@truefoundry/ai-gateway-sdk 0.0.0-stage → 0.0.2

package/dist/http/safeFetch.js

@@ -0,0 +1,226 @@
+import net from 'node:net';
+import config from '../config.js';
+import { runWithSdkRequestContext } from '../requestContext.js';
+import { ignoreWithLog } from '../utils/ignoreWithLog.js';
+import { createSafeDispatcher, } from './createSafeDispatcher.js';
+import { SSRFError, unwrapSafeFetchError } from './errors.js';
+import { assertHostnameIsPublic } from './guardedLookup.js';
+import { isPublicIp } from './isPublicIp.js';
+import { assertHostnameAllowed } from './urlverify/hostname.js';
+import { getSsrfGuardMode, logSsrfViolation } from './urlverify/mode.js';
+/** Control plane segments the gateway only reaches through its own client, never through safeFetch. */
+const UNREACHABLE_PATH_SEGMENTS = new Set(['master-keys', 'nats-creds']);
+function assertPathIsReachable(url) {
+    // Per escape: decodeURIComponent throws on the first malformed one, skipping the rest of the path.
+    const pathname = url.pathname.replace(/%([0-9a-f]{2})/gi, (_escape, hex) => String.fromCharCode(Number.parseInt(hex, 16)));
+    // Still escaped after one pass means it was double-encoded.
+    if (/%[0-9a-f]{2}/i.test(pathname)) {
+        throw new SSRFError('Blocked: double-encoded path');
+    }
+    // Per segment and lowercased: routes live beneath /master-keys too, and Nest routes case-insensitively.
+    for (const segment of pathname.toLowerCase().split('/')) {
+        if (UNREACHABLE_PATH_SEGMENTS.has(segment)) {
+            throw new SSRFError(`Blocked: "${segment}" is not reachable through the gateway`);
+        }
+    }
+}
+async function assertTargetIsPublic(url, proxyUrl) {
+    // Kill switch: skip before any DNS activity, not just the classification. Without this, the proxy
+    // pre-flight branch below would still run a real DNS lookup (and could throw on a resolution
+    // failure) even in `off` mode.
+    const mode = getSsrfGuardMode();
+    if (mode === 'off') {
+        return;
+    }
+    try {
+        assertPathIsReachable(url);
+        // `new URL` normalizes octal/decimal/hex IPv4 forms to dotted quads and keeps IPv6 bracketed.
+        const host = url.hostname.startsWith('[') ? url.hostname.slice(1, -1) : url.hostname;
+        if (net.isIP(host) !== 0) {
+            // A literal IP never reaches the DNS layer, so the socket lookup guard would not see it.
+            if (!isPublicIp(host))
+                throw new SSRFError(`Blocked: "${host}" is an internal address`);
+            return;
+        }
+        // Cheap, no-DNS check so denylisted hostnames fail before a dispatcher/connection is even built.
+        // The connect-time guard (guardedLookup) re-runs this, so it still applies if a caller reaches
+        // the dispatcher some other way.
+        assertHostnameAllowed(host);
+        // With a forward proxy the socket connects to the proxy and the proxy resolves the target, so
+        // the socket lookup guard would only ever classify the proxy. Check the target here instead.
+        if (proxyUrl) {
+            await assertHostnameIsPublic(host);
+        }
+    }
+    catch (error) {
+        if (mode === 'enforce')
+            throw error;
+        logSsrfViolation({ url: url.href }, error);
+    }
+}
+/**
+ * The same internal-address validation `safeFetch` runs before connecting, exposed for callers that
+ * can't route their actual request through `safeFetch` itself — e.g. a caller that needs to inspect
+ * every hop of a redirect chain rather than only its final response. Re-run this on every hop of a
+ * manually-followed redirect chain, not just the first URL.
+ */
+export async function assertSafeToFetch(url, ssrf = 'guard', connection) {
+    if (ssrf === 'guard') {
+        const effectiveProxy = connection ? connection.proxyUrl : config.HTTPS_PROXY || config.HTTP_PROXY;
+        await assertTargetIsPublic(url, effectiveProxy);
+    }
+}
+/** undici's own limit (`maxRedirects` in its RedirectHandler), reproduced here. */
+const MAX_REDIRECTS = 20;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/** undici's `requestBodyHeader`: dropped along with the body when a redirect downgrades to GET. */
+const REQUEST_BODY_HEADERS = [
+    'content-encoding',
+    'content-language',
+    'content-location',
+    'content-type',
+    'content-length',
+];
+/** Credentials must not leak to a different origin than the one the caller addressed. */
+const CROSS_ORIGIN_STRIPPED_HEADERS = [
+    'authorization',
+    'proxy-authorization',
+    'cookie',
+    'host',
+    'x-tfy-actor-authorization',
+];
+/** undici reports every redirect failure as an opaque `TypeError('fetch failed')`; match that. */
+function redirectNetworkError(reason) {
+    return new TypeError('fetch failed', { cause: new Error(reason) });
+}
+/**
+ * A body undici can serialize again for the next hop. A `ReadableStream` (and anything else that is
+ * only an async iterator) is consumed by the first hop, so it can never be replayed.
+ */
+function isReplayableBody(body) {
+    if (body === null || body === undefined)
+        return true;
+    if (typeof body === 'string')
+        return true;
+    if (body instanceof URLSearchParams || body instanceof FormData || body instanceof Blob)
+        return true;
+    return ArrayBuffer.isView(body) || body instanceof ArrayBuffer;
+}
+function resolveLocation(location, currentUrl) {
+    let nextUrl;
+    try {
+        nextUrl = new URL(location, currentUrl);
+    }
+    catch {
+        throw redirectNetworkError(`invalid redirect location "${location}"`);
+    }
+    if (nextUrl.protocol !== 'http:' && nextUrl.protocol !== 'https:') {
+        throw redirectNetworkError(`redirect location "${location}" is not http(s)`);
+    }
+    return nextUrl;
+}
+/** The `Location` this response redirects to, or `undefined` if it ends the chain. */
+function redirectLocation(response) {
+    if (!REDIRECT_STATUSES.has(response.status))
+        return undefined;
+    return response.headers.get('location') ?? undefined;
+}
+/**
+ * The request to send next, or a rejection of the whole chain. Reproduces steps 6-13 of undici's
+ * `httpRedirectFetch`: hop limit, method downgrade, header stripping, and its refusal to re-send a
+ * body it can no longer serialize.
+ */
+function nextHopFor(response, location, input, requestInit, currentUrl, hopsLeft) {
+    if (hopsLeft === 0)
+        throw redirectNetworkError('redirect count exceeded');
+    const nextUrl = resolveLocation(location, currentUrl);
+    const request = input instanceof Request ? input : undefined;
+    // Headers are read from the init, never from a materialized Request: undici generates a fresh
+    // multipart boundary every time it serializes a FormData body, so a `content-type` read back off
+    // this hop would carry a boundary that no longer matches the replayed body.
+    const headers = new Headers(requestInit.headers ?? request?.headers);
+    let method = (requestInit.method ?? request?.method ?? 'GET').toUpperCase();
+    let body = (requestInit.body ?? null);
+    // A `Request` input exposes its body only as a ReadableStream, even when it was constructed from
+    // a string, so there is nothing left to re-extract it from. Native `fetch` can, because it keeps
+    // the original source internally; this is a known and currently unused gap.
+    const bodyIsReplayable = requestInit.body !== undefined ? isReplayableBody(requestInit.body) : request?.body == null;
+    // A 303 drops the body regardless, so only the other statuses need it to be re-sendable.
+    if (response.status !== 303 && !bodyIsReplayable) {
+        throw redirectNetworkError('cannot redirect with a non-replayable body');
+    }
+    const downgradesToGet = ((response.status === 301 || response.status === 302) && method === 'POST') ||
+        (response.status === 303 && method !== 'GET' && method !== 'HEAD');
+    if (downgradesToGet) {
+        method = 'GET';
+        body = null;
+        for (const header of REQUEST_BODY_HEADERS)
+            headers.delete(header);
+    }
+    if (nextUrl.origin !== currentUrl.origin) {
+        for (const header of CROSS_ORIGIN_STRIPPED_HEADERS)
+            headers.delete(header);
+    }
+    return { url: nextUrl, init: { ...requestInit, method, headers, body } };
+}
+/**
+ * One hop: validate this URL, send it, and — when the caller asked for `follow` — recurse into the
+ * redirect target instead of letting undici chase it. Every URL that is ever connected to therefore
+ * passes through the `assertSafeToFetch` above, which handing the chain to undici would skip for
+ * hops 1..n. `hopsLeft` and `dispatcher` are the only reasons this isn't `safeFetch` itself: the
+ * budget has no business in the public signature, and rebuilding the dispatcher per hop would give
+ * a caller with custom TLS or timeouts a fresh connection pool for every redirect.
+ *
+ * Because each hop is a separate `fetch`, the returned `Response` has `redirected === false`
+ * (`response.url` is still the final hop's URL). No call site reads `redirected`.
+ */
+async function guardedFetch(input, init, hopsLeft, pooledDispatcher) {
+    const { ssrf = 'guard', tls, connection, tenantName: _tenantName, ...requestInit } = init;
+    let url;
+    try {
+        url = new URL(input instanceof Request ? input.url : input);
+    }
+    catch {
+        throw new SSRFError(`Blocked: "${String(input)}" is not a valid URL`);
+    }
+    await assertSafeToFetch(url, ssrf, connection);
+    const dispatcher = pooledDispatcher ?? createSafeDispatcher(ssrf, tls, connection);
+    const redirect = requestInit.redirect ?? 'follow';
+    // `manual` and `error` follow nothing, so undici can never reach an unvalidated hop on its own —
+    // the caller's choice passes straight through.
+    const followsRedirects = redirect === 'follow' && ssrf === 'guard' && getSsrfGuardMode() !== 'off';
+    let response;
+    try {
+        // Node's global fetch (undici) accepts `dispatcher`; using it keeps Response identity identical
+        // to what call sites had before, unlike importing undici's own fetch.
+        response = await fetch(input, {
+            ...requestInit,
+            redirect: followsRedirects ? 'manual' : redirect,
+            dispatcher,
+        });
+    }
+    catch (error) {
+        throw unwrapSafeFetchError(error);
+    }
+    if (!followsRedirects)
+        return response;
+    // Nothing about the request is recomputed until a 3xx actually arrives, so the overwhelmingly
+    // common no-redirect path — including the streaming proxy bodies — behaves exactly as a bare fetch.
+    const location = redirectLocation(response);
+    if (location === undefined)
+        return response;
+    // Past this point the chain is either followed or rejected, and this 3xx body is discarded either
+    // way; leaving it unread would pin its pooled socket until the keep-alive timeout.
+    void response.body?.cancel().catch(ignoreWithLog('sdk.safeFetch.redirectBodyCancel'));
+    const nextHop = nextHopFor(response, location, input, requestInit, url, hopsLeft);
+    return guardedFetch(nextHop.url, { ...nextHop.init, ssrf, tls, connection, tenantName: init.tenantName }, hopsLeft - 1, dispatcher);
+}
+export async function safeFetch(input, init = {}) {
+    const { tenantName } = init;
+    if (tenantName) {
+        return runWithSdkRequestContext({ tenantName }, () => guardedFetch(input, init, MAX_REDIRECTS, undefined));
+    }
+    return guardedFetch(input, init, MAX_REDIRECTS, undefined);
+}
+export default safeFetch;
+//# sourceMappingURL=safeFetch.js.map

package/dist/http/safeFetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeFetch.js","sourceRoot":"","sources":["../../src/http/safeFetch.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,OAAO,MAAM,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EACL,oBAAoB,GAGrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AA0CtE,uGAAuG;AACvG,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;AAEzE,SAAS,qBAAqB,CAAC,GAAQ;IACrC,mGAAmG;IACnG,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,GAAW,EAAE,EAAE,CACjF,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAC9C,CAAC;IAEF,4DAA4D;IAC5D,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACtD,CAAC;IAED,wGAAwG;IACxG,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,IAAI,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,SAAS,CAAC,aAAa,OAAO,wCAAwC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,GAAQ,EAAE,QAA4B;IACxE,kGAAkG;IAClG,6FAA6F;IAC7F,+BAA+B;IAC/B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAE3B,8FAA8F;QAC9F,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAErF,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,yFAAyF;YACzF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,aAAa,IAAI,0BAA0B,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QAED,iGAAiG;QACjG,+FAA+F;QAC/F,iCAAiC;QACjC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE5B,8FAA8F;QAC9F,6FAA6F;QAC7F,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,KAAK,CAAC;QACpC,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,OAAiB,OAAO,EACxB,UAAuC;IAEvC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC;QAClG,MAAM,oBAAoB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7D,mGAAmG;AACnG,MAAM,oBAAoB,GAAG;IAC3B,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,cAAc;IACd,gBAAgB;CACjB,CAAC;AACF,yFAAyF;AACzF,MAAM,6BAA6B,GAAG;IACpC,eAAe;IACf,qBAAqB;IACrB,QAAQ;IACR,MAAM;IACN,2BAA2B;CAC5B,CAAC;AAEF,kGAAkG;AAClG,SAAS,oBAAoB,CAAC,MAAc;IAC1C,OAAO,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAiC;IACzD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,YAAY,eAAe,IAAI,IAAI,YAAY,QAAQ,IAAI,IAAI,YAAY,IAAI;QAAE,OAAO,IAAI,CAAC;IACrG,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,YAAY,WAAW,CAAC;AACjE,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,UAAe;IACxD,IAAI,OAAY,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,oBAAoB,CAAC,8BAA8B,QAAQ,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClE,MAAM,oBAAoB,CAAC,sBAAsB,QAAQ,kBAAkB,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CACjB,QAAkB,EAClB,QAAgB,EAChB,KAA6B,EAC7B,WAAwB,EACxB,UAAe,EACf,QAAgB;IAEhB,IAAI,QAAQ,KAAK,CAAC;QAAE,MAAM,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,8FAA8F;IAC9F,iGAAiG;IACjG,4EAA4E;IAC5E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,WAAW,CAAC,OAAO,IAAI,OAAO,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,MAAM,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,OAAO,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5E,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,IAAI,CAAoB,CAAC;IAEzD,iGAAiG;IACjG,iGAAiG;IACjG,4EAA4E;IAC5E,MAAM,gBAAgB,GAAG,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC;IACrH,yFAAyF;IACzF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACjD,MAAM,oBAAoB,CAAC,4CAA4C,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,eAAe,GACnB,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,MAAM,KAAK,MAAM,CAAC;QAC3E,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC;IACrE,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,GAAG,KAAK,CAAC;QACf,IAAI,GAAG,IAAI,CAAC;QACZ,KAAK,MAAM,MAAM,IAAI,oBAAoB;YAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACzC,KAAK,MAAM,MAAM,IAAI,6BAA6B;YAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,YAAY,CACzB,KAA6B,EAC7B,IAAmB,EACnB,QAAgB,EAChB,gBAAwC;IAExC,MAAM,EAAE,IAAI,GAAG,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,CAAC;IAE1F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,aAAa,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAE/C,MAAM,UAAU,GAAG,gBAAgB,IAAI,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAClD,iGAAiG;IACjG,+CAA+C;IAC/C,MAAM,gBAAgB,GAAG,QAAQ,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,IAAI,gBAAgB,EAAE,KAAK,KAAK,CAAC;IAEnG,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,gGAAgG;QAChG,sEAAsE;QACtE,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE;YAC5B,GAAG,WAAW;YACd,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YAChD,UAAU;SACI,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,CAAC,gBAAgB;QAAE,OAAO,QAAQ,CAAC;IAEvC,8FAA8F;IAC9F,oGAAoG;IACpG,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAE5C,kGAAkG;IAClG,mFAAmF;IACnF,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,kCAAkC,CAAC,CAAC,CAAC;IAEtF,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAClF,OAAO,YAAY,CACjB,OAAO,CAAC,GAAG,EACX,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EACvE,QAAQ,GAAG,CAAC,EACZ,UAAU,CACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAA6B,EAAE,OAAsB,EAAE;IACrF,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAC5B,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,wBAAwB,CAAC,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED,eAAe,SAAS,CAAC"}

package/dist/http/types.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Who chose the destination host.
+ *
+ * - `guard`: the URL is influenced by a caller, a model, or an upstream response. Internal and
+ *   reserved addresses are blocked.
+ * - `none`: the URL comes from tenant/admin configuration or is a deliberate internal call
+ *   (localhost loopback, cloud metadata). IP checks are skipped, because private endpoints are a
+ *   supported product feature, and redirects are left entirely to undici.
+ */
+export type SsrfMode = 'guard' | 'none';

package/dist/http/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/http/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/http/types.ts"],"names":[],"mappings":""}

package/dist/http/urlverify/config.d.ts

@@ -0,0 +1,20 @@
+/**
+ * All tunables for {@link UrlVerifyConfig} live in one JSON-serializable object so the whole
+ * config can later be replaced wholesale from a ConfigMap without touching the service.
+ */
+export interface UrlVerifyConfig {
+    allowedProtocols: string[];
+    /** Denied IPv4 CIDRs. Anything outside these is treated as public, internet-routable. */
+    denyCidrsV4: string[];
+    /** Denied IPv6 CIDRs. Anything outside these is treated as public, internet-routable. */
+    denyCidrsV6: string[];
+    /** Deployment specific ranges, e.g. cluster pod/service CIDRs that fall outside the ranges above. */
+    extraDenyCidrs: string[];
+    /** Hostnames denied on an exact (case-insensitive) match. */
+    denyHostsExact: string[];
+    /** Hostnames denied when they end with one of these suffixes. */
+    denyHostSuffixes: string[];
+    /** Maximum time to wait for a hostname DNS lookup before treating it as unresolved. */
+    dnsLookupTimeoutMs: number;
+}
+export declare const URL_VERIFY_CONFIG: UrlVerifyConfig;

package/dist/http/urlverify/config.js

@@ -0,0 +1,66 @@
+/**
+ * ================================
+ * Ported from servicefoundry-server's `src/urlverify/config.ts` (PLA-2199).
+ * Only change from upstream: the import of the top-level configuration object, to match this
+ * repo's `src/config.ts` instead of servicefoundry-server's `src/configuration.ts`.
+ * ================================
+ */
+import config from '../../config.js';
+const DEFAULT_URL_VERIFY_CONFIG = {
+    allowedProtocols: ['http:', 'https:'],
+    denyCidrsV4: [
+        '0.0.0.0/8', // "this host"
+        '10.0.0.0/8', // private
+        '100.64.0.0/10', // CGNAT (EKS secondary pod CIDRs)
+        '127.0.0.0/8', // loopback
+        '169.254.0.0/16', // link-local + 169.254.169.254 / 169.254.170.2 metadata
+        '172.16.0.0/12', // private (docker, k8s service CIDRs)
+        '192.0.0.0/24', // IETF protocol assignments
+        '192.0.2.0/24', // TEST-NET-1
+        '192.88.99.0/24', // 6to4 relay anycast
+        '192.168.0.0/16', // private
+        '198.18.0.0/15', // benchmarking
+        '198.51.100.0/24', // TEST-NET-2
+        '203.0.113.0/24', // TEST-NET-3
+        '224.0.0.0/4', // multicast
+        '240.0.0.0/4', // reserved + 255.255.255.255 broadcast
+    ],
+    denyCidrsV6: [
+        '::/96', // unspecified, ::1, IPv4-compatible ::a.b.c.d
+        '64:ff9b::/96', // NAT64 well-known
+        '64:ff9b:1::/48', // NAT64 local-use
+        '100::/64', // discard-only
+        '2001::/32', // Teredo
+        '2001:10::/28', // ORCHID
+        '2001:20::/28', // ORCHIDv2
+        '2001:db8::/32', // documentation
+        '2002::/16', // 6to4
+        'fc00::/7', // unique-local (IPv6 k8s service CIDRs)
+        'fe80::/10', // link-local
+        'ff00::/8', // multicast
+    ],
+    extraDenyCidrs: [],
+    denyHostsExact: ['localhost', 'metadata', 'instance-data', 'metadata.google.internal'],
+    denyHostSuffixes: [
+        '.local',
+        '.localhost',
+        '.localdomain',
+        '.internal',
+        '.svc',
+        '.cluster',
+        '.arpa',
+        '.lan',
+        '.intranet',
+        '.corp',
+        '.home',
+        '.test',
+        '.invalid',
+        '.example',
+    ],
+    dnsLookupTimeoutMs: 3_000,
+};
+export const URL_VERIFY_CONFIG = {
+    ...DEFAULT_URL_VERIFY_CONFIG,
+    ...config.URL_VERIFY_CONFIG,
+};
+//# sourceMappingURL=config.js.map

package/dist/http/urlverify/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/http/urlverify/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,MAAM,MAAM,cAAc,CAAC;AAsBlC,MAAM,yBAAyB,GAAoB;IACjD,gBAAgB,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;IAErC,WAAW,EAAE;QACX,WAAW,EAAE,cAAc;QAC3B,YAAY,EAAE,UAAU;QACxB,eAAe,EAAE,kCAAkC;QACnD,aAAa,EAAE,WAAW;QAC1B,gBAAgB,EAAE,wDAAwD;QAC1E,eAAe,EAAE,sCAAsC;QACvD,cAAc,EAAE,4BAA4B;QAC5C,cAAc,EAAE,aAAa;QAC7B,gBAAgB,EAAE,qBAAqB;QACvC,gBAAgB,EAAE,UAAU;QAC5B,eAAe,EAAE,eAAe;QAChC,iBAAiB,EAAE,aAAa;QAChC,gBAAgB,EAAE,aAAa;QAC/B,aAAa,EAAE,YAAY;QAC3B,aAAa,EAAE,uCAAuC;KACvD;IAED,WAAW,EAAE;QACX,OAAO,EAAE,8CAA8C;QACvD,cAAc,EAAE,mBAAmB;QACnC,gBAAgB,EAAE,kBAAkB;QACpC,UAAU,EAAE,eAAe;QAC3B,WAAW,EAAE,SAAS;QACtB,cAAc,EAAE,SAAS;QACzB,cAAc,EAAE,WAAW;QAC3B,eAAe,EAAE,gBAAgB;QACjC,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,wCAAwC;QACpD,WAAW,EAAE,aAAa;QAC1B,UAAU,EAAE,YAAY;KACzB;IAED,cAAc,EAAE,EAAE;IAElB,cAAc,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,0BAA0B,CAAC;IAEtF,gBAAgB,EAAE;QAChB,QAAQ;QACR,YAAY;QACZ,cAAc;QACd,WAAW;QACX,MAAM;QACN,UAAU;QACV,OAAO;QACP,MAAM;QACN,WAAW;QACX,OAAO;QACP,OAAO;QACP,OAAO;QACP,UAAU;QACV,UAAU;KACX;IAED,kBAAkB,EAAE,KAAK;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAoB;IAChD,GAAG,yBAAyB;IAC5B,GAAG,MAAM,CAAC,iBAAiB;CAC5B,CAAC"}

package/dist/http/urlverify/hostname.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Hostname-shape checks, ported from servicefoundry-server's `UrlVerifyService.assertHostnameAllowed`
+ * (PLA-2199): exact-match and suffix-match denylists, plus rejecting single-label hosts, which would
+ * otherwise resolve through the runtime's DNS search path to an in-cluster/in-VPC service. Runs before
+ * any DNS lookup, so it applies to both the proxy and direct-connection paths in `safeFetch`.
+ *
+ * Always classifies — callers (`safeFetch`'s `assertTargetIsPublic`, `guardedLookup`) decide whether
+ * the guard is off, log-only, or blocking via `getSsrfGuardMode()`.
+ */
+export declare function assertHostnameAllowed(hostname: string): void;

package/dist/http/urlverify/hostname.js

@@ -0,0 +1,29 @@
+import { SSRFError } from '../errors.js';
+import { URL_VERIFY_CONFIG } from './config.js';
+const DENY_HOSTS_EXACT = new Set(URL_VERIFY_CONFIG.denyHostsExact.map(host => host.toLowerCase()));
+const DENY_HOST_SUFFIXES = URL_VERIFY_CONFIG.denyHostSuffixes.map(suffix => suffix.toLowerCase());
+/**
+ * Hostname-shape checks, ported from servicefoundry-server's `UrlVerifyService.assertHostnameAllowed`
+ * (PLA-2199): exact-match and suffix-match denylists, plus rejecting single-label hosts, which would
+ * otherwise resolve through the runtime's DNS search path to an in-cluster/in-VPC service. Runs before
+ * any DNS lookup, so it applies to both the proxy and direct-connection paths in `safeFetch`.
+ *
+ * Always classifies — callers (`safeFetch`'s `assertTargetIsPublic`, `guardedLookup`) decide whether
+ * the guard is off, log-only, or blocking via `getSsrfGuardMode()`.
+ */
+export function assertHostnameAllowed(hostname) {
+    const host = hostname.toLowerCase();
+    if (DENY_HOSTS_EXACT.has(host)) {
+        throw new SSRFError(`Blocked: host "${host}" is not allowed`);
+    }
+    // Single-label hosts resolve through the runtime's DNS search path to in-cluster/in-VPC services.
+    if (!host.includes('.')) {
+        throw new SSRFError(`Blocked: host "${host}" must be a fully qualified name`);
+    }
+    for (const suffix of DENY_HOST_SUFFIXES) {
+        if (host.endsWith(suffix)) {
+            throw new SSRFError(`Blocked: host "${host}" is not allowed`);
+        }
+    }
+}
+//# sourceMappingURL=hostname.js.map

package/dist/http/urlverify/hostname.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostname.js","sourceRoot":"","sources":["../../../src/http/urlverify/hostname.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACnG,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AAElG;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CAAC,kBAAkB,IAAI,kBAAkB,CAAC,CAAC;IAChE,CAAC;IACD,kGAAkG;IAClG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,SAAS,CAAC,kBAAkB,IAAI,kCAAkC,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,SAAS,CAAC,kBAAkB,IAAI,kBAAkB,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/http/urlverify/ip.d.ts

@@ -0,0 +1,13 @@
+/**
+ * ================================
+ * Ported verbatim from servicefoundry-server's `src/urlverify/ip.ts` (PLA-2199).
+ * No logic changes — keep this file in sync with the upstream source.
+ * ================================
+ */
+export interface ParsedIp {
+    bytes: number[];
+    version: 4 | 6;
+}
+/** IPv4-mapped IPv6 (::ffff:a.b.c.d) collapses to its IPv4 form so one deny list covers both. */
+export declare function parseIp(value: string): ParsedIp | null;
+export declare function isIpInCidr(bytes: number[], cidr: string): boolean;

package/dist/http/urlverify/ip.js

@@ -0,0 +1,115 @@
+function parseIpv4(value) {
+    const parts = value.split('.');
+    if (parts.length !== 4) {
+        return null;
+    }
+    const bytes = [];
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part)) {
+            return null;
+        }
+        const byte = Number(part);
+        if (byte > 255) {
+            return null;
+        }
+        bytes.push(byte);
+    }
+    return bytes;
+}
+function splitHextets(value) {
+    return value ? value.split(':') : [];
+}
+function parseIpv6(value) {
+    let address = value;
+    const zoneIndex = address.indexOf('%');
+    if (zoneIndex !== -1) {
+        address = address.slice(0, zoneIndex);
+    }
+    if (!address.includes(':')) {
+        return null;
+    }
+    // Rewrite a trailing embedded IPv4 (::ffff:127.0.0.1) into two hextets.
+    const lastColon = address.lastIndexOf(':');
+    if (address.slice(lastColon + 1).includes('.')) {
+        const embedded = parseIpv4(address.slice(lastColon + 1));
+        if (!embedded) {
+            return null;
+        }
+        const high = ((embedded[0] << 8) | embedded[1]).toString(16);
+        const low = ((embedded[2] << 8) | embedded[3]).toString(16);
+        address = `${address.slice(0, lastColon + 1)}${high}:${low}`;
+    }
+    const halves = address.split('::');
+    if (halves.length > 2) {
+        return null;
+    }
+    const head = splitHextets(halves[0]);
+    const tail = halves.length === 2 ? splitHextets(halves[1]) : null;
+    let groups;
+    if (tail === null) {
+        if (head.length !== 8) {
+            return null;
+        }
+        groups = head;
+    }
+    else {
+        if (head.length + tail.length > 8) {
+            return null;
+        }
+        groups = [...head, ...Array(8 - head.length - tail.length).fill('0'), ...tail];
+    }
+    const bytes = [];
+    for (const group of groups) {
+        if (!/^[0-9a-fA-F]{1,4}$/.test(group)) {
+            return null;
+        }
+        const hextet = parseInt(group, 16);
+        bytes.push((hextet >> 8) & 0xff, hextet & 0xff);
+    }
+    return bytes;
+}
+/** IPv4-mapped IPv6 (::ffff:a.b.c.d) collapses to its IPv4 form so one deny list covers both. */
+export function parseIp(value) {
+    const ipv4 = parseIpv4(value);
+    if (ipv4) {
+        return { bytes: ipv4, version: 4 };
+    }
+    const ipv6 = parseIpv6(value);
+    if (!ipv6) {
+        return null;
+    }
+    const isIpv4Mapped = ipv6.slice(0, 10).every(byte => byte === 0) && ipv6[10] === 0xff && ipv6[11] === 0xff;
+    if (isIpv4Mapped) {
+        return { bytes: ipv6.slice(12), version: 4 };
+    }
+    return { bytes: ipv6, version: 6 };
+}
+export function isIpInCidr(bytes, cidr) {
+    const slashIndex = cidr.lastIndexOf('/');
+    if (slashIndex === -1) {
+        return false;
+    }
+    const prefixText = cidr.slice(slashIndex + 1);
+    if (!/^\d{1,3}$/.test(prefixText)) {
+        return false;
+    }
+    const prefixLength = Number(prefixText);
+    const network = parseIp(cidr.slice(0, slashIndex));
+    if (!network || network.bytes.length !== bytes.length) {
+        return false;
+    }
+    if (prefixLength > bytes.length * 8) {
+        return false;
+    }
+    let remainingBits = prefixLength;
+    for (let index = 0; index < bytes.length && remainingBits > 0; index++) {
+        const bitsInByte = Math.min(8, remainingBits);
+        const mask = (0xff << (8 - bitsInByte)) & 0xff;
+        if ((bytes[index] & mask) !== (network.bytes[index] & mask)) {
+            return false;
+        }
+        remainingBits -= bitsInByte;
+    }
+    return true;
+}
+//# sourceMappingURL=ip.js.map

package/dist/http/urlverify/ip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip.js","sourceRoot":"","sources":["../../../src/http/urlverify/ip.ts"],"names":[],"mappings":"AAWA,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wEAAwE;IACxE,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5D,OAAO,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAElE,IAAI,MAAgB,CAAC;IACrB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAS,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC;IAC3G,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAe,EAAE,IAAY;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,YAAY,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,aAAa,GAAG,YAAY,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,aAAa,IAAI,UAAU,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/http/urlverify/mode.d.ts

@@ -0,0 +1,20 @@
+/**
+ * How safeFetch's SSRF guard behaves for a request classified as internal/disallowed.
+ *
+ * - `off`: no IP/hostname classification runs at all.
+ * - `monitor`: classification runs, but a violation is only logged, not blocked.
+ * - `enforce`: classification runs and a violation throws `SSRFError`. Takes precedence over
+ *   `monitor` if both flags are set.
+ *
+ * Redirects are followed in every mode; `monitor` and `enforce` additionally classify each hop.
+ */
+export type SsrfGuardMode = 'off' | 'monitor' | 'enforce';
+export declare function getSsrfGuardMode(): SsrfGuardMode;
+/**
+ * Logs a violation caught in `monitor` mode — the request is allowed to proceed regardless.
+ *
+ * Tenant comes from {@link getSdkRequestTenantName} (entered via `safeFetch`'s
+ * `tenantName` init, or P7 `execute` from `SessionContext`). Best-effort: omitted
+ * when the call is outside that store.
+ */
+export declare function logSsrfViolation(context: Record<string, unknown>, error: unknown): void;

package/dist/http/urlverify/mode.js

@@ -0,0 +1,22 @@
+import config from '../../config.js';
+import { logger } from '../../logger.js';
+import { getSdkRequestTenantName } from '../../requestContext.js';
+export function getSsrfGuardMode() {
+    if (config.ENFORCE_SSRF)
+        return 'enforce';
+    if (config.ENABLE_SSRF)
+        return 'monitor';
+    return 'off';
+}
+/**
+ * Logs a violation caught in `monitor` mode — the request is allowed to proceed regardless.
+ *
+ * Tenant comes from {@link getSdkRequestTenantName} (entered via `safeFetch`'s
+ * `tenantName` init, or P7 `execute` from `SessionContext`). Best-effort: omitted
+ * when the call is outside that store.
+ */
+export function logSsrfViolation(context, error) {
+    const tenant = getSdkRequestTenantName();
+    logger.warn('SSRF Guard Violation', { ...context, ...(tenant ? { tenant } : {}), error });
+}
+//# sourceMappingURL=mode.js.map

package/dist/http/urlverify/mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode.js","sourceRoot":"","sources":["../../../src/http/urlverify/mode.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,cAAc,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAc/D,MAAM,UAAU,gBAAgB;IAC9B,IAAI,MAAM,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,MAAM,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgC,EAAE,KAAc;IAC/E,MAAM,MAAM,GAAG,uBAAuB,EAAE,CAAC;IACzC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5F,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * 0.x public surface for @truefoundry/ai-gateway-sdk (P8.1).
+ * Internal modules (providers, bridges, transforms, stream pumps internals) are not exported.
+ */
+export { initAdapters } from './adapters/index.js';
+export type { ContentItem, ExtractedMessages, GuardrailHelpers, GuardrailsRunConfig, GuardrailsScope, HookEventType, MessageLocation, } from './adapters/index.js';
+export { transformCapturedProviderResponse, type CapturedProviderResponse, type TransformCapturedProviderResponseInput, type TransformedClientResponse, } from './parity/transformCapturedProviderResponse.js';
+export { getSdkRequestTenantName, runWithSdkRequestContext } from './requestContext.js';
+export { LlmGatewaySdk } from './sdk.js';
+export { getStreamModeSplitPattern, pumpProviderAwsEventStream, pumpProviderSseStream, readSseFrames, shouldReadAwsEventStream, } from './stream/index.js';
+export type { GetStreamModeSplitPatternInput, PumpProviderAwsEventStreamOptions, PumpProviderBaseOptions, PumpProviderSseOptions, PumpResult, ReadSseFramesOptions, ReadSseFramesResult, ShouldReadAwsEventStreamInput, SplitPattern, SseCommentMode, StreamTransformFn, } from './stream/index.js';
+export type { CachePort } from './types/cache.js';
+export type { BilledUsageOverlay, EndReason, Endpoint, ExecutionFinishReason, ExecutionModelMetadata, ExecutionReport, ExecutionTimings, ExecutionToolUsage, MidStreamError, MidStreamErrorKind, MidStreamProviderErrorToken, ProviderCallConfig, ProviderOptions, SdkCallInputs, SdkExecuteResult, SdkExecutionConfig, SdkInitConfig, SdkRequest, SdkRequestBody, SessionContext, TokenUsage, TokenUsageIteration, } from './types/contracts.js';
+export type { AnthropicServerToolColumn, AnthropicServerToolMapping, BetaColumn, CatalogProviderConfig, CatalogProviderConfigs, ModelConfigMap, ProviderModelConfigs, } from './types/modelConfig.js';
+export type { AnthropicOptions, AwsOptions, AwsSagemakerOptions, AzureAiInferenceOptions, AzureOptions, CommonHeaderOptions, FireworksAiOptions, HuggingFaceOptions, MistralOptions, OpenAIOptions, ProviderHeaderOptions, SnowflakeCortexOptions, StabilityAiOptions, VertexOptions, WorkersAiOptions, } from './types/options.js';
+export { deriveProviderHeaderOptions } from './utils/deriveProviderHeaderOptions.js';

package/dist/index.js

@@ -0,0 +1,11 @@
+/**
+ * 0.x public surface for @truefoundry/ai-gateway-sdk (P8.1).
+ * Internal modules (providers, bridges, transforms, stream pumps internals) are not exported.
+ */
+export { initAdapters } from './adapters/index.js';
+export { transformCapturedProviderResponse, } from './parity/transformCapturedProviderResponse.js';
+export { getSdkRequestTenantName, runWithSdkRequestContext } from './requestContext.js';
+export { LlmGatewaySdk } from './sdk.js';
+export { getStreamModeSplitPattern, pumpProviderAwsEventStream, pumpProviderSseStream, readSseFrames, shouldReadAwsEventStream, } from './stream/index.js';
+export { deriveProviderHeaderOptions } from './utils/deriveProviderHeaderOptions.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAU1C,OAAO,EACL,iCAAiC,GAIlC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,aAAa,EACb,wBAAwB,GACzB,MAAM,UAAU,CAAC;AAiElB,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC"}

package/dist/loadbalancer_utils.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Phase 1 type-only LoadBalanceTargetType for originPinning.
+ * Full load-balancer logic stays in the gateway.
+ */
+import type { ComplexityBasedLoadBalanceTarget, LatencyBasedLoadBalanceTarget, LoadBalanceTarget, PriorityBasedLoadBalanceTarget } from './autogen/models.js';
+export type LoadBalanceTargetType = LoadBalanceTarget | LatencyBasedLoadBalanceTarget | PriorityBasedLoadBalanceTarget | ComplexityBasedLoadBalanceTarget;

package/dist/loadbalancer_utils.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=loadbalancer_utils.js.map

package/dist/loadbalancer_utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadbalancer_utils.js","sourceRoot":"","sources":["../src/loadbalancer_utils.ts"],"names":[],"mappings":""}