repoburg 1.3.255 → 1.3.257

package/daemon/dist/tabtape/export/export.spec.js

@@ -0,0 +1,262 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = __importDefault(require("crypto"));
+const zlib_1 = __importDefault(require("zlib"));
+const errors_1 = require("../errors");
+const reader_1 = require("../query/reader");
+const redact_1 = require("../redact");
+const sink_1 = require("../sink");
+const record_1 = require("../store/record");
+const qt = __importStar(require("../testing/querytest"));
+const tmp_1 = require("../testing/tmp");
+const export_1 = require("./export");
+const t0 = qt.T0;
+const assets = { js: "document.title='</script><script>alert(1)';", css: 'body{color:red}</style><b>' };
+afterEach(async () => {
+    await qt.closeTestStores();
+    (0, tmp_1.cleanupTempDirs)();
+});
+async function view(title = 'App </title>') {
+    const st = qt.testStore();
+    qt.start(st, 's1', t0, 'http://app.test/', title);
+    qt.append(st, 's1', qt.rrMeta(t0, 'http://app.test/', 800, 600), qt.rrFull(t0), qt.net(t0 + 1000, {
+        kind: 'fetch',
+        method: 'POST',
+        url: 'http://app.test/login',
+        reqHeaders: { Authorization: 'Bearer test-token', Accept: '*/*' },
+        reqBody: '{"password":"********"}',
+        resBody: '{"ok":true}',
+        status: 200,
+    }), qt.consoleRec(t0 + 2000, { level: 'log', source: 'console', text: 'hello {…}', args: ['hello', { secret: 1 }] }), qt.ws(t0 + 2500, 'ws-1', 'recv', '{"chat":"hi"}'), qt.rrMeta(t0 + 30000, 'http://app.test/', 800, 600), qt.rrFull(t0 + 30000), qt.consoleRec(t0 + 31000, { level: 'log', source: 'console', text: 'after checkout' }), qt.consoleRec(t0 + 60000, { level: 'log', source: 'console', text: 'late' }), qt.rrInc(t0 + 60000));
+    return new reader_1.Reader(st).view('s1');
+}
+const DATA_RE = /<script id="tabtape-data" type="application\/octet-stream">([\s\S]*?)<\/script>/;
+const META_RE = /<script id="tabtape-meta" type="application\/json">([\s\S]*?)<\/script>/;
+/** The embedded recording, decoded like the viewer does: base64, then gunzip. */
+function recording(page) {
+    const m = DATA_RE.exec(page);
+    if (!m)
+        throw new Error(`no data script in:\n${page}`);
+    return zlib_1.default.gunzipSync(Buffer.from(m[1], 'base64')).toString('utf8');
+}
+function meta(page) {
+    const m = META_RE.exec(page);
+    if (!m)
+        throw new Error('no meta script');
+    return JSON.parse(m[1]);
+}
+/** Writes the file with the options the Go tests used; checks the reported size. */
+async function render(o = {}, v) {
+    const out = (0, sink_1.collect)();
+    const n = await (0, export_1.writeExport)(out.sink, v ?? (await view()), assets, {
+        ...o,
+        redact: new redact_1.RedactHeaders(),
+        version: '0.2.0',
+        now: () => t0 + 100000,
+    });
+    const bytes = out.bytes();
+    expect(n).toBe(bytes.length);
+    const page = bytes.toString('utf8');
+    const lines = recording(page)
+        .trim()
+        .split('\n')
+        .map((l) => JSON.parse(l));
+    return { page, lines, meta: meta(page) };
+}
+function find(lines, type) {
+    return lines.filter((l) => l.type === type).map((l) => l.data);
+}
+/** "\uXXXX" as JSON writes it. */
+const u = (hex) => String.fromCharCode(92) + 'u' + hex;
+async function storeText(st, id) {
+    const out = (0, sink_1.collect)();
+    await st.writeSession(id, out.sink);
+    return out.bytes().toString('utf8');
+}
+describe('writeExport', () => {
+    it('hides secrets and escapes the frame by default', async () => {
+        const { page, lines, meta: m } = await render();
+        expect(lines.length).toBe(10);
+        const req = find(lines, 'network')[0];
+        expect(req.reqHeaders.Authorization).toBe(redact_1.REDACTED);
+        expect(req.reqBody).toBeDefined();
+        expect(page).not.toContain('</script><script>alert');
+        expect(page).not.toContain('</style><b>');
+        expect(page).toContain('<title>App &lt;/title&gt; · tabtape recording</title>');
+        expect([m.id, m.version, m.redactedHeaders.length]).toEqual(['s1', '0.2.0', 5]);
+    });
+    it('strips bodies, console arguments and WebSocket data on request', async () => {
+        const { lines, meta: m } = await render({ secrets: true, stripBodies: true, stripConsoleArgs: true });
+        const req = find(lines, 'network')[0];
+        expect(req.reqHeaders.Authorization).toBe('Bearer test-token'); // secrets keep the header
+        expect('reqBody' in req).toBe(false);
+        expect(req.reqBodyNote).toBe('removed from this export');
+        expect(req.resBody).toBeUndefined();
+        for (const c of find(lines, 'console'))
+            expect('args' in c).toBe(false);
+        const ws = find(lines, 'ws')[0];
+        expect([ws.data, ws.dataRemoved, ws.conn]).toEqual([undefined, true, 'ws-1']);
+        expect([m.bodiesRemoved, m.consoleArgsRemoved, 'redactedHeaders' in m]).toEqual([true, true, false]);
+    });
+    it('keeps WebSocket connections that are open during the range', async () => {
+        const st = qt.testStore();
+        qt.append(st, 's1', qt.rrMeta(t0, 'http://app.test/', 800, 600), qt.rrFull(t0), qt.net(t0 + 1000, { id: 'ws-1', kind: 'websocket', method: 'GET', url: 'ws://app.test/live', status: 101, closedAt: t0 + 50000 }), qt.net(t0 + 2000, { id: 'ws-2', kind: 'websocket', method: 'GET', url: 'ws://app.test/short', status: 101, closedAt: t0 + 3000 }), qt.rrMeta(t0 + 30000, 'http://app.test/', 800, 600), qt.rrFull(t0 + 30000), qt.ws(t0 + 41000, 'ws-1', 'recv', '{"price":1}'), qt.rrInc(t0 + 60000));
+        const out = (0, sink_1.collect)();
+        await (0, export_1.writeExport)(out.sink, await new reader_1.Reader(st).view('s1'), assets, { from: 40000, to: 45000, redact: new redact_1.RedactHeaders(), version: '' });
+        const body = recording(out.bytes().toString('utf8'));
+        // The connection open during the range stays (ws-1); the closed one goes (ws-2).
+        expect(body).toContain('"id":"ws-1"');
+        expect(body).not.toContain('"id":"ws-2"');
+        expect(body).toContain('price');
+    });
+    it('starts a range at the snapshot before it', async () => {
+        const { lines, meta: m } = await render({ from: 40000, to: 50000 });
+        expect(find(lines, 'console').map((c) => c.text)).toEqual(['after checkout']);
+        const rr = find(lines, 'rrweb');
+        expect([rr.length, rr[0].type]).toEqual([2, reader_1.RR_META]);
+        expect(m.range).toEqual({ from: 40000, to: 50000 });
+    });
+    it('needs the viewer', async () => {
+        const opts = { redact: new redact_1.RedactHeaders(), version: '' };
+        await expect((0, export_1.writeExport)((0, sink_1.collect)().sink, await view(), { js: '', css: '' }, opts)).rejects.toBeInstanceOf(errors_1.NoViewerError);
+        await expect((0, export_1.writeExport)((0, sink_1.collect)().sink, await view(), { js: Buffer.alloc(0), css: 'x' }, opts)).rejects.toBeInstanceOf(errors_1.NoViewerError);
+    });
+    it('writes meta fields and escapes them like Go', async () => {
+        const ls = String.fromCharCode(0x2028);
+        const title = `</script><b> & "q" ${ls}`;
+        const out = (0, sink_1.collect)();
+        const v = await view(title);
+        await (0, export_1.writeExport)(out.sink, v, assets, { redact: new redact_1.RedactHeaders(''), version: '1.0"<x>', now: () => 42 });
+        const page = out.bytes().toString('utf8');
+        expect(page).toContain(`"title":"${u('003c')}/script${u('003e')}${u('003c')}b${u('003e')} ${u('0026')} \\"q\\" ${u('2028')}"`);
+        expect(page).toContain('<meta name="generator" content="tabtape 1.0&#34;&lt;x&gt;">');
+        expect(page).toContain('<title>&lt;/script&gt;&lt;b&gt; &amp; &#34;q&#34; ');
+        // Field order and omitted fields as with Go's json.Marshal: no redacted
+        // headers to list, no range, nothing removed.
+        expect(Object.keys(meta(page))).toEqual(['id', 'title', 'url', 'startedAt', 'userAgent', 'exportedAt', 'version']);
+        expect(meta(page)).toMatchObject({ id: 's1', title, url: 'http://app.test/', startedAt: t0, userAgent: qt.UA, exportedAt: 42 });
+    });
+    it('escapes closing tags in the assets in any case and keeps their bytes', async () => {
+        const invalidUTF8 = Buffer.from([0xff, 0xfe]);
+        const js = Buffer.concat([invalidUTF8, Buffer.from('a</SCRIPT b</Script c</scriptx d</ſcript e</scrip')]);
+        const out = (0, sink_1.collect)();
+        await (0, export_1.writeExport)(out.sink, await view(), { js, css: 'x</STYLE y</style' }, { redact: new redact_1.RedactHeaders(), version: '' });
+        const page = out.bytes();
+        const want = Buffer.concat([invalidUTF8, Buffer.from('a<\\/SCRIPT b<\\/Script c<\\/scriptx d<\\/ſcript e</scrip')]);
+        expect(page.includes(Buffer.concat([Buffer.from('<script>'), want, Buffer.from('</script>\n</body>\n</html>\n')]))).toBe(true);
+        expect(page.toString('utf8')).toContain('<style>x<\\/STYLE y<\\/style</style>');
+    });
+    it('re-encodes edited lines with the envelope in order', async () => {
+        const st = qt.testStore();
+        const rec = {
+            ts: t0,
+            type: 'network',
+            data: { kind: 'fetch', method: 'GET', url: 'http://app.test/a', reqHeaders: { Authorization: 'x', 'X-Null': null }, resHeaders: 'odd' },
+            extra: 1,
+        };
+        st.append('s1', [(0, record_1.parseRecord)(JSON.stringify(rec))]);
+        const out = (0, sink_1.collect)();
+        await (0, export_1.writeExport)(out.sink, await new reader_1.Reader(st).view('s1'), assets, { redact: new redact_1.RedactHeaders(), version: '' });
+        // Like Go: unknown envelope fields are dropped, a null header becomes "",
+        // and headers that are not a map of strings are left alone.
+        expect(recording(out.bytes().toString('utf8'))).toBe(`{"sid":"s1","ts":${t0},"type":"network","data":{"kind":"fetch","method":"GET","url":"http://app.test/a",` +
+            `"reqHeaders":{"Authorization":"${redact_1.REDACTED}","X-Null":""},"resHeaders":"odd"}}\n`);
+    });
+    it('streams large sessions in chunks, waiting for the sink', async () => {
+        const st = bigSession();
+        const parts = [];
+        let busy = false;
+        let overlapped = false;
+        const sink = (chunk) => {
+            if (busy)
+                overlapped = true;
+            parts.push(Buffer.from(chunk));
+            busy = true;
+            return new Promise((resolve) => setImmediate(() => {
+                busy = false;
+                resolve();
+            }));
+        };
+        const n = await (0, export_1.writeExport)(sink, await new reader_1.Reader(st).view('big'), assets, { secrets: true, redact: new redact_1.RedactHeaders(), version: '' });
+        const page = Buffer.concat(parts);
+        expect(overlapped).toBe(false);
+        expect(n).toBe(page.length);
+        expect(parts.length).toBeGreaterThan(10);
+        // Lines that need no change are kept byte for byte, in file order.
+        expect(recording(page.toString('utf8'))).toBe(await storeText(st, 'big'));
+    });
+    it('reports the same size to a counting sink', async () => {
+        const v = await view();
+        const opts = { redact: new redact_1.RedactHeaders(), version: '0.2.0', now: () => t0 };
+        const out = (0, sink_1.collect)();
+        const c = (0, sink_1.counter)();
+        const n = await (0, export_1.writeExport)(out.sink, v, assets, opts);
+        expect(await (0, export_1.writeExport)(c.sink, v, assets, opts)).toBe(n);
+        expect([c.count(), out.bytes().length]).toEqual([n, n]);
+    });
+    it('passes sink errors through', async () => {
+        const opts = { redact: new redact_1.RedactHeaders(), version: '' };
+        const boom = new Error('client went away');
+        const failOn = (call) => {
+            let calls = 0;
+            return () => (++calls === call ? Promise.reject(boom) : undefined);
+        };
+        const throwing = () => {
+            throw boom;
+        };
+        const big = await new reader_1.Reader(bigSession()).view('big');
+        await expect((0, export_1.writeExport)(failOn(6), big, assets, opts)).rejects.toBe(boom); // while lines are compressed
+        await expect((0, export_1.writeExport)(failOn(4), await view(), assets, opts)).rejects.toBe(boom); // at the end of the data
+        await expect((0, export_1.writeExport)(throwing, await view(), assets, opts)).rejects.toBe(boom);
+    });
+});
+/** Some 1 MB of hardly compressible console lines, and one line bigger than a batch. */
+function bigSession() {
+    const st = qt.testStore();
+    qt.start(st, 'big', t0, 'http://app.test/', 'Big');
+    qt.append(st, 'big', qt.rrMeta(t0, 'http://app.test/', 800, 600), qt.rrFull(t0));
+    for (let i = 0; i < 600; i += 100) {
+        const recs = [];
+        for (let j = 0; j < 100; j++)
+            recs.push(qt.consoleRec(t0 + i + j + 1, { level: 'log', text: crypto_1.default.randomBytes(600).toString('hex') }));
+        qt.append(st, 'big', ...recs);
+    }
+    qt.append(st, 'big', qt.consoleRec(t0 + 10000, { level: 'log', text: crypto_1.default.randomBytes(200000).toString('base64') }));
+    return st;
+}

package/daemon/dist/tabtape/har/gostd.js

@@ -0,0 +1,395 @@
+"use strict";
+/**
+ * Equivalents of the Go standard library functions the Go server's HAR
+ * conversion relied on (Go 1.25: net/http cookie parsing, mime.ParseMediaType,
+ * net/url parsing and unescaping, path.Ext, strings.TrimSpace), so that HAR
+ * files keep coming out the same. Only the parts the conversion uses are
+ * implemented; validity rules follow Go's, including its quirks.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.trimSpace = trimSpace;
+exports.compareStrings = compareStrings;
+exports.parseCookie = parseCookie;
+exports.parseSetCookie = parseSetCookie;
+exports.mediaType = mediaType;
+exports.queryUnescape = queryUnescape;
+exports.parseURL = parseURL;
+exports.pathExt = pathExt;
+/** A 128-entry ASCII membership table. */
+function asciiTable(chars) {
+    const t = new Uint8Array(128);
+    for (let i = 0; i < chars.length; i++)
+        t[chars.charCodeAt(i)] = 1;
+    return t;
+}
+const ALNUM = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
+/** RFC 7230 token characters: Go's httpguts token table, and mime's in Go 1.25 (older versions also took "{" and "}"). */
+const TOKEN = asciiTable(ALNUM + "!#$%&'*+-.^_`|~");
+const isTokenChar = (c) => c < 128 && TOKEN[c] === 1;
+function isToken(s) {
+    if (s === '')
+        return false;
+    for (let i = 0; i < s.length; i++)
+        if (!isTokenChar(s.charCodeAt(i)))
+            return false;
+    return true;
+}
+/** unicode.IsSpace (Unicode White_Space): unlike String.prototype.trim, U+0085 counts and U+FEFF does not. */
+function isSpace(c) {
+    return ((c >= 0x09 && c <= 0x0d) ||
+        c === 0x20 ||
+        c === 0x85 ||
+        c === 0xa0 ||
+        c === 0x1680 ||
+        (c >= 0x2000 && c <= 0x200a) ||
+        c === 0x2028 ||
+        c === 0x2029 ||
+        c === 0x202f ||
+        c === 0x205f ||
+        c === 0x3000);
+}
+/** strings.TrimSpace. */
+function trimSpace(s) {
+    let i = 0;
+    let j = s.length;
+    while (i < j && isSpace(s.charCodeAt(i)))
+        i++;
+    while (j > i && isSpace(s.charCodeAt(j - 1)))
+        j--;
+    return s.slice(i, j);
+}
+function trimLeftSpace(s) {
+    let i = 0;
+    while (i < s.length && isSpace(s.charCodeAt(i)))
+        i++;
+    return s.slice(i);
+}
+/** textproto.TrimString: trims ASCII space, tab, CR and LF only. */
+function trimASCII(s) {
+    const ws = (c) => c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d;
+    let i = 0;
+    let j = s.length;
+    while (i < j && ws(s.charCodeAt(i)))
+        i++;
+    while (j > i && ws(s.charCodeAt(j - 1)))
+        j--;
+    return s.slice(i, j);
+}
+/** Go's string order: by UTF-8 bytes (UTF-16 order differs past U+FFFF). */
+function compareStrings(a, b) {
+    if (a === b)
+        return 0;
+    return Buffer.compare(Buffer.from(a, 'utf8'), Buffer.from(b, 'utf8'));
+}
+// ---------- cookies (net/http) ----------
+/** parseCookieValue: strips one pair of double quotes; null if a byte is not allowed in a cookie value. */
+function cookieValue(raw) {
+    if (raw.length > 1 && raw[0] === '"' && raw[raw.length - 1] === '"')
+        raw = raw.slice(1, -1);
+    for (let i = 0; i < raw.length; i++) {
+        const c = raw.charCodeAt(i);
+        if (c < 0x20 || c >= 0x7f || c === 0x22 /* " */ || c === 0x3b /* ; */ || c === 0x5c /* \ */)
+            return null;
+    }
+    return raw;
+}
+/** http.ParseCookie: the cookies of a Cookie header, or null when any part is malformed. */
+function parseCookie(line) {
+    const parts = trimASCII(line).split(';');
+    if (parts.length === 1 && parts[0] === '')
+        return null;
+    const out = [];
+    for (const part of parts) {
+        const s = trimASCII(part);
+        const eq = s.indexOf('=');
+        if (eq < 0)
+            return null;
+        const name = s.slice(0, eq); // not trimmed, unlike in ParseSetCookie
+        if (!isToken(name))
+            return null;
+        const value = cookieValue(s.slice(eq + 1));
+        if (value === null)
+            return null;
+        out.push({ name, value });
+    }
+    return out;
+}
+/** http.ParseSetCookie, name and value only (its attributes never make it fail); null on a syntax error. */
+function parseSetCookie(line) {
+    const parts = trimASCII(line).split(';');
+    if (parts.length === 1 && parts[0] === '')
+        return null;
+    const first = trimASCII(parts[0]);
+    const eq = first.indexOf('=');
+    if (eq < 0)
+        return null;
+    const name = trimASCII(first.slice(0, eq));
+    if (!isToken(name))
+        return null;
+    const value = cookieValue(first.slice(eq + 1));
+    return value === null ? null : { name, value };
+}
+// ---------- media types (mime) ----------
+const TSPECIALS = '()<>@,;:\\"/[]?=';
+function consumeToken(v) {
+    let i = 0;
+    while (i < v.length && isTokenChar(v.charCodeAt(i)))
+        i++;
+    return [v.slice(0, i), v.slice(i)];
+}
+/** A token or a quoted string; ["", v] on failure. */
+function consumeValue(v) {
+    if (v === '')
+        return ['', ''];
+    if (v[0] !== '"')
+        return consumeToken(v);
+    let out = '';
+    for (let i = 1; i < v.length; i++) {
+        const c = v[i];
+        if (c === '"')
+            return [out, v.slice(i + 1)];
+        // A backslash only escapes tspecials (MSIE sends file paths unescaped).
+        if (c === '\\' && i + 1 < v.length && TSPECIALS.indexOf(v[i + 1]) >= 0) {
+            out += v[i + 1];
+            i++;
+            continue;
+        }
+        if (c === '\r' || c === '\n')
+            return ['', v];
+        out += c;
+    }
+    return ['', v]; // no closing quote
+}
+function consumeMediaParam(v) {
+    let rest = trimLeftSpace(v);
+    if (rest[0] !== ';')
+        return null;
+    rest = trimLeftSpace(rest.slice(1));
+    let key;
+    [key, rest] = consumeToken(rest);
+    key = key.toLowerCase();
+    if (key === '')
+        return null;
+    rest = trimLeftSpace(rest);
+    if (rest[0] !== '=')
+        return null;
+    rest = trimLeftSpace(rest.slice(1));
+    const [value, after] = consumeValue(rest);
+    if (value === '' && after === rest)
+        return null;
+    return { key, value, rest: after };
+}
+/** checkMediaTypeDisposition: "type" or "type/subtype". */
+function validMediaType(s) {
+    const [typ, rest] = consumeToken(s);
+    if (typ === '')
+        return false;
+    if (rest === '')
+        return true;
+    if (rest[0] !== '/')
+        return false;
+    const [subtype, after] = consumeToken(rest.slice(1));
+    return subtype !== '' && after === '';
+}
+/**
+ * The media type mime.ParseMediaType returns, lowercase and without
+ * parameters; null where it returns an error: a malformed type or parameter,
+ * or a parameter repeated with another value.
+ */
+function mediaType(v) {
+    const semi = v.indexOf(';');
+    const base = semi < 0 ? v : v.slice(0, semi);
+    const mt = trimSpace(base.toLowerCase());
+    if (!validMediaType(mt))
+        return null;
+    const params = new Map();
+    // RFC 2231 parts ("name*", "name*0") are kept apart per base name.
+    const continuation = new Map();
+    let rest = v.slice(base.length);
+    while (rest.length > 0) {
+        rest = trimLeftSpace(rest);
+        if (rest.length === 0)
+            break;
+        const p = consumeMediaParam(rest);
+        if (!p) {
+            if (trimSpace(rest) === ';')
+                break; // trailing semicolons are not an error
+            return null;
+        }
+        let pmap = params;
+        const star = p.key.indexOf('*');
+        if (star >= 0) {
+            const baseName = p.key.slice(0, star);
+            let m = continuation.get(baseName);
+            if (!m)
+                continuation.set(baseName, (m = new Map()));
+            pmap = m;
+        }
+        const prev = pmap.get(p.key);
+        if (prev !== undefined && prev !== p.value)
+            return null; // duplicate parameter name
+        pmap.set(p.key, p.value);
+        rest = p.rest;
+    }
+    return mt;
+}
+// ---------- URLs (net/url, path) ----------
+const isHex = (c) => (c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x46) || (c >= 0x61 && c <= 0x66);
+const unhex = (c) => (c <= 0x39 ? c - 0x30 : (c | 0x20) - 0x61 + 10);
+/** Whether s[i] starts a well-formed "%XX" escape. */
+const goodEscape = (s, i) => i + 2 < s.length && isHex(s.charCodeAt(i + 1)) && isHex(s.charCodeAt(i + 2));
+/**
+ * Go's unescape for queries (plusIsSpace), paths and fragments: decodes
+ * "%XX" escapes byte-wise; null when a "%" is not followed by two hex digits.
+ * Decoded bytes that are not UTF-8 become U+FFFD.
+ */
+function unescape(s, plusIsSpace) {
+    let decode = false;
+    for (let i = 0; i < s.length; i++) {
+        const c = s.charCodeAt(i);
+        if (c === 0x25) {
+            if (!goodEscape(s, i))
+                return null;
+            decode = true;
+            i += 2;
+        }
+        else if (c === 0x2b && plusIsSpace) {
+            decode = true;
+        }
+    }
+    if (!decode)
+        return s;
+    const b = Buffer.from(s, 'utf8'); // "%", "+" and hex digits are single bytes
+    const out = Buffer.allocUnsafe(b.length);
+    let n = 0;
+    for (let i = 0; i < b.length; i++) {
+        const c = b[i];
+        if (c === 0x25) {
+            out[n++] = (unhex(b[i + 1]) << 4) | unhex(b[i + 2]);
+            i += 2;
+        }
+        else {
+            out[n++] = c === 0x2b && plusIsSpace ? 0x20 : c;
+        }
+    }
+    return out.toString('utf8', 0, n);
+}
+/** url.QueryUnescape: "%XX" escapes, and "+" is a space; null on a malformed escape. */
+function queryUnescape(s) {
+    return unescape(s, true);
+}
+/** ASCII characters a host may contain unescaped (url.shouldEscape in host mode). */
+const HOST = asciiTable(ALNUM + "!$&'()*+,;=:[]<>\"-_.~");
+const hostChar = (c) => c < 128 && HOST[c] === 1;
+/** Go's unescape in host (or IPv6 zone) mode, as a check: ASCII may not be escaped (but %25), nor written unless allowed. */
+function validHostEscapes(s, zone) {
+    for (let i = 0; i < s.length; i++) {
+        const c = s.charCodeAt(i);
+        if (c === 0x25) {
+            if (!goodEscape(s, i))
+                return false;
+            const hi = unhex(s.charCodeAt(i + 1));
+            const v = (hi << 4) | unhex(s.charCodeAt(i + 2));
+            if (v !== 0x25) {
+                if (!zone && hi < 8)
+                    return false;
+                if (zone && v !== 0x20 && !hostChar(v))
+                    return false;
+            }
+            i += 2;
+        }
+        else if (c < 0x80 && !hostChar(c)) {
+            return false;
+        }
+    }
+    return true;
+}
+const validOptionalPort = (port) => /^(:[0-9]*)?$/.test(port);
+/** parseHost: host[:port], with "[v6]" literals and their %25 zones. */
+function validHost(host) {
+    if (host[0] === '[') {
+        const i = host.lastIndexOf(']');
+        if (i < 0)
+            return false; // missing ']' in host
+        if (!validOptionalPort(host.slice(i + 1)))
+            return false;
+        const zone = host.slice(0, i).indexOf('%25');
+        if (zone >= 0) {
+            return validHostEscapes(host.slice(0, zone), false) && validHostEscapes(host.slice(zone, i), true) && validHostEscapes(host.slice(i), false);
+        }
+    }
+    else {
+        const i = host.lastIndexOf(':');
+        if (i >= 0 && !validOptionalPort(host.slice(i)))
+            return false;
+    }
+    return validHostEscapes(host, false);
+}
+const USERINFO = /^[A-Za-z0-9\-._:~!$&'()*+,;=%@]*$/;
+/** parseAuthority: [userinfo@]host[:port]. */
+function validAuthority(authority) {
+    const at = authority.lastIndexOf('@');
+    if (!validHost(at < 0 ? authority : authority.slice(at + 1)))
+        return false;
+    if (at < 0)
+        return true;
+    const userinfo = authority.slice(0, at);
+    return USERINFO.test(userinfo) && unescape(userinfo, false) !== null;
+}
+const CTL = /[\x00-\x1f\x7f]/;
+const SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*:/;
+/**
+ * url.Parse: null where Go fails (a control character, ":" without a
+ * scheme, a colon in the first segment of a relative path, a malformed host,
+ * port or user info, or a malformed escape in the path or fragment).
+ */
+function parseURL(raw) {
+    const hash = raw.indexOf('#');
+    const parts = parseNoFragment(hash < 0 ? raw : raw.slice(0, hash));
+    if (parts === null)
+        return null;
+    if (hash >= 0 && unescape(raw.slice(hash + 1), false) === null)
+        return null;
+    return parts;
+}
+function parseNoFragment(raw) {
+    if (CTL.test(raw))
+        return null; // invalid control character in URL
+    if (raw === '*')
+        return { scheme: '', rawQuery: '', path: '*' };
+    if (raw[0] === ':')
+        return null; // missing protocol scheme
+    const m = SCHEME.exec(raw);
+    const scheme = m ? m[0].slice(0, -1).toLowerCase() : '';
+    let rest = m ? raw.slice(m[0].length) : raw;
+    let rawQuery = '';
+    const q = rest.indexOf('?');
+    if (q >= 0) {
+        rawQuery = rest.slice(q + 1);
+        rest = rest.slice(0, q);
+    }
+    if (rest[0] !== '/') {
+        if (scheme !== '')
+            return { scheme, rawQuery, path: '' }; // opaque: a rootless path
+        const slash = rest.indexOf('/');
+        if ((slash < 0 ? rest : rest.slice(0, slash)).indexOf(':') >= 0)
+            return null; // first path segment in URL cannot contain colon
+    }
+    if ((scheme !== '' || !rest.startsWith('///')) && rest.startsWith('//')) {
+        const slash = rest.indexOf('/', 2);
+        const authority = slash < 0 ? rest.slice(2) : rest.slice(2, slash);
+        rest = slash < 0 ? '' : rest.slice(slash);
+        if (!validAuthority(authority))
+            return null;
+    }
+    const path = unescape(rest, false);
+    return path === null ? null : { scheme, rawQuery, path };
+}
+/** path.Ext: the suffix from the last "." of the final element, or "". */
+function pathExt(p) {
+    for (let i = p.length - 1; i >= 0 && p[i] !== '/'; i--) {
+        if (p[i] === '.')
+            return p.slice(i);
+    }
+    return '';
+}