remoteclaw 0.1.0-next.2abd2fa → 0.1.0-next.2e9a6cd

package/dist/sessions-Bw4LRnSr.js

@@ -1,252 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { Ct as theme, St as isRich, ft as info } from "./entry.js";
-import { C as parseAgentSessionKey, s as normalizeAgentId } from "./session-key-C2n-VILA.js";
-import { i as loadConfig } from "./config-FHu9Bn4R.js";
-import { n as listAgentIds, s as resolveDefaultAgentId } from "./agent-scope-C50VuLKh.js";
-import { G as resolveFreshSessionTotalTokens, l as loadSessionStore } from "./sessions--PykPynp.js";
-import { m as resolveStorePath } from "./chat-envelope-DEZ-5RY8.js";
-import { n as DEFAULT_MODEL, t as DEFAULT_CONTEXT_TOKENS } from "./defaults-B5KStIBg.js";
-import { n as formatTimeAgo } from "./format-relative-CxLpEQOX.js";
-import { l as resolveSessionModelRef, n as classifySessionKey } from "./session-utils-CEtEq6bi.js";
-
-//#region src/commands/session-store-targets.ts
-function dedupeTargetsByStorePath(targets) {
-	const deduped = /* @__PURE__ */ new Map();
-	for (const target of targets) if (!deduped.has(target.storePath)) deduped.set(target.storePath, target);
-	return [...deduped.values()];
-}
-function resolveSessionStoreTargets(cfg, opts) {
-	const defaultAgentId = resolveDefaultAgentId(cfg);
-	const hasAgent = Boolean(opts.agent?.trim());
-	const allAgents = opts.allAgents === true;
-	if (hasAgent && allAgents) throw new Error("--agent and --all-agents cannot be used together");
-	if (opts.store && (hasAgent || allAgents)) throw new Error("--store cannot be combined with --agent or --all-agents");
-	if (opts.store) return [{
-		agentId: defaultAgentId,
-		storePath: resolveStorePath(opts.store, { agentId: defaultAgentId })
-	}];
-	if (allAgents) return dedupeTargetsByStorePath(listAgentIds(cfg).map((agentId) => ({
-		agentId,
-		storePath: resolveStorePath(cfg.session?.store, { agentId })
-	})));
-	if (hasAgent) {
-		const knownAgents = listAgentIds(cfg);
-		const requested = normalizeAgentId(opts.agent ?? "");
-		if (!knownAgents.includes(requested)) throw new Error(`Unknown agent id "${opts.agent}". Use "remoteclaw agents list" to see configured agents.`);
-		return [{
-			agentId: requested,
-			storePath: resolveStorePath(cfg.session?.store, { agentId: requested })
-		}];
-	}
-	return [{
-		agentId: defaultAgentId,
-		storePath: resolveStorePath(cfg.session?.store, { agentId: defaultAgentId })
-	}];
-}
-
-//#endregion
-//#region src/commands/sessions-table.ts
-const SESSION_KEY_PAD = 26;
-const SESSION_AGE_PAD = 9;
-const SESSION_MODEL_PAD = 14;
-function toSessionDisplayRows(store) {
-	return Object.entries(store).map(([key, entry]) => {
-		const updatedAt = entry?.updatedAt ?? null;
-		return {
-			key,
-			updatedAt,
-			ageMs: updatedAt ? Date.now() - updatedAt : null,
-			sessionId: entry?.sessionId,
-			systemSent: entry?.systemSent,
-			abortedLastRun: entry?.abortedLastRun,
-			thinkingLevel: entry?.thinkingLevel,
-			verboseLevel: entry?.verboseLevel,
-			reasoningLevel: entry?.reasoningLevel,
-			elevatedLevel: entry?.elevatedLevel,
-			responseUsage: entry?.responseUsage,
-			groupActivation: entry?.groupActivation,
-			inputTokens: entry?.inputTokens,
-			outputTokens: entry?.outputTokens,
-			totalTokens: entry?.totalTokens,
-			totalTokensFresh: entry?.totalTokensFresh,
-			model: entry?.model,
-			modelProvider: entry?.modelProvider,
-			providerOverride: entry?.providerOverride,
-			modelOverride: entry?.modelOverride,
-			contextTokens: entry?.contextTokens
-		};
-	}).toSorted((a, b) => (b.updatedAt ?? 0) - (a.updatedAt ?? 0));
-}
-function resolveSessionDisplayDefaults(_cfg) {
-	return { model: DEFAULT_MODEL };
-}
-function resolveSessionDisplayModel(cfg, row, defaults) {
-	return resolveSessionModelRef(cfg, row, parseAgentSessionKey(row.key)?.agentId).model ?? defaults.model;
-}
-function truncateSessionKey(key) {
-	if (key.length <= SESSION_KEY_PAD) return key;
-	const head = Math.max(4, SESSION_KEY_PAD - 10);
-	return `${key.slice(0, head)}...${key.slice(-6)}`;
-}
-function formatSessionKeyCell(key, rich) {
-	const label = truncateSessionKey(key).padEnd(SESSION_KEY_PAD);
-	return rich ? theme.accent(label) : label;
-}
-function formatSessionAgeCell(updatedAt, rich) {
-	const padded = (updatedAt ? formatTimeAgo(Date.now() - updatedAt) : "unknown").padEnd(SESSION_AGE_PAD);
-	return rich ? theme.muted(padded) : padded;
-}
-function formatSessionModelCell(model, rich) {
-	const label = (model ?? "unknown").padEnd(SESSION_MODEL_PAD);
-	return rich ? theme.info(label) : label;
-}
-function formatSessionFlagsCell(row, rich) {
-	const label = [
-		row.thinkingLevel ? `think:${row.thinkingLevel}` : null,
-		row.verboseLevel ? `verbose:${row.verboseLevel}` : null,
-		row.reasoningLevel ? `reasoning:${row.reasoningLevel}` : null,
-		row.elevatedLevel ? `elev:${row.elevatedLevel}` : null,
-		row.responseUsage ? `usage:${row.responseUsage}` : null,
-		row.groupActivation ? `activation:${row.groupActivation}` : null,
-		row.systemSent ? "system" : null,
-		row.abortedLastRun ? "aborted" : null,
-		row.sessionId ? `id:${row.sessionId}` : null
-	].filter(Boolean).join(" ");
-	return label.length === 0 ? "" : rich ? theme.muted(label) : label;
-}
-
-//#endregion
-//#region src/commands/sessions.ts
-var sessions_exports = /* @__PURE__ */ __exportAll({ sessionsCommand: () => sessionsCommand });
-const AGENT_PAD = 10;
-const KIND_PAD = 6;
-const TOKENS_PAD = 20;
-const formatKTokens = (value) => `${(value / 1e3).toFixed(value >= 1e4 ? 0 : 1)}k`;
-const colorByPct = (label, pct, rich) => {
-	if (!rich || pct === null) return label;
-	if (pct >= 95) return theme.error(label);
-	if (pct >= 80) return theme.warn(label);
-	if (pct >= 60) return theme.success(label);
-	return theme.muted(label);
-};
-const formatTokensCell = (total, contextTokens, rich) => {
-	if (total === void 0) {
-		const label = `unknown/${contextTokens ? formatKTokens(contextTokens) : "?"} (?%)`;
-		return rich ? theme.muted(label.padEnd(TOKENS_PAD)) : label.padEnd(TOKENS_PAD);
-	}
-	const totalLabel = formatKTokens(total);
-	const ctxLabel = contextTokens ? formatKTokens(contextTokens) : "?";
-	const pct = contextTokens ? Math.min(999, Math.round(total / contextTokens * 100)) : null;
-	return colorByPct(`${totalLabel}/${ctxLabel} (${pct ?? "?"}%)`.padEnd(TOKENS_PAD), pct, rich);
-};
-const formatKindCell = (kind, rich) => {
-	const label = kind.padEnd(KIND_PAD);
-	if (!rich) return label;
-	if (kind === "group") return theme.accentBright(label);
-	if (kind === "global") return theme.warn(label);
-	if (kind === "direct") return theme.accent(label);
-	return theme.muted(label);
-};
-async function sessionsCommand(opts, runtime) {
-	const aggregateAgents = opts.allAgents === true;
-	const cfg = loadConfig();
-	const displayDefaults = resolveSessionDisplayDefaults(cfg);
-	const configContextTokens = cfg.agents?.defaults?.contextTokens ?? DEFAULT_CONTEXT_TOKENS;
-	let targets;
-	try {
-		targets = resolveSessionStoreTargets(cfg, {
-			store: opts.store,
-			agent: opts.agent,
-			allAgents: opts.allAgents
-		});
-	} catch (error) {
-		runtime.error(error instanceof Error ? error.message : String(error));
-		runtime.exit(1);
-		return;
-	}
-	let activeMinutes;
-	if (opts.active !== void 0) {
-		const parsed = Number.parseInt(String(opts.active), 10);
-		if (Number.isNaN(parsed) || parsed <= 0) {
-			runtime.error("--active must be a positive integer (minutes)");
-			runtime.exit(1);
-			return;
-		}
-		activeMinutes = parsed;
-	}
-	const rows = targets.flatMap((target) => {
-		const store = loadSessionStore(target.storePath);
-		return toSessionDisplayRows(store).map((row) => ({
-			...row,
-			agentId: parseAgentSessionKey(row.key)?.agentId ?? target.agentId,
-			kind: classifySessionKey(row.key, store[row.key])
-		}));
-	}).filter((row) => {
-		if (activeMinutes === void 0) return true;
-		if (!row.updatedAt) return false;
-		return Date.now() - row.updatedAt <= activeMinutes * 6e4;
-	}).toSorted((a, b) => (b.updatedAt ?? 0) - (a.updatedAt ?? 0));
-	if (opts.json) {
-		const multi = targets.length > 1;
-		const aggregate = aggregateAgents || multi;
-		runtime.log(JSON.stringify({
-			path: aggregate ? null : targets[0]?.storePath ?? null,
-			stores: aggregate ? targets.map((target) => ({
-				agentId: target.agentId,
-				path: target.storePath
-			})) : void 0,
-			allAgents: aggregateAgents ? true : void 0,
-			count: rows.length,
-			activeMinutes: activeMinutes ?? null,
-			sessions: rows.map((r) => {
-				const model = resolveSessionDisplayModel(cfg, r, displayDefaults);
-				return {
-					...r,
-					totalTokens: resolveFreshSessionTotalTokens(r) ?? null,
-					totalTokensFresh: typeof r.totalTokens === "number" ? r.totalTokensFresh !== false : false,
-					contextTokens: r.contextTokens ?? configContextTokens ?? null,
-					model
-				};
-			})
-		}, null, 2));
-		return;
-	}
-	if (targets.length === 1 && !aggregateAgents) runtime.log(info(`Session store: ${targets[0]?.storePath}`));
-	else runtime.log(info(`Session stores: ${targets.length} (${targets.map((t) => t.agentId).join(", ")})`));
-	runtime.log(info(`Sessions listed: ${rows.length}`));
-	if (activeMinutes) runtime.log(info(`Filtered to last ${activeMinutes} minute(s)`));
-	if (rows.length === 0) {
-		runtime.log("No sessions found.");
-		return;
-	}
-	const rich = isRich();
-	const showAgentColumn = aggregateAgents || targets.length > 1;
-	const header = [
-		...showAgentColumn ? ["Agent".padEnd(AGENT_PAD)] : [],
-		"Kind".padEnd(KIND_PAD),
-		"Key".padEnd(SESSION_KEY_PAD),
-		"Age".padEnd(SESSION_AGE_PAD),
-		"Model".padEnd(SESSION_MODEL_PAD),
-		"Tokens (ctx %)".padEnd(TOKENS_PAD),
-		"Flags"
-	].join(" ");
-	runtime.log(rich ? theme.heading(header) : header);
-	for (const row of rows) {
-		const model = resolveSessionDisplayModel(cfg, row, displayDefaults);
-		const contextTokens = row.contextTokens ?? configContextTokens;
-		const total = resolveFreshSessionTotalTokens(row);
-		const line = [
-			...showAgentColumn ? [rich ? theme.accentBright(row.agentId.padEnd(AGENT_PAD)) : row.agentId.padEnd(AGENT_PAD)] : [],
-			formatKindCell(row.kind, rich),
-			formatSessionKeyCell(row.key, rich),
-			formatSessionAgeCell(row.updatedAt, rich),
-			formatSessionModelCell(model, rich),
-			formatTokensCell(total, contextTokens ?? null, rich),
-			formatSessionFlagsCell(row, rich)
-		].join(" ");
-		runtime.log(line.trimEnd());
-	}
-}
-
-//#endregion
-export { SESSION_MODEL_PAD as a, formatSessionKeyCell as c, resolveSessionDisplayModel as d, toSessionDisplayRows as f, SESSION_KEY_PAD as i, formatSessionModelCell as l, sessions_exports as n, formatSessionAgeCell as o, resolveSessionStoreTargets as p, SESSION_AGE_PAD as r, formatSessionFlagsCell as s, sessionsCommand as t, resolveSessionDisplayDefaults as u };

package/dist/ssrf-Ck9HDZpv.js

@@ -1,183 +0,0 @@
-import { f as parseCanonicalIpAddress, l as isPrivateOrLoopbackIpAddress, n as isBlockedSpecialUseIpv4Address, o as isIpv4Address, p as parseLooseIpAddress, r as isCanonicalDottedDecimalIPv4, s as isLegacyIpv4Literal, t as extractEmbeddedIpv4FromIpv6 } from "./ip-D0zgNmBV.js";
-import { lookup } from "node:dns";
-import { lookup as lookup$1 } from "node:dns/promises";
-import { Agent } from "undici";
-
-//#region src/infra/net/hostname.ts
-function normalizeHostname(hostname) {
-	const normalized = hostname.trim().toLowerCase().replace(/\.$/, "");
-	if (normalized.startsWith("[") && normalized.endsWith("]")) return normalized.slice(1, -1);
-	return normalized;
-}
-
-//#endregion
-//#region src/infra/net/ssrf.ts
-var SsrFBlockedError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "SsrFBlockedError";
-	}
-};
-const BLOCKED_HOSTNAMES = new Set([
-	"localhost",
-	"localhost.localdomain",
-	"metadata.google.internal"
-]);
-function normalizeHostnameSet(values) {
-	if (!values || values.length === 0) return /* @__PURE__ */ new Set();
-	return new Set(values.map((value) => normalizeHostname(value)).filter(Boolean));
-}
-function normalizeHostnameAllowlist(values) {
-	if (!values || values.length === 0) return [];
-	return Array.from(new Set(values.map((value) => normalizeHostname(value)).filter((value) => value !== "*" && value !== "*." && value.length > 0)));
-}
-function resolveAllowPrivateNetwork(policy) {
-	return policy?.dangerouslyAllowPrivateNetwork === true || policy?.allowPrivateNetwork === true;
-}
-function resolveIpv4SpecialUseBlockOptions(policy) {
-	return { allowRfc2544BenchmarkRange: policy?.allowRfc2544BenchmarkRange === true };
-}
-function isHostnameAllowedByPattern(hostname, pattern) {
-	if (pattern.startsWith("*.")) {
-		const suffix = pattern.slice(2);
-		if (!suffix || hostname === suffix) return false;
-		return hostname.endsWith(`.${suffix}`);
-	}
-	return hostname === pattern;
-}
-function matchesHostnameAllowlist(hostname, allowlist) {
-	if (allowlist.length === 0) return true;
-	return allowlist.some((pattern) => isHostnameAllowedByPattern(hostname, pattern));
-}
-function looksLikeUnsupportedIpv4Literal(address) {
-	const parts = address.split(".");
-	if (parts.length === 0 || parts.length > 4) return false;
-	if (parts.some((part) => part.length === 0)) return true;
-	return parts.every((part) => /^[0-9]+$/.test(part) || /^0x/i.test(part));
-}
-function isPrivateIpAddress(address, policy) {
-	let normalized = address.trim().toLowerCase();
-	if (normalized.startsWith("[") && normalized.endsWith("]")) normalized = normalized.slice(1, -1);
-	if (!normalized) return false;
-	const blockOptions = resolveIpv4SpecialUseBlockOptions(policy);
-	const strictIp = parseCanonicalIpAddress(normalized);
-	if (strictIp) {
-		if (isIpv4Address(strictIp)) return isBlockedSpecialUseIpv4Address(strictIp, blockOptions);
-		if (isPrivateOrLoopbackIpAddress(strictIp.toString())) return true;
-		const embeddedIpv4 = extractEmbeddedIpv4FromIpv6(strictIp);
-		if (embeddedIpv4) return isBlockedSpecialUseIpv4Address(embeddedIpv4, blockOptions);
-		return false;
-	}
-	if (normalized.includes(":") && !parseLooseIpAddress(normalized)) return true;
-	if (!isCanonicalDottedDecimalIPv4(normalized) && isLegacyIpv4Literal(normalized)) return true;
-	if (looksLikeUnsupportedIpv4Literal(normalized)) return true;
-	return false;
-}
-function isBlockedHostnameNormalized(normalized) {
-	if (BLOCKED_HOSTNAMES.has(normalized)) return true;
-	return normalized.endsWith(".localhost") || normalized.endsWith(".local") || normalized.endsWith(".internal");
-}
-function isBlockedHostnameOrIp(hostname, policy) {
-	const normalized = normalizeHostname(hostname);
-	if (!normalized) return false;
-	return isBlockedHostnameNormalized(normalized) || isPrivateIpAddress(normalized, policy);
-}
-const BLOCKED_HOST_OR_IP_MESSAGE = "Blocked hostname or private/internal/special-use IP address";
-const BLOCKED_RESOLVED_IP_MESSAGE = "Blocked: resolves to private/internal/special-use IP address";
-function assertAllowedHostOrIpOrThrow(hostnameOrIp, policy) {
-	if (isBlockedHostnameOrIp(hostnameOrIp, policy)) throw new SsrFBlockedError(BLOCKED_HOST_OR_IP_MESSAGE);
-}
-function assertAllowedResolvedAddressesOrThrow(results, policy) {
-	for (const entry of results) if (isBlockedHostnameOrIp(entry.address, policy)) throw new SsrFBlockedError(BLOCKED_RESOLVED_IP_MESSAGE);
-}
-function createPinnedLookup(params) {
-	const normalizedHost = normalizeHostname(params.hostname);
-	const fallback = params.fallback ?? lookup;
-	const fallbackLookup = fallback;
-	const fallbackWithOptions = fallback;
-	const records = params.addresses.map((address) => ({
-		address,
-		family: address.includes(":") ? 6 : 4
-	}));
-	let index = 0;
-	return ((host, options, callback) => {
-		const cb = typeof options === "function" ? options : callback;
-		if (!cb) return;
-		const normalized = normalizeHostname(host);
-		if (!normalized || normalized !== normalizedHost) {
-			if (typeof options === "function" || options === void 0) return fallbackLookup(host, cb);
-			return fallbackWithOptions(host, options, cb);
-		}
-		const opts = typeof options === "object" && options !== null ? options : {};
-		const requestedFamily = typeof options === "number" ? options : typeof opts.family === "number" ? opts.family : 0;
-		const candidates = requestedFamily === 4 || requestedFamily === 6 ? records.filter((entry) => entry.family === requestedFamily) : records;
-		const usable = candidates.length > 0 ? candidates : records;
-		if (opts.all) {
-			cb(null, usable);
-			return;
-		}
-		const chosen = usable[index % usable.length];
-		index += 1;
-		cb(null, chosen.address, chosen.family);
-	});
-}
-function dedupeAndPreferIpv4(results) {
-	const seen = /* @__PURE__ */ new Set();
-	const ipv4 = [];
-	const otherFamilies = [];
-	for (const entry of results) {
-		if (seen.has(entry.address)) continue;
-		seen.add(entry.address);
-		if (entry.family === 4) {
-			ipv4.push(entry.address);
-			continue;
-		}
-		otherFamilies.push(entry.address);
-	}
-	return [...ipv4, ...otherFamilies];
-}
-async function resolvePinnedHostnameWithPolicy(hostname, params = {}) {
-	const normalized = normalizeHostname(hostname);
-	if (!normalized) throw new Error("Invalid hostname");
-	const allowPrivateNetwork = resolveAllowPrivateNetwork(params.policy);
-	const allowedHostnames = normalizeHostnameSet(params.policy?.allowedHostnames);
-	const hostnameAllowlist = normalizeHostnameAllowlist(params.policy?.hostnameAllowlist);
-	const isExplicitAllowed = allowedHostnames.has(normalized);
-	const skipPrivateNetworkChecks = allowPrivateNetwork || isExplicitAllowed;
-	if (!matchesHostnameAllowlist(normalized, hostnameAllowlist)) throw new SsrFBlockedError(`Blocked hostname (not in allowlist): ${hostname}`);
-	if (!skipPrivateNetworkChecks) assertAllowedHostOrIpOrThrow(normalized, params.policy);
-	const results = await (params.lookupFn ?? lookup$1)(normalized, { all: true });
-	if (results.length === 0) throw new Error(`Unable to resolve hostname: ${hostname}`);
-	if (!skipPrivateNetworkChecks) assertAllowedResolvedAddressesOrThrow(results, params.policy);
-	const addresses = dedupeAndPreferIpv4(results);
-	if (addresses.length === 0) throw new Error(`Unable to resolve hostname: ${hostname}`);
-	return {
-		hostname: normalized,
-		addresses,
-		lookup: createPinnedLookup({
-			hostname: normalized,
-			addresses
-		})
-	};
-}
-function createPinnedDispatcher(pinned) {
-	return new Agent({ connect: {
-		lookup: pinned.lookup,
-		autoSelectFamily: true,
-		autoSelectFamilyAttemptTimeout: 300
-	} });
-}
-async function closeDispatcher(dispatcher) {
-	if (!dispatcher) return;
-	const candidate = dispatcher;
-	try {
-		if (typeof candidate.close === "function") {
-			await candidate.close();
-			return;
-		}
-		if (typeof candidate.destroy === "function") candidate.destroy();
-	} catch {}
-}
-
-//#endregion
-export { resolvePinnedHostnameWithPolicy as a, isBlockedHostnameOrIp as i, closeDispatcher as n, normalizeHostname as o, createPinnedDispatcher as r, SsrFBlockedError as t };

package/dist/ssrf-m7kFIobZ.js

@@ -1,183 +0,0 @@
-import { f as parseCanonicalIpAddress, l as isPrivateOrLoopbackIpAddress, n as isBlockedSpecialUseIpv4Address, o as isIpv4Address, p as parseLooseIpAddress, r as isCanonicalDottedDecimalIPv4, s as isLegacyIpv4Literal, t as extractEmbeddedIpv4FromIpv6 } from "./ip-C9q3Oq20.js";
-import { lookup } from "node:dns";
-import { lookup as lookup$1 } from "node:dns/promises";
-import { Agent } from "undici";
-
-//#region src/infra/net/hostname.ts
-function normalizeHostname(hostname) {
-	const normalized = hostname.trim().toLowerCase().replace(/\.$/, "");
-	if (normalized.startsWith("[") && normalized.endsWith("]")) return normalized.slice(1, -1);
-	return normalized;
-}
-
-//#endregion
-//#region src/infra/net/ssrf.ts
-var SsrFBlockedError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "SsrFBlockedError";
-	}
-};
-const BLOCKED_HOSTNAMES = new Set([
-	"localhost",
-	"localhost.localdomain",
-	"metadata.google.internal"
-]);
-function normalizeHostnameSet(values) {
-	if (!values || values.length === 0) return /* @__PURE__ */ new Set();
-	return new Set(values.map((value) => normalizeHostname(value)).filter(Boolean));
-}
-function normalizeHostnameAllowlist(values) {
-	if (!values || values.length === 0) return [];
-	return Array.from(new Set(values.map((value) => normalizeHostname(value)).filter((value) => value !== "*" && value !== "*." && value.length > 0)));
-}
-function resolveAllowPrivateNetwork(policy) {
-	return policy?.dangerouslyAllowPrivateNetwork === true || policy?.allowPrivateNetwork === true;
-}
-function resolveIpv4SpecialUseBlockOptions(policy) {
-	return { allowRfc2544BenchmarkRange: policy?.allowRfc2544BenchmarkRange === true };
-}
-function isHostnameAllowedByPattern(hostname, pattern) {
-	if (pattern.startsWith("*.")) {
-		const suffix = pattern.slice(2);
-		if (!suffix || hostname === suffix) return false;
-		return hostname.endsWith(`.${suffix}`);
-	}
-	return hostname === pattern;
-}
-function matchesHostnameAllowlist(hostname, allowlist) {
-	if (allowlist.length === 0) return true;
-	return allowlist.some((pattern) => isHostnameAllowedByPattern(hostname, pattern));
-}
-function looksLikeUnsupportedIpv4Literal(address) {
-	const parts = address.split(".");
-	if (parts.length === 0 || parts.length > 4) return false;
-	if (parts.some((part) => part.length === 0)) return true;
-	return parts.every((part) => /^[0-9]+$/.test(part) || /^0x/i.test(part));
-}
-function isPrivateIpAddress(address, policy) {
-	let normalized = address.trim().toLowerCase();
-	if (normalized.startsWith("[") && normalized.endsWith("]")) normalized = normalized.slice(1, -1);
-	if (!normalized) return false;
-	const blockOptions = resolveIpv4SpecialUseBlockOptions(policy);
-	const strictIp = parseCanonicalIpAddress(normalized);
-	if (strictIp) {
-		if (isIpv4Address(strictIp)) return isBlockedSpecialUseIpv4Address(strictIp, blockOptions);
-		if (isPrivateOrLoopbackIpAddress(strictIp.toString())) return true;
-		const embeddedIpv4 = extractEmbeddedIpv4FromIpv6(strictIp);
-		if (embeddedIpv4) return isBlockedSpecialUseIpv4Address(embeddedIpv4, blockOptions);
-		return false;
-	}
-	if (normalized.includes(":") && !parseLooseIpAddress(normalized)) return true;
-	if (!isCanonicalDottedDecimalIPv4(normalized) && isLegacyIpv4Literal(normalized)) return true;
-	if (looksLikeUnsupportedIpv4Literal(normalized)) return true;
-	return false;
-}
-function isBlockedHostnameNormalized(normalized) {
-	if (BLOCKED_HOSTNAMES.has(normalized)) return true;
-	return normalized.endsWith(".localhost") || normalized.endsWith(".local") || normalized.endsWith(".internal");
-}
-function isBlockedHostnameOrIp(hostname, policy) {
-	const normalized = normalizeHostname(hostname);
-	if (!normalized) return false;
-	return isBlockedHostnameNormalized(normalized) || isPrivateIpAddress(normalized, policy);
-}
-const BLOCKED_HOST_OR_IP_MESSAGE = "Blocked hostname or private/internal/special-use IP address";
-const BLOCKED_RESOLVED_IP_MESSAGE = "Blocked: resolves to private/internal/special-use IP address";
-function assertAllowedHostOrIpOrThrow(hostnameOrIp, policy) {
-	if (isBlockedHostnameOrIp(hostnameOrIp, policy)) throw new SsrFBlockedError(BLOCKED_HOST_OR_IP_MESSAGE);
-}
-function assertAllowedResolvedAddressesOrThrow(results, policy) {
-	for (const entry of results) if (isBlockedHostnameOrIp(entry.address, policy)) throw new SsrFBlockedError(BLOCKED_RESOLVED_IP_MESSAGE);
-}
-function createPinnedLookup(params) {
-	const normalizedHost = normalizeHostname(params.hostname);
-	const fallback = params.fallback ?? lookup;
-	const fallbackLookup = fallback;
-	const fallbackWithOptions = fallback;
-	const records = params.addresses.map((address) => ({
-		address,
-		family: address.includes(":") ? 6 : 4
-	}));
-	let index = 0;
-	return ((host, options, callback) => {
-		const cb = typeof options === "function" ? options : callback;
-		if (!cb) return;
-		const normalized = normalizeHostname(host);
-		if (!normalized || normalized !== normalizedHost) {
-			if (typeof options === "function" || options === void 0) return fallbackLookup(host, cb);
-			return fallbackWithOptions(host, options, cb);
-		}
-		const opts = typeof options === "object" && options !== null ? options : {};
-		const requestedFamily = typeof options === "number" ? options : typeof opts.family === "number" ? opts.family : 0;
-		const candidates = requestedFamily === 4 || requestedFamily === 6 ? records.filter((entry) => entry.family === requestedFamily) : records;
-		const usable = candidates.length > 0 ? candidates : records;
-		if (opts.all) {
-			cb(null, usable);
-			return;
-		}
-		const chosen = usable[index % usable.length];
-		index += 1;
-		cb(null, chosen.address, chosen.family);
-	});
-}
-function dedupeAndPreferIpv4(results) {
-	const seen = /* @__PURE__ */ new Set();
-	const ipv4 = [];
-	const otherFamilies = [];
-	for (const entry of results) {
-		if (seen.has(entry.address)) continue;
-		seen.add(entry.address);
-		if (entry.family === 4) {
-			ipv4.push(entry.address);
-			continue;
-		}
-		otherFamilies.push(entry.address);
-	}
-	return [...ipv4, ...otherFamilies];
-}
-async function resolvePinnedHostnameWithPolicy(hostname, params = {}) {
-	const normalized = normalizeHostname(hostname);
-	if (!normalized) throw new Error("Invalid hostname");
-	const allowPrivateNetwork = resolveAllowPrivateNetwork(params.policy);
-	const allowedHostnames = normalizeHostnameSet(params.policy?.allowedHostnames);
-	const hostnameAllowlist = normalizeHostnameAllowlist(params.policy?.hostnameAllowlist);
-	const isExplicitAllowed = allowedHostnames.has(normalized);
-	const skipPrivateNetworkChecks = allowPrivateNetwork || isExplicitAllowed;
-	if (!matchesHostnameAllowlist(normalized, hostnameAllowlist)) throw new SsrFBlockedError(`Blocked hostname (not in allowlist): ${hostname}`);
-	if (!skipPrivateNetworkChecks) assertAllowedHostOrIpOrThrow(normalized, params.policy);
-	const results = await (params.lookupFn ?? lookup$1)(normalized, { all: true });
-	if (results.length === 0) throw new Error(`Unable to resolve hostname: ${hostname}`);
-	if (!skipPrivateNetworkChecks) assertAllowedResolvedAddressesOrThrow(results, params.policy);
-	const addresses = dedupeAndPreferIpv4(results);
-	if (addresses.length === 0) throw new Error(`Unable to resolve hostname: ${hostname}`);
-	return {
-		hostname: normalized,
-		addresses,
-		lookup: createPinnedLookup({
-			hostname: normalized,
-			addresses
-		})
-	};
-}
-function createPinnedDispatcher(pinned) {
-	return new Agent({ connect: {
-		lookup: pinned.lookup,
-		autoSelectFamily: true,
-		autoSelectFamilyAttemptTimeout: 300
-	} });
-}
-async function closeDispatcher(dispatcher) {
-	if (!dispatcher) return;
-	const candidate = dispatcher;
-	try {
-		if (typeof candidate.close === "function") {
-			await candidate.close();
-			return;
-		}
-		if (typeof candidate.destroy === "function") candidate.destroy();
-	} catch {}
-}
-
-//#endregion
-export { resolvePinnedHostnameWithPolicy as a, isBlockedHostnameOrIp as i, closeDispatcher as n, normalizeHostname as o, createPinnedDispatcher as r, SsrFBlockedError as t };