langflower 0.0.1

package/vendor/server/dist/config/redact-langflower-config.test.js

@@ -0,0 +1,69 @@
+import { describe, expect, it } from 'vitest';
+import { redactLangflowerConfigForBridge } from './redact-langflower-config.js';
+import { resolveProviderCredentials } from './resolve-provider-credentials.js';
+const configWithSecrets = () => ({
+    model: 'openai/gpt-4o-mini',
+    provider: {
+        openai: {
+            name: 'OpenAI',
+            options: {
+                baseURL: 'https://api.openai.com/v1',
+                apiKey: '{env:OPENAI_API_KEY}',
+            },
+            models: ['gpt-4o-mini'],
+        },
+        literal: {
+            name: 'Literal key provider',
+            options: {
+                apiKey: 'sk-live-secret-key-value',
+            },
+            models: ['test-model'],
+        },
+    },
+});
+describe('redactLangflowerConfigForBridge', () => {
+    it('omits apiKey from provider options (env ref and literal)', () => {
+        const redacted = redactLangflowerConfigForBridge(configWithSecrets());
+        expect(redacted.provider?.openai).toEqual({
+            name: 'OpenAI',
+            options: { baseURL: 'https://api.openai.com/v1' },
+            models: ['gpt-4o-mini'],
+        });
+        expect(redacted.provider?.literal).toEqual({
+            name: 'Literal key provider',
+            models: ['test-model'],
+        });
+        expect(redacted.provider?.openai?.options).not.toHaveProperty('apiKey');
+        expect(redacted.provider?.literal).not.toHaveProperty('options');
+    });
+    it('resolved credentials never appear in redacted snapshot payload', () => {
+        const prior = process.env.TEST_LF_KEY;
+        process.env.TEST_LF_KEY = 'resolved-secret-value';
+        try {
+            const config = {
+                provider: {
+                    test: {
+                        name: 'Test',
+                        options: { apiKey: '{env:TEST_LF_KEY}' },
+                    },
+                },
+            };
+            const resolved = resolveProviderCredentials(config, 'test');
+            const redacted = redactLangflowerConfigForBridge(config);
+            const serialized = JSON.stringify(redacted);
+            expect(resolved.apiKey).toBe('resolved-secret-value');
+            expect(serialized).not.toContain('resolved-secret-value');
+            expect(serialized).not.toContain('TEST_LF_KEY');
+            expect(redacted.provider?.test?.options).toBeUndefined();
+        }
+        finally {
+            if (prior === undefined) {
+                delete process.env.TEST_LF_KEY;
+            }
+            else {
+                process.env.TEST_LF_KEY = prior;
+            }
+        }
+    });
+});
+//# sourceMappingURL=redact-langflower-config.test.js.map

package/vendor/server/dist/config/redact-langflower-config.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-langflower-config.test.js","sourceRoot":"","sources":["../../src/config/redact-langflower-config.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAE/E,MAAM,iBAAiB,GAAG,GAAqB,EAAE,CAAC,CAAC;IAClD,KAAK,EAAE,oBAAoB;IAC3B,QAAQ,EAAE;QACT,MAAM,EAAE;YACP,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE;gBACR,OAAO,EAAE,2BAA2B;gBACpC,MAAM,EAAE,sBAAsB;aAC9B;YACD,MAAM,EAAE,CAAC,aAAa,CAAC;SACvB;QACD,OAAO,EAAE;YACR,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE;gBACR,MAAM,EAAE,0BAA0B;aAClC;YACD,MAAM,EAAE,CAAC,YAAY,CAAC;SACtB;KACD;CACD,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QACnE,MAAM,QAAQ,GAAG,+BAA+B,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAEtE,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC;YACzC,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE;YACjD,MAAM,EAAE,CAAC,aAAa,CAAC;SACvB,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC;YAC1C,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,CAAC,YAAY,CAAC;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACxE,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACzE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,uBAAuB,CAAC;QAElD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAqB;gBAChC,QAAQ,EAAE;oBACT,IAAI,EAAE;wBACL,IAAI,EAAE,MAAM;wBACZ,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;qBACxC;iBACD;aACD,CAAC;YAEF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,QAAQ,GAAG,+BAA+B,CAAC,MAAM,CAAC,CAAC;YACzD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAE5C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACtD,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;YAC1D,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YAChD,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;QAC1D,CAAC;gBAAS,CAAC;YACV,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC;YACjC,CAAC;QACF,CAAC;IACF,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/vendor/server/dist/config/resolve-global-langflower-config-path.d.ts

@@ -0,0 +1,6 @@
+/**
+ * OS-specific absolute path for the global `langflower.jsonc`
+ * (ADR-002 amend / CONFIG § Global config).
+ */
+export declare const resolveGlobalLangflowerConfigPath: () => string;
+//# sourceMappingURL=resolve-global-langflower-config-path.d.ts.map

package/vendor/server/dist/config/resolve-global-langflower-config-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-global-langflower-config-path.d.ts","sourceRoot":"","sources":["../../src/config/resolve-global-langflower-config-path.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,eAAO,MAAM,iCAAiC,QAAO,MAqBpD,CAAC"}

package/vendor/server/dist/config/resolve-global-langflower-config-path.js

@@ -0,0 +1,19 @@
+import os from 'node:os';
+import path from 'node:path';
+/**
+ * OS-specific absolute path for the global `langflower.jsonc`
+ * (ADR-002 amend / CONFIG § Global config).
+ */
+export const resolveGlobalLangflowerConfigPath = () => {
+    if (process.platform === 'win32') {
+        const appData = process.env.APPDATA ??
+            path.join(os.homedir(), 'AppData', 'Roaming');
+        return path.join(appData, 'langflower', 'langflower.jsonc');
+    }
+    if (process.platform === 'darwin') {
+        return path.join(os.homedir(), 'Library', 'Application Support', 'langflower', 'langflower.jsonc');
+    }
+    const xdg = process.env.XDG_CONFIG_HOME ?? path.join(os.homedir(), '.config');
+    return path.join(xdg, 'langflower', 'langflower.jsonc');
+};
+//# sourceMappingURL=resolve-global-langflower-config-path.js.map

package/vendor/server/dist/config/resolve-global-langflower-config-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-global-langflower-config-path.js","sourceRoot":"","sources":["../../src/config/resolve-global-langflower-config-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAW,EAAE;IAC7D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,MAAM,OAAO,GACZ,OAAO,CAAC,GAAG,CAAC,OAAO;YACnB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,IAAI,CACf,EAAE,CAAC,OAAO,EAAE,EACZ,SAAS,EACT,qBAAqB,EACrB,YAAY,EACZ,kBAAkB,CAClB,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GACR,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC;AACzD,CAAC,CAAC"}

package/vendor/server/dist/config/resolve-provider-credentials.d.ts

@@ -0,0 +1,21 @@
+import type { LangflowerConfig } from '@langflower/shared/langflower.js';
+type ResolvedProviderCredentials = {
+    readonly apiKey?: string;
+    readonly baseURL?: string;
+};
+export type ResolveProviderCredentialsResult = {
+    readonly ok: true;
+    readonly credentials: ResolvedProviderCredentials;
+} | {
+    readonly ok: false;
+    readonly message: string;
+};
+/**
+ * Resolves `{env:VAR}` placeholders in provider options from `process.env`.
+ * Server-only — never call from bridge payloads or `@langflower/common-nodes`.
+ *
+ * Never throws — missing provider / env returns `{ ok: false, message }`.
+ */
+export declare const resolveProviderCredentials: (config: LangflowerConfig, providerId: string) => ResolveProviderCredentialsResult;
+export {};
+//# sourceMappingURL=resolve-provider-credentials.d.ts.map

package/vendor/server/dist/config/resolve-provider-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-provider-credentials.d.ts","sourceRoot":"","sources":["../../src/config/resolve-provider-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEzE,KAAK,2BAA2B,GAAG;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,gCAAgC,GACzC;IACA,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAC;CACjD,GACD;IACA,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACxB,CAAC;AAiDL;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,GACtC,QAAQ,gBAAgB,EACxB,YAAY,MAAM,KAChB,gCA6BF,CAAC"}

package/vendor/server/dist/config/resolve-provider-credentials.js

@@ -0,0 +1,60 @@
+const ENV_REF_PATTERN = /^\{env:([A-Za-z_][A-Za-z0-9_]*)\}$/;
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const resolveEnvRef = (value, context) => {
+    const match = ENV_REF_PATTERN.exec(value);
+    if (match === null) {
+        return { ok: true, value };
+    }
+    const varName = match[1];
+    const resolved = process.env[varName];
+    if (resolved === undefined || resolved === '') {
+        return {
+            ok: false,
+            message: `Environment variable ${varName} is not set (${context})`,
+        };
+    }
+    return { ok: true, value: resolved };
+};
+const resolveOptionString = (value, context) => {
+    if (typeof value !== 'string' || value.length === 0) {
+        return { ok: true, value: undefined };
+    }
+    const resolved = resolveEnvRef(value, context);
+    if (!resolved.ok) {
+        return resolved;
+    }
+    return { ok: true, value: resolved.value };
+};
+/**
+ * Resolves `{env:VAR}` placeholders in provider options from `process.env`.
+ * Server-only — never call from bridge payloads or `@langflower/common-nodes`.
+ *
+ * Never throws — missing provider / env returns `{ ok: false, message }`.
+ */
+export const resolveProviderCredentials = (config, providerId) => {
+    const provider = config.provider?.[providerId];
+    if (provider === undefined) {
+        return {
+            ok: false,
+            message: `Provider "${providerId}" is not configured`,
+        };
+    }
+    const options = isRecord(provider.options) ? provider.options : {};
+    const context = `provider ${providerId}`;
+    const apiKey = resolveOptionString(options.apiKey, context);
+    if (!apiKey.ok) {
+        return apiKey;
+    }
+    const baseURL = resolveOptionString(options.baseURL, context);
+    if (!baseURL.ok) {
+        return baseURL;
+    }
+    return {
+        ok: true,
+        credentials: {
+            ...(apiKey.value !== undefined ? { apiKey: apiKey.value } : {}),
+            ...(baseURL.value !== undefined ? { baseURL: baseURL.value } : {}),
+        },
+    };
+};
+//# sourceMappingURL=resolve-provider-credentials.js.map

package/vendor/server/dist/config/resolve-provider-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-provider-credentials.js","sourceRoot":"","sources":["../../src/config/resolve-provider-credentials.ts"],"names":[],"mappings":"AAiBA,MAAM,eAAe,GAAG,oCAAoC,CAAC;AAE7D,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACrE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEtE,MAAM,aAAa,GAAG,CACrB,KAAa,EACb,OAAe,EAGoC,EAAE;IACrD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/C,OAAO;YACN,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,wBAAwB,OAAO,gBAAgB,OAAO,GAAG;SAClE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAC3B,KAAc,EACd,OAAe,EAGoC,EAAE;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAC5C,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACzC,MAAwB,EACxB,UAAkB,EACiB,EAAE;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,CAAC;IAE/C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACN,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,aAAa,UAAU,qBAAqB;SACrD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,OAAO,GAAG,YAAY,UAAU,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,OAAO;QACN,EAAE,EAAE,IAAI;QACR,WAAW,EAAE;YACZ,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE;KACD,CAAC;AACH,CAAC,CAAC"}

package/vendor/server/dist/config/resolve-provider-credentials.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=resolve-provider-credentials.test.d.ts.map

package/vendor/server/dist/config/resolve-provider-credentials.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-provider-credentials.test.d.ts","sourceRoot":"","sources":["../../src/config/resolve-provider-credentials.test.ts"],"names":[],"mappings":""}

package/vendor/server/dist/config/resolve-provider-credentials.test.js

@@ -0,0 +1,63 @@
+import { describe, expect, it } from 'vitest';
+import { resolveProviderCredentials } from './resolve-provider-credentials.js';
+const testConfig = (apiKey) => ({
+    provider: {
+        openai: {
+            name: 'OpenAI',
+            options: {
+                baseURL: 'https://api.openai.com/v1',
+                apiKey,
+            },
+        },
+    },
+});
+describe('resolveProviderCredentials', () => {
+    it('resolves {env:VAR} from process.env', () => {
+        const prior = process.env.TEST_LF_KEY;
+        process.env.TEST_LF_KEY = 'lf-test-key-value';
+        try {
+            expect(resolveProviderCredentials(testConfig('{env:TEST_LF_KEY}'), 'openai')).toEqual({
+                apiKey: 'lf-test-key-value',
+                baseURL: 'https://api.openai.com/v1',
+            });
+        }
+        finally {
+            if (prior === undefined) {
+                delete process.env.TEST_LF_KEY;
+            }
+            else {
+                process.env.TEST_LF_KEY = prior;
+            }
+        }
+    });
+    it('passes through literal apiKey and baseURL', () => {
+        expect(resolveProviderCredentials(testConfig('sk-static-key'), 'openai')).toEqual({
+            apiKey: 'sk-static-key',
+            baseURL: 'https://api.openai.com/v1',
+        });
+    });
+    it('throws when env var is missing without echoing the secret', () => {
+        const prior = process.env.MISSING_LF_SECRET_VAR;
+        delete process.env.MISSING_LF_SECRET_VAR;
+        try {
+            expect(() => resolveProviderCredentials(testConfig('{env:MISSING_LF_SECRET_VAR}'), 'openai')).toThrow(/Environment variable MISSING_LF_SECRET_VAR is not set/);
+            try {
+                resolveProviderCredentials(testConfig('{env:MISSING_LF_SECRET_VAR}'), 'openai');
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                expect(message).not.toContain('sk-');
+                expect(message).not.toContain('secret');
+            }
+        }
+        finally {
+            if (prior !== undefined) {
+                process.env.MISSING_LF_SECRET_VAR = prior;
+            }
+        }
+    });
+    it('throws when provider id is unknown', () => {
+        expect(() => resolveProviderCredentials(testConfig('{env:TEST}'), 'unknown')).toThrow(/Provider "unknown" is not configured/);
+    });
+});
+//# sourceMappingURL=resolve-provider-credentials.test.js.map

package/vendor/server/dist/config/resolve-provider-credentials.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-provider-credentials.test.js","sourceRoot":"","sources":["../../src/config/resolve-provider-credentials.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAE/E,MAAM,UAAU,GAAG,CAAC,MAAc,EAAoB,EAAE,CAAC,CAAC;IACzD,QAAQ,EAAE;QACT,MAAM,EAAE;YACP,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE;gBACR,OAAO,EAAE,2BAA2B;gBACpC,MAAM;aACN;SACD;KACD;CACD,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,mBAAmB,CAAC;QAE9C,IAAI,CAAC;YACJ,MAAM,CACL,0BAA0B,CACzB,UAAU,CAAC,mBAAmB,CAAC,EAC/B,QAAQ,CACR,CACD,CAAC,OAAO,CAAC;gBACT,MAAM,EAAE,mBAAmB;gBAC3B,OAAO,EAAE,2BAA2B;aACpC,CAAC,CAAC;QACJ,CAAC;gBAAS,CAAC;YACV,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC;YACjC,CAAC;QACF,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACpD,MAAM,CACL,0BAA0B,CACzB,UAAU,CAAC,eAAe,CAAC,EAC3B,QAAQ,CACR,CACD,CAAC,OAAO,CAAC;YACT,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,2BAA2B;SACpC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACpE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAChD,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAEzC,IAAI,CAAC;YACJ,MAAM,CAAC,GAAG,EAAE,CACX,0BAA0B,CACzB,UAAU,CAAC,6BAA6B,CAAC,EACzC,QAAQ,CACR,CACD,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC;YAEnE,IAAI,CAAC;gBACJ,0BAA0B,CACzB,UAAU,CAAC,6BAA6B,CAAC,EACzC,QAAQ,CACR,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,OAAO,GACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACzC,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,KAAK,CAAC;YAC3C,CAAC;QACF,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,GAAG,EAAE,CACX,0BAA0B,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,CAC/D,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/vendor/server/dist/crawl/create-crawl-context.d.ts

@@ -0,0 +1,6 @@
+import type { CrawlContext } from '@langflower/node-definitions';
+/**
+ * Persist crawl pages under `<project>/.langflower/crawl/{runId}/`.
+ */
+export declare const createCrawlContext: (projectDir: string, runId: string) => CrawlContext;
+//# sourceMappingURL=create-crawl-context.d.ts.map

package/vendor/server/dist/crawl/create-crawl-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-crawl-context.d.ts","sourceRoot":"","sources":["../../src/crawl/create-crawl-context.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAkB,MAAM,8BAA8B,CAAC;AAKjF;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAC9B,YAAY,MAAM,EAClB,OAAO,MAAM,KACX,YAgCF,CAAC"}

package/vendor/server/dist/crawl/create-crawl-context.js

@@ -0,0 +1,33 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+const sanitizeSegment = (value) => value.replace(/[^a-zA-Z0-9._-]+/g, '_').slice(0, 80);
+/**
+ * Persist crawl pages under `<project>/.langflower/crawl/{runId}/`.
+ */
+export const createCrawlContext = (projectDir, runId) => {
+    const safeRunId = sanitizeSegment(runId || 'run');
+    const rootDir = path.join(projectDir, '.langflower', 'crawl', safeRunId);
+    let sequence = 0;
+    return {
+        runId: safeRunId,
+        savePage: async (page) => {
+            await fs.mkdir(rootDir, { recursive: true });
+            sequence += 1;
+            const stem = `${String(sequence).padStart(4, '0')}-${sanitizeSegment(page.url)}`;
+            const fileName = `${stem}.json`;
+            const savedPath = path.join(rootDir, fileName);
+            const record = {
+                url: page.url,
+                html: page.html,
+                text: page.text,
+                ...(page.title !== undefined && page.title.length > 0
+                    ? { title: page.title }
+                    : {}),
+                savedPath: path.relative(projectDir, savedPath).replace(/\\/g, '/'),
+            };
+            await fs.writeFile(savedPath, `${JSON.stringify(record, null, 2)}\n`, 'utf8');
+            return record;
+        },
+    };
+};
+//# sourceMappingURL=create-crawl-context.js.map

package/vendor/server/dist/crawl/create-crawl-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-crawl-context.js","sourceRoot":"","sources":["../../src/crawl/create-crawl-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE,CACjD,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAEtD;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CACjC,UAAkB,EAClB,KAAa,EACE,EAAE;IACjB,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACzE,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,OAAO;QACN,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,KAAK,EAAE,IAAI,EAA2B,EAAE;YACjD,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,QAAQ,IAAI,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjF,MAAM,QAAQ,GAAG,GAAG,IAAI,OAAO,CAAC;YAChC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAmB;gBAC9B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;oBACpD,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;oBACvB,CAAC,CAAC,EAAE,CAAC;gBACN,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnE,CAAC;YAEF,MAAM,EAAE,CAAC,SAAS,CACjB,SAAS,EACT,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EACtC,MAAM,CACN,CAAC;YAEF,OAAO,MAAM,CAAC;QACf,CAAC;KACD,CAAC;AACH,CAAC,CAAC"}

package/vendor/server/dist/crawl/create-crawl-context.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=create-crawl-context.test.d.ts.map

package/vendor/server/dist/crawl/create-crawl-context.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-crawl-context.test.d.ts","sourceRoot":"","sources":["../../src/crawl/create-crawl-context.test.ts"],"names":[],"mappings":""}

package/vendor/server/dist/crawl/create-crawl-context.test.js

@@ -0,0 +1,30 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { createCrawlContext } from './create-crawl-context.js';
+describe('createCrawlContext', () => {
+    let projectDir;
+    beforeEach(async () => {
+        projectDir = await fs.mkdtemp(path.join(os.tmpdir(), 'lf-crawl-'));
+    });
+    afterEach(async () => {
+        await fs.rm(projectDir, { recursive: true, force: true });
+    });
+    it('writes page JSON under .langflower/crawl/{runId}/', async () => {
+        const crawl = createCrawlContext(projectDir, 'run-42');
+        const saved = await crawl.savePage({
+            url: 'https://example.com/a',
+            html: '<html><title>A</title></html>',
+            text: 'A',
+            title: 'A',
+        });
+        expect(saved.savedPath).toMatch(/^\.langflower\/crawl\/run-42\/0001-.*\.json$/);
+        const absolute = path.join(projectDir, saved.savedPath);
+        const raw = await fs.readFile(absolute, 'utf8');
+        const parsed = JSON.parse(raw);
+        expect(parsed.url).toBe('https://example.com/a');
+        expect(parsed.title).toBe('A');
+    });
+});
+//# sourceMappingURL=create-crawl-context.test.js.map

package/vendor/server/dist/crawl/create-crawl-context.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-crawl-context.test.js","sourceRoot":"","sources":["../../src/crawl/create-crawl-context.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IACnC,IAAI,UAAkB,CAAC;IAEvB,UAAU,CAAC,KAAK,IAAI,EAAE;QACrB,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC;YAClC,GAAG,EAAE,uBAAuB;YAC5B,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,GAAG;YACT,KAAK,EAAE,GAAG;SACV,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAC9B,8CAA8C,CAC9C,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoC,CAAC;QAElE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/vendor/server/dist/crawl/create-web-fetch.d.ts

@@ -0,0 +1,12 @@
+import type { WebFetchRequest, WebFetchResult } from '@langflower/node-definitions';
+export type CreateWebFetchOptions = {
+    readonly allowedHosts?: readonly string[];
+    /** Injected for tests; defaults to global `fetch`. */
+    readonly fetchImpl?: typeof fetch;
+};
+/**
+ * SSRF-guarded HTTP GET for crawl / Fetch URL nodes.
+ * Validates every redirect hop; truncates body at `maxBytes`.
+ */
+export declare const createWebFetch: (options?: CreateWebFetchOptions) => ((request: WebFetchRequest) => Promise<WebFetchResult>);
+//# sourceMappingURL=create-web-fetch.d.ts.map

package/vendor/server/dist/crawl/create-web-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-web-fetch.d.ts","sourceRoot":"","sources":["../../src/crawl/create-web-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,eAAe,EACf,cAAc,EACd,MAAM,8BAA8B,CAAC;AAOtC,MAAM,MAAM,qBAAqB,GAAG;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,sDAAsD;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAClC,CAAC;AAkDF;;;GAGG;AACH,eAAO,MAAM,cAAc,GAC1B,UAAS,qBAA0B,KACjC,CAAC,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,CAAC,CAoGxD,CAAC"}

package/vendor/server/dist/crawl/create-web-fetch.js

@@ -0,0 +1,128 @@
+import { assertUrlSafeForFetch } from './ssrf-guard.js';
+const DEFAULT_TIMEOUT_MS = 30_000;
+const DEFAULT_MAX_BYTES = 5_000_000;
+const MAX_REDIRECTS = 5;
+const headersToRecord = (headers) => {
+    const out = {};
+    headers.forEach((value, key) => {
+        out[key] = value;
+    });
+    return out;
+};
+const readBodyLimited = async (response, maxBytes) => {
+    if (response.body === null) {
+        return '';
+    }
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let total = 0;
+    let text = '';
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done) {
+            break;
+        }
+        if (value === undefined) {
+            continue;
+        }
+        total += value.byteLength;
+        if (total > maxBytes) {
+            await reader.cancel();
+            throw new Error(`Response exceeded maxBytes (${maxBytes}).`);
+        }
+        text += decoder.decode(value, { stream: true });
+    }
+    text += decoder.decode();
+    return text;
+};
+/**
+ * SSRF-guarded HTTP GET for crawl / Fetch URL nodes.
+ * Validates every redirect hop; truncates body at `maxBytes`.
+ */
+export const createWebFetch = (options = {}) => {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    return async (request) => {
+        const timeoutMs = typeof request.timeoutMs === 'number' && request.timeoutMs > 0
+            ? request.timeoutMs
+            : DEFAULT_TIMEOUT_MS;
+        const maxBytes = typeof request.maxBytes === 'number' && request.maxBytes > 0
+            ? request.maxBytes
+            : DEFAULT_MAX_BYTES;
+        try {
+            let currentUrl = request.url;
+            for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {
+                const safeUrl = await assertUrlSafeForFetch(currentUrl, {
+                    ...(options.allowedHosts !== undefined
+                        ? { allowedHosts: options.allowedHosts }
+                        : {}),
+                });
+                const controller = new AbortController();
+                const timer = setTimeout(() => controller.abort(), timeoutMs);
+                try {
+                    const response = await fetchImpl(safeUrl.toString(), {
+                        method: 'GET',
+                        redirect: 'manual',
+                        signal: controller.signal,
+                        headers: {
+                            Accept: 'text/html,application/xhtml+xml,*/*;q=0.8',
+                            'User-Agent': 'LangflowerCrawl/0.1',
+                        },
+                    });
+                    if (response.status >= 300 &&
+                        response.status < 400 &&
+                        response.headers.has('location')) {
+                        const location = response.headers.get('location');
+                        if (location === null || location.length === 0) {
+                            return {
+                                ok: false,
+                                status: response.status,
+                                url: safeUrl.toString(),
+                                headers: headersToRecord(response.headers),
+                                body: '',
+                                error: 'Redirect missing Location header.',
+                            };
+                        }
+                        currentUrl = new URL(location, safeUrl).toString();
+                        continue;
+                    }
+                    const body = await readBodyLimited(response, maxBytes);
+                    return {
+                        ok: response.ok,
+                        status: response.status,
+                        url: safeUrl.toString(),
+                        headers: headersToRecord(response.headers),
+                        body,
+                        ...(response.ok
+                            ? {}
+                            : {
+                                error: `HTTP ${response.status} ${response.statusText}`,
+                            }),
+                    };
+                }
+                finally {
+                    clearTimeout(timer);
+                }
+            }
+            return {
+                ok: false,
+                status: 0,
+                url: currentUrl,
+                headers: {},
+                body: '',
+                error: `Too many redirects (>${MAX_REDIRECTS}).`,
+            };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return {
+                ok: false,
+                status: 0,
+                url: request.url,
+                headers: {},
+                body: '',
+                error: message,
+            };
+        }
+    };
+};
+//# sourceMappingURL=create-web-fetch.js.map

package/vendor/server/dist/crawl/create-web-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-web-fetch.js","sourceRoot":"","sources":["../../src/crawl/create-web-fetch.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AACpC,MAAM,aAAa,GAAG,CAAC,CAAC;AAQxB,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAoC,EAAE;IAC9E,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACZ,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,KAAK,EAC5B,QAAkB,EAClB,QAAgB,EACE,EAAE;IACpB,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAG,EAAE,CAAC;IAEd,SAAS,CAAC;QACT,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAE5C,IAAI,IAAI,EAAE,CAAC;YACV,MAAM;QACP,CAAC;QAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,SAAS;QACV,CAAC;QAED,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAE1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACtB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,IAAI,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IACzB,OAAO,IAAI,CAAC;AACb,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC7B,UAAiC,EAAE,EACuB,EAAE;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAE7C,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,MAAM,SAAS,GACd,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,GAAG,CAAC;YAC7D,CAAC,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC,kBAAkB,CAAC;QACvB,MAAM,QAAQ,GACb,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,GAAG,CAAC;YAC3D,CAAC,CAAC,OAAO,CAAC,QAAQ;YAClB,CAAC,CAAC,iBAAiB,CAAC;QAEtB,IAAI,CAAC;YACJ,IAAI,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC;YAE7B,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,aAAa,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;gBAClD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE;oBACvD,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS;wBACrC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;wBACxC,CAAC,CAAC,EAAE,CAAC;iBACN,CAAC,CAAC;gBAEH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;gBACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;gBAE9D,IAAI,CAAC;oBACJ,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE;wBACpD,MAAM,EAAE,KAAK;wBACb,QAAQ,EAAE,QAAQ;wBAClB,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,OAAO,EAAE;4BACR,MAAM,EAAE,2CAA2C;4BACnD,YAAY,EAAE,qBAAqB;yBACnC;qBACD,CAAC,CAAC;oBAEH,IACC,QAAQ,CAAC,MAAM,IAAI,GAAG;wBACtB,QAAQ,CAAC,MAAM,GAAG,GAAG;wBACrB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAC/B,CAAC;wBACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;wBAElD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;4BAChD,OAAO;gCACN,EAAE,EAAE,KAAK;gCACT,MAAM,EAAE,QAAQ,CAAC,MAAM;gCACvB,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE;gCACvB,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC;gCAC1C,IAAI,EAAE,EAAE;gCACR,KAAK,EAAE,mCAAmC;6BAC1C,CAAC;wBACH,CAAC;wBAED,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;wBACnD,SAAS;oBACV,CAAC;oBAED,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;oBAEvD,OAAO;wBACN,EAAE,EAAE,QAAQ,CAAC,EAAE;wBACf,MAAM,EAAE,QAAQ,CAAC,MAAM;wBACvB,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE;wBACvB,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC;wBAC1C,IAAI;wBACJ,GAAG,CAAC,QAAQ,CAAC,EAAE;4BACd,CAAC,CAAC,EAAE;4BACJ,CAAC,CAAC;gCACA,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE;6BACvD,CAAC;qBACJ,CAAC;gBACH,CAAC;wBAAS,CAAC;oBACV,YAAY,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;YACF,CAAC;YAED,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,CAAC;gBACT,GAAG,EAAE,UAAU;gBACf,OAAO,EAAE,EAAE;gBACX,IAAI,EAAE,EAAE;gBACR,KAAK,EAAE,wBAAwB,aAAa,IAAI;aAChD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAExD,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,CAAC;gBACT,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,OAAO,EAAE,EAAE;gBACX,IAAI,EAAE,EAAE;gBACR,KAAK,EAAE,OAAO;aACd,CAAC;QACH,CAAC;IACF,CAAC,CAAC;AACH,CAAC,CAAC"}

package/vendor/server/dist/crawl/create-web-fetch.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=create-web-fetch.test.d.ts.map

package/vendor/server/dist/crawl/create-web-fetch.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-web-fetch.test.d.ts","sourceRoot":"","sources":["../../src/crawl/create-web-fetch.test.ts"],"names":[],"mappings":""}

package/vendor/server/dist/crawl/create-web-fetch.test.js

@@ -0,0 +1,43 @@
+import { describe, expect, it, vi } from 'vitest';
+import { createWebFetch } from './create-web-fetch.js';
+describe('createWebFetch', () => {
+    it('returns body from a mocked public fetch (offline)', async () => {
+        const fetchImpl = vi.fn(async () => new Response('<html><body>Hi</body></html>', {
+            status: 200,
+            headers: { 'content-type': 'text/html' },
+        }));
+        // Public IP literal avoids DNS; fetch is mocked.
+        const webFetch = createWebFetch({ fetchImpl });
+        const result = await webFetch({ url: 'https://8.8.8.8/' });
+        expect(result.ok).toBe(true);
+        expect(result.status).toBe(200);
+        expect(result.body).toContain('Hi');
+        expect(fetchImpl).toHaveBeenCalled();
+    });
+    it('does not call fetch for blocked URLs', async () => {
+        const fetchImpl = vi.fn();
+        const webFetch = createWebFetch({ fetchImpl });
+        const result = await webFetch({ url: 'http://127.0.0.1/admin' });
+        expect(result.ok).toBe(false);
+        expect(result.error).toMatch(/Blocked/i);
+        expect(fetchImpl).not.toHaveBeenCalled();
+    });
+    it('re-validates redirect targets', async () => {
+        const fetchImpl = vi.fn(async (input) => {
+            const url = String(input);
+            if (url.includes('8.8.8.8')) {
+                return new Response(null, {
+                    status: 302,
+                    headers: { location: 'http://127.0.0.1/secret' },
+                });
+            }
+            return new Response('should-not-reach', { status: 200 });
+        });
+        const webFetch = createWebFetch({ fetchImpl });
+        const result = await webFetch({ url: 'https://8.8.8.8/' });
+        expect(result.ok).toBe(false);
+        expect(result.error).toMatch(/Blocked/i);
+        expect(fetchImpl).toHaveBeenCalledTimes(1);
+    });
+});
+//# sourceMappingURL=create-web-fetch.test.js.map

package/vendor/server/dist/crawl/create-web-fetch.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-web-fetch.test.js","sourceRoot":"","sources":["../../src/crawl/create-web-fetch.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAClC,IAAI,QAAQ,CAAC,8BAA8B,EAAE;YAC5C,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;SACxC,CAAC,CACyB,CAAC;QAE7B,iDAAiD;QACjD,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAE3D,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,CAAC,CAAC,gBAAgB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAA6B,CAAC;QACrD,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAEjE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,KAAwB,EAAE,EAAE;YAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAE1B,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACzB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,QAAQ,EAAE,yBAAyB,EAAE;iBAChD,CAAC,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,QAAQ,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC,CAA4B,CAAC;QAE9B,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAE3D,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/vendor/server/dist/crawl/ssrf-guard.d.ts

@@ -0,0 +1,13 @@
+/** True when the address is loopback, private, link-local, or metadata. */
+export declare const isBlockedIpAddress: (address: string) => boolean;
+export type AssertUrlSafeOptions = {
+    readonly allowedHosts?: readonly string[];
+    /** When true, skip DNS resolution (hostname-only checks). */
+    readonly skipDns?: boolean;
+};
+/**
+ * Reject non-http(s) URLs, blocked hostnames, and (by default) private IPs
+ * after DNS resolution. Optional `allowedHosts` is an exact hostname allowlist.
+ */
+export declare const assertUrlSafeForFetch: (rawUrl: string, options?: AssertUrlSafeOptions) => Promise<URL>;
+//# sourceMappingURL=ssrf-guard.d.ts.map

package/vendor/server/dist/crawl/ssrf-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-guard.d.ts","sourceRoot":"","sources":["../../src/crawl/ssrf-guard.ts"],"names":[],"mappings":"AA8EA,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,GAAI,SAAS,MAAM,KAAG,OAYpD,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,GACjC,QAAQ,MAAM,EACd,UAAS,oBAAyB,KAChC,OAAO,CAAC,GAAG,CAkEb,CAAC"}