@deepexi/datasense-connector 3.0.1 → 3.1.0

package/testing/gateway.js

@@ -1,402 +0,0 @@
-import { createHash, createHmac, sign as rsaSign } from 'node:crypto';
-import { lookup } from 'node:dns/promises';
-import { createLocalDb, LocalDbError } from './local-db.js';
-import { PinnedBodyTooLargeError, pinnedRequest } from './pinned-http.js';
-import { redactSecretValues, secretRedactionTexts } from './redaction.js';
-import { LocalRunError } from './types.js';
-export class LocalGatewayError extends Error {
-    code;
-    status;
-    constructor(code, message, status) {
-        super(message);
-        this.name = 'LocalGatewayError';
-        this.code = code;
-        this.status = status;
-    }
-}
-const DEFAULT_TIMEOUT_MS = 30_000;
-const MAX_TIMEOUT_MS = 120_000;
-const RESPONSE_MAX_BYTES = 10 * 1024 * 1024;
-const MAX_REDIRECTS = 5;
-const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
-const DROPPED_REQUEST_HEADERS = new Set(['host', 'content-length', 'connection', 'transfer-encoding', 'keep-alive', 'upgrade']);
-const METADATA_ADDRESSES = new Set(['169.254.169.254', '100.100.100.200', 'fd00:ec2::254']);
-const SECRET_FIELD = '[A-Za-z_][A-Za-z0-9_]*';
-const PLAIN_HANDLE = new RegExp(`ontos:secret:(${SECRET_FIELD})`, 'g');
-const URL_HANDLE = new RegExp(`ontos(?::|%3[Aa])secret(?::|%3[Aa])(${SECRET_FIELD})`, 'g');
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-function errorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
-export function normalizeHost(host) {
-    const value = host.trim().replace(/^\[|\]$/g, '').replace(/\.$/, '').toLowerCase();
-    const mapped = /^::ffff:(?:0:)?([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(value);
-    if (mapped) {
-        const high = Number.parseInt(mapped[1] ?? '0', 16);
-        const low = Number.parseInt(mapped[2] ?? '0', 16);
-        return `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`;
-    }
-    const dotted = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(value);
-    if (dotted?.[1])
-        return dotted[1];
-    return value;
-}
-function matchHostPattern(host, pattern) {
-    const normalized = normalizeHost(pattern);
-    if (normalized.startsWith('*.')) {
-        const suffix = normalized.slice(1);
-        return suffix.length > 1 && host.length > suffix.length && host.endsWith(suffix);
-    }
-    return normalized !== '' && host === normalized;
-}
-function isMetadataAddress(host) {
-    return METADATA_ADDRESSES.has(normalizeHost(host));
-}
-function isIpLiteral(host) {
-    return /^\d+\.\d+\.\d+\.\d+$/.test(host) || host.includes(':');
-}
-function secretUnavailable(field) {
-    return new LocalGatewayError('EGRESS_SECRET_UNAVAILABLE', `Secret '${field}' is unavailable: it isn't configured locally`, 422);
-}
-function lookupSecret(values, field) {
-    const value = Object.hasOwn(values, field) ? values[field] : undefined;
-    if (typeof value !== 'string')
-        throw secretUnavailable(field);
-    return value;
-}
-function substituteHandles(text, values) {
-    for (const match of text.matchAll(PLAIN_HANDLE))
-        lookupSecret(values, match[1] ?? '');
-    return text.replace(PLAIN_HANDLE, (_match, field) => lookupSecret(values, field));
-}
-function substituteUrlHandles(text, values) {
-    for (const match of text.matchAll(URL_HANDLE))
-        lookupSecret(values, match[1] ?? '');
-    return text.replace(URL_HANDLE, (_match, field) => encodeURIComponent(lookupSecret(values, field)));
-}
-export class LocalLimiter {
-    perSecond;
-    concurrency;
-    nextAt = 0;
-    active = 0;
-    waiting = [];
-    constructor(perSecond, concurrency) {
-        this.perSecond = perSecond;
-        this.concurrency = concurrency;
-    }
-    async acquire() {
-        if (this.active < this.concurrency && this.waiting.length === 0) {
-            this.active += 1;
-        }
-        else {
-            await new Promise((resolve) => this.waiting.push(resolve));
-        }
-        const now = Date.now();
-        const at = Math.max(now, this.nextAt);
-        this.nextAt = at + 1000 / this.perSecond;
-        if (at > now)
-            await sleep(at - now);
-        let released = false;
-        return () => {
-            if (released)
-                return;
-            released = true;
-            const next = this.waiting.shift();
-            if (next)
-                next();
-            else
-                this.active -= 1;
-        };
-    }
-}
-function parseHttpRequest(payload) {
-    if (!isRecord(payload) || typeof payload.url !== 'string' || typeof payload.method !== 'string') {
-        throw new LocalGatewayError('BAD_REQUEST', 'http request must have a method and a url', 400);
-    }
-    return payload;
-}
-function scriptUrlOf(request) {
-    let url;
-    try {
-        url = new URL(request.url);
-    }
-    catch {
-        throw new LocalGatewayError('BAD_REQUEST', 'url must be an absolute URL', 400);
-    }
-    for (const [name, value] of Object.entries(request.query ?? {})) {
-        for (const item of Array.isArray(value) ? value : [value])
-            url.searchParams.append(name, item);
-    }
-    return url;
-}
-const utf8 = new TextDecoder('utf-8', { fatal: true });
-function encodeBody(bytes) {
-    try {
-        return { body: utf8.decode(bytes), bodyEncoding: 'utf8' };
-    }
-    catch {
-        return { body: Buffer.from(bytes).toString('base64'), bodyEncoding: 'base64' };
-    }
-}
-function tooLarge() {
-    return new LocalGatewayError('EGRESS_RESPONSE_TOO_LARGE', `The external system's response exceeds the ${RESPONSE_MAX_BYTES / 1024 / 1024} MiB limit`, 502);
-}
-function hostDenied(host) {
-    return new LocalRunError('HOST_DENIED', `Access to host '${host}' is denied: add it to the connector's hosts and the local configuration`);
-}
-function computeCrypto(request, values) {
-    const data = substituteHandles(request.data, values);
-    switch (request.op) {
-        case 'hash':
-            return { value: createHash(request.algorithm).update(data, 'utf8').digest(request.encoding) };
-        case 'hmac':
-            return { value: createHmac(request.algorithm, substituteHandles(request.key, values)).update(data, 'utf8').digest(request.encoding) };
-        case 'sign': {
-            try {
-                return { value: rsaSign('sha256', Buffer.from(data, 'utf8'), substituteHandles(request.key, values)).toString(request.encoding) };
-            }
-            catch (error) {
-                if (error instanceof LocalGatewayError)
-                    throw error;
-                throw new LocalGatewayError('BAD_REQUEST', 'key is not a valid RSA private key', 400);
-            }
-        }
-        default:
-            throw new LocalGatewayError('BAD_REQUEST', 'op must be one of hmac, sign, hash', 400);
-    }
-}
-export function createLocalGateway(options) {
-    const secrets = { ...options.secrets };
-    const secretTexts = secretRedactionTexts([...Object.values(secrets), ...(options.db?.password ? [options.db.password] : [])]);
-    const redact = (text) => redactSecretValues(text, secretTexts);
-    const hostPatterns = [...options.hosts];
-    const doFetch = options.fetch ?? fetch;
-    const realNetwork = options.fetch === undefined;
-    const resolveHost = options.resolve ?? ((host) => lookup(host, { all: true, verbatim: true }));
-    const limiter = options.rateLimit && options.rateLimit.perSecond > 0
-        ? new LocalLimiter(options.rateLimit.perSecond, Math.max(1, Math.floor(options.rateLimit.concurrency || 1)))
-        : null;
-    const cache = new Map();
-    let db = null;
-    const exchange = (entry) => {
-        try {
-            options.onExchange?.(entry);
-        }
-        catch {
-        }
-    };
-    const checkHost = async (url) => {
-        const host = normalizeHost(url.hostname);
-        if (isMetadataAddress(host))
-            throw hostDenied(host);
-        const allowed = hostPatterns.some((pattern) => matchHostPattern(host, pattern) || normalizeHost(pattern) === url.host.toLowerCase());
-        if (!allowed)
-            throw hostDenied(host);
-        if (!realNetwork)
-            return null;
-        if (isIpLiteral(host))
-            return [{ address: host, family: host.includes(':') ? 6 : 4 }];
-        let addresses;
-        try {
-            addresses = await resolveHost(host);
-        }
-        catch (error) {
-            throw new LocalGatewayError('EGRESS_UPSTREAM_FAILED', redact(`The outbound request failed: cannot resolve ${host}: ${errorMessage(error)}`), 502);
-        }
-        if (addresses.length === 0)
-            throw new LocalGatewayError('EGRESS_UPSTREAM_FAILED', `The outbound request failed: cannot resolve ${host}`, 502);
-        if (addresses.some((record) => isMetadataAddress(record.address)))
-            throw hostDenied(host);
-        return addresses;
-    };
-    const sendOnce = async (url, method, headers, body, addresses, signal) => {
-        try {
-            if (addresses !== null)
-                return await pinnedRequest({ url, method, headers, body, addresses, signal, maxBytes: RESPONSE_MAX_BYTES });
-            return await doFetch(url.toString(), {
-                method,
-                headers,
-                ...(body !== null && method !== 'GET' && method !== 'HEAD' ? { body: body } : {}),
-                redirect: 'manual',
-                signal,
-            });
-        }
-        catch (error) {
-            if (error instanceof PinnedBodyTooLargeError)
-                throw tooLarge();
-            if (signal.aborted)
-                throw new LocalGatewayError('EGRESS_TIMEOUT', 'The outbound request timed out', 504);
-            throw new LocalGatewayError('EGRESS_UPSTREAM_FAILED', redact(`The outbound request failed: ${errorMessage(error)}`), 502);
-        }
-    };
-    const http = async (payload) => {
-        const request = parseHttpRequest(payload);
-        const scriptUrl = scriptUrlOf(request);
-        let url;
-        try {
-            url = new URL(substituteUrlHandles(scriptUrl.toString(), secrets));
-        }
-        catch (error) {
-            if (error instanceof LocalGatewayError)
-                throw error;
-            throw new LocalGatewayError('BAD_REQUEST', 'url is not valid after substituting secrets', 400);
-        }
-        if (url.protocol !== 'https:' && url.protocol !== 'http:')
-            throw new LocalGatewayError('EGRESS_SCHEME_DENIED', 'Only http(s) outbound requests are allowed', 403);
-        let addresses = await checkHost(url);
-        let headers = {};
-        for (const [name, value] of Object.entries(request.headers ?? {})) {
-            if (DROPPED_REQUEST_HEADERS.has(name.toLowerCase()))
-                continue;
-            headers[name] = substituteHandles(value, secrets);
-        }
-        let body = null;
-        if (request.body !== null && request.body !== undefined) {
-            body = request.bodyEncoding === 'base64' ? Buffer.from(request.body, 'base64') : Buffer.from(substituteHandles(request.body, secrets), 'utf8');
-        }
-        const timeoutMs = Math.min(request.timeoutMs ?? DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS);
-        const release = limiter ? await limiter.acquire() : () => undefined;
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), timeoutMs);
-        try {
-            let method = request.method;
-            let redirects = 0;
-            for (;;) {
-                const response = await sendOnce(url, method, headers, body, addresses, controller.signal);
-                const location = response.headers.get('location');
-                if (REDIRECT_STATUSES.has(response.status) && location !== null && redirects < MAX_REDIRECTS) {
-                    let next = null;
-                    try {
-                        next = new URL(location, url);
-                    }
-                    catch {
-                        next = null;
-                    }
-                    if (next && next.host === url.host && (next.protocol === 'https:' || next.protocol === 'http:')) {
-                        redirects += 1;
-                        if (response.status === 303 ? method !== 'HEAD' : (response.status === 301 || response.status === 302) && method !== 'GET' && method !== 'HEAD') {
-                            method = 'GET';
-                            body = null;
-                            headers = Object.fromEntries(Object.entries(headers).filter(([name]) => name.toLowerCase() !== 'content-type'));
-                        }
-                        url = next;
-                        addresses = await checkHost(url);
-                        continue;
-                    }
-                }
-                let bytes;
-                try {
-                    bytes = method === 'HEAD' ? new Uint8Array() : new Uint8Array(await response.arrayBuffer());
-                }
-                catch (error) {
-                    if (controller.signal.aborted)
-                        throw new LocalGatewayError('EGRESS_TIMEOUT', 'The outbound request timed out', 504);
-                    throw new LocalGatewayError('EGRESS_UPSTREAM_FAILED', redact(`Reading the response failed: ${errorMessage(error)}`), 502);
-                }
-                if (bytes.byteLength > RESPONSE_MAX_BYTES)
-                    throw tooLarge();
-                const responseHeaders = {};
-                response.headers.forEach((value, name) => {
-                    const lower = name.toLowerCase();
-                    if (lower === 'content-encoding' || lower === 'content-length')
-                        return;
-                    responseHeaders[lower] = value;
-                });
-                return {
-                    status: response.status,
-                    url: redirects === 0 ? scriptUrl.toString() : url.toString(),
-                    headers: responseHeaders,
-                    ...encodeBody(bytes),
-                };
-            }
-        }
-        finally {
-            clearTimeout(timer);
-            release();
-        }
-    };
-    const redactResponse = (response) => ({
-        ...response,
-        url: redact(response.url),
-        headers: Object.fromEntries(Object.entries(response.headers).map(([name, value]) => [name, redact(value)])),
-        body: response.bodyEncoding === 'utf8' ? redact(response.body) : response.body,
-    });
-    const dbOf = () => {
-        if (!options.db)
-            throw new LocalGatewayError('DB_PROXY_NOT_DECLARED', 'ctx.db is not configured locally: set db in the local configuration', 403);
-        if (isMetadataAddress(options.db.host))
-            throw hostDenied(normalizeHost(options.db.host));
-        db ??= createLocalDb(options.db, { driver: options.postgres, secrets: Object.values(secrets) });
-        return db;
-    };
-    const traced = async (kind, request, run) => {
-        const startedAt = Date.now();
-        try {
-            const response = await run();
-            exchange({ kind, request, response, error: null, durationMs: Date.now() - startedAt });
-            return response;
-        }
-        catch (error) {
-            const code = isRecord(error) && typeof error.code === 'string' ? error.code : 'HOST_CALL_FAILED';
-            exchange({ kind, request, response: null, error: { code, message: errorMessage(error) }, durationMs: Date.now() - startedAt });
-            throw error;
-        }
-    };
-    const call = async (method, payload) => {
-        switch (method) {
-            case 'http':
-                return redactResponse(await traced('http', payload, () => http(payload)));
-            case 'db.query': {
-                const request = payload;
-                return traced('db', request, () => dbOf().query({ sql: request.sql, params: request.params ?? [] }));
-            }
-            case 'db.next': {
-                const cursorId = isRecord(payload) && typeof payload.cursorId === 'string' ? payload.cursorId : '';
-                return traced('db', { cursorId }, () => dbOf().next(cursorId));
-            }
-            case 'db.close': {
-                const cursorId = isRecord(payload) && typeof payload.cursorId === 'string' ? payload.cursorId : '';
-                await dbOf().close(cursorId);
-                return null;
-            }
-            case 'crypto':
-                return traced('crypto', payload, async () => computeCrypto(payload, secrets));
-            case 'cache.get': {
-                const key = isRecord(payload) && typeof payload.key === 'string' ? payload.key : '';
-                const entry = cache.get(key);
-                if (!entry || Date.parse(entry.expiresAt) <= Date.now())
-                    return null;
-                return entry;
-            }
-            case 'cache.set': {
-                if (!isRecord(payload) || typeof payload.key !== 'string' || typeof payload.value !== 'string' || typeof payload.ttlSeconds !== 'number') {
-                    throw new LocalGatewayError('BAD_REQUEST', 'cache.set needs key, value and ttlSeconds', 400);
-                }
-                cache.set(payload.key, { value: payload.value, expiresAt: new Date(Date.now() + payload.ttlSeconds * 1000).toISOString() });
-                return null;
-            }
-            case 'secret.reveal': {
-                const field = isRecord(payload) && typeof payload.field === 'string' ? payload.field : '';
-                return { value: lookupSecret(secrets, field) };
-            }
-            default:
-                throw new LocalGatewayError('HOST_METHOD_UNSUPPORTED', `the local gateway does not answer ${method}`);
-        }
-    };
-    return {
-        call,
-        redact,
-        async close() {
-            const current = db;
-            db = null;
-            if (current)
-                await current.end();
-        },
-    };
-}
-export { LocalDbError };

package/testing/import-guard.d.ts

@@ -1,57 +0,0 @@
-/**
- * 本地源码加载器的导入检查（不执行任何代码，只用调用方传入的 TypeScript 编译器 API 解析语法树）。
- *
- * 两层：
- * 1. `findForbiddenSourceSyntax`：与 shared `server/connector-source-guard.ts` 的同名函数规则相同（SDK 不依赖 shared，
- *    这里另写一份，`test/testing/import-guard.test.ts` 用同一批样例对照两份实现）：
- *    - 任何 import 属性 / 断言（静态 `import`、`export … from` 的 `with` / `assert`，动态 `import(x, options)` 的第二参）；
- *    - `macro:` 开头的说明符；
- *    - SDK 只认精确的 `@deepexi/datasense-connector`：子路径（含 `/testing`）与改名前的旧包名都拒绝；
- *    - TypeScript 解析出的语法错误。
- * 2. `classifySpecifier`：转译后代码里每个 `require(…)` 的说明符（与服务端打包插件的白名单相同）：只允许相对路径与
- *    `@deepexi/datasense-connector`；`node:*` 与 Node 内置模块、裸包名、绝对路径与 URL 说明符都拒绝；逃出源码根的相对路径
- *    单独报 `PATH_ESCAPE`。
- */
-import type * as TS from 'typescript';
-export type TypeScriptApi = typeof TS;
-export interface SourceGuardDiagnostic {
-    /** 相对源码根目录的路径。 */
-    file: string;
-    /** 从 1 开始。 */
-    line: number;
-    /** 从 0 开始。 */
-    column: number;
-    message: string;
-    /** `syntax`：语法错误；`import`：禁用的导入写法。 */
-    kind: 'syntax' | 'import';
-}
-export declare const CONNECTOR_SDK_SPECIFIER = "@deepexi/datasense-connector";
-export declare function asTypeScript(value: unknown): TypeScriptApi;
-/** 检查一个源码文件，返回全部违规（空数组表示通过）。规则与 shared 的 `findForbiddenSourceSyntax` 相同。 */
-export declare function findForbiddenSourceSyntax(ts: TypeScriptApi, filePath: string, content: string): SourceGuardDiagnostic[];
-/** 转译后 CommonJS 代码里的 `require(…)`：`specifier` 为 null 表示参数不是字面量（运行时才知道导入什么）。 */
-export declare function collectRequires(ts: TypeScriptApi, filePath: string, output: string): Array<{
-    specifier: string | null;
-    line: number;
-}>;
-/**
- * 源码里写出的值导入说明符（`import` / `export … from` / `import()` / `require()` 的字面量；`import type` 与 `export type` 不算）。
- * 转译会删掉没用到的导入，只看转译结果会放过 `import fs from 'node:fs'` 这类写了没用的导入，所以源码这一层也要归类。
- */
-export declare function collectSourceSpecifiers(ts: TypeScriptApi, filePath: string, content: string): Array<{
-    specifier: string;
-    line: number;
-}>;
-export type SpecifierClass = {
-    kind: 'sdk';
-} | {
-    kind: 'relative';
-    target: string;
-} | {
-    kind: 'escape';
-} | {
-    kind: 'forbidden';
-    message: string;
-};
-/** 一个 `require` 说明符的归类；`importer` 是相对源码根目录的路径。 */
-export declare function classifySpecifier(specifier: string, importer: string): SpecifierClass;

package/testing/import-guard.js

@@ -1,187 +0,0 @@
-export const CONNECTOR_SDK_SPECIFIER = '@deepexi/datasense-connector';
-const RETIRED_SDK_SPECIFIER = ['@mu-ontos', 'connector-sdk'].join('/');
-const MACRO_SPECIFIER = /^macro:/i;
-const NODE_BUILTINS = new Set([
-    'assert', 'async_hooks', 'buffer', 'child_process', 'cluster', 'console', 'constants', 'crypto', 'dgram', 'diagnostics_channel',
-    'dns', 'domain', 'events', 'fs', 'http', 'http2', 'https', 'inspector', 'module', 'net', 'os', 'path', 'perf_hooks', 'process',
-    'punycode', 'querystring', 'readline', 'repl', 'stream', 'string_decoder', 'sys', 'timers', 'tls', 'trace_events', 'tty', 'url',
-    'util', 'v8', 'vm', 'wasi', 'worker_threads', 'zlib', 'test', 'sqlite', 'sea',
-]);
-export function asTypeScript(value) {
-    const api = (value !== null && typeof value === 'object' && 'default' in value && typeof value.default === 'object'
-        ? value.default
-        : value);
-    if (!api || typeof api.createSourceFile !== 'function' || typeof api.transpileModule !== 'function') {
-        throw new TypeError('options.typescript must be the TypeScript compiler API (import ts from "typescript")');
-    }
-    return api;
-}
-function scriptKindOf(ts, filePath) {
-    if (filePath.endsWith('.tsx'))
-        return ts.ScriptKind.TSX;
-    if (filePath.endsWith('.jsx'))
-        return ts.ScriptKind.JSX;
-    if (/\.[cm]?js$/.test(filePath))
-        return ts.ScriptKind.JS;
-    return ts.ScriptKind.TS;
-}
-function sdkSpecifierProblem(specifier) {
-    if (specifier === RETIRED_SDK_SPECIFIER || specifier.startsWith(`${RETIRED_SDK_SPECIFIER}/`)) {
-        return `import '${specifier}' is not allowed; the SDK package is now '${CONNECTOR_SDK_SPECIFIER}'`;
-    }
-    if (specifier.startsWith(`${CONNECTOR_SDK_SPECIFIER}/`)) {
-        return `import '${specifier}' is not allowed; import '${CONNECTOR_SDK_SPECIFIER}' itself`;
-    }
-    return null;
-}
-function literalSpecifier(ts, node) {
-    if (node && (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)))
-        return node.text;
-    return null;
-}
-export function findForbiddenSourceSyntax(ts, filePath, content) {
-    const sourceFile = ts.createSourceFile(filePath, content, ts.ScriptTarget.Latest, true, scriptKindOf(ts, filePath));
-    const problems = [];
-    const report = (position, message, kind) => {
-        const { line, character } = sourceFile.getLineAndCharacterOfPosition(position);
-        problems.push({ file: filePath, line: line + 1, column: character, message, kind });
-    };
-    const parseDiagnostics = sourceFile.parseDiagnostics ?? [];
-    for (const diagnostic of parseDiagnostics) {
-        report(diagnostic.start ?? 0, `syntax error: ${ts.flattenDiagnosticMessageText(diagnostic.messageText, ' ')}`, 'syntax');
-    }
-    const checkSpecifier = (node) => {
-        const specifier = literalSpecifier(ts, node);
-        if (!node || specifier === null)
-            return;
-        if (MACRO_SPECIFIER.test(specifier)) {
-            report(node.getStart(sourceFile), `import '${specifier}' is not allowed; connectors cannot use Bun macros`, 'import');
-            return;
-        }
-        const sdkProblem = sdkSpecifierProblem(specifier);
-        if (sdkProblem !== null)
-            report(node.getStart(sourceFile), sdkProblem, 'import');
-    };
-    const attributesMessage = (keyword) => `import attributes ('${keyword} { … }') are not allowed; connectors cannot use Bun macros or other import attributes`;
-    const visit = (node) => {
-        if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) {
-            checkSpecifier(node.moduleSpecifier);
-            if (node.attributes) {
-                report(node.attributes.getStart(sourceFile), attributesMessage(node.attributes.token === ts.SyntaxKind.AssertKeyword ? 'assert' : 'with'), 'import');
-            }
-        }
-        else if (ts.isImportEqualsDeclaration(node)) {
-            if (ts.isExternalModuleReference(node.moduleReference))
-                checkSpecifier(node.moduleReference.expression);
-        }
-        else if (ts.isCallExpression(node)) {
-            const callee = node.expression;
-            if (callee.kind === ts.SyntaxKind.ImportKeyword) {
-                checkSpecifier(node.arguments[0]);
-                const options = node.arguments[1];
-                if (options)
-                    report(options.getStart(sourceFile), attributesMessage('with'), 'import');
-            }
-            else if (ts.isIdentifier(callee) && callee.text === 'require') {
-                checkSpecifier(node.arguments[0]);
-            }
-        }
-        ts.forEachChild(node, visit);
-    };
-    visit(sourceFile);
-    return problems;
-}
-export function collectRequires(ts, filePath, output) {
-    const sourceFile = ts.createSourceFile(`${filePath}.js`, output, ts.ScriptTarget.Latest, true, ts.ScriptKind.JS);
-    const found = [];
-    const visit = (node) => {
-        if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && node.expression.text === 'require') {
-            const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
-            found.push({ specifier: literalSpecifier(ts, node.arguments[0]), line: line + 1 });
-        }
-        ts.forEachChild(node, visit);
-    };
-    visit(sourceFile);
-    return found;
-}
-export function collectSourceSpecifiers(ts, filePath, content) {
-    const sourceFile = ts.createSourceFile(filePath, content, ts.ScriptTarget.Latest, true, scriptKindOf(ts, filePath));
-    const found = [];
-    const add = (node) => {
-        const specifier = literalSpecifier(ts, node);
-        if (!node || specifier === null)
-            return;
-        const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
-        found.push({ specifier, line: line + 1 });
-    };
-    const visit = (node) => {
-        if (ts.isImportDeclaration(node)) {
-            if (!node.importClause?.isTypeOnly)
-                add(node.moduleSpecifier);
-        }
-        else if (ts.isExportDeclaration(node)) {
-            if (!node.isTypeOnly)
-                add(node.moduleSpecifier);
-        }
-        else if (ts.isImportEqualsDeclaration(node)) {
-            if (!node.isTypeOnly && ts.isExternalModuleReference(node.moduleReference))
-                add(node.moduleReference.expression);
-        }
-        else if (ts.isCallExpression(node)) {
-            const callee = node.expression;
-            if (callee.kind === ts.SyntaxKind.ImportKeyword || (ts.isIdentifier(callee) && callee.text === 'require'))
-                add(node.arguments[0]);
-        }
-        ts.forEachChild(node, visit);
-    };
-    visit(sourceFile);
-    return found;
-}
-function packageNameOf(specifier) {
-    const parts = specifier.split('/');
-    if (specifier.startsWith('@'))
-        return parts.slice(0, 2).join('/');
-    return parts[0] ?? specifier;
-}
-function normalizePosix(input) {
-    const out = [];
-    for (const segment of input.split('/')) {
-        if (segment === '' || segment === '.')
-            continue;
-        if (segment === '..') {
-            if (out.length > 0 && out[out.length - 1] !== '..')
-                out.pop();
-            else
-                out.push('..');
-        }
-        else {
-            out.push(segment);
-        }
-    }
-    return out.length === 0 ? '.' : out.join('/');
-}
-export function classifySpecifier(specifier, importer) {
-    if (specifier === CONNECTOR_SDK_SPECIFIER)
-        return { kind: 'sdk' };
-    const isRelative = specifier === '.' || specifier === '..' || specifier.startsWith('./') || specifier.startsWith('../');
-    if (isRelative) {
-        const slash = importer.lastIndexOf('/');
-        const baseDir = slash === -1 ? '' : importer.slice(0, slash);
-        const target = normalizePosix(baseDir ? `${baseDir}/${specifier}` : specifier);
-        if (target === '..' || target.startsWith('../'))
-            return { kind: 'escape' };
-        return { kind: 'relative', target };
-    }
-    const sdkProblem = sdkSpecifierProblem(specifier);
-    if (sdkProblem !== null)
-        return { kind: 'forbidden', message: sdkProblem };
-    if (MACRO_SPECIFIER.test(specifier))
-        return { kind: 'forbidden', message: `import '${specifier}' is not allowed; connectors cannot use Bun macros` };
-    if (specifier.startsWith('node:') || specifier.startsWith('bun:') || specifier === 'bun' || NODE_BUILTINS.has(packageNameOf(specifier))) {
-        return { kind: 'forbidden', message: `import '${specifier}' is not allowed; connectors cannot use Node.js or Bun built-in modules` };
-    }
-    if (specifier.startsWith('/') || /^[a-z][a-z0-9+.-]*:/i.test(specifier)) {
-        return { kind: 'forbidden', message: `import '${specifier}' is not allowed; only relative imports and '${CONNECTOR_SDK_SPECIFIER}' are allowed` };
-    }
-    return { kind: 'forbidden', message: `import '${specifier}' is not allowed; connectors can only depend on '${CONNECTOR_SDK_SPECIFIER}'` };
-}