@omnicross/core 0.1.10 → 0.2.1

package/dist/chunk-DBBR6RHF.js

@@ -0,0 +1,236 @@
+// src/search/egress.ts
+import { lookup as defaultDnsLookup } from "dns";
+import { isIP } from "net";
+import {
+  isSearchProviderError,
+  SearchProviderError
+} from "@omnicross/contracts/search-types";
+import { Agent } from "undici";
+var DEFAULT_SEARCH_EGRESS_POLICY = Object.freeze({});
+var ALLOWED_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
+var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal"]);
+var DENIAL_TEXT = Object.freeze({
+  scheme: "only http and https are permitted",
+  malformed: "the request target is not a valid absolute URL",
+  loopback: "loopback addresses are not permitted",
+  unspecified: "unspecified addresses are not permitted",
+  "link-local": "link-local addresses are not permitted",
+  private: "private addresses are not permitted",
+  "unique-local": "unique-local addresses are not permitted",
+  metadata: "cloud metadata endpoints are not permitted"
+});
+function validateEgressUrl(url, policy = DEFAULT_SEARCH_EGRESS_POLICY, providerId) {
+  let parsed;
+  try {
+    parsed = url instanceof URL ? url : new URL(url);
+  } catch {
+    throw egressDenied("unknown-host", "malformed", providerId);
+  }
+  if (!ALLOWED_SCHEMES.has(parsed.protocol)) {
+    throw egressDenied(parsed.hostname || "unknown-host", "scheme", providerId, parsed.protocol);
+  }
+  const hostname = parsed.hostname;
+  if (isAllowlisted(hostname, policy)) return parsed;
+  const denial = classifyHostname(hostname);
+  if (denial) throw egressDenied(hostname, denial, providerId);
+  return parsed;
+}
+function assertEgressAddressAllowed(address, hostname, policy = DEFAULT_SEARCH_EGRESS_POLICY, providerId) {
+  if (isAllowlisted(hostname, policy)) return;
+  const denial = classifyAddress(address);
+  if (denial) throw egressDenied(hostname, denial, providerId, void 0, address);
+}
+function isAllowlisted(hostname, policy) {
+  const allowed = policy.allowedPrivateHosts;
+  if (!allowed || allowed.length === 0) return false;
+  const normalized = normalizeHostname(hostname);
+  return allowed.some((entry) => normalizeHostname(entry) === normalized);
+}
+function normalizeHostname(hostname) {
+  const trimmed = hostname.trim().toLowerCase().replace(/\.+$/, "");
+  return trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
+}
+function classifyHostname(hostname) {
+  const candidate = normalizeHostname(hostname);
+  if (candidate === "") return "malformed";
+  const version = isIP(candidate);
+  if (version !== 0) return classifyAddress(candidate);
+  if (candidate === "localhost" || candidate.endsWith(".localhost")) return "loopback";
+  if (METADATA_HOSTNAMES.has(candidate)) return "metadata";
+  return void 0;
+}
+function classifyAddress(address) {
+  const candidate = normalizeHostname(address);
+  const version = isIP(candidate);
+  if (version === 4) return classifyIPv4(candidate);
+  if (version === 6) return classifyIPv6(candidate);
+  return "malformed";
+}
+function classifyIPv4(address) {
+  const octets = address.split(".").map((part) => Number.parseInt(part, 10));
+  if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet))) return "malformed";
+  const [a, b, c, d] = octets;
+  if (a === 127) return "loopback";
+  if (a === 0) return "unspecified";
+  if (a === 10) return "private";
+  if (a === 172 && b >= 16 && b <= 31) return "private";
+  if (a === 192 && b === 168) return "private";
+  if (a === 169 && b === 254 && c === 169 && d === 254) return "metadata";
+  if (a === 169 && b === 254) return "link-local";
+  return void 0;
+}
+function classifyIPv6(address) {
+  const pieces = parseIPv6Pieces(address);
+  if (!pieces) return "malformed";
+  const topIsZero = pieces.slice(0, 5).every((piece) => piece === 0);
+  if (topIsZero && (pieces[5] === 65535 || pieces[5] === 0)) {
+    const embedded = [pieces[6] >> 8, pieces[6] & 255, pieces[7] >> 8, pieces[7] & 255];
+    const isLoopbackOrUnspecified = pieces[5] === 0 && pieces[6] === 0 && pieces[7] <= 1;
+    if (isLoopbackOrUnspecified) return pieces[7] === 1 ? "loopback" : "unspecified";
+    return classifyIPv4(embedded.join("."));
+  }
+  if ((pieces[0] & 65472) === 65152) return "link-local";
+  if ((pieces[0] & 65024) === 64512) return "unique-local";
+  return void 0;
+}
+function parseIPv6Pieces(address) {
+  let text = address.split("%")[0];
+  const lastColon = text.lastIndexOf(":");
+  const tail = text.slice(lastColon + 1);
+  if (tail.includes(".")) {
+    if (isIP(tail) !== 4) return void 0;
+    const octets = tail.split(".").map((part) => Number.parseInt(part, 10));
+    const high = (octets[0] << 8 | octets[1]).toString(16);
+    const low = (octets[2] << 8 | octets[3]).toString(16);
+    text = `${text.slice(0, lastColon + 1)}${high}:${low}`;
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return void 0;
+  const head = halves[0] === "" ? [] : halves[0].split(":");
+  const rest = halves.length === 2 ? halves[1] === "" ? [] : halves[1].split(":") : [];
+  let groups;
+  if (halves.length === 1) {
+    if (head.length !== 8) return void 0;
+    groups = head;
+  } else {
+    const zeros = 8 - head.length - rest.length;
+    if (zeros < 1) return void 0;
+    groups = [...head, ...Array.from({ length: zeros }, () => "0"), ...rest];
+  }
+  const pieces = [];
+  for (const group of groups) {
+    if (!/^[0-9a-f]{1,4}$/i.test(group)) return void 0;
+    pieces.push(Number.parseInt(group, 16));
+  }
+  return pieces;
+}
+function egressDenied(hostname, reason, providerId, scheme, resolvedAddress) {
+  const subject = scheme ? `scheme "${scheme}"` : `host "${hostname}"`;
+  const via = resolvedAddress ? ` (resolved to a ${reason} address)` : "";
+  const details = { host: hostname, egressClass: reason };
+  if (resolvedAddress) details.egressStage = "dns";
+  return new SearchProviderError(
+    "policy_denied",
+    `egress policy denied ${subject}${via}: ${DENIAL_TEXT[reason]}`,
+    {
+      providerId,
+      retryable: false,
+      details
+    }
+  );
+}
+function findEgressDenial(error) {
+  let current = error;
+  for (let depth = 0; depth < 6 && current !== void 0 && current !== null; depth += 1) {
+    if (isSearchProviderError(current) && current.code === "policy_denied") {
+      return current;
+    }
+    current = current instanceof Error ? current.cause : void 0;
+  }
+  return void 0;
+}
+function createEgressGuardedLookup(policy = DEFAULT_SEARCH_EGRESS_POLICY, lookupImpl = defaultDnsLookup) {
+  const guarded = (hostname, options, callback) => {
+    const requestedAll = Boolean(options?.all);
+    const lookupOptions = { ...options, all: true };
+    lookupImpl(hostname, lookupOptions, (error, addresses) => {
+      if (error) {
+        callback(error);
+        return;
+      }
+      const entries = Array.isArray(addresses) ? addresses : [];
+      if (entries.length === 0) {
+        callback(new Error(`no addresses resolved for ${hostname}`));
+        return;
+      }
+      try {
+        for (const entry of entries) assertEgressAddressAllowed(entry.address, hostname, policy);
+      } catch (denial) {
+        callback(denial);
+        return;
+      }
+      if (requestedAll) callback(null, entries);
+      else callback(null, entries[0].address, entries[0].family);
+    });
+  };
+  return guarded;
+}
+var guardedDispatchers = /* @__PURE__ */ new Map();
+function createEgressGuardedDispatcher(policy = DEFAULT_SEARCH_EGRESS_POLICY, lookupImpl) {
+  if (lookupImpl) {
+    return new Agent({ connect: { lookup: createEgressGuardedLookup(policy, lookupImpl) } });
+  }
+  const signature = JSON.stringify(normalizePolicy(policy));
+  const cached = guardedDispatchers.get(signature);
+  if (cached) return cached;
+  const dispatcher = new Agent({ connect: { lookup: createEgressGuardedLookup(policy) } });
+  guardedDispatchers.set(signature, dispatcher);
+  return dispatcher;
+}
+function normalizePolicy(policy) {
+  return {
+    allowedPrivateHosts: [...policy.allowedPrivateHosts ?? []].map(normalizeHostname).sort((left, right) => left < right ? -1 : left > right ? 1 : 0)
+  };
+}
+
+// src/search/http/proxy.ts
+import { EnvHttpProxyAgent } from "undici";
+var cachedProxySignature = "";
+var cachedProxyDispatcher;
+function resolveSearchProxySettings(env = process.env) {
+  const allProxy = firstNonEmpty(env.all_proxy, env.ALL_PROXY);
+  const httpProxy = firstNonEmpty(env.http_proxy, env.HTTP_PROXY, allProxy);
+  const httpsProxy = firstNonEmpty(env.https_proxy, env.HTTPS_PROXY, allProxy);
+  if (!httpProxy && !httpsProxy) return void 0;
+  const noProxy = firstNonEmpty(env.no_proxy, env.NO_PROXY);
+  return {
+    ...httpProxy ? { httpProxy } : {},
+    ...httpsProxy ? { httpsProxy } : {},
+    ...noProxy ? { noProxy } : {}
+  };
+}
+function getSearchProxyDispatcher(proxy) {
+  const signature = JSON.stringify(proxy);
+  if (cachedProxyDispatcher && cachedProxySignature === signature) return cachedProxyDispatcher;
+  cachedProxySignature = signature;
+  cachedProxyDispatcher = new EnvHttpProxyAgent(proxy);
+  return cachedProxyDispatcher;
+}
+function firstNonEmpty(...values) {
+  for (const value of values) {
+    const trimmed = value?.trim();
+    if (trimmed) return trimmed;
+  }
+  return void 0;
+}
+
+export {
+  DEFAULT_SEARCH_EGRESS_POLICY,
+  validateEgressUrl,
+  assertEgressAddressAllowed,
+  findEgressDenial,
+  createEgressGuardedLookup,
+  createEgressGuardedDispatcher,
+  resolveSearchProxySettings,
+  getSearchProxyDispatcher
+};

package/dist/chunk-E4QHVXV5.cjs

@@ -0,0 +1,118 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }// src/search/frontends.ts
+var SEARCH_FRONTEND_NAMES = Object.freeze([
+  "codex",
+  "responses",
+  "anthropic"
+]);
+var SEARCH_FRONTEND_MODES = Object.freeze([
+  "native",
+  "managed",
+  "off"
+]);
+var DEFAULT_SEARCH_FRONTEND_MODES = Object.freeze({
+  codex: "off",
+  responses: "native",
+  anthropic: "native"
+});
+var SEARCH_UNSUPPORTED_CAPABILITY_CODE = "unsupported_capability";
+function searchErrorHttpStatus(code) {
+  switch (code) {
+    case "rate_limited":
+      return 429;
+    case "timeout":
+      return 504;
+    case "cancelled":
+      return 499;
+    case "config_missing":
+      return 503;
+    case "auth_failed":
+    case "upstream_unavailable":
+    case "parse_failed":
+    case "policy_denied":
+      return 502;
+    default:
+      return 502;
+  }
+}
+function isSearchFrontendMode(value) {
+  return typeof value === "string" && SEARCH_FRONTEND_MODES.includes(value);
+}
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function normalizeSearchFrontendModes(value) {
+  const raw = _nullishCoalesce(record(value), () => ( {}));
+  const modes = {
+    ...DEFAULT_SEARCH_FRONTEND_MODES
+  };
+  for (const name of SEARCH_FRONTEND_NAMES) {
+    const candidate = raw[name];
+    if (isSearchFrontendMode(candidate)) modes[name] = candidate;
+  }
+  return Object.freeze(modes);
+}
+function validateSearchFrontendModes(value, path = "$.search.modes") {
+  if (value === void 0) return [];
+  const raw = record(value);
+  if (!raw) return [`${path}: expected an object`];
+  const errors = [];
+  for (const [key, candidate] of Object.entries(raw)) {
+    if (!SEARCH_FRONTEND_NAMES.includes(key)) {
+      errors.push(`${path}.${key}: unknown frontend (expected ${SEARCH_FRONTEND_NAMES.join(", ")})`);
+      continue;
+    }
+    if (isSearchFrontendMode(candidate)) continue;
+    errors.push(
+      `${path}.${key}: not a mode (got ${typeof candidate}; expected ${SEARCH_FRONTEND_MODES.join(", ")})`
+    );
+  }
+  return errors;
+}
+
+// src/search/webSearchBackendCompat.ts
+
+
+
+var _searchcompat = require('@omnicross/contracts/search-compat');
+var _searchtypes = require('@omnicross/contracts/search-types');
+function searchRuntimeAsWebSearchBackend(runtime, options = {}) {
+  return {
+    async search(query, providerId, searchOptions) {
+      try {
+        const response = await runtime.search({
+          query,
+          provider: providerId,
+          // `WebSearchOptions` is a strict subset of `SearchOptions` with
+          // identical field names — asserted in the contracts tests.
+          ...searchOptions === void 0 ? {} : { options: searchOptions }
+        });
+        return _searchcompat.toLegacyWebSearchResponse.call(void 0, response);
+      } catch (error) {
+        return _searchcompat.searchErrorToLegacyWebSearchResponse.call(void 0, query, _searchtypes.toSearchErrorShape.call(void 0, error));
+      }
+    },
+    isProviderEnabled(id) {
+      return runtime.listProviders().some((descriptor) => descriptor.id === id);
+    },
+    async readUrl(url, readOptions) {
+      if (options.readUrl !== void 0) return options.readUrl(url, readOptions);
+      return {
+        success: false,
+        url,
+        error: "URL reading is not available through the search runtime adapter"
+      };
+    }
+  };
+}
+
+
+
+
+
+
+
+
+
+
+
+exports.SEARCH_FRONTEND_NAMES = SEARCH_FRONTEND_NAMES; exports.SEARCH_FRONTEND_MODES = SEARCH_FRONTEND_MODES; exports.DEFAULT_SEARCH_FRONTEND_MODES = DEFAULT_SEARCH_FRONTEND_MODES; exports.SEARCH_UNSUPPORTED_CAPABILITY_CODE = SEARCH_UNSUPPORTED_CAPABILITY_CODE; exports.searchErrorHttpStatus = searchErrorHttpStatus; exports.isSearchFrontendMode = isSearchFrontendMode; exports.normalizeSearchFrontendModes = normalizeSearchFrontendModes; exports.validateSearchFrontendModes = validateSearchFrontendModes; exports.searchRuntimeAsWebSearchBackend = searchRuntimeAsWebSearchBackend;