@zhixuan92/multi-model-agent-core 3.11.1 → 3.12.0

package/dist/research/adapters/arxiv.d.ts

@@ -0,0 +1,6 @@
+import type { AdapterResult } from './types.js';
+export interface ArxivOpts {
+    maxResults?: number;
+}
+export declare function arxivSearch(query: string, opts?: ArxivOpts): Promise<AdapterResult[]>;
+//# sourceMappingURL=arxiv.d.ts.map

package/dist/research/adapters/arxiv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arxiv.d.ts","sourceRoot":"","sources":["../../../src/research/adapters/arxiv.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIhD,MAAM,WAAW,SAAS;IAAG,UAAU,CAAC,EAAE,MAAM,CAAC;CAAE;AAEnD,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,SAAc,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAgC/F"}

package/dist/research/adapters/arxiv.js

@@ -0,0 +1,36 @@
+import { request } from 'undici';
+import { XMLParser } from 'fast-xml-parser';
+const parser = new XMLParser({ ignoreAttributes: false, attributeNamePrefix: '@_' });
+export async function arxivSearch(query, opts = {}) {
+    const max = Math.min(25, Math.max(1, opts.maxResults ?? 10));
+    const url = new URL('https://export.arxiv.org/api/query');
+    url.searchParams.set('search_query', `all:${query}`);
+    url.searchParams.set('max_results', String(max));
+    const res = await request(url.toString(), { method: 'GET' });
+    if (res.statusCode >= 300 && res.statusCode < 400) {
+        throw new Error('adapter_unexpected_redirect: arxiv');
+    }
+    if (res.statusCode !== 200) {
+        throw new Error(`arxiv_http_${res.statusCode}`);
+    }
+    const xml = await res.body.text();
+    const parsed = parser.parse(xml);
+    const entriesRaw = parsed.feed?.entry;
+    const entries = Array.isArray(entriesRaw) ? entriesRaw : entriesRaw ? [entriesRaw] : [];
+    return entries.slice(0, max).map((e) => {
+        const id = String(e.id ?? '');
+        const m = id.match(/(\d{4}\.\d{4,5})(v\d+)?$/);
+        const rawUrl = id || String(e.link?.['@_href'] ?? '');
+        const url = rawUrl.replace(/^http:\/\//i, 'https://');
+        return {
+            adapterId: 'arxiv',
+            recordId: m?.[1] ?? id,
+            title: String(e.title ?? '').trim(),
+            url,
+            snippet: String(e.summary ?? '').trim().slice(0, 500),
+            publishedAt: String(e.published ?? ''),
+            raw: e,
+        };
+    });
+}
+//# sourceMappingURL=arxiv.js.map

package/dist/research/adapters/arxiv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arxiv.js","sourceRoot":"","sources":["../../../src/research/adapters/arxiv.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAG5C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;AAIrF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa,EAAE,OAAkB,EAAE;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,KAAK,EAAE,CAAC,CAAC;IACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAmC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE;QAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QACtD,OAAO;YACL,SAAS,EAAE,OAAgB;YAC3B,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;YACtB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACnC,GAAG;YACH,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACrD,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;YACtC,GAAG,EAAE,CAAC;SACP,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/research/adapters/generic-rss.d.ts

@@ -0,0 +1,8 @@
+import type { AdapterResult } from './types.js';
+import type { WebFetchResult } from '../web-fetch.js';
+export interface RssOpts {
+    webFetch: (url: string) => Promise<WebFetchResult>;
+    maxResults?: number;
+}
+export declare function rssAdapter(url: string, opts: RssOpts): Promise<AdapterResult[]>;
+//# sourceMappingURL=generic-rss.d.ts.map

package/dist/research/adapters/generic-rss.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic-rss.d.ts","sourceRoot":"","sources":["../../../src/research/adapters/generic-rss.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAItD,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAsBrF"}

package/dist/research/adapters/generic-rss.js

@@ -0,0 +1,26 @@
+import { XMLParser } from 'fast-xml-parser';
+const parser = new XMLParser({ ignoreAttributes: false, attributeNamePrefix: '@_' });
+export async function rssAdapter(url, opts) {
+    const r = await opts.webFetch(url);
+    if (r.status !== 'ok')
+        throw new Error(`rss_fetch_failed:${r.reasonCode}`);
+    if (r.textTruncated)
+        throw new Error('rss_text_truncated_skip');
+    const parsed = parser.parse(r.rawText);
+    const rdfItems = parsed?.['rdf:RDF']?.item ?? parsed?.RDF?.item;
+    const items = parsed?.rss?.channel?.item ?? parsed?.feed?.entry ?? rdfItems ?? [];
+    const arr = Array.isArray(items) ? items : [items];
+    const max = Math.min(50, Math.max(1, opts.maxResults ?? 25));
+    return arr.slice(0, max).map((it) => ({
+        adapterId: 'rss',
+        recordId: String(it.guid?.['#text'] ?? it.guid ??
+            it['rdf:about'] ?? it['@_rdf:about'] ??
+            it.link ?? it.title),
+        title: String(it.title?.['#text'] ?? it.title ?? '').trim(),
+        url: String(it.link?.['@_href'] ?? it.link ?? ''),
+        snippet: String(it.description?.['#text'] ?? it.description ?? it.summary ?? '').replace(/<[^>]+>/g, '').slice(0, 500),
+        publishedAt: String(it.pubDate ?? it.published ?? it['dc:date'] ?? ''),
+        raw: it,
+    }));
+}
+//# sourceMappingURL=generic-rss.js.map

package/dist/research/adapters/generic-rss.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic-rss.js","sourceRoot":"","sources":["../../../src/research/adapters/generic-rss.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAI5C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;AAOrF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,IAAa;IACzD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAQ,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,IAAI,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,QAAQ,IAAI,EAAE,CAAC;IAClF,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAO,EAAE,EAAE,CAAC,CAAC;QACzC,SAAS,EAAE,KAAc;QACzB,QAAQ,EAAE,MAAM,CACd,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI;YAC7B,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC;YACpC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,CACpB;QACD,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC3D,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QACjD,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QACtH,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACtE,GAAG,EAAE,EAAE;KACR,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/research/adapters/github-search.d.ts

@@ -0,0 +1,7 @@
+import type { AdapterResult } from './types.js';
+export interface GitHubOpts {
+    kind: 'repo' | 'code';
+    maxResults?: number;
+}
+export declare function githubSearch(query: string, opts: GitHubOpts): Promise<AdapterResult[]>;
+//# sourceMappingURL=github-search.d.ts.map

package/dist/research/adapters/github-search.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-search.d.ts","sourceRoot":"","sources":["../../../src/research/adapters/github-search.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAAE;AA6B3E,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAsF5F"}

package/dist/research/adapters/github-search.js

@@ -0,0 +1,95 @@
+import { request } from 'undici';
+function isGitHubKind(kind) {
+    return kind === 'repo' || kind === 'code';
+}
+function firstTextMatchFragment(textMatches) {
+    if (!Array.isArray(textMatches))
+        return '';
+    const fragment = textMatches[0]?.fragment;
+    return typeof fragment === 'string' ? fragment : '';
+}
+export async function githubSearch(query, opts) {
+    if (!isGitHubKind(opts.kind))
+        throw new Error('github_invalid_kind');
+    const max = Math.min(25, Math.max(1, opts.maxResults ?? 10));
+    const path = opts.kind === 'repo' ? '/search/repositories' : '/search/code';
+    const url = new URL(`https://api.github.com${path}`);
+    url.searchParams.set('q', query);
+    url.searchParams.set('per_page', String(max));
+    const accept = opts.kind === 'code'
+        ? 'application/vnd.github.v3.text-match+json'
+        : 'application/vnd.github+json';
+    const res = await request(url.toString(), {
+        method: 'GET',
+        headers: { accept, 'user-agent': 'mma-explore' },
+    });
+    if (res.statusCode === 403) {
+        const remaining = res.headers['x-ratelimit-remaining'];
+        if (remaining === '0')
+            throw new Error('github_rate_limited');
+        try {
+            const text = await res.body.text();
+            const body = JSON.parse(text);
+            if (typeof body.message === 'string') {
+                const msg = body.message.toLowerCase();
+                if (msg.includes('rate limit') || msg.includes('abuse')) {
+                    throw new Error('github_rate_limited');
+                }
+            }
+        }
+        catch (err) {
+            if (err instanceof Error && err.message === 'github_rate_limited')
+                throw err;
+        }
+        throw new Error(`github_http_${res.statusCode}`);
+    }
+    if (res.statusCode >= 300 && res.statusCode < 400) {
+        throw new Error('adapter_unexpected_redirect: github_search');
+    }
+    if (res.statusCode !== 200)
+        throw new Error(`github_http_${res.statusCode}`);
+    let body;
+    try {
+        body = await res.body.json();
+    }
+    catch {
+        throw new Error('github_invalid_json');
+    }
+    const items = typeof body === 'object' && body !== null && 'items' in body && Array.isArray(body.items)
+        ? body.items
+        : [];
+    if (opts.kind === 'repo') {
+        return items.slice(0, max).map((raw) => {
+            const item = raw;
+            const recordId = typeof item.full_name === 'string' && item.full_name.length > 0
+                ? item.full_name
+                : String(item.id ?? '');
+            return {
+                adapterId: 'github_search',
+                recordId,
+                title: recordId,
+                url: String(item.html_url ?? item.url ?? ''),
+                snippet: String(item.description ?? '').slice(0, 500),
+                raw: item,
+            };
+        });
+    }
+    return items.slice(0, max).map((raw) => {
+        const item = raw;
+        const repoName = typeof item.repository?.full_name === 'string' ? item.repository.full_name : '';
+        const filePath = typeof item.path === 'string' ? item.path : '';
+        const fallbackId = String(item.url ?? item.html_url ?? '');
+        const recordId = repoName || filePath ? `${repoName}:${filePath}` : fallbackId;
+        const title = repoName || filePath ? `${repoName} — ${filePath}` : fallbackId;
+        const snippet = firstTextMatchFragment(item.text_matches);
+        return {
+            adapterId: 'github_search',
+            recordId,
+            title,
+            url: String(item.html_url ?? item.url ?? ''),
+            snippet: snippet.slice(0, 500),
+            raw: item,
+        };
+    });
+}
+//# sourceMappingURL=github-search.js.map

package/dist/research/adapters/github-search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-search.js","sourceRoot":"","sources":["../../../src/research/adapters/github-search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAsBjC,SAAS,YAAY,CAAC,IAAa;IACjC,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,CAAC;AAC5C,CAAC;AAED,SAAS,sBAAsB,CAAC,WAAoB;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;IAC1C,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,IAAgB;IAChE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAErE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,cAAc,CAAC;IAC5E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;IACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM;QACjC,CAAC,CAAC,2CAA2C;QAC7C,CAAC,CAAC,6BAA6B,CAAC;IAElC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;QACxC,MAAM,EAAE,KAAK;QAEb,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE;KACjD,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACvD,IAAI,SAAS,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC;YACtD,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,KAAK,qBAAqB;gBAAE,MAAM,GAAG,CAAC;QAC/E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAE7E,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACrG,CAAC,CAAC,IAAI,CAAC,KAAK;QACZ,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,EAAE;YAC9C,MAAM,IAAI,GAAG,GAAqB,CAAC;YACnC,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;gBAC9E,CAAC,CAAC,IAAI,CAAC,SAAS;gBAChB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1B,OAAO;gBACL,SAAS,EAAE,eAAwB;gBACnC,QAAQ;gBACR,KAAK,EAAE,QAAQ;gBACf,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;gBAC5C,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACrD,GAAG,EAAE,IAAI;aACV,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,GAAqB,CAAC;QACnC,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,UAAU,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;QAC/E,MAAM,KAAK,GAAG,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,MAAM,QAAQ,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;QAC9E,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC1D,OAAO;YACL,SAAS,EAAE,eAAwB;YACnC,QAAQ;YACR,KAAK;YACL,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;YAC5C,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YAC9B,GAAG,EAAE,IAAI;SACV,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/research/adapters/index.d.ts

@@ -0,0 +1,8 @@
+import type { ResearchConfig } from '../../config/schema.js';
+import type { AdapterId } from './types.js';
+export declare function resolveEnabledAdapters(cfg: ResearchConfig['builtinAdapters']): AdapterId[];
+export { arxivSearch } from './arxiv.js';
+export { semanticScholarSearch } from './semantic-scholar.js';
+export { githubSearch } from './github-search.js';
+export { rssAdapter } from './generic-rss.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/research/adapters/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/research/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,cAAc,CAAC,iBAAiB,CAAC,GAAG,SAAS,EAAE,CAO1F;AAED,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/research/adapters/index.js

@@ -0,0 +1,17 @@
+export function resolveEnabledAdapters(cfg) {
+    const out = [];
+    if (cfg.arxiv)
+        out.push('arxiv');
+    if (cfg.semanticScholar)
+        out.push('semantic_scholar');
+    if (cfg.githubSearch)
+        out.push('github_search');
+    if (cfg.genericRss)
+        out.push('rss');
+    return out;
+}
+export { arxivSearch } from './arxiv.js';
+export { semanticScholarSearch } from './semantic-scholar.js';
+export { githubSearch } from './github-search.js';
+export { rssAdapter } from './generic-rss.js';
+//# sourceMappingURL=index.js.map

package/dist/research/adapters/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/research/adapters/index.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,sBAAsB,CAAC,GAAsC;IAC3E,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,IAAI,GAAG,CAAC,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,eAAe;QAAE,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACtD,IAAI,GAAG,CAAC,YAAY;QAAE,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,GAAG,CAAC,UAAU;QAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/research/adapters/semantic-scholar.d.ts

@@ -0,0 +1,6 @@
+import type { AdapterResult } from './types.js';
+export interface SSOpts {
+    maxResults?: number;
+}
+export declare function semanticScholarSearch(query: string, opts?: SSOpts): Promise<AdapterResult[]>;
+//# sourceMappingURL=semantic-scholar.d.ts.map

package/dist/research/adapters/semantic-scholar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semantic-scholar.d.ts","sourceRoot":"","sources":["../../../src/research/adapters/semantic-scholar.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,WAAW,MAAM;IAAG,UAAU,CAAC,EAAE,MAAM,CAAC;CAAE;AA8BhD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,MAAW,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAiCtG"}

package/dist/research/adapters/semantic-scholar.js

@@ -0,0 +1,54 @@
+import { request } from 'undici';
+function normalizeRecord(r) {
+    const paperId = typeof r.paperId === 'string' && r.paperId.length > 0 ? r.paperId : null;
+    const title = typeof r.title === 'string' ? r.title.trim() : '';
+    if (!paperId || !title)
+        return null;
+    const abstract = typeof r.abstract === 'string' ? r.abstract : '';
+    const apiUrl = typeof r.url === 'string' && r.url.length > 0 ? r.url : null;
+    const year = typeof r.year === 'number' && Number.isFinite(r.year) && r.year > 1900 ? r.year : null;
+    return {
+        adapterId: 'semantic_scholar',
+        recordId: paperId,
+        title,
+        url: apiUrl ?? `https://www.semanticscholar.org/paper/${paperId}`,
+        snippet: abstract.slice(0, 500),
+        publishedAt: year ? `${year}-01-01` : undefined,
+        raw: r,
+    };
+}
+export async function semanticScholarSearch(query, opts = {}) {
+    const max = Math.min(25, Math.max(1, opts.maxResults ?? 10));
+    const url = new URL('https://api.semanticscholar.org/graph/v1/paper/search');
+    url.searchParams.set('query', query);
+    url.searchParams.set('limit', String(max));
+    url.searchParams.set('fields', 'paperId,title,abstract,year,authors,url');
+    let res;
+    try {
+        res = await request(url.toString(), { method: 'GET' });
+    }
+    catch (err) {
+        throw new Error(`semantic_scholar_request_failed: ${err.message}`);
+    }
+    if (res.statusCode === 429)
+        throw new Error('semantic_scholar_rate_limited');
+    if (res.statusCode >= 300 && res.statusCode < 400)
+        throw new Error('adapter_unexpected_redirect: semantic_scholar');
+    if (res.statusCode !== 200)
+        throw new Error(`semantic_scholar_http_${res.statusCode}`);
+    let body;
+    try {
+        body = await res.body.json();
+    }
+    catch (err) {
+        throw new Error(`semantic_scholar_parse_error: ${err.message}`);
+    }
+    const data = Array.isArray(body?.data)
+        ? body.data
+        : [];
+    return data
+        .slice(0, max)
+        .map(normalizeRecord)
+        .filter((r) => r !== null);
+}
+//# sourceMappingURL=semantic-scholar.js.map

package/dist/research/adapters/semantic-scholar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semantic-scholar.js","sourceRoot":"","sources":["../../../src/research/adapters/semantic-scholar.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAajC,SAAS,eAAe,CAAC,CAAY;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAEpG,OAAO;QACL,SAAS,EAAE,kBAA2B;QACtC,QAAQ,EAAE,OAAO;QACjB,KAAK;QACL,GAAG,EAAE,MAAM,IAAI,yCAAyC,OAAO,EAAE;QACjE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QAC/B,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,SAAS;QAC/C,GAAG,EAAE,CAAC;KACP,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa,EAAE,OAAe,EAAE;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,uDAAuD,CAAC,CAAC;IAC7E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,yCAAyC,CAAC,CAAC;IAE1E,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oCAAqC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC7E,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACpH,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAEvF,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAE,IAAgC,EAAE,IAAI,CAAC;QACjE,CAAC,CAAE,IAAgC,CAAC,IAAmB;QACvD,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO,IAAI;SACR,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACb,GAAG,CAAC,eAAe,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAsB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AACnD,CAAC"}

package/dist/research/adapters/types.d.ts

@@ -0,0 +1,15 @@
+export type AdapterId = 'arxiv' | 'semantic_scholar' | 'github_search' | 'rss';
+export interface AdapterResult {
+    adapterId: AdapterId;
+    recordId: string;
+    title: string;
+    url: string;
+    snippet: string;
+    publishedAt?: string;
+    raw: unknown;
+}
+export interface AdapterCallContext {
+    abortSignal: AbortSignal;
+    hostAllowlist?: ReadonlySet<string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/research/adapters/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/research/adapters/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,kBAAkB,GAAG,eAAe,GAAG,KAAK,CAAC;AAE/E,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,OAAO,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,WAAW,CAAC;IAEzB,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACrC"}

package/dist/research/adapters/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/research/adapters/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/research/adapters/types.ts"],"names":[],"mappings":""}

package/dist/research/allowlist.d.ts

@@ -0,0 +1,25 @@
+export declare function extractURLHosts(strings: readonly string[]): string[];
+export interface AllowlistInput {
+    fetchAllowlistExtra: readonly string[];
+    userSources: readonly string[];
+}
+export type AllowlistProvenance = 'extra' | 'user_source';
+export type HostAllowlist = ReadonlyMap<string, AllowlistProvenance>;
+/**
+ * Build the per-task fetch allowlist as a provenance-aware map. Per spec
+ * §6.2 / §7.1 step 8, the private-network opt-in is gated on
+ * `provenance === 'extra'` — only operator-declared hosts in
+ * `fetchAllowlistExtra` are eligible, never hosts harvested from
+ * `userSources`. Build order: userSources first (lower precedence), then
+ * fetchAllowlistExtra overwrites — so collisions resolve to the operator's
+ * deliberate intent.
+ *
+ * Both sources are validated through canonicalizeHostname; invalid entries
+ * (IP literals, single-label names, malformed hostnames, overlong hosts)
+ * are silently skipped. This mirrors ResearchConfigSchema's HostString
+ * canonicalization as defense-in-depth for callers that have not parsed
+ * configuration first; silent skipping preserves URL-extraction behavior
+ * for untrusted userSources while keeping this builder non-throwing.
+ */
+export declare function buildHostAllowlist(input: AllowlistInput): HostAllowlist;
+//# sourceMappingURL=allowlist.d.ts.map

package/dist/research/allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.d.ts","sourceRoot":"","sources":["../../src/research/allowlist.ts"],"names":[],"mappings":"AAyCA,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAsBpE;AAED,MAAM,WAAW,cAAc;IAC7B,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,aAAa,CAAC;AAC1D,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;AAErE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,CAYvE"}

package/dist/research/allowlist.js

@@ -0,0 +1,102 @@
+import { isIP } from 'node:net';
+const URL_REGEX = /\bhttps?:\/\/[^\s'"<>()]+/gi;
+const FORBIDDEN_HOST_CHARS = /[\/:@?#]|:\/\//;
+const MAX_HOSTNAME_LENGTH = 253;
+const TRAILING_URL_PUNCTUATION = /[.,;:!?]+$/;
+/**
+ * Validate and canonicalize a hostname string. Returns the canonical
+ * (lowercase, IDNA-encoded) form or null if the input is not a valid
+ * DNS FQDN. Mirrors the HostString rules in config/schema.ts as a
+ * defense-in-depth layer: even though ResearchConfigSchema already
+ * validates fetchAllowlistExtra via HostString, this function ensures
+ * that any caller of buildHostAllowlist — including callers that bypass
+ * schema parsing — cannot inject non-FQDN entries with "extra" provenance.
+ */
+function canonicalizeHostname(raw) {
+    const trimmed = raw.trim();
+    if (trimmed.length === 0 || trimmed.length > MAX_HOSTNAME_LENGTH)
+        return null;
+    if (FORBIDDEN_HOST_CHARS.test(trimmed))
+        return null;
+    // Strip trailing dot (DNS root label) — example.com. ≡ example.com
+    const stripped = trimmed.endsWith('.') ? trimmed.slice(0, -1) : trimmed;
+    if (stripped.length === 0 || stripped.length > MAX_HOSTNAME_LENGTH)
+        return null;
+    let canonical;
+    try {
+        canonical = new URL(`https://${stripped}`).hostname;
+    }
+    catch {
+        return null;
+    }
+    if (canonical.length === 0 || canonical.length > MAX_HOSTNAME_LENGTH)
+        return null;
+    if (isIP(canonical) !== 0)
+        return null;
+    const labels = canonical.split('.');
+    if (labels.length < 2)
+        return null;
+    for (const label of labels) {
+        if (label.length === 0 || label.length > 63)
+            return null;
+        if (label.startsWith('-') || label.endsWith('-'))
+            return null;
+    }
+    return canonical;
+}
+export function extractURLHosts(strings) {
+    const out = [];
+    const seen = new Set();
+    for (const s of strings) {
+        const matches = s.match(URL_REGEX) ?? [];
+        for (const m of matches) {
+            try {
+                const candidate = m.replace(TRAILING_URL_PUNCTUATION, '');
+                const u = new URL(candidate);
+                if (!u.hostname)
+                    continue;
+                const canonical = canonicalizeHostname(u.hostname);
+                if (canonical === null)
+                    continue;
+                if (!seen.has(canonical)) {
+                    seen.add(canonical);
+                    out.push(canonical);
+                }
+            }
+            catch {
+                // malformed URL — silently skip
+            }
+        }
+    }
+    return out;
+}
+/**
+ * Build the per-task fetch allowlist as a provenance-aware map. Per spec
+ * §6.2 / §7.1 step 8, the private-network opt-in is gated on
+ * `provenance === 'extra'` — only operator-declared hosts in
+ * `fetchAllowlistExtra` are eligible, never hosts harvested from
+ * `userSources`. Build order: userSources first (lower precedence), then
+ * fetchAllowlistExtra overwrites — so collisions resolve to the operator's
+ * deliberate intent.
+ *
+ * Both sources are validated through canonicalizeHostname; invalid entries
+ * (IP literals, single-label names, malformed hostnames, overlong hosts)
+ * are silently skipped. This mirrors ResearchConfigSchema's HostString
+ * canonicalization as defense-in-depth for callers that have not parsed
+ * configuration first; silent skipping preserves URL-extraction behavior
+ * for untrusted userSources while keeping this builder non-throwing.
+ */
+export function buildHostAllowlist(input) {
+    const map = new Map();
+    for (const h of extractURLHosts(input.userSources)) {
+        map.set(h, 'user_source');
+    }
+    for (const h of input.fetchAllowlistExtra) {
+        const canonical = canonicalizeHostname(h);
+        if (canonical !== null) {
+            map.set(canonical, 'extra');
+        }
+    }
+    return map;
+}
+//# sourceMappingURL=allowlist.js.map

package/dist/research/allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.js","sourceRoot":"","sources":["../../src/research/allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,MAAM,SAAS,GAAG,6BAA6B,CAAC;AAEhD,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAC9C,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,wBAAwB,GAAG,YAAY,CAAC;AAE9C;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAC9E,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,mEAAmE;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAClF,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACzD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAA0B;IACxD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;gBAC1D,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC7B,IAAI,CAAC,CAAC,CAAC,QAAQ;oBAAE,SAAS;gBAC1B,MAAM,SAAS,GAAG,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,SAAS,KAAK,IAAI;oBAAE,SAAS;gBACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBACpB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAUD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAqB;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA+B,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC5B,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/research/ssrf-guard.d.ts

@@ -0,0 +1,12 @@
+export type IPClass = 'public' | 'loopback' | 'private' | 'link-local-or-metadata' | 'unspecified' | 'multicast' | 'broadcast-or-reserved';
+export declare class SsrfBlocked extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare function classifyIP(ip: string): IPClass;
+export interface ResolveOptions {
+    resolve?: (host: string) => Promise<string[]>;
+    allowPrivateForHost: boolean;
+}
+export declare function resolveAndPin(host: string, options: ResolveOptions): Promise<string>;
+//# sourceMappingURL=ssrf-guard.d.ts.map

package/dist/research/ssrf-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-guard.d.ts","sourceRoot":"","sources":["../../src/research/ssrf-guard.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,OAAO,GACf,QAAQ,GACR,UAAU,GACV,SAAS,GACT,wBAAwB,GACxB,aAAa,GACb,WAAW,GACX,uBAAuB,CAAC;AAE5B,qBAAa,WAAY,SAAQ,KAAK;aACR,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAI1D;AA8DD,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAyD9C;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9C,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AA+CD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,MAAM,CAAC,CAyCjB"}