comfyui-mcp 0.6.1 → 0.7.0

package/dist/experimental/agent-poc.js

@@ -0,0 +1,210 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { logger } from "../utils/logger.js";
+import { handleChatRequest } from "./chat-handler.js";
+import { startQuickTunnel } from "../services/tunnel.js";
+const DEFAULT_PORT = 8765;
+const DEFAULT_HOST = "127.0.0.1";
+const DEFAULT_MAX_BODY_BYTES = 1024 * 1024; // 1 MiB
+class PayloadTooLargeError extends Error {
+    limit;
+    constructor(limit) {
+        super(`Request body exceeds the ${limit}-byte limit`);
+        this.limit = limit;
+        this.name = "PayloadTooLargeError";
+    }
+}
+/** Convert a Node IncomingMessage into a Fetch-style Request (body size-capped). */
+async function toFetchRequest(req, ctx) {
+    const url = `http://${ctx.host}:${ctx.port}${req.url ?? "/"}`;
+    const method = req.method ?? "GET";
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(req.headers)) {
+        if (value === undefined)
+            continue;
+        if (Array.isArray(value)) {
+            for (const v of value)
+                headers.append(key, v);
+        }
+        else {
+            headers.set(key, value);
+        }
+    }
+    const hasBody = method !== "GET" && method !== "HEAD";
+    let body;
+    if (hasBody) {
+        const chunks = [];
+        let total = 0;
+        for await (const chunk of req) {
+            const buf = chunk;
+            total += buf.length;
+            // Cap the body while reading so a huge/chunked POST can't exhaust memory
+            // before JSON parsing (the server may be exposed via the tunnel).
+            if (total > ctx.maxBodyBytes) {
+                throw new PayloadTooLargeError(ctx.maxBodyBytes);
+            }
+            chunks.push(buf);
+        }
+        body = Buffer.concat(chunks).toString("utf-8");
+    }
+    return new Request(url, { method, headers, body });
+}
+/** Pipe a Fetch-style Response into a Node ServerResponse. */
+async function sendFetchResponse(res, response) {
+    const headers = {};
+    response.headers.forEach((value, key) => {
+        headers[key] = value;
+    });
+    res.writeHead(response.status, headers);
+    if (response.body) {
+        // response.body is a web ReadableStream; bridge it to the Node response.
+        // Await pipeline so downstream/stream errors (e.g. client disconnect mid-
+        // stream) reject here instead of surfacing as an unhandled 'error' event.
+        const source = Readable.fromWeb(response.body);
+        await pipeline(source, res);
+    }
+    else {
+        res.end(await response.text());
+    }
+}
+/** Constant-time `Authorization: Bearer <token>` check. */
+function isAuthorized(req, token) {
+    const header = req.headers["authorization"];
+    const value = Array.isArray(header) ? header[0] : header;
+    if (!value)
+        return false;
+    const m = /^Bearer\s+(.+)$/i.exec(value.trim());
+    if (!m)
+        return false;
+    const provided = Buffer.from(m[1].trim());
+    const expected = Buffer.from(token);
+    return (provided.length === expected.length && timingSafeEqual(provided, expected));
+}
+/**
+ * Start the experimental agent POC HTTP server (and optional tunnel).
+ * Returns a handle (incl. the bearer token). Callers gate this behind the env flag.
+ */
+export async function startAgentPoc(options = {}) {
+    const envPort = process.env.COMFYUI_MCP_AGENT_PORT
+        ? Number(process.env.COMFYUI_MCP_AGENT_PORT)
+        : undefined;
+    const requestedPort = options.port ?? (envPort && !Number.isNaN(envPort) ? envPort : DEFAULT_PORT);
+    const host = options.host ?? DEFAULT_HOST;
+    const token = options.token ??
+        process.env.COMFYUI_MCP_AGENT_TOKEN ??
+        randomBytes(24).toString("hex");
+    const ctx = {
+        host,
+        port: requestedPort,
+        token,
+        maxBodyBytes: options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES,
+    };
+    const server = createServer((req, res) => {
+        void handleRequest(req, res, ctx);
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(requestedPort, host, () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+    const address = server.address();
+    const port = typeof address === "object" && address ? address.port : requestedPort;
+    ctx.port = port;
+    const localUrl = `http://${host}:${port}`;
+    logger.info(`[agent-poc] chat server listening on ${localUrl}/api/chat`);
+    logger.info(`[agent-poc] session token (send as 'Authorization: Bearer <token>'): ${token}`);
+    let tunnel = null;
+    if (options.tunnel) {
+        try {
+            tunnel = await startQuickTunnel(port);
+            logger.info(`[agent-poc] public URL: ${tunnel.url}`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            logger.error(`[agent-poc] failed to open tunnel: ${message}`);
+        }
+    }
+    return {
+        localUrl,
+        publicUrl: tunnel?.url ?? null,
+        token,
+        stop: async () => {
+            tunnel?.stop();
+            await new Promise((resolve) => server.close(() => resolve()));
+        },
+    };
+}
+async function handleRequest(req, res, ctx) {
+    // CORS: the tunnel + bearer token are the perimeter. `*` is safe here because
+    // requests are non-credentialed and must carry the Authorization header below.
+    res.setHeader("Access-Control-Allow-Origin", "*");
+    res.setHeader("Access-Control-Allow-Headers", "authorization, content-type");
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+    if (req.method === "OPTIONS") {
+        res.writeHead(204);
+        res.end();
+        return;
+    }
+    // Health probe stays open (no secret, no provider spend).
+    if (req.method === "GET" && req.url === "/health") {
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify({ status: "ok" }));
+        return;
+    }
+    // Everything past here requires the bearer token.
+    if (!isAuthorized(req, ctx.token)) {
+        res.writeHead(401, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: "Unauthorized" }));
+        return;
+    }
+    if (req.method === "POST" && req.url === "/api/chat") {
+        const contentType = req.headers["content-type"] ?? "";
+        if (!contentType.includes("application/json")) {
+            res.writeHead(415, { "content-type": "application/json" });
+            res.end(JSON.stringify({ error: "Expected content-type: application/json" }));
+            return;
+        }
+        try {
+            const request = await toFetchRequest(req, ctx);
+            const response = await handleChatRequest(request);
+            await sendFetchResponse(res, response);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            logger.error(`[agent-poc] /api/chat error: ${message}`);
+            if (res.headersSent) {
+                // Streaming already started — destroy the socket rather than corrupt
+                // the stream protocol by appending a JSON error body to it.
+                res.destroy(err instanceof Error ? err : new Error(message));
+            }
+            else if (err instanceof PayloadTooLargeError) {
+                res.writeHead(413, { "content-type": "application/json" });
+                res.end(JSON.stringify({ error: message }));
+            }
+            else {
+                res.writeHead(500, { "content-type": "application/json" });
+                res.end(JSON.stringify({ error: message }));
+            }
+        }
+        return;
+    }
+    res.writeHead(404, { "content-type": "application/json" });
+    res.end(JSON.stringify({ error: "Not found" }));
+}
+/**
+ * Gated bootstrap. Only starts the POC when COMFYUI_MCP_AGENT_POC is truthy.
+ * Safe to call unconditionally from a side entry; a no-op otherwise.
+ */
+export async function maybeStartAgentPoc() {
+    if (!process.env.COMFYUI_MCP_AGENT_POC) {
+        return null;
+    }
+    return startAgentPoc({
+        tunnel: process.env.COMFYUI_MCP_AGENT_TUNNEL === "1",
+    });
+}
+//# sourceMappingURL=agent-poc.js.map

package/dist/experimental/agent-poc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-poc.js","sourceRoot":"","sources":["../../src/experimental/agent-poc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAoB,MAAM,uBAAuB,CAAC;AAwC3E,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,YAAY,GAAG,WAAW,CAAC;AACjC,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;AAEpD,MAAM,oBAAqB,SAAQ,KAAK;IACV;IAA5B,YAA4B,KAAa;QACvC,KAAK,CAAC,4BAA4B,KAAK,aAAa,CAAC,CAAC;QAD5B,UAAK,GAAL,KAAK,CAAQ;QAEvC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AASD,oFAAoF;AACpF,KAAK,UAAU,cAAc,CAC3B,GAAoB,EACpB,GAAmB;IAEnB,MAAM,GAAG,GAAG,UAAU,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IAEnC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;IACtD,IAAI,IAAwB,CAAC;IAC7B,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,KAAe,CAAC;YAC5B,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC;YACpB,yEAAyE;YACzE,kEAAkE;YAClE,IAAI,KAAK,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;gBAC7B,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,8DAA8D;AAC9D,KAAK,UAAU,iBAAiB,CAC9B,GAAmB,EACnB,QAAkB;IAElB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAExC,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClB,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAC7B,QAAQ,CAAC,IAA8C,CACxD,CAAC;QACF,MAAM,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,SAAS,YAAY,CAAC,GAAoB,EAAE,KAAa;IACvD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,CACL,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAA2B,EAAE;IAE7B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAChD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;QAC5C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GACjB,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC;IAC1C,MAAM,KAAK,GACT,OAAO,CAAC,KAAK;QACb,OAAO,CAAC,GAAG,CAAC,uBAAuB;QACnC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,GAAG,GAAmB;QAC1B,IAAI;QACJ,IAAI,EAAE,aAAa;QACnB,KAAK;QACL,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,sBAAsB;KAC7D,CAAC;IAEF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,KAAK,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE;YACtC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;IACnF,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAChB,MAAM,QAAQ,GAAG,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;IAC1C,MAAM,CAAC,IAAI,CAAC,wCAAwC,QAAQ,WAAW,CAAC,CAAC;IACzE,MAAM,CAAC,IAAI,CACT,wEAAwE,KAAK,EAAE,CAChF,CAAC;IAEF,IAAI,MAAM,GAAuB,IAAI,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,2BAA2B,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,CAAC,KAAK,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI;QAC9B,KAAK;QACL,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAoB,EACpB,GAAmB,EACnB,GAAmB;IAEnB,8EAA8E;IAC9E,+EAA+E;IAC/E,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAC;IAC7E,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;IAEpE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IAED,0DAA0D;IAC1D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IAED,kDAAkD;IAClD,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QACrD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACtD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CACrE,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,CAAC,KAAK,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAC;YACxD,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACpB,qEAAqE;gBACrE,4DAA4D;gBAC5D,GAAG,CAAC,OAAO,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/D,CAAC;iBAAM,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;gBAC/C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QACD,OAAO;IACT,CAAC;IAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,aAAa,CAAC;QACnB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,GAAG;KACrD,CAAC,CAAC;AACL,CAAC"}

package/dist/experimental/chat-handler.d.ts

@@ -0,0 +1,34 @@
+import { type LanguageModel } from "ai";
+/**
+ * The single server-side tool for the POC. Has an `execute` so the AI SDK runs
+ * it on the server and feeds the result back into the model automatically.
+ */
+export declare const tools: {
+    generate_image: import("ai").Tool<{
+        prompt: string;
+        width?: number | undefined;
+        height?: number | undefined;
+    }, {
+        status: string;
+        prompt: string;
+        width: number;
+        height: number;
+        imageUrl: string;
+        note: string;
+    }>;
+};
+export interface ChatHandlerOptions {
+    /** Override the model (mainly for tests). Defaults to the provider registry. */
+    model?: LanguageModel;
+    /** Optional `provider:model` id forwarded to the registry. */
+    modelId?: string;
+    /** System prompt for the agent. */
+    system?: string;
+}
+/**
+ * Handle a chat request. Accepts a Fetch-style `Request` whose JSON body is
+ * `{ messages: UIMessage[], model?: string }` and returns a streaming
+ * `Response` (UI message stream protocol).
+ */
+export declare function handleChatRequest(req: Request, options?: ChatHandlerOptions): Promise<Response>;
+//# sourceMappingURL=chat-handler.d.ts.map

package/dist/experimental/chat-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-handler.d.ts","sourceRoot":"","sources":["../../src/experimental/chat-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,aAAa,EAGnB,MAAM,IAAI,CAAC;AAiBZ;;;GAGG;AACH,eAAO,MAAM,KAAK;;;;;;;;;;;;;CAsBC,CAAC;AAEpB,MAAM,WAAW,kBAAkB;IACjC,gFAAgF;IAChF,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAKD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,QAAQ,CAAC,CAkBnB"}

package/dist/experimental/chat-handler.js

@@ -0,0 +1,60 @@
+import { convertToModelMessages, stepCountIs, streamText, tool, } from "ai";
+import { z } from "zod";
+import { resolveModel } from "./provider-registry.js";
+// ---------------------------------------------------------------------------
+// Experimental AI SDK chat handler for the embedded-agent-panel POC.
+//
+// `POST /api/chat` -> streamText({ model, messages, tools }).toUIMessageStreamResponse()
+//
+// Includes ONE server-side tool end-to-end (`generate_image`) which, for the
+// POC, returns a stub result. Wiring the real comfyui-mcp generate tools is a
+// later phase (see design/embedded-agent-panel.md, build order step 5).
+//
+// This module is only reached behind COMFYUI_MCP_AGENT_POC.
+// ---------------------------------------------------------------------------
+/**
+ * The single server-side tool for the POC. Has an `execute` so the AI SDK runs
+ * it on the server and feeds the result back into the model automatically.
+ */
+export const tools = {
+    generate_image: tool({
+        description: "Generate an image from a text prompt using ComfyUI. (POC stub — returns a placeholder result instead of running a real workflow.)",
+        inputSchema: z.object({
+            prompt: z.string().describe("The text prompt to generate an image from."),
+            width: z.number().int().positive().optional().describe("Image width in pixels."),
+            height: z.number().int().positive().optional().describe("Image height in pixels."),
+        }),
+        execute: async ({ prompt, width, height }) => {
+            // POC stub: real implementation will enqueue a ComfyUI workflow and
+            // return the resulting asset id / image URL.
+            return {
+                status: "stubbed",
+                prompt,
+                width: width ?? 1024,
+                height: height ?? 1024,
+                imageUrl: "https://example.invalid/poc-placeholder.png",
+                note: "Placeholder result from the POC. No real workflow was executed.",
+            };
+        },
+    }),
+};
+const DEFAULT_SYSTEM = "You are an assistant embedded in ComfyUI. You can generate images with the generate_image tool.";
+/**
+ * Handle a chat request. Accepts a Fetch-style `Request` whose JSON body is
+ * `{ messages: UIMessage[], model?: string }` and returns a streaming
+ * `Response` (UI message stream protocol).
+ */
+export async function handleChatRequest(req, options = {}) {
+    const body = (await req.json());
+    const messages = body.messages ?? [];
+    const model = options.model ?? resolveModel(options.modelId ?? body.model);
+    const result = streamText({
+        model,
+        system: options.system ?? DEFAULT_SYSTEM,
+        messages: await convertToModelMessages(messages),
+        tools,
+        stopWhen: stepCountIs(5),
+    });
+    return result.toUIMessageStreamResponse();
+}
+//# sourceMappingURL=chat-handler.js.map

package/dist/experimental/chat-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-handler.js","sourceRoot":"","sources":["../../src/experimental/chat-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,IAAI,GAIL,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,8EAA8E;AAC9E,qEAAqE;AACrE,EAAE;AACF,yFAAyF;AACzF,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,wEAAwE;AACxE,EAAE;AACF,4DAA4D;AAC5D,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,cAAc,EAAE,IAAI,CAAC;QACnB,WAAW,EACT,mIAAmI;QACrI,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;YACzE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YAChF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;SACnF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;YAC3C,oEAAoE;YACpE,6CAA6C;YAC7C,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,MAAM;gBACN,KAAK,EAAE,KAAK,IAAI,IAAI;gBACpB,MAAM,EAAE,MAAM,IAAI,IAAI;gBACtB,QAAQ,EAAE,6CAA6C;gBACvD,IAAI,EAAE,iEAAiE;aACxE,CAAC;QACJ,CAAC;KACF,CAAC;CACe,CAAC;AAWpB,MAAM,cAAc,GAClB,iGAAiG,CAAC;AAEpG;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAY,EACZ,UAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAErC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAG,UAAU,CAAC;QACxB,KAAK;QACL,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,cAAc;QACxC,QAAQ,EAAE,MAAM,sBAAsB,CAAC,QAAQ,CAAC;QAChD,KAAK;QACL,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;KACzB,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,yBAAyB,EAAE,CAAC;AAC5C,CAAC"}

package/dist/experimental/provider-registry.d.ts

@@ -0,0 +1,8 @@
+import type { LanguageModel } from "ai";
+export declare const registry: import("ai").ProviderRegistryProvider<{
+    anthropic: import("@ai-sdk/anthropic").AnthropicProvider;
+    openai: import("@ai-sdk/openai").OpenAIProvider;
+    google: import("@ai-sdk/google").GoogleGenerativeAIProvider;
+}, ":">;
+export declare function resolveModel(id?: string): LanguageModel;
+//# sourceMappingURL=provider-registry.d.ts.map

package/dist/experimental/provider-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-registry.d.ts","sourceRoot":"","sources":["../../src/experimental/provider-registry.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAaxC,eAAO,MAAM,QAAQ;;;;OAInB,CAAC;AAkCH,wBAAgB,YAAY,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,aAAa,CASvD"}

package/dist/experimental/provider-registry.js

@@ -0,0 +1,50 @@
+import { anthropic } from "@ai-sdk/anthropic";
+import { google } from "@ai-sdk/google";
+import { openai } from "@ai-sdk/openai";
+import { createProviderRegistry } from "ai";
+// ---------------------------------------------------------------------------
+// Provider registry for the experimental embedded-agent-panel POC.
+//
+// Picks the language model per request from a single registry, keyed by a
+// `provider:model` string (the AI SDK default separator). Default is Anthropic
+// with the model from COMFYUI_MCP_AGENT_MODEL. Provider API keys are read from
+// the usual env vars by each provider package (ANTHROPIC_API_KEY, etc.).
+//
+// Not part of the default MCP server — only used behind COMFYUI_MCP_AGENT_POC.
+// ---------------------------------------------------------------------------
+export const registry = createProviderRegistry({
+    anthropic,
+    openai,
+    google,
+});
+const DEFAULT_MODEL = "anthropic:claude-sonnet-4-5";
+/**
+ * The set of model ids a request is allowed to select: the server default
+ * (COMFYUI_MCP_AGENT_MODEL or DEFAULT_MODEL) plus any explicitly allow-listed
+ * via COMFYUI_MCP_AGENT_ALLOWED_MODELS (comma-separated `provider:model`).
+ */
+function allowedModels() {
+    const set = new Set([DEFAULT_MODEL]);
+    const envDefault = process.env.COMFYUI_MCP_AGENT_MODEL?.trim();
+    if (envDefault)
+        set.add(envDefault);
+    const extra = process.env.COMFYUI_MCP_AGENT_ALLOWED_MODELS;
+    if (extra) {
+        for (const m of extra.split(",")) {
+            const t = m.trim();
+            if (t)
+                set.add(t);
+        }
+    }
+    return set;
+}
+export function resolveModel(id) {
+    const fallback = process.env.COMFYUI_MCP_AGENT_MODEL?.trim() || DEFAULT_MODEL;
+    // Only honour a client-supplied model id if it is explicitly allow-listed.
+    // Otherwise ignore it and use the server default — this stops a leaked tunnel
+    // URL from letting a caller select arbitrary (expensive) models on your keys.
+    const requested = id?.trim();
+    const modelId = requested && allowedModels().has(requested) ? requested : fallback;
+    return registry.languageModel(modelId);
+}
+//# sourceMappingURL=provider-registry.js.map

package/dist/experimental/provider-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-registry.js","sourceRoot":"","sources":["../../src/experimental/provider-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,IAAI,CAAC;AAG5C,8EAA8E;AAC9E,mEAAmE;AACnE,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,+EAA+E;AAC/E,yEAAyE;AACzE,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAE9E,MAAM,CAAC,MAAM,QAAQ,GAAG,sBAAsB,CAAC;IAC7C,SAAS;IACT,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,6BAA6B,CAAC;AAapD;;;;GAIG;AACH,SAAS,aAAa;IACpB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,aAAa,CAAC,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,UAAU;QAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;IAC3D,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAW;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC;IAC9E,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,SAAS,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;IAC7B,MAAM,OAAO,GACX,SAAS,IAAI,aAAa,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrE,OAAO,QAAQ,CAAC,aAAa,CAAC,OAA0B,CAAC,CAAC;AAC5D,CAAC"}

package/dist/experimental/run.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=run.d.ts.map

package/dist/experimental/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/experimental/run.ts"],"names":[],"mappings":""}

package/dist/experimental/run.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+import { logger } from "../utils/logger.js";
+import { maybeStartAgentPoc } from "./agent-poc.js";
+// ---------------------------------------------------------------------------
+// Standalone runner for the experimental embedded-agent-panel POC.
+//
+// This is intentionally NOT imported by src/index.ts — the default MCP server
+// (stdio / HTTP) never touches the POC. Run it explicitly, e.g.:
+//
+//   COMFYUI_MCP_AGENT_POC=1 ANTHROPIC_API_KEY=... npx tsx src/experimental/run.ts
+//   COMFYUI_MCP_AGENT_POC=1 COMFYUI_MCP_AGENT_TUNNEL=1 ... node dist/experimental/run.js
+// ---------------------------------------------------------------------------
+async function main() {
+    const handle = await maybeStartAgentPoc();
+    if (!handle) {
+        logger.warn("[agent-poc] COMFYUI_MCP_AGENT_POC is not set — nothing to run. Set it to 1 to start the POC.");
+        return;
+    }
+    logger.info(`[agent-poc] ready at ${handle.localUrl}/api/chat`);
+    if (handle.publicUrl) {
+        logger.info(`[agent-poc] public URL: ${handle.publicUrl}`);
+    }
+    const shutdown = () => {
+        logger.info("[agent-poc] shutting down...");
+        void handle.stop().then(() => process.exit(0));
+    };
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+}
+main().catch((err) => {
+    logger.error("[agent-poc] fatal error", err);
+    process.exit(1);
+});
+//# sourceMappingURL=run.js.map

package/dist/experimental/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/experimental/run.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,8EAA8E;AAC9E,mEAAmE;AACnE,EAAE;AACF,8EAA8E;AAC9E,iEAAiE;AACjE,EAAE;AACF,kFAAkF;AAClF,yFAAyF;AACzF,8EAA8E;AAE9E,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CACT,8FAA8F,CAC/F,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,QAAQ,WAAW,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,2BAA2B,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/services/download-auth.d.ts

@@ -0,0 +1,23 @@
+export type DownloadAuth = {
+    type: "bearer";
+    token: string;
+} | {
+    type: "basic";
+    username: string;
+    password: string;
+} | {
+    type: "header";
+    header_name: string;
+    header_value: string;
+} | {
+    type: "query";
+    query_param: string;
+    query_value: string;
+};
+export interface DownloadRequestAuth {
+    url: string;
+    headers: Record<string, string>;
+}
+export declare function redactUrlForLogs(url: string, extraSensitiveParams?: string[]): string;
+export declare function applyDownloadAuth(url: string, auth?: DownloadAuth): DownloadRequestAuth;
+//# sourceMappingURL=download-auth.d.ts.map

package/dist/services/download-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"download-auth.d.ts","sourceRoot":"","sources":["../../src/services/download-auth.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAyCD,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,oBAAoB,GAAE,MAAM,EAAO,GAClC,MAAM,CAaR;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,YAAY,GAClB,mBAAmB,CAgCrB"}

package/dist/services/download-auth.js

@@ -0,0 +1,78 @@
+import { ValidationError } from "../utils/errors.js";
+const TOKEN_QUERY_RE = /token|key|secret|signature|auth|password|credential/i;
+const REDACTED = "[REDACTED]";
+const HEADER_NAME_RE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+const ASCII_CONTROL_RE = /[\x00-\x1F\x7F]/;
+function rejectControlChars(label, value) {
+    if (ASCII_CONTROL_RE.test(value)) {
+        throw new ValidationError(`${label} cannot contain ASCII control characters.`);
+    }
+}
+function validateDownloadAuth(auth) {
+    if (auth.type === "bearer") {
+        rejectControlChars("Bearer token", auth.token);
+        return;
+    }
+    if (auth.type === "basic") {
+        rejectControlChars("Basic auth username", auth.username);
+        rejectControlChars("Basic auth password", auth.password);
+        return;
+    }
+    if (auth.type === "header") {
+        if (!HEADER_NAME_RE.test(auth.header_name)) {
+            throw new ValidationError("Header auth header_name must be a valid HTTP header token.");
+        }
+        rejectControlChars("Header auth header_value", auth.header_value);
+        return;
+    }
+    if (auth.query_param.length === 0) {
+        throw new ValidationError("Query auth query_param must be a non-empty string.");
+    }
+    rejectControlChars("Query auth query_param", auth.query_param);
+}
+export function redactUrlForLogs(url, extraSensitiveParams = []) {
+    try {
+        const parsed = new URL(url);
+        const sensitive = new Set(extraSensitiveParams.map((p) => p.toLowerCase()));
+        for (const key of [...parsed.searchParams.keys()]) {
+            if (sensitive.has(key.toLowerCase()) || TOKEN_QUERY_RE.test(key)) {
+                parsed.searchParams.set(key, REDACTED);
+            }
+        }
+        return parsed.toString();
+    }
+    catch {
+        return url;
+    }
+}
+export function applyDownloadAuth(url, auth) {
+    if (!auth)
+        return { url, headers: {} };
+    validateDownloadAuth(auth);
+    if (auth.type === "bearer") {
+        return {
+            url,
+            headers: { Authorization: `Bearer ${auth.token}` },
+        };
+    }
+    if (auth.type === "basic") {
+        const encoded = Buffer.from(`${auth.username}:${auth.password}`).toString("base64");
+        return {
+            url,
+            headers: { Authorization: `Basic ${encoded}` },
+        };
+    }
+    if (auth.type === "header") {
+        return {
+            url,
+            headers: { [auth.header_name]: auth.header_value },
+        };
+    }
+    const parsed = new URL(url);
+    parsed.searchParams.set(auth.query_param, auth.query_value);
+    return {
+        url: parsed.toString(),
+        headers: {},
+    };
+}
+//# sourceMappingURL=download-auth.js.map

package/dist/services/download-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"download-auth.js","sourceRoot":"","sources":["../../src/services/download-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAarD,MAAM,cAAc,GAAG,sDAAsD,CAAC;AAC9E,MAAM,QAAQ,GAAG,YAAY,CAAC;AAC9B,MAAM,cAAc,GAAG,gCAAgC,CAAC;AACxD,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAE3C,SAAS,kBAAkB,CAAC,KAAa,EAAE,KAAa;IACtD,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,eAAe,CAAC,GAAG,KAAK,2CAA2C,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAkB;IAC9C,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,kBAAkB,CAAC,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,kBAAkB,CAAC,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,eAAe,CACvB,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,kBAAkB,CAAC,0BAA0B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CAAC,oDAAoD,CAAC,CAAC;IAClF,CAAC;IACD,kBAAkB,CAAC,wBAAwB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,uBAAiC,EAAE;IAEnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC5E,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAClD,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,GAAW,EACX,IAAmB;IAEnB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACvC,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAE3B,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACL,GAAG;YACH,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;SACnD,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpF,OAAO;YACL,GAAG;YACH,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,OAAO,EAAE,EAAE;SAC/C,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACL,GAAG;YACH,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE;SACnD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5D,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE;QACtB,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC"}

package/dist/services/download-cache.d.ts

@@ -0,0 +1,26 @@
+import { copyFile, link, mkdir, readdir, rename, rm, stat, utimes } from "node:fs/promises";
+export declare const downloadCacheFs: {
+    copyFile: typeof copyFile;
+    link: typeof link;
+    mkdir: typeof mkdir;
+    readdir: typeof readdir;
+    rename: typeof rename;
+    rm: typeof rm;
+    stat: typeof stat;
+    utimes: typeof utimes;
+};
+export interface DownloadCacheOptions {
+    url: string;
+    headers: Record<string, string>;
+    targetPath: string;
+    logUrl?: string;
+}
+export interface DownloadCacheResult {
+    targetPath: string;
+    usedCache: boolean;
+    cachePath?: string;
+    materializedBy?: "hardlink" | "copy";
+}
+export declare function downloadUrlToFile(url: string, targetPath: string, headers: Record<string, string>, logUrl?: string): Promise<void>;
+export declare function downloadWithCache(options: DownloadCacheOptions): Promise<DownloadCacheResult>;
+//# sourceMappingURL=download-cache.d.ts.map

package/dist/services/download-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"download-cache.d.ts","sourceRoot":"","sources":["../../src/services/download-cache.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,QAAQ,EACR,IAAI,EACJ,KAAK,EACL,OAAO,EACP,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACP,MAAM,kBAAkB,CAAC;AAa1B,eAAO,MAAM,eAAe;;;;;;;;;CAS3B,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;CACtC;AA+ID,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAqB9B"}