langflower 0.1.0 → 0.1.2

package/vendor/server/dist/config/resolve-draft-provider-credentials.js

@@ -1,60 +0,0 @@
-import { resolveProviderCredentials } from './resolve-provider-credentials.js';
-const ENV_REF_PATTERN = /^\{env:([A-Za-z_][A-Za-z0-9_]*)\}$/;
-const resolveEnvRef = (value, context) => {
-    const match = ENV_REF_PATTERN.exec(value);
-    if (match === null) {
-        return { ok: true, value };
-    }
-    const varName = match[1];
-    const resolved = process.env[varName];
-    if (resolved === undefined || resolved === '') {
-        return {
-            ok: false,
-            message: `Environment variable ${varName} is not set (${context})`,
-        };
-    }
-    return { ok: true, value: resolved };
-};
-export const resolveDraftProviderCredentials = (row, savedLayer) => {
-    const baseURL = row.baseURL.trim();
-    if (baseURL.length === 0) {
-        return {
-            ok: false,
-            message: 'Base URL is empty',
-        };
-    }
-    const context = `draft provider ${row.id.trim() || '(new)'}`;
-    const pendingKey = row.apiKey.trim();
-    if (pendingKey.length > 0) {
-        const resolved = resolveEnvRef(pendingKey, context);
-        if (!resolved.ok) {
-            return resolved;
-        }
-        return {
-            ok: true,
-            credentials: {
-                apiKey: resolved.value,
-                baseURL,
-            },
-        };
-    }
-    const providerId = row.id.trim();
-    if (providerId.length > 0 &&
-        savedLayer.provider?.[providerId] !== undefined) {
-        const fromSaved = resolveProviderCredentials(savedLayer, providerId);
-        if (!fromSaved.ok) {
-            return fromSaved;
-        }
-        return {
-            ok: true,
-            credentials: {
-                ...fromSaved.credentials,
-                baseURL,
-            },
-        };
-    }
-    return {
-        ok: true,
-        credentials: { baseURL },
-    };
-};

package/vendor/server/dist/config/resolve-global-langflower-config-path.d.ts

@@ -1,5 +0,0 @@
-/**
- * OS-specific absolute path for the global `langflower.jsonc`
- * (ADR-002 amend / CONFIG § Global config).
- */
-export declare const resolveGlobalLangflowerConfigPath: () => string;

package/vendor/server/dist/config/resolve-global-langflower-config-path.js

@@ -1,18 +0,0 @@
-import os from 'node:os';
-import path from 'node:path';
-/**
- * OS-specific absolute path for the global `langflower.jsonc`
- * (ADR-002 amend / CONFIG § Global config).
- */
-export const resolveGlobalLangflowerConfigPath = () => {
-    if (process.platform === 'win32') {
-        const appData = process.env.APPDATA ??
-            path.join(os.homedir(), 'AppData', 'Roaming');
-        return path.join(appData, 'langflower', 'langflower.jsonc');
-    }
-    if (process.platform === 'darwin') {
-        return path.join(os.homedir(), 'Library', 'Application Support', 'langflower', 'langflower.jsonc');
-    }
-    const xdg = process.env.XDG_CONFIG_HOME ?? path.join(os.homedir(), '.config');
-    return path.join(xdg, 'langflower', 'langflower.jsonc');
-};

package/vendor/server/dist/config/resolve-provider-credentials.d.ts

@@ -1,20 +0,0 @@
-import type { LangflowerConfig } from '@langflower/shared/langflower.js';
-type ResolvedProviderCredentials = {
-    readonly apiKey?: string;
-    readonly baseURL?: string;
-};
-export type ResolveProviderCredentialsResult = {
-    readonly ok: true;
-    readonly credentials: ResolvedProviderCredentials;
-} | {
-    readonly ok: false;
-    readonly message: string;
-};
-/**
- * Resolves `{env:VAR}` placeholders in provider options from `process.env`.
- * Server-only — never call from bridge payloads or `@langflower/common-nodes`.
- *
- * Never throws — missing provider / env returns `{ ok: false, message }`.
- */
-export declare const resolveProviderCredentials: (config: LangflowerConfig, providerId: string) => ResolveProviderCredentialsResult;
-export {};

package/vendor/server/dist/config/resolve-provider-credentials.js

@@ -1,59 +0,0 @@
-const ENV_REF_PATTERN = /^\{env:([A-Za-z_][A-Za-z0-9_]*)\}$/;
-const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
-const resolveEnvRef = (value, context) => {
-    const match = ENV_REF_PATTERN.exec(value);
-    if (match === null) {
-        return { ok: true, value };
-    }
-    const varName = match[1];
-    const resolved = process.env[varName];
-    if (resolved === undefined || resolved === '') {
-        return {
-            ok: false,
-            message: `Environment variable ${varName} is not set (${context})`,
-        };
-    }
-    return { ok: true, value: resolved };
-};
-const resolveOptionString = (value, context) => {
-    if (typeof value !== 'string' || value.length === 0) {
-        return { ok: true, value: undefined };
-    }
-    const resolved = resolveEnvRef(value, context);
-    if (!resolved.ok) {
-        return resolved;
-    }
-    return { ok: true, value: resolved.value };
-};
-/**
- * Resolves `{env:VAR}` placeholders in provider options from `process.env`.
- * Server-only — never call from bridge payloads or `@langflower/common-nodes`.
- *
- * Never throws — missing provider / env returns `{ ok: false, message }`.
- */
-export const resolveProviderCredentials = (config, providerId) => {
-    const provider = config.provider?.[providerId];
-    if (provider === undefined) {
-        return {
-            ok: false,
-            message: `Provider "${providerId}" is not configured`,
-        };
-    }
-    const options = isRecord(provider.options) ? provider.options : {};
-    const context = `provider ${providerId}`;
-    const apiKey = resolveOptionString(options.apiKey, context);
-    if (!apiKey.ok) {
-        return apiKey;
-    }
-    const baseURL = resolveOptionString(options.baseURL, context);
-    if (!baseURL.ok) {
-        return baseURL;
-    }
-    return {
-        ok: true,
-        credentials: {
-            ...(apiKey.value !== undefined ? { apiKey: apiKey.value } : {}),
-            ...(baseURL.value !== undefined ? { baseURL: baseURL.value } : {}),
-        },
-    };
-};

package/vendor/server/dist/config/resolve-provider-credentials.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=resolve-provider-credentials.test.d.ts.map

package/vendor/server/dist/config/resolve-provider-credentials.test.js

@@ -1,63 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { resolveProviderCredentials } from './resolve-provider-credentials.js';
-const testConfig = (apiKey) => ({
-    provider: {
-        openai: {
-            name: 'OpenAI',
-            options: {
-                baseURL: 'https://api.openai.com/v1',
-                apiKey,
-            },
-        },
-    },
-});
-describe('resolveProviderCredentials', () => {
-    it('resolves {env:VAR} from process.env', () => {
-        const prior = process.env.TEST_LF_KEY;
-        process.env.TEST_LF_KEY = 'lf-test-key-value';
-        try {
-            expect(resolveProviderCredentials(testConfig('{env:TEST_LF_KEY}'), 'openai')).toEqual({
-                apiKey: 'lf-test-key-value',
-                baseURL: 'https://api.openai.com/v1',
-            });
-        }
-        finally {
-            if (prior === undefined) {
-                delete process.env.TEST_LF_KEY;
-            }
-            else {
-                process.env.TEST_LF_KEY = prior;
-            }
-        }
-    });
-    it('passes through literal apiKey and baseURL', () => {
-        expect(resolveProviderCredentials(testConfig('sk-static-key'), 'openai')).toEqual({
-            apiKey: 'sk-static-key',
-            baseURL: 'https://api.openai.com/v1',
-        });
-    });
-    it('throws when env var is missing without echoing the secret', () => {
-        const prior = process.env.MISSING_LF_SECRET_VAR;
-        delete process.env.MISSING_LF_SECRET_VAR;
-        try {
-            expect(() => resolveProviderCredentials(testConfig('{env:MISSING_LF_SECRET_VAR}'), 'openai')).toThrow(/Environment variable MISSING_LF_SECRET_VAR is not set/);
-            try {
-                resolveProviderCredentials(testConfig('{env:MISSING_LF_SECRET_VAR}'), 'openai');
-            }
-            catch (error) {
-                const message = error instanceof Error ? error.message : String(error);
-                expect(message).not.toContain('sk-');
-                expect(message).not.toContain('secret');
-            }
-        }
-        finally {
-            if (prior !== undefined) {
-                process.env.MISSING_LF_SECRET_VAR = prior;
-            }
-        }
-    });
-    it('throws when provider id is unknown', () => {
-        expect(() => resolveProviderCredentials(testConfig('{env:TEST}'), 'unknown')).toThrow(/Provider "unknown" is not configured/);
-    });
-});
-//# sourceMappingURL=resolve-provider-credentials.test.js.map

package/vendor/server/dist/crawl/create-crawl-context.d.ts

@@ -1,6 +0,0 @@
-import type { CrawlContext } from '@langflower/node-definitions';
-/**
- * Persist crawl pages under `<project>/.langflower/crawl/{runId}/`.
- */
-export declare const createCrawlContext: (projectDir: string, runId: string) => CrawlContext;
-//# sourceMappingURL=create-crawl-context.d.ts.map

package/vendor/server/dist/crawl/create-crawl-context.js

@@ -1,33 +0,0 @@
-import fs from 'node:fs/promises';
-import path from 'node:path';
-const sanitizeSegment = (value) => value.replace(/[^a-zA-Z0-9._-]+/g, '_').slice(0, 80);
-/**
- * Persist crawl pages under `<project>/.langflower/crawl/{runId}/`.
- */
-export const createCrawlContext = (projectDir, runId) => {
-    const safeRunId = sanitizeSegment(runId || 'run');
-    const rootDir = path.join(projectDir, '.langflower', 'crawl', safeRunId);
-    let sequence = 0;
-    return {
-        runId: safeRunId,
-        savePage: async (page) => {
-            await fs.mkdir(rootDir, { recursive: true });
-            sequence += 1;
-            const stem = `${String(sequence).padStart(4, '0')}-${sanitizeSegment(page.url)}`;
-            const fileName = `${stem}.json`;
-            const savedPath = path.join(rootDir, fileName);
-            const record = {
-                url: page.url,
-                html: page.html,
-                text: page.text,
-                ...(page.title !== undefined && page.title.length > 0
-                    ? { title: page.title }
-                    : {}),
-                savedPath: path.relative(projectDir, savedPath).replace(/\\/g, '/'),
-            };
-            await fs.writeFile(savedPath, `${JSON.stringify(record, null, 2)}\n`, 'utf8');
-            return record;
-        },
-    };
-};
-//# sourceMappingURL=create-crawl-context.js.map

package/vendor/server/dist/crawl/create-crawl-context.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=create-crawl-context.test.d.ts.map

package/vendor/server/dist/crawl/create-crawl-context.test.js

@@ -1,30 +0,0 @@
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { createCrawlContext } from './create-crawl-context.js';
-describe('createCrawlContext', () => {
-    let projectDir;
-    beforeEach(async () => {
-        projectDir = await fs.mkdtemp(path.join(os.tmpdir(), 'lf-crawl-'));
-    });
-    afterEach(async () => {
-        await fs.rm(projectDir, { recursive: true, force: true });
-    });
-    it('writes page JSON under .langflower/crawl/{runId}/', async () => {
-        const crawl = createCrawlContext(projectDir, 'run-42');
-        const saved = await crawl.savePage({
-            url: 'https://example.com/a',
-            html: '<html><title>A</title></html>',
-            text: 'A',
-            title: 'A',
-        });
-        expect(saved.savedPath).toMatch(/^\.langflower\/crawl\/run-42\/0001-.*\.json$/);
-        const absolute = path.join(projectDir, saved.savedPath);
-        const raw = await fs.readFile(absolute, 'utf8');
-        const parsed = JSON.parse(raw);
-        expect(parsed.url).toBe('https://example.com/a');
-        expect(parsed.title).toBe('A');
-    });
-});
-//# sourceMappingURL=create-crawl-context.test.js.map

package/vendor/server/dist/crawl/create-web-fetch.d.ts

@@ -1,12 +0,0 @@
-import type { WebFetchRequest, WebFetchResult } from '@langflower/node-definitions';
-export type CreateWebFetchOptions = {
-    readonly allowedHosts?: readonly string[];
-    /** Injected for tests; defaults to global `fetch`. */
-    readonly fetchImpl?: typeof fetch;
-};
-/**
- * SSRF-guarded HTTP GET for crawl / Fetch URL nodes.
- * Validates every redirect hop; truncates body at `maxBytes`.
- */
-export declare const createWebFetch: (options?: CreateWebFetchOptions) => ((request: WebFetchRequest) => Promise<WebFetchResult>);
-//# sourceMappingURL=create-web-fetch.d.ts.map

package/vendor/server/dist/crawl/create-web-fetch.js

@@ -1,128 +0,0 @@
-import { assertUrlSafeForFetch } from './ssrf-guard.js';
-const DEFAULT_TIMEOUT_MS = 30_000;
-const DEFAULT_MAX_BYTES = 5_000_000;
-const MAX_REDIRECTS = 5;
-const headersToRecord = (headers) => {
-    const out = {};
-    headers.forEach((value, key) => {
-        out[key] = value;
-    });
-    return out;
-};
-const readBodyLimited = async (response, maxBytes) => {
-    if (response.body === null) {
-        return '';
-    }
-    const reader = response.body.getReader();
-    const decoder = new TextDecoder();
-    let total = 0;
-    let text = '';
-    for (;;) {
-        const { done, value } = await reader.read();
-        if (done) {
-            break;
-        }
-        if (value === undefined) {
-            continue;
-        }
-        total += value.byteLength;
-        if (total > maxBytes) {
-            await reader.cancel();
-            throw new Error(`Response exceeded maxBytes (${maxBytes}).`);
-        }
-        text += decoder.decode(value, { stream: true });
-    }
-    text += decoder.decode();
-    return text;
-};
-/**
- * SSRF-guarded HTTP GET for crawl / Fetch URL nodes.
- * Validates every redirect hop; truncates body at `maxBytes`.
- */
-export const createWebFetch = (options = {}) => {
-    const fetchImpl = options.fetchImpl ?? fetch;
-    return async (request) => {
-        const timeoutMs = typeof request.timeoutMs === 'number' && request.timeoutMs > 0
-            ? request.timeoutMs
-            : DEFAULT_TIMEOUT_MS;
-        const maxBytes = typeof request.maxBytes === 'number' && request.maxBytes > 0
-            ? request.maxBytes
-            : DEFAULT_MAX_BYTES;
-        try {
-            let currentUrl = request.url;
-            for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {
-                const safeUrl = await assertUrlSafeForFetch(currentUrl, {
-                    ...(options.allowedHosts !== undefined
-                        ? { allowedHosts: options.allowedHosts }
-                        : {}),
-                });
-                const controller = new AbortController();
-                const timer = setTimeout(() => controller.abort(), timeoutMs);
-                try {
-                    const response = await fetchImpl(safeUrl.toString(), {
-                        method: 'GET',
-                        redirect: 'manual',
-                        signal: controller.signal,
-                        headers: {
-                            Accept: 'text/html,application/xhtml+xml,*/*;q=0.8',
-                            'User-Agent': 'LangflowerCrawl/0.1',
-                        },
-                    });
-                    if (response.status >= 300 &&
-                        response.status < 400 &&
-                        response.headers.has('location')) {
-                        const location = response.headers.get('location');
-                        if (location === null || location.length === 0) {
-                            return {
-                                ok: false,
-                                status: response.status,
-                                url: safeUrl.toString(),
-                                headers: headersToRecord(response.headers),
-                                body: '',
-                                error: 'Redirect missing Location header.',
-                            };
-                        }
-                        currentUrl = new URL(location, safeUrl).toString();
-                        continue;
-                    }
-                    const body = await readBodyLimited(response, maxBytes);
-                    return {
-                        ok: response.ok,
-                        status: response.status,
-                        url: safeUrl.toString(),
-                        headers: headersToRecord(response.headers),
-                        body,
-                        ...(response.ok
-                            ? {}
-                            : {
-                                error: `HTTP ${response.status} ${response.statusText}`,
-                            }),
-                    };
-                }
-                finally {
-                    clearTimeout(timer);
-                }
-            }
-            return {
-                ok: false,
-                status: 0,
-                url: currentUrl,
-                headers: {},
-                body: '',
-                error: `Too many redirects (>${MAX_REDIRECTS}).`,
-            };
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            return {
-                ok: false,
-                status: 0,
-                url: request.url,
-                headers: {},
-                body: '',
-                error: message,
-            };
-        }
-    };
-};
-//# sourceMappingURL=create-web-fetch.js.map

package/vendor/server/dist/crawl/create-web-fetch.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=create-web-fetch.test.d.ts.map

package/vendor/server/dist/crawl/create-web-fetch.test.js

@@ -1,43 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { createWebFetch } from './create-web-fetch.js';
-describe('createWebFetch', () => {
-    it('returns body from a mocked public fetch (offline)', async () => {
-        const fetchImpl = vi.fn(async () => new Response('<html><body>Hi</body></html>', {
-            status: 200,
-            headers: { 'content-type': 'text/html' },
-        }));
-        // Public IP literal avoids DNS; fetch is mocked.
-        const webFetch = createWebFetch({ fetchImpl });
-        const result = await webFetch({ url: 'https://8.8.8.8/' });
-        expect(result.ok).toBe(true);
-        expect(result.status).toBe(200);
-        expect(result.body).toContain('Hi');
-        expect(fetchImpl).toHaveBeenCalled();
-    });
-    it('does not call fetch for blocked URLs', async () => {
-        const fetchImpl = vi.fn();
-        const webFetch = createWebFetch({ fetchImpl });
-        const result = await webFetch({ url: 'http://127.0.0.1/admin' });
-        expect(result.ok).toBe(false);
-        expect(result.error).toMatch(/Blocked/i);
-        expect(fetchImpl).not.toHaveBeenCalled();
-    });
-    it('re-validates redirect targets', async () => {
-        const fetchImpl = vi.fn(async (input) => {
-            const url = String(input);
-            if (url.includes('8.8.8.8')) {
-                return new Response(null, {
-                    status: 302,
-                    headers: { location: 'http://127.0.0.1/secret' },
-                });
-            }
-            return new Response('should-not-reach', { status: 200 });
-        });
-        const webFetch = createWebFetch({ fetchImpl });
-        const result = await webFetch({ url: 'https://8.8.8.8/' });
-        expect(result.ok).toBe(false);
-        expect(result.error).toMatch(/Blocked/i);
-        expect(fetchImpl).toHaveBeenCalledTimes(1);
-    });
-});
-//# sourceMappingURL=create-web-fetch.test.js.map

package/vendor/server/dist/crawl/ssrf-guard.d.ts

@@ -1,13 +0,0 @@
-/** True when the address is loopback, private, link-local, or metadata. */
-export declare const isBlockedIpAddress: (address: string) => boolean;
-export type AssertUrlSafeOptions = {
-    readonly allowedHosts?: readonly string[];
-    /** When true, skip DNS resolution (hostname-only checks). */
-    readonly skipDns?: boolean;
-};
-/**
- * Reject non-http(s) URLs, blocked hostnames, and (by default) private IPs
- * after DNS resolution. Optional `allowedHosts` is an exact hostname allowlist.
- */
-export declare const assertUrlSafeForFetch: (rawUrl: string, options?: AssertUrlSafeOptions) => Promise<URL>;
-//# sourceMappingURL=ssrf-guard.d.ts.map

package/vendor/server/dist/crawl/ssrf-guard.js

@@ -1,117 +0,0 @@
-import dns from 'node:dns/promises';
-import net from 'node:net';
-const BLOCKED_HOSTNAMES = new Set([
-    'localhost',
-    'localhost.localdomain',
-    'metadata.google.internal',
-]);
-const isIpv4Private = (ip) => {
-    const parts = ip.split('.').map((part) => Number(part));
-    if (parts.length !== 4 ||
-        parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
-        return false;
-    }
-    const a = parts[0] ?? 0;
-    const b = parts[1] ?? 0;
-    if (a === 10) {
-        return true;
-    }
-    if (a === 127) {
-        return true;
-    }
-    if (a === 0) {
-        return true;
-    }
-    if (a === 169 && b === 254) {
-        return true;
-    }
-    if (a === 172 && b >= 16 && b <= 31) {
-        return true;
-    }
-    if (a === 192 && b === 168) {
-        return true;
-    }
-    if (a === 100 && b >= 64 && b <= 127) {
-        return true;
-    }
-    return false;
-};
-const isIpv6Private = (ip) => {
-    const normalized = ip.toLowerCase();
-    if (normalized === '::1' || normalized === '::') {
-        return true;
-    }
-    if (normalized.startsWith('fc') || normalized.startsWith('fd')) {
-        return true;
-    }
-    if (normalized.startsWith('fe80:')) {
-        return true;
-    }
-    // IPv4-mapped IPv6 (:ffff:x.x.x.x)
-    const mapped = normalized.match(/^:ffff:(\d+\.\d+\.\d+\.\d+)$/i);
-    if (mapped?.[1] !== undefined) {
-        return isIpv4Private(mapped[1]);
-    }
-    return false;
-};
-/** True when the address is loopback, private, link-local, or metadata. */
-export const isBlockedIpAddress = (address) => {
-    const family = net.isIP(address);
-    if (family === 4) {
-        return isIpv4Private(address);
-    }
-    if (family === 6) {
-        return isIpv6Private(address);
-    }
-    return true;
-};
-/**
- * Reject non-http(s) URLs, blocked hostnames, and (by default) private IPs
- * after DNS resolution. Optional `allowedHosts` is an exact hostname allowlist.
- */
-export const assertUrlSafeForFetch = async (rawUrl, options = {}) => {
-    let parsed;
-    try {
-        parsed = new URL(rawUrl);
-    }
-    catch {
-        throw new Error(`Invalid URL: ${rawUrl}`);
-    }
-    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
-        throw new Error(`Blocked URL protocol «${parsed.protocol}» (only http/https).`);
-    }
-    const hostname = parsed.hostname.toLowerCase();
-    if (hostname.length === 0) {
-        throw new Error('URL hostname is empty.');
-    }
-    if (BLOCKED_HOSTNAMES.has(hostname) ||
-        hostname.endsWith('.localhost') ||
-        hostname.endsWith('.local')) {
-        throw new Error(`Blocked hostname «${hostname}».`);
-    }
-    const allowed = options.allowedHosts?.map((host) => host.toLowerCase());
-    if (allowed !== undefined && allowed.length > 0) {
-        if (!allowed.includes(hostname)) {
-            throw new Error(`Hostname «${hostname}» is not in harness.allowedHosts.`);
-        }
-    }
-    if (net.isIP(hostname) !== 0) {
-        if (isBlockedIpAddress(hostname)) {
-            throw new Error(`Blocked IP address «${hostname}».`);
-        }
-        return parsed;
-    }
-    if (options.skipDns === true) {
-        return parsed;
-    }
-    const records = await dns.lookup(hostname, { all: true, verbatim: true });
-    if (records.length === 0) {
-        throw new Error(`DNS lookup failed for «${hostname}».`);
-    }
-    const blocked = records.find((record) => isBlockedIpAddress(record.address));
-    if (blocked !== undefined) {
-        throw new Error(`Blocked: «${hostname}» resolves to private/link-local address ${blocked.address}.`);
-    }
-    return parsed;
-};
-//# sourceMappingURL=ssrf-guard.js.map

package/vendor/server/dist/crawl/ssrf-guard.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=ssrf-guard.test.d.ts.map