tchanged = true;\n\t\t\t\t}\n\t\t\t\tif (group && !includedGroups.has(group)) {\n\t\t\t\t\tincludedGroups.add(group);\n\t\t\t\t\tchanged = true;\n\t\t\t\t}\n\t\t\t\tconst parentId = readString(row.parent_id);\n\t\t\t\tif (parentId && !includedIds.has(parentId)) {\n\t\t\t\t\tincludedIds.add(parentId);\n\t\t\t\t\tchanged = true;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn rows.filter((row) => {\n\t\tconst id = readString(row.id);\n\t\tconst group = readString(row.translation_group);\n\t\treturn (id && includedIds.has(id)) || (group && includedGroups.has(group));\n\t});\n}\n\nfunction projectPublishedRows(\n\ttableName: SystemTable,\n\trows: Record<string, unknown>[],\n\tprojection: PublishedProjection,\n): Record<string, unknown>[] {\n\tswitch (tableName) {\n\t\tcase \"_emdash_seo\":\n\t\t\treturn rows.filter((row) => {\n\t\t\t\tconst published = isPublishedContentReference(projection, row.collection, row.content_id);\n\t\t\t\tif (!published) return false;\n\t\t\t\tconst image = readString(row.seo_image);\n\t\t\t\tif (image) {\n\t\t\t\t\tcollectMediaReferences(image, projection);\n\t\t\t\t\tif (!EXTERNAL_OR_ROOT_URL.test(image)) {\n\t\t\t\t\t\tprojection.mediaIds.add(image);\n\t\t\t\t\t\tprojection.mediaStorageKeys.add(image);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn true;\n\t\t\t});\n\t\tcase \"content_taxonomies\":\n\t\t\treturn rows.filter((row) => {\n\t\t\t\tconst published = isPublishedContentReference(projection, row.collection, row.entry_id);\n\t\t\t\tconst taxonomyGroup = readString(row.taxonomy_id);\n\t\t\t\tif (published && taxonomyGroup) projection.taxonomyGroups.add(taxonomyGroup);\n\t\t\t\treturn published;\n\t\t\t});\n\t\tcase \"taxonomies\":\n\t\t\treturn projectTaxonomyRows(rows, projection);\n\t\tcase \"_emdash_menu_items\":\n\t\t\treturn rows.filter((row) => {\n\t\t\t\tconst type = readString(row.type);\n\t\t\t\tconst referenceId = readString(row.reference_id);\n\t\t\t\tif (!referenceId || type === \"custom\") return true;\n\t\t\t\tif (type === \"taxonomy\") {\n\t\t\t\t\tprojection.taxonomyGroups.add(referenceId);\n\t\t\t\t\treturn true;\n\t\t\t\t}\n\t\t\t\tif (type === \"collection\" && !row.reference_id) return true;\n\t\t\t\tconst collection =\n\t\t\t\t\treadString(row.reference_collection) ??\n\t\t\t\t\t(type === \"post\" || type === \"page\" ? `${type}s` : null);\n\t\t\t\treturn isPublishedContentReference(projection, collection, referenceId);\n\t\t\t});\n\t\tcase \"media\":\n\t\t\treturn rows.filter((row) => {\n\t\t\t\tconst id = readString(row.id);\n\t\t\t\tconst storageKey = readString(row.storage_key);\n\t\t\t\treturn (\n\t\t\t\t\t(id !== null && projection.mediaIds.has(id)) ||\n\t\t\t\t\t(storageKey !== null && projection.mediaStorageKeys.has(storageKey))\n\t\t\t\t);\n\t\t\t});\n\t\tcase \"options\":\n\t\t\treturn rows;\n\t\tdefault:\n\t\t\treturn [];\n\t}\n}\n\nexport interface GenerateSnapshotOptions {\n\t/** Include draft and scheduled content (default: false) */\n\tincludeDrafts?: boolean;\n\t/** Include trashed content (deleted_at set). Used by backups (default: false) */\n\tincludeTrashed?: boolean;\n\t/** Origin URL for absolutizing local media URLs (e.g. \"https://mysite.com\") */\n\torigin?: string;\n\t/**\n\t * Allowlist of options-table key prefixes to include (default:\n\t * `SAFE_OPTIONS_PREFIXES`). Callers widening this must never include a\n\t * prefix that matches secrets (`emdash:preview_secret`, `plugin:`,\n\t * `emdash:passkey_pending:`) — the output may be user-downloadable.\n\t */\n\toptionPrefixes?: string[];\n\t/** Exact options-table keys to include in addition to `optionPrefixes`. */\n\toptionKeys?: string[];\n}\n\n/**\n * Generate a portable database snapshot.\n *\n * Discovers ec_* content tables dynamically, exports system tables\n * needed for rendering, and includes schema info for table recreation.\n */\nexport async function generateSnapshot(\n\tdb: Kysely<Database>,\n\toptions?: GenerateSnapshotOptions,\n): Promise<Snapshot> {\n\tconst includeDrafts = options?.includeDrafts ?? false;\n\tconst includeTrashed = options?.includeTrashed ?? false;\n\tconst optionPrefixes = options?.optionPrefixes ?? SAFE_OPTIONS_PREFIXES;\n\tconst optionKeys = new Set(options?.optionKeys);\n\tconst publishedOnly = !includeDrafts && !includeTrashed;\n\tconst publishedProjection = createPublishedProjection();\n\n\tconst contentTables = await listTablesLike(db, \"ec_%\");\n\n\t// Build list of all tables to export\n\tconst allTables = [...contentTables, ...SYSTEM_TABLES];\n\n\tconst tables: Record<string, Record<string, unknown>[]> = {};\n\tconst schema: Record<string, { columns: string[]; types?: Record<string, string> }> = {};\n\n\tfor (const tableName of allTables) {\n\t\tif (isExcluded(tableName)) continue;\n\n\t\t// Content table names come from the database catalog. Validate them\n\t\t// before passing them to sql.ref().\n\t\tif (!SAFE_TABLE_NAME.test(tableName)) continue;\n\n\t\tconst columnInfo = await listTableColumns(db, tableName);\n\t\tif (columnInfo.length === 0) continue;\n\n\t\tconst columns = columnInfo.map((column) => column.name);\n\t\tconst types: Record<string, SnapshotColumnType> = {};\n\t\tfor (const column of columnInfo) {\n\t\t\ttypes[column.name] = normalizeColumnType(column.type);\n\t\t}\n\n\t\tschema[tableName] = { columns, types };\n\n\t\tlet rows: Record<string, unknown>[];\n\n\t\tif (tableName.startsWith(\"ec_\")) {\n\t\t\tif (includeTrashed) {\n\t\t\t\trows = (\n\t\t\t\t\tawait sql<Record<string, unknown>>`\n\t\t\t\t\t\tSELECT * FROM ${sql.ref(tableName)}\n\t\t\t\t\t`.execute(db)\n\t\t\t\t).rows;\n\t\t\t} else if (includeDrafts) {\n\t\t\t\trows = (\n\t\t\t\t\tawait sql<Record<string, unknown>>`\n\t\t\t\t\t\tSELECT * FROM ${sql.ref(tableName)}\n\t\t\t\t\t\tWHERE deleted_at IS NULL\n\t\t\t\t\t`.execute(db)\n\t\t\t\t).rows;\n\t\t\t} else {\n\t\t\t\trows = (\n\t\t\t\t\tawait sql<Record<string, unknown>>`\n\t\t\t\t\t\tSELECT * FROM ${sql.ref(tableName)}\n\t\t\t\t\t\tWHERE deleted_at IS NULL\n\t\t\t\t\t\tAND status = 'published'\n\t\t\t\t\t`.execute(db)\n\t\t\t\t).rows;\n\t\t\t}\n\t\t} else if (\n\t\t\tpublishedOnly &&\n\t\t\tisSystemTable(tableName) &&\n\t\t\tPUBLISHED_TABLE_POLICIES[tableName] === \"omit\"\n\t\t) {\n\t\t\trows = [];\n\t\t} else if (tableName === \"options\") {\n\t\t\trows = (\n\t\t\t\tawait sql<Record<string, unknown>>`\n\t\t\t\t\tSELECT * FROM ${sql.ref(tableName)}\n\t\t\t\t`.execute(db)\n\t\t\t).rows.filter((row) => {\n\t\t\t\tconst name = typeof row.name === \"string\" ? row.name : \"\";\n\t\t\t\treturn optionKeys.has(name) || optionPrefixes.some((prefix) => name.startsWith(prefix));\n\t\t\t});\n\t\t} else {\n\t\t\trows = (\n\t\t\t\tawait sql<Record<string, unknown>>`\n\t\t\t\t\tSELECT * FROM ${sql.ref(tableName)}\n\t\t\t\t`.execute(db)\n\t\t\t).rows;\n\t\t}\n\n\t\tif (publishedOnly) {\n\t\t\tif (tableName.startsWith(\"ec_\")) {\n\t\t\t\trecordPublishedContent(publishedProjection, tableName, rows);\n\t\t\t} else if (\n\t\t\t\tisSystemTable(tableName) &&\n\t\t\t\tPUBLISHED_TABLE_POLICIES[tableName] === \"content-linked\"\n\t\t\t) {\n\t\t\t\trows = projectPublishedRows(tableName, rows, publishedProjection);\n\t\t\t}\n\t\t\tfor (const row of rows) collectMediaReferences(row, publishedProjection);\n\t\t}\n\n\t\tif (rows.length > 0) {\n\t\t\ttables[tableName] = normalizeRows(rows, types);\n\t\t}\n\t}\n\n\t// Absolutize local media URLs in content tables so snapshots are portable.\n\t// Local image fields are stored as JSON with provider:\"local\" and\n\t// meta.storageKey but no src — the URL is derived at render time.\n\t// For snapshots consumed by external preview services, inject src now.\n\tif (options?.origin) {\n\t\tconst origin = options.origin;\n\t\tfor (const [tableName, rows] of Object.entries(tables)) {\n\t\t\tif (!tableName.startsWith(\"ec_\")) continue;\n\t\t\tfor (const row of rows) {\n\t\t\t\tfor (const [col, value] of Object.entries(row)) {\n\t\t\t\t\tif (typeof value !== \"string\" || !value.startsWith(\"{\")) continue;\n\t\t\t\t\trow[col] = injectMediaSrc(value, origin);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\treturn {\n\t\ttables,\n\t\tschema,\n\t\tgeneratedAt: new Date().toISOString(),\n\t};\n}\n"],"mappings":";;;;;;;;AAuBA,eAAsB,uBACrB,QACA,KACA,KACA,QACmB;AACnB,KAAI,MAAM,KAAK,KAAK,GAAG,IAAM,QAAO;CAEpC,MAAM,UAAU,IAAI,aAAa;CACjC,MAAM,MAAM,MAAM,OAAO,OAAO,UAC/B,OACA,QAAQ,OAAO,OAAO,EACtB;EAAE,MAAM;EAAQ,MAAM;EAAW,EACjC,OACA,CAAC,SAAS,CACV;CAED,MAAM,WAAW,IAAI,WAAW,IAAI,SAAS,EAAE;AAC/C,MAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,EACpC,UAAS,IAAI,KAAK,SAAS,IAAI,UAAU,GAAG,IAAI,EAAE,EAAE,GAAG;AAGxD,QAAO,OAAO,OAAO,OAAO,QAAQ,KAAK,UAAU,QAAQ,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;;;;;;;;;;;;AAavF,SAAgB,4BACf,QACsD;CACtD,MAAM,YAAY,OAAO,YAAY,IAAI;AACzC,KAAI,aAAa,EAAG,QAAO;CAE3B,MAAM,MAAM,OAAO,UAAU,YAAY,EAAE;AAC3C,KAAI,IAAI,WAAW,GAAI,QAAO;CAE9B,MAAM,OAAO,OAAO,UAAU,GAAG,UAAU;CAC3C,MAAM,kBAAkB,KAAK,YAAY,IAAI;AAC7C,KAAI,mBAAmB,EAAG,QAAO;CAEjC,MAAM,SAAS,KAAK,UAAU,GAAG,gBAAgB;CACjD,MAAM,MAAM,SAAS,KAAK,UAAU,kBAAkB,EAAE,EAAE,GAAG;AAE7D,KAAI,MAAM,IAAI,IAAI,OAAO,WAAW,EAAG,QAAO;AAE9C,QAAO;EAAE;EAAQ;EAAK;EAAK;;AAK5B,MAAM,oBAAoB;AAC1B,MAAM,oBAAoB;AAC1B,MAAM,uBAAuB;;;;;AAM7B,SAAS,eAAe,SAAiB,QAAwB;AAChE,KAAI;EACH,MAAM,MAAM,KAAK,MAAM,QAAQ;AAC/B,MAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,MAAM,QAAQ,IAAI,CAAE,QAAO;AAC1E,MAAI,mBAAmB,KAAK,OAAO,CAClC,QAAO,KAAK,UAAU,IAAI;AAE3B,SAAO;SACA;AACP,SAAO;;;AAIT,SAAS,SAAS,OAAkD;AACnE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;;;;;AAO5E,SAAS,mBAAmB,KAA8B,QAAyB;CAClF,IAAI,WAAW;AAGf,MAAK,IAAI,aAAa,WAAY,CAAC,IAAI,YAAY,IAAI,MAAM,IAAI,SAAU,CAAC,IAAI,KAAK;EAEpF,MAAM,cADO,SAAS,IAAI,KAAK,GAAG,IAAI,OAAO,SACpB,cAAc,IAAI;AAC3C,MAAI,OAAO,eAAe,YAAY,YAAY;AACjD,OAAI,MAAM,GAAG,SAAS,oBAAoB;AAC1C,cAAW;;;AAKb,MAAK,MAAM,SAAS,OAAO,OAAO,IAAI,CACrC,KAAI,MAAM,QAAQ,MAAM,EACvB;OAAK,MAAM,QAAQ,MAClB,KAAI,SAAS,KAAK,EACjB;OAAI,mBAAmB,MAAM,OAAO,CACnC,YAAW;;YAIJ,SAAS,MAAM,EACzB;MAAI,mBAAmB,OAAO,OAAO,CACpC,YAAW;;AAKd,QAAO;;;;;;;AAUR,MAAM,kBAAkB;;;;;AAmBxB,MAAM,gBAAgB;CACrB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;;AAUD,MAAM,2BAAsE;CAC3E,qBAAqB;CACrB,6BAA6B;CAC7B,qBAAqB;CACrB,gBAAgB;CAChB,uBAAuB;CACvB,6BAA6B;CAC7B,eAAe;CACf,oBAAoB;CACpB,kBAAkB;CAClB,sBAAsB;CACtB,iBAAiB;CACjB,aAAa;CACb,oBAAoB;CACpB,oBAAoB;CACpB,YAAY;CACZ,SAAS;CACT,OAAO;CACP,WAAW;CACX;AAED,MAAM,mBAAwC,IAAI,IAAI,cAAc;AAEpE,SAAS,cAAc,WAA6C;AACnE,QAAO,iBAAiB,IAAI,UAAU;;;;;AAkBvC,MAAM,oBAAoB;CACzB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;;;;AASD,MAAM,wBAAwB,CAAC,QAAQ;AAEvC,SAAS,WAAW,WAA4B;AAC/C,QAAO,kBAAkB,MAAM,WAAW,UAAU,WAAW,OAAO,CAAC;;AAKxE,SAAS,oBAAoB,MAAkC;AAC9D,SAAQ,KAAK,aAAa,EAA1B;EACC,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,UACJ,QAAO;EACR,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,UACJ,QAAO;EACR,KAAK;EACL,KAAK,QACJ,QAAO;EACR,KAAK;EACL,KAAK,QACJ,QAAO;EACR,QACC,QAAO;;;AAIV,SAAS,cACR,MACA,OAC4B;AAC5B,MAAK,MAAM,OAAO,KACjB,MAAK,MAAM,CAAC,QAAQ,SAAS,OAAO,QAAQ,MAAM,EAAE;EACnD,MAAM,QAAQ,IAAI;AAClB,MAAI,SAAS,UAAU,UAAU,QAAQ,UAAU,UAAa,OAAO,UAAU,SAChF,KAAI,UAAU,KAAK,UAAU,MAAM;;AAItC,QAAO;;AAGR,SAAS,4BAAiD;AACzD,QAAO;EACN,yBAAS,IAAI,KAAK;EAClB,gCAAgB,IAAI,KAAK;EACzB,0BAAU,IAAI,KAAK;EACnB,kCAAkB,IAAI,KAAK;EAC3B;;AAGF,SAAS,WAAW,OAA+B;AAClD,QAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;;AAGhE,SAAS,uBACR,YACA,WACA,MACO;CACP,MAAM,aAAyC;EAC9C,qBAAK,IAAI,KAAK;EACd,mCAAmB,IAAI,KAAK;EAC5B;AACD,MAAK,MAAM,OAAO,MAAM;EACvB,MAAM,KAAK,WAAW,IAAI,GAAG;EAC7B,MAAM,mBAAmB,WAAW,IAAI,kBAAkB;AAC1D,MAAI,GAAI,YAAW,IAAI,IAAI,GAAG;AAC9B,MAAI,iBAAkB,YAAW,kBAAkB,IAAI,iBAAiB;;AAEzE,YAAW,QAAQ,IAAI,UAAU,MAAM,EAAa,EAAE,WAAW;;AAGlE,SAAS,4BACR,YACA,YACA,WACU;CACV,MAAM,iBAAiB,WAAW,WAAW;CAC7C,MAAM,KAAK,WAAW,UAAU;AAChC,KAAI,CAAC,kBAAkB,CAAC,GAAI,QAAO;CACnC,MAAM,aAAa,WAAW,QAAQ,IAAI,eAAe;AACzD,QAAO,YAAY,IAAI,IAAI,GAAG,KAAK,QAAQ,YAAY,kBAAkB,IAAI,GAAG,KAAK;;AAGtF,SAAS,uBAAuB,OAAgB,YAAuC;AACtF,KAAI,OAAO,UAAU,UAAU;AAC9B,MAAI,MAAM,WAAW,kBAAkB,EAAE;GACxC,MAAM,aAAa,MAAM,MAAM,GAAyB,CAAC,MAAM,mBAAmB,EAAE,CAAC;AACrF,OAAI,WAAY,YAAW,iBAAiB,IAAI,WAAW;AAC3D;;EAED,MAAM,UAAU,MAAM,WAAW;AACjC,MAAI,QAAQ,WAAW,IAAI,IAAI,QAAQ,WAAW,IAAI,CACrD,KAAI;AACH,0BAAuB,KAAK,MAAM,MAAM,EAAE,WAAW;UAC9C;AAIT;;AAED,KAAI,MAAM,QAAQ,MAAM,EAAE;AACzB,OAAK,MAAM,QAAQ,MAAO,wBAAuB,MAAM,WAAW;AAClE;;AAED,KAAI,CAAC,SAAS,MAAM,CAAE;CAEtB,MAAM,UAAU,WAAW,MAAM,QAAQ;AACzC,KAAI,QAAS,YAAW,SAAS,IAAI,QAAQ;CAE7C,MAAM,WAAW,WAAW,MAAM,SAAS;CAC3C,MAAM,OAAO,SAAS,MAAM,KAAK,GAAG,MAAM,OAAO;CACjD,MAAM,eAAe,WAAW,MAAM,GAAG;AACzC,MAAK,aAAa,WAAY,CAAC,YAAY,SAAU,aACpD,YAAW,SAAS,IAAI,aAAa;CAEtC,MAAM,aAAa,WAAW,MAAM,WAAW,IAAI,WAAW,MAAM,WAAW;AAC/E,KAAI,WAAY,YAAW,iBAAiB,IAAI,WAAW;CAG3D,MAAM,WAAW,YADH,SAAS,MAAM,MAAM,GAAG,MAAM,QAAQ,OACjB,KAAK;AACxC,KAAI,UAAU;AACb,aAAW,SAAS,IAAI,SAAS;AACjC,aAAW,iBAAiB,IAAI,SAAS;;AAG1C,MAAK,MAAM,SAAS,OAAO,OAAO,MAAM,CAAE,wBAAuB,OAAO,WAAW;;AAGpF,SAAS,oBACR,MACA,YAC4B;CAC5B,MAAM,iBAAiB,IAAI,IAAI,WAAW,eAAe;CACzD,MAAM,cAAc,IAAI,IAAI,WAAW,eAAe;CACtD,IAAI,UAAU;AACd,QAAO,SAAS;AACf,YAAU;AACV,OAAK,MAAM,OAAO,MAAM;GACvB,MAAM,KAAK,WAAW,IAAI,GAAG;GAC7B,MAAM,QAAQ,WAAW,IAAI,kBAAkB;AAC/C,OAAI,CAAC,GAAI;AACT,OAAI,YAAY,IAAI,GAAG,IAAK,SAAS,eAAe,IAAI,MAAM,EAAG;AAChE,QAAI,CAAC,YAAY,IAAI,GAAG,EAAE;AACzB,iBAAY,IAAI,GAAG;AACnB,eAAU;;AAEX,QAAI,SAAS,CAAC,eAAe,IAAI,MAAM,EAAE;AACxC,oBAAe,IAAI,MAAM;AACzB,eAAU;;IAEX,MAAM,WAAW,WAAW,IAAI,UAAU;AAC1C,QAAI,YAAY,CAAC,YAAY,IAAI,SAAS,EAAE;AAC3C,iBAAY,IAAI,SAAS;AACzB,eAAU;;;;;AAKd,QAAO,KAAK,QAAQ,QAAQ;EAC3B,MAAM,KAAK,WAAW,IAAI,GAAG;EAC7B,MAAM,QAAQ,WAAW,IAAI,kBAAkB;AAC/C,SAAQ,MAAM,YAAY,IAAI,GAAG,IAAM,SAAS,eAAe,IAAI,MAAM;GACxE;;AAGH,SAAS,qBACR,WACA,MACA,YAC4B;AAC5B,SAAQ,WAAR;EACC,KAAK,cACJ,QAAO,KAAK,QAAQ,QAAQ;AAE3B,OAAI,CADc,4BAA4B,YAAY,IAAI,YAAY,IAAI,WAAW,CACzE,QAAO;GACvB,MAAM,QAAQ,WAAW,IAAI,UAAU;AACvC,OAAI,OAAO;AACV,2BAAuB,OAAO,WAAW;AACzC,QAAI,CAAC,qBAAqB,KAAK,MAAM,EAAE;AACtC,gBAAW,SAAS,IAAI,MAAM;AAC9B,gBAAW,iBAAiB,IAAI,MAAM;;;AAGxC,UAAO;IACN;EACH,KAAK,qBACJ,QAAO,KAAK,QAAQ,QAAQ;GAC3B,MAAM,YAAY,4BAA4B,YAAY,IAAI,YAAY,IAAI,SAAS;GACvF,MAAM,gBAAgB,WAAW,IAAI,YAAY;AACjD,OAAI,aAAa,cAAe,YAAW,eAAe,IAAI,cAAc;AAC5E,UAAO;IACN;EACH,KAAK,aACJ,QAAO,oBAAoB,MAAM,WAAW;EAC7C,KAAK,qBACJ,QAAO,KAAK,QAAQ,QAAQ;GAC3B,MAAM,OAAO,WAAW,IAAI,KAAK;GACjC,MAAM,cAAc,WAAW,IAAI,aAAa;AAChD,OAAI,CAAC,eAAe,SAAS,SAAU,QAAO;AAC9C,OAAI,SAAS,YAAY;AACxB,eAAW,eAAe,IAAI,YAAY;AAC1C,WAAO;;AAER,OAAI,SAAS,gBAAgB,CAAC,IAAI,aAAc,QAAO;AAIvD,UAAO,4BAA4B,YAFlC,WAAW,IAAI,qBAAqB,KACnC,SAAS,UAAU,SAAS,SAAS,GAAG,KAAK,KAAK,OACO,YAAY;IACtE;EACH,KAAK,QACJ,QAAO,KAAK,QAAQ,QAAQ;GAC3B,MAAM,KAAK,WAAW,IAAI,GAAG;GAC7B,MAAM,aAAa,WAAW,IAAI,YAAY;AAC9C,UACE,OAAO,QAAQ,WAAW,SAAS,IAAI,GAAG,IAC1C,eAAe,QAAQ,WAAW,iBAAiB,IAAI,WAAW;IAEnE;EACH,KAAK,UACJ,QAAO;EACR,QACC,QAAO,EAAE;;;;;;;;;AA4BZ,eAAsB,iBACrB,IACA,SACoB;CACpB,MAAM,gBAAgB,SAAS,iBAAiB;CAChD,MAAM,iBAAiB,SAAS,kBAAkB;CAClD,MAAM,iBAAiB,SAAS,kBAAkB;CAClD,MAAM,aAAa,IAAI,IAAI,SAAS,WAAW;CAC/C,MAAM,gBAAgB,CAAC,iBAAiB,CAAC;CACzC,MAAM,sBAAsB,2BAA2B;CAKvD,MAAM,YAAY,CAAC,GAHG,MAAM,eAAe,IAAI,OAAO,EAGjB,GAAG,cAAc;CAEtD,MAAM,SAAoD,EAAE;CAC5D,MAAM,SAAgF,EAAE;AAExF,MAAK,MAAM,aAAa,WAAW;AAClC,MAAI,WAAW,UAAU,CAAE;AAI3B,MAAI,CAAC,gBAAgB,KAAK,UAAU,CAAE;EAEtC,MAAM,aAAa,MAAM,iBAAiB,IAAI,UAAU;AACxD,MAAI,WAAW,WAAW,EAAG;EAE7B,MAAM,UAAU,WAAW,KAAK,WAAW,OAAO,KAAK;EACvD,MAAM,QAA4C,EAAE;AACpD,OAAK,MAAM,UAAU,WACpB,OAAM,OAAO,QAAQ,oBAAoB,OAAO,KAAK;AAGtD,SAAO,aAAa;GAAE;GAAS;GAAO;EAEtC,IAAI;AAEJ,MAAI,UAAU,WAAW,MAAM,CAC9B,KAAI,eACH,SACC,MAAM,GAA4B;sBACjB,IAAI,IAAI,UAAU,CAAC;OAClC,QAAQ,GAAG,EACZ;WACQ,cACV,SACC,MAAM,GAA4B;sBACjB,IAAI,IAAI,UAAU,CAAC;;OAElC,QAAQ,GAAG,EACZ;MAEF,SACC,MAAM,GAA4B;sBACjB,IAAI,IAAI,UAAU,CAAC;;;OAGlC,QAAQ,GAAG,EACZ;WAGH,iBACA,cAAc,UAAU,IACxB,yBAAyB,eAAe,OAExC,QAAO,EAAE;WACC,cAAc,UACxB,SACC,MAAM,GAA4B;qBACjB,IAAI,IAAI,UAAU,CAAC;MAClC,QAAQ,GAAG,EACZ,KAAK,QAAQ,QAAQ;GACtB,MAAM,OAAO,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO;AACvD,UAAO,WAAW,IAAI,KAAK,IAAI,eAAe,MAAM,WAAW,KAAK,WAAW,OAAO,CAAC;IACtF;MAEF,SACC,MAAM,GAA4B;qBACjB,IAAI,IAAI,UAAU,CAAC;MAClC,QAAQ,GAAG,EACZ;AAGH,MAAI,eAAe;AAClB,OAAI,UAAU,WAAW,MAAM,CAC9B,wBAAuB,qBAAqB,WAAW,KAAK;YAE5D,cAAc,UAAU,IACxB,yBAAyB,eAAe,iBAExC,QAAO,qBAAqB,WAAW,MAAM,oBAAoB;AAElE,QAAK,MAAM,OAAO,KAAM,wBAAuB,KAAK,oBAAoB;;AAGzE,MAAI,KAAK,SAAS,EACjB,QAAO,aAAa,cAAc,MAAM,MAAM;;AAQhD,KAAI,SAAS,QAAQ;EACpB,MAAM,SAAS,QAAQ;AACvB,OAAK,MAAM,CAAC,WAAW,SAAS,OAAO,QAAQ,OAAO,EAAE;AACvD,OAAI,CAAC,UAAU,WAAW,MAAM,CAAE;AAClC,QAAK,MAAM,OAAO,KACjB,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,EAAE;AAC/C,QAAI,OAAO,UAAU,YAAY,CAAC,MAAM,WAAW,IAAI,CAAE;AACzD,QAAI,OAAO,eAAe,OAAO,OAAO;;;;AAM5C,QAAO;EACN;EACA;EACA,8BAAa,IAAI,MAAM,EAAC,aAAa;EACrC"}

package/dist/ssrf-CRJ-xom5.mjs

@@ -1,406 +0,0 @@
-//#region src/security/ssrf.ts
-/**
-* SSRF protection for outbound HTTP requests.
-*
-* Validates that URLs do not target non-public network addresses.
-*/
-const IPV6_BRACKET_PATTERN = /^\[|\]$/g;
-const IPV4_PART_PATTERN = /^(?:0|[1-9]\d{0,2})$/;
-const IPV6_PART_PATTERN = /^[0-9a-f]{1,4}$/i;
-/** Strip trailing dots from an FQDN-form hostname ("localhost." -> "localhost"). */
-const TRAILING_DOT_PATTERN = /\.+$/;
-/**
-* IPv4 ranges that are not globally reachable unicast destinations.
-*/
-const BLOCKED_PATTERNS = [
-	{
-		start: ip4ToNum(0, 0, 0, 0),
-		end: ip4ToNum(0, 255, 255, 255)
-	},
-	{
-		start: ip4ToNum(10, 0, 0, 0),
-		end: ip4ToNum(10, 255, 255, 255)
-	},
-	{
-		start: ip4ToNum(100, 64, 0, 0),
-		end: ip4ToNum(100, 127, 255, 255)
-	},
-	{
-		start: ip4ToNum(127, 0, 0, 0),
-		end: ip4ToNum(127, 255, 255, 255)
-	},
-	{
-		start: ip4ToNum(169, 254, 0, 0),
-		end: ip4ToNum(169, 254, 255, 255)
-	},
-	{
-		start: ip4ToNum(172, 16, 0, 0),
-		end: ip4ToNum(172, 31, 255, 255)
-	},
-	{
-		start: ip4ToNum(192, 0, 0, 0),
-		end: ip4ToNum(192, 0, 0, 255)
-	},
-	{
-		start: ip4ToNum(192, 0, 2, 0),
-		end: ip4ToNum(192, 0, 2, 255)
-	},
-	{
-		start: ip4ToNum(192, 88, 99, 0),
-		end: ip4ToNum(192, 88, 99, 255)
-	},
-	{
-		start: ip4ToNum(192, 168, 0, 0),
-		end: ip4ToNum(192, 168, 255, 255)
-	},
-	{
-		start: ip4ToNum(198, 18, 0, 0),
-		end: ip4ToNum(198, 19, 255, 255)
-	},
-	{
-		start: ip4ToNum(198, 51, 100, 0),
-		end: ip4ToNum(198, 51, 100, 255)
-	},
-	{
-		start: ip4ToNum(203, 0, 113, 0),
-		end: ip4ToNum(203, 0, 113, 255)
-	},
-	{
-		start: ip4ToNum(224, 0, 0, 0),
-		end: ip4ToNum(255, 255, 255, 255)
-	}
-];
-const ALLOWED_IPV4_EXCEPTIONS = new Set([ip4ToNum(192, 0, 0, 9), ip4ToNum(192, 0, 0, 10)]);
-function ipv6Range(address, prefixLength) {
-	const parsed = parseIpv6(address);
-	if (parsed === null) throw new Error(`Invalid IPv6 range: ${address}/${prefixLength}`);
-	return {
-		address: parsed,
-		prefixLength
-	};
-}
-const IPV6_GLOBAL_UNICAST_RANGE = ipv6Range("2000::", 3);
-const IPV4_COMPATIBLE_IPV6_RANGE = ipv6Range("::", 96);
-const IPV4_EMBEDDED_IPV6_RANGES = [
-	IPV4_COMPATIBLE_IPV6_RANGE,
-	ipv6Range("::ffff:0:0", 96),
-	ipv6Range("::ffff:0:0:0", 96),
-	ipv6Range("64:ff9b::", 96)
-];
-/** Globally reachable allocations inside the otherwise reserved 2001::/23 block. */
-const ALLOWED_IPV6_SPECIAL_RANGES = [
-	ipv6Range("2001:1::1", 128),
-	ipv6Range("2001:1::2", 128),
-	ipv6Range("2001:1::3", 128),
-	ipv6Range("2001:3::", 32),
-	ipv6Range("2001:4:112::", 48),
-	ipv6Range("2001:20::", 28),
-	ipv6Range("2001:30::", 28)
-];
-/** Non-global allocations inside the ordinary IPv6 global-unicast range. */
-const BLOCKED_IPV6_GLOBAL_UNICAST_RANGES = [
-	ipv6Range("2001::", 23),
-	ipv6Range("2001:db8::", 32),
-	ipv6Range("2002::", 16),
-	ipv6Range("3ffe::", 16),
-	ipv6Range("3fff::", 20)
-];
-const BLOCKED_HOSTNAMES = new Set([
-	"localhost",
-	"metadata.google.internal",
-	"metadata.google",
-	"::1"
-]);
-/**
-* Wildcard DNS services that publicly resolve arbitrary IPs embedded in the
-* hostname. Commonly used in local dev and by SSRF exploit tooling to bypass
-* hostname-only blocklists (e.g. 127.0.0.1.nip.io -> 127.0.0.1).
-*
-* Matched case-insensitively as a suffix, so both the apex and any subdomain
-* are blocked.
-*/
-const BLOCKED_HOSTNAME_SUFFIXES = [
-	"nip.io",
-	"sslip.io",
-	"xip.io",
-	"traefik.me",
-	"lvh.me",
-	"localtest.me"
-];
-/** Blocked URL schemes */
-const ALLOWED_SCHEMES = new Set(["http:", "https:"]);
-function ip4ToNum(a, b, c, d) {
-	return (a << 24 | b << 16 | c << 8 | d) >>> 0;
-}
-function parseIpv4(ip) {
-	const parts = ip.split(".");
-	if (parts.length !== 4) return null;
-	const nums = parts.map((part) => IPV4_PART_PATTERN.test(part) ? Number(part) : NaN);
-	if (nums.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return null;
-	return ip4ToNum(nums[0], nums[1], nums[2], nums[3]);
-}
-function parseIpv6(ip) {
-	let address = ip;
-	if (address.includes(".")) {
-		const separator = address.lastIndexOf(":");
-		if (separator === -1) return null;
-		const ipv4 = parseIpv4(address.slice(separator + 1));
-		if (ipv4 === null) return null;
-		address = `${address.slice(0, separator + 1)}${(ipv4 >>> 16).toString(16)}:${(ipv4 & 65535).toString(16)}`;
-	}
-	if (address.includes(":::") || address.split("::").length > 2) return null;
-	const [before = "", after = ""] = address.split("::");
-	const head = before === "" ? [] : before.split(":");
-	const tail = after === "" ? [] : after.split(":");
-	const parts = [...head, ...tail];
-	if (parts.some((part) => !IPV6_PART_PATTERN.test(part)) || parts.length > 8) return null;
-	if (address.includes("::") ? parts.length >= 8 : parts.length !== 8) return null;
-	const zeroCount = address.includes("::") ? 8 - parts.length : 0;
-	return [
-		...head,
-		...Array.from({ length: zeroCount }).fill("0"),
-		...tail
-	].map((part) => Number.parseInt(part, 16));
-}
-function isIpv6InRange(address, range) {
-	const completeParts = Math.floor(range.prefixLength / 16);
-	for (let i = 0; i < completeParts; i++) if (address[i] !== range.address[i]) return false;
-	const remainingBits = range.prefixLength % 16;
-	if (remainingBits === 0) return true;
-	const mask = 65535 << 16 - remainingBits & 65535;
-	return (address[completeParts] & mask) === (range.address[completeParts] & mask);
-}
-function extractEmbeddedIpv4(address) {
-	if (!IPV4_EMBEDDED_IPV6_RANGES.some((range) => isIpv6InRange(address, range))) return null;
-	const ipv4 = (address[6] << 16 | address[7]) >>> 0;
-	if (ipv4 <= 1 && isIpv6InRange(address, IPV4_COMPATIBLE_IPV6_RANGE)) return null;
-	return ipv4;
-}
-function isNonPublicIp(ip) {
-	const parsedIpv4 = parseIpv4(ip);
-	const ipv6 = parsedIpv4 === null ? parseIpv6(ip) : null;
-	const ipv4 = ipv6 === null ? parsedIpv4 : extractEmbeddedIpv4(ipv6);
-	if (ipv4 !== null) {
-		if (ALLOWED_IPV4_EXCEPTIONS.has(ipv4)) return false;
-		return BLOCKED_PATTERNS.some((range) => ipv4 >= range.start && ipv4 <= range.end);
-	}
-	if (ipv6 === null) return true;
-	if (ALLOWED_IPV6_SPECIAL_RANGES.some((range) => isIpv6InRange(ipv6, range))) return false;
-	if (!isIpv6InRange(ipv6, IPV6_GLOBAL_UNICAST_RANGE)) return true;
-	return BLOCKED_IPV6_GLOBAL_UNICAST_RANGES.some((range) => isIpv6InRange(ipv6, range));
-}
-/**
-* Error thrown when SSRF protection blocks a URL.
-*/
-var SsrfError = class extends Error {
-	code = "SSRF_BLOCKED";
-	constructor(message) {
-		super(message);
-		this.name = "SsrfError";
-	}
-};
-/**
-* Validate a URL's scheme, hostname, and literal address.
-*
-* Checks:
-* 1. URL is well-formed with http/https scheme
-* 2. Hostname is not a known internal name (localhost, metadata endpoints)
-* 3. If hostname is an IP literal, it is a public address
-*
-* Hostnames also need DNS validation before dispatch. Resolving and checking
-* addresses does not bind an ordinary fetch() connection to those addresses.
-*
-* @throws SsrfError if the URL targets an internal address
-*/
-/** Maximum number of redirects to follow in ssrfSafeFetch */
-const MAX_REDIRECTS = 5;
-function validateExternalUrl(url) {
-	let parsed;
-	try {
-		parsed = new URL(url);
-	} catch {
-		throw new SsrfError("Invalid URL");
-	}
-	if (!ALLOWED_SCHEMES.has(parsed.protocol)) throw new SsrfError(`Scheme '${parsed.protocol}' is not allowed`);
-	const normalizedHost = parsed.hostname.replace(IPV6_BRACKET_PATTERN, "").toLowerCase().replace(TRAILING_DOT_PATTERN, "");
-	if (BLOCKED_HOSTNAMES.has(normalizedHost)) throw new SsrfError("URLs targeting internal hosts are not allowed");
-	for (const suffix of BLOCKED_HOSTNAME_SUFFIXES) if (normalizedHost === suffix || normalizedHost.endsWith(`.${suffix}`)) throw new SsrfError("URLs targeting wildcard DNS services are not allowed");
-	if (isIpLiteral(normalizedHost) && isNonPublicIp(normalizedHost)) throw new SsrfError("URLs targeting non-public IP addresses are not allowed");
-	return parsed;
-}
-/**
-* Module-level default resolver. Tests can swap this with a stub so fetch
-* mocks don't see unexpected DoH round-trips. Production code should leave
-* it alone.
-*/
-let defaultResolver = null;
-/** Timeout for a single DoH request, in milliseconds. */
-const DOH_TIMEOUT_MS = 3e3;
-/** Default DoH endpoint — Cloudflare's public resolver. */
-const DEFAULT_DOH_URL = "https://cloudflare-dns.com/dns-query";
-function hasProperty(obj, key) {
-	return typeof obj === "object" && obj !== null && key in obj;
-}
-/**
-* Narrow an unknown JSON body to a DohResponse shape we can read safely.
-* Throws if the body doesn't look like a DoH response — a malformed body is
-* indistinguishable from a failure and must not be silently treated as empty.
-*/
-function parseDohResponse(raw) {
-	if (!hasProperty(raw, "Status") || typeof raw.Status !== "number") throw new Error("DoH response missing Status field");
-	const answers = [];
-	if (hasProperty(raw, "Answer") && Array.isArray(raw.Answer)) {
-		for (const entry of raw.Answer) if (hasProperty(entry, "type") && typeof entry.type === "number" && Number.isInteger(entry.type) && hasProperty(entry, "data") && typeof entry.data === "string") answers.push({
-			type: entry.type,
-			data: entry.data
-		});
-	}
-	return {
-		Status: raw.Status,
-		Answer: answers
-	};
-}
-/**
-* Resolve a hostname via DNS over HTTPS (Cloudflare). Returns all A and AAAA
-* records. Works in both Workers and Node without requiring node:dns.
-*
-* Fails closed: any network error, non-2xx response, or DNS rcode != 0
-* causes a rejected promise so the calling validator treats it as a block.
-*/
-const cloudflareDohResolver = async (hostname) => {
-	async function query(type) {
-		const expectedAnswerType = type === "A" ? 1 : 28;
-		const params = new URLSearchParams({
-			name: hostname,
-			type
-		});
-		const controller = new AbortController();
-		const timeout = setTimeout(() => controller.abort(), DOH_TIMEOUT_MS);
-		try {
-			const response = await globalThis.fetch(`${DEFAULT_DOH_URL}?${params.toString()}`, {
-				headers: { Accept: "application/dns-json" },
-				signal: controller.signal
-			});
-			if (!response.ok) throw new Error(`DoH lookup failed: ${response.status}`);
-			const body = parseDohResponse(await response.json());
-			if (body.Status === 3) return [];
-			if (body.Status !== 0) throw new Error(`DoH ${type} lookup failed: rcode=${body.Status}`);
-			return body.Answer.filter((answer) => answer.type === expectedAnswerType).map((answer) => answer.data).filter(isIpLiteral);
-		} finally {
-			clearTimeout(timeout);
-		}
-	}
-	const [a, aaaa] = await Promise.all([query("A"), query("AAAA")]);
-	return [...a, ...aaaa];
-};
-/**
-* Validate a URL and reject hostnames that resolve to non-public addresses,
-* including wildcard DNS services like nip.io used by exploit tooling.
-*
-* Runs `validateExternalUrl` first for cheap pre-flight checks (scheme,
-* literal IP, known-bad hostnames). Then resolves the hostname and rejects
-* if ANY returned address is non-public.
-*
-* Fails closed: if resolution fails or returns no records, throws SsrfError.
-*
-* **Caveats.** This does NOT fully close the TOCTOU between check and
-* connect. Attacks that still work against this layer include:
-*
-* - TTL=0 rebind: authoritative server returns public IP to the check, then
-*   private IP to the subsequent fetch() a few milliseconds later.
-* - Split-view via EDNS Client Subnet or source-IP inspection: the
-*   authoritative server returns public IP to Cloudflare's DoH resolver and
-*   private IP to the victim's own resolver (used by fetch()).
-* - Host-file overrides or split-horizon corporate DNS on self-hosted Node.
-* - Attacker-controlled rebinding services the caller has allowlisted.
-*
-* Connections must use the addresses from resolveAndValidateExternalUrlTarget
-* to avoid a second lookup. Callers using ordinary fetch() need network-level
-* egress controls to prevent these attacks.
-*/
-async function resolveAndValidateExternalUrl(url, options) {
-	return (await resolveAndValidateExternalUrlTarget(url, options)).url;
-}
-/**
-* Validate a URL and return the exact public addresses approved for the
-* subsequent connection.
-*/
-async function resolveAndValidateExternalUrlTarget(url, options) {
-	const parsed = validateExternalUrl(url);
-	const hostname = parsed.hostname.replace(IPV6_BRACKET_PATTERN, "");
-	if (isIpLiteral(hostname)) return {
-		url: parsed,
-		addresses: [hostname]
-	};
-	const resolver = options?.resolver ?? defaultResolver ?? cloudflareDohResolver;
-	let addresses;
-	try {
-		addresses = await resolver(hostname);
-	} catch (error) {
-		throw new SsrfError(`Could not resolve hostname: ${error instanceof Error ? error.message : String(error)}`);
-	}
-	if (addresses.length === 0) throw new SsrfError("Hostname resolved to no addresses");
-	for (const ip of addresses) {
-		if (!isIpLiteral(ip)) throw new SsrfError("Hostname resolver returned a non-IP address");
-		if (isNonPublicIp(ip)) throw new SsrfError("Hostname resolves to a non-public IP address");
-	}
-	return {
-		url: parsed,
-		addresses
-	};
-}
-/** True when a string is a valid IPv4 or IPv6 literal. */
-function isIpLiteral(host) {
-	return parseIpv4(host) !== null || parseIpv6(host) !== null;
-}
-/**
-* Fetch a URL with SSRF protection on redirects.
-*
-* Uses `redirect: "manual"` to intercept redirects and re-validate each
-* redirect target against SSRF rules before following it. This prevents
-* an attacker from setting up an allowed external URL that redirects to
-* an internal IP (e.g. 169.254.169.254 for cloud metadata).
-*
-* @throws SsrfError if the initial URL or any redirect target is internal
-*/
-/** Headers that must be stripped when a redirect crosses origins */
-const CREDENTIAL_HEADERS = [
-	"authorization",
-	"cookie",
-	"proxy-authorization"
-];
-async function ssrfSafeFetch(url, init, options) {
-	let currentUrl = url;
-	let currentInit = init;
-	for (let i = 0; i <= MAX_REDIRECTS; i++) {
-		const validated = await resolveAndValidateExternalUrl(currentUrl, options);
-		if (options?.httpsOnly === true && validated.protocol !== "https:") throw new SsrfError("Only HTTPS URLs are allowed");
-		const response = await globalThis.fetch(currentUrl, {
-			...currentInit,
-			redirect: "manual"
-		});
-		if (response.status < 300 || response.status >= 400) return response;
-		const location = response.headers.get("Location");
-		if (!location) return response;
-		const previousOrigin = new URL(currentUrl).origin;
-		currentUrl = new URL(location, currentUrl).href;
-		if (previousOrigin !== new URL(currentUrl).origin && currentInit) currentInit = stripCredentialHeaders(currentInit);
-	}
-	throw new SsrfError(`Too many redirects (max ${MAX_REDIRECTS})`);
-}
-/**
-* Return a copy of init with credential headers removed.
-*/
-function stripCredentialHeaders(init) {
-	if (!init.headers) return init;
-	const headers = new Headers(init.headers);
-	for (const name of CREDENTIAL_HEADERS) headers.delete(name);
-	return {
-		...init,
-		headers
-	};
-}
-
-//#endregion
-export { ssrfSafeFetch as a, resolveAndValidateExternalUrlTarget as i, cloudflareDohResolver as n, stripCredentialHeaders as o, resolveAndValidateExternalUrl as r, validateExternalUrl as s, SsrfError as t };
-//# sourceMappingURL=ssrf-CRJ-xom5.mjs.map

package/dist/ssrf-CRJ-xom5.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"ssrf-CRJ-xom5.mjs","names":[],"sources":["../src/security/ssrf.ts"],"sourcesContent":["/**\n * SSRF protection for outbound HTTP requests.\n *\n * Validates that URLs do not target non-public network addresses.\n */\n\nconst IPV6_BRACKET_PATTERN = /^\\[|\\]$/g;\nconst IPV4_PART_PATTERN = /^(?:0|[1-9]\\d{0,2})$/;\nconst IPV6_PART_PATTERN = /^[0-9a-f]{1,4}$/i;\n\n/** Strip trailing dots from an FQDN-form hostname (\"localhost.\" -> \"localhost\"). */\nconst TRAILING_DOT_PATTERN = /\\.+$/;\n\n/**\n * IPv4 ranges that are not globally reachable unicast destinations.\n */\nconst BLOCKED_PATTERNS: Array<{ start: number; end: number }> = [\n\t// Current network\n\t{ start: ip4ToNum(0, 0, 0, 0), end: ip4ToNum(0, 255, 255, 255) },\n\t// Private use\n\t{ start: ip4ToNum(10, 0, 0, 0), end: ip4ToNum(10, 255, 255, 255) },\n\t// Shared address space\n\t{ start: ip4ToNum(100, 64, 0, 0), end: ip4ToNum(100, 127, 255, 255) },\n\t// Loopback\n\t{ start: ip4ToNum(127, 0, 0, 0), end: ip4ToNum(127, 255, 255, 255) },\n\t// Link-local, including common cloud metadata endpoints\n\t{ start: ip4ToNum(169, 254, 0, 0), end: ip4ToNum(169, 254, 255, 255) },\n\t// Private use\n\t{ start: ip4ToNum(172, 16, 0, 0), end: ip4ToNum(172, 31, 255, 255) },\n\t// IETF protocol assignments. Globally reachable exceptions are handled below.\n\t{ start: ip4ToNum(192, 0, 0, 0), end: ip4ToNum(192, 0, 0, 255) },\n\t// Documentation\n\t{ start: ip4ToNum(192, 0, 2, 0), end: ip4ToNum(192, 0, 2, 255) },\n\t// Deprecated 6to4 relay anycast\n\t{ start: ip4ToNum(192, 88, 99, 0), end: ip4ToNum(192, 88, 99, 255) },\n\t// Private use\n\t{ start: ip4ToNum(192, 168, 0, 0), end: ip4ToNum(192, 168, 255, 255) },\n\t// Benchmarking\n\t{ start: ip4ToNum(198, 18, 0, 0), end: ip4ToNum(198, 19, 255, 255) },\n\t// Documentation\n\t{ start: ip4ToNum(198, 51, 100, 0), end: ip4ToNum(198, 51, 100, 255) },\n\t{ start: ip4ToNum(203, 0, 113, 0), end: ip4ToNum(203, 0, 113, 255) },\n\t// Multicast, reserved, and limited broadcast\n\t{ start: ip4ToNum(224, 0, 0, 0), end: ip4ToNum(255, 255, 255, 255) },\n];\n\nconst ALLOWED_IPV4_EXCEPTIONS = new Set([ip4ToNum(192, 0, 0, 9), ip4ToNum(192, 0, 0, 10)]);\n\ninterface Ipv6Range {\n\taddress: number[];\n\tprefixLength: number;\n}\n\nfunction ipv6Range(address: string, prefixLength: number): Ipv6Range {\n\tconst parsed = parseIpv6(address);\n\tif (parsed === null) throw new Error(`Invalid IPv6 range: ${address}/${prefixLength}`);\n\treturn { address: parsed, prefixLength };\n}\n\nconst IPV6_GLOBAL_UNICAST_RANGE = ipv6Range(\"2000::\", 3);\nconst IPV4_COMPATIBLE_IPV6_RANGE = ipv6Range(\"::\", 96);\nconst IPV4_EMBEDDED_IPV6_RANGES: Ipv6Range[] = [\n\tIPV4_COMPATIBLE_IPV6_RANGE,\n\tipv6Range(\"::ffff:0:0\", 96),\n\tipv6Range(\"::ffff:0:0:0\", 96),\n\tipv6Range(\"64:ff9b::\", 96),\n];\n\n/** Globally reachable allocations inside the otherwise reserved 2001::/23 block. */\nconst ALLOWED_IPV6_SPECIAL_RANGES: Ipv6Range[] = [\n\tipv6Range(\"2001:1::1\", 128),\n\tipv6Range(\"2001:1::2\", 128),\n\tipv6Range(\"2001:1::3\", 128),\n\tipv6Range(\"2001:3::\", 32),\n\tipv6Range(\"2001:4:112::\", 48),\n\tipv6Range(\"2001:20::\", 28),\n\tipv6Range(\"2001:30::\", 28),\n];\n\n/** Non-global allocations inside the ordinary IPv6 global-unicast range. */\nconst BLOCKED_IPV6_GLOBAL_UNICAST_RANGES: Ipv6Range[] = [\n\tipv6Range(\"2001::\", 23),\n\tipv6Range(\"2001:db8::\", 32),\n\tipv6Range(\"2002::\", 16),\n\tipv6Range(\"3ffe::\", 16),\n\tipv6Range(\"3fff::\", 20),\n];\n\n// Bracket-stripped form is used for lookups (validateExternalUrl strips\n// brackets from parsed.hostname before checking), so \"::1\" appears here\n// without brackets. The \"::1\" case is already covered by isNonPublicIp, but\n// keeping it here makes the intent explicit and gives a clearer error\n// message for the common `http://[::1]/` form.\nconst BLOCKED_HOSTNAMES = new Set([\n\t\"localhost\",\n\t\"metadata.google.internal\",\n\t\"metadata.google\",\n\t\"::1\",\n]);\n\n/**\n * Wildcard DNS services that publicly resolve arbitrary IPs embedded in the\n * hostname. Commonly used in local dev and by SSRF exploit tooling to bypass\n * hostname-only blocklists (e.g. 127.0.0.1.nip.io -> 127.0.0.1).\n *\n * Matched case-insensitively as a suffix, so both the apex and any subdomain\n * are blocked.\n */\nconst BLOCKED_HOSTNAME_SUFFIXES = [\n\t\"nip.io\",\n\t\"sslip.io\",\n\t\"xip.io\",\n\t\"traefik.me\",\n\t\"lvh.me\",\n\t\"localtest.me\",\n];\n\n/** Blocked URL schemes */\nconst ALLOWED_SCHEMES = new Set([\"http:\", \"https:\"]);\n\nfunction ip4ToNum(a: number, b: number, c: number, d: number): number {\n\treturn ((a << 24) | (b << 16) | (c << 8) | d) >>> 0;\n}\n\nfunction parseIpv4(ip: string): number | null {\n\tconst parts = ip.split(\".\");\n\tif (parts.length !== 4) return null;\n\n\tconst nums = parts.map((part) => (IPV4_PART_PATTERN.test(part) ? Number(part) : Number.NaN));\n\tif (nums.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return null;\n\n\treturn ip4ToNum(nums[0], nums[1], nums[2], nums[3]);\n}\n\nfunction parseIpv6(ip: string): number[] | null {\n\tlet address = ip;\n\tif (address.includes(\".\")) {\n\t\tconst separator = address.lastIndexOf(\":\");\n\t\tif (separator === -1) return null;\n\t\tconst ipv4 = parseIpv4(address.slice(separator + 1));\n\t\tif (ipv4 === null) return null;\n\t\taddress = `${address.slice(0, separator + 1)}${(ipv4 >>> 16).toString(16)}:${(ipv4 & 0xffff).toString(16)}`;\n\t}\n\tif (address.includes(\":::\") || address.split(\"::\").length > 2) return null;\n\n\tconst [before = \"\", after = \"\"] = address.split(\"::\");\n\tconst head = before === \"\" ? [] : before.split(\":\");\n\tconst tail = after === \"\" ? [] : after.split(\":\");\n\tconst parts = [...head, ...tail];\n\tif (parts.some((part) => !IPV6_PART_PATTERN.test(part)) || parts.length > 8) return null;\n\tif (address.includes(\"::\") ? parts.length >= 8 : parts.length !== 8) return null;\n\n\tconst zeroCount = address.includes(\"::\") ? 8 - parts.length : 0;\n\treturn [...head, ...Array.from<string>({ length: zeroCount }).fill(\"0\"), ...tail].map((part) =>\n\t\tNumber.parseInt(part, 16),\n\t);\n}\n\nfunction isIpv6InRange(address: number[], range: Ipv6Range): boolean {\n\tconst completeParts = Math.floor(range.prefixLength / 16);\n\tfor (let i = 0; i < completeParts; i++) {\n\t\tif (address[i] !== range.address[i]) return false;\n\t}\n\n\tconst remainingBits = range.prefixLength % 16;\n\tif (remainingBits === 0) return true;\n\tconst mask = (0xffff << (16 - remainingBits)) & 0xffff;\n\treturn (address[completeParts] & mask) === (range.address[completeParts] & mask);\n}\n\nfunction extractEmbeddedIpv4(address: number[]): number | null {\n\tif (!IPV4_EMBEDDED_IPV6_RANGES.some((range) => isIpv6InRange(address, range))) return null;\n\tconst ipv4 = ((address[6] << 16) | address[7]) >>> 0;\n\t// The unspecified and loopback addresses retain their native IPv6 meaning.\n\tif (ipv4 <= 1 && isIpv6InRange(address, IPV4_COMPATIBLE_IPV6_RANGE)) return null;\n\treturn ipv4;\n}\n\n/** Convert a hex-form IPv6 address with an embedded IPv4 destination to dotted decimal. */\nexport function normalizeIPv6MappedToIPv4(ip: string): string | null {\n\tif (ip.includes(\".\")) return null;\n\tconst address = parseIpv6(ip);\n\tif (address === null) return null;\n\tconst ipv4 = extractEmbeddedIpv4(address);\n\tif (ipv4 === null) return null;\n\treturn `${ipv4 >>> 24}.${(ipv4 >>> 16) & 0xff}.${(ipv4 >>> 8) & 0xff}.${ipv4 & 0xff}`;\n}\n\nfunction isNonPublicIp(ip: string): boolean {\n\tconst parsedIpv4 = parseIpv4(ip);\n\tconst ipv6 = parsedIpv4 === null ? parseIpv6(ip) : null;\n\tconst ipv4 = ipv6 === null ? parsedIpv4 : extractEmbeddedIpv4(ipv6);\n\tif (ipv4 !== null) {\n\t\tif (ALLOWED_IPV4_EXCEPTIONS.has(ipv4)) return false;\n\t\treturn BLOCKED_PATTERNS.some((range) => ipv4 >= range.start && ipv4 <= range.end);\n\t}\n\tif (ipv6 === null) return true;\n\tif (ALLOWED_IPV6_SPECIAL_RANGES.some((range) => isIpv6InRange(ipv6, range))) return false;\n\tif (!isIpv6InRange(ipv6, IPV6_GLOBAL_UNICAST_RANGE)) return true;\n\treturn BLOCKED_IPV6_GLOBAL_UNICAST_RANGES.some((range) => isIpv6InRange(ipv6, range));\n}\n\n/**\n * Error thrown when SSRF protection blocks a URL.\n */\nexport class SsrfError extends Error {\n\tcode = \"SSRF_BLOCKED\" as const;\n\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"SsrfError\";\n\t}\n}\n\n/**\n * Validate a URL's scheme, hostname, and literal address.\n *\n * Checks:\n * 1. URL is well-formed with http/https scheme\n * 2. Hostname is not a known internal name (localhost, metadata endpoints)\n * 3. If hostname is an IP literal, it is a public address\n *\n * Hostnames also need DNS validation before dispatch. Resolving and checking\n * addresses does not bind an ordinary fetch() connection to those addresses.\n *\n * @throws SsrfError if the URL targets an internal address\n */\n/** Maximum number of redirects to follow in ssrfSafeFetch */\nconst MAX_REDIRECTS = 5;\n\nexport function validateExternalUrl(url: string): URL {\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(url);\n\t} catch {\n\t\tthrow new SsrfError(\"Invalid URL\");\n\t}\n\n\t// Only allow http/https\n\tif (!ALLOWED_SCHEMES.has(parsed.protocol)) {\n\t\tthrow new SsrfError(`Scheme '${parsed.protocol}' is not allowed`);\n\t}\n\n\t// Strip brackets from IPv6 hostname\n\tconst hostname = parsed.hostname.replace(IPV6_BRACKET_PATTERN, \"\");\n\n\t// Normalize the hostname for blocklist matching: lowercase + strip any\n\t// trailing dots. WHATWG preserves trailing dots on .hostname, so without\n\t// this normalization \"localhost.\" and \"nip.io.\" bypass the checks.\n\tconst normalizedHost = hostname.toLowerCase().replace(TRAILING_DOT_PATTERN, \"\");\n\n\t// Check against known internal hostnames\n\tif (BLOCKED_HOSTNAMES.has(normalizedHost)) {\n\t\tthrow new SsrfError(\"URLs targeting internal hosts are not allowed\");\n\t}\n\n\t// Check against wildcard DNS services used by SSRF tooling to bypass\n\t// hostname-only checks. Match the apex and any subdomain.\n\tfor (const suffix of BLOCKED_HOSTNAME_SUFFIXES) {\n\t\tif (normalizedHost === suffix || normalizedHost.endsWith(`.${suffix}`)) {\n\t\t\tthrow new SsrfError(\"URLs targeting wildcard DNS services are not allowed\");\n\t\t}\n\t}\n\n\t// Check if hostname is a non-public IP address. Use the\n\t// normalized form so \"127.0.0.1..\" and friends don't bypass parseIpv4\n\t// (which rejects extra trailing dots).\n\tif (isIpLiteral(normalizedHost) && isNonPublicIp(normalizedHost)) {\n\t\tthrow new SsrfError(\"URLs targeting non-public IP addresses are not allowed\");\n\t}\n\n\treturn parsed;\n}\n\n// ---------------------------------------------------------------------------\n// DNS-aware validation\n// ---------------------------------------------------------------------------\n\n/**\n * A resolver that maps a hostname to a list of IPv4/IPv6 addresses.\n * Injectable so callers can swap in OS-level DNS on Node, stub it in tests,\n * or point to a different DoH endpoint.\n */\nexport type DnsResolver = (hostname: string) => Promise<string[]>;\n\n/**\n * Module-level default resolver. Tests can swap this with a stub so fetch\n * mocks don't see unexpected DoH round-trips. Production code should leave\n * it alone.\n */\nlet defaultResolver: DnsResolver | null = null;\n\n/** Override the default DNS resolver. Returns the previous value. */\nexport function setDefaultDnsResolver(resolver: DnsResolver | null): DnsResolver | null {\n\tconst previous = defaultResolver;\n\tdefaultResolver = resolver;\n\treturn previous;\n}\n\n/** Timeout for a single DoH request, in milliseconds. */\nconst DOH_TIMEOUT_MS = 3000;\n\n/** Default DoH endpoint — Cloudflare's public resolver. */\nconst DEFAULT_DOH_URL = \"https://cloudflare-dns.com/dns-query\";\n\ninterface DohAnswer {\n\ttype: number;\n\tdata: string;\n}\n\ninterface DohResponse {\n\tStatus: number;\n\tAnswer: DohAnswer[];\n}\n\nfunction hasProperty<K extends string>(obj: unknown, key: K): obj is Record<K, unknown> {\n\treturn typeof obj === \"object\" && obj !== null && key in obj;\n}\n\n/**\n * Narrow an unknown JSON body to a DohResponse shape we can read safely.\n * Throws if the body doesn't look like a DoH response — a malformed body is\n * indistinguishable from a failure and must not be silently treated as empty.\n */\nfunction parseDohResponse(raw: unknown): DohResponse {\n\tif (!hasProperty(raw, \"Status\") || typeof raw.Status !== \"number\") {\n\t\tthrow new Error(\"DoH response missing Status field\");\n\t}\n\tconst answers: DohAnswer[] = [];\n\tif (hasProperty(raw, \"Answer\") && Array.isArray(raw.Answer)) {\n\t\tfor (const entry of raw.Answer) {\n\t\t\tif (\n\t\t\t\thasProperty(entry, \"type\") &&\n\t\t\t\ttypeof entry.type === \"number\" &&\n\t\t\t\tNumber.isInteger(entry.type) &&\n\t\t\t\thasProperty(entry, \"data\") &&\n\t\t\t\ttypeof entry.data === \"string\"\n\t\t\t) {\n\t\t\t\tanswers.push({ type: entry.type, data: entry.data });\n\t\t\t}\n\t\t}\n\t}\n\treturn { Status: raw.Status, Answer: answers };\n}\n\n/**\n * Resolve a hostname via DNS over HTTPS (Cloudflare). Returns all A and AAAA\n * records. Works in both Workers and Node without requiring node:dns.\n *\n * Fails closed: any network error, non-2xx response, or DNS rcode != 0\n * causes a rejected promise so the calling validator treats it as a block.\n */\nexport const cloudflareDohResolver: DnsResolver = async (hostname) => {\n\tasync function query(type: \"A\" | \"AAAA\"): Promise<string[]> {\n\t\tconst expectedAnswerType = type === \"A\" ? 1 : 28;\n\t\tconst params = new URLSearchParams({ name: hostname, type });\n\t\tconst controller = new AbortController();\n\t\tconst timeout = setTimeout(() => controller.abort(), DOH_TIMEOUT_MS);\n\t\ttry {\n\t\t\tconst response = await globalThis.fetch(`${DEFAULT_DOH_URL}?${params.toString()}`, {\n\t\t\t\theaders: { Accept: \"application/dns-json\" },\n\t\t\t\tsignal: controller.signal,\n\t\t\t});\n\t\t\tif (!response.ok) {\n\t\t\t\tthrow new Error(`DoH lookup failed: ${response.status}`);\n\t\t\t}\n\t\t\tconst raw = await response.json();\n\t\t\tconst body = parseDohResponse(raw);\n\t\t\t// NXDOMAIN (3) is a legitimate \"does not exist\" — treat as empty.\n\t\t\t// Any other non-zero status (SERVFAIL=2, REFUSED=5, etc.) is\n\t\t\t// ambiguous and could be a split-view attacker hiding records\n\t\t\t// from our resolver. Fail closed.\n\t\t\tif (body.Status === 3) return [];\n\t\t\tif (body.Status !== 0) {\n\t\t\t\tthrow new Error(`DoH ${type} lookup failed: rcode=${body.Status}`);\n\t\t\t}\n\t\t\t// DoH Answer arrays often include CNAME records alongside A/AAAA\n\t\t\t// records. Their `data` is a hostname, not an IP. Filter to just\n\t\t\t// IP literals of the requested record type.\n\t\t\treturn body.Answer.filter((answer) => answer.type === expectedAnswerType)\n\t\t\t\t.map((answer) => answer.data)\n\t\t\t\t.filter(isIpLiteral);\n\t\t} finally {\n\t\t\tclearTimeout(timeout);\n\t\t}\n\t}\n\n\tconst [a, aaaa] = await Promise.all([query(\"A\"), query(\"AAAA\")]);\n\treturn [...a, ...aaaa];\n};\n\n/**\n * Validate a URL and reject hostnames that resolve to non-public addresses,\n * including wildcard DNS services like nip.io used by exploit tooling.\n *\n * Runs `validateExternalUrl` first for cheap pre-flight checks (scheme,\n * literal IP, known-bad hostnames). Then resolves the hostname and rejects\n * if ANY returned address is non-public.\n *\n * Fails closed: if resolution fails or returns no records, throws SsrfError.\n *\n * **Caveats.** This does NOT fully close the TOCTOU between check and\n * connect. Attacks that still work against this layer include:\n *\n * - TTL=0 rebind: authoritative server returns public IP to the check, then\n *   private IP to the subsequent fetch() a few milliseconds later.\n * - Split-view via EDNS Client Subnet or source-IP inspection: the\n *   authoritative server returns public IP to Cloudflare's DoH resolver and\n *   private IP to the victim's own resolver (used by fetch()).\n * - Host-file overrides or split-horizon corporate DNS on self-hosted Node.\n * - Attacker-controlled rebinding services the caller has allowlisted.\n *\n * Connections must use the addresses from resolveAndValidateExternalUrlTarget\n * to avoid a second lookup. Callers using ordinary fetch() need network-level\n * egress controls to prevent these attacks.\n */\nexport async function resolveAndValidateExternalUrl(\n\turl: string,\n\toptions?: { resolver?: DnsResolver },\n): Promise<URL> {\n\treturn (await resolveAndValidateExternalUrlTarget(url, options)).url;\n}\n\nexport interface ResolvedExternalUrlTarget {\n\turl: URL;\n\taddresses: readonly string[];\n}\n\n/**\n * Validate a URL and return the exact public addresses approved for the\n * subsequent connection.\n */\nexport async function resolveAndValidateExternalUrlTarget(\n\turl: string,\n\toptions?: { resolver?: DnsResolver },\n): Promise<ResolvedExternalUrlTarget> {\n\tconst parsed = validateExternalUrl(url);\n\n\t// Strip brackets from IPv6 hostnames\n\tconst hostname = parsed.hostname.replace(IPV6_BRACKET_PATTERN, \"\");\n\n\t// If the hostname is already an IP literal, validateExternalUrl has\n\t// already checked it against the non-public ranges. Skip DNS.\n\tif (isIpLiteral(hostname)) {\n\t\treturn { url: parsed, addresses: [hostname] };\n\t}\n\n\tconst resolver = options?.resolver ?? defaultResolver ?? cloudflareDohResolver;\n\n\tlet addresses: string[];\n\ttry {\n\t\taddresses = await resolver(hostname);\n\t} catch (error) {\n\t\tthrow new SsrfError(\n\t\t\t`Could not resolve hostname: ${error instanceof Error ? error.message : String(error)}`,\n\t\t);\n\t}\n\n\tif (addresses.length === 0) {\n\t\tthrow new SsrfError(\"Hostname resolved to no addresses\");\n\t}\n\n\tfor (const ip of addresses) {\n\t\tif (!isIpLiteral(ip)) {\n\t\t\tthrow new SsrfError(\"Hostname resolver returned a non-IP address\");\n\t\t}\n\t\tif (isNonPublicIp(ip)) {\n\t\t\tthrow new SsrfError(\"Hostname resolves to a non-public IP address\");\n\t\t}\n\t}\n\n\treturn { url: parsed, addresses };\n}\n\n/** True when a string is a valid IPv4 or IPv6 literal. */\nfunction isIpLiteral(host: string): boolean {\n\treturn parseIpv4(host) !== null || parseIpv6(host) !== null;\n}\n\n/**\n * Fetch a URL with SSRF protection on redirects.\n *\n * Uses `redirect: \"manual\"` to intercept redirects and re-validate each\n * redirect target against SSRF rules before following it. This prevents\n * an attacker from setting up an allowed external URL that redirects to\n * an internal IP (e.g. 169.254.169.254 for cloud metadata).\n *\n * @throws SsrfError if the initial URL or any redirect target is internal\n */\n/** Headers that must be stripped when a redirect crosses origins */\nconst CREDENTIAL_HEADERS = [\"authorization\", \"cookie\", \"proxy-authorization\"];\n\nexport async function ssrfSafeFetch(\n\turl: string,\n\tinit?: RequestInit,\n\toptions?: { resolver?: DnsResolver; httpsOnly?: boolean },\n): Promise<Response> {\n\tlet currentUrl = url;\n\tlet currentInit = init;\n\n\tfor (let i = 0; i <= MAX_REDIRECTS; i++) {\n\t\tconst validated = await resolveAndValidateExternalUrl(currentUrl, options);\n\t\tif (options?.httpsOnly === true && validated.protocol !== \"https:\") {\n\t\t\tthrow new SsrfError(\"Only HTTPS URLs are allowed\");\n\t\t}\n\n\t\tconst response = await globalThis.fetch(currentUrl, {\n\t\t\t...currentInit,\n\t\t\tredirect: \"manual\",\n\t\t});\n\n\t\t// Not a redirect -- return directly\n\t\tif (response.status < 300 || response.status >= 400) {\n\t\t\treturn response;\n\t\t}\n\n\t\t// Extract redirect target\n\t\tconst location = response.headers.get(\"Location\");\n\t\tif (!location) {\n\t\t\treturn response;\n\t\t}\n\n\t\t// Resolve relative redirects against the current URL\n\t\tconst previousOrigin = new URL(currentUrl).origin;\n\t\tcurrentUrl = new URL(location, currentUrl).href;\n\t\tconst nextOrigin = new URL(currentUrl).origin;\n\n\t\t// Strip credential headers on cross-origin redirects\n\t\tif (previousOrigin !== nextOrigin && currentInit) {\n\t\t\tcurrentInit = stripCredentialHeaders(currentInit);\n\t\t}\n\t}\n\n\tthrow new SsrfError(`Too many redirects (max ${MAX_REDIRECTS})`);\n}\n\n/**\n * Return a copy of init with credential headers removed.\n */\nexport function stripCredentialHeaders(init: RequestInit): RequestInit {\n\tif (!init.headers) return init;\n\n\tconst headers = new Headers(init.headers);\n\tfor (const name of CREDENTIAL_HEADERS) {\n\t\theaders.delete(name);\n\t}\n\n\treturn { ...init, headers };\n}\n"],"mappings":";;;;;;AAMA,MAAM,uBAAuB;AAC7B,MAAM,oBAAoB;AAC1B,MAAM,oBAAoB;;AAG1B,MAAM,uBAAuB;;;;AAK7B,MAAM,mBAA0D;CAE/D;EAAE,OAAO,SAAS,GAAG,GAAG,GAAG,EAAE;EAAE,KAAK,SAAS,GAAG,KAAK,KAAK,IAAI;EAAE;CAEhE;EAAE,OAAO,SAAS,IAAI,GAAG,GAAG,EAAE;EAAE,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;EAAE;CAElE;EAAE,OAAO,SAAS,KAAK,IAAI,GAAG,EAAE;EAAE,KAAK,SAAS,KAAK,KAAK,KAAK,IAAI;EAAE;CAErE;EAAE,OAAO,SAAS,KAAK,GAAG,GAAG,EAAE;EAAE,KAAK,SAAS,KAAK,KAAK,KAAK,IAAI;EAAE;CAEpE;EAAE,OAAO,SAAS,KAAK,KAAK,GAAG,EAAE;EAAE,KAAK,SAAS,KAAK,KAAK,KAAK,IAAI;EAAE;CAEtE;EAAE,OAAO,SAAS,KAAK,IAAI,GAAG,EAAE;EAAE,KAAK,SAAS,KAAK,IAAI,KAAK,IAAI;EAAE;CAEpE;EAAE,OAAO,SAAS,KAAK,GAAG,GAAG,EAAE;EAAE,KAAK,SAAS,KAAK,GAAG,GAAG,IAAI;EAAE;CAEhE;EAAE,OAAO,SAAS,KAAK,GAAG,GAAG,EAAE;EAAE,KAAK,SAAS,KAAK,GAAG,GAAG,IAAI;EAAE;CAEhE;EAAE,OAAO,SAAS,KAAK,IAAI,IAAI,EAAE;EAAE,KAAK,SAAS,KAAK,IAAI,IAAI,IAAI;EAAE;CAEpE;EAAE,OAAO,SAAS,KAAK,KAAK,GAAG,EAAE;EAAE,KAAK,SAAS,KAAK,KAAK,KAAK,IAAI;EAAE;CAEtE;EAAE,OAAO,SAAS,KAAK,IAAI,GAAG,EAAE;EAAE,KAAK,SAAS,KAAK,IAAI,KAAK,IAAI;EAAE;CAEpE;EAAE,OAAO,SAAS,KAAK,IAAI,KAAK,EAAE;EAAE,KAAK,SAAS,KAAK,IAAI,KAAK,IAAI;EAAE;CACtE;EAAE,OAAO,SAAS,KAAK,GAAG,KAAK,EAAE;EAAE,KAAK,SAAS,KAAK,GAAG,KAAK,IAAI;EAAE;CAEpE;EAAE,OAAO,SAAS,KAAK,GAAG,GAAG,EAAE;EAAE,KAAK,SAAS,KAAK,KAAK,KAAK,IAAI;EAAE;CACpE;AAED,MAAM,0BAA0B,IAAI,IAAI,CAAC,SAAS,KAAK,GAAG,GAAG,EAAE,EAAE,SAAS,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC;AAO1F,SAAS,UAAU,SAAiB,cAAiC;CACpE,MAAM,SAAS,UAAU,QAAQ;AACjC,KAAI,WAAW,KAAM,OAAM,IAAI,MAAM,uBAAuB,QAAQ,GAAG,eAAe;AACtF,QAAO;EAAE,SAAS;EAAQ;EAAc;;AAGzC,MAAM,4BAA4B,UAAU,UAAU,EAAE;AACxD,MAAM,6BAA6B,UAAU,MAAM,GAAG;AACtD,MAAM,4BAAyC;CAC9C;CACA,UAAU,cAAc,GAAG;CAC3B,UAAU,gBAAgB,GAAG;CAC7B,UAAU,aAAa,GAAG;CAC1B;;AAGD,MAAM,8BAA2C;CAChD,UAAU,aAAa,IAAI;CAC3B,UAAU,aAAa,IAAI;CAC3B,UAAU,aAAa,IAAI;CAC3B,UAAU,YAAY,GAAG;CACzB,UAAU,gBAAgB,GAAG;CAC7B,UAAU,aAAa,GAAG;CAC1B,UAAU,aAAa,GAAG;CAC1B;;AAGD,MAAM,qCAAkD;CACvD,UAAU,UAAU,GAAG;CACvB,UAAU,cAAc,GAAG;CAC3B,UAAU,UAAU,GAAG;CACvB,UAAU,UAAU,GAAG;CACvB,UAAU,UAAU,GAAG;CACvB;AAOD,MAAM,oBAAoB,IAAI,IAAI;CACjC;CACA;CACA;CACA;CACA,CAAC;;;;;;;;;AAUF,MAAM,4BAA4B;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;;AAGD,MAAM,kBAAkB,IAAI,IAAI,CAAC,SAAS,SAAS,CAAC;AAEpD,SAAS,SAAS,GAAW,GAAW,GAAW,GAAmB;AACrE,SAAS,KAAK,KAAO,KAAK,KAAO,KAAK,IAAK,OAAO;;AAGnD,SAAS,UAAU,IAA2B;CAC7C,MAAM,QAAQ,GAAG,MAAM,IAAI;AAC3B,KAAI,MAAM,WAAW,EAAG,QAAO;CAE/B,MAAM,OAAO,MAAM,KAAK,SAAU,kBAAkB,KAAK,KAAK,GAAG,OAAO,KAAK,GAAG,IAAY;AAC5F,KAAI,KAAK,MAAM,MAAM,CAAC,OAAO,UAAU,EAAE,IAAI,IAAI,KAAK,IAAI,IAAI,CAAE,QAAO;AAEvE,QAAO,SAAS,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,GAAG;;AAGpD,SAAS,UAAU,IAA6B;CAC/C,IAAI,UAAU;AACd,KAAI,QAAQ,SAAS,IAAI,EAAE;EAC1B,MAAM,YAAY,QAAQ,YAAY,IAAI;AAC1C,MAAI,cAAc,GAAI,QAAO;EAC7B,MAAM,OAAO,UAAU,QAAQ,MAAM,YAAY,EAAE,CAAC;AACpD,MAAI,SAAS,KAAM,QAAO;AAC1B,YAAU,GAAG,QAAQ,MAAM,GAAG,YAAY,EAAE,IAAI,SAAS,IAAI,SAAS,GAAG,CAAC,IAAI,OAAO,OAAQ,SAAS,GAAG;;AAE1G,KAAI,QAAQ,SAAS,MAAM,IAAI,QAAQ,MAAM,KAAK,CAAC,SAAS,EAAG,QAAO;CAEtE,MAAM,CAAC,SAAS,IAAI,QAAQ,MAAM,QAAQ,MAAM,KAAK;CACrD,MAAM,OAAO,WAAW,KAAK,EAAE,GAAG,OAAO,MAAM,IAAI;CACnD,MAAM,OAAO,UAAU,KAAK,EAAE,GAAG,MAAM,MAAM,IAAI;CACjD,MAAM,QAAQ,CAAC,GAAG,MAAM,GAAG,KAAK;AAChC,KAAI,MAAM,MAAM,SAAS,CAAC,kBAAkB,KAAK,KAAK,CAAC,IAAI,MAAM,SAAS,EAAG,QAAO;AACpF,KAAI,QAAQ,SAAS,KAAK,GAAG,MAAM,UAAU,IAAI,MAAM,WAAW,EAAG,QAAO;CAE5E,MAAM,YAAY,QAAQ,SAAS,KAAK,GAAG,IAAI,MAAM,SAAS;AAC9D,QAAO;EAAC,GAAG;EAAM,GAAG,MAAM,KAAa,EAAE,QAAQ,WAAW,CAAC,CAAC,KAAK,IAAI;EAAE,GAAG;EAAK,CAAC,KAAK,SACtF,OAAO,SAAS,MAAM,GAAG,CACzB;;AAGF,SAAS,cAAc,SAAmB,OAA2B;CACpE,MAAM,gBAAgB,KAAK,MAAM,MAAM,eAAe,GAAG;AACzD,MAAK,IAAI,IAAI,GAAG,IAAI,eAAe,IAClC,KAAI,QAAQ,OAAO,MAAM,QAAQ,GAAI,QAAO;CAG7C,MAAM,gBAAgB,MAAM,eAAe;AAC3C,KAAI,kBAAkB,EAAG,QAAO;CAChC,MAAM,OAAQ,SAAW,KAAK,gBAAkB;AAChD,SAAQ,QAAQ,iBAAiB,WAAW,MAAM,QAAQ,iBAAiB;;AAG5E,SAAS,oBAAoB,SAAkC;AAC9D,KAAI,CAAC,0BAA0B,MAAM,UAAU,cAAc,SAAS,MAAM,CAAC,CAAE,QAAO;CACtF,MAAM,QAAS,QAAQ,MAAM,KAAM,QAAQ,QAAQ;AAEnD,KAAI,QAAQ,KAAK,cAAc,SAAS,2BAA2B,CAAE,QAAO;AAC5E,QAAO;;AAaR,SAAS,cAAc,IAAqB;CAC3C,MAAM,aAAa,UAAU,GAAG;CAChC,MAAM,OAAO,eAAe,OAAO,UAAU,GAAG,GAAG;CACnD,MAAM,OAAO,SAAS,OAAO,aAAa,oBAAoB,KAAK;AACnE,KAAI,SAAS,MAAM;AAClB,MAAI,wBAAwB,IAAI,KAAK,CAAE,QAAO;AAC9C,SAAO,iBAAiB,MAAM,UAAU,QAAQ,MAAM,SAAS,QAAQ,MAAM,IAAI;;AAElF,KAAI,SAAS,KAAM,QAAO;AAC1B,KAAI,4BAA4B,MAAM,UAAU,cAAc,MAAM,MAAM,CAAC,CAAE,QAAO;AACpF,KAAI,CAAC,cAAc,MAAM,0BAA0B,CAAE,QAAO;AAC5D,QAAO,mCAAmC,MAAM,UAAU,cAAc,MAAM,MAAM,CAAC;;;;;AAMtF,IAAa,YAAb,cAA+B,MAAM;CACpC,OAAO;CAEP,YAAY,SAAiB;AAC5B,QAAM,QAAQ;AACd,OAAK,OAAO;;;;;;;;;;;;;;;;;AAkBd,MAAM,gBAAgB;AAEtB,SAAgB,oBAAoB,KAAkB;CACrD,IAAI;AACJ,KAAI;AACH,WAAS,IAAI,IAAI,IAAI;SACd;AACP,QAAM,IAAI,UAAU,cAAc;;AAInC,KAAI,CAAC,gBAAgB,IAAI,OAAO,SAAS,CACxC,OAAM,IAAI,UAAU,WAAW,OAAO,SAAS,kBAAkB;CASlE,MAAM,iBALW,OAAO,SAAS,QAAQ,sBAAsB,GAAG,CAKlC,aAAa,CAAC,QAAQ,sBAAsB,GAAG;AAG/E,KAAI,kBAAkB,IAAI,eAAe,CACxC,OAAM,IAAI,UAAU,gDAAgD;AAKrE,MAAK,MAAM,UAAU,0BACpB,KAAI,mBAAmB,UAAU,eAAe,SAAS,IAAI,SAAS,CACrE,OAAM,IAAI,UAAU,uDAAuD;AAO7E,KAAI,YAAY,eAAe,IAAI,cAAc,eAAe,CAC/D,OAAM,IAAI,UAAU,yDAAyD;AAG9E,QAAO;;;;;;;AAmBR,IAAI,kBAAsC;;AAU1C,MAAM,iBAAiB;;AAGvB,MAAM,kBAAkB;AAYxB,SAAS,YAA8B,KAAc,KAAmC;AACvF,QAAO,OAAO,QAAQ,YAAY,QAAQ,QAAQ,OAAO;;;;;;;AAQ1D,SAAS,iBAAiB,KAA2B;AACpD,KAAI,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,IAAI,WAAW,SACxD,OAAM,IAAI,MAAM,oCAAoC;CAErD,MAAM,UAAuB,EAAE;AAC/B,KAAI,YAAY,KAAK,SAAS,IAAI,MAAM,QAAQ,IAAI,OAAO,EAC1D;OAAK,MAAM,SAAS,IAAI,OACvB,KACC,YAAY,OAAO,OAAO,IAC1B,OAAO,MAAM,SAAS,YACtB,OAAO,UAAU,MAAM,KAAK,IAC5B,YAAY,OAAO,OAAO,IAC1B,OAAO,MAAM,SAAS,SAEtB,SAAQ,KAAK;GAAE,MAAM,MAAM;GAAM,MAAM,MAAM;GAAM,CAAC;;AAIvD,QAAO;EAAE,QAAQ,IAAI;EAAQ,QAAQ;EAAS;;;;;;;;;AAU/C,MAAa,wBAAqC,OAAO,aAAa;CACrE,eAAe,MAAM,MAAuC;EAC3D,MAAM,qBAAqB,SAAS,MAAM,IAAI;EAC9C,MAAM,SAAS,IAAI,gBAAgB;GAAE,MAAM;GAAU;GAAM,CAAC;EAC5D,MAAM,aAAa,IAAI,iBAAiB;EACxC,MAAM,UAAU,iBAAiB,WAAW,OAAO,EAAE,eAAe;AACpE,MAAI;GACH,MAAM,WAAW,MAAM,WAAW,MAAM,GAAG,gBAAgB,GAAG,OAAO,UAAU,IAAI;IAClF,SAAS,EAAE,QAAQ,wBAAwB;IAC3C,QAAQ,WAAW;IACnB,CAAC;AACF,OAAI,CAAC,SAAS,GACb,OAAM,IAAI,MAAM,sBAAsB,SAAS,SAAS;GAGzD,MAAM,OAAO,iBADD,MAAM,SAAS,MAAM,CACC;AAKlC,OAAI,KAAK,WAAW,EAAG,QAAO,EAAE;AAChC,OAAI,KAAK,WAAW,EACnB,OAAM,IAAI,MAAM,OAAO,KAAK,wBAAwB,KAAK,SAAS;AAKnE,UAAO,KAAK,OAAO,QAAQ,WAAW,OAAO,SAAS,mBAAmB,CACvE,KAAK,WAAW,OAAO,KAAK,CAC5B,OAAO,YAAY;YACZ;AACT,gBAAa,QAAQ;;;CAIvB,MAAM,CAAC,GAAG,QAAQ,MAAM,QAAQ,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC;AAChE,QAAO,CAAC,GAAG,GAAG,GAAG,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BvB,eAAsB,8BACrB,KACA,SACe;AACf,SAAQ,MAAM,oCAAoC,KAAK,QAAQ,EAAE;;;;;;AAYlE,eAAsB,oCACrB,KACA,SACqC;CACrC,MAAM,SAAS,oBAAoB,IAAI;CAGvC,MAAM,WAAW,OAAO,SAAS,QAAQ,sBAAsB,GAAG;AAIlE,KAAI,YAAY,SAAS,CACxB,QAAO;EAAE,KAAK;EAAQ,WAAW,CAAC,SAAS;EAAE;CAG9C,MAAM,WAAW,SAAS,YAAY,mBAAmB;CAEzD,IAAI;AACJ,KAAI;AACH,cAAY,MAAM,SAAS,SAAS;UAC5B,OAAO;AACf,QAAM,IAAI,UACT,+BAA+B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GACrF;;AAGF,KAAI,UAAU,WAAW,EACxB,OAAM,IAAI,UAAU,oCAAoC;AAGzD,MAAK,MAAM,MAAM,WAAW;AAC3B,MAAI,CAAC,YAAY,GAAG,CACnB,OAAM,IAAI,UAAU,8CAA8C;AAEnE,MAAI,cAAc,GAAG,CACpB,OAAM,IAAI,UAAU,+CAA+C;;AAIrE,QAAO;EAAE,KAAK;EAAQ;EAAW;;;AAIlC,SAAS,YAAY,MAAuB;AAC3C,QAAO,UAAU,KAAK,KAAK,QAAQ,UAAU,KAAK,KAAK;;;;;;;;;;;;;AAcxD,MAAM,qBAAqB;CAAC;CAAiB;CAAU;CAAsB;AAE7E,eAAsB,cACrB,KACA,MACA,SACoB;CACpB,IAAI,aAAa;CACjB,IAAI,cAAc;AAElB,MAAK,IAAI,IAAI,GAAG,KAAK,eAAe,KAAK;EACxC,MAAM,YAAY,MAAM,8BAA8B,YAAY,QAAQ;AAC1E,MAAI,SAAS,cAAc,QAAQ,UAAU,aAAa,SACzD,OAAM,IAAI,UAAU,8BAA8B;EAGnD,MAAM,WAAW,MAAM,WAAW,MAAM,YAAY;GACnD,GAAG;GACH,UAAU;GACV,CAAC;AAGF,MAAI,SAAS,SAAS,OAAO,SAAS,UAAU,IAC/C,QAAO;EAIR,MAAM,WAAW,SAAS,QAAQ,IAAI,WAAW;AACjD,MAAI,CAAC,SACJ,QAAO;EAIR,MAAM,iBAAiB,IAAI,IAAI,WAAW,CAAC;AAC3C,eAAa,IAAI,IAAI,UAAU,WAAW,CAAC;AAI3C,MAAI,mBAHe,IAAI,IAAI,WAAW,CAAC,UAGF,YACpC,eAAc,uBAAuB,YAAY;;AAInD,OAAM,IAAI,UAAU,2BAA2B,cAAc,GAAG;;;;;AAMjE,SAAgB,uBAAuB,MAAgC;AACtE,KAAI,CAAC,KAAK,QAAS,QAAO;CAE1B,MAAM,UAAU,IAAI,QAAQ,KAAK,QAAQ;AACzC,MAAK,MAAM,QAAQ,mBAClB,SAAQ,OAAO,KAAK;AAGrB,QAAO;EAAE,GAAG;EAAM;EAAS"}