@tool-bridge/server 0.3.0 → 0.5.0

package/dist/{airtable-V6446SVY.js → airtable-7TFNLFIF.js}

@@ -1,14 +1,16 @@
 import {
   createProviderPlugin,
-  guardedFetch,
   requireApiKey,
   upstreamError
-} from "./chunk-CSJEZHQO.js";
-import "./chunk-K7FVSFUX.js";
+} from "./chunk-FHYFPPBZ.js";
+import {
+  guardedFetch
+} from "./chunk-7GP7DRES.js";
+import "./chunk-B4ZA7EGO.js";
 import {
   TBError,
   external_exports
-} from "./chunk-JLTYA2B3.js";
+} from "./chunk-7PM4FD5K.js";
 import "./chunk-MLKGABMK.js";
 
 // ../plugins/src/airtable/api.ts

package/dist/{alt_text_generator_ai-HV7JZPDT.js → alt_text_generator_ai-VJSAHBJM.js}

@@ -1,14 +1,16 @@
 import {
   createProviderPlugin,
-  guardedFetch,
   requireApiKey,
   upstreamError
-} from "./chunk-CSJEZHQO.js";
-import "./chunk-K7FVSFUX.js";
+} from "./chunk-FHYFPPBZ.js";
+import {
+  guardedFetch
+} from "./chunk-7GP7DRES.js";
+import "./chunk-B4ZA7EGO.js";
 import {
   TBError,
   external_exports
-} from "./chunk-JLTYA2B3.js";
+} from "./chunk-7PM4FD5K.js";
 import "./chunk-MLKGABMK.js";
 
 // ../plugins/src/alt_text_generator_ai/schema.ts

package/dist/{amap-TTTVB6WS.js → amap-KZMUDGK6.js}

@@ -1,14 +1,16 @@
 import {
   createProviderPlugin,
-  guardedFetch,
   requireApiKey,
   upstreamError
-} from "./chunk-CSJEZHQO.js";
-import "./chunk-K7FVSFUX.js";
+} from "./chunk-FHYFPPBZ.js";
+import {
+  guardedFetch
+} from "./chunk-7GP7DRES.js";
+import "./chunk-B4ZA7EGO.js";
 import {
   TBError,
   external_exports
-} from "./chunk-JLTYA2B3.js";
+} from "./chunk-7PM4FD5K.js";
 import "./chunk-MLKGABMK.js";
 
 // ../plugins/src/amap/api.ts

package/dist/{anthropic-JH3RA363.js → anthropic-C6FCUSY7.js}

@@ -1,14 +1,16 @@
 import {
   createProviderPlugin,
-  guardedFetch,
   requireApiKey,
   upstreamError
-} from "./chunk-CSJEZHQO.js";
-import "./chunk-K7FVSFUX.js";
+} from "./chunk-FHYFPPBZ.js";
+import {
+  guardedFetch
+} from "./chunk-7GP7DRES.js";
+import "./chunk-B4ZA7EGO.js";
 import {
   TBError,
   external_exports
-} from "./chunk-JLTYA2B3.js";
+} from "./chunk-7PM4FD5K.js";
 import "./chunk-MLKGABMK.js";
 
 // ../plugins/src/anthropic/api.ts

package/dist/{apify-ETNN7ITU.js → apify-MUCWNIWU.js}

@@ -1,14 +1,16 @@
 import {
   createProviderPlugin,
-  guardedFetch,
   requireApiKey,
   upstreamError
-} from "./chunk-CSJEZHQO.js";
-import "./chunk-K7FVSFUX.js";
+} from "./chunk-FHYFPPBZ.js";
+import {
+  guardedFetch
+} from "./chunk-7GP7DRES.js";
+import "./chunk-B4ZA7EGO.js";
 import {
   TBError,
   external_exports
-} from "./chunk-JLTYA2B3.js";
+} from "./chunk-7PM4FD5K.js";
 import "./chunk-MLKGABMK.js";
 
 // ../plugins/src/apify/api.ts

package/dist/{brave_search-3DDR2MMB.js → brave_search-NRVZ4ZNY.js}

@@ -1,14 +1,16 @@
 import {
   createProviderPlugin,
-  guardedFetch,
   requireApiKey,
   upstreamError
-} from "./chunk-CSJEZHQO.js";
-import "./chunk-K7FVSFUX.js";
+} from "./chunk-FHYFPPBZ.js";
+import {
+  guardedFetch
+} from "./chunk-7GP7DRES.js";
+import "./chunk-B4ZA7EGO.js";
 import {
   TBError,
   external_exports
-} from "./chunk-JLTYA2B3.js";
+} from "./chunk-7PM4FD5K.js";
 import "./chunk-MLKGABMK.js";
 
 // ../plugins/src/brave_search/api.ts

package/dist/{chunk-KGYJEEBI.js → chunk-3C3J36GT.js}

@@ -130,7 +130,7 @@ import {
   url,
   validatePath,
   virtualizeTools
-} from "./chunk-JLTYA2B3.js";
+} from "./chunk-7PM4FD5K.js";
 
 // src/config.ts
 var DEFAULT_PORT = 8787;
@@ -442,7 +442,7 @@ async function doBootstrap(store, adminSk, requireAdminSk) {
   if (!bootstrapped) await store.put(KEY_BOOTSTRAPPED, true);
 }
 function runBootstrap(store, opts) {
-  return doBootstrap(store, opts?.adminSk, opts?.requireAdminSk ?? false);
+  return doBootstrap(store, opts?.adminSk, opts?.requireAdminSk ?? true);
 }
 function buildDeps(opts) {
   return {
@@ -457,8 +457,7 @@ function buildDeps(opts) {
       store: opts.store,
       probe: (manifest) => probePlugin(manifest, opts.pluginBindings),
       fetchContract: (manifest) => fetchPluginContract(manifest, opts.pluginBindings),
-      allowInsecureHttp: opts.allowInsecureHttp,
-      ...opts.pluginBindings !== void 0 ? { bindings: () => [...(opts.pluginBindings ?? /* @__PURE__ */ new Map()).keys()] } : {}
+      allowInsecureHttp: opts.allowInsecureHttp
     },
     // federation 模块:remote host 白名单运行时存储 + env 基线。
     federation: { store: new RemoteAllowlistStore(opts.store), base: opts.remoteAllowlistBase },
@@ -650,53 +649,6 @@ function createS3ObjectStore(cfg, opts) {
   };
 }
 
-// ../app/src/deviceNodes.ts
-function tbErrorFromBody(body) {
-  return new TBError(body.code, body.message, { retryable: body.retryable });
-}
-function requireDevice(deps) {
-  if (deps.device === void 0) {
-    throw TBError.unimplemented("device capability disabled: no device transport");
-  }
-  return deps.device;
-}
-async function invokeDevice(deps, deviceId, req) {
-  const id = crypto.randomUUID();
-  const body = await requireDevice(deps).invoke(deviceId, { id, ...req });
-  if (!body || !("ok" in body)) {
-    throw new TBError("unavailable", "device session returned invalid result");
-  }
-  if (body.ok) return body.value;
-  throw tbErrorFromBody(body.error);
-}
-function deviceMarkerOf(pc) {
-  if (pc === void 0 || typeof pc.deviceId !== "string" || typeof pc.mountPath !== "string") {
-    return null;
-  }
-  return {
-    deviceId: pc.deviceId,
-    mountPath: pc.mountPath,
-    ...Array.isArray(pc.cmds) ? { cmds: pc.cmds } : {}
-  };
-}
-function deviceToolMarker(node) {
-  if (node.kind !== "tool" || node.config?.kind !== "tool") return null;
-  return deviceMarkerOf(node.config.providerConfig);
-}
-function relativeDevicePath(nodePath, mountPath) {
-  if (nodePath.startsWith(`${mountPath}/`)) return nodePath.slice(mountPath.length + 1);
-  throw new TBError("invalid_argument", `device \u8282\u70B9 '${nodePath}' \u4E0D\u5728\u6302\u8F7D '${mountPath}' \u4E0B`);
-}
-function assertNoDeviceMarker(config) {
-  const pc = config.providerConfig;
-  if (pc !== null && typeof pc === "object" && deviceMarkerOf(pc) !== null) {
-    throw new TBError(
-      "invalid_argument",
-      "providerConfig \u7684 device \u8F6C\u53D1\u6807\u8BB0\u7531\u7F51\u5173\u4EE3\u5199,\u4E0D\u5F97\u7ECF\u6CE8\u518C\u9762\u643A\u5E26"
-    );
-  }
-}
-
 // ../app/src/providers/toolCache.ts
 var KEY_PREFIX = "toolcache:";
 function toolCacheKey(path) {
@@ -992,6 +944,53 @@ var SearchSynchronizer = class {
 // ../app/src/deps.ts
 var TOOL_CACHE_TTL_DEFAULT = 300;
 
+// ../app/src/deviceNodes.ts
+function tbErrorFromBody(body) {
+  return new TBError(body.code, body.message, { retryable: body.retryable });
+}
+function requireDevice(deps) {
+  if (deps.device === void 0) {
+    throw TBError.unimplemented("device capability disabled: no device transport");
+  }
+  return deps.device;
+}
+async function invokeDevice(deps, deviceId, req) {
+  const id = crypto.randomUUID();
+  const body = await requireDevice(deps).invoke(deviceId, { id, ...req });
+  if (!body || !("ok" in body)) {
+    throw new TBError("unavailable", "device session returned invalid result");
+  }
+  if (body.ok) return body.value;
+  throw tbErrorFromBody(body.error);
+}
+function deviceMarkerOf(pc) {
+  if (pc === void 0 || typeof pc.deviceId !== "string" || typeof pc.mountPath !== "string") {
+    return null;
+  }
+  return {
+    deviceId: pc.deviceId,
+    mountPath: pc.mountPath,
+    ...Array.isArray(pc.cmds) ? { cmds: pc.cmds } : {}
+  };
+}
+function deviceToolMarker(node) {
+  if (node.kind !== "tool" || node.config?.kind !== "tool") return null;
+  return deviceMarkerOf(node.config.providerConfig);
+}
+function relativeDevicePath(nodePath, mountPath) {
+  if (nodePath.startsWith(`${mountPath}/`)) return nodePath.slice(mountPath.length + 1);
+  throw new TBError("invalid_argument", `device \u8282\u70B9 '${nodePath}' \u4E0D\u5728\u6302\u8F7D '${mountPath}' \u4E0B`);
+}
+function assertNoDeviceMarker(config) {
+  const pc = config.providerConfig;
+  if (pc !== null && typeof pc === "object" && deviceMarkerOf(pc) !== null) {
+    throw new TBError(
+      "invalid_argument",
+      "providerConfig \u7684 device \u8F6C\u53D1\u6807\u8BB0\u7531\u7F51\u5173\u4EE3\u5199,\u4E0D\u5F97\u7ECF\u6CE8\u518C\u9762\u643A\u5E26"
+    );
+  }
+}
+
 // ../app/src/providers/http.ts
 function toSpec(t) {
   const spec = { name: t.name, description: t.description, effect: effectFor(t) };
@@ -19265,6 +19264,47 @@ function mountCallContext(ctx, mountPath, providerConfig, exportId) {
     ...exportId !== void 0 ? { exportId } : {}
   };
 }
+async function assertPluginMountContract(exported, config, deps) {
+  const providerConfig = config.providerConfig ?? {};
+  const missingConfig = (exported.mountConfigFields ?? []).filter((field) => {
+    if (field.required !== true) return false;
+    const value = providerConfig[field.key];
+    return value === void 0 || value === null || typeof value === "string" && value.trim() === "";
+  }).map((field) => field.key);
+  if (missingConfig.length > 0) {
+    throw new TBError(
+      "invalid_argument",
+      `plugin export '${exported.id}' \u7F3A\u5C11\u5FC5\u586B providerConfig:${missingConfig.join(", ")}`
+    );
+  }
+  const authRef = typeof config.authRef === "string" && config.authRef.trim() !== "" ? config.authRef.trim() : void 0;
+  if (exported.auth?.kind === "none") {
+    if (authRef !== void 0) {
+      throw new TBError(
+        "invalid_argument",
+        `plugin export '${exported.id}' \u58F0\u660E auth:none,\u4E0D\u5F97\u7ED1\u5B9A authRef`
+      );
+    }
+    return;
+  }
+  const requiresAuth = exported.oauth !== void 0 || exported.credentialFields !== void 0 || exported.auth?.kind === "single" && exported.auth.required === true;
+  if (requiresAuth && authRef === void 0) {
+    throw new TBError(
+      "invalid_argument",
+      `plugin export '${exported.id}' \u9700\u8981 authRef`
+    );
+  }
+  if (authRef === void 0) return;
+  const raw = await deps.secrets.resolve(authRef);
+  if (raw === void 0) {
+    throw new TBError("invalid_argument", `secret '${authRef}' \u4E0D\u5B58\u5728\u6216\u65E0\u6CD5\u89E3\u5BC6`);
+  }
+  if (exported.credentialFields !== void 0) {
+    parseCredentialValues(raw, exported.credentialFields);
+  } else if (exported.oauth !== void 0) {
+    parseCredentialValues(raw, [...OAUTH_CLIENT_FIELDS]);
+  }
+}
 async function providerAccessTokenFor(opts) {
   const encryptionKey = opts.deps.encryptionKey;
   if (encryptionKey === void 0) {
@@ -19290,7 +19330,7 @@ async function providerFor(node, ctx, deps) {
   if (node.kind === "mcp" && node.config?.kind === "mcp") {
     return createMcpProvider(node.config, deps.secrets, {
       allowInsecure: insecure,
-      // 会话复用凭证存 StateStore(mcpsession:<path>);调用结果不缓存(providers/mcp.ts)。
+      // era 判定存 StateStore(mcpera:<path>);调用结果不缓存(providers/mcp.ts)。
       session: { store: deps.state, nodePath: node.path },
       // auth:'oauth' 节点的托管凭证存取面(mcpoauth:*);密钥缺省 → provider 内报 unavailable。
       ...deps.encryptionKey !== void 0 ? { oauth: { store: deps.state, encryptionKey: deps.encryptionKey } } : {}
@@ -19452,13 +19492,11 @@ async function assertToolConfig(config, deps, ctx, mountPath) {
     typeof exportId === "string" ? exportId : void 0
   );
   const authRef = config.authRef;
-  if (exported.credentialFields !== void 0 && typeof authRef === "string") {
-    const raw = await deps.secrets.resolve(authRef);
-    if (raw === void 0) {
-      throw new TBError("invalid_argument", `secret '${authRef}' \u4E0D\u5B58\u5728\u6216\u65E0\u6CD5\u89E3\u5BC6`);
-    }
-    parseCredentialValues(raw, exported.credentialFields);
-  }
+  await assertPluginMountContract(
+    exported,
+    config,
+    deps
+  );
   if (exported.credentialProbe === void 0 || typeof authRef !== "string" || ctx === void 0 || mountPath === void 0 || exported.oauth !== void 0) {
     return;
   }
@@ -19713,7 +19751,14 @@ async function assertContextConfig(config, deps) {
   assertNoDeviceMarker(config);
   const cfg = config;
   if (cfg.provider !== "r2" && cfg.provider !== "s3") {
-    await requirePluginExport(deps, cfg.provider, "context", "context", cfg.export);
+    const { export: exported } = await requirePluginExport(
+      deps,
+      cfg.provider,
+      "context",
+      "context",
+      cfg.export
+    );
+    await assertPluginMountContract(exported, cfg, deps);
     return;
   }
   if (cfg.provider === "s3") {
@@ -38291,7 +38336,7 @@ import { join as join4 } from "path";
 // package.json
 var package_default = {
   name: "@tool-bridge/server",
-  version: "0.3.0",
+  version: "0.5.0",
   description: "tool-bridge self-hosted server: run the HTBP gateway on Node with SQLite persistence, filesystem object storage and WebSocket device channel \u2014 single container via docker run",
   type: "module",
   license: "MIT",

package/dist/{chunk-CSJEZHQO.js → chunk-7GP7DRES.js}

@@ -1,80 +1,6 @@
-import {
-  createPlugin
-} from "./chunk-K7FVSFUX.js";
 import {
   TBError
-} from "./chunk-JLTYA2B3.js";
-
-// ../plugins/src/_runtime/plugin.ts
-function requireApiKey(ctx, service) {
-  const key = ctx.upstreamAuth;
-  if (key === void 0 || key === "") {
-    throw new TBError(
-      "unavailable",
-      `${service} \u9700\u8981 API key:\u7ED9\u6302\u8F7D\u8282\u70B9\u914D config.authRef \u6307\u5411\u5DF2\u5B58\u5165 system/secret \u7684\u51ED\u8BC1`
-    );
-  }
-  return key;
-}
-function requireCredential(ctx, service, field) {
-  const values = ctx.credentials;
-  if (values === void 0) {
-    throw new TBError(
-      "unavailable",
-      `${service} \u9700\u8981\u591A\u5B57\u6BB5\u51ED\u8BC1:\u7ED9\u6302\u8F7D\u8282\u70B9\u914D config.authRef \u6307\u5411\u5DF2\u5B58\u5165 system/secret \u7684\u51ED\u8BC1(\u7528 \`tb secret set <name> --field ...\` \u5199\u5165)`
-    );
-  }
-  const value = values[field];
-  if (value === void 0 || value === "") {
-    throw new TBError("internal", `${service} \u7684\u51ED\u8BC1\u5B57\u6BB5 '${field}' \u672A\u5728 credentialFields \u91CC\u58F0\u660E`);
-  }
-  return value;
-}
-function createProviderPlugin(input) {
-  const names = Object.keys(input.actions);
-  const handlerNames = Object.keys(input.handlers);
-  const missing = names.filter((name) => !handlerNames.includes(name));
-  const extra = handlerNames.filter((name) => !names.includes(name));
-  if (missing.length > 0 || extra.length > 0) {
-    throw new Error(
-      `action \u8868\u4E0E handler \u8868\u4E0D\u543B\u5408:\u7F3A handler [${missing.join(", ")}];\u591A\u4F59 handler [${extra.join(", ")}]`
-    );
-  }
-  const plugin = createPlugin({ token: (env) => env.PLUGIN_TOKEN });
-  const tools = plugin.tools(input.exportId ?? "actions", { description: input.description });
-  if (input.oauth !== void 0) tools.oauth(input.oauth);
-  if (input.credentialFields !== void 0) tools.credentials(input.credentialFields);
-  for (const name of names) {
-    tools.register(name, input.actions[name], (args, ctx) => input.handlers[name](args, {
-      upstreamAuth: ctx.upstreamAuth,
-      credentials: ctx.credentials,
-      config: ctx.mountConfig
-    }));
-  }
-  if (input.credentialProbe !== void 0) {
-    const effect = input.actions[input.credentialProbe]?.effect;
-    if (effect !== "read") {
-      throw new Error(
-        `credentialProbe '${input.credentialProbe}' \u7684 effect \u662F '${effect ?? "\u672A\u58F0\u660E"}', \u63A2\u9488\u5FC5\u987B\u662F read \u2014\u2014 \u6302\u8F7D\u65F6\u4F1A\u771F\u5B9E\u8C03\u7528\u5B83`
-      );
-    }
-    tools.probeCredentialWith(input.credentialProbe);
-  }
-  return plugin;
-}
-
-// ../plugins/src/_runtime/upstreamError.ts
-function upstreamError(status, message) {
-  if (status === 401) {
-    return new TBError("permission_denied", message, { httpStatus: 401 });
-  }
-  if (status === 403) return new TBError("permission_denied", message);
-  if (status === 404) return new TBError("not_found", message);
-  if (status === 409) return new TBError("conflict", message);
-  if (status === 429) return new TBError("rate_limited", message, { retryable: true });
-  if (status >= 500) return new TBError("unavailable", message, { retryable: true });
-  return new TBError("invalid_argument", message);
-}
+} from "./chunk-7PM4FD5K.js";
 
 // ../plugins/src/_runtime/ipPolicy.ts
 function parseIpv4(value) {
@@ -186,10 +112,10 @@ var CROSS_ORIGIN_STRIPPED_HEADERS = [
 function looksLikeCredentialHeader(name) {
   return /(?:^|-)(?:api[-_]?key|key|token|secret|auth)(?:$|-)/i.test(name);
 }
-function stripCredentials(headers) {
+function stripCredentials(headers, sensitiveHeaders) {
   const next = new Headers(headers);
   for (const [name] of headers) {
-    if (CROSS_ORIGIN_STRIPPED_HEADERS.includes(name.toLowerCase()) || looksLikeCredentialHeader(name)) {
+    if (CROSS_ORIGIN_STRIPPED_HEADERS.includes(name.toLowerCase()) || looksLikeCredentialHeader(name) || sensitiveHeaders.has(name.toLowerCase())) {
       next.delete(name);
     }
   }
@@ -219,7 +145,11 @@ function assertPublicHttpUrl(value) {
   return url;
 }
 function createGuardedFetch(options = {}) {
+  const crossOriginRedirect = options.crossOriginRedirect ?? "follow";
   const maxRedirects = options.maxRedirects ?? MAX_REDIRECTS;
+  const sensitiveHeaders = new Set(
+    (options.sensitiveHeaders ?? []).map((name) => name.toLowerCase())
+  );
   return async function guardedFetch2(input, init) {
     const transport = options.fetch ?? globalThis.fetch;
     const initial = input instanceof Request ? input.url : String(input);
@@ -234,7 +164,11 @@ function createGuardedFetch(options = {}) {
       }
       const previousOrigin = new URL(request.url).origin;
       url = assertPublicHttpUrl(new URL(location, url));
-      const headers = url.origin === previousOrigin ? request.headers : stripCredentials(request.headers);
+      const crossesOrigin = url.origin !== previousOrigin;
+      if (crossesOrigin && crossOriginRedirect === "error") {
+        throw new EgressBlockedError("\u643A\u5E26\u654F\u611F\u4FE1\u606F\u7684\u51FA\u7AD9\u8BF7\u6C42\u4E0D\u5141\u8BB8\u8DE8\u6E90\u91CD\u5B9A\u5411");
+      }
+      const headers = !crossesOrigin ? request.headers : stripCredentials(request.headers, sensitiveHeaders);
       const downgrade = response.status === 303 || (response.status === 301 || response.status === 302) && request.method !== "GET";
       request = downgrade ? new Request(url, { method: "GET", headers, redirect: "manual" }) : new Request(url, { ...request, headers, redirect: "manual" });
     }
@@ -243,10 +177,7 @@ function createGuardedFetch(options = {}) {
 var guardedFetch = createGuardedFetch();
 
 export {
-  requireApiKey,
-  requireCredential,
-  createProviderPlugin,
-  upstreamError,
   assertPublicHttpUrl,
+  createGuardedFetch,
   guardedFetch
 };