@capybara-hq/kernel 0.0.0-stage → 0.1.0-rc.0

package/dist/models/purposes.js

@@ -0,0 +1,267 @@
+import { sanitizeParams, } from "@capybara-hq/plugin-sdk";
+import { z } from "zod";
+import { paramIssues } from "../agents/agents.service.js";
+import { ModelRef } from "../agents/definition.js";
+import { ApiError } from "../errors.js";
+import { audit } from "../identity/audit.js";
+import { lockEnterpriseAdminsAndAuthorize } from "../identity/enterprise-admin.js";
+import { lockOrgAndAuthorize } from "../orgs/org-lock.js";
+import { estimateTokens } from "../runtime/context/tokens.js";
+import { consumeModelStream } from "../runtime/model-call.js";
+import { ProviderListError } from "../runtime/providers.js";
+/**
+ * 模型用途映射（C9）：内核与插件按「用途」取模型，不在代码里写死模型。
+ * - 用途 = 内核用途 {@link KERNEL_PURPOSES}（目前只有评委 `eval`），或已加载插件 `permissions.models` 声明的；
+ * - 映射 = 部署默认（`org_id` 为 null，企业管理员设）+ 组织覆盖（组织管理员设，`org.models.manage`）；
+ *   生效的映射先取组织覆盖、再取部署默认，都没有 → `model.unconfigured`；
+ * - 目标模型按部署范围解析（与运行时一致），参数按目标模型自己的声明严格校验；不做模型白名单；
+ * - 每次都查 PG，不在进程内缓存（多副本下改映射立即生效）。`ctx.models` 仍预留，插件暂不能调用。
+ */
+/**
+ * Purposes the kernel declares: the eval judge, and the three sub-agent model tiers (phase C,
+ * spec §5.4: `fast` / `standard` / `capable` → `subagent_<tier>`; an unmapped tier runs on the
+ * parent's model).
+ */
+export const KERNEL_PURPOSES = [
+    { purpose: "eval", kind: "chat", label: { zh: "评测评委", en: "Eval judge" } },
+    /** Conversation titles (UI refresh B); unmapped → the conversation's current chat model. */
+    { purpose: "title", kind: "chat", label: { zh: "会话标题", en: "Conversation titles" } },
+    {
+        purpose: "subagent_fast",
+        kind: "chat",
+        label: { zh: "子代理：快速", en: "Sub-agent: fast" },
+    },
+    {
+        purpose: "subagent_standard",
+        kind: "chat",
+        label: { zh: "子代理：标准", en: "Sub-agent: standard" },
+    },
+    {
+        purpose: "subagent_capable",
+        kind: "chat",
+        label: { zh: "子代理：最强", en: "Sub-agent: capable" },
+    },
+];
+/** `PUT …/model-purposes/:purpose` 的 body：设映射，或 `target: null` 清除。 */
+export const PURPOSE_PUT = z
+    .object({
+    target: z
+        .object({
+        model: ModelRef.strict(),
+        params: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
+    })
+        .strict()
+        .nullable(),
+})
+    .strict();
+/**
+ * 用途请求已经发出、但没有正常收完（出错、超时、中止）：`tokens` 是应计入预算的估算用量（输入估算 + 已流出字符 / 4，
+ * 与评测回放一致），`cause` 是原始错误。请求发出之前的失败（未映射、模型不可用）原样抛出。
+ */
+export class PurposeAttemptError extends Error {
+    cause;
+    tokens;
+    provider;
+    model;
+    constructor(cause, tokens, provider, model) {
+        super(cause instanceof Error ? cause.message : String(cause), { cause });
+        this.cause = cause;
+        this.tokens = tokens;
+        this.provider = provider;
+        this.model = model;
+        this.name = "PurposeAttemptError";
+    }
+}
+const unknownPurpose = (purpose) => new ApiError("model.purpose_unknown", `Unknown model purpose "${purpose}"`);
+const invalid = (details) => new ApiError("validation_failed", "Invalid purpose target", details);
+const targetOf = (r) => r === undefined
+    ? null
+    : {
+        model: { provider: r.provider, model: r.model },
+        params: (r.params ?? {}),
+    };
+export class ModelPurposesService {
+    d;
+    constructor(d) {
+        this.d = d;
+    }
+    /** 全部已声明的用途：内核的在前，其后按插件加载顺序。 */
+    declared() {
+        const out = KERNEL_PURPOSES.map((p) => ({
+            purpose: p.purpose,
+            kind: p.kind,
+            label: { ...p.label },
+            declaredBy: "kernel",
+        }));
+        const seen = new Set(out.map((p) => p.purpose));
+        for (const m of this.d.manifests()) {
+            for (const p of m.permissions?.models ?? []) {
+                if (seen.has(p.purpose))
+                    continue;
+                seen.add(p.purpose);
+                out.push({
+                    purpose: p.purpose,
+                    kind: p.kind,
+                    label: { zh: p.label.zh, en: p.label.en },
+                    declaredBy: m.name,
+                });
+            }
+        }
+        return out;
+    }
+    find(purpose) {
+        const p = this.declared().find((x) => x.purpose === purpose);
+        if (!p)
+            throw unknownPurpose(purpose);
+        return p;
+    }
+    async rows(purposes, orgId) {
+        if (purposes.length === 0)
+            return [];
+        return this.d.db
+            .selectFrom("model_purpose_mappings")
+            .select(["org_id", "purpose", "provider", "model", "params"])
+            .where("purpose", "in", purposes)
+            .where((eb) => orgId === undefined
+            ? eb("org_id", "is", null)
+            : eb.or([eb("org_id", "is", null), eb("org_id", "=", orgId)]))
+            .execute();
+    }
+    async views(decl, orgId) {
+        const rows = await this.rows(decl.map((p) => p.purpose), orgId);
+        return decl.map((p) => {
+            const def = targetOf(rows.find((r) => r.purpose === p.purpose && r.org_id === null));
+            const ovr = orgId === undefined
+                ? null
+                : targetOf(rows.find((r) => r.purpose === p.purpose && r.org_id === orgId));
+            return { ...p, default: def, override: ovr, effective: ovr ?? def };
+        });
+    }
+    /** 全部用途与映射；不给 `orgId` = 部署级视图（`override` 一律为 null）。 */
+    async list(orgId) {
+        return this.views(this.declared(), orgId);
+    }
+    /** 校验目标：模型可解析（部署范围）、参数按它的声明严格通过。 */
+    async check(target) {
+        let info;
+        try {
+            ({ info } = await this.d.registry.resolve(target.model));
+        }
+        catch (e) {
+            if (e instanceof ProviderListError)
+                throw e;
+            if (e instanceof ApiError && e.code === "agent.model_unavailable") {
+                throw invalid([{ path: "target.model", message: "model is not available" }]);
+            }
+            throw e;
+        }
+        const issues = paramIssues("target.params", info.parameters, target.params);
+        if (issues.length > 0)
+            throw invalid(issues);
+    }
+    async set(orgId, purpose, target, actor, actorTokenId) {
+        const decl = this.find(purpose);
+        if (target)
+            await this.check(target);
+        await this.d.db.transaction().execute(async (trx) => {
+            if (orgId === null)
+                await lockEnterpriseAdminsAndAuthorize(trx, actor);
+            else
+                await lockOrgAndAuthorize(trx, orgId, actor, "org.models.manage");
+            if (target === null) {
+                await trx
+                    .deleteFrom("model_purpose_mappings")
+                    .where("purpose", "=", purpose)
+                    .where((eb) => (orgId === null ? eb("org_id", "is", null) : eb("org_id", "=", orgId)))
+                    .execute();
+            }
+            else {
+                const values = {
+                    provider: target.model.provider,
+                    model: target.model.model,
+                    params: JSON.stringify(target.params),
+                    updated_by: actor,
+                };
+                await trx
+                    .insertInto("model_purpose_mappings")
+                    .values({ org_id: orgId, purpose, ...values })
+                    .onConflict((oc) => oc
+                    .constraint("model_purpose_mappings_scope_key")
+                    .doUpdateSet({ ...values, updated_at: new Date() }))
+                    .execute();
+            }
+            await audit(trx, {
+                actorAccountId: actor,
+                ...(actorTokenId !== undefined && { actorTokenId }),
+                ...(orgId !== null && { orgId }),
+                action: "model.purpose_mapped",
+                target: purpose,
+                detail: { scope: orgId === null ? "deployment" : "org", target },
+            });
+        });
+        const [view] = await this.views([decl], orgId ?? undefined);
+        return view;
+    }
+    /** 设置（或 `null` 清除）部署默认；只有企业管理员（事务内复核）。 */
+    setDefault(purpose, target, actor, actorTokenId) {
+        return this.set(null, purpose, target, actor, actorTokenId);
+    }
+    /** 设置（或 `null` 清除）组织覆盖；事务内锁组织并复核 `org.models.manage`。 */
+    setOrg(orgId, purpose, target, actor, actorTokenId) {
+        return this.set(orgId, purpose, target, actor, actorTokenId);
+    }
+    /** 生效的映射：组织覆盖，否则部署默认；都没有 → `model.unconfigured`；用途未声明 → `model.purpose_unknown`。 */
+    async resolve(orgId, purpose) {
+        const [view] = await this.views([this.find(purpose)], orgId);
+        if (!view?.effective) {
+            throw new ApiError("model.unconfigured", `No model is configured for the "${purpose}" purpose`);
+        }
+        return view.effective;
+    }
+    /**
+     * 按用途发一次对话请求：解析映射、按目标模型的声明宽松处理参数（补默认值，与运行时一致），用 `consumeModelStream`
+     * 收完（只有流空闲看门狗）。输出上限取 `min(req.maxOutputTokens, 目标模型的 maxOutputTokens)`。
+     * 请求发出之前的失败原样抛出；发出之后的失败包成 {@link PurposeAttemptError}（带估算用量）。
+     * `opts.fallback`: the target used when the purpose is not mapped (`model.unconfigured`).
+     * `opts.beforeSend`: called with the resolved target and the final request just before sending;
+     * what it throws is thrown as is (a pre-send failure, e.g. a denied `model.request` hook).
+     */
+    async chat(orgId, purpose, req, signal, opts = {}) {
+        let target;
+        try {
+            target = await this.resolve(orgId, purpose);
+        }
+        catch (e) {
+            if (!(e instanceof ApiError && e.code === "model.unconfigured") || !opts.fallback)
+                throw e;
+            target = opts.fallback;
+        }
+        const { provider, info } = await this.d.registry.resolve(target.model);
+        const request = {
+            ...req,
+            model: info.id,
+            params: sanitizeParams(info.parameters, target.params).value,
+            // 输出上限不超过目标模型自己的上限（与运行时 assembleModelRequest 一致）
+            maxOutputTokens: Math.min(req.maxOutputTokens, info.maxOutputTokens),
+        };
+        const idleMs = info.streamIdleTimeoutMs ?? this.d.config().runtime.streamIdleMs;
+        await opts.beforeSend?.(target.model, request);
+        let chars = 0;
+        try {
+            const out = await consumeModelStream(provider, request, idleMs, signal, (ev) => {
+                chars += ev.text.length;
+            });
+            return {
+                content: out.content,
+                stopReason: out.stopReason,
+                usage: out.usage,
+                provider: target.model.provider,
+                model: target.model.model,
+            };
+        }
+        catch (err) {
+            const tokens = estimateTokens(request.messages, request.system, request.tools) + Math.ceil(chars / 4);
+            throw new PurposeAttemptError(err, tokens, target.model.provider, target.model.model);
+        }
+    }
+}

package/dist/net/proxy.d.ts

@@ -0,0 +1,44 @@
+import { Agent } from "undici";
+/**
+ * Tunneling untrusted downloads through an HTTP(S) egress proxy with `CONNECT` (`net.httpsProxy`).
+ *
+ * Behind a proxy the kernel does not resolve the target: the proxy does, and the kernel's own DNS
+ * may answer fake or internal addresses (e.g. a fake-IP resolver answering 198.18.0.0/15) that say
+ * nothing about where the proxy connects. `safeFetch` therefore checks only the hostname rules
+ * (IP-literal targets against the private ranges and `allowPrivateHosts`; `allowedHosts` is checked
+ * by the callers on the hostname) and leaves SSRF protection for resolved addresses to the proxy.
+ *
+ * The proxy URL may carry credentials (`http://user:pass@proxy:3128`, sent as Basic
+ * `Proxy-Authorization`); they never appear in errors or logs: messages name the proxy by host and
+ * port only ({@link proxyLabel}).
+ */
+/** The egress proxy part of a `NetPolicy`. */
+export type NetProxy = {
+    /** `http://` or `https://` proxy URL, optionally with `user:password@`. */
+    url: string;
+    /** Hostnames that bypass the proxy (an entry also matches its subdomains). */
+    noProxy: string[];
+};
+/** Why a `net.httpsProxy` value is refused (English, never echoing the value), or undefined. */
+export declare function proxyUrlProblem(value: string): string | undefined;
+/** Why a `net.noProxy` entry is refused, or undefined: a hostname (optionally `.`-prefixed) or IP. */
+export declare function noProxyEntryProblem(entry: string): string | undefined;
+/** Whether `host` bypasses the proxy: equal to a `noProxy` entry or a subdomain of one. */
+export declare function bypassesProxy(host: string, noProxy: readonly string[]): boolean;
+/** The proxy as `host:port`, for messages: never its credentials. */
+export declare function proxyLabel(proxy: URL): string;
+/**
+ * TLS trust overrides (tests): `ca` for the target, `proxyCa` for an https proxy; and the tunnel
+ * deadline (tests; default 10 s).
+ */
+export type ProxyTls = {
+    ca?: string | string[];
+    proxyCa?: string | string[];
+    tunnelTimeoutMs?: number;
+};
+/**
+ * An undici dispatcher that reaches every https origin through a `CONNECT` tunnel on `proxyUrl`,
+ * then speaks TLS to the target over it (SNI and certificate checks for the target's hostname).
+ * The target is never resolved locally. One agent per download, like `pinnedAgent`.
+ */
+export declare function proxyAgent(proxyUrl: string, tls?: ProxyTls): Agent;

package/dist/net/proxy.js

@@ -0,0 +1,162 @@
+import { isIP } from "node:net";
+import { Agent, buildConnector } from "undici";
+import { NetDeniedError, normalizeHost } from "./public-address.js";
+/**
+ * How long opening the tunnel may take in total: connecting to the proxy plus its whole `CONNECT`
+ * answer. One deadline, not an idle timeout, so a proxy trickling bytes cannot hold a download open.
+ */
+const TUNNEL_TIMEOUT_MS = 10_000;
+/** The largest `CONNECT` response head accepted from the proxy. */
+const MAX_RESPONSE_HEAD = 16 * 1024;
+/** Why a `net.httpsProxy` value is refused (English, never echoing the value), or undefined. */
+export function proxyUrlProblem(value) {
+    let u;
+    try {
+        u = new URL(value);
+    }
+    catch {
+        return "must be an http:// or https:// URL such as http://proxy.internal:3128";
+    }
+    if (u.protocol !== "http:" && u.protocol !== "https:") {
+        return "must be an http:// or https:// URL (other proxy protocols are not supported)";
+    }
+    if ((u.pathname !== "" && u.pathname !== "/") || u.search !== "" || u.hash !== "") {
+        return "must not have a path, query or fragment";
+    }
+    try {
+        // proxyAgent decodes them for Basic auth; a bad escape (`%zz`) would throw on every download
+        decodeURIComponent(u.username);
+        decodeURIComponent(u.password);
+    }
+    catch {
+        return "the user name or password is not valid percent-encoding";
+    }
+    return undefined;
+}
+const HOSTNAME_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+/** Why a `net.noProxy` entry is refused, or undefined: a hostname (optionally `.`-prefixed) or IP. */
+export function noProxyEntryProblem(entry) {
+    const e = entry.startsWith(".") ? entry.slice(1) : entry;
+    if (isIP(e) !== 0 || HOSTNAME_RE.test(e))
+        return undefined;
+    return `"${entry}" is not a hostname or an IP address (no scheme, port, path or wildcard)`;
+}
+/** Whether `host` bypasses the proxy: equal to a `noProxy` entry or a subdomain of one. */
+export function bypassesProxy(host, noProxy) {
+    const h = normalizeHost(host);
+    return noProxy.some((entry) => {
+        const e = normalizeHost(entry.startsWith(".") ? entry.slice(1) : entry);
+        return e !== "" && (h === e || (isIP(h) === 0 && h.endsWith(`.${e}`)));
+    });
+}
+/** The proxy as `host:port`, for messages: never its credentials. */
+export function proxyLabel(proxy) {
+    return `${proxy.hostname}:${proxy.port || (proxy.protocol === "https:" ? "443" : "80")}`;
+}
+/** Reads the proxy's answer to `CONNECT` and resolves its status once the head is complete. */
+function readConnectResponse(socket) {
+    return new Promise((resolve, reject) => {
+        let head = Buffer.alloc(0);
+        const done = (err, status) => {
+            socket.off("data", onData);
+            socket.off("error", onError);
+            socket.off("close", onClose);
+            if (err)
+                reject(err);
+            else
+                resolve(status);
+        };
+        const onData = (chunk) => {
+            head = Buffer.concat([head, chunk]);
+            // Checked before looking for the terminator, so a large chunk that holds it is refused too
+            if (head.length > MAX_RESPONSE_HEAD) {
+                done(new Error("the proxy response head is too large"));
+                return;
+            }
+            const end = head.indexOf("\r\n\r\n");
+            if (end < 0)
+                return;
+            socket.pause();
+            const rest = head.subarray(end + 4);
+            // Bytes after the head belong to the TLS stream: the socket is paused, so tls.connect over
+            // it (targetConnect with httpSocket) reads them first
+            if (rest.length > 0)
+                socket.unshift(rest);
+            const m = /^HTTP\/1\.[01] (\d{3})/.exec(head.subarray(0, end).toString("latin1"));
+            if (!m)
+                done(new Error("the proxy sent an invalid response to CONNECT"));
+            else
+                done(null, Number(m[1]));
+        };
+        const onError = (e) => done(e);
+        const onClose = () => done(new Error("the proxy closed the connection during CONNECT"));
+        socket.on("data", onData);
+        socket.on("error", onError);
+        socket.on("close", onClose);
+    });
+}
+/**
+ * An undici dispatcher that reaches every https origin through a `CONNECT` tunnel on `proxyUrl`,
+ * then speaks TLS to the target over it (SNI and certificate checks for the target's hostname).
+ * The target is never resolved locally. One agent per download, like `pinnedAgent`.
+ */
+export function proxyAgent(proxyUrl, tls = {}) {
+    const proxy = new URL(proxyUrl);
+    const label = proxyLabel(proxy);
+    const auth = proxy.username !== "" || proxy.password !== ""
+        ? `Basic ${Buffer.from(`${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`).toString("base64")}`
+        : undefined;
+    const tunnelTimeoutMs = tls.tunnelTimeoutMs ?? TUNNEL_TIMEOUT_MS;
+    const proxyConnect = buildConnector({
+        timeout: tunnelTimeoutMs,
+        ...(tls.proxyCa !== undefined && { ca: tls.proxyCa }),
+    });
+    const targetConnect = buildConnector({
+        ...(tls.ca !== undefined && { ca: tls.ca }),
+    });
+    const proxyPort = proxy.port || (proxy.protocol === "https:" ? "443" : "80");
+    const proxyHost = normalizeHost(proxy.hostname);
+    const connect = (opts, callback) => {
+        const target = normalizeHost(opts.hostname);
+        const port = opts.port || "443";
+        const authority = `${isIP(target) === 6 ? `[${target}]` : target}:${port}`;
+        const fail = (e) => callback(e, null);
+        if (opts.protocol !== "https:") {
+            fail(new Error("only https targets are sent through the egress proxy"));
+            return;
+        }
+        const deadline = Date.now() + tunnelTimeoutMs;
+        proxyConnect({
+            protocol: proxy.protocol,
+            hostname: proxyHost,
+            host: `${proxy.hostname}:${proxyPort}`,
+            port: proxyPort,
+        }, (err, socket) => {
+            if (err || socket === null) {
+                fail(new Error(`cannot connect to the egress proxy ${label}: ${err?.message ?? ""}`));
+                return;
+            }
+            const s = socket;
+            // What is left of the one deadline that started before connecting to the proxy
+            const timer = setTimeout(() => s.destroy(new Error("the proxy did not answer CONNECT in time")), Math.max(0, deadline - Date.now()));
+            const lines = [`CONNECT ${authority} HTTP/1.1`, `Host: ${authority}`];
+            if (auth !== undefined)
+                lines.push(`Proxy-Authorization: ${auth}`);
+            s.write(`${lines.join("\r\n")}\r\n\r\n`);
+            readConnectResponse(s).then((status) => {
+                clearTimeout(timer);
+                if (status < 200 || status > 299) {
+                    s.destroy();
+                    fail(new NetDeniedError("net.proxy_refused", target, `The egress proxy ${label} refused the connection to ${authority} (HTTP ${status}).`));
+                    return;
+                }
+                targetConnect({ ...opts, httpSocket: s }, callback);
+            }, (e) => {
+                clearTimeout(timer);
+                s.destroy();
+                fail(new Error(`egress proxy ${label}: ${e.message}`));
+            });
+        });
+    };
+    return new Agent({ connect: connect });
+}

package/dist/net/public-address.d.ts

@@ -0,0 +1,60 @@
+/** Whether connecting to this (resolved) IP is forbidden: private, loopback, reserved, or unparseable. */
+export declare function isForbiddenAddress(ip: string): boolean;
+/** Link-local (incl. cloud metadata 169.254.169.254) or unparseable: forbidden whatever the exemptions. */
+export declare function isLinkLocalAddress(ip: string): boolean;
+/** A hostname normalized for comparison: lower case, no IPv6 brackets, no trailing dots. */
+export declare function normalizeHost(host: string): string;
+/** `localhost`, `127.0.0.0/8` or `::1` (as written in a URL). */
+export declare function isLoopbackHost(host: string): boolean;
+/** Where downloads may go besides public addresses. */
+export type NetPolicy = {
+    /** Testing only: plain http and loopback addresses for loopback hosts. */
+    allowInsecureLoopback: boolean;
+    /**
+     * `marketplaces.allowPrivateHosts`: a hostname entry (exact, case-insensitive) exempts that host's
+     * resolved addresses; an IP or CIDR entry exempts IP-literal URL hosts inside it only, never a DNS
+     * name that resolves there (an attacker's name could point into the range).
+     */
+    allowPrivateHosts: string[];
+    /** Origins configured by the admin (the npm registry): their hosts may resolve to private addresses. */
+    trustedOrigins: string[];
+    /**
+     * `net.httpsProxy` / `net.noProxy`: https downloads tunnel through this proxy (see `proxy.ts`);
+     * the target is then resolved by the proxy, not checked here, except IP-literal hosts.
+     */
+    proxy?: {
+        url: string;
+        noProxy: string[];
+    };
+};
+export type LookupFn = (host: string) => Promise<{
+    address: string;
+    family: number;
+}[]>;
+export type NetDeniedCode = "net.private_address" | "net.dns_failed" | "net.redirect" | "net.insecure_url" | "net.proxy_refused";
+/** A download refused by the network rules. English message, safe to show. */
+export declare class NetDeniedError extends Error {
+    readonly code: NetDeniedCode;
+    readonly host: string;
+    constructor(code: NetDeniedCode, host: string, message: string);
+}
+/** The shortest prefix an `allowPrivateHosts` CIDR may have, per family. */
+export declare const MIN_CIDR_PREFIX: {
+    readonly ipv4: 8;
+    readonly ipv6: 16;
+};
+/** A syntactically valid `addr/prefix` CIDR as [address, prefix, family], else undefined. */
+export declare function parseCidr(s: string): [string, number, "ipv4" | "ipv6"] | undefined;
+/**
+ * Why a `marketplaces.allowPrivateHosts` entry is invalid (English), or null when it is a hostname,
+ * an IP address or a CIDR no broader than /8 (IPv4) or /16 (IPv6).
+ */
+export declare function privateHostEntryProblem(entry: string): string | null;
+/** A valid `marketplaces.allowPrivateHosts` entry (see {@link privateHostEntryProblem}). */
+export declare function isPrivateHostEntry(entry: string): boolean;
+/**
+ * Resolves `host` (an IP literal is taken as is) and returns every address, in resolution order,
+ * after checking that each is public or exempt by `policy`. Throws {@link NetDeniedError}
+ * `net.dns_failed` (no answer) or `net.private_address` (some address is private and not exempt).
+ */
+export declare function resolvePublic(host: string, policy: NetPolicy, lookup?: LookupFn): Promise<string[]>;