@truefoundry/ai-gateway-sdk 0.0.0-stage → 0.0.2

package/dist/http/createSafeDispatcher.js

@@ -0,0 +1,49 @@
+import { Agent, EnvHttpProxyAgent } from 'undici';
+import config from '../config.js';
+import { guardedLookup } from './guardedLookup.js';
+function buildDispatcher(ssrf, tls, connection) {
+    const connect = {
+        ...tls,
+        ...(ssrf === 'guard' ? { lookup: guardedLookup } : {}),
+    };
+    const timeouts = {
+        headersTimeout: connection?.headersTimeoutMs ?? config.UNDICI_HEADERS_TIMEOUT_MS,
+        bodyTimeout: connection?.bodyTimeoutMs ?? config.UNDICI_BODY_TIMEOUT_MS,
+    };
+    // When connection is provided it owns the proxy decision (undefined = direct). Falling back to
+    // process env would reintroduce a proxy the MCP store deliberately omitted.
+    const httpProxy = connection ? connection.proxyUrl : config.HTTP_PROXY;
+    const httpsProxy = connection ? connection.proxyUrl : config.HTTPS_PROXY;
+    const noProxy = connection ? connection.noProxy : config.NO_PROXY;
+    if (httpsProxy || httpProxy) {
+        // Mirrors proxy-bootstrap's global agent so per-request dispatchers keep honoring NO_PROXY.
+        return new EnvHttpProxyAgent({
+            httpProxy,
+            httpsProxy,
+            ...(noProxy ? { noProxy } : {}),
+            ...(tls ? { requestTls: tls } : {}),
+            connect,
+            ...timeouts,
+        });
+    }
+    return new Agent({ connect, ...timeouts });
+}
+// Requests without per-request overrides — the overwhelming majority — share a dispatcher so
+// connection pooling survives. Overrides are per provider account or per MCP server, so those build
+// a dispatcher per request, matching what the handlers already did before safeFetch.
+const sharedDispatchers = new Map();
+export function createSafeDispatcher(ssrf, tls, connection) {
+    if (tls || connection)
+        return buildDispatcher(ssrf, tls, connection);
+    let shared = sharedDispatchers.get(ssrf);
+    if (!shared) {
+        shared = buildDispatcher(ssrf, undefined, undefined);
+        sharedDispatchers.set(ssrf, shared);
+    }
+    return shared;
+}
+/** @internal Exported for tests: drops the pooled dispatchers so proxy/timeout config is re-read. */
+export function __resetSharedDispatchersForTests() {
+    sharedDispatchers.clear();
+}
+//# sourceMappingURL=createSafeDispatcher.js.map

package/dist/http/createSafeDispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createSafeDispatcher.js","sourceRoot":"","sources":["../../src/http/createSafeDispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAmB,MAAM,QAAQ,CAAC;AACnE,OAAO,MAAM,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA6BhD,SAAS,eAAe,CACtB,IAAc,EACd,GAAoC,EACpC,UAAkD;IAElD,MAAM,OAAO,GAAG;QACd,GAAG,GAAG;QACN,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;IACF,MAAM,QAAQ,GAAG;QACf,cAAc,EAAE,UAAU,EAAE,gBAAgB,IAAI,MAAM,CAAC,yBAAyB;QAChF,WAAW,EAAE,UAAU,EAAE,aAAa,IAAI,MAAM,CAAC,sBAAsB;KACxE,CAAC;IAEF,+FAA+F;IAC/F,4EAA4E;IAC5E,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;IACvE,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;IACzE,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IAElE,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;QAC5B,4FAA4F;QAC5F,OAAO,IAAI,iBAAiB,CAAC;YAC3B,SAAS;YACT,UAAU;YACV,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,OAAO;YACP,GAAG,QAAQ;SACZ,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,6FAA6F;AAC7F,oGAAoG;AACpG,qFAAqF;AACrF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAwB,CAAC;AAE1D,MAAM,UAAU,oBAAoB,CAClC,IAAc,EACd,GAAoC,EACpC,UAAkD;IAElD,IAAI,GAAG,IAAI,UAAU;QAAE,OAAO,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAErE,IAAI,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACrD,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,gCAAgC;IAC9C,iBAAiB,CAAC,KAAK,EAAE,CAAC;AAC5B,CAAC"}

package/dist/http/errors.d.ts

@@ -0,0 +1,23 @@
+/** Thrown when safeFetch refuses a request because its target is internal or denylisted. */
+export declare class SSRFError extends Error {
+    name: string;
+    /** Stable marker: Node's DNS lookup callback stringifies custom errors into a plain Error. */
+    code: string;
+}
+/**
+ * undici surfaces connect-time failures as `TypeError('fetch failed')` with the real reason on the
+ * cause chain, so an SSRFError raised inside the DNS lookup would otherwise reach callers as an
+ * opaque network error. Recovers our error from anywhere on that chain.
+ */
+export declare function unwrapSafeFetchError(error: unknown): unknown;
+/** 504 when the upstream never answered in time, 502 when it could not be reached at all. */
+export type UpstreamConnectivityFailure = {
+    status: 502 | 504;
+    message: string;
+};
+/**
+ * Classifies a failure to reach an upstream at the network level (timeout, refused, DNS, reset, TLS), so callers
+ * can attribute it to the upstream instead of a generic gateway 500. Walks the cause chain because undici only
+ * reports `fetch failed` at the top; `undefined` for anything that is not a connectivity failure.
+ */
+export declare function getUpstreamConnectivityFailure(error: unknown): UpstreamConnectivityFailure | undefined;

package/dist/http/errors.js

@@ -0,0 +1,128 @@
+/** Thrown when safeFetch refuses a request because its target is internal or denylisted. */
+export class SSRFError extends Error {
+    name = 'SSRFError';
+    /** Stable marker: Node's DNS lookup callback stringifies custom errors into a plain Error. */
+    code = 'ERR_SSRF_BLOCKED';
+}
+// A malformed error chain should never turn error handling into an infinite loop.
+const MAX_CAUSE_DEPTH = 10;
+function readErrorField(error, field) {
+    if (!error || typeof error !== 'object')
+        return undefined;
+    const value = error[field];
+    return typeof value === 'string' ? value : undefined;
+}
+/**
+ * undici/Node often preserve neither the SSRFError prototype nor a nested `.cause` when the failure
+ * originates inside `connect.lookup`: the callback error is re-created as a plain Error whose
+ * message is `"SSRFError: …"`. Match by code/name/message so callers still see SSRFError.
+ */
+function asSSRFError(error) {
+    if (error instanceof SSRFError)
+        return error;
+    const code = readErrorField(error, 'code');
+    const name = readErrorField(error, 'name');
+    const message = readErrorField(error, 'message');
+    if (code === 'ERR_SSRF_BLOCKED' || name === 'SSRFError') {
+        return new SSRFError(message || 'Blocked by SSRF guard');
+    }
+    if (message?.startsWith('SSRFError:')) {
+        return new SSRFError(message.slice('SSRFError:'.length).trim());
+    }
+    return undefined;
+}
+/** Each link of `error`'s `.cause` chain, outermost first; `error` itself is not yielded. */
+function* causeChain(error) {
+    let cause = error?.cause;
+    for (let depth = 0; cause && depth < MAX_CAUSE_DEPTH; depth++) {
+        yield cause;
+        cause = cause.cause;
+    }
+}
+// A dual-stack connect fails with one error per address, wrapped in an AggregateError.
+function aggregateMembers(link) {
+    const errors = link?.errors;
+    return Array.isArray(errors) ? errors : [];
+}
+/**
+ * undici surfaces connect-time failures as `TypeError('fetch failed')` with the real reason on the
+ * cause chain, so an SSRFError raised inside the DNS lookup would otherwise reach callers as an
+ * opaque network error. Recovers our error from anywhere on that chain.
+ */
+export function unwrapSafeFetchError(error) {
+    const direct = asSSRFError(error);
+    if (direct)
+        return direct;
+    for (const link of causeChain(error)) {
+        for (const candidate of [link, ...aggregateMembers(link)]) {
+            const ssrf = asSSRFError(candidate);
+            if (ssrf)
+                return ssrf;
+        }
+    }
+    return error;
+}
+const FETCH_FAILED_MESSAGE = 'fetch failed';
+const UPSTREAM_TIMEOUT_NAMES = new Set(['ConnectTimeoutError', 'HeadersTimeoutError', 'BodyTimeoutError']);
+const UPSTREAM_TIMEOUT_CODES = new Set([
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_HEADERS_TIMEOUT',
+    'UND_ERR_BODY_TIMEOUT',
+    'ETIMEDOUT',
+]);
+const UPSTREAM_UNREACHABLE_CODES = new Set([
+    'ECONNREFUSED',
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'ECONNRESET',
+    'EHOSTUNREACH',
+    'ENETUNREACH',
+    'EPIPE',
+    'UND_ERR_SOCKET',
+]);
+const UPSTREAM_TLS_CODE_PREFIXES = ['ERR_TLS_', 'ERR_SSL_', 'CERT_'];
+function classifyNetworkError(error) {
+    const name = readErrorField(error, 'name');
+    const code = readErrorField(error, 'code');
+    if ((name && UPSTREAM_TIMEOUT_NAMES.has(name)) || (code && UPSTREAM_TIMEOUT_CODES.has(code)))
+        return 504;
+    if (code && (UPSTREAM_UNREACHABLE_CODES.has(code) || UPSTREAM_TLS_CODE_PREFIXES.some(p => code.startsWith(p)))) {
+        return 502;
+    }
+    return undefined;
+}
+// An AggregateError's own message is usually empty; its members carry the per-address reasons, one per line.
+function describeCause(link) {
+    const memberMessages = aggregateMembers(link)
+        .map(member => readErrorField(member, 'message'))
+        .filter((message) => Boolean(message));
+    if (memberMessages.length > 0)
+        return [...new Set(memberMessages)].join('\n');
+    return readErrorField(link, 'message') || undefined;
+}
+function isFetchFailed(error) {
+    return error instanceof Error && error.message === FETCH_FAILED_MESSAGE;
+}
+/**
+ * Classifies a failure to reach an upstream at the network level (timeout, refused, DNS, reset, TLS), so callers
+ * can attribute it to the upstream instead of a generic gateway 500. Walks the cause chain because undici only
+ * reports `fetch failed` at the top; `undefined` for anything that is not a connectivity failure.
+ */
+export function getUpstreamConnectivityFailure(error) {
+    let failure;
+    for (const link of causeChain(error)) {
+        const status = [link, ...aggregateMembers(link)].map(classifyNetworkError).find(s => s !== undefined);
+        if (status === undefined)
+            continue;
+        // Deeper links sit closer to the socket, so the last recognised one carries the most specific reason.
+        failure = { status, message: describeCause(link) ?? failure?.message ?? FETCH_FAILED_MESSAGE };
+    }
+    if (failure)
+        return failure;
+    // undici says `fetch failed` for every connect-phase error; an unrecognised cause still means unreachable.
+    if (isFetchFailed(error)) {
+        return { status: 502, message: describeCause(error.cause) ?? FETCH_FAILED_MESSAGE };
+    }
+    return undefined;
+}
+//# sourceMappingURL=errors.js.map

package/dist/http/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/http/errors.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,IAAI,GAAG,WAAW,CAAC;IAC5B,8FAA8F;IAC9F,IAAI,GAAG,kBAAkB,CAAC;CAC3B;AAED,kFAAkF;AAClF,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,SAAS,cAAc,CAAC,KAAc,EAAE,KAAkC;IACxE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,KAAK,GAAI,KAAiC,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,YAAY,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7C,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAEjD,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACxD,OAAO,IAAI,SAAS,CAAC,OAAO,IAAI,uBAAuB,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,OAAO,EAAE,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6FAA6F;AAC7F,QAAQ,CAAC,CAAC,UAAU,CAAC,KAAc;IACjC,IAAI,KAAK,GAAa,KAAyC,EAAE,KAAK,CAAC;IACvE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,KAAK,GAAG,eAAe,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9D,MAAM,KAAK,CAAC;QACZ,KAAK,GAAI,KAA6B,CAAC,KAAK,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,gBAAgB,CAAC,IAAa;IACrC,MAAM,MAAM,GAAI,IAA2C,EAAE,MAAM,CAAC;IACpE,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAE5C,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAC3G,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,yBAAyB;IACzB,yBAAyB;IACzB,sBAAsB;IACtB,WAAW;CACZ,CAAC,CAAC;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,cAAc;IACd,WAAW;IACX,WAAW;IACX,YAAY;IACZ,cAAc;IACd,aAAa;IACb,OAAO;IACP,gBAAgB;CACjB,CAAC,CAAC;AACH,MAAM,0BAA0B,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AAKrE,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACzG,IAAI,IAAI,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/G,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6GAA6G;AAC7G,SAAS,aAAa,CAAC,IAAa;IAClC,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC;SAC1C,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;SAChD,MAAM,CAAC,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,OAAO,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,oBAAoB,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,IAAI,OAAgD,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACtG,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,sGAAsG;QACtG,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,2GAA2G;IAC3G,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,CAAE,KAAe,CAAC,KAAK,CAAC,IAAI,oBAAoB,EAAE,CAAC;IACjG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/http/guardedLookup.d.ts

@@ -0,0 +1,18 @@
+import type { LookupFunction } from 'node:net';
+/**
+ * A DNS lookup that, in `enforce` mode, fails the connection when any resolved address is internal.
+ * In `monitor` mode a violation is only logged — the callback still receives the real address, so
+ * the connection proceeds (failing it here would be blocking, not monitoring). In `off` mode this
+ * passes through to a plain lookup with no classification at all.
+ *
+ * undici runs this inside the socket's own lookup, so the addresses we validate (in `enforce` mode)
+ * are exactly the ones the socket connects to. There is no separate "validate now, resolve again
+ * later" step, which is what closes the DNS-rebinding window.
+ */
+export declare const guardedLookup: LookupFunction;
+/**
+ * Best-effort pre-flight check, used only when a forward proxy is configured: the socket then
+ * connects to the proxy, so {@link guardedLookup} would classify the proxy instead of the target.
+ * The proxy still resolves the target itself, so this cannot rule out rebinding.
+ */
+export declare function assertHostnameIsPublic(hostname: string): Promise<void>;

package/dist/http/guardedLookup.js

@@ -0,0 +1,72 @@
+import { lookup as dnsLookup } from 'node:dns';
+import { lookup as dnsLookupAsync } from 'node:dns/promises';
+import { SSRFError } from './errors.js';
+import { isPublicIp } from './isPublicIp.js';
+import { assertHostnameAllowed } from './urlverify/hostname.js';
+import { getSsrfGuardMode, logSsrfViolation } from './urlverify/mode.js';
+function assertAddressesArePublic(hostname, addresses) {
+    if (addresses.length === 0) {
+        throw new SSRFError(`Blocked: DNS for "${hostname}" returned no addresses`);
+    }
+    const internal = addresses.find(a => !isPublicIp(a.address));
+    if (internal) {
+        throw new SSRFError(`Blocked: "${hostname}" resolves to internal address ${internal.address}`);
+    }
+}
+/**
+ * A DNS lookup that, in `enforce` mode, fails the connection when any resolved address is internal.
+ * In `monitor` mode a violation is only logged — the callback still receives the real address, so
+ * the connection proceeds (failing it here would be blocking, not monitoring). In `off` mode this
+ * passes through to a plain lookup with no classification at all.
+ *
+ * undici runs this inside the socket's own lookup, so the addresses we validate (in `enforce` mode)
+ * are exactly the ones the socket connects to. There is no separate "validate now, resolve again
+ * later" step, which is what closes the DNS-rebinding window.
+ */
+export const guardedLookup = (hostname, options, callback) => {
+    const mode = getSsrfGuardMode();
+    if (mode === 'off') {
+        return dnsLookup(hostname, options, callback);
+    }
+    try {
+        assertHostnameAllowed(hostname);
+    }
+    catch (hostnameError) {
+        if (mode === 'enforce')
+            return callback(hostnameError, '');
+        logSsrfViolation({ hostname }, hostnameError);
+    }
+    const allOptions = { ...options, all: true };
+    dnsLookup(hostname, allOptions, (err, addresses) => {
+        if (err)
+            return callback(err, '');
+        try {
+            assertAddressesArePublic(hostname, addresses);
+        }
+        catch (ssrfError) {
+            if (mode === 'enforce')
+                return callback(ssrfError, '');
+            logSsrfViolation({ hostname }, ssrfError);
+        }
+        if (options.all)
+            return callback(null, addresses);
+        callback(null, addresses[0].address, addresses[0].family);
+    });
+};
+/**
+ * Best-effort pre-flight check, used only when a forward proxy is configured: the socket then
+ * connects to the proxy, so {@link guardedLookup} would classify the proxy instead of the target.
+ * The proxy still resolves the target itself, so this cannot rule out rebinding.
+ */
+export async function assertHostnameIsPublic(hostname) {
+    assertHostnameAllowed(hostname);
+    let addresses;
+    try {
+        addresses = await dnsLookupAsync(hostname, { all: true });
+    }
+    catch {
+        throw new SSRFError(`Blocked: host "${hostname}" could not be resolved`);
+    }
+    assertAddressesArePublic(hostname, addresses);
+}
+//# sourceMappingURL=guardedLookup.js.map

package/dist/http/guardedLookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardedLookup.js","sourceRoot":"","sources":["../../src/http/guardedLookup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEtE,SAAS,wBAAwB,CAAC,QAAgB,EAAE,SAA0B;IAC5E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,qBAAqB,QAAQ,yBAAyB,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,aAAa,QAAQ,kCAAkC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAmB,CAAC,QAAQ,EAAE,OAAsB,EAAE,QAAQ,EAAE,EAAE;IAC1F,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC;QACH,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,aAAa,EAAE,CAAC;QACvB,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC,aAAsC,EAAE,EAAE,CAAC,CAAC;QACpF,gBAAgB,CAAC,EAAE,QAAQ,EAAE,EAAE,aAAa,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,UAAU,GAAqB,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC/D,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;QACjD,IAAI,GAAG;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,wBAAwB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAC,SAAkC,EAAE,EAAE,CAAC,CAAC;YAChF,gBAAgB,CAAC,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,OAAO,CAAC,GAAG;YAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAClD,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAgB;IAC3D,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAEhC,IAAI,SAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,kBAAkB,QAAQ,yBAAyB,CAAC,CAAC;IAC3E,CAAC;IACD,wBAAwB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC"}

package/dist/http/index.d.ts

@@ -0,0 +1,7 @@
+export { createSafeDispatcher, type SafeFetchConnectionOptions, type SafeFetchTlsOptions, } from './createSafeDispatcher.js';
+export { SSRFError, getUpstreamConnectivityFailure, type UpstreamConnectivityFailure } from './errors.js';
+export { assertHostnameIsPublic, guardedLookup } from './guardedLookup.js';
+export { isPublicIp } from './isPublicIp.js';
+export { assertMeshTlsFilesReadable, createMeshHttpsAgent, isInternalMeshUrl, isMeshMutualTlsEnabled, meshNatsTlsOptions, meshServerTlsOptions, meshTlsExemptPathSet, meshTlsFetchOptions, meshTlsHttpsAgentOptions, normalizeInternalMeshUrl, } from './meshTls.js';
+export { assertSafeToFetch, safeFetch, type SafeFetchInit } from './safeFetch.js';
+export type { SsrfMode } from './types.js';

package/dist/http/index.js

@@ -0,0 +1,7 @@
+export { createSafeDispatcher, } from './createSafeDispatcher.js';
+export { SSRFError, getUpstreamConnectivityFailure } from './errors.js';
+export { assertHostnameIsPublic, guardedLookup } from './guardedLookup.js';
+export { isPublicIp } from './isPublicIp.js';
+export { assertMeshTlsFilesReadable, createMeshHttpsAgent, isInternalMeshUrl, isMeshMutualTlsEnabled, meshNatsTlsOptions, meshServerTlsOptions, meshTlsExemptPathSet, meshTlsFetchOptions, meshTlsHttpsAgentOptions, normalizeInternalMeshUrl, } from './meshTls.js';
+export { assertSafeToFetch, safeFetch } from './safeFetch.js';
+//# sourceMappingURL=index.js.map

package/dist/http/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,GAGrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,8BAA8B,EAAoC,MAAM,UAAU,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAsB,MAAM,aAAa,CAAC"}

package/dist/http/isPublicIp.d.ts

@@ -0,0 +1 @@
+export declare function isPublicIp(ip: string): boolean;

package/dist/http/isPublicIp.js

@@ -0,0 +1,63 @@
+import { isIPv4, isIPv6 } from 'node:net';
+import config from '../config.js';
+import { URL_VERIFY_CONFIG } from './urlverify/config.js';
+import { isIpInCidr, parseIp } from './urlverify/ip.js';
+/**
+ * True only for a public, internet-routable IP; any internal/reserved/unparseable address is false.
+ *
+ * Built on top of servicefoundry-server's `src/urlverify/{config,ip}.ts` (PLA-2199), ported verbatim
+ * into `./urlverify/`: `URL_VERIFY_CONFIG.denyCidrsV4/denyCidrsV6/extraDenyCidrs` is the source of
+ * truth for which ranges are non-public, and `parseIp`/`isIpInCidr` do the byte-level matching.
+ * `SSRF_BLOCKED_EXACT_IPS` is an addition on top (not part of the ported files) for blocking single
+ * addresses without needing a CIDR.
+ *
+ * Always classifies — callers (`safeFetch`'s `assertTargetIsPublic`, `guardedLookup`) decide whether
+ * the guard is off, log-only, or blocking via `getSsrfGuardMode()`.
+ */
+function blockedExactIps() {
+    return new Set(config.SSRF_BLOCKED_EXACT_IPS.map(ip => normalizeIp(ip)));
+}
+function normalizeIp(ip) {
+    let normalized = ip.replace(/\.+$/, '').toLowerCase();
+    if (normalized.startsWith('[') && normalized.endsWith(']')) {
+        normalized = normalized.slice(1, -1);
+    }
+    return normalized;
+}
+/** Unmaps IPv4-mapped IPv6 (`::ffff:x.x.x.x` or `::ffff:7f00:1`) to the embedded IPv4 string when present. */
+function unmapIpv4MappedAddress(ip) {
+    const normalized = normalizeIp(ip);
+    if (!normalized.startsWith('::ffff:')) {
+        return normalized;
+    }
+    const embedded = normalized.slice('::ffff:'.length);
+    if (isIPv4(embedded)) {
+        return embedded;
+    }
+    const hexParts = embedded.split(':');
+    if (hexParts.length === 2 && hexParts.every(part => /^[0-9a-f]{1,4}$/i.test(part))) {
+        const hi = parseInt(hexParts[0], 16);
+        const lo = parseInt(hexParts[1], 16);
+        return `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
+    }
+    return normalized;
+}
+function isDeniedByCidrs(ip) {
+    const parsed = parseIp(ip);
+    if (!parsed) {
+        return true; // unparseable — fail closed, same as the pre-ported implementation.
+    }
+    const denyCidrs = parsed.version === 4 ? URL_VERIFY_CONFIG.denyCidrsV4 : URL_VERIFY_CONFIG.denyCidrsV6;
+    return [...denyCidrs, ...URL_VERIFY_CONFIG.extraDenyCidrs].some(cidr => isIpInCidr(parsed.bytes, cidr));
+}
+export function isPublicIp(ip) {
+    const candidate = unmapIpv4MappedAddress(ip);
+    if (blockedExactIps().has(candidate)) {
+        return false;
+    }
+    if (isIPv4(candidate) || isIPv6(candidate)) {
+        return !isDeniedByCidrs(candidate);
+    }
+    return false;
+}
+//# sourceMappingURL=isPublicIp.js.map

package/dist/http/isPublicIp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isPublicIp.js","sourceRoot":"","sources":["../../src/http/isPublicIp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,MAAM,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAErD;;;;;;;;;;;GAWG;AAEH,SAAS,eAAe;IACtB,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,WAAW,CAAC,EAAU;IAC7B,IAAI,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,8GAA8G;AAC9G,SAAS,sBAAsB,CAAC,EAAU;IACxC,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnF,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,EAAU;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,CAAC,oEAAoE;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC;IACvG,OAAO,CAAC,GAAG,SAAS,EAAE,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAU;IACnC,MAAM,SAAS,GAAG,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,eAAe,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,OAAO,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/http/loopbackDispatcher.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Makes the process-wide `fetch` carry mesh TLS material for calls the gateway makes to ITSELF.
+ *
+ * THIS IS THE ONE SANCTIONED EXCEPTION to the rule in {@link ../http/meshTls} that the material is
+ * never installed globally, and it does not weaken it: what goes on the global dispatcher is a
+ * router, not the material. Anything whose origin is not exactly {@link loopbackOrigin} is handed
+ * to the unchanged base dispatcher, so no provider, customer MCP server or auth host can be reached
+ * with the client certificate — or, worse, with a `ca` that replaces the default trust store and
+ * would fail verification against every public host.
+ *
+ * Why it is needed at all: {@link loopbackFetch} already fixes every loopback caller that lets us
+ * pass a `fetch` in (`mcpGateway/connectedLocalClient.ts`, and agent model calls via
+ * `createLoopbackOpenAILLM`). Two still do not: registered-MCP (`RemoteMCP` from
+ * `@truefoundry/utils`) and the channels session/turn client (`AgentSessionClient` from
+ * `truefoundry-gateway-sdk`) each own their transport and expose no `fetch`/agent hook, so under
+ * TLS they present no client certificate and do not trust the internal CA unless this router is
+ * installed. The symptom is a bare `fetch failed: self-signed certificate in certificate chain`.
+ *
+ * Remove this once those clients accept a `fetch`, in favour of passing {@link loopbackFetch}.
+ * Note: OpenAI's Node shim uses `node-fetch`, which ignores undici's global dispatcher — model
+ * calls must use {@link loopbackFetch} directly, not this router alone.
+ */
+import type { Dispatcher } from 'undici';
+/**
+ * Wraps `base` so loopback dispatches get the mesh material and everything else is untouched.
+ *
+ * A no-op when TLS is off — `loopbackTlsFetchOptions()` returns undefined, and the origin is plain
+ * http anyway — so this is safe to install unconditionally at bootstrap. It is resolved per
+ * dispatch instead of at wrap time because the wrap happens during bootstrap, before anything has
+ * established that the certificate files are readable.
+ */
+export declare function withLoopbackMeshTls(base: Dispatcher): Dispatcher;

package/dist/http/loopbackDispatcher.js

@@ -0,0 +1,40 @@
+import { createSafeDispatcher } from './createSafeDispatcher.js';
+import { isLoopbackUrl } from './loopbackFetch.js';
+import { loopbackTlsFetchOptions } from './meshTls.js';
+/**
+ * Keyed on the certificate rather than built once, so a reissued certificate is picked up without
+ * a restart, and pooled rather than built per call, because this sits under the agent's token
+ * streaming — `createSafeDispatcher` builds a fresh Agent whenever TLS options are passed, which
+ * would mean a new connection pool per request.
+ */
+let pooled;
+function loopbackTlsDispatcher() {
+    const tls = loopbackTlsFetchOptions();
+    if (!tls)
+        return undefined;
+    if (pooled?.cert !== tls.cert) {
+        // `ssrf: 'none'` for the same reason loopbackFetch needs it: `localhost` is on the urlverify
+        // hostname denylist, so the guarded mode would block the call outright.
+        pooled = { cert: tls.cert, dispatcher: createSafeDispatcher('none', tls, undefined) };
+    }
+    return pooled.dispatcher;
+}
+/**
+ * Wraps `base` so loopback dispatches get the mesh material and everything else is untouched.
+ *
+ * A no-op when TLS is off — `loopbackTlsFetchOptions()` returns undefined, and the origin is plain
+ * http anyway — so this is safe to install unconditionally at bootstrap. It is resolved per
+ * dispatch instead of at wrap time because the wrap happens during bootstrap, before anything has
+ * established that the certificate files are readable.
+ */
+export function withLoopbackMeshTls(base) {
+    return base.compose(dispatch => (options, handler) => {
+        if (isLoopbackUrl(options.origin ?? '')) {
+            const loopback = loopbackTlsDispatcher();
+            if (loopback)
+                return loopback.dispatch(options, handler);
+        }
+        return dispatch(options, handler);
+    });
+}
+//# sourceMappingURL=loopbackDispatcher.js.map

package/dist/http/loopbackDispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopbackDispatcher.js","sourceRoot":"","sources":["../../src/http/loopbackDispatcher.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEpD;;;;;GAKG;AACH,IAAI,MAA4D,CAAC;AAEjE,SAAS,qBAAqB;IAC5B,MAAM,GAAG,GAAG,uBAAuB,EAAE,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAE3B,IAAI,MAAM,EAAE,IAAI,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,6FAA6F;QAC7F,wEAAwE;QACxE,MAAM,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,oBAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgB;IAClD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;QACnD,IAAI,aAAa,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;YACzC,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/http/loopbackFetch.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Whether `url` targets this gateway's own listener, and so should use {@link loopbackFetch}.
+ *
+ * Compared by origin rather than by hostname: an external MCP server on `localhost` at a different
+ * port is not us, and — the case that actually matters — a customer's remote MCP URL must never pick
+ * up the internal material. Call sites that build transports for both loopback and remote targets
+ * (`mcpGateway/connectedLocalClient.ts`) gate on this.
+ */
+export declare function isLoopbackUrl(url: string | URL): boolean;
+/**
+ * Matches the MCP SDK's `FetchLike` and OpenAI's `fetch` override — a drop-in for global `fetch`
+ * elsewhere when the target is this process.
+ *
+ * Returns the TLS material afresh per call rather than closing over it, so a process that boots with
+ * TLS off does not cache an empty option set that would then be wrong. `meshTlsFetchOptions` caches
+ * the file reads, so this is not a per-request disk hit.
+ */
+export declare const loopbackFetch: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;

package/dist/http/loopbackFetch.js

@@ -0,0 +1,47 @@
+/**
+ * `fetch` for calls the gateway makes to itself.
+ *
+ * Several paths call the gateway back through its own port: the MCP transport probe and client
+ * (`/{tenant}/mcp/{server}/server`), the semantic-cache embeddings hop, complexity routing, and the
+ * agent channels client. Once the listener serves HTTPS with mutual TLS, plain `fetch` fails those
+ * twice over — it does not trust the internal CA, and it presents no client certificate — so they
+ * need a dispatcher carrying the pod's own material.
+ *
+ * `ssrf: 'none'` is required, not incidental: `localhost` is on the hostname denylist in
+ * `urlverify/config.ts`, so the guarded mode would block every loopback call. That is safe here
+ * because the target is built from `config.PORT` rather than from tenant or request input — the
+ * existing loopback call in `handlers/complexityRouting` already does the same thing for the same
+ * reason.
+ *
+ * DO NOT use this as a general-purpose fetch. It carries the client certificate and, more
+ * dangerously, a `ca` that REPLACES the default trust store — pointed at any public host it would
+ * fail verification against every provider the gateway talks to.
+ */
+import { loopbackOrigin, loopbackTlsFetchOptions } from './meshTls.js';
+import { safeFetch } from './safeFetch.js';
+/**
+ * Whether `url` targets this gateway's own listener, and so should use {@link loopbackFetch}.
+ *
+ * Compared by origin rather than by hostname: an external MCP server on `localhost` at a different
+ * port is not us, and — the case that actually matters — a customer's remote MCP URL must never pick
+ * up the internal material. Call sites that build transports for both loopback and remote targets
+ * (`mcpGateway/connectedLocalClient.ts`) gate on this.
+ */
+export function isLoopbackUrl(url) {
+    try {
+        return new URL(url instanceof URL ? url.href : url).origin === loopbackOrigin();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Matches the MCP SDK's `FetchLike` and OpenAI's `fetch` override — a drop-in for global `fetch`
+ * elsewhere when the target is this process.
+ *
+ * Returns the TLS material afresh per call rather than closing over it, so a process that boots with
+ * TLS off does not cache an empty option set that would then be wrong. `meshTlsFetchOptions` caches
+ * the file reads, so this is not a per-request disk hit.
+ */
+export const loopbackFetch = (input, init) => safeFetch(input, { ...init, ssrf: 'none', tls: loopbackTlsFetchOptions() });
+//# sourceMappingURL=loopbackFetch.js.map

package/dist/http/loopbackFetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopbackFetch.js","sourceRoot":"","sources":["../../src/http/loopbackFetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,GAAiB;IAC7C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAA6B,EAAE,IAAkB,EAAqB,EAAE,CACpG,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC"}