patchwork-os 1.2.0-beta.3.canary.875 → 1.2.0-beta.3.canary.877

package/dist/ssrfGuard.js

@@ -26,204 +26,26 @@
  * both walked straight past it):
  *   - `validateOutboundUrl(url, opts)` — parse, protocol, userinfo strip,
  *     lexical check, DNS pre-resolution re-check, returns the address to pin.
- *   - `safeFetch(url, init, opts)` — validates, pins the connection to the
- *     resolved address (hostname rewritten to the IP, original name carried
- *     in the Host header so SNI / virtual hosting keep working), follows up
- *     to N redirects manually re-validating EVERY hop, downgrades method/body
- *     per RFC 7231 on 301/302/303, and drops credential headers on a
- *     cross-origin hop.
- */
-import dns from "node:dns/promises";
-/**
- * Convert the hex-compressed form that `new URL()` may return for an
- * IPv4-mapped/translated IPv6 address back to dotted-decimal so the existing
- * `isPrivateHost` checks apply.
- *
- * Handles:
- *   "xxxx:yyyy"  — two 16-bit groups (up to 4 hex digits each, no leading zeros)
- *   "xxxxxxxx"   — a single 32-bit group
- *
- * Returns null when the input is not recognisable as 32-bit hex-IPv4.
- */
-function hexIpv4ToDotted(s) {
-    const colon = s.indexOf(":");
-    if (colon !== -1) {
-        const hi = s.slice(0, colon);
-        const lo = s.slice(colon + 1);
-        if (!/^[0-9a-f]{1,4}$/i.test(hi) || !/^[0-9a-f]{1,4}$/i.test(lo))
-            return null;
-        const hiN = parseInt(hi, 16);
-        const loN = parseInt(lo, 16);
-        return `${(hiN >>> 8) & 0xff}.${hiN & 0xff}.${(loN >>> 8) & 0xff}.${loN & 0xff}`;
-    }
-    if (!/^[0-9a-f]{1,8}$/i.test(s))
-        return null;
-    const n = parseInt(s, 16);
-    return `${(n >>> 24) & 0xff}.${(n >>> 16) & 0xff}.${(n >>> 8) & 0xff}.${n & 0xff}`;
-}
-/**
- * inet_aton-style loose IPv4 parse: 1-4 parts, each decimal, octal (leading
- * 0) or hex (0x). Returns canonical dotted-quad or null when the string is
- * not an all-numeric IPv4 form. `new URL()` already canonicalises these, but
- * callers that hand `isPrivateHost` a raw string (a DNS answer, a Location
- * header hostname) must not be bypassable by `0x7f000001`, `2130706433`,
- * `0177.0.0.1` or `127.1`.
- */
-function looseIpv4ToDotted(host) {
-    if (!/^[0-9a-fx.]+$/i.test(host) ||
-        host.startsWith(".") ||
-        host.endsWith("."))
-        return null;
-    const parts = host.split(".");
-    if (parts.length < 1 || parts.length > 4)
-        return null;
-    const nums = [];
-    for (const part of parts) {
-        let n;
-        if (/^0x[0-9a-f]+$/i.test(part))
-            n = parseInt(part.slice(2), 16);
-        else if (/^0[0-7]+$/.test(part))
-            n = parseInt(part, 8);
-        else if (/^\d+$/.test(part))
-            n = parseInt(part, 10);
-        else
-            return null;
-        if (!Number.isFinite(n))
-            return null;
-        nums.push(n);
-    }
-    // Last part fills the remaining bytes (inet_aton semantics).
-    const last = nums[nums.length - 1];
-    const remainingBytes = 4 - (nums.length - 1);
-    if (last >= 2 ** (8 * remainingBytes))
-        return null;
-    for (let i = 0; i < nums.length - 1; i++) {
-        if (nums[i] > 255)
-            return null;
-    }
-    let value = 0;
-    for (let i = 0; i < nums.length - 1; i++) {
-        value = value * 256 + nums[i];
-    }
-    value = value * 2 ** (8 * remainingBytes) + last;
-    return `${(value >>> 24) & 0xff}.${(value >>> 16) & 0xff}.${(value >>> 8) & 0xff}.${value & 0xff}`;
-}
-/**
- * Block requests to private/loopback addresses. Lexical-only check.
- *
- * Mirrors the predicate previously inlined in `tools/httpClient.ts`. Updates
- * here MUST stay in sync with the test fixtures in
- * `src/tools/__tests__/httpClient.test.ts`.
- */
-export function isPrivateHost(hostname) {
-    const host = hostname.startsWith("[") && hostname.endsWith("]")
-        ? hostname.slice(1, -1).toLowerCase()
-        : hostname.toLowerCase();
-    if (host === "localhost" || host.endsWith(".localhost"))
-        return true;
-    if (host === "0.0.0.0")
-        return true;
-    // Reject non-decimal IPv4 notations (hex/octal) that bypass the dotted-quad
-    // regex below. Node's URL parser may normalize them on some platforms.
-    if (/^0x[0-9a-f]+$/i.test(host) || /^0[0-7]{7,}$/.test(host))
-        return true;
-    // Unusual IPv4 notations (decimal integer, short-form "127.1", zero-padded
-    // octal, per-part hex): canonicalise and re-check the dotted form.
-    const canonicalIpv4 = /^\d{1,3}(\.\d{1,3}){3}$/.test(host);
-    if (!canonicalIpv4) {
-        const dotted = looseIpv4ToDotted(host);
-        if (dotted !== null)
-            return isPrivateHost(dotted);
-    }
-    // IPv4 range checks
-    const ipv4 = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-    if (ipv4) {
-        const a = Number(ipv4[1]);
-        const b = Number(ipv4[2]);
-        if (a === 127)
-            return true; // 127.0.0.0/8 loopback
-        if (a === 10)
-            return true; // 10.0.0.0/8 RFC 1918 private
-        if (a === 172 && b >= 16 && b <= 31)
-            return true; // 172.16.0.0/12 RFC 1918 private
-        if (a === 192 && b === 168)
-            return true; // 192.168.0.0/16 RFC 1918 private
-        if (a === 169 && b === 254)
-            return true; // 169.254.0.0/16 link-local / AWS metadata
-        if (a === 100 && b >= 64 && b <= 127)
-            return true; // 100.64.0.0/10 CGNAT (RFC 6598)
-        if (a === 0)
-            return true; // 0.0.0.0/8
-    }
-    // IPv6 checks
-    if (host === "::1")
-        return true; // loopback
-    if (host.startsWith("fe80:"))
-        return true; // link-local
-    if (host.startsWith("fc") || host.startsWith("fd"))
-        return true; // ULA (RFC 4193)
-    if (host.startsWith("2002:"))
-        return true; // 6to4 (RFC 3056) — embeds IPv4 in bits 16-47;
-    // a 6to4 address for a private IPv4 (e.g. 2002:c0a8:0101:: → 192.168.1.1) bypasses
-    // the IPv4 checks above unless we block the entire /16 here.
-    // Check longer prefix first — ::ffff:0: (IPv4-translated) before ::ffff: (IPv4-mapped)
-    // Also handle hex-compressed form that new URL() may return (e.g. "7f00:1" = 127.0.0.1).
-    if (host.startsWith("::ffff:0:")) {
-        const rest = host.slice(9);
-        const dotted = hexIpv4ToDotted(rest);
-        return isPrivateHost(dotted ?? rest);
-    }
-    if (host.startsWith("::ffff:")) {
-        const rest = host.slice(7);
-        const dotted = hexIpv4ToDotted(rest);
-        return isPrivateHost(dotted ?? rest);
-    }
-    return false;
-}
-/**
- * Loopback-only check (127.0.0.0/8, ::1, localhost). Lexical-only.
- *
- * Used by `isPrivateNonLoopbackHost` and by automation webhook fan-out, which
- * intentionally ALLOWS loopback (sidecars) but blocks every other private
- * range (RFC 1918, link-local, ULA, IMDS, 6to4-wrapped private, etc.).
- */
-export function isLoopbackHost(hostname) {
-    const host = hostname.startsWith("[") && hostname.endsWith("]")
-        ? hostname.slice(1, -1).toLowerCase()
-        : hostname.toLowerCase();
-    if (host === "localhost" || host.endsWith(".localhost"))
-        return true;
-    if (host === "::1")
-        return true;
-    const ipv4 = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-    if (ipv4 && Number(ipv4[1]) === 127)
-        return true;
-    // IPv6-mapped/translated loopback: ::ffff:127.0.0.1 / ::ffff:0:127.0.0.1
-    // Also handle hex-compressed form from new URL() (e.g. "7f00:1" = 127.0.0.1).
-    if (host.startsWith("::ffff:0:")) {
-        const rest = host.slice(9);
-        const dotted = hexIpv4ToDotted(rest);
-        return isLoopbackHost(dotted ?? rest);
-    }
-    if (host.startsWith("::ffff:")) {
-        const rest = host.slice(7);
-        const dotted = hexIpv4ToDotted(rest);
-        return isLoopbackHost(dotted ?? rest);
-    }
-    return false;
-}
-/**
- * Private host MINUS loopback. Lexical-only.
+ *   - `safeFetch(url, init, opts)` — validates, pins the CONNECTION to the
+ *     resolved address through an undici dispatcher whose `connect.lookup`
+ *     returns that address, follows up to N redirects manually re-validating
+ *     EVERY hop, downgrades method/body per RFC 7231 on 301/302/303, and
+ *     drops credential headers on a cross-origin hop.
  *
- * Use when a sink intentionally allows loopback (e.g. webhook fan-out to local
- * sidecars) but must still block RFC 1918, link-local, IMDS, ULA, 6to4-wrapped
- * private, and IPv4-mapped/translated private addresses.
+ * The pin lives in the connection, never in the URL. #1572 first pinned by
+ * rewriting the URL's hostname to the IP and carrying the name in a `Host`
+ * header; TLS takes SNI and the certificate check from the URL, so every
+ * public HTTPS request failed ERR_TLS_CERT_ALTNAME_INVALID, and `fetch`
+ * silently drops a caller-set `Host`, so plain HTTP reached virtual hosts
+ * with the wrong one. Found 2026-10-02 against the installed build; nothing
+ * in the suite could see it because every test used a mocked fetch or a
+ * loopback HTTP server.
  */
-export function isPrivateNonLoopbackHost(hostname) {
-    if (isLoopbackHost(hostname))
-        return false;
-    return isPrivateHost(hostname);
-}
+import dns from "node:dns/promises";
+import { Agent } from "undici";
+import { isLoopbackHost, isPrivateHost, isPrivateNonLoopbackHost, } from "./privateHost.js";
+// Re-exported so every existing `from "./ssrfGuard.js"` importer is unchanged.
+export { isLoopbackHost, isPrivateHost, isPrivateNonLoopbackHost };
 /**
  * Async URL safety gate used by `/recipes/install` and `commands/recipeInstall.ts`.
  *
@@ -355,21 +177,45 @@ function refusalMessage(v, hop) {
             return `${where}request refused`;
     }
 }
-function pin(url, address) {
-    if (address === undefined)
-        return url.toString();
-    const pinned = new URL(url.toString());
-    pinned.hostname = address.includes(":") ? `[${address}]` : address;
-    return pinned.toString();
+/**
+ * A dispatcher whose connections go to `address` (when given), however the
+ * URL's hostname would resolve. The URL is left alone, so TLS uses the real
+ * name for SNI and certificate verification and the Host header is derived
+ * from it. Node's `net`/`tls` call `lookup` with `{ all: true }` when
+ * autoSelectFamily is on, so both callback shapes are answered.
+ *
+ * One Agent per hop, with short keep-alive: the pin is per-hostname-per-hop,
+ * and a shared pool keyed only on origin would happily reuse a socket pinned
+ * for a previous answer.
+ */
+function hopDispatcher(address, opts) {
+    const connect = { ...(opts.connect ?? {}) };
+    if (address !== undefined) {
+        const family = address.includes(":") ? 6 : 4;
+        connect.lookup = (_hostname, lookupOpts, cb) => {
+            if (lookupOpts?.all)
+                cb(null, [{ address, family }]);
+            else
+                cb(null, address, family);
+        };
+    }
+    const agent = new Agent({
+        connect,
+        keepAliveTimeout: 1_000,
+        keepAliveMaxTimeout: 1_000,
+    });
+    return opts.wrapDispatcher ? opts.wrapDispatcher(agent) : agent;
 }
 /**
  * Fetch with the full outbound discipline. Throws `OutboundHttpError` on any
  * refusal (initial URL or any redirect hop); transport errors propagate from
  * `fetchImpl` untouched so callers keep their own timeout/abort messages.
  *
- * `init.headers` must be a plain object; keys are lowercased. `host` is set
- * by this function AFTER caller headers so a caller cannot un-pin a hop.
- * Every other `init` field (signal, dispatcher, …) is passed through.
+ * `init.headers` must be a plain object; keys are lowercased. A caller's
+ * `host` header and `dispatcher` are DROPPED: Host is derived from the URL,
+ * and the dispatcher is the pin — accepting either from the caller is a way
+ * to steer the request somewhere the validation never looked. Every other
+ * `init` field (signal, …) is passed through.
  */
 export async function safeFetch(input, init = {}, opts = {}) {
     const fetchImpl = opts.fetchImpl ?? ((u, i) => globalThis.fetch(u, i));
@@ -381,15 +227,17 @@ export async function safeFetch(input, init = {}, opts = {}) {
     }
     const headers = {};
     for (const [k, v] of Object.entries(init.headers ?? {})) {
-        headers[k.toLowerCase()] = v;
+        const key = k.toLowerCase();
+        if (key === "host")
+            continue;
+        headers[key] = v;
     }
-    const { method: initMethod, headers: _h, body: initBody, ...rest } = init;
+    const { method: initMethod, headers: _h, body: initBody, dispatcher: _callerDispatcher, ...rest } = init;
     let currentMethod = (initMethod ?? "GET").toUpperCase();
     let currentBody = initBody;
     let displayUrl = first.url;
-    let currentUrl = pin(first.url, first.pinnedAddress);
-    if (first.pinnedAddress !== undefined)
-        headers.host = first.url.hostname;
+    let currentUrl = first.url.toString();
+    let currentDispatcher = hopDispatcher(first.pinnedAddress, opts);
     const originalOrigin = first.url.origin;
     let redirects = 0;
     while (true) {
@@ -399,6 +247,7 @@ export async function safeFetch(input, init = {}, opts = {}) {
             headers,
             body: currentBody,
             redirect: "manual",
+            dispatcher: currentDispatcher,
         });
         const isRedirect = response.status >= 300 && response.status < 400;
         if (!followRedirects || !isRedirect) {
@@ -424,9 +273,6 @@ export async function safeFetch(input, init = {}, opts = {}) {
         if (!next.ok || next.url === undefined) {
             throw new OutboundHttpError(next.reason ?? "invalid_redirect", refusalMessage(next, "redirect"));
         }
-        // Host always from the real name — even when this hop's DNS failed —
-        // so the previous hop's Host never leaks onto the new request.
-        headers.host = next.url.hostname;
         // RFC 7231 + browser/fetch semantics: 301/302 of a non-GET/HEAD and any
         // 303 become GET without a body; 307/308 preserve both.
         if (response.status === 303 ||
@@ -442,8 +288,12 @@ export async function safeFetch(input, init = {}, opts = {}) {
             for (const h of CREDENTIAL_HEADERS)
                 delete headers[h];
         }
+        // The previous hop's response is fully handled (a redirect body is never
+        // read), so its dispatcher can close; the next hop gets its own pin.
+        void currentDispatcher.close?.().catch?.(() => { });
         displayUrl = next.url;
-        currentUrl = pin(next.url, next.pinnedAddress);
+        currentUrl = next.url.toString();
+        currentDispatcher = hopDispatcher(next.pinnedAddress, opts);
         redirects++;
     }
 }

package/dist/ssrfGuard.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssrfGuard.js","sourceRoot":"","sources":["../src/ssrfGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,GAAG,MAAM,mBAAmB,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7B,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1B,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,IACE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAElB,OAAO,IAAI,CAAC;IACd,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAS,CAAC;QACd,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;aAC5D,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;aAClD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;;YAC/C,OAAO,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IACD,6DAA6D;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAW,CAAC;IAC7C,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,IAAK,IAAI,CAAC,CAAC,CAAY,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,KAAK,GAAG,KAAK,GAAG,GAAG,GAAI,IAAI,CAAC,CAAC,CAAY,CAAC;IAC5C,CAAC;IACD,KAAK,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,cAAc,CAAC,GAAG,IAAI,CAAC;IACjD,OAAO,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC;AACrG,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,IAAI,GACR,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAChD,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QACrC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE7B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEpC,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,aAAa,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,oBAAoB;IACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACxE,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;QACnD,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,8BAA8B;QACzD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,iCAAiC;QACnF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;QAC3E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;QACpF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,iCAAiC;QACpF,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,YAAY;IACxC,CAAC;IAED,cAAc;IACd,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,WAAW;IAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IACxD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,iBAAiB;IAClF,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,+CAA+C;IAC1F,mFAAmF;IACnF,6DAA6D;IAC7D,uFAAuF;IACvF,yFAAyF;IACzF,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,aAAa,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,aAAa,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,IAAI,GACR,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAChD,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QACrC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACxE,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjD,yEAAyE;IACzE,8EAA8E;IAC9E,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,cAAc,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,cAAc,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,IAAI,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAiB;IAEjB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,MAAM,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IACxE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,wBAAwB;gBAChC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,MAAM,OAAO,EAAE;aAC1C,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;QAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAyCD,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAgB,EAAmB,EAAE;IACpE,oEAAoE;IACpE,kEAAkE;IAClE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAmB,EACnB,OAA2B,EAAE;IAE7B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC1D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7E,CAAC;IACD,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAElB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;IAChD,IAAI,CAAC,YAAY,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC;IAC1E,CAAC;IAED,IAAI,aAAiC,CAAC;IACtC,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;QAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,MAAM,aAAa,EAAE;YAC5C,GAAG;SACJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAExB;IADlB,YACkB,IAAqB,EACrC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAiB;QAIrC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAyBD,MAAM,kBAAkB,GAAG;IACzB,eAAe;IACf,QAAQ;IACR,WAAW;IACX,qBAAqB;CACb,CAAC;AAEX,SAAS,cAAc,CAAC,CAAwB,EAAE,GAA2B;IAC3E,MAAM,KAAK,GAAG,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,aAAa;YAChB,OAAO,GAAG,KAAK,UAAU;gBACvB,CAAC,CAAC,+BAA+B,CAAC,CAAC,MAAM,GAAG;gBAC5C,CAAC,CAAC,iBAAiB,CAAC,CAAC,MAAM,GAAG,CAAC;QACnC,KAAK,sBAAsB;YACzB,OAAO,GAAG,KAAK,0CAA0C,CAAC,CAAC,MAAM,GAAG,CAAC;QACvE,KAAK,cAAc;YACjB,OAAO,GAAG,KAAK,0CAA0C,CAAC,CAAC,MAAM,cAAc,CAAC;QAClF,KAAK,wBAAwB;YAC3B,OAAO,GAAG,KAAK,oDAAoD,CAAC,CAAC,MAAM,aAAa,CAAC;QAC3F;YACE,OAAO,GAAG,KAAK,iBAAiB,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,GAAQ,EAAE,OAA2B;IAChD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;IACnE,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAmB,EACnB,OAII,EAAE,EACN,OAAyB,EAAE;IAE3B,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAgB,CAAC,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC;IACrD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IAE7C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,iBAAiB,CACzB,KAAK,CAAC,MAAM,IAAI,aAAa,EAC7B,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CACjC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAE1E,IAAI,aAAa,GAAG,CAAC,UAAU,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,IAAI,WAAW,GAAG,QAAQ,CAAC;IAC3B,IAAI,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC;IAC3B,IAAI,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;IACzE,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;IACxC,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE;YAC3C,GAAG,IAAI;YACP,MAAM,EAAE,aAAa;YACrB,OAAO;YACP,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC;QACnE,IAAI,CAAC,eAAe,IAAI,CAAC,UAAU,EAAE,CAAC;YACpC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC;QAClE,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;YAC9B,MAAM,IAAI,iBAAiB,CACzB,oBAAoB,EACpB,wBAAwB,YAAY,GAAG,CACxC,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,mDAAmD;QACnD,IAAI,OAAY,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,+BAA+B,QAAQ,GAAG,CAC3C,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,iBAAiB,CACzB,IAAI,CAAC,MAAM,IAAI,kBAAkB,EACjC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CACjC,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,+DAA+D;QAC/D,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;QAEjC,wEAAwE;QACxE,wDAAwD;QACxD,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;YACvB,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC;gBACnD,aAAa,KAAK,KAAK;gBACvB,aAAa,KAAK,MAAM,CAAC,EAC3B,CAAC;YACD,aAAa,GAAG,KAAK,CAAC;YACtB,WAAW,GAAG,SAAS,CAAC;YACxB,OAAO,OAAO,CAAC,cAAc,CAAC,CAAC;YAC/B,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,IAAI,kBAAkB;gBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC;QACtB,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/C,SAAS,EAAE,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"ssrfGuard.js","sourceRoot":"","sources":["../src/ssrfGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,GAAG,MAAM,mBAAmB,CAAC;AACpC,OAAO,EAAE,KAAK,EAAmB,MAAM,QAAQ,CAAC;AAChD,OAAO,EACL,cAAc,EACd,aAAa,EACb,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAE1B,+EAA+E;AAC/E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,wBAAwB,EAAE,CAAC;AAkBnE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAiB;IAEjB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,MAAM,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IACxE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,wBAAwB;gBAChC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,MAAM,OAAO,EAAE;aAC1C,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;QAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAyCD,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAgB,EAAmB,EAAE;IACpE,oEAAoE;IACpE,kEAAkE;IAClE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAmB,EACnB,OAA2B,EAAE;IAE7B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC1D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7E,CAAC;IACD,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAElB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;IAChD,IAAI,CAAC,YAAY,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC;IAC1E,CAAC;IAED,IAAI,aAAiC,CAAC;IACtC,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;QAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,MAAM,aAAa,EAAE;YAC5C,GAAG;SACJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAExB;IADlB,YACkB,IAAqB,EACrC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAiB;QAIrC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAyCD,MAAM,kBAAkB,GAAG;IACzB,eAAe;IACf,QAAQ;IACR,WAAW;IACX,qBAAqB;CACb,CAAC;AAEX,SAAS,cAAc,CAAC,CAAwB,EAAE,GAA2B;IAC3E,MAAM,KAAK,GAAG,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,aAAa;YAChB,OAAO,GAAG,KAAK,UAAU;gBACvB,CAAC,CAAC,+BAA+B,CAAC,CAAC,MAAM,GAAG;gBAC5C,CAAC,CAAC,iBAAiB,CAAC,CAAC,MAAM,GAAG,CAAC;QACnC,KAAK,sBAAsB;YACzB,OAAO,GAAG,KAAK,0CAA0C,CAAC,CAAC,MAAM,GAAG,CAAC;QACvE,KAAK,cAAc;YACjB,OAAO,GAAG,KAAK,0CAA0C,CAAC,CAAC,MAAM,cAAc,CAAC;QAClF,KAAK,wBAAwB;YAC3B,OAAO,GAAG,KAAK,oDAAoD,CAAC,CAAC,MAAM,aAAa,CAAC;QAC3F;YACE,OAAO,GAAG,KAAK,iBAAiB,CAAC;IACrC,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CACpB,OAA2B,EAC3B,IAAsB;IAEtB,MAAM,OAAO,GAA4B,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IACrE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,MAAM,GAAG,CACf,SAAiB,EACjB,UAAyC,EACzC,EAAgC,EAChC,EAAE;YACF,IAAI,UAAU,EAAE,GAAG;gBAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;;gBAChD,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC;QACtB,OAAO;QACP,gBAAgB,EAAE,KAAK;QACvB,mBAAmB,EAAE,KAAK;KAC3B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAClE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAmB,EACnB,OAII,EAAE,EACN,OAAyB,EAAE;IAE3B,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAgB,CAAC,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC;IACrD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IAE7C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,iBAAiB,CACzB,KAAK,CAAC,MAAM,IAAI,aAAa,EAC7B,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CACjC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5B,IAAI,GAAG,KAAK,MAAM;YAAE,SAAS;QAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,EACJ,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,EAAE,EACX,IAAI,EAAE,QAAQ,EACd,UAAU,EAAE,iBAAiB,EAC7B,GAAG,IAAI,EACR,GAAG,IAAI,CAAC;IAET,IAAI,aAAa,GAAG,CAAC,UAAU,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,IAAI,WAAW,GAAG,QAAQ,CAAC;IAC3B,IAAI,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC;IAC3B,IAAI,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IACtC,IAAI,iBAAiB,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;IACxC,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE;YAC3C,GAAG,IAAI;YACP,MAAM,EAAE,aAAa;YACrB,OAAO;YACP,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,iBAAiB;SAC9B,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC;QACnE,IAAI,CAAC,eAAe,IAAI,CAAC,UAAU,EAAE,CAAC;YACpC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC;QAClE,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;YAC9B,MAAM,IAAI,iBAAiB,CACzB,oBAAoB,EACpB,wBAAwB,YAAY,GAAG,CACxC,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,mDAAmD;QACnD,IAAI,OAAY,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,+BAA+B,QAAQ,GAAG,CAC3C,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,iBAAiB,CACzB,IAAI,CAAC,MAAM,IAAI,kBAAkB,EACjC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CACjC,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,wDAAwD;QACxD,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;YACvB,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC;gBACnD,aAAa,KAAK,KAAK;gBACvB,aAAa,KAAK,MAAM,CAAC,EAC3B,CAAC;YACD,aAAa,GAAG,KAAK,CAAC;YACtB,WAAW,GAAG,SAAS,CAAC;YACxB,OAAO,OAAO,CAAC,cAAc,CAAC,CAAC;YAC/B,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,IAAI,kBAAkB;gBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,yEAAyE;QACzE,qEAAqE;QACrE,KAAM,iBAA2B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9D,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC;QACtB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,iBAAiB,GAAG,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAC5D,SAAS,EAAE,CAAC;IACd,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchwork-os",
-  "version": "1.2.0-beta.3.canary.875",
+  "version": "1.2.0-beta.3.canary.877",
   "description": "Your personal AI runtime, local-first. Patchwork OS gives any AI model a consistent set of tools, YAML recipes, a delegation policy with approval queue, and a durable trace memory — all on your machine, all under your policy.",
   "type": "module",
   "main": "dist/index.js",