tungsten 0.6.3 → 0.7.1

package/vendor/dotenv.js

@@ -6,7 +6,7 @@ const __filename = __tungstenFileURLToPath(import.meta.url);
 const __dirname = __tungstenDirname(__filename);
 import require$$0__default from 'fs';
 import require$$0 from 'path';
-import require$$0$2 from 'os';
+import require$$2 from 'os';
 import require$$0$1 from 'crypto';
 
 var main = {exports: {}};
@@ -22,7 +22,7 @@ function requireMain () {
 	hasRequiredMain = 1;
 	const fs = require$$0__default;
 	const path = require$$0;
-	const os = require$$0$2;
+	const os = require$$2;
 	const crypto = require$$0$1;
 	const packageJson = require$$4;
 

package/vendor/express.js

@@ -4,7 +4,7 @@ import { dirname as __tungstenDirname } from 'node:path';
 const require = __tungstenCreateRequire(import.meta.url);
 const __filename = __tungstenFileURLToPath(import.meta.url);
 const __dirname = __tungstenDirname(__filename);
-import { r as requireSrc, a as requireMs } from './chunk-D2EnpcLg.js';
+import { r as requireSrc, a as requireMs } from './chunk-BGvapINa.js';
 import require$$0$4 from 'path';
 import { c as commonjsGlobal, g as getAugmentedNamespace } from './chunk-BYvDIO7e.js';
 import require$$0$5 from 'buffer';
@@ -17,8 +17,8 @@ import require$$0$7 from 'crypto';
 import require$$0__default from 'fs';
 import require$$5$1 from 'stream';
 import 'tty';
+import './chunk-B34JUlnS.js';
 import 'os';
-import './chunk-Hy-cCmu-.js';
 
 var express$1 = {exports: {}};
 
@@ -32331,6 +32331,13 @@ function requireProxyAddr () {
 	    if (!isip(addr)) return false
 
 	    var ip = parseip(addr);
+
+	    if (ip.kind() === 'ipv6' && ip.isIPv4MappedAddress()) {
+	      // Canonicalize IPv4-mapped candidates to IPv4 so a mapped address
+	      // cannot bypass the cross-family guard via the same-family path
+	      ip = ip.toIPv4Address();
+	    }
+
 	    var ipconv;
 	    var kind = ip.kind();
 
@@ -32347,6 +32354,12 @@ function requireProxyAddr () {
 	          continue
 	        }
 
+	        if (subnetkind !== 'ipv4' && !(subnetrange >= 96 && subnetip.isIPv4MappedAddress())) {
+	          // IPv6 subnet only spans IPv4 when it is a mapped subnet whose
+	          // prefix covers the ::ffff: marker; otherwise it must not match IPv4
+	          continue
+	        }
+
 	        if (!ipconv) {
 	          // Convert IP to match subnet IP kind
 	          ipconv = subnetkind === 'ipv4'
@@ -32355,6 +32368,9 @@ function requireProxyAddr () {
 	        }
 
 	        trusted = ipconv;
+	      } else if (kind === 'ipv6' && subnetip.isIPv4MappedAddress()) {
+	        // A native IPv6 candidate cannot match an IPv4-mapped subnet
+	        continue
 	      }
 
 	      if (trusted.match(subnetip, subnetrange)) {
@@ -32383,6 +32399,13 @@ function requireProxyAddr () {
 	    if (!isip(addr)) return false
 
 	    var ip = parseip(addr);
+
+	    if (ip.kind() === 'ipv6' && ip.isIPv4MappedAddress()) {
+	      // Canonicalize IPv4-mapped candidates to IPv4 so a mapped address
+	      // cannot bypass the cross-family guard via the same-family path
+	      ip = ip.toIPv4Address();
+	    }
+
 	    var kind = ip.kind();
 
 	    if (kind !== subnetkind) {
@@ -32391,10 +32414,19 @@ function requireProxyAddr () {
 	        return false
 	      }
 
+	      if (!subnetisipv4 && !(subnetrange >= 96 && subnetip.isIPv4MappedAddress())) {
+	        // IPv6 subnet only spans IPv4 when it is a mapped subnet whose
+	        // prefix covers the ::ffff: marker; otherwise it must not match IPv4
+	        return false
+	      }
+
 	      // Convert IP to match subnet IP kind
 	      ip = subnetisipv4
 	        ? ip.toIPv4Address()
 	        : ip.toIPv4MappedAddress();
+	    } else if (kind === 'ipv6' && subnetip.isIPv4MappedAddress()) {
+	      // A native IPv6 candidate cannot match an IPv4-mapped subnet
+	      return false
 	    }
 
 	    return ip.match(subnetip, subnetrange)
@@ -36431,16 +36463,21 @@ function requireRangeParser () {
 
 	  // parse all ranges
 	  for (var i = 0; i < arr.length; i++) {
-	    var range = arr[i].split('-');
-	    var start = parseInt(range[0], 10);
-	    var end = parseInt(range[1], 10);
+	    var indexOf = arr[i].indexOf('-');
+	    if (indexOf === -1) {
+	      return -2
+	    }
+
+	    var startStr = arr[i].slice(0, indexOf).trim();
+	    var endStr = arr[i].slice(indexOf + 1).trim();
 
-	    // -nnn
-	    if (isNaN(start)) {
+	    var start = parsePos(startStr);
+	    var end = parsePos(endStr);
+
+	    if (startStr.length === 0) {
 	      start = size - end;
 	      end = size - 1;
-	    // nnn-
-	    } else if (isNaN(end)) {
+	    } else if (endStr.length === 0) {
 	      end = size - 1;
 	    }
 
@@ -36449,8 +36486,12 @@ function requireRangeParser () {
 	      end = size - 1;
 	    }
 
+	    if (isNaN(start) || isNaN(end)) {
+	      return -2
+	    }
+
 	    // invalid or unsatisifiable
-	    if (isNaN(start) || isNaN(end) || start > end || start < 0) {
+	    if (start > end || start < 0) {
 	      continue
 	    }
 
@@ -36471,6 +36512,16 @@ function requireRangeParser () {
 	    : ranges
 	}
 
+	/**
+	 * Parse string to integer.
+	 * @private
+	 */
+
+	function parsePos (str) {
+	  if (/^\d+$/.test(str)) return Number(str)
+	  return NaN
+	}
+
 	/**
 	 * Combine overlapping & adjacent ranges.
 	 * @private

package/vendor/manifest.json

@@ -1,7 +1,7 @@
 {
     "lockfile": {
-        "size": 238795,
-        "mtimeMs": 1789635426367.559
+        "size": 239726,
+        "mtimeMs": 1790613012060.566
     },
     "specifiers": {
         "@babel/core": "babel-core",
@@ -25,6 +25,7 @@
         "sxy-lib/arrays.js": "sxy-lib-arrays",
         "sxy-lib/promises.js": "sxy-lib-promises",
         "sxy-lib-object-copy": "sxy-lib-object-copy",
-        "sxy-package-investigator": "sxy-package-investigator"
+        "sxy-package-investigator": "sxy-package-investigator",
+        "css-select": "css-select"
     }
 }

package/vendor/postcss.js

@@ -4,7 +4,7 @@ import { dirname as __tungstenDirname } from 'node:path';
 const require = __tungstenCreateRequire(import.meta.url);
 const __filename = __tungstenFileURLToPath(import.meta.url);
 const __dirname = __tungstenDirname(__filename);
-export { A as AtRule, C as Comment, a as Container, b as CssSyntaxError, D as Declaration, c as Document, I as Input, N as Node, P as Processor, R as Result, d as Root, e as Rule, W as Warning, f as atRule, g as comment, h as decl, p as default, i as document, j as fromJSON, l as list, k as parse, m as plugin, r as root, n as rule, s as stringify } from './chunk-Cqrj-Zqr.js';
+export { A as AtRule, C as Comment, a as Container, b as CssSyntaxError, D as Declaration, c as Document, I as Input, N as Node, P as Processor, R as Result, d as Root, e as Rule, W as Warning, f as atRule, g as comment, h as decl, p as default, i as document, j as fromJSON, l as list, k as parse, m as plugin, r as root, n as rule, s as stringify } from './chunk-BmAiqUzD.js';
 import './chunk-Lqa6rV_r.js';
 import 'path';
 import 'url';