@omnicross/core 0.2.0 → 0.3.0

package/dist/chunk-7RJI3NDI.cjs

@@ -0,0 +1,236 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }// src/search/egress.ts
+var _dns = require('dns');
+var _net = require('net');
+
+
+
+var _searchtypes = require('@omnicross/contracts/search-types');
+var _undici = require('undici');
+var DEFAULT_SEARCH_EGRESS_POLICY = Object.freeze({});
+var ALLOWED_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
+var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal"]);
+var DENIAL_TEXT = Object.freeze({
+  scheme: "only http and https are permitted",
+  malformed: "the request target is not a valid absolute URL",
+  loopback: "loopback addresses are not permitted",
+  unspecified: "unspecified addresses are not permitted",
+  "link-local": "link-local addresses are not permitted",
+  private: "private addresses are not permitted",
+  "unique-local": "unique-local addresses are not permitted",
+  metadata: "cloud metadata endpoints are not permitted"
+});
+function validateEgressUrl(url, policy = DEFAULT_SEARCH_EGRESS_POLICY, providerId) {
+  let parsed;
+  try {
+    parsed = url instanceof URL ? url : new URL(url);
+  } catch (e) {
+    throw egressDenied("unknown-host", "malformed", providerId);
+  }
+  if (!ALLOWED_SCHEMES.has(parsed.protocol)) {
+    throw egressDenied(parsed.hostname || "unknown-host", "scheme", providerId, parsed.protocol);
+  }
+  const hostname = parsed.hostname;
+  if (isAllowlisted(hostname, policy)) return parsed;
+  const denial = classifyHostname(hostname);
+  if (denial) throw egressDenied(hostname, denial, providerId);
+  return parsed;
+}
+function assertEgressAddressAllowed(address, hostname, policy = DEFAULT_SEARCH_EGRESS_POLICY, providerId) {
+  if (isAllowlisted(hostname, policy)) return;
+  const denial = classifyAddress(address);
+  if (denial) throw egressDenied(hostname, denial, providerId, void 0, address);
+}
+function isAllowlisted(hostname, policy) {
+  const allowed = policy.allowedPrivateHosts;
+  if (!allowed || allowed.length === 0) return false;
+  const normalized = normalizeHostname(hostname);
+  return allowed.some((entry) => normalizeHostname(entry) === normalized);
+}
+function normalizeHostname(hostname) {
+  const trimmed = hostname.trim().toLowerCase().replace(/\.+$/, "");
+  return trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
+}
+function classifyHostname(hostname) {
+  const candidate = normalizeHostname(hostname);
+  if (candidate === "") return "malformed";
+  const version = _net.isIP.call(void 0, candidate);
+  if (version !== 0) return classifyAddress(candidate);
+  if (candidate === "localhost" || candidate.endsWith(".localhost")) return "loopback";
+  if (METADATA_HOSTNAMES.has(candidate)) return "metadata";
+  return void 0;
+}
+function classifyAddress(address) {
+  const candidate = normalizeHostname(address);
+  const version = _net.isIP.call(void 0, candidate);
+  if (version === 4) return classifyIPv4(candidate);
+  if (version === 6) return classifyIPv6(candidate);
+  return "malformed";
+}
+function classifyIPv4(address) {
+  const octets = address.split(".").map((part) => Number.parseInt(part, 10));
+  if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet))) return "malformed";
+  const [a, b, c, d] = octets;
+  if (a === 127) return "loopback";
+  if (a === 0) return "unspecified";
+  if (a === 10) return "private";
+  if (a === 172 && b >= 16 && b <= 31) return "private";
+  if (a === 192 && b === 168) return "private";
+  if (a === 169 && b === 254 && c === 169 && d === 254) return "metadata";
+  if (a === 169 && b === 254) return "link-local";
+  return void 0;
+}
+function classifyIPv6(address) {
+  const pieces = parseIPv6Pieces(address);
+  if (!pieces) return "malformed";
+  const topIsZero = pieces.slice(0, 5).every((piece) => piece === 0);
+  if (topIsZero && (pieces[5] === 65535 || pieces[5] === 0)) {
+    const embedded = [pieces[6] >> 8, pieces[6] & 255, pieces[7] >> 8, pieces[7] & 255];
+    const isLoopbackOrUnspecified = pieces[5] === 0 && pieces[6] === 0 && pieces[7] <= 1;
+    if (isLoopbackOrUnspecified) return pieces[7] === 1 ? "loopback" : "unspecified";
+    return classifyIPv4(embedded.join("."));
+  }
+  if ((pieces[0] & 65472) === 65152) return "link-local";
+  if ((pieces[0] & 65024) === 64512) return "unique-local";
+  return void 0;
+}
+function parseIPv6Pieces(address) {
+  let text = address.split("%")[0];
+  const lastColon = text.lastIndexOf(":");
+  const tail = text.slice(lastColon + 1);
+  if (tail.includes(".")) {
+    if (_net.isIP.call(void 0, tail) !== 4) return void 0;
+    const octets = tail.split(".").map((part) => Number.parseInt(part, 10));
+    const high = (octets[0] << 8 | octets[1]).toString(16);
+    const low = (octets[2] << 8 | octets[3]).toString(16);
+    text = `${text.slice(0, lastColon + 1)}${high}:${low}`;
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return void 0;
+  const head = halves[0] === "" ? [] : halves[0].split(":");
+  const rest = halves.length === 2 ? halves[1] === "" ? [] : halves[1].split(":") : [];
+  let groups;
+  if (halves.length === 1) {
+    if (head.length !== 8) return void 0;
+    groups = head;
+  } else {
+    const zeros = 8 - head.length - rest.length;
+    if (zeros < 1) return void 0;
+    groups = [...head, ...Array.from({ length: zeros }, () => "0"), ...rest];
+  }
+  const pieces = [];
+  for (const group of groups) {
+    if (!/^[0-9a-f]{1,4}$/i.test(group)) return void 0;
+    pieces.push(Number.parseInt(group, 16));
+  }
+  return pieces;
+}
+function egressDenied(hostname, reason, providerId, scheme, resolvedAddress) {
+  const subject = scheme ? `scheme "${scheme}"` : `host "${hostname}"`;
+  const via = resolvedAddress ? ` (resolved to a ${reason} address)` : "";
+  const details = { host: hostname, egressClass: reason };
+  if (resolvedAddress) details.egressStage = "dns";
+  return new (0, _searchtypes.SearchProviderError)(
+    "policy_denied",
+    `egress policy denied ${subject}${via}: ${DENIAL_TEXT[reason]}`,
+    {
+      providerId,
+      retryable: false,
+      details
+    }
+  );
+}
+function findEgressDenial(error) {
+  let current = error;
+  for (let depth = 0; depth < 6 && current !== void 0 && current !== null; depth += 1) {
+    if (_searchtypes.isSearchProviderError.call(void 0, current) && current.code === "policy_denied") {
+      return current;
+    }
+    current = current instanceof Error ? current.cause : void 0;
+  }
+  return void 0;
+}
+function createEgressGuardedLookup(policy = DEFAULT_SEARCH_EGRESS_POLICY, lookupImpl = _dns.lookup) {
+  const guarded = (hostname, options, callback) => {
+    const requestedAll = Boolean(_optionalChain([options, 'optionalAccess', _ => _.all]));
+    const lookupOptions = { ...options, all: true };
+    lookupImpl(hostname, lookupOptions, (error, addresses) => {
+      if (error) {
+        callback(error);
+        return;
+      }
+      const entries = Array.isArray(addresses) ? addresses : [];
+      if (entries.length === 0) {
+        callback(new Error(`no addresses resolved for ${hostname}`));
+        return;
+      }
+      try {
+        for (const entry of entries) assertEgressAddressAllowed(entry.address, hostname, policy);
+      } catch (denial) {
+        callback(denial);
+        return;
+      }
+      if (requestedAll) callback(null, entries);
+      else callback(null, entries[0].address, entries[0].family);
+    });
+  };
+  return guarded;
+}
+var guardedDispatchers = /* @__PURE__ */ new Map();
+function createEgressGuardedDispatcher(policy = DEFAULT_SEARCH_EGRESS_POLICY, lookupImpl) {
+  if (lookupImpl) {
+    return new (0, _undici.Agent)({ connect: { lookup: createEgressGuardedLookup(policy, lookupImpl) } });
+  }
+  const signature = JSON.stringify(normalizePolicy(policy));
+  const cached = guardedDispatchers.get(signature);
+  if (cached) return cached;
+  const dispatcher = new (0, _undici.Agent)({ connect: { lookup: createEgressGuardedLookup(policy) } });
+  guardedDispatchers.set(signature, dispatcher);
+  return dispatcher;
+}
+function normalizePolicy(policy) {
+  return {
+    allowedPrivateHosts: [..._nullishCoalesce(policy.allowedPrivateHosts, () => ( []))].map(normalizeHostname).sort((left, right) => left < right ? -1 : left > right ? 1 : 0)
+  };
+}
+
+// src/search/http/proxy.ts
+
+var cachedProxySignature = "";
+var cachedProxyDispatcher;
+function resolveSearchProxySettings(env = process.env) {
+  const allProxy = firstNonEmpty(env.all_proxy, env.ALL_PROXY);
+  const httpProxy = firstNonEmpty(env.http_proxy, env.HTTP_PROXY, allProxy);
+  const httpsProxy = firstNonEmpty(env.https_proxy, env.HTTPS_PROXY, allProxy);
+  if (!httpProxy && !httpsProxy) return void 0;
+  const noProxy = firstNonEmpty(env.no_proxy, env.NO_PROXY);
+  return {
+    ...httpProxy ? { httpProxy } : {},
+    ...httpsProxy ? { httpsProxy } : {},
+    ...noProxy ? { noProxy } : {}
+  };
+}
+function getSearchProxyDispatcher(proxy) {
+  const signature = JSON.stringify(proxy);
+  if (cachedProxyDispatcher && cachedProxySignature === signature) return cachedProxyDispatcher;
+  cachedProxySignature = signature;
+  cachedProxyDispatcher = new (0, _undici.EnvHttpProxyAgent)(proxy);
+  return cachedProxyDispatcher;
+}
+function firstNonEmpty(...values) {
+  for (const value of values) {
+    const trimmed = _optionalChain([value, 'optionalAccess', _2 => _2.trim, 'call', _3 => _3()]);
+    if (trimmed) return trimmed;
+  }
+  return void 0;
+}
+
+
+
+
+
+
+
+
+
+
+exports.DEFAULT_SEARCH_EGRESS_POLICY = DEFAULT_SEARCH_EGRESS_POLICY; exports.validateEgressUrl = validateEgressUrl; exports.assertEgressAddressAllowed = assertEgressAddressAllowed; exports.findEgressDenial = findEgressDenial; exports.createEgressGuardedLookup = createEgressGuardedLookup; exports.createEgressGuardedDispatcher = createEgressGuardedDispatcher; exports.resolveSearchProxySettings = resolveSearchProxySettings; exports.getSearchProxyDispatcher = getSearchProxyDispatcher;