@omnicross/core 0.2.0 → 0.2.1

package/dist/egress-I46O_p5L.d.cts

@@ -0,0 +1,126 @@
+import { lookup } from 'node:dns';
+import { SearchProviderId, SearchProviderError } from '@omnicross/contracts/search-types';
+import { Dispatcher } from 'undici';
+
+/**
+ * The SSRF egress policy every search network path runs through
+ * (plan hard-constraint 7).
+ *
+ * 阶段4 introduces the first attacker-influenceable network surface in the
+ * search tree: a custom `apiHost`. Until now every search request went to one
+ * of two fixed engines, so a URL built from configuration could not be aimed at
+ * an internal address. It can now, which is why this module exists and why it
+ * guards BOTH the API transport and the HTTP slice's redirect walk rather than
+ * living inside one adapter.
+ *
+ * Two layers, because one is not enough:
+ *
+ * 1. {@link validateEgressUrl} — a URL-level check applied to the initial URL
+ *    and to EVERY redirect hop. It catches literal addresses and the named
+ *    loopback/metadata hosts before a request is built.
+ * 2. {@link createEgressGuardedDispatcher} — a connection-time check of every
+ *    address DNS resolves to. Layer 1 alone is a TOCTOU: `evil.example` passes
+ *    the URL check as a public name and then resolves to `127.0.0.1`. Validating
+ *    at the moment of use closes that rebinding window.
+ *
+ * The division of labour between them is worth stating, because it is the
+ * easiest thing to misread here: layer 1 can only judge what a URL SAYS, so it
+ * denies literal addresses and the two host names that are denied by name
+ * (`localhost`, `metadata.google.internal`). An ordinary internal name like
+ * `searx.internal.corp` carries no address and passes layer 1 exactly as a
+ * public name would — layer 2 is what asks where it actually points. Neither
+ * layer is redundant: layer 1 stops `http://169.254.169.254/` without a
+ * resolver, and layer 2 stops every name that lies.
+ *
+ * LIMITATION, stated here because it is a property of the design and not an
+ * oversight: layer 2 only applies to DIRECT connections. When a proxy
+ * dispatcher is in use the proxy resolves DNS, so the guarded lookup never
+ * runs; proxied paths keep layer 1 on every hop and nothing more. The
+ * precedence is asserted by a test rather than left to be discovered.
+ *
+ * Denial messages carry the HOSTNAME only. A search URL embeds the user's
+ * query and may carry userinfo credentials, and these errors are printed,
+ * logged, and returned to callers.
+ *
+ * @module search/egress
+ */
+
+/**
+ * The admin-level egress policy.
+ *
+ * Construction-level, never per-request: a per-request allowlist would let an
+ * attacker who can influence a search request also influence where it may go,
+ * which is the whole thing this module prevents.
+ */
+interface SearchEgressPolicy {
+    /**
+     * Hostnames permitted to resolve into an otherwise-denied address class.
+     *
+     * The escape hatch for an internal SearXNG deployment
+     * (`searx.internal.corp`). Matching is EXACT and case-insensitive — no
+     * wildcards, no suffix matching — because a suffix rule (`.corp`) is one
+     * attacker-registered subdomain away from admitting anything.
+     */
+    allowedPrivateHosts?: string[];
+}
+/** Permit every public host; permit nothing private. The production default. */
+declare const DEFAULT_SEARCH_EGRESS_POLICY: Readonly<SearchEgressPolicy>;
+/** Why a host was denied. Stamped into `details.egressClass` for diagnostics. */
+type EgressDenialReason = 'scheme' | 'malformed' | 'loopback' | 'unspecified' | 'link-local' | 'private' | 'unique-local' | 'metadata';
+/**
+ * Validate one request target against the policy.
+ *
+ * @param url - the target. A relative or unparseable value is a denial, not a
+ *   crash: a redirect `location` is attacker-controlled input.
+ * @returns the parsed URL, so callers can reuse it instead of re-parsing.
+ * @throws SearchProviderError code `policy_denied`, naming the hostname only.
+ */
+declare function validateEgressUrl(url: string | URL, policy?: SearchEgressPolicy, providerId?: SearchProviderId): URL;
+/**
+ * Classify a resolved ADDRESS for a hostname that already passed
+ * {@link validateEgressUrl}.
+ *
+ * Separate from the URL check because this is the rebinding defense: the
+ * hostname was public, the address it resolved to may not be. Allowlisting is
+ * by hostname, so an allowlisted name's private address is admitted here too —
+ * that is exactly what the SearXNG escape hatch means.
+ */
+declare function assertEgressAddressAllowed(address: string, hostname: string, policy?: SearchEgressPolicy, providerId?: SearchProviderId): void;
+/**
+ * The `policy_denied` error buried in a thrown value's `cause` chain, if any.
+ *
+ * undici reports a connect-time failure as a `TypeError: fetch failed` whose
+ * `cause` holds the real error, so a denial raised inside the guarded lookup
+ * reaches the caller wrapped. Without this the transport would classify a
+ * blocked rebinding attempt as `upstream_unavailable`.
+ *
+ * The depth cap assumes undici's wrapping stays SHALLOW — today it is two
+ * levels and this allows six. If a future undici (or an intermediate
+ * dispatcher) nests deeper, a blocked rebinding attempt would quietly
+ * reclassify as a transport failure: the request is still refused, but the
+ * security signal is lost. That is the failure mode to check if denials ever
+ * start reading as `upstream_unavailable`.
+ */
+declare function findEgressDenial(error: unknown): SearchProviderError | undefined;
+/** Node's `dns.lookup` shape — the seam a test replaces. */
+type EgressDnsLookup = typeof lookup;
+/**
+ * Wrap a resolver so every address it returns is validated before use.
+ *
+ * Always resolves with `all: true` and re-shapes the answer to whatever the
+ * caller asked for. Node's `net.connect` passes `all: true` under
+ * `autoSelectFamily` and `all: false` otherwise; validating only the address a
+ * single-answer lookup happened to pick would leave the others unchecked on the
+ * hosts where it matters most.
+ */
+declare function createEgressGuardedLookup(policy?: SearchEgressPolicy, lookupImpl?: EgressDnsLookup): EgressDnsLookup;
+/**
+ * An undici dispatcher that validates every resolved address before connecting.
+ *
+ * Cached per policy signature: a fresh `Agent` per request would leak
+ * connection pools. As in `search/http/proxy.ts`, a superseded dispatcher is
+ * never closed — a concurrent request may still be reading through it.
+ */
+declare function createEgressGuardedDispatcher(policy?: SearchEgressPolicy, lookupImpl?: EgressDnsLookup): Dispatcher;
+
+export { DEFAULT_SEARCH_EGRESS_POLICY as D, type EgressDenialReason as E, type SearchEgressPolicy as S, type EgressDnsLookup as a, assertEgressAddressAllowed as b, createEgressGuardedDispatcher as c, createEgressGuardedLookup as d, findEgressDenial as f, validateEgressUrl as v };

package/dist/egress-I46O_p5L.d.ts

@@ -0,0 +1,126 @@
+import { lookup } from 'node:dns';
+import { SearchProviderId, SearchProviderError } from '@omnicross/contracts/search-types';
+import { Dispatcher } from 'undici';
+
+/**
+ * The SSRF egress policy every search network path runs through
+ * (plan hard-constraint 7).
+ *
+ * 阶段4 introduces the first attacker-influenceable network surface in the
+ * search tree: a custom `apiHost`. Until now every search request went to one
+ * of two fixed engines, so a URL built from configuration could not be aimed at
+ * an internal address. It can now, which is why this module exists and why it
+ * guards BOTH the API transport and the HTTP slice's redirect walk rather than
+ * living inside one adapter.
+ *
+ * Two layers, because one is not enough:
+ *
+ * 1. {@link validateEgressUrl} — a URL-level check applied to the initial URL
+ *    and to EVERY redirect hop. It catches literal addresses and the named
+ *    loopback/metadata hosts before a request is built.
+ * 2. {@link createEgressGuardedDispatcher} — a connection-time check of every
+ *    address DNS resolves to. Layer 1 alone is a TOCTOU: `evil.example` passes
+ *    the URL check as a public name and then resolves to `127.0.0.1`. Validating
+ *    at the moment of use closes that rebinding window.
+ *
+ * The division of labour between them is worth stating, because it is the
+ * easiest thing to misread here: layer 1 can only judge what a URL SAYS, so it
+ * denies literal addresses and the two host names that are denied by name
+ * (`localhost`, `metadata.google.internal`). An ordinary internal name like
+ * `searx.internal.corp` carries no address and passes layer 1 exactly as a
+ * public name would — layer 2 is what asks where it actually points. Neither
+ * layer is redundant: layer 1 stops `http://169.254.169.254/` without a
+ * resolver, and layer 2 stops every name that lies.
+ *
+ * LIMITATION, stated here because it is a property of the design and not an
+ * oversight: layer 2 only applies to DIRECT connections. When a proxy
+ * dispatcher is in use the proxy resolves DNS, so the guarded lookup never
+ * runs; proxied paths keep layer 1 on every hop and nothing more. The
+ * precedence is asserted by a test rather than left to be discovered.
+ *
+ * Denial messages carry the HOSTNAME only. A search URL embeds the user's
+ * query and may carry userinfo credentials, and these errors are printed,
+ * logged, and returned to callers.
+ *
+ * @module search/egress
+ */
+
+/**
+ * The admin-level egress policy.
+ *
+ * Construction-level, never per-request: a per-request allowlist would let an
+ * attacker who can influence a search request also influence where it may go,
+ * which is the whole thing this module prevents.
+ */
+interface SearchEgressPolicy {
+    /**
+     * Hostnames permitted to resolve into an otherwise-denied address class.
+     *
+     * The escape hatch for an internal SearXNG deployment
+     * (`searx.internal.corp`). Matching is EXACT and case-insensitive — no
+     * wildcards, no suffix matching — because a suffix rule (`.corp`) is one
+     * attacker-registered subdomain away from admitting anything.
+     */
+    allowedPrivateHosts?: string[];
+}
+/** Permit every public host; permit nothing private. The production default. */
+declare const DEFAULT_SEARCH_EGRESS_POLICY: Readonly<SearchEgressPolicy>;
+/** Why a host was denied. Stamped into `details.egressClass` for diagnostics. */
+type EgressDenialReason = 'scheme' | 'malformed' | 'loopback' | 'unspecified' | 'link-local' | 'private' | 'unique-local' | 'metadata';
+/**
+ * Validate one request target against the policy.
+ *
+ * @param url - the target. A relative or unparseable value is a denial, not a
+ *   crash: a redirect `location` is attacker-controlled input.
+ * @returns the parsed URL, so callers can reuse it instead of re-parsing.
+ * @throws SearchProviderError code `policy_denied`, naming the hostname only.
+ */
+declare function validateEgressUrl(url: string | URL, policy?: SearchEgressPolicy, providerId?: SearchProviderId): URL;
+/**
+ * Classify a resolved ADDRESS for a hostname that already passed
+ * {@link validateEgressUrl}.
+ *
+ * Separate from the URL check because this is the rebinding defense: the
+ * hostname was public, the address it resolved to may not be. Allowlisting is
+ * by hostname, so an allowlisted name's private address is admitted here too —
+ * that is exactly what the SearXNG escape hatch means.
+ */
+declare function assertEgressAddressAllowed(address: string, hostname: string, policy?: SearchEgressPolicy, providerId?: SearchProviderId): void;
+/**
+ * The `policy_denied` error buried in a thrown value's `cause` chain, if any.
+ *
+ * undici reports a connect-time failure as a `TypeError: fetch failed` whose
+ * `cause` holds the real error, so a denial raised inside the guarded lookup
+ * reaches the caller wrapped. Without this the transport would classify a
+ * blocked rebinding attempt as `upstream_unavailable`.
+ *
+ * The depth cap assumes undici's wrapping stays SHALLOW — today it is two
+ * levels and this allows six. If a future undici (or an intermediate
+ * dispatcher) nests deeper, a blocked rebinding attempt would quietly
+ * reclassify as a transport failure: the request is still refused, but the
+ * security signal is lost. That is the failure mode to check if denials ever
+ * start reading as `upstream_unavailable`.
+ */
+declare function findEgressDenial(error: unknown): SearchProviderError | undefined;
+/** Node's `dns.lookup` shape — the seam a test replaces. */
+type EgressDnsLookup = typeof lookup;
+/**
+ * Wrap a resolver so every address it returns is validated before use.
+ *
+ * Always resolves with `all: true` and re-shapes the answer to whatever the
+ * caller asked for. Node's `net.connect` passes `all: true` under
+ * `autoSelectFamily` and `all: false` otherwise; validating only the address a
+ * single-answer lookup happened to pick would leave the others unchecked on the
+ * hosts where it matters most.
+ */
+declare function createEgressGuardedLookup(policy?: SearchEgressPolicy, lookupImpl?: EgressDnsLookup): EgressDnsLookup;
+/**
+ * An undici dispatcher that validates every resolved address before connecting.
+ *
+ * Cached per policy signature: a fresh `Agent` per request would leak
+ * connection pools. As in `search/http/proxy.ts`, a superseded dispatcher is
+ * never closed — a concurrent request may still be reading through it.
+ */
+declare function createEgressGuardedDispatcher(policy?: SearchEgressPolicy, lookupImpl?: EgressDnsLookup): Dispatcher;
+
+export { DEFAULT_SEARCH_EGRESS_POLICY as D, type EgressDenialReason as E, type SearchEgressPolicy as S, type EgressDnsLookup as a, assertEgressAddressAllowed as b, createEgressGuardedDispatcher as c, createEgressGuardedLookup as d, findEgressDenial as f, validateEgressUrl as v };

package/dist/frontends-Doz0RaWu.d.cts

@@ -0,0 +1,97 @@
+import { SearchErrorCode } from '@omnicross/contracts/search-types';
+
+/**
+ * Per-frontend search execution modes (plan 阶段5, hard constraint 6).
+ *
+ * Three protocol frontends can reach search — Codex `/v1/alpha/search`, OpenAI
+ * Responses, and Anthropic Messages — and each of them independently answers
+ * ONE question: who executes the search?
+ *
+ * - `native`   — the UPSTREAM executes it. Omnicross injects/relays and touches
+ *                nothing else; the wire stays whatever the provider produced.
+ * - `managed`  — OMNICROSS executes it through {@link SearchRuntime} and
+ *                synthesizes protocol-compatible output.
+ * - `off`      — the capability is not offered: a structured
+ *                `unsupported_capability` error, never a bare 404 (plan §15).
+ *
+ * **Native and managed are never mixed on one wire exchange.** That is a plan
+ * hard constraint, and this module is how it is made structural rather than
+ * conventional: a request resolves its mode ONCE, before any wire bytes, and
+ * the two lanes downstream share no emission code. A helper that "falls back
+ * from native to managed" (or the reverse) would defeat the whole arrangement,
+ * so no such helper exists here and none should be added.
+ *
+ * The defaults preserve today's behavior exactly: Responses and Anthropic keep
+ * their existing native relay, and Codex is `off` — which is the one deliberate
+ * visible change in this change set, since `off` answers with a structured
+ * error where the router previously answered a generic 404.
+ *
+ * Pure vocabulary: no IO, no provider imports, no runtime. That is what lets
+ * `outbound-api` and `provider-proxy` both import it without dragging jsdom or
+ * undici into their module graphs.
+ *
+ * @module search/frontends
+ */
+
+/** Who executes a search for one protocol frontend. */
+type SearchFrontendMode = 'native' | 'managed' | 'off';
+/** The protocol frontends that can reach search. */
+type SearchFrontendName = 'codex' | 'responses' | 'anthropic';
+/** The resolved mode of every frontend. Total — every frontend always has one. */
+type SearchFrontendModes = {
+    readonly [K in SearchFrontendName]: SearchFrontendMode;
+};
+/** Every frontend name, in the order configuration and doctor print them. */
+declare const SEARCH_FRONTEND_NAMES: readonly SearchFrontendName[];
+/** Every mode value, for validation messages and exhaustiveness. */
+declare const SEARCH_FRONTEND_MODES: readonly SearchFrontendMode[];
+/**
+ * The behavior-preserving defaults.
+ *
+ * `codex: 'off'` is not "search disabled" — the route exists and answers with a
+ * structured `unsupported_capability`. It is off because the Codex request and
+ * response schemas are UNVERIFIED (see `docs/design/search-baseline/wire-baseline.md`
+ * §1.2/§1.3); enabling it is a deliberate operator decision.
+ */
+declare const DEFAULT_SEARCH_FRONTEND_MODES: SearchFrontendModes;
+/**
+ * The stable error code every frontend uses when its mode is `off`.
+ *
+ * Plan §15: a frontend may close managed search, but it must then say
+ * `unsupported_capability` — it must never keep exposing an unimplemented route
+ * as a 404. The string is shared so the three frontends cannot drift apart.
+ */
+declare const SEARCH_UNSUPPORTED_CAPABILITY_CODE = "unsupported_capability";
+/**
+ * HTTP status for a search-taxonomy failure surfaced by a protocol frontend.
+ *
+ * The mapping answers "whose problem is it?" rather than "which code is it?":
+ * a client can act on 429 and 504; everything that failed on OUR side of the
+ * wire — a provider that broke, a policy that refused, a config we lack — is a
+ * 502-class fact about the gateway's upstream, not a fault in the request the
+ * client sent. The one 4xx here is `cancelled`, which is 499 because the client
+ * itself hung up.
+ */
+declare function searchErrorHttpStatus(code: SearchErrorCode): number;
+/** Whether `value` is one of the three modes. */
+declare function isSearchFrontendMode(value: unknown): value is SearchFrontendMode;
+/**
+ * Read modes tolerantly: an unusable member falls back to its default rather
+ * than throwing, so a malformed config never takes the daemon down.
+ *
+ * Use {@link validateSearchFrontendModes} to REPORT what was unusable — the two
+ * run side by side exactly as the images config's tolerant read and strict
+ * validation do.
+ */
+declare function normalizeSearchFrontendModes(value: unknown): SearchFrontendModes;
+/**
+ * Structured validation errors, naming the offending FIELD.
+ *
+ * The rejected VALUE is never echoed, only its type. A mode is not a secret,
+ * but a secret pasted into the wrong field is still a secret, and a validator
+ * that quotes whatever it was handed is one misconfiguration away from putting
+ * it in a log. Same no-echo rule as the images config validator.
+ */
+declare function validateSearchFrontendModes(value: unknown, path?: string): string[];
+
+export { DEFAULT_SEARCH_FRONTEND_MODES as D, SEARCH_FRONTEND_MODES as S, SEARCH_FRONTEND_NAMES as a, SEARCH_UNSUPPORTED_CAPABILITY_CODE as b, type SearchFrontendMode as c, type SearchFrontendModes as d, type SearchFrontendName as e, isSearchFrontendMode as i, normalizeSearchFrontendModes as n, searchErrorHttpStatus as s, validateSearchFrontendModes as v };

package/dist/frontends-Doz0RaWu.d.ts

@@ -0,0 +1,97 @@
+import { SearchErrorCode } from '@omnicross/contracts/search-types';
+
+/**
+ * Per-frontend search execution modes (plan 阶段5, hard constraint 6).
+ *
+ * Three protocol frontends can reach search — Codex `/v1/alpha/search`, OpenAI
+ * Responses, and Anthropic Messages — and each of them independently answers
+ * ONE question: who executes the search?
+ *
+ * - `native`   — the UPSTREAM executes it. Omnicross injects/relays and touches
+ *                nothing else; the wire stays whatever the provider produced.
+ * - `managed`  — OMNICROSS executes it through {@link SearchRuntime} and
+ *                synthesizes protocol-compatible output.
+ * - `off`      — the capability is not offered: a structured
+ *                `unsupported_capability` error, never a bare 404 (plan §15).
+ *
+ * **Native and managed are never mixed on one wire exchange.** That is a plan
+ * hard constraint, and this module is how it is made structural rather than
+ * conventional: a request resolves its mode ONCE, before any wire bytes, and
+ * the two lanes downstream share no emission code. A helper that "falls back
+ * from native to managed" (or the reverse) would defeat the whole arrangement,
+ * so no such helper exists here and none should be added.
+ *
+ * The defaults preserve today's behavior exactly: Responses and Anthropic keep
+ * their existing native relay, and Codex is `off` — which is the one deliberate
+ * visible change in this change set, since `off` answers with a structured
+ * error where the router previously answered a generic 404.
+ *
+ * Pure vocabulary: no IO, no provider imports, no runtime. That is what lets
+ * `outbound-api` and `provider-proxy` both import it without dragging jsdom or
+ * undici into their module graphs.
+ *
+ * @module search/frontends
+ */
+
+/** Who executes a search for one protocol frontend. */
+type SearchFrontendMode = 'native' | 'managed' | 'off';
+/** The protocol frontends that can reach search. */
+type SearchFrontendName = 'codex' | 'responses' | 'anthropic';
+/** The resolved mode of every frontend. Total — every frontend always has one. */
+type SearchFrontendModes = {
+    readonly [K in SearchFrontendName]: SearchFrontendMode;
+};
+/** Every frontend name, in the order configuration and doctor print them. */
+declare const SEARCH_FRONTEND_NAMES: readonly SearchFrontendName[];
+/** Every mode value, for validation messages and exhaustiveness. */
+declare const SEARCH_FRONTEND_MODES: readonly SearchFrontendMode[];
+/**
+ * The behavior-preserving defaults.
+ *
+ * `codex: 'off'` is not "search disabled" — the route exists and answers with a
+ * structured `unsupported_capability`. It is off because the Codex request and
+ * response schemas are UNVERIFIED (see `docs/design/search-baseline/wire-baseline.md`
+ * §1.2/§1.3); enabling it is a deliberate operator decision.
+ */
+declare const DEFAULT_SEARCH_FRONTEND_MODES: SearchFrontendModes;
+/**
+ * The stable error code every frontend uses when its mode is `off`.
+ *
+ * Plan §15: a frontend may close managed search, but it must then say
+ * `unsupported_capability` — it must never keep exposing an unimplemented route
+ * as a 404. The string is shared so the three frontends cannot drift apart.
+ */
+declare const SEARCH_UNSUPPORTED_CAPABILITY_CODE = "unsupported_capability";
+/**
+ * HTTP status for a search-taxonomy failure surfaced by a protocol frontend.
+ *
+ * The mapping answers "whose problem is it?" rather than "which code is it?":
+ * a client can act on 429 and 504; everything that failed on OUR side of the
+ * wire — a provider that broke, a policy that refused, a config we lack — is a
+ * 502-class fact about the gateway's upstream, not a fault in the request the
+ * client sent. The one 4xx here is `cancelled`, which is 499 because the client
+ * itself hung up.
+ */
+declare function searchErrorHttpStatus(code: SearchErrorCode): number;
+/** Whether `value` is one of the three modes. */
+declare function isSearchFrontendMode(value: unknown): value is SearchFrontendMode;
+/**
+ * Read modes tolerantly: an unusable member falls back to its default rather
+ * than throwing, so a malformed config never takes the daemon down.
+ *
+ * Use {@link validateSearchFrontendModes} to REPORT what was unusable — the two
+ * run side by side exactly as the images config's tolerant read and strict
+ * validation do.
+ */
+declare function normalizeSearchFrontendModes(value: unknown): SearchFrontendModes;
+/**
+ * Structured validation errors, naming the offending FIELD.
+ *
+ * The rejected VALUE is never echoed, only its type. A mode is not a secret,
+ * but a secret pasted into the wrong field is still a secret, and a validator
+ * that quotes whatever it was handed is one misconfiguration away from putting
+ * it in a log. Same no-echo rule as the images config validator.
+ */
+declare function validateSearchFrontendModes(value: unknown, path?: string): string[];
+
+export { DEFAULT_SEARCH_FRONTEND_MODES as D, SEARCH_FRONTEND_MODES as S, SEARCH_FRONTEND_NAMES as a, SEARCH_UNSUPPORTED_CAPABILITY_CODE as b, type SearchFrontendMode as c, type SearchFrontendModes as d, type SearchFrontendName as e, isSearchFrontendMode as i, normalizeSearchFrontendModes as n, searchErrorHttpStatus as s, validateSearchFrontendModes as v };

package/dist/image-generation.cjs

@@ -23,7 +23,7 @@
 
 
 
-var _chunkCTKM773Jcjs = require('./chunk-CTKM773J.cjs');
+var _chunkUPQIWJIEcjs = require('./chunk-UPQIWJIE.cjs');
 
 
 
@@ -49,4 +49,4 @@ var _chunkCTKM773Jcjs = require('./chunk-CTKM773J.cjs');
 
 
 
-exports.DEFAULT_IMAGE_API_LIMITS = _chunkCTKM773Jcjs.DEFAULT_IMAGE_API_LIMITS; exports.IMAGE_REQUEST_DIRECTORY_MARKER_CONTENT = _chunkCTKM773Jcjs.IMAGE_REQUEST_DIRECTORY_MARKER_CONTENT; exports.IMAGE_REQUEST_DIRECTORY_MARKER_NAME = _chunkCTKM773Jcjs.IMAGE_REQUEST_DIRECTORY_MARKER_NAME; exports.ImageGenerationError = _chunkCTKM773Jcjs.ImageGenerationError; exports.ImageOrchestrator = _chunkCTKM773Jcjs.ImageOrchestrator; exports.ImageProviderRegistry = _chunkCTKM773Jcjs.ImageProviderRegistry; exports.ImageRequestResourceScope = _chunkCTKM773Jcjs.ImageRequestResourceScope; exports.InMemoryImageAsset = _chunkCTKM773Jcjs.InMemoryImageAsset; exports.InMemoryImageReferenceStore = _chunkCTKM773Jcjs.InMemoryImageReferenceStore; exports.InMemoryResponsesImageStateStore = _chunkCTKM773Jcjs.InMemoryResponsesImageStateStore; exports.assertFiniteImageApiLimits = _chunkCTKM773Jcjs.assertFiniteImageApiLimits; exports.createImageApiContributions = _chunkCTKM773Jcjs.createImageApiContributions; exports.createImageRequestResourceScope = _chunkCTKM773Jcjs.createImageRequestResourceScope; exports.createResponsesImageGenerationContribution = _chunkCTKM773Jcjs.createResponsesImageGenerationContribution; exports.createSafeRemoteImageResolver = _chunkCTKM773Jcjs.createSafeRemoteImageResolver; exports.emitImageTelemetry = _chunkCTKM773Jcjs.emitImageTelemetry; exports.imageGenerationErrorFromPublic = _chunkCTKM773Jcjs.imageGenerationErrorFromPublic; exports.inspectResponsesImageRequest = _chunkCTKM773Jcjs.inspectResponsesImageRequest; exports.isImageGenerationError = _chunkCTKM773Jcjs.isImageGenerationError; exports.normalizeImageGenerationError = _chunkCTKM773Jcjs.normalizeImageGenerationError; exports.readImageAssetBytes = _chunkCTKM773Jcjs.readImageAssetBytes; exports.resolveImageCapabilities = _chunkCTKM773Jcjs.resolveImageCapabilities; exports.serializeImageGenerationError = _chunkCTKM773Jcjs.serializeImageGenerationError; exports.validateResponsesImageSelection = _chunkCTKM773Jcjs.validateResponsesImageSelection;
+exports.DEFAULT_IMAGE_API_LIMITS = _chunkUPQIWJIEcjs.DEFAULT_IMAGE_API_LIMITS; exports.IMAGE_REQUEST_DIRECTORY_MARKER_CONTENT = _chunkUPQIWJIEcjs.IMAGE_REQUEST_DIRECTORY_MARKER_CONTENT; exports.IMAGE_REQUEST_DIRECTORY_MARKER_NAME = _chunkUPQIWJIEcjs.IMAGE_REQUEST_DIRECTORY_MARKER_NAME; exports.ImageGenerationError = _chunkUPQIWJIEcjs.ImageGenerationError; exports.ImageOrchestrator = _chunkUPQIWJIEcjs.ImageOrchestrator; exports.ImageProviderRegistry = _chunkUPQIWJIEcjs.ImageProviderRegistry; exports.ImageRequestResourceScope = _chunkUPQIWJIEcjs.ImageRequestResourceScope; exports.InMemoryImageAsset = _chunkUPQIWJIEcjs.InMemoryImageAsset; exports.InMemoryImageReferenceStore = _chunkUPQIWJIEcjs.InMemoryImageReferenceStore; exports.InMemoryResponsesImageStateStore = _chunkUPQIWJIEcjs.InMemoryResponsesImageStateStore; exports.assertFiniteImageApiLimits = _chunkUPQIWJIEcjs.assertFiniteImageApiLimits; exports.createImageApiContributions = _chunkUPQIWJIEcjs.createImageApiContributions; exports.createImageRequestResourceScope = _chunkUPQIWJIEcjs.createImageRequestResourceScope; exports.createResponsesImageGenerationContribution = _chunkUPQIWJIEcjs.createResponsesImageGenerationContribution; exports.createSafeRemoteImageResolver = _chunkUPQIWJIEcjs.createSafeRemoteImageResolver; exports.emitImageTelemetry = _chunkUPQIWJIEcjs.emitImageTelemetry; exports.imageGenerationErrorFromPublic = _chunkUPQIWJIEcjs.imageGenerationErrorFromPublic; exports.inspectResponsesImageRequest = _chunkUPQIWJIEcjs.inspectResponsesImageRequest; exports.isImageGenerationError = _chunkUPQIWJIEcjs.isImageGenerationError; exports.normalizeImageGenerationError = _chunkUPQIWJIEcjs.normalizeImageGenerationError; exports.readImageAssetBytes = _chunkUPQIWJIEcjs.readImageAssetBytes; exports.resolveImageCapabilities = _chunkUPQIWJIEcjs.resolveImageCapabilities; exports.serializeImageGenerationError = _chunkUPQIWJIEcjs.serializeImageGenerationError; exports.validateResponsesImageSelection = _chunkUPQIWJIEcjs.validateResponsesImageSelection;

package/dist/image-generation.d.cts

@@ -1,8 +1,8 @@
 import { ImageCapabilityEvidenceLayer, ImageCapabilities, ImageGenerationErrorCode, ImageRetrySafety, ImageModerationDetails, ImageGenerationPublicError } from '@omnicross/contracts/image-generation-types';
-import { al as ResponsesImageGenerationContributionDeps, ak as ResponsesImageGenerationContribution, am as ResponsesImageInspectionInput, a9 as ResponsesImageAdmission, a7 as ResponsesHostedToolSelection } from './types-DsHBBk3h.cjs';
-export { I as ImageAsset, e as ImageJob, f as ImageJobObservability, g as ImageJobObservabilitySnapshot, h as ImageOrchestrator, i as ImageOrchestratorOptions, j as ImageOrchestratorRunOptions, k as ImageProvider, l as ImageProviderContext, m as ImageProviderLease, n as ImageProviderRegistry, o as ImageProviderRequest, p as ImageReferenceLease, q as ImageReferenceResolution, r as ImageReferenceSaveInput, s as ImageReferenceStore, t as ImageReferenceValue, u as ImageRetentionPolicy, v as ImageTelemetryOutputMetadata, w as ImageTelemetryRecord, x as ImageTelemetrySink, y as InMemoryImageAsset, z as InMemoryImageReferenceStore, B as InMemoryResponsesImageStateStore, C as InMemoryResponsesImageStateStoreOptions, a6 as ResponsesHostedToolIdentity, a8 as ResponsesImageAction, aa as ResponsesImageCallBinding, ab as ResponsesImageCallId, ac as ResponsesImageCallResolution, ad as ResponsesImageCallStateLease, ae as ResponsesImageCompletedRecord, af as ResponsesImageEventAllocator, ag as ResponsesImageExecutionEvent, ah as ResponsesImageFailedRecord, ai as ResponsesImageGenerationCallItem, aj as ResponsesImageGenerationCallStartedItem, an as ResponsesImageNormalizedOptions, ao as ResponsesImagePartialEvent, ap as ResponsesImageRequestScope, aq as ResponsesImageRequestScopeInput, ar as ResponsesImageResponseResolution, as as ResponsesImageResponseStateLease, at as ResponsesImageSelectionPolicy, au as ResponsesImageStartedRecord, av as ResponsesImageStateCommitInput, aw as ResponsesImageStateStore, ax as ResponsesImageTrustedRuntime, aA as ResponsesSelectedImageCall, aL as emitImageTelemetry, aP as readImageAssetBytes } from './types-DsHBBk3h.cjs';
-import { d as ImageApiContributionsDeps, c as ImageApiContributions, R as RemoteImageAssetResolver } from './types-CbglB73l.cjs';
-export { C as CreateImageRequestResourceScopeOptions, D as DEFAULT_IMAGE_API_LIMITS, I as IMAGE_REQUEST_DIRECTORY_MARKER_CONTENT, a as IMAGE_REQUEST_DIRECTORY_MARKER_NAME, b as ImageApiAuditRecord, e as ImageApiLimits, f as ImageApiRuntime, g as ImageApiRuntimeResolver, h as ImageOpenAIOperationContribution, i as ImageRemoteMaterializer, j as ImageRequestResourceOwnership, k as ImageRequestResourceScope, l as ImageTemporaryResourceBudget, m as ImageTemporaryResourceBudgetLease, n as assertFiniteImageApiLimits, o as createImageRequestResourceScope } from './types-CbglB73l.cjs';
+import { al as ResponsesImageGenerationContributionDeps, ak as ResponsesImageGenerationContribution, am as ResponsesImageInspectionInput, a9 as ResponsesImageAdmission, a7 as ResponsesHostedToolSelection } from './types-BSIJdsyl.cjs';
+export { I as ImageAsset, e as ImageJob, f as ImageJobObservability, g as ImageJobObservabilitySnapshot, h as ImageOrchestrator, i as ImageOrchestratorOptions, j as ImageOrchestratorRunOptions, k as ImageProvider, l as ImageProviderContext, m as ImageProviderLease, n as ImageProviderRegistry, o as ImageProviderRequest, p as ImageReferenceLease, q as ImageReferenceResolution, r as ImageReferenceSaveInput, s as ImageReferenceStore, t as ImageReferenceValue, u as ImageRetentionPolicy, v as ImageTelemetryOutputMetadata, w as ImageTelemetryRecord, x as ImageTelemetrySink, y as InMemoryImageAsset, z as InMemoryImageReferenceStore, B as InMemoryResponsesImageStateStore, C as InMemoryResponsesImageStateStoreOptions, a6 as ResponsesHostedToolIdentity, a8 as ResponsesImageAction, aa as ResponsesImageCallBinding, ab as ResponsesImageCallId, ac as ResponsesImageCallResolution, ad as ResponsesImageCallStateLease, ae as ResponsesImageCompletedRecord, af as ResponsesImageEventAllocator, ag as ResponsesImageExecutionEvent, ah as ResponsesImageFailedRecord, ai as ResponsesImageGenerationCallItem, aj as ResponsesImageGenerationCallStartedItem, an as ResponsesImageNormalizedOptions, ao as ResponsesImagePartialEvent, ap as ResponsesImageRequestScope, aq as ResponsesImageRequestScopeInput, ar as ResponsesImageResponseResolution, as as ResponsesImageResponseStateLease, at as ResponsesImageSelectionPolicy, au as ResponsesImageStartedRecord, av as ResponsesImageStateCommitInput, aw as ResponsesImageStateStore, ax as ResponsesImageTrustedRuntime, aA as ResponsesSelectedImageCall, aL as emitImageTelemetry, aP as readImageAssetBytes } from './types-BSIJdsyl.cjs';
+import { d as ImageApiContributionsDeps, c as ImageApiContributions, R as RemoteImageAssetResolver } from './types-Be-yt_6T.cjs';
+export { C as CreateImageRequestResourceScopeOptions, D as DEFAULT_IMAGE_API_LIMITS, I as IMAGE_REQUEST_DIRECTORY_MARKER_CONTENT, a as IMAGE_REQUEST_DIRECTORY_MARKER_NAME, b as ImageApiAuditRecord, e as ImageApiLimits, f as ImageApiRuntime, g as ImageApiRuntimeResolver, h as ImageOpenAIOperationContribution, i as ImageRemoteMaterializer, j as ImageRequestResourceOwnership, k as ImageRequestResourceScope, l as ImageTemporaryResourceBudget, m as ImageTemporaryResourceBudgetLease, n as assertFiniteImageApiLimits, o as createImageRequestResourceScope } from './types-Be-yt_6T.cjs';
 import 'node:http';
 import '@omnicross/contracts/completion-types';
 import '@omnicross/contracts/usage-stats-types';
@@ -20,6 +20,9 @@ import './transformer/types.cjs';
 import './transformer/TransformerService.cjs';
 import './ports/web-search-backend.cjs';
 import '@omnicross/contracts/websearch-types';
+import './frontends-Doz0RaWu.cjs';
+import '@omnicross/contracts/search-types';
+import './runtime-t8AZacFF.cjs';
 import 'node:fs/promises';
 
 declare function createResponsesImageGenerationContribution(deps: ResponsesImageGenerationContributionDeps): ResponsesImageGenerationContribution;

package/dist/image-generation.d.ts

@@ -1,8 +1,8 @@
 import { ImageCapabilityEvidenceLayer, ImageCapabilities, ImageGenerationErrorCode, ImageRetrySafety, ImageModerationDetails, ImageGenerationPublicError } from '@omnicross/contracts/image-generation-types';
-import { al as ResponsesImageGenerationContributionDeps, ak as ResponsesImageGenerationContribution, am as ResponsesImageInspectionInput, a9 as ResponsesImageAdmission, a7 as ResponsesHostedToolSelection } from './types-CVRge76p.js';
-export { I as ImageAsset, e as ImageJob, f as ImageJobObservability, g as ImageJobObservabilitySnapshot, h as ImageOrchestrator, i as ImageOrchestratorOptions, j as ImageOrchestratorRunOptions, k as ImageProvider, l as ImageProviderContext, m as ImageProviderLease, n as ImageProviderRegistry, o as ImageProviderRequest, p as ImageReferenceLease, q as ImageReferenceResolution, r as ImageReferenceSaveInput, s as ImageReferenceStore, t as ImageReferenceValue, u as ImageRetentionPolicy, v as ImageTelemetryOutputMetadata, w as ImageTelemetryRecord, x as ImageTelemetrySink, y as InMemoryImageAsset, z as InMemoryImageReferenceStore, B as InMemoryResponsesImageStateStore, C as InMemoryResponsesImageStateStoreOptions, a6 as ResponsesHostedToolIdentity, a8 as ResponsesImageAction, aa as ResponsesImageCallBinding, ab as ResponsesImageCallId, ac as ResponsesImageCallResolution, ad as ResponsesImageCallStateLease, ae as ResponsesImageCompletedRecord, af as ResponsesImageEventAllocator, ag as ResponsesImageExecutionEvent, ah as ResponsesImageFailedRecord, ai as ResponsesImageGenerationCallItem, aj as ResponsesImageGenerationCallStartedItem, an as ResponsesImageNormalizedOptions, ao as ResponsesImagePartialEvent, ap as ResponsesImageRequestScope, aq as ResponsesImageRequestScopeInput, ar as ResponsesImageResponseResolution, as as ResponsesImageResponseStateLease, at as ResponsesImageSelectionPolicy, au as ResponsesImageStartedRecord, av as ResponsesImageStateCommitInput, aw as ResponsesImageStateStore, ax as ResponsesImageTrustedRuntime, aA as ResponsesSelectedImageCall, aL as emitImageTelemetry, aP as readImageAssetBytes } from './types-CVRge76p.js';
-import { d as ImageApiContributionsDeps, c as ImageApiContributions, R as RemoteImageAssetResolver } from './types-Bd72H4SB.js';
-export { C as CreateImageRequestResourceScopeOptions, D as DEFAULT_IMAGE_API_LIMITS, I as IMAGE_REQUEST_DIRECTORY_MARKER_CONTENT, a as IMAGE_REQUEST_DIRECTORY_MARKER_NAME, b as ImageApiAuditRecord, e as ImageApiLimits, f as ImageApiRuntime, g as ImageApiRuntimeResolver, h as ImageOpenAIOperationContribution, i as ImageRemoteMaterializer, j as ImageRequestResourceOwnership, k as ImageRequestResourceScope, l as ImageTemporaryResourceBudget, m as ImageTemporaryResourceBudgetLease, n as assertFiniteImageApiLimits, o as createImageRequestResourceScope } from './types-Bd72H4SB.js';
+import { al as ResponsesImageGenerationContributionDeps, ak as ResponsesImageGenerationContribution, am as ResponsesImageInspectionInput, a9 as ResponsesImageAdmission, a7 as ResponsesHostedToolSelection } from './types-By9Tg6-I.js';
+export { I as ImageAsset, e as ImageJob, f as ImageJobObservability, g as ImageJobObservabilitySnapshot, h as ImageOrchestrator, i as ImageOrchestratorOptions, j as ImageOrchestratorRunOptions, k as ImageProvider, l as ImageProviderContext, m as ImageProviderLease, n as ImageProviderRegistry, o as ImageProviderRequest, p as ImageReferenceLease, q as ImageReferenceResolution, r as ImageReferenceSaveInput, s as ImageReferenceStore, t as ImageReferenceValue, u as ImageRetentionPolicy, v as ImageTelemetryOutputMetadata, w as ImageTelemetryRecord, x as ImageTelemetrySink, y as InMemoryImageAsset, z as InMemoryImageReferenceStore, B as InMemoryResponsesImageStateStore, C as InMemoryResponsesImageStateStoreOptions, a6 as ResponsesHostedToolIdentity, a8 as ResponsesImageAction, aa as ResponsesImageCallBinding, ab as ResponsesImageCallId, ac as ResponsesImageCallResolution, ad as ResponsesImageCallStateLease, ae as ResponsesImageCompletedRecord, af as ResponsesImageEventAllocator, ag as ResponsesImageExecutionEvent, ah as ResponsesImageFailedRecord, ai as ResponsesImageGenerationCallItem, aj as ResponsesImageGenerationCallStartedItem, an as ResponsesImageNormalizedOptions, ao as ResponsesImagePartialEvent, ap as ResponsesImageRequestScope, aq as ResponsesImageRequestScopeInput, ar as ResponsesImageResponseResolution, as as ResponsesImageResponseStateLease, at as ResponsesImageSelectionPolicy, au as ResponsesImageStartedRecord, av as ResponsesImageStateCommitInput, aw as ResponsesImageStateStore, ax as ResponsesImageTrustedRuntime, aA as ResponsesSelectedImageCall, aL as emitImageTelemetry, aP as readImageAssetBytes } from './types-By9Tg6-I.js';
+import { d as ImageApiContributionsDeps, c as ImageApiContributions, R as RemoteImageAssetResolver } from './types-Dm4_36V4.js';
+export { C as CreateImageRequestResourceScopeOptions, D as DEFAULT_IMAGE_API_LIMITS, I as IMAGE_REQUEST_DIRECTORY_MARKER_CONTENT, a as IMAGE_REQUEST_DIRECTORY_MARKER_NAME, b as ImageApiAuditRecord, e as ImageApiLimits, f as ImageApiRuntime, g as ImageApiRuntimeResolver, h as ImageOpenAIOperationContribution, i as ImageRemoteMaterializer, j as ImageRequestResourceOwnership, k as ImageRequestResourceScope, l as ImageTemporaryResourceBudget, m as ImageTemporaryResourceBudgetLease, n as assertFiniteImageApiLimits, o as createImageRequestResourceScope } from './types-Dm4_36V4.js';
 import 'node:http';
 import '@omnicross/contracts/completion-types';
 import '@omnicross/contracts/usage-stats-types';
@@ -20,6 +20,9 @@ import './transformer/types.js';
 import './transformer/TransformerService.js';
 import './ports/web-search-backend.js';
 import '@omnicross/contracts/websearch-types';
+import './frontends-Doz0RaWu.js';
+import '@omnicross/contracts/search-types';
+import './runtime-t8AZacFF.js';
 import 'node:fs/promises';
 
 declare function createResponsesImageGenerationContribution(deps: ResponsesImageGenerationContributionDeps): ResponsesImageGenerationContribution;

package/dist/image-generation.js

@@ -23,7 +23,7 @@ import {
   resolveImageCapabilities,
   serializeImageGenerationError,
   validateResponsesImageSelection
-} from "./chunk-DEIUR2TH.js";
+} from "./chunk-LQYS2N47.js";
 export {
   DEFAULT_IMAGE_API_LIMITS,
   IMAGE_REQUEST_DIRECTORY_MARKER_CONTENT,