@namzu/sdk 27.1.0 → 29.0.0

package/src/connector/mcp/{server-stdio.ts → server/server-stdio.ts}

@@ -1,7 +1,8 @@
 import type { Readable, Writable } from 'node:stream'
+import { SCOPE_ATTRIBUTE } from '../../../utils/log/types.js'
 
-import type { MCPJsonRpcMessage, MCPTransport } from '../../types/connector/mcp.js'
-import { type Logger, getRootLogger } from '../../utils/logger.js'
+import type { MCPJsonRpcMessage, MCPTransport } from '../../../types/connector/mcp.js'
+import { type Logger, resolveLogger } from '../../../utils/logger.js'
 
 /**
  * The server half of stdio, so `MCPServer` has something to run on.
@@ -48,10 +49,10 @@ export class ServerStdioTransport implements MCPTransport {
 	 * that replaced `process.stdin` would break every other test sharing
 	 * the runner.
 	 */
-	constructor(streams?: { input?: Readable; output?: Writable }) {
+	constructor(streams?: { input?: Readable; output?: Writable }, log?: Logger) {
 		this.input = streams?.input ?? process.stdin
 		this.output = streams?.output ?? process.stdout
-		this.log = getRootLogger().child({ component: 'ServerStdioTransport' })
+		this.log = resolveLogger(log).child({ [SCOPE_ATTRIBUTE]: 'connector/mcp/server/stdio' })
 	}
 
 	async connect(): Promise<void> {

package/src/connector/mcp/{server.ts → server/server.ts}

@@ -1,4 +1,5 @@
-import { JSON_RPC_METHOD_NOT_FOUND } from '../../constants/mcp/index.js'
+import { JSON_RPC_METHOD_NOT_FOUND } from '../../../constants/mcp/index.js'
+import { NAMZU } from '../../../constants/telemetry/index.js'
 import type {
 	MCPContentBlock,
 	MCPJsonRpcMessage,
@@ -9,12 +10,13 @@ import type {
 	MCPToolDefinition,
 	MCPToolResult,
 	MCPTransport,
-} from '../../types/connector/index.js'
-import type { MCPPromptDefinition, MCPPromptMessage } from '../../types/connector/index.js'
-import type { MCPServerId } from '../../types/ids/index.js'
-import { toErrorMessage } from '../../utils/error.js'
-import { generateMCPServerId } from '../../utils/id.js'
-import { type Logger, getRootLogger } from '../../utils/logger.js'
+} from '../../../types/connector/index.js'
+import type { MCPPromptDefinition, MCPPromptMessage } from '../../../types/connector/index.js'
+import type { MCPServerId } from '../../../types/ids/index.js'
+import { toErrorMessage } from '../../../utils/error.js'
+import { generateMCPServerId } from '../../../utils/id.js'
+import { SCOPE_ATTRIBUTE } from '../../../utils/log/types.js'
+import { type Logger, resolveLogger } from '../../../utils/logger.js'
 
 /**
  * A method this server does not implement.
@@ -73,13 +75,17 @@ export class MCPServer {
 		toolProvider: MCPServerToolProvider,
 		resourceProvider?: MCPServerResourceProvider,
 		promptProvider?: MCPServerPromptProvider,
+		log?: Logger,
 	) {
 		this.id = config.id ?? generateMCPServerId()
 		this.config = config
 		this.toolProvider = toolProvider
 		this.resourceProvider = resourceProvider
 		this.promptProvider = promptProvider
-		this.log = getRootLogger().child({ component: 'MCPServer', serverId: this.id })
+		this.log = resolveLogger(log).child({
+			[SCOPE_ATTRIBUTE]: 'connector/mcp/server',
+			[NAMZU.MCP_SERVER_ID]: this.id,
+		})
 	}
 
 	async start(transport: MCPTransport): Promise<void> {
@@ -95,13 +101,13 @@ export class MCPServer {
 			this.log.info('MCP client disconnected')
 		})
 		transport.onError((err) => {
-			this.log.error('MCP server transport error', { error: err.message })
+			this.log.error('MCP server transport error', { 'exception.message': err.message })
 		})
 
 		await transport.connect()
 		this.running = true
 		this.startedAt = Date.now()
-		this.log.info(`MCPServer "${this.config.name}" started`)
+		this.log.info('MCPServer started', { 'namzu.mcp.server_name': this.config.name })
 	}
 
 	async stop(): Promise<void> {
@@ -111,7 +117,7 @@ export class MCPServer {
 			await this.transport.close()
 			this.transport = null
 		}
-		this.log.info(`MCPServer "${this.config.name}" stopped`)
+		this.log.info('MCPServer stopped', { 'namzu.mcp.server_name': this.config.name })
 	}
 
 	isRunning(): boolean {

package/src/connector/mcp/stdio.ts

@@ -4,7 +4,8 @@ import type {
 	MCPStdioTransportConfig,
 	MCPTransport,
 } from '../../types/connector/index.js'
-import { type Logger, getRootLogger } from '../../utils/logger.js'
+import { SCOPE_ATTRIBUTE } from '../../utils/log/types.js'
+import { type Logger, resolveLogger } from '../../utils/logger.js'
 
 /**
  * How long a child gets to honour SIGTERM before SIGKILL. Two seconds is
@@ -129,8 +130,11 @@ export class StdioTransport implements MCPTransport {
 	private buffer = ''
 	private log: Logger
 
-	constructor(private readonly config: MCPStdioTransportConfig) {
-		this.log = getRootLogger().child({ component: 'StdioTransport' })
+	constructor(
+		private readonly config: MCPStdioTransportConfig,
+		log?: Logger,
+	) {
+		this.log = resolveLogger(log).child({ [SCOPE_ATTRIBUTE]: 'connector/mcp/stdio' })
 	}
 
 	async connect(): Promise<void> {
@@ -148,12 +152,14 @@ export class StdioTransport implements MCPTransport {
 		})
 
 		this.process.stderr?.on('data', (chunk: Buffer) => {
-			this.log.warn(`MCP server stderr: ${chunk.toString('utf-8').trim()}`)
+			this.log.warn('MCP server stderr', {
+				'namzu.mcp.stderr': chunk.toString('utf-8').trim(),
+			})
 		})
 
 		this.process.on('close', (code) => {
 			this.connected = false
-			this.log.info(`MCP server process exited with code ${code}`)
+			this.log.info('MCP server process exited', { 'namzu.mcp.exit_code': code })
 			for (const handler of this.closeHandlers) handler()
 			// After the notification, not before it: this event is what tells
 			// `MCPClient` the session ended.
@@ -167,9 +173,10 @@ export class StdioTransport implements MCPTransport {
 		})
 
 		this.connected = true
-		this.log.info(
-			`StdioTransport connected: ${this.config.command} ${(this.config.args ?? []).join(' ')}`,
-		)
+		this.log.info('StdioTransport connected', {
+			'namzu.mcp.command': this.config.command,
+			'namzu.mcp.args': (this.config.args ?? []).join(' '),
+		})
 	}
 
 	async close(): Promise<void> {
@@ -272,7 +279,9 @@ export class StdioTransport implements MCPTransport {
 				const message = JSON.parse(trimmed) as MCPJsonRpcMessage
 				for (const handler of this.messageHandlers) handler(message)
 			} catch {
-				this.log.warn(`StdioTransport: invalid JSON-RPC message: ${trimmed.slice(0, 100)}`)
+				this.log.warn('StdioTransport: invalid JSON-RPC message', {
+					'namzu.mcp.message_head': trimmed.slice(0, 100),
+				})
 			}
 		}
 	}

package/src/connector/mcp/streamable-http.ts

@@ -3,7 +3,8 @@ import type {
 	MCPStreamableHttpTransportConfig,
 	MCPTransport,
 } from '../../types/connector/index.js'
-import { type Logger, getRootLogger } from '../../utils/logger.js'
+import { SCOPE_ATTRIBUTE } from '../../utils/log/types.js'
+import { type Logger, resolveLogger } from '../../utils/logger.js'
 
 const DEFAULT_TIMEOUT_MS = 30_000
 
@@ -15,14 +16,17 @@ export class StreamableHttpTransport implements MCPTransport {
 	private sessionId: string | null = null
 	private log: Logger
 
-	constructor(private readonly config: MCPStreamableHttpTransportConfig) {
-		this.log = getRootLogger().child({ component: 'StreamableHttpTransport' })
+	constructor(
+		private readonly config: MCPStreamableHttpTransportConfig,
+		log?: Logger,
+	) {
+		this.log = resolveLogger(log).child({ [SCOPE_ATTRIBUTE]: 'connector/mcp/streamable-http' })
 	}
 
 	async connect(): Promise<void> {
 		if (this.connected) return
 		this.connected = true
-		this.log.info(`StreamableHttpTransport connected to ${this.config.url}`)
+		this.log.info('StreamableHttpTransport connected', { 'namzu.mcp.url': this.config.url })
 	}
 
 	async close(): Promise<void> {

package/src/{bridge/tools/connector → connector/tools}/adapter.ts

@@ -1,9 +1,9 @@
 import { z } from 'zod'
-import type { ConnectorManager } from '../../../manager/connector/lifecycle.js'
-import type { ConnectorMethod } from '../../../types/connector/index.js'
-import type { ConnectorId, ConnectorInstanceId } from '../../../types/ids/index.js'
-import type { ToolContext, ToolDefinition, ToolResult } from '../../../types/tool/index.js'
-import { parseConnectorInstanceId } from '../../../utils/id.js'
+import type { ConnectorManager } from '../../manager/connector/lifecycle.js'
+import type { ConnectorMethod } from '../../types/connector/index.js'
+import type { ConnectorId, ConnectorInstanceId } from '../../types/ids/index.js'
+import type { ToolContext, ToolDefinition, ToolResult } from '../../types/tool/index.js'
+import { parseConnectorInstanceId } from '../../utils/id.js'
 
 export function connectorMethodToTool(
 	connectorId: ConnectorId,

package/src/{bridge/tools/connector → connector/tools}/definitions.ts

@@ -1,8 +1,8 @@
 import { z } from 'zod'
-import type { ConnectorManager } from '../../../manager/connector/lifecycle.js'
-import { defineTool } from '../../../tools/defineTool.js'
-import type { ToolDefinition } from '../../../types/tool/index.js'
-import { parseConnectorInstanceId } from '../../../utils/id.js'
+import type { ConnectorManager } from '../../manager/connector/lifecycle.js'
+import { defineTool } from '../../tools/defineTool.js'
+import type { ToolDefinition } from '../../types/tool/index.js'
+import { parseConnectorInstanceId } from '../../utils/id.js'
 
 export interface ConnectorToolConfig {
 	manager: ConnectorManager

package/src/{bridge/tools/connector → connector/tools}/router.ts

@@ -1,7 +1,8 @@
-import type { ConnectorManager } from '../../../manager/connector/lifecycle.js'
-import type { ToolDefinition, ToolRegistryContract } from '../../../types/tool/index.js'
-import { toErrorMessage } from '../../../utils/error.js'
-import { type Logger, getRootLogger } from '../../../utils/logger.js'
+import type { ConnectorManager } from '../../manager/connector/lifecycle.js'
+import type { ToolDefinition, ToolRegistryContract } from '../../types/tool/index.js'
+import { toErrorMessage } from '../../utils/error.js'
+import { SCOPE_ATTRIBUTE } from '../../utils/log/types.js'
+import { type Logger, resolveLogger } from '../../utils/logger.js'
 import { connectorInstanceToTools, createConnectorRouterTool } from './adapter.js'
 
 export type ConnectorToolStrategy = 'per-method' | 'router'
@@ -9,6 +10,7 @@ export type ConnectorToolStrategy = 'per-method' | 'router'
 export interface ConnectorToolRouterConfig {
 	manager: ConnectorManager
 	strategy?: ConnectorToolStrategy
+	log?: Logger
 }
 
 export class ConnectorToolRouter {
@@ -19,7 +21,7 @@ export class ConnectorToolRouter {
 	constructor(config: ConnectorToolRouterConfig) {
 		this.manager = config.manager
 		this.strategy = config.strategy ?? 'per-method'
-		this.log = getRootLogger().child({ component: 'ConnectorToolRouter' })
+		this.log = resolveLogger(config.log).child({ [SCOPE_ATTRIBUTE]: 'connector/tools/router' })
 	}
 
 	getTools(): ToolDefinition[] {
@@ -34,8 +36,9 @@ export class ConnectorToolRouter {
 			try {
 				tools.push(...connectorInstanceToTools(instance.id, this.manager))
 			} catch (err) {
-				this.log.error(`Failed to create tools for instance ${instance.id}`, {
-					error: toErrorMessage(err),
+				this.log.error('Failed to create tools for a connector instance', {
+					'namzu.connector.instance_id': instance.id,
+					'exception.message': toErrorMessage(err),
 				})
 			}
 		}
@@ -49,7 +52,10 @@ export class ConnectorToolRouter {
 			toolRegistry.register(tool)
 			names.push(tool.name)
 		}
-		this.log.info(`Registered ${names.length} connector tools`, { tools: names })
+		this.log.info('Registered connector tools', {
+			'namzu.connector.tool_count': names.length,
+			'namzu.tool.names': names,
+		})
 		return names
 	}
 
@@ -57,7 +63,9 @@ export class ConnectorToolRouter {
 		for (const name of toolNames) {
 			toolRegistry.unregister(name)
 		}
-		this.log.info(`Unregistered ${toolNames.length} connector tools`)
+		this.log.info('Unregistered connector tools', {
+			'namzu.connector.tool_count': toolNames.length,
+		})
 	}
 
 	refreshTools(toolRegistry: ToolRegistryContract, previousNames: string[]): string[] {

package/src/connector/web/guarded-fetch.ts

@@ -0,0 +1,288 @@
+import { lookup } from 'node:dns/promises'
+import { isIP } from 'node:net'
+
+import {
+	type WebFetchProvider,
+	WebFetchRefusedError,
+	type WebFetchRequest,
+	type WebFetchResult,
+} from './types.js'
+
+/**
+ * Fetching a URL a model chose, without handing it the inside of the host.
+ *
+ * A model naming a URL is untrusted input reaching the network stack, and
+ * the network the agent runs on is not the network the model is thinking
+ * about. `http://169.254.169.254/` is a cloud metadata endpoint holding
+ * credentials; `http://localhost:6379/` is whatever the host runs on 6379;
+ * `file:///etc/passwd` is not even the network. None of those look unusual
+ * in a URL a model produced while reasoning about a public site.
+ *
+ * So this refuses rather than filtering afterwards. A response body already
+ * fetched is already a request that happened, and for a metadata endpoint
+ * the request IS the exfiltration — the body only decides whether the model
+ * gets to read what was taken.
+ */
+
+/** Every scheme this will follow. Everything else is refused by name. */
+const ALLOWED_SCHEMES = new Set(['http:', 'https:'])
+
+const DEFAULT_MAX_REDIRECTS = 5
+const DEFAULT_MAX_BYTES = 2 * 1024 * 1024
+const DEFAULT_TIMEOUT_MS = 30_000
+
+/**
+ * Headers this never forwards, whatever the caller asked for.
+ *
+ * A tool argument is model-authored, so `headers` is a channel from the
+ * model into an outbound request. `authorization` and `cookie` are the two
+ * that turn "fetch this page" into "fetch this page as me", and `host` is
+ * how a request to an allowed address gets routed to a different virtual
+ * host than the one that was checked.
+ */
+const STRIPPED_HEADERS = new Set(['authorization', 'cookie', 'host', 'proxy-authorization'])
+
+export interface GuardedFetchConfig {
+	/** Injected so a test needs no socket. Defaults to the global `fetch`. */
+	readonly fetch?: typeof globalThis.fetch
+	readonly maxRedirects?: number
+	readonly maxBytes?: number
+	readonly timeoutMs?: number
+	/**
+	 * Hostnames this must refuse regardless of where they resolve.
+	 *
+	 * A host's own belt on top of the address check: an internal name that
+	 * resolves publicly is not caught by an IP-range rule, and only the host
+	 * knows its own names.
+	 */
+	readonly blockedHosts?: readonly string[]
+	/**
+	 * Allow addresses the private-range check would refuse.
+	 *
+	 * `false`, and the default is the whole point. A test fixture on
+	 * `127.0.0.1` is the one legitimate case, and it is a decision a host
+	 * makes explicitly rather than one it inherits.
+	 */
+	readonly allowPrivateAddresses?: boolean
+	/**
+	 * How a hostname becomes addresses. Defaults to `node:dns`.
+	 *
+	 * Injected for the reason `fetch` is: a test that has to reach a real
+	 * resolver is a test that depends on somebody's DNS. It is also the seam
+	 * a host uses to pin resolution — see `assertAllowed` for the rebinding
+	 * gap this cannot close on its own.
+	 */
+	readonly resolve?: (hostname: string) => Promise<readonly string[]>
+}
+
+/**
+ * Is this address inside the host's own network?
+ *
+ * Written out rather than pulled from a dependency, because the list is
+ * short, stable, and the thing being protected is worth reading in full.
+ * IPv6 included: `::1` is loopback and `fc00::/7` is unique-local, and a
+ * guard that checked only IPv4 would be bypassed by a name with a AAAA
+ * record.
+ */
+export function isPrivateAddress(address: string): boolean {
+	const kind = isIP(address)
+	if (kind === 4) {
+		const parts = address.split('.').map(Number)
+		const [a = 0, b = 0] = parts
+		if (a === 127) return true // loopback
+		if (a === 10) return true // private
+		if (a === 172 && b >= 16 && b <= 31) return true // private
+		if (a === 192 && b === 168) return true // private
+		if (a === 169 && b === 254) return true // link-local, incl. cloud metadata
+		if (a === 0) return true // "this network"
+		if (a >= 224) return true // multicast and reserved
+		return false
+	}
+	if (kind === 6) {
+		const lower = address.toLowerCase().replace(/^\[|\]$/g, '')
+		if (lower === '::1' || lower === '::') return true
+		if (lower.startsWith('fe80')) return true // link-local
+		if (/^f[cd]/.test(lower)) return true // unique-local fc00::/7
+		// An IPv4-mapped address (::ffff:127.0.0.1) is an IPv4 address
+		// wearing an IPv6 spelling, and refusing it needs the IPv4 rules.
+		const mapped = lower.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/)
+		if (mapped?.[1]) return isPrivateAddress(mapped[1])
+		return false
+	}
+	return false
+}
+
+export class GuardedFetchProvider implements WebFetchProvider {
+	constructor(private readonly config: GuardedFetchConfig = {}) {}
+
+	private get maxRedirects(): number {
+		return this.config.maxRedirects ?? DEFAULT_MAX_REDIRECTS
+	}
+
+	/**
+	 * Refuse a URL before anything is sent.
+	 *
+	 * Called for the original URL AND for every redirect target. That
+	 * repetition is the point: checking once and then following redirects is
+	 * the classic version of this bug — a permitted public URL answers
+	 * `302 -> http://169.254.169.254/`, and a fetch that validated only what
+	 * the caller typed follows it happily.
+	 */
+	private async assertAllowed(rawUrl: string): Promise<URL> {
+		let url: URL
+		try {
+			url = new URL(rawUrl)
+		} catch {
+			throw new WebFetchRefusedError(`"${rawUrl}" is not a URL.`, {
+				url: rawUrl,
+				reason: 'scheme',
+			})
+		}
+
+		if (!ALLOWED_SCHEMES.has(url.protocol)) {
+			// Named rather than generic: `file:` and `data:` are the ones a
+			// model reaches for by accident, and telling it which scheme was
+			// refused is what lets it correct itself.
+			throw new WebFetchRefusedError(
+				`Refused "${url.protocol}" — only http and https are fetched.`,
+				{ url: rawUrl, reason: 'scheme' },
+			)
+		}
+
+		const hostname = url.hostname.toLowerCase().replace(/^\[|\]$/g, '')
+		if (this.config.blockedHosts?.some((blocked) => blocked.toLowerCase() === hostname)) {
+			throw new WebFetchRefusedError(`Refused "${hostname}" — the host blocks this name.`, {
+				url: rawUrl,
+				reason: 'blocked-host',
+			})
+		}
+
+		if (this.config.allowPrivateAddresses === true) return url
+
+		// RESOLVED, not just parsed. A hostname check alone is bypassed by any
+		// name whose A record points inside — which is a thing anyone can set
+		// up on a domain they own, and costs nothing to try.
+		//
+		// The residual gap is stated rather than hidden: between this lookup
+		// and the connection, the name can be re-resolved to something else
+		// (DNS rebinding). Closing that needs the fetch to pin the address it
+		// checked, which the platform `fetch` gives no way to do. A host that
+		// needs that guarantee supplies its own `fetch` that does.
+		const resolve =
+			this.config.resolve ??
+			(async (name: string) => (await lookup(name, { all: true })).map((r) => r.address))
+		let addresses: readonly string[]
+		if (isIP(hostname)) {
+			addresses = [hostname]
+		} else {
+			try {
+				addresses = await resolve(hostname)
+			} catch (err) {
+				// REFUSE. `.catch(() => [])` was the first version of this line
+				// and it is fail-open: an empty list satisfies the loop below,
+				// so a name nobody could resolve was treated as a name with no
+				// private addresses — and the fetch that followed would resolve
+				// it again for real, against whatever answered the second time.
+				throw new WebFetchRefusedError(
+					`Refused "${hostname}" — it could not be resolved (${err instanceof Error ? err.message : String(err)}), so nothing here can say where it points.`,
+					{ url: rawUrl, reason: 'private-address' },
+				)
+			}
+			if (addresses.length === 0) {
+				throw new WebFetchRefusedError(`Refused "${hostname}" — it resolves to no addresses.`, {
+					url: rawUrl,
+					reason: 'private-address',
+				})
+			}
+		}
+
+		for (const address of addresses) {
+			if (isPrivateAddress(address)) {
+				throw new WebFetchRefusedError(
+					`Refused "${hostname}" — it resolves to ${address}, inside this host's own network.`,
+					{ url: rawUrl, reason: 'private-address' },
+				)
+			}
+		}
+		return url
+	}
+
+	async fetch(request: WebFetchRequest): Promise<WebFetchResult> {
+		const doFetch = this.config.fetch ?? globalThis.fetch
+		const timeoutMs = this.config.timeoutMs ?? DEFAULT_TIMEOUT_MS
+		const maxBytes = this.config.maxBytes ?? DEFAULT_MAX_BYTES
+
+		const headers: Record<string, string> = {}
+		for (const [key, value] of Object.entries(request.headers ?? {})) {
+			if (!STRIPPED_HEADERS.has(key.toLowerCase())) headers[key] = value
+		}
+
+		const timer = new AbortController()
+		const deadline = setTimeout(() => timer.abort(), timeoutMs)
+		// Both: the caller's cancel and our own deadline. Honouring only one
+		// leaves the other unable to stop a fetch that has stopped being
+		// wanted.
+		request.signal?.addEventListener('abort', () => timer.abort(), { once: true })
+
+		try {
+			const redirects: string[] = []
+			let current = await this.assertAllowed(request.url)
+
+			for (let hop = 0; ; hop++) {
+				if (hop > this.maxRedirects) {
+					throw new WebFetchRefusedError(
+						`Refused after ${this.maxRedirects} redirects from "${request.url}".`,
+						{ url: request.url, reason: 'redirect-limit' },
+					)
+				}
+				redirects.push(current.toString())
+
+				// `manual`, so every hop comes back here to be checked. Letting
+				// the platform follow redirects is exactly the hole this class
+				// exists to close: it would land on the final URL having never
+				// asked whether that URL was allowed.
+				const response = await doFetch(current, {
+					headers,
+					redirect: 'manual',
+					signal: timer.signal,
+				})
+
+				const location = response.headers.get('location')
+				if (response.status >= 300 && response.status < 400 && location) {
+					// Resolved against the current URL, because a `Location` may
+					// be relative — and a relative one that is not resolved would
+					// be checked as a different URL than the one followed.
+					const next = new URL(location, current)
+					try {
+						current = await this.assertAllowed(next.toString())
+					} catch (err) {
+						if (err instanceof WebFetchRefusedError) {
+							throw new WebFetchRefusedError(
+								`A redirect from "${current.toString()}" pointed at "${next.toString()}", which was refused: ${err.message}`,
+								{ url: next.toString(), reason: 'redirect-target' },
+							)
+						}
+						throw err
+					}
+					continue
+				}
+
+				const text = await response.text()
+				const truncated = Buffer.byteLength(text) > maxBytes
+				const body = truncated ? Buffer.from(text).subarray(0, maxBytes).toString('utf8') : text
+				const contentType = response.headers.get('content-type') ?? undefined
+
+				return {
+					url: current.toString(),
+					status: response.status,
+					...(contentType === undefined ? {} : { contentType }),
+					body,
+					truncated,
+					redirects,
+				}
+			}
+		} finally {
+			clearTimeout(deadline)
+		}
+	}
+}

package/src/connector/web/index.ts

@@ -0,0 +1,17 @@
+// Reaching the web, as a seam. Fetching is implemented here because its
+// rules are about the network and the same everywhere; searching is not,
+// and ships with no vendor. See `types.ts` for why that asymmetry is the
+// design rather than an omission.
+export { GuardedFetchProvider, isPrivateAddress } from './guarded-fetch.js'
+export type { GuardedFetchConfig } from './guarded-fetch.js'
+export { WebFetchRefusedError } from './types.js'
+export type {
+	WebFetchProvider,
+	WebFetchRefusalReason,
+	WebFetchRequest,
+	WebFetchResult,
+	WebSearchHit,
+	WebSearchProvider,
+	WebSearchRequest,
+	WebSearchResult,
+} from './types.js'