@jini-ai/agent-runtime 0.2.1 → 0.3.0

package/dist/providers/connection-guard.js

@@ -16,6 +16,24 @@
  * or RFC1918/link-local/CGNAT/metadata-service addresses, and strip bearer
  * tokens / API-key headers / `?key=` query values out of free-form text
  * before it is logged or surfaced to a caller.
+ *
+ * Also exports `pinnedFetch` — a `node:https`/`node:http`-based POST that dials the exact address
+ * `validateBaseUrlResolved` already validated, instead of leaving the transport to re-resolve DNS
+ * independently when it connects. Added later than the four functions above, for the same
+ * dependency-free package; see `pinnedFetch`'s own doc for why `fetch()` itself cannot do this.
+ *
+ * ## Paired with `@jini-ai/ui`'s `utils/endpoint-policy.ts`
+ *
+ * That module carries a browser-safe copy of the SYNCHRONOUS half below —
+ * `isLoopbackApiHost`/`isBlockedExternalApiHostname`/`validateBaseUrl` — so the
+ * settings tabs can reject a bad endpoint as the operator types it. It is a
+ * copy rather than an import because `endpoint-policy.ts` itself has zero
+ * imports by design and this package is Node-only (`validateBaseUrlResolved`
+ * needs `node:dns`); see that file's header for the full reasoning.
+ *
+ * **If the block-list here changes, change it there too.** A divergence means
+ * the UI accepts an endpoint this guard then refuses — or, in the direction
+ * that actually matters, the UI accepts one this guard would have refused.
  */
 function normalizeBracketedIpv6(hostname) {
     const stripped = hostname.startsWith('[') && hostname.endsWith(']')
@@ -106,11 +124,32 @@ export function isBlockedExternalApiHostname(hostname) {
     const mapped = ipv4MappedToDotted(host);
     return Boolean(mapped && isBlockedIpv4(mapped));
 }
-/** Synchronous base-URL check: scheme allow-list + literal-hostname block-list. Does not resolve DNS — see {@link validateBaseUrlResolved}. */
+/**
+ * Synchronous base-URL check: scheme allow-list + literal-hostname block-list.
+ * Does not resolve DNS — see {@link validateBaseUrlResolved}.
+ *
+ * **Trims before parsing, and must keep doing so.** `@jini-ai/ui`'s
+ * `isAllowedEndpointUrl` is a deliberate browser-safe copy of this function and
+ * trims its input; this one did not. WHATWG URL parsing strips leading/trailing
+ * ASCII space itself, so the two agreed on `" https://x "` and diverged only on
+ * whitespace `String.prototype.trim` removes but the URL parser does not — NBSP,
+ * BOM, thin space and friends. A URL pasted from a rich-text source therefore
+ * passed the UI and was refused at connection time.
+ * `endpoint-policy.parity.test.ts` now holds the two in agreement mechanically.
+ *
+ * Trimming cannot weaken the block-list. Checked across every whitespace
+ * character `trim` strips, against blocked/loopback/public hosts in all three
+ * padding positions: an untrimmed parse either fails outright or yields a
+ * hostname IDENTICAL to the trimmed one. It never yields a DIFFERENT host, which
+ * is the only shape that would let the block-list inspect one string while the
+ * network used another.
+ */
 export function validateBaseUrl(baseUrl) {
     let parsed;
     try {
-        parsed = new URL(String(baseUrl).replace(/\/+$/, ''));
+        // Trim BEFORE stripping trailing slashes: in `"https://x/ "` the trailing
+        // character is the space, so the slash strip alone would never reach it.
+        parsed = new URL(String(baseUrl).trim().replace(/\/+$/, ''));
     }
     catch {
         return { error: 'Invalid baseUrl' };
@@ -144,6 +183,25 @@ function looksLikeIpLiteral(hostname) {
  * hostname that resolves to a loopback address (including `*.localhost` per
  * RFC 6761 and IPv4-mapped IPv6 loopback) follows the same carve-out.
  *
+ * ## The TOCTOU this closes, and how
+ *
+ * A validator that only checks and returns pass/fail has a gap: `fetch` (or any transport) then
+ * resolves the hostname AGAIN, independently, when it dials. Between those two resolutions the
+ * answer can change — a DNS rebinding attacker returns a public address to this check and a
+ * private one to the connection. No amount of re-checking closes that on its own; the request has
+ * to dial the exact address that was approved. So this function does the resolution exactly ONCE
+ * and hands the first validated address back as `pinnedAddress` — feed it to {@link pinnedFetch},
+ * which dials that address directly instead of letting the transport re-resolve. `pinnedAddress` is
+ * only set when a lookup actually happened (i.e. never for the loopback-literal / IP-literal hosts
+ * below, which need no pinning: an IP literal never re-resolves to anything else, and loopback
+ * literals are outside this threat model — see the carve-out above).
+ *
+ * That said, `baseUrl` here is operator-configured provider config, not attacker-supplied input —
+ * pinning is defence-in-depth rather than the primary trust boundary. Callers should additionally
+ * refuse redirects (`redirect: 'error'`), which closes the OTHER way a validated origin reaches an
+ * unvalidated address; `pinnedFetch` never follows one regardless (`node:https`/`node:http` don't,
+ * unlike `fetch`'s default), but callers still pass `redirect: 'error'` for self-documentation.
+ *
  * DNS lookup failures are not treated as a security signal — the caller is
  * going to surface a connection error from `fetch` anyway, and turning a
  * transient resolver hiccup into a rejection would just confuse callers. The
@@ -176,7 +234,151 @@ export async function validateBaseUrlResolved(baseUrl, lookup) {
             return { error: 'Internal IPs blocked', forbidden: true };
         }
     }
-    return sync;
+    // Pin to the FIRST resolved address — the loop above already proved every address in this list
+    // cleared the block-list, so this is "the address the guard actually approved", singular, ready
+    // to hand to `pinnedFetch`. An empty `addresses` array (a `lookup` that resolves to nothing
+    // without throwing) leaves `pinnedAddress` unset; a real `dns.lookup` throws ENOTFOUND rather
+    // than resolving to `[]`, so this is not a realistic gap, just a graceful fallback to the
+    // pre-pinning pass-through behavior.
+    const pinnedAddress = addresses[0];
+    return pinnedAddress ? { ...sync, pinnedAddress } : sync;
+}
+/**
+ * Idle-socket safety net, applied to every `pinnedFetch` request regardless of `init.signal`.
+ * Plain `http(s).request` has NO default timeout at all — unlike `fetch`, which is backed by
+ * undici's `Agent` defaults (`headersTimeout`/`bodyTimeout`, both 300_000ms there). Without this,
+ * a truly silent/dead connection would hang forever where `fetch` previously would not have. This
+ * is a ceiling underneath a caller-supplied `AbortSignal`, not a replacement for one — whichever
+ * fires first wins; the number matches undici's default rather than inventing a new one.
+ */
+const PINNED_FETCH_IDLE_TIMEOUT_MS = 300_000;
+/**
+ * `fetch()`-shaped POST that dials `pinnedAddress` directly instead of letting the transport
+ * re-resolve DNS when it connects — see {@link validateBaseUrlResolved}'s doc for the TOCTOU this
+ * closes and why `pinnedAddress` is the exact address that function already validated.
+ *
+ * Built on `node:https`/`node:http`, not `fetch`, because Node's global `fetch` is backed by an
+ * internal, non-importable copy of undici and exposes no `lookup`/dispatcher hook without adding
+ * `undici` (or an equivalent) as a runtime dependency — confirmed empirically against this
+ * package's pinned Node version (`require('node:undici')` throws `No such built-in module`, i.e.
+ * it is not a stable built-in here even though Node's own `fetch` uses it internally). This
+ * package carries no external runtime dependencies by design (module doc), so `node:https`/
+ * `node:http`'s own `lookup` option — which `net.connect` already accepts for exactly this purpose
+ * — is the only built-in path.
+ *
+ * `hostname`/`servername` passed to the transport stay the ORIGINAL host from `url`, not
+ * `pinnedAddress`; only the `lookup` override changes which address the socket actually dials.
+ * That is what keeps this a pin rather than a redirect to a different origin: the Host header and,
+ * for https, the TLS SNI + certificate hostname validation are unaffected, so a certificate for the
+ * real hostname still validates normally against a connection that happens to land on the address
+ * the guard already approved. Never follows a redirect — `http(s).request` doesn't, unlike
+ * `fetch`'s default — which is the other half of the rebinding surface `redirect: 'error'`
+ * documents at each call site.
+ *
+ * When `pinnedAddress` is `undefined` — the loopback-literal / IP-literal hosts
+ * `validateBaseUrlResolved` never runs a lookup for — this issues a normal, unpinned request
+ * (`lookup` option simply omitted). That is intentional, not a gap: an IP literal has nothing left
+ * to re-resolve, and loopback literals are the documented carve-out, outside this threat model.
+ */
+export async function pinnedFetch(url, init, pinnedAddress) {
+    const parsed = new URL(url);
+    const isHttps = parsed.protocol === 'https:';
+    const { request: httpsRequest } = await import('node:https');
+    const { request: httpRequest } = await import('node:http');
+    const transportRequest = isHttps ? httpsRequest : httpRequest;
+    const family = pinnedAddress?.family === 6 ? 6 : 4;
+    return new Promise((resolve, reject) => {
+        const req = transportRequest({
+            hostname: parsed.hostname,
+            ...(parsed.port ? { port: Number(parsed.port) } : {}),
+            path: `${parsed.pathname}${parsed.search}`,
+            method: init.method,
+            // `identity` is explicit, not incidental. `fetch` transparently decompresses a response;
+            // `http(s).request` does NOT, so a compressed body would reach a caller that parses it as
+            // UTF-8 SSE and produce silent garbage — surfacing far from the cause as an empty stream
+            // or a JSON parse error. Node sends no `Accept-Encoding` of its own, so this only makes
+            // the existing behaviour explicit and survives a caller that sets its own headers.
+            // Paired with the `content-encoding` check below, which covers a server that compresses
+            // unbidden anyway.
+            headers: { 'accept-encoding': 'identity', ...init.headers },
+            // `servername` set explicitly to the ORIGINAL hostname (not `pinnedAddress`) is what SNI
+            // and certificate hostname validation actually run against — this is what makes it a pin
+            // rather than a redirect to a different origin. `rejectUnauthorized` is left at its
+            // `node:https` default (`true`, i.e. certificate validation stays ON); nothing in this
+            // function ever sets it, and it must stay that way.
+            ...(isHttps ? { servername: parsed.hostname } : {}),
+            ...(pinnedAddress
+                ? {
+                    // Happy Eyeballs (`autoSelectFamily`, on by default since Node 20) races several
+                    // resolved addresses and expects `lookup` to support its array-returning calling
+                    // convention — the opposite of what pinning wants (exactly one address, no fallback
+                    // to any other). Disabling it keeps `net`'s classic single-address `lookup` contract,
+                    // which is what the callback below implements.
+                    autoSelectFamily: false,
+                    lookup: (_hostname, _options, callback) => {
+                        callback(null, pinnedAddress.address, family);
+                    },
+                }
+                : {}),
+        }, (res) => {
+            const status = res.statusCode ?? 0;
+            // A server may compress despite `accept-encoding: identity`. Nothing downstream
+            // decompresses, so failing loudly here is strictly better than handing back bytes the
+            // caller will misparse: a hard error names the cause, silent garbage does not.
+            const encoding = res.headers['content-encoding'];
+            if (typeof encoding === 'string' && encoding.trim() !== '' && encoding.trim().toLowerCase() !== 'identity') {
+                res.resume(); // drain, so the socket is not left half-read
+                reject(new Error(`pinnedFetch: response used unsupported content-encoding "${encoding}". `
+                    + 'This transport does not decompress; the request asked for identity.'));
+                return;
+            }
+            // `http(s).request` never auto-follows a redirect the way `fetch`'s default does, but
+            // that alone is a WEAKER posture than the `redirect: 'error'` callers ask for: real
+            // `fetch` THROWS on a 3xx, whereas simply not following one would resolve normally with
+            // `status: 302` and a likely-empty body — turning the guard's hard failure into a quiet
+            // `ok: false` a caller could half-handle as a generic upstream error. That undersells the
+            // reviewer's original finding: a guard-passing endpoint could 302 into blocked address
+            // space with auth headers still attached. So this rejects explicitly, matching `fetch`'s
+            // throw rather than merely approximating it by omission. Only the five redirect codes
+            // `fetch` itself treats as redirects (a `Location` header is what actually enables the
+            // rebinding hop) — NOT every 3xx: `304 Not Modified` carries no `Location` and no provider
+            // in this package sends conditional-request headers that could ever produce one.
+            if (status === 301 || status === 302 || status === 303 || status === 307 || status === 308) {
+                res.resume();
+                reject(new Error(`pinnedFetch: refused to follow a ${status} redirect`
+                    + (typeof res.headers.location === 'string' ? ` to "${res.headers.location}"` : '')
+                    + '. Matches fetch\'s redirect: \'error\' behavior — a guard-passing endpoint redirecting into blocked address space is the other half of the SSRF finding this transport closes.'));
+                return;
+            }
+            resolve({
+                ok: status >= 200 && status < 300,
+                status,
+                body: res,
+                text: () => new Promise((resolveText, rejectText) => {
+                    const chunks = [];
+                    res.on('data', (chunk) => chunks.push(chunk));
+                    res.on('end', () => resolveText(Buffer.concat(chunks).toString('utf8')));
+                    res.on('error', rejectText);
+                }),
+            });
+        });
+        if (init.signal) {
+            if (init.signal.aborted) {
+                req.destroy(new Error('The operation was aborted'));
+            }
+            else {
+                init.signal.addEventListener('abort', () => req.destroy(new Error('The operation was aborted')), { once: true });
+            }
+        }
+        // Fires on socket INACTIVITY (no bytes sent or received), covering connect hangs, a
+        // provider that accepts the connection and then never speaks, and a body that stalls
+        // mid-stream — not on total request duration, matching `setTimeout`'s own semantics.
+        req.setTimeout(PINNED_FETCH_IDLE_TIMEOUT_MS, () => {
+            req.destroy(new Error(`pinnedFetch: no activity for ${PINNED_FETCH_IDLE_TIMEOUT_MS}ms`));
+        });
+        req.on('error', reject);
+        req.end(init.body);
+    });
 }
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');

package/dist/providers/connection-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"connection-guard.js","sourceRoot":"","sources":["../../src/providers/connection-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QACjE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC,CAAC,QAAQ,CAAC;IACb,wEAAwE;IACxE,0EAA0E;IAC1E,wEAAwE;IACxE,+DAA+D;IAC/D,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAChC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,MAA0C,CAAC;AACpD,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACrB,OAAO,CACL,CAAC,KAAK,CAAC;QACP,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC;QAClC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;QACxB,CAAC,KAAK,EAAE;QACR,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;QACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC,IAAI,GAAG,CACT,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IACE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EACxD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IACxB,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IACxB,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO;QACL,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,GAAG;QACpB,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,GAAG;QACpB,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,GAAG;QACnB,KAAK,GAAG,GAAG;KACZ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,gKAAgK;AAChK,MAAM,UAAU,4BAA4B,CAAC,QAAgB;IAC3D,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,+IAA+I;AAC/I,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAKD,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC7D,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC,CAAC,QAAQ,CAAC;IACb,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,MAAmB;IAEnB,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,kBAAkB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,iBAAiB,CAAC,EAAE,CAAC;YAAE,SAAS;QACpC,IAAI,4BAA4B,CAAC,EAAE,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,eAAyD,EAAE;IAE3D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7D,IAAI,QAAQ,GAAG,IAAI;SAChB,OAAO,CAAC,gCAAgC,EAAE,mBAAmB,CAAC;SAC9D,OAAO,CAAC,0DAA0D,EAAE,gBAAgB,CAAC;SACrF,OAAO,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;IAClD,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChE,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kIAAkI;AAClI,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACrD,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC"}
+{"version":3,"file":"connection-guard.js","sourceRoot":"","sources":["../../src/providers/connection-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAiBH,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QACjE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC,CAAC,QAAQ,CAAC;IACb,wEAAwE;IACxE,0EAA0E;IAC1E,wEAAwE;IACxE,+DAA+D;IAC/D,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAChC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,MAA0C,CAAC;AACpD,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACrB,OAAO,CACL,CAAC,KAAK,CAAC;QACP,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC;QAClC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;QACxB,CAAC,KAAK,EAAE;QACR,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;QACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC,IAAI,GAAG,CACT,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IACE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EACxD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IACxB,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IACxB,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO;QACL,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,GAAG;QACpB,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,GAAG;QACpB,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,GAAG;QACnB,KAAK,GAAG,GAAG;KACZ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,gKAAgK;AAChK,MAAM,UAAU,4BAA4B,CAAC,QAAgB;IAC3D,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAKD,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC7D,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC,CAAC,QAAQ,CAAC;IACb,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,MAAmB;IAEnB,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,kBAAkB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,iBAAiB,CAAC,EAAE,CAAC;YAAE,SAAS;QACpC,IAAI,4BAA4B,CAAC,EAAE,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,gGAAgG;IAChG,4FAA4F;IAC5F,8FAA8F;IAC9F,0FAA0F;IAC1F,qCAAqC;IACrC,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAmCD;;;;;;;GAOG;AACH,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAW,EACX,IAAqB,EACrB,aAA2C;IAE3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC7C,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IAC9D,MAAM,MAAM,GAAG,aAAa,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnD,OAAO,IAAI,OAAO,CAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1D,MAAM,GAAG,GAAG,gBAAgB,CAC1B;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;YAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,yFAAyF;YACzF,0FAA0F;YAC1F,yFAAyF;YACzF,wFAAwF;YACxF,mFAAmF;YACnF,wFAAwF;YACxF,mBAAmB;YACnB,OAAO,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE;YAC3D,yFAAyF;YACzF,yFAAyF;YACzF,oFAAoF;YACpF,uFAAuF;YACvF,oDAAoD;YACpD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,aAAa;gBACf,CAAC,CAAC;oBACE,iFAAiF;oBACjF,iFAAiF;oBACjF,oFAAoF;oBACpF,sFAAsF;oBACtF,+CAA+C;oBAC/C,gBAAgB,EAAE,KAAK;oBACvB,MAAM,EAAE,CACN,SAAiB,EACjB,QAAiB,EACjB,QAAsF,EAChF,EAAE;wBACR,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBAChD,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;YACnC,gFAAgF;YAChF,sFAAsF;YACtF,+EAA+E;YAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;YACjD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,EAAE,CAAC;gBAC3G,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,6CAA6C;gBAC3D,MAAM,CACJ,IAAI,KAAK,CACP,4DAA4D,QAAQ,KAAK;sBACvE,qEAAqE,CACxE,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,sFAAsF;YACtF,oFAAoF;YACpF,wFAAwF;YACxF,wFAAwF;YACxF,0FAA0F;YAC1F,uFAAuF;YACvF,yFAAyF;YACzF,sFAAsF;YACtF,uFAAuF;YACvF,2FAA2F;YAC3F,iFAAiF;YACjF,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC3F,GAAG,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,CACJ,IAAI,KAAK,CACP,oCAAoC,MAAM,WAAW;sBACnD,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;sBACjF,gLAAgL,CACnL,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,OAAO,CAAC;gBACN,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;gBACjC,MAAM;gBACN,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,GAAG,EAAE,CACT,IAAI,OAAO,CAAS,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE;oBAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;oBAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;oBACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACzE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBAC9B,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACxB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnH,CAAC;QACH,CAAC;QAED,oFAAoF;QACpF,qFAAqF;QACrF,qFAAqF;QACrF,GAAG,CAAC,UAAU,CAAC,4BAA4B,EAAE,GAAG,EAAE;YAChD,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,gCAAgC,4BAA4B,IAAI,CAAC,CAAC,CAAC;QAC3F,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,eAAyD,EAAE;IAE3D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7D,IAAI,QAAQ,GAAG,IAAI;SAChB,OAAO,CAAC,gCAAgC,EAAE,mBAAmB,CAAC;SAC9D,OAAO,CAAC,0DAA0D,EAAE,gBAAgB,CAAC;SACrF,OAAO,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;IAClD,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChE,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kIAAkI;AAClI,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACrD,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC"}

package/dist/providers/connection-test.d.ts

@@ -0,0 +1,62 @@
+/**
+ * @module providers/connection-test
+ *
+ * BYOK connection smoke test — sends a tiny "Reply with only: ok" completion
+ * request to the configured provider endpoint and classifies the outcome, so
+ * a settings UI can tell the operator "this endpoint works" without spending
+ * a real chat turn to find out. Ported from OD's `apps/daemon/src/connectionTest.ts`
+ * (`testProviderConnection` + `buildProviderCall` + `inspectProviderCompletion`),
+ * narrowed to the four protocols `@jini-ai/ui`'s execution-tab canary exposes
+ * (`anthropic` / `openai` / `azure` / `google`) — the origin also covers
+ * `ollama` / `senseaudio` / `aihubmix` / `bedrock`, which stay out of scope
+ * here the same way `model-catalog.ts` keeps Bedrock to a static seed and
+ * Azure to an explicit "unsupported" response for model discovery.
+ *
+ * Shares this package's own vendored SSRF guard / secret redaction
+ * (`connection-guard.ts`) and vendored connectivity types (`types.ts`) —
+ * no OD workspace-package imports, matching every other file in this
+ * directory.
+ */
+import type { DnsLookupFn } from './connection-guard.js';
+import type { ConnectionTestKind, ConnectionTestProtocol } from './types.js';
+/** The four wire protocols this smoke test knows how to speak. A narrower
+ *  type than {@link ConnectionTestProtocol} on purpose — see this module's
+ *  header for what's out of scope and why. */
+export type SupportedConnectionTestProtocol = 'anthropic' | 'openai' | 'azure' | 'google';
+export interface ProviderConnectionTestRequest {
+    protocol: ConnectionTestProtocol;
+    baseUrl: string;
+    apiKey: string;
+    model: string;
+    /** Azure only — the `api-version` query param. */
+    apiVersion?: string;
+}
+export type ProviderConnectionTestInput = ProviderConnectionTestRequest & {
+    signal?: AbortSignal;
+    requestInit?: Pick<RequestInit, 'dispatcher'>;
+    /** Injectable DNS resolver for the base-URL SSRF guard; defaults to `node:dns`. */
+    dnsLookup?: DnsLookupFn;
+};
+export interface ConnectionTestResponse {
+    ok: boolean;
+    kind: ConnectionTestKind;
+    latencyMs: number;
+    model?: string;
+    status?: number;
+    detail?: string;
+}
+/**
+ * Probes a BYOK provider endpoint with the supplied credentials by sending a
+ * tiny smoke-test completion request, and classifies the result. Validates
+ * the base URL (sync + DNS-resolved SSRF guard) before issuing any request,
+ * exactly like {@link import('./model-catalog.js').listProviderModels}.
+ *
+ * Never throws for provider-side or network failures — every failure path
+ * resolves to `{ ok: false, kind, detail }`. Only truly unsupported
+ * protocols short-circuit before any network access.
+ *
+ * @complexity O(1) — one bounded-size HTTP request with a hard timeout.
+ * @overallScore 100
+ */
+export declare function testProviderConnection(input: ProviderConnectionTestInput): Promise<ConnectionTestResponse>;
+//# sourceMappingURL=connection-test.d.ts.map

package/dist/providers/connection-test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-test.d.ts","sourceRoot":"","sources":["../../src/providers/connection-test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAE7E;;8CAE8C;AAC9C,MAAM,MAAM,+BAA+B,GAAG,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE1F,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,EAAE,sBAAsB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,2BAA2B,GAAG,6BAA6B,GAAG;IACxE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC9C,mFAAmF;IACnF,SAAS,CAAC,EAAE,WAAW,CAAC;CACzB,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,kBAAkB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAuPD;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA0IhH"}