@skrr-ai/cli 0.1.115 → 0.1.117

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/loopbackHttp.js

@@ -1,268 +1,241 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
 };
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.loopbackFetch = exports.LoopbackTargetRefusedError = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = void 0;
-exports.isLoopbackAddress = isLoopbackAddress;
-exports.isLoopbackHostname = isLoopbackHostname;
-exports.assertLoopbackHttpUrl = assertLoopbackHttpUrl;
-/**
- * OSK-12134 — the ONE HTTP client for talking to a process on this machine.
- *
- * ── Why this is not `fetch` ────────────────────────────────────────────────
- *
- * The compiled daemon runs on Bun, and Bun's `fetch` routes EVERY URL through
- * `HTTP_PROXY` / `HTTPS_PROXY` unless `NO_PROXY` names it — a `127.0.0.1`
- * target included. Node's `fetch` does the same once `NODE_USE_ENV_PROXY=1` is
- * set (Node 22.21+/24). On a laptop with a local proxy exported in the shell
- * (Clash, Surge, a corporate agent, …) every loopback call the daemon, a
- * wrapper, or the CLI made with `fetch` was delivered to that proxy instead —
- * WITH its credential: the daemon's local secret, the CLI-handoff descriptor
- * secret, the wrapper fan-out bearer, the browser bridge token, the extension
- * relay token. OSK-12087 found this on the `/health` probe and moved that one
- * caller to `node:http`; this module is that fix made the only way to do it.
- *
- * `node:http` never consults proxy environment variables, on Node or on Bun, so
- * a request made through it cannot be routed off the machine by environment.
- *
- * ── What it refuses ────────────────────────────────────────────────────────
- *
- * Only `http:` URLs whose host is a loopback name or address are accepted
- * (`127.0.0.0/8`, `::1`, `localhost`). Anything else throws BEFORE a socket is
- * opened: a caller that builds its URL from a descriptor or an environment
- * variable must not be turned into an SSRF primitive by a hostile value, and a
- * credential that is only meant for this machine must not be sent anywhere
- * else. `localhost` is resolved through a lookup that rejects any non-loopback
- * answer, so a rewritten hosts file cannot redirect it either.
- *
- * ── Shape ──────────────────────────────────────────────────────────────────
- *
- * `loopbackFetch` is a drop-in for the subset of `fetch` these callers use —
- * method, headers, a string/bytes body, an `AbortSignal` — and returns a real
- * `Response`, so existing callers (and their `fetchImpl` test seams) change one
- * identifier. Transport failures reject with `TypeError('fetch failed')` whose
- * `cause` carries the socket error (`ECONNREFUSED`, …), and aborts reject with
- * the signal's reason, exactly as `fetch` does, so existing error handling keeps
- * working. The response body is buffered (bounded by `maxBodyBytes`); nothing
- * on loopback streams through this client.
- */
-const node_dns_1 = __importDefault(require("node:dns"));
-const node_http_1 = __importDefault(require("node:http"));
-const node_net_1 = __importDefault(require("node:net"));
-/** Loopback host names this client will connect to, besides 127/8 and ::1 literals. */
-const LOOPBACK_NAMES = new Set(['localhost']);
-/** Upper bound on a buffered response body. Loopback control-plane bodies are small. */
-exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = 16 * 1024 * 1024;
-/** Statuses a `Response` must be constructed with a null body for. */
-const NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);
-/** Thrown (synchronously surfaced as a rejection) for a URL that is not loopback HTTP. */
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var loopbackHttp_exports = {};
+__export(loopbackHttp_exports, {
+  LOOPBACK_DEFAULT_MAX_BODY_BYTES: () => LOOPBACK_DEFAULT_MAX_BODY_BYTES,
+  LoopbackTargetRefusedError: () => LoopbackTargetRefusedError,
+  assertLoopbackHttpUrl: () => assertLoopbackHttpUrl,
+  isLoopbackAddress: () => isLoopbackAddress,
+  isLoopbackHostname: () => isLoopbackHostname,
+  loopbackFetch: () => loopbackFetch
+});
+module.exports = __toCommonJS(loopbackHttp_exports);
+var import_node_dns = __toESM(require("node:dns"), 1);
+var import_node_http = __toESM(require("node:http"), 1);
+var import_node_net = __toESM(require("node:net"), 1);
+const LOOPBACK_NAMES = /* @__PURE__ */ new Set(["localhost"]);
+const LOOPBACK_DEFAULT_MAX_BODY_BYTES = 16 * 1024 * 1024;
+const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([101, 103, 204, 205, 304]);
 class LoopbackTargetRefusedError extends Error {
-    code = 'LOOPBACK_TARGET_REFUSED';
-    constructor(message) {
-        super(message);
-        this.name = 'LoopbackTargetRefusedError';
-    }
+  code = "LOOPBACK_TARGET_REFUSED";
+  constructor(message) {
+    super(message);
+    this.name = "LoopbackTargetRefusedError";
+  }
 }
-exports.LoopbackTargetRefusedError = LoopbackTargetRefusedError;
 function stripBrackets(hostname) {
-    return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+  return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
 }
-/** True for an IP literal in 127.0.0.0/8, `::1`, or an IPv4-mapped 127/8 address. */
 function isLoopbackAddress(address) {
-    const value = stripBrackets(address.trim().toLowerCase());
-    if (node_net_1.default.isIPv4(value))
-        return value.split('.')[0] === '127';
-    if (node_net_1.default.isIPv6(value)) {
-        if (value === '::1' || value === '0:0:0:0:0:0:0:1')
-            return true;
-        // IPv4-mapped (::ffff:127.0.0.1, which WHATWG URL normalizes to ::ffff:7f00:1).
-        if (value.startsWith('::ffff:')) {
-            const rest = value.slice('::ffff:'.length);
-            if (node_net_1.default.isIPv4(rest))
-                return isLoopbackAddress(rest);
-            const high = /^([0-9a-f]{1,4}):[0-9a-f]{1,4}$/.exec(rest);
-            return high ? parseInt(high[1], 16) >> 8 === 127 : false;
-        }
-        return false;
+  const value = stripBrackets(address.trim().toLowerCase());
+  if (import_node_net.default.isIPv4(value))
+    return value.split(".")[0] === "127";
+  if (import_node_net.default.isIPv6(value)) {
+    if (value === "::1" || value === "0:0:0:0:0:0:0:1")
+      return true;
+    if (value.startsWith("::ffff:")) {
+      const rest = value.slice("::ffff:".length);
+      if (import_node_net.default.isIPv4(rest))
+        return isLoopbackAddress(rest);
+      const high = /^([0-9a-f]{1,4}):[0-9a-f]{1,4}$/.exec(rest);
+      return high ? parseInt(high[1], 16) >> 8 === 127 : false;
     }
     return false;
+  }
+  return false;
 }
-/** True for a host name or address this client accepts as "this machine". */
 function isLoopbackHostname(hostname) {
-    const value = stripBrackets(hostname.trim().toLowerCase());
-    return LOOPBACK_NAMES.has(value) || isLoopbackAddress(value);
+  const value = stripBrackets(hostname.trim().toLowerCase());
+  return LOOPBACK_NAMES.has(value) || isLoopbackAddress(value);
 }
-/**
- * Parse and validate a loopback HTTP URL. Throws {@link LoopbackTargetRefusedError}
- * for anything that is not `http:` to a loopback host.
- */
 function assertLoopbackHttpUrl(input) {
-    let url;
-    try {
-        url = new URL(String(input));
-    }
-    catch {
-        throw new LoopbackTargetRefusedError('Loopback request refused: not a valid URL.');
-    }
-    if (url.protocol !== 'http:') {
-        throw new LoopbackTargetRefusedError(`Loopback request refused: only http: is allowed on loopback (got ${url.protocol}).`);
+  let url;
+  try {
+    url = new URL(String(input));
+  } catch {
+    throw new LoopbackTargetRefusedError("Loopback request refused: not a valid URL.");
+  }
+  if (url.protocol !== "http:") {
+    throw new LoopbackTargetRefusedError(`Loopback request refused: only http: is allowed on loopback (got ${url.protocol}).`);
+  }
+  if (!isLoopbackHostname(url.hostname)) {
+    throw new LoopbackTargetRefusedError(`Loopback request refused: ${url.hostname} is not a loopback host.`);
+  }
+  if (url.username || url.password) {
+    throw new LoopbackTargetRefusedError("Loopback request refused: URL must not carry userinfo.");
+  }
+  return url;
+}
+const loopbackOnlyLookup = (hostname, options, callback) => {
+  import_node_dns.default.lookup(hostname, { ...options, all: true }, (err, addresses) => {
+    if (err) {
+      callback(err, "", 0);
+      return;
     }
-    if (!isLoopbackHostname(url.hostname)) {
-        throw new LoopbackTargetRefusedError(`Loopback request refused: ${url.hostname} is not a loopback host.`);
+    const list = Array.isArray(addresses) ? addresses : [];
+    const loopback = list.filter((entry) => isLoopbackAddress(entry.address));
+    if (loopback.length === 0) {
+      const refused = Object.assign(new Error(`${hostname} did not resolve to a loopback address`), { code: "LOOPBACK_TARGET_REFUSED" });
+      callback(refused, "", 0);
+      return;
     }
-    if (url.username || url.password) {
-        throw new LoopbackTargetRefusedError('Loopback request refused: URL must not carry userinfo.');
+    if (options?.all) {
+      callback(null, loopback);
+      return;
     }
-    return url;
-}
-/** A `dns.lookup` that only ever answers with a loopback address. */
-const loopbackOnlyLookup = (hostname, options, callback) => {
-    node_dns_1.default.lookup(hostname, { ...options, all: true }, (err, addresses) => {
-        if (err) {
-            callback(err, '', 0);
-            return;
-        }
-        const list = (Array.isArray(addresses) ? addresses : []);
-        const loopback = list.filter((entry) => isLoopbackAddress(entry.address));
-        if (loopback.length === 0) {
-            const refused = Object.assign(new Error(`${hostname} did not resolve to a loopback address`), { code: 'LOOPBACK_TARGET_REFUSED' });
-            callback(refused, '', 0);
-            return;
-        }
-        if (options?.all) {
-            callback(null, loopback);
-            return;
-        }
-        callback(null, loopback[0].address, loopback[0].family);
-    });
+    callback(null, loopback[0].address, loopback[0].family);
+  });
 };
 function abortReason(signal) {
-    return signal.reason !== undefined
-        ? signal.reason
-        : new DOMException('This operation was aborted', 'AbortError');
+  return signal.reason !== void 0 ? signal.reason : new DOMException("This operation was aborted", "AbortError");
 }
 function fetchFailed(cause) {
-    return new TypeError('fetch failed', { cause });
+  return new TypeError("fetch failed", { cause });
 }
 function toBodyBuffer(body) {
-    if (body === undefined || body === null)
-        return null;
-    if (typeof body === 'string')
-        return Buffer.from(body, 'utf8');
-    if (body instanceof ArrayBuffer)
-        return Buffer.from(body);
-    if (ArrayBuffer.isView(body))
-        return Buffer.from(body.buffer, body.byteOffset, body.byteLength);
-    throw new TypeError('loopbackFetch supports only string or byte bodies');
+  if (body === void 0 || body === null)
+    return null;
+  if (typeof body === "string")
+    return Buffer.from(body, "utf8");
+  if (body instanceof ArrayBuffer)
+    return Buffer.from(body);
+  if (ArrayBuffer.isView(body))
+    return Buffer.from(body.buffer, body.byteOffset, body.byteLength);
+  throw new TypeError("loopbackFetch supports only string or byte bodies");
 }
-/**
- * `fetch` for a loopback URL, over `node:http`, never through a proxy.
- * Refuses (rejects with {@link LoopbackTargetRefusedError}) any other target.
- */
 const loopbackFetch = (input, init = {}) => {
-    let url;
-    let payload;
+  let url;
+  let payload;
+  try {
+    url = assertLoopbackHttpUrl(input);
+    payload = toBodyBuffer(init.body);
+  } catch (err) {
+    return Promise.reject(err);
+  }
+  const signal = init.signal ?? void 0;
+  if (signal?.aborted)
+    return Promise.reject(abortReason(signal));
+  const maxBodyBytes = init.maxBodyBytes ?? LOOPBACK_DEFAULT_MAX_BODY_BYTES;
+  const method = (init.method ?? "GET").toUpperCase();
+  const headers = {};
+  new Headers(init.headers ?? void 0).forEach((value, name) => {
+    headers[name] = value;
+  });
+  if (payload && headers["content-length"] === void 0) {
+    headers["content-length"] = String(payload.length);
+  }
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let req;
+    const onAbort = () => {
+      if (settled)
+        return;
+      settled = true;
+      req?.destroy();
+      reject(abortReason(signal));
+    };
+    const finish = (fn) => {
+      if (settled)
+        return;
+      settled = true;
+      signal?.removeEventListener("abort", onAbort);
+      fn();
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
     try {
-        url = assertLoopbackHttpUrl(input);
-        payload = toBodyBuffer(init.body);
-    }
-    catch (err) {
-        return Promise.reject(err);
-    }
-    const signal = init.signal ?? undefined;
-    if (signal?.aborted)
-        return Promise.reject(abortReason(signal));
-    const maxBodyBytes = init.maxBodyBytes ?? exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES;
-    const method = (init.method ?? 'GET').toUpperCase();
-    const headers = {};
-    new Headers(init.headers ?? undefined).forEach((value, name) => {
-        headers[name] = value;
-    });
-    if (payload && headers['content-length'] === undefined) {
-        headers['content-length'] = String(payload.length);
+      req = import_node_http.default.request({
+        protocol: "http:",
+        host: stripBrackets(url.hostname),
+        port: url.port ? Number(url.port) : 80,
+        path: `${url.pathname}${url.search}`,
+        method,
+        headers,
+        // No pooled agent: a short-lived command must be able to exit as soon
+        // as it has its answer, and no socket outlives its request.
+        agent: false,
+        lookup: loopbackOnlyLookup
+      }, (res) => {
+        const chunks = [];
+        let size = 0;
+        res.on("data", (chunk) => {
+          size += chunk.length;
+          if (size > maxBodyBytes) {
+            res.destroy();
+            finish(() => reject(fetchFailed(new Error(`response larger than ${maxBodyBytes} bytes`))));
+            return;
+          }
+          chunks.push(chunk);
+        });
+        res.on("error", (err) => finish(() => reject(fetchFailed(err))));
+        res.on("aborted", () => finish(() => reject(fetchFailed(new Error("response aborted")))));
+        res.on("end", () => {
+          finish(() => {
+            const status = res.statusCode ?? 0;
+            const responseHeaders = new Headers();
+            for (const [name, value] of Object.entries(res.headers)) {
+              if (value === void 0)
+                continue;
+              if (Array.isArray(value)) {
+                for (const v of value)
+                  responseHeaders.append(name, v);
+              } else {
+                responseHeaders.set(name, String(value));
+              }
+            }
+            const body = NULL_BODY_STATUSES.has(status) ? null : Buffer.concat(chunks);
+            try {
+              resolve(new Response(body, {
+                status,
+                statusText: res.statusMessage ?? "",
+                headers: responseHeaders
+              }));
+            } catch (err) {
+              reject(fetchFailed(err));
+            }
+          });
+        });
+      });
+      req.on("error", (err) => finish(() => reject(fetchFailed(err))));
+      if (payload)
+        req.write(payload);
+      req.end();
+    } catch (err) {
+      finish(() => reject(fetchFailed(err)));
     }
-    return new Promise((resolve, reject) => {
-        let settled = false;
-        let req;
-        const onAbort = () => {
-            if (settled)
-                return;
-            settled = true;
-            req?.destroy();
-            reject(abortReason(signal));
-        };
-        const finish = (fn) => {
-            if (settled)
-                return;
-            settled = true;
-            signal?.removeEventListener('abort', onAbort);
-            fn();
-        };
-        signal?.addEventListener('abort', onAbort, { once: true });
-        try {
-            req = node_http_1.default.request({
-                protocol: 'http:',
-                host: stripBrackets(url.hostname),
-                port: url.port ? Number(url.port) : 80,
-                path: `${url.pathname}${url.search}`,
-                method,
-                headers,
-                // No pooled agent: a short-lived command must be able to exit as soon
-                // as it has its answer, and no socket outlives its request.
-                agent: false,
-                lookup: loopbackOnlyLookup,
-            }, (res) => {
-                const chunks = [];
-                let size = 0;
-                res.on('data', (chunk) => {
-                    size += chunk.length;
-                    if (size > maxBodyBytes) {
-                        res.destroy();
-                        finish(() => reject(fetchFailed(new Error(`response larger than ${maxBodyBytes} bytes`))));
-                        return;
-                    }
-                    chunks.push(chunk);
-                });
-                res.on('error', (err) => finish(() => reject(fetchFailed(err))));
-                res.on('aborted', () => finish(() => reject(fetchFailed(new Error('response aborted')))));
-                res.on('end', () => {
-                    finish(() => {
-                        const status = res.statusCode ?? 0;
-                        const responseHeaders = new Headers();
-                        for (const [name, value] of Object.entries(res.headers)) {
-                            if (value === undefined)
-                                continue;
-                            if (Array.isArray(value)) {
-                                for (const v of value)
-                                    responseHeaders.append(name, v);
-                            }
-                            else {
-                                responseHeaders.set(name, String(value));
-                            }
-                        }
-                        const body = NULL_BODY_STATUSES.has(status) ? null : Buffer.concat(chunks);
-                        try {
-                            resolve(new Response(body, {
-                                status,
-                                statusText: res.statusMessage ?? '',
-                                headers: responseHeaders,
-                            }));
-                        }
-                        catch (err) {
-                            reject(fetchFailed(err));
-                        }
-                    });
-                });
-            });
-            req.on('error', (err) => finish(() => reject(fetchFailed(err))));
-            if (payload)
-                req.write(payload);
-            req.end();
-        }
-        catch (err) {
-            finish(() => reject(fetchFailed(err)));
-        }
-    });
+  });
 };
-exports.loopbackFetch = loopbackFetch;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  LOOPBACK_DEFAULT_MAX_BODY_BYTES,
+  LoopbackTargetRefusedError,
+  assertLoopbackHttpUrl,
+  isLoopbackAddress,
+  isLoopbackHostname,
+  loopbackFetch
+});