open-multi-agent-kit 0.90.7 → 0.90.9

package/dist/commands/doctor-provider-cli.js

@@ -0,0 +1,215 @@
+/**
+ * CLI entry for the provider doctor.
+ *
+ * Canonical form: `omk provider doctor <provider-id>` with `--level`, `--model`,
+ * `--timeout`, and the Level-2 opt-in `--probe-model`. The legacy flag form
+ * `omk --doctor-provider <provider-id>` (with `--doctor-level`/`--doctor-model`/
+ * `--doctor-timeout`) remains a supported alias.
+ *
+ * Prints exactly one sanitized JSON document to stdout and reports a stable exit code:
+ * 0 = diagnosis ok, 1 = diagnosis failed, 2 = usage error. Usage errors never echo
+ * argument values, so mistyped invocations cannot leak credentials.
+ */
+import { join } from "node:path";
+import { AuthStorage } from "../core/auth-storage.js";
+import { ModelRegistry } from "../core/model-registry.js";
+import { canonicalProviderEndpointUrl, diagnoseProvider, getAgentDir, } from "./doctor-provider.js";
+import { createProviderDoctorTransport } from "./doctor-provider-transport.js";
+export const DOCTOR_PROVIDER_FLAG = "--doctor-provider";
+const USAGE = `Usage: omk provider doctor <provider-id> [--level <0|1>] [--model <model-id>] [--timeout <ms>] [--probe-model <model-id>] (legacy alias: omk ${DOCTOR_PROVIDER_FLAG} <provider-id>)`;
+const HELP = [
+    "Provider doctor: diagnose one provider's configuration and endpoint reachability.",
+    "",
+    USAGE,
+    "",
+    "  --level <0|1>             0 = static checks only (default); 1 = adds GET-only reachability probes",
+    "  --model <model-id>        validate a specific model against the provider",
+    "  --timeout <ms>            network probe timeout in milliseconds",
+    "  --probe-model <model-id>  Level 2 (opt-in): one minimal-token generative POST probe;",
+    "                            may incur provider costs and sets costWarning in the output",
+    "",
+    "Levels 0 and 1 are non-generative and GET-only; no tool-call probe is ever sent.",
+    "Output is one sanitized JSON document (credentials are never printed).",
+    "Exit codes: 0 = ok, 1 = diagnosis failed, 2 = usage error.",
+    "Legacy flags --doctor-level/--doctor-model/--doctor-timeout are aliases of --level/--model/--timeout.",
+].join("\n");
+function parseDoctorProviderArgs(args) {
+    const canonical = args[0] === "provider" && args[1] === "doctor";
+    if (!canonical && !args.includes(DOCTOR_PROVIDER_FLAG))
+        return { kind: "absent" };
+    const error = (message) => ({ kind: "error", message });
+    let providerId;
+    let level = 0;
+    let modelId;
+    let timeoutMs;
+    let probeModelId;
+    let help = false;
+    const rest = canonical ? args.slice(2) : args;
+    for (let index = 0; index < rest.length; index++) {
+        const arg = rest[index];
+        const takeValue = () => {
+            const value = rest[index + 1];
+            if (value === undefined || value.startsWith("--"))
+                return undefined;
+            index++;
+            return value;
+        };
+        if (!canonical && arg === DOCTOR_PROVIDER_FLAG) {
+            providerId = takeValue();
+            if (!providerId)
+                return error(`${DOCTOR_PROVIDER_FLAG} requires a provider id`);
+        }
+        else if (arg === "--help" || arg === "-h") {
+            help = true;
+        }
+        else if (arg === "--doctor-level" || arg === "--level") {
+            const value = takeValue();
+            if (value !== "0" && value !== "1") {
+                return error("--level/--doctor-level must be 0 or 1; Level 2 runs only via --probe-model");
+            }
+            level = Number(value);
+        }
+        else if (arg === "--doctor-model" || arg === "--model") {
+            modelId = takeValue();
+            if (!modelId)
+                return error("--model/--doctor-model requires a model id");
+        }
+        else if (arg === "--doctor-timeout" || arg === "--timeout") {
+            const value = takeValue();
+            const parsedTimeout = value === undefined ? Number.NaN : Number(value);
+            if (!Number.isInteger(parsedTimeout) || parsedTimeout <= 0) {
+                return error("--timeout/--doctor-timeout requires a positive integer of milliseconds");
+            }
+            timeoutMs = parsedTimeout;
+        }
+        else if (arg === "--probe-model") {
+            probeModelId = takeValue();
+            if (!probeModelId)
+                return error("--probe-model requires a model id");
+        }
+        else if (canonical && providerId === undefined && !arg.startsWith("-")) {
+            providerId = arg;
+        }
+        else {
+            // Never echo the offending argument: it may carry a credential value.
+            return error("unexpected extra arguments in provider doctor mode");
+        }
+    }
+    if (help)
+        return { kind: "help" };
+    if (!providerId) {
+        return error(canonical ? "provider doctor requires a provider id" : `${DOCTOR_PROVIDER_FLAG} requires a provider id`);
+    }
+    if (modelId !== undefined && probeModelId !== undefined && modelId !== probeModelId) {
+        return error("--model and --probe-model must name the same model");
+    }
+    // Level 2 is reachable only through the explicit --probe-model opt-in.
+    if (probeModelId !== undefined)
+        level = 2;
+    return { kind: "ok", parsed: { providerId, level, modelId, timeoutMs, probeModelId } };
+}
+const STRIPPED_REQUEST_HEADERS = new Set([
+    "connection",
+    "content-length",
+    "expect",
+    "host",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "proxy-connection",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
+const SINGLE_VALUE_CREDENTIAL_HEADERS = new Set(["authorization", "cf-aig-authorization"]);
+function safeResolvedHeaders(resolvedHeaders, apiKey, providerId) {
+    const headers = new Headers();
+    const names = new Set();
+    for (const [name, value] of Object.entries(resolvedHeaders ?? {})) {
+        const normalizedName = name.toLowerCase();
+        if (STRIPPED_REQUEST_HEADERS.has(normalizedName))
+            continue;
+        if (SINGLE_VALUE_CREDENTIAL_HEADERS.has(normalizedName) && names.has(normalizedName)) {
+            throw new Error("provider auth headers conflict");
+        }
+        names.add(normalizedName);
+        headers.set(name, value);
+    }
+    if (apiKey) {
+        const authorizationName = providerId === "cloudflare-ai-gateway" ? "cf-aig-authorization" : "authorization";
+        if (!headers.has(authorizationName))
+            headers.set(authorizationName, `Bearer ${apiKey}`);
+    }
+    return headers;
+}
+function createProductionAuthHeaderResolver(agentDir) {
+    let registry;
+    return async (target) => {
+        registry ??= ModelRegistry.create(AuthStorage.create(join(agentDir, "auth.json")), join(agentDir, "models.json"));
+        const modelId = target.endpoint.modelId;
+        const model = modelId ? registry.find(target.providerId, modelId) : undefined;
+        if (!model ||
+            canonicalProviderEndpointUrl(model.baseUrl) !== canonicalProviderEndpointUrl(target.endpoint.baseUrl) ||
+            model.api !== target.endpoint.api) {
+            throw new Error("provider auth model unavailable");
+        }
+        const resolved = await registry.getApiKeyAndHeaders(model);
+        if (!resolved.ok)
+            throw new Error("provider auth unavailable");
+        const headers = safeResolvedHeaders(resolved.headers, resolved.apiKey, target.providerId);
+        if (target.auth.present && !resolved.apiKey && [...headers].length === 0) {
+            throw new Error("provider auth unavailable");
+        }
+        return headers;
+    };
+}
+/**
+ * Runs the provider doctor when argv is `provider doctor ...` or contains `--doctor-provider`.
+ * Returns `{ handled: false }` untouched argv so the regular CLI flow continues.
+ */
+export async function runDoctorProviderCli(args, overrides = {}) {
+    const parsed = parseDoctorProviderArgs(args);
+    if (parsed.kind === "absent")
+        return { handled: false, exitCode: 0 };
+    const writeLine = overrides.writeLine ?? ((line) => console.log(line));
+    if (parsed.kind === "help") {
+        writeLine(HELP);
+        return { handled: true, exitCode: 0 };
+    }
+    if (parsed.kind === "error") {
+        writeLine(JSON.stringify({
+            status: "fail",
+            error: { category: "config", code: "cli-usage", message: `${parsed.message}. ${USAGE}` },
+        }, null, 2));
+        return { handled: true, exitCode: 2 };
+    }
+    const { providerId, level, modelId, timeoutMs, probeModelId } = parsed.parsed;
+    const transport = overrides.transport ?? (level >= 1 ? createProviderDoctorTransport() : undefined);
+    const agentDir = overrides.agentDir ?? getAgentDir();
+    const resolveAuthHeaders = level === 2 ? (overrides.resolveAuthHeaders ?? createProductionAuthHeaderResolver(agentDir)) : undefined;
+    try {
+        const result = await diagnoseProvider(providerId, {
+            level,
+            modelId,
+            probeModelId,
+            timeoutMs,
+            agentDir,
+            kimiConfigPath: overrides.kimiConfigPath,
+            transport,
+            resolveAuthHeaders,
+        });
+        writeLine(JSON.stringify(result, null, 2));
+        return { handled: true, exitCode: result.status === "ok" ? 0 : 1, result };
+    }
+    catch {
+        // diagnoseProvider maps every failure internally; this is fail-closed insurance
+        // with a fixed message so nothing sensitive can surface.
+        writeLine(JSON.stringify({
+            status: "fail",
+            error: { category: "unknown", code: "unexpected-response", message: "Provider doctor failed" },
+        }, null, 2));
+        return { handled: true, exitCode: 1 };
+    }
+}
+//# sourceMappingURL=doctor-provider-cli.js.map

package/dist/commands/doctor-provider-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-provider-cli.js","sourceRoot":"","sources":["../../src/commands/doctor-provider-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EACN,4BAA4B,EAC5B,gBAAgB,EAChB,WAAW,GAKX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAE/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AACxD,MAAM,KAAK,GAAG,gJAAgJ,oBAAoB,iBAAiB,CAAC;AACpM,MAAM,IAAI,GAAG;IACZ,mFAAmF;IACnF,EAAE;IACF,KAAK;IACL,EAAE;IACF,qGAAqG;IACrG,4EAA4E;IAC5E,mEAAmE;IACnE,wFAAwF;IACxF,yFAAyF;IACzF,EAAE;IACF,kFAAkF;IAClF,wEAAwE;IACxE,4DAA4D;IAC5D,uGAAuG;CACvG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AA+Bb,SAAS,uBAAuB,CAAC,IAAuB,EAAgB;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;IACjE,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAClF,MAAM,KAAK,GAAG,CAAC,OAAe,EAAgB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAE9E,IAAI,UAA8B,CAAC;IACnC,IAAI,KAAK,GAAwB,CAAC,CAAC;IACnC,IAAI,OAA2B,CAAC;IAChC,IAAI,SAA6B,CAAC;IAClC,IAAI,YAAgC,CAAC;IACrC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,SAAS,GAAG,GAAuB,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACpE,KAAK,EAAE,CAAC;YACR,OAAO,KAAK,CAAC;QAAA,CACb,CAAC;QACF,IAAI,CAAC,SAAS,IAAI,GAAG,KAAK,oBAAoB,EAAE,CAAC;YAChD,UAAU,GAAG,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC,GAAG,oBAAoB,yBAAyB,CAAC,CAAC;QACjF,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC7C,IAAI,GAAG,IAAI,CAAC;QACb,CAAC;aAAM,IAAI,GAAG,KAAK,gBAAgB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;YAC1B,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;gBACpC,OAAO,KAAK,CAAC,4EAA4E,CAAC,CAAC;YAC5F,CAAC;YACD,KAAK,GAAG,MAAM,CAAC,KAAK,CAAwB,CAAC;QAC9C,CAAC;aAAM,IAAI,GAAG,KAAK,gBAAgB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,GAAG,SAAS,EAAE,CAAC;YACtB,IAAI,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,GAAG,KAAK,kBAAkB,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;YAC1B,MAAM,aAAa,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;gBAC5D,OAAO,KAAK,CAAC,wEAAwE,CAAC,CAAC;YACxF,CAAC;YACD,SAAS,GAAG,aAAa,CAAC;QAC3B,CAAC;aAAM,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;YACpC,YAAY,GAAG,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,YAAY;gBAAE,OAAO,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACtE,CAAC;aAAM,IAAI,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1E,UAAU,GAAG,GAAG,CAAC;QAClB,CAAC;aAAM,CAAC;YACP,sEAAsE;YACtE,OAAO,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACpE,CAAC;IACF,CAAC;IACD,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClC,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,KAAK,CACX,SAAS,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,GAAG,oBAAoB,yBAAyB,CACvG,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QACrF,OAAO,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACpE,CAAC;IACD,uEAAuE;IACvE,IAAI,YAAY,KAAK,SAAS;QAAE,KAAK,GAAG,CAAC,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;AAAA,CACvF;AAED,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACxC,YAAY;IACZ,gBAAgB;IAChB,QAAQ;IACR,MAAM;IACN,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,kBAAkB;IAClB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACT,CAAC,CAAC;AACH,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAE3F,SAAS,mBAAmB,CAC3B,eAAmD,EACnD,MAA0B,EAC1B,UAAkB,EACR;IACV,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,SAAS;QAC3D,IAAI,+BAA+B,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,iBAAiB,GAAG,UAAU,KAAK,uBAAuB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,eAAe,CAAC;QAC5G,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,UAAU,MAAM,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,SAAS,kCAAkC,CAAC,QAAgB,EAAoC;IAC/F,IAAI,QAAmC,CAAC;IACxC,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;QACxB,QAAQ,KAAK,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;QAClH,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,IACC,CAAC,KAAK;YACN,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,4BAA4B,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YACrG,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,QAAQ,CAAC,GAAG,EAChC,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1F,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,OAAO,CAAC;IAAA,CACf,CAAC;AAAA,CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,IAAuB,EACvB,SAAS,GAA+B,EAAE,EACN;IACpC,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAErE,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,SAAS,CACR,IAAI,CAAC,SAAS,CACb;YACC,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,EAAE;SACxF,EACD,IAAI,EACJ,CAAC,CACD,CACD,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9E,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,6BAA6B,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpG,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;IACrD,MAAM,kBAAkB,GACvB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,kBAAkB,IAAI,kCAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE;YACjD,KAAK;YACL,OAAO;YACP,YAAY;YACZ,SAAS;YACT,QAAQ;YACR,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,SAAS;YACT,kBAAkB;SAClB,CAAC,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACR,gFAAgF;QAChF,yDAAyD;QACzD,SAAS,CACR,IAAI,CAAC,SAAS,CACb;YACC,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,wBAAwB,EAAE;SAC9F,EACD,IAAI,EACJ,CAAC,CACD,CACD,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;AAAA,CACD","sourcesContent":["/**\n * CLI entry for the provider doctor.\n *\n * Canonical form: `omk provider doctor <provider-id>` with `--level`, `--model`,\n * `--timeout`, and the Level-2 opt-in `--probe-model`. The legacy flag form\n * `omk --doctor-provider <provider-id>` (with `--doctor-level`/`--doctor-model`/\n * `--doctor-timeout`) remains a supported alias.\n *\n * Prints exactly one sanitized JSON document to stdout and reports a stable exit code:\n * 0 = diagnosis ok, 1 = diagnosis failed, 2 = usage error. Usage errors never echo\n * argument values, so mistyped invocations cannot leak credentials.\n */\n\nimport { join } from \"node:path\";\nimport { AuthStorage } from \"../core/auth-storage.ts\";\nimport { ModelRegistry } from \"../core/model-registry.ts\";\nimport {\n\tcanonicalProviderEndpointUrl,\n\tdiagnoseProvider,\n\tgetAgentDir,\n\ttype ProviderDoctorAuthHeaderResolver,\n\ttype ProviderDoctorLevel,\n\ttype ProviderDoctorResult,\n\ttype ProviderDoctorTransport,\n} from \"./doctor-provider.ts\";\nimport { createProviderDoctorTransport } from \"./doctor-provider-transport.ts\";\n\nexport const DOCTOR_PROVIDER_FLAG = \"--doctor-provider\";\nconst USAGE = `Usage: omk provider doctor <provider-id> [--level <0|1>] [--model <model-id>] [--timeout <ms>] [--probe-model <model-id>] (legacy alias: omk ${DOCTOR_PROVIDER_FLAG} <provider-id>)`;\nconst HELP = [\n\t\"Provider doctor: diagnose one provider's configuration and endpoint reachability.\",\n\t\"\",\n\tUSAGE,\n\t\"\",\n\t\"  --level <0|1>             0 = static checks only (default); 1 = adds GET-only reachability probes\",\n\t\"  --model <model-id>        validate a specific model against the provider\",\n\t\"  --timeout <ms>            network probe timeout in milliseconds\",\n\t\"  --probe-model <model-id>  Level 2 (opt-in): one minimal-token generative POST probe;\",\n\t\"                            may incur provider costs and sets costWarning in the output\",\n\t\"\",\n\t\"Levels 0 and 1 are non-generative and GET-only; no tool-call probe is ever sent.\",\n\t\"Output is one sanitized JSON document (credentials are never printed).\",\n\t\"Exit codes: 0 = ok, 1 = diagnosis failed, 2 = usage error.\",\n\t\"Legacy flags --doctor-level/--doctor-model/--doctor-timeout are aliases of --level/--model/--timeout.\",\n].join(\"\\n\");\n\nexport interface DoctorProviderCliOverrides {\n\tagentDir?: string;\n\tkimiConfigPath?: string;\n\ttransport?: ProviderDoctorTransport;\n\t/** Level-2 test seam; production uses AuthStorage + ModelRegistry lazily inside request dispatch. */\n\tresolveAuthHeaders?: ProviderDoctorAuthHeaderResolver;\n\twriteLine?: (line: string) => void;\n}\n\nexport interface DoctorProviderCliOutcome {\n\thandled: boolean;\n\texitCode: number;\n\tresult?: ProviderDoctorResult;\n}\n\ninterface ParsedDoctorArgs {\n\tproviderId: string;\n\tlevel: ProviderDoctorLevel;\n\tmodelId?: string;\n\ttimeoutMs?: number;\n\tprobeModelId?: string;\n}\n\ntype ParseOutcome =\n\t| { kind: \"absent\" }\n\t| { kind: \"help\" }\n\t| { kind: \"error\"; message: string }\n\t| { kind: \"ok\"; parsed: ParsedDoctorArgs };\n\nfunction parseDoctorProviderArgs(args: readonly string[]): ParseOutcome {\n\tconst canonical = args[0] === \"provider\" && args[1] === \"doctor\";\n\tif (!canonical && !args.includes(DOCTOR_PROVIDER_FLAG)) return { kind: \"absent\" };\n\tconst error = (message: string): ParseOutcome => ({ kind: \"error\", message });\n\n\tlet providerId: string | undefined;\n\tlet level: ProviderDoctorLevel = 0;\n\tlet modelId: string | undefined;\n\tlet timeoutMs: number | undefined;\n\tlet probeModelId: string | undefined;\n\tlet help = false;\n\tconst rest = canonical ? args.slice(2) : args;\n\tfor (let index = 0; index < rest.length; index++) {\n\t\tconst arg = rest[index];\n\t\tconst takeValue = (): string | undefined => {\n\t\t\tconst value = rest[index + 1];\n\t\t\tif (value === undefined || value.startsWith(\"--\")) return undefined;\n\t\t\tindex++;\n\t\t\treturn value;\n\t\t};\n\t\tif (!canonical && arg === DOCTOR_PROVIDER_FLAG) {\n\t\t\tproviderId = takeValue();\n\t\t\tif (!providerId) return error(`${DOCTOR_PROVIDER_FLAG} requires a provider id`);\n\t\t} else if (arg === \"--help\" || arg === \"-h\") {\n\t\t\thelp = true;\n\t\t} else if (arg === \"--doctor-level\" || arg === \"--level\") {\n\t\t\tconst value = takeValue();\n\t\t\tif (value !== \"0\" && value !== \"1\") {\n\t\t\t\treturn error(\"--level/--doctor-level must be 0 or 1; Level 2 runs only via --probe-model\");\n\t\t\t}\n\t\t\tlevel = Number(value) as ProviderDoctorLevel;\n\t\t} else if (arg === \"--doctor-model\" || arg === \"--model\") {\n\t\t\tmodelId = takeValue();\n\t\t\tif (!modelId) return error(\"--model/--doctor-model requires a model id\");\n\t\t} else if (arg === \"--doctor-timeout\" || arg === \"--timeout\") {\n\t\t\tconst value = takeValue();\n\t\t\tconst parsedTimeout = value === undefined ? Number.NaN : Number(value);\n\t\t\tif (!Number.isInteger(parsedTimeout) || parsedTimeout <= 0) {\n\t\t\t\treturn error(\"--timeout/--doctor-timeout requires a positive integer of milliseconds\");\n\t\t\t}\n\t\t\ttimeoutMs = parsedTimeout;\n\t\t} else if (arg === \"--probe-model\") {\n\t\t\tprobeModelId = takeValue();\n\t\t\tif (!probeModelId) return error(\"--probe-model requires a model id\");\n\t\t} else if (canonical && providerId === undefined && !arg.startsWith(\"-\")) {\n\t\t\tproviderId = arg;\n\t\t} else {\n\t\t\t// Never echo the offending argument: it may carry a credential value.\n\t\t\treturn error(\"unexpected extra arguments in provider doctor mode\");\n\t\t}\n\t}\n\tif (help) return { kind: \"help\" };\n\tif (!providerId) {\n\t\treturn error(\n\t\t\tcanonical ? \"provider doctor requires a provider id\" : `${DOCTOR_PROVIDER_FLAG} requires a provider id`,\n\t\t);\n\t}\n\tif (modelId !== undefined && probeModelId !== undefined && modelId !== probeModelId) {\n\t\treturn error(\"--model and --probe-model must name the same model\");\n\t}\n\t// Level 2 is reachable only through the explicit --probe-model opt-in.\n\tif (probeModelId !== undefined) level = 2;\n\treturn { kind: \"ok\", parsed: { providerId, level, modelId, timeoutMs, probeModelId } };\n}\n\nconst STRIPPED_REQUEST_HEADERS = new Set([\n\t\"connection\",\n\t\"content-length\",\n\t\"expect\",\n\t\"host\",\n\t\"keep-alive\",\n\t\"proxy-authenticate\",\n\t\"proxy-authorization\",\n\t\"proxy-connection\",\n\t\"te\",\n\t\"trailer\",\n\t\"transfer-encoding\",\n\t\"upgrade\",\n]);\nconst SINGLE_VALUE_CREDENTIAL_HEADERS = new Set([\"authorization\", \"cf-aig-authorization\"]);\n\nfunction safeResolvedHeaders(\n\tresolvedHeaders: Record<string, string> | undefined,\n\tapiKey: string | undefined,\n\tproviderId: string,\n): Headers {\n\tconst headers = new Headers();\n\tconst names = new Set<string>();\n\tfor (const [name, value] of Object.entries(resolvedHeaders ?? {})) {\n\t\tconst normalizedName = name.toLowerCase();\n\t\tif (STRIPPED_REQUEST_HEADERS.has(normalizedName)) continue;\n\t\tif (SINGLE_VALUE_CREDENTIAL_HEADERS.has(normalizedName) && names.has(normalizedName)) {\n\t\t\tthrow new Error(\"provider auth headers conflict\");\n\t\t}\n\t\tnames.add(normalizedName);\n\t\theaders.set(name, value);\n\t}\n\tif (apiKey) {\n\t\tconst authorizationName = providerId === \"cloudflare-ai-gateway\" ? \"cf-aig-authorization\" : \"authorization\";\n\t\tif (!headers.has(authorizationName)) headers.set(authorizationName, `Bearer ${apiKey}`);\n\t}\n\treturn headers;\n}\n\nfunction createProductionAuthHeaderResolver(agentDir: string): ProviderDoctorAuthHeaderResolver {\n\tlet registry: ModelRegistry | undefined;\n\treturn async (target) => {\n\t\tregistry ??= ModelRegistry.create(AuthStorage.create(join(agentDir, \"auth.json\")), join(agentDir, \"models.json\"));\n\t\tconst modelId = target.endpoint.modelId;\n\t\tconst model = modelId ? registry.find(target.providerId, modelId) : undefined;\n\t\tif (\n\t\t\t!model ||\n\t\t\tcanonicalProviderEndpointUrl(model.baseUrl) !== canonicalProviderEndpointUrl(target.endpoint.baseUrl) ||\n\t\t\tmodel.api !== target.endpoint.api\n\t\t) {\n\t\t\tthrow new Error(\"provider auth model unavailable\");\n\t\t}\n\n\t\tconst resolved = await registry.getApiKeyAndHeaders(model);\n\t\tif (!resolved.ok) throw new Error(\"provider auth unavailable\");\n\t\tconst headers = safeResolvedHeaders(resolved.headers, resolved.apiKey, target.providerId);\n\t\tif (target.auth.present && !resolved.apiKey && [...headers].length === 0) {\n\t\t\tthrow new Error(\"provider auth unavailable\");\n\t\t}\n\t\treturn headers;\n\t};\n}\n\n/**\n * Runs the provider doctor when argv is `provider doctor ...` or contains `--doctor-provider`.\n * Returns `{ handled: false }` untouched argv so the regular CLI flow continues.\n */\nexport async function runDoctorProviderCli(\n\targs: readonly string[],\n\toverrides: DoctorProviderCliOverrides = {},\n): Promise<DoctorProviderCliOutcome> {\n\tconst parsed = parseDoctorProviderArgs(args);\n\tif (parsed.kind === \"absent\") return { handled: false, exitCode: 0 };\n\n\tconst writeLine = overrides.writeLine ?? ((line: string) => console.log(line));\n\tif (parsed.kind === \"help\") {\n\t\twriteLine(HELP);\n\t\treturn { handled: true, exitCode: 0 };\n\t}\n\tif (parsed.kind === \"error\") {\n\t\twriteLine(\n\t\t\tJSON.stringify(\n\t\t\t\t{\n\t\t\t\t\tstatus: \"fail\",\n\t\t\t\t\terror: { category: \"config\", code: \"cli-usage\", message: `${parsed.message}. ${USAGE}` },\n\t\t\t\t},\n\t\t\t\tnull,\n\t\t\t\t2,\n\t\t\t),\n\t\t);\n\t\treturn { handled: true, exitCode: 2 };\n\t}\n\n\tconst { providerId, level, modelId, timeoutMs, probeModelId } = parsed.parsed;\n\tconst transport = overrides.transport ?? (level >= 1 ? createProviderDoctorTransport() : undefined);\n\tconst agentDir = overrides.agentDir ?? getAgentDir();\n\tconst resolveAuthHeaders =\n\t\tlevel === 2 ? (overrides.resolveAuthHeaders ?? createProductionAuthHeaderResolver(agentDir)) : undefined;\n\ttry {\n\t\tconst result = await diagnoseProvider(providerId, {\n\t\t\tlevel,\n\t\t\tmodelId,\n\t\t\tprobeModelId,\n\t\t\ttimeoutMs,\n\t\t\tagentDir,\n\t\t\tkimiConfigPath: overrides.kimiConfigPath,\n\t\t\ttransport,\n\t\t\tresolveAuthHeaders,\n\t\t});\n\t\twriteLine(JSON.stringify(result, null, 2));\n\t\treturn { handled: true, exitCode: result.status === \"ok\" ? 0 : 1, result };\n\t} catch {\n\t\t// diagnoseProvider maps every failure internally; this is fail-closed insurance\n\t\t// with a fixed message so nothing sensitive can surface.\n\t\twriteLine(\n\t\t\tJSON.stringify(\n\t\t\t\t{\n\t\t\t\t\tstatus: \"fail\",\n\t\t\t\t\terror: { category: \"unknown\", code: \"unexpected-response\", message: \"Provider doctor failed\" },\n\t\t\t\t},\n\t\t\t\tnull,\n\t\t\t\t2,\n\t\t\t),\n\t\t);\n\t\treturn { handled: true, exitCode: 1 };\n\t}\n}\n"]}

package/dist/commands/doctor-provider-transport.d.ts

@@ -0,0 +1,35 @@
+/**
+ * First-party Level-1/Level-2 transport for the provider doctor.
+ *
+ * Safety properties:
+ * - GET, plus bounded JSON POST for the opt-in Level-2 model probe; redirects are
+ *   never followed (the raw 3xx status is returned).
+ * - POST bodies are capped, must be JSON, and are never echoed anywhere.
+ * - The response is dropped as soon as the status line arrives: no body, headers,
+ *   or error details ever leave this module, and thrown errors use fixed messages.
+ * - Loopback-only policies require every resolved address to be loopback.
+ * - Public policies validate every resolved address against the doctor blocklist and
+ *   pin the socket to one validated address; the hostname is never re-resolved
+ *   (DNS-rebinding safe) and TLS identity is still checked against the original hostname.
+ */
+import { type Socket } from "node:net";
+import { type ProviderDoctorTransport } from "./doctor-provider.ts";
+/** Resolves a hostname to every address it maps to. */
+export type ProviderDoctorLookup = (hostname: string) => Promise<readonly string[]>;
+/** The validated connection target handed to the test-only socket seam. */
+export interface ProviderDoctorPinnedConnection {
+    address: string;
+    port: number;
+    hostname: string;
+}
+export interface ProviderDoctorTransportOptions {
+    /** DNS resolver returning every address for a hostname. Defaults to node:dns lookup({ all: true }). */
+    lookup?: ProviderDoctorLookup;
+    /**
+     * Test-only seam (plain http) that builds the socket for a validated, pinned address.
+     * Production requests always dial the pinned address directly.
+     */
+    createConnection?: (pinned: ProviderDoctorPinnedConnection) => Socket;
+}
+export declare function createProviderDoctorTransport(options?: ProviderDoctorTransportOptions): ProviderDoctorTransport;
+//# sourceMappingURL=doctor-provider-transport.d.ts.map

package/dist/commands/doctor-provider-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-provider-transport.d.ts","sourceRoot":"","sources":["../../src/commands/doctor-provider-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EAAQ,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAE7C,OAAO,EAKN,KAAK,uBAAuB,EAG5B,MAAM,sBAAsB,CAAC;AAE9B,uDAAuD;AACvD,MAAM,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAEpF,2EAA2E;AAC3E,MAAM,WAAW,8BAA8B;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,8BAA8B;IAC9C,uGAAuG;IACvG,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,8BAA8B,KAAK,MAAM,CAAC;CACtE;AA2DD,wBAAgB,6BAA6B,CAAC,OAAO,GAAE,8BAAmC,GAAG,uBAAuB,CA+GnH","sourcesContent":["/**\n * First-party Level-1/Level-2 transport for the provider doctor.\n *\n * Safety properties:\n * - GET, plus bounded JSON POST for the opt-in Level-2 model probe; redirects are\n *   never followed (the raw 3xx status is returned).\n * - POST bodies are capped, must be JSON, and are never echoed anywhere.\n * - The response is dropped as soon as the status line arrives: no body, headers,\n *   or error details ever leave this module, and thrown errors use fixed messages.\n * - Loopback-only policies require every resolved address to be loopback.\n * - Public policies validate every resolved address against the doctor blocklist and\n *   pin the socket to one validated address; the hostname is never re-resolved\n *   (DNS-rebinding safe) and TLS identity is still checked against the original hostname.\n */\n\nimport { lookup as dnsLookup } from \"node:dns/promises\";\nimport { request as httpRequest, type RequestOptions } from \"node:http\";\nimport { request as httpsRequest } from \"node:https\";\nimport { isIP, type Socket } from \"node:net\";\nimport { checkServerIdentity } from \"node:tls\";\nimport {\n\tisBlockedPublicAddress,\n\tisLoopbackAddress,\n\tnormalizedUrlHostname,\n\tProviderDoctorAuthMaterializationError,\n\ttype ProviderDoctorTransport,\n\ttype ProviderDoctorTransportRequest,\n\ttype ProviderDoctorTransportResponse,\n} from \"./doctor-provider.ts\";\n\n/** Resolves a hostname to every address it maps to. */\nexport type ProviderDoctorLookup = (hostname: string) => Promise<readonly string[]>;\n\n/** The validated connection target handed to the test-only socket seam. */\nexport interface ProviderDoctorPinnedConnection {\n\taddress: string;\n\tport: number;\n\thostname: string;\n}\n\nexport interface ProviderDoctorTransportOptions {\n\t/** DNS resolver returning every address for a hostname. Defaults to node:dns lookup({ all: true }). */\n\tlookup?: ProviderDoctorLookup;\n\t/**\n\t * Test-only seam (plain http) that builds the socket for a validated, pinned address.\n\t * Production requests always dial the pinned address directly.\n\t */\n\tcreateConnection?: (pinned: ProviderDoctorPinnedConnection) => Socket;\n}\n\nconst SCHEME_UNSUPPORTED = \"provider doctor transport rejected an unsupported URL scheme\";\nconst METHOD_UNSUPPORTED = \"provider doctor transport only performs GET and bounded POST requests\";\nconst REQUEST_SHAPE_INVALID = \"provider doctor transport rejected an invalid request shape\";\nconst MAX_POST_BODY_BYTES = 4_096;\nconst RESOLUTION_FAILED = \"provider doctor transport could not resolve the endpoint hostname\";\nconst RESOLUTION_BLOCKED = \"provider doctor transport blocked hostname re-resolution\";\nconst ADDRESS_BLOCKED = \"provider doctor transport blocked a resolved address by policy\";\nconst REQUEST_FAILED = \"provider doctor transport request failed\";\nconst REQUEST_ABORTED = \"provider doctor transport request was aborted\";\nconst STRIPPED_REQUEST_HEADERS = new Set([\n\t\"connection\",\n\t\"content-length\",\n\t\"expect\",\n\t\"host\",\n\t\"keep-alive\",\n\t\"proxy-authenticate\",\n\t\"proxy-authorization\",\n\t\"proxy-connection\",\n\t\"te\",\n\t\"trailer\",\n\t\"transfer-encoding\",\n\t\"upgrade\",\n]);\nconst SINGLE_VALUE_CREDENTIAL_HEADERS = new Set([\"authorization\", \"cf-aig-authorization\"]);\nconst ADDITIONAL_AUTHORIZATION_VALUE = /,\\s*[!#$%&'*+.^_`|~0-9A-Za-z-]+\\s+/;\n\nconst defaultLookup: ProviderDoctorLookup = async (hostname) => {\n\tconst results = await dnsLookup(hostname, { all: true, verbatim: true });\n\treturn results.map((result) => result.address);\n};\n\nasync function resolveAddresses(hostname: string, lookup: ProviderDoctorLookup): Promise<readonly string[]> {\n\tif (isIP(hostname) !== 0) return [hostname];\n\tlet addresses: readonly string[];\n\ttry {\n\t\taddresses = await lookup(hostname);\n\t} catch {\n\t\tthrow new Error(RESOLUTION_FAILED);\n\t}\n\tif (addresses.length === 0) throw new Error(RESOLUTION_FAILED);\n\treturn addresses;\n}\n\nfunction assertRequestActive(signal: AbortSignal): void {\n\tif (signal.aborted) throw new Error(REQUEST_ABORTED);\n}\n\nfunction assertAddressesAllowed(\n\taddresses: readonly string[],\n\tpolicy: ProviderDoctorTransportRequest[\"addressPolicy\"],\n): void {\n\tfor (const address of addresses) {\n\t\tconst allowed = policy.kind === \"loopback-only\" ? isLoopbackAddress(address) : !isBlockedPublicAddress(address);\n\t\tif (!allowed) throw new Error(ADDRESS_BLOCKED);\n\t}\n}\n\nexport function createProviderDoctorTransport(options: ProviderDoctorTransportOptions = {}): ProviderDoctorTransport {\n\tconst lookup = options.lookup ?? defaultLookup;\n\n\treturn {\n\t\tpinsResolvedAddress: true,\n\t\tasync request(request: ProviderDoctorTransportRequest): Promise<ProviderDoctorTransportResponse> {\n\t\t\tassertRequestActive(request.signal);\n\t\t\tconst isPost = request.method === \"POST\";\n\t\t\tif (request.method !== \"GET\" && !isPost) throw new Error(METHOD_UNSUPPORTED);\n\t\t\tif (!isPost && request.body !== undefined) throw new Error(REQUEST_SHAPE_INVALID);\n\t\t\tif (isPost) {\n\t\t\t\tif (typeof request.body !== \"string\" || request.contentType !== \"application/json\") {\n\t\t\t\t\tthrow new Error(REQUEST_SHAPE_INVALID);\n\t\t\t\t}\n\t\t\t\tif (Buffer.byteLength(request.body, \"utf-8\") > MAX_POST_BODY_BYTES) {\n\t\t\t\t\tthrow new Error(REQUEST_SHAPE_INVALID);\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst url = request.url;\n\t\t\tconst isHttps = url.protocol === \"https:\";\n\t\t\tif (!isHttps && url.protocol !== \"http:\") throw new Error(SCHEME_UNSUPPORTED);\n\n\t\t\tconst hostname = normalizedUrlHostname(url);\n\t\t\tconst addresses = await resolveAddresses(hostname, lookup);\n\t\t\tassertAddressesAllowed(addresses, request.addressPolicy);\n\t\t\tassertRequestActive(request.signal);\n\t\t\tconst pinned = addresses[0];\n\t\t\tconst port = url.port.length > 0 ? Number(url.port) : isHttps ? 443 : 80;\n\n\t\t\tlet materializedHeaders: Headers;\n\t\t\ttry {\n\t\t\t\tmaterializedHeaders = await request.createHeaders();\n\t\t\t} catch {\n\t\t\t\tthrow new ProviderDoctorAuthMaterializationError();\n\t\t\t}\n\t\t\tassertRequestActive(request.signal);\n\t\t\tconst headers: Record<string, string> = {};\n\t\t\tfor (const [name, value] of materializedHeaders) {\n\t\t\t\tconst normalizedName = name.toLowerCase();\n\t\t\t\tif (STRIPPED_REQUEST_HEADERS.has(normalizedName)) continue;\n\t\t\t\tif (SINGLE_VALUE_CREDENTIAL_HEADERS.has(normalizedName) && ADDITIONAL_AUTHORIZATION_VALUE.test(value)) {\n\t\t\t\t\tthrow new ProviderDoctorAuthMaterializationError();\n\t\t\t\t}\n\t\t\t\theaders[normalizedName] = value;\n\t\t\t}\n\t\t\theaders.host = url.host;\n\t\t\tif (isPost) {\n\t\t\t\theaders[\"content-type\"] = \"application/json\";\n\t\t\t\theaders[\"content-length\"] = String(Buffer.byteLength(request.body as string, \"utf-8\"));\n\t\t\t}\n\n\t\t\tconst base: RequestOptions = {\n\t\t\t\tmethod: request.method,\n\t\t\t\tpath: `${url.pathname}${url.search}`,\n\t\t\t\theaders,\n\t\t\t\tsignal: request.signal,\n\t\t\t\tsetHost: false,\n\t\t\t};\n\t\t\tconst seam = options.createConnection;\n\t\t\tconst requestOptions: RequestOptions = seam\n\t\t\t\t? { ...base, createConnection: () => seam({ address: pinned, port, hostname }) }\n\t\t\t\t: {\n\t\t\t\t\t\t...base,\n\t\t\t\t\t\thost: pinned,\n\t\t\t\t\t\tport,\n\t\t\t\t\t\tagent: false,\n\t\t\t\t\t\t// Fail closed if anything below ever tries to resolve a name again.\n\t\t\t\t\t\tlookup: (_hostname, lookupOptions, callback) => {\n\t\t\t\t\t\t\tconst done = typeof lookupOptions === \"function\" ? lookupOptions : callback;\n\t\t\t\t\t\t\t(done as (error: Error) => void)(new Error(RESOLUTION_BLOCKED));\n\t\t\t\t\t\t},\n\t\t\t\t\t\t...(isHttps\n\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\tservername: isIP(hostname) === 0 ? hostname : \"\",\n\t\t\t\t\t\t\t\t\tcheckServerIdentity: (\n\t\t\t\t\t\t\t\t\t\t_host: string,\n\t\t\t\t\t\t\t\t\t\tcertificate: Parameters<typeof checkServerIdentity>[1],\n\t\t\t\t\t\t\t\t\t) => checkServerIdentity(hostname, certificate),\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t};\n\n\t\t\tassertRequestActive(request.signal);\n\t\t\treturn new Promise<ProviderDoctorTransportResponse>((resolve, reject) => {\n\t\t\t\tlet settled = false;\n\t\t\t\tconst settle = (action: () => void): void => {\n\t\t\t\t\tif (settled) return;\n\t\t\t\t\tsettled = true;\n\t\t\t\t\taction();\n\t\t\t\t};\n\t\t\t\tif (request.signal.aborted) {\n\t\t\t\t\tsettle(() => reject(new Error(REQUEST_ABORTED)));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tconst clientRequest = (isHttps ? httpsRequest : httpRequest)(requestOptions, (response) => {\n\t\t\t\t\tconst status = response.statusCode ?? 0;\n\t\t\t\t\t// Drop the response immediately: the doctor only needs the status,\n\t\t\t\t\t// so no body is ever read or buffered (bounded by construction).\n\t\t\t\t\tresponse.destroy();\n\t\t\t\t\tsettle(() => resolve({ status }));\n\t\t\t\t});\n\t\t\t\tclientRequest.on(\"error\", () => settle(() => reject(new Error(REQUEST_FAILED))));\n\t\t\t\tif (request.signal.aborted) {\n\t\t\t\t\tclientRequest.destroy();\n\t\t\t\t\tsettle(() => reject(new Error(REQUEST_ABORTED)));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tclientRequest.end(isPost ? (request.body as string) : undefined);\n\t\t\t});\n\t\t},\n\t};\n}\n"]}

package/dist/commands/doctor-provider-transport.js

@@ -0,0 +1,185 @@
+/**
+ * First-party Level-1/Level-2 transport for the provider doctor.
+ *
+ * Safety properties:
+ * - GET, plus bounded JSON POST for the opt-in Level-2 model probe; redirects are
+ *   never followed (the raw 3xx status is returned).
+ * - POST bodies are capped, must be JSON, and are never echoed anywhere.
+ * - The response is dropped as soon as the status line arrives: no body, headers,
+ *   or error details ever leave this module, and thrown errors use fixed messages.
+ * - Loopback-only policies require every resolved address to be loopback.
+ * - Public policies validate every resolved address against the doctor blocklist and
+ *   pin the socket to one validated address; the hostname is never re-resolved
+ *   (DNS-rebinding safe) and TLS identity is still checked against the original hostname.
+ */
+import { lookup as dnsLookup } from "node:dns/promises";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { isIP } from "node:net";
+import { checkServerIdentity } from "node:tls";
+import { isBlockedPublicAddress, isLoopbackAddress, normalizedUrlHostname, ProviderDoctorAuthMaterializationError, } from "./doctor-provider.js";
+const SCHEME_UNSUPPORTED = "provider doctor transport rejected an unsupported URL scheme";
+const METHOD_UNSUPPORTED = "provider doctor transport only performs GET and bounded POST requests";
+const REQUEST_SHAPE_INVALID = "provider doctor transport rejected an invalid request shape";
+const MAX_POST_BODY_BYTES = 4_096;
+const RESOLUTION_FAILED = "provider doctor transport could not resolve the endpoint hostname";
+const RESOLUTION_BLOCKED = "provider doctor transport blocked hostname re-resolution";
+const ADDRESS_BLOCKED = "provider doctor transport blocked a resolved address by policy";
+const REQUEST_FAILED = "provider doctor transport request failed";
+const REQUEST_ABORTED = "provider doctor transport request was aborted";
+const STRIPPED_REQUEST_HEADERS = new Set([
+    "connection",
+    "content-length",
+    "expect",
+    "host",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "proxy-connection",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
+const SINGLE_VALUE_CREDENTIAL_HEADERS = new Set(["authorization", "cf-aig-authorization"]);
+const ADDITIONAL_AUTHORIZATION_VALUE = /,\s*[!#$%&'*+.^_`|~0-9A-Za-z-]+\s+/;
+const defaultLookup = async (hostname) => {
+    const results = await dnsLookup(hostname, { all: true, verbatim: true });
+    return results.map((result) => result.address);
+};
+async function resolveAddresses(hostname, lookup) {
+    if (isIP(hostname) !== 0)
+        return [hostname];
+    let addresses;
+    try {
+        addresses = await lookup(hostname);
+    }
+    catch {
+        throw new Error(RESOLUTION_FAILED);
+    }
+    if (addresses.length === 0)
+        throw new Error(RESOLUTION_FAILED);
+    return addresses;
+}
+function assertRequestActive(signal) {
+    if (signal.aborted)
+        throw new Error(REQUEST_ABORTED);
+}
+function assertAddressesAllowed(addresses, policy) {
+    for (const address of addresses) {
+        const allowed = policy.kind === "loopback-only" ? isLoopbackAddress(address) : !isBlockedPublicAddress(address);
+        if (!allowed)
+            throw new Error(ADDRESS_BLOCKED);
+    }
+}
+export function createProviderDoctorTransport(options = {}) {
+    const lookup = options.lookup ?? defaultLookup;
+    return {
+        pinsResolvedAddress: true,
+        async request(request) {
+            assertRequestActive(request.signal);
+            const isPost = request.method === "POST";
+            if (request.method !== "GET" && !isPost)
+                throw new Error(METHOD_UNSUPPORTED);
+            if (!isPost && request.body !== undefined)
+                throw new Error(REQUEST_SHAPE_INVALID);
+            if (isPost) {
+                if (typeof request.body !== "string" || request.contentType !== "application/json") {
+                    throw new Error(REQUEST_SHAPE_INVALID);
+                }
+                if (Buffer.byteLength(request.body, "utf-8") > MAX_POST_BODY_BYTES) {
+                    throw new Error(REQUEST_SHAPE_INVALID);
+                }
+            }
+            const url = request.url;
+            const isHttps = url.protocol === "https:";
+            if (!isHttps && url.protocol !== "http:")
+                throw new Error(SCHEME_UNSUPPORTED);
+            const hostname = normalizedUrlHostname(url);
+            const addresses = await resolveAddresses(hostname, lookup);
+            assertAddressesAllowed(addresses, request.addressPolicy);
+            assertRequestActive(request.signal);
+            const pinned = addresses[0];
+            const port = url.port.length > 0 ? Number(url.port) : isHttps ? 443 : 80;
+            let materializedHeaders;
+            try {
+                materializedHeaders = await request.createHeaders();
+            }
+            catch {
+                throw new ProviderDoctorAuthMaterializationError();
+            }
+            assertRequestActive(request.signal);
+            const headers = {};
+            for (const [name, value] of materializedHeaders) {
+                const normalizedName = name.toLowerCase();
+                if (STRIPPED_REQUEST_HEADERS.has(normalizedName))
+                    continue;
+                if (SINGLE_VALUE_CREDENTIAL_HEADERS.has(normalizedName) && ADDITIONAL_AUTHORIZATION_VALUE.test(value)) {
+                    throw new ProviderDoctorAuthMaterializationError();
+                }
+                headers[normalizedName] = value;
+            }
+            headers.host = url.host;
+            if (isPost) {
+                headers["content-type"] = "application/json";
+                headers["content-length"] = String(Buffer.byteLength(request.body, "utf-8"));
+            }
+            const base = {
+                method: request.method,
+                path: `${url.pathname}${url.search}`,
+                headers,
+                signal: request.signal,
+                setHost: false,
+            };
+            const seam = options.createConnection;
+            const requestOptions = seam
+                ? { ...base, createConnection: () => seam({ address: pinned, port, hostname }) }
+                : {
+                    ...base,
+                    host: pinned,
+                    port,
+                    agent: false,
+                    // Fail closed if anything below ever tries to resolve a name again.
+                    lookup: (_hostname, lookupOptions, callback) => {
+                        const done = typeof lookupOptions === "function" ? lookupOptions : callback;
+                        done(new Error(RESOLUTION_BLOCKED));
+                    },
+                    ...(isHttps
+                        ? {
+                            servername: isIP(hostname) === 0 ? hostname : "",
+                            checkServerIdentity: (_host, certificate) => checkServerIdentity(hostname, certificate),
+                        }
+                        : {}),
+                };
+            assertRequestActive(request.signal);
+            return new Promise((resolve, reject) => {
+                let settled = false;
+                const settle = (action) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    action();
+                };
+                if (request.signal.aborted) {
+                    settle(() => reject(new Error(REQUEST_ABORTED)));
+                    return;
+                }
+                const clientRequest = (isHttps ? httpsRequest : httpRequest)(requestOptions, (response) => {
+                    const status = response.statusCode ?? 0;
+                    // Drop the response immediately: the doctor only needs the status,
+                    // so no body is ever read or buffered (bounded by construction).
+                    response.destroy();
+                    settle(() => resolve({ status }));
+                });
+                clientRequest.on("error", () => settle(() => reject(new Error(REQUEST_FAILED))));
+                if (request.signal.aborted) {
+                    clientRequest.destroy();
+                    settle(() => reject(new Error(REQUEST_ABORTED)));
+                    return;
+                }
+                clientRequest.end(isPost ? request.body : undefined);
+            });
+        },
+    };
+}
+//# sourceMappingURL=doctor-provider-transport.js.map

package/dist/commands/doctor-provider-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-provider-transport.js","sourceRoot":"","sources":["../../src/commands/doctor-provider-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAuB,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,IAAI,EAAe,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EACN,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EACrB,sCAAsC,GAItC,MAAM,sBAAsB,CAAC;AAsB9B,MAAM,kBAAkB,GAAG,8DAA8D,CAAC;AAC1F,MAAM,kBAAkB,GAAG,uEAAuE,CAAC;AACnG,MAAM,qBAAqB,GAAG,6DAA6D,CAAC;AAC5F,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,iBAAiB,GAAG,mEAAmE,CAAC;AAC9F,MAAM,kBAAkB,GAAG,0DAA0D,CAAC;AACtF,MAAM,eAAe,GAAG,gEAAgE,CAAC;AACzF,MAAM,cAAc,GAAG,0CAA0C,CAAC;AAClE,MAAM,eAAe,GAAG,+CAA+C,CAAC;AACxE,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACxC,YAAY;IACZ,gBAAgB;IAChB,QAAQ;IACR,MAAM;IACN,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,kBAAkB;IAClB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACT,CAAC,CAAC;AACH,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAC3F,MAAM,8BAA8B,GAAG,oCAAoC,CAAC;AAE5E,MAAM,aAAa,GAAyB,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAAA,CAC/C,CAAC;AAEF,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,MAA4B,EAA8B;IAC3G,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,SAA4B,CAAC;IACjC,IAAI,CAAC;QACJ,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC/D,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,mBAAmB,CAAC,MAAmB,EAAQ;IACvD,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;AAAA,CACrD;AAED,SAAS,sBAAsB,CAC9B,SAA4B,EAC5B,MAAuD,EAChD;IACP,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAChH,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IAChD,CAAC;AAAA,CACD;AAED,MAAM,UAAU,6BAA6B,CAAC,OAAO,GAAmC,EAAE,EAA2B;IACpH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAE/C,OAAO;QACN,mBAAmB,EAAE,IAAI;QACzB,KAAK,CAAC,OAAO,CAAC,OAAuC,EAA4C;YAChG,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;YACzC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAC7E,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAClF,IAAI,MAAM,EAAE,CAAC;gBACZ,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,KAAK,kBAAkB,EAAE,CAAC;oBACpF,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBACxC,CAAC;gBACD,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,mBAAmB,EAAE,CAAC;oBACpE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBACxC,CAAC;YACF,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAC1C,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAE9E,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC3D,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YACzD,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAEzE,IAAI,mBAA4B,CAAC;YACjC,IAAI,CAAC;gBACJ,mBAAmB,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACR,MAAM,IAAI,sCAAsC,EAAE,CAAC;YACpD,CAAC;YACD,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,mBAAmB,EAAE,CAAC;gBACjD,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC1C,IAAI,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC;oBAAE,SAAS;gBAC3D,IAAI,+BAA+B,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACvG,MAAM,IAAI,sCAAsC,EAAE,CAAC;gBACpD,CAAC;gBACD,OAAO,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC;YACjC,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACxB,IAAI,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;gBAC7C,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAc,EAAE,OAAO,CAAC,CAAC,CAAC;YACxF,CAAC;YAED,MAAM,IAAI,GAAmB;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;gBACpC,OAAO;gBACP,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO,EAAE,KAAK;aACd,CAAC;YACF,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC;YACtC,MAAM,cAAc,GAAmB,IAAI;gBAC1C,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE;gBAChF,CAAC,CAAC;oBACA,GAAG,IAAI;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI;oBACJ,KAAK,EAAE,KAAK;oBACZ,oEAAoE;oBACpE,MAAM,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,CAAC;wBAC/C,MAAM,IAAI,GAAG,OAAO,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;wBAC3E,IAA+B,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;oBAAA,CAChE;oBACD,GAAG,CAAC,OAAO;wBACV,CAAC,CAAC;4BACA,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;4BAChD,mBAAmB,EAAE,CACpB,KAAa,EACb,WAAsD,EACrD,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,WAAW,CAAC;yBAC/C;wBACF,CAAC,CAAC,EAAE,CAAC;iBACN,CAAC;YAEJ,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,OAAO,IAAI,OAAO,CAAkC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;gBACxE,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAQ,EAAE,CAAC;oBAC5C,IAAI,OAAO;wBAAE,OAAO;oBACpB,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM,EAAE,CAAC;gBAAA,CACT,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC5B,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;oBACjD,OAAO;gBACR,CAAC;gBACD,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;oBAC1F,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC;oBACxC,mEAAmE;oBACnE,iEAAiE;oBACjE,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACnB,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBAAA,CAClC,CAAC,CAAC;gBACH,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjF,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC5B,aAAa,CAAC,OAAO,EAAE,CAAC;oBACxB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;oBACjD,OAAO;gBACR,CAAC;gBACD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,OAAO,CAAC,IAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAAA,CACjE,CAAC,CAAC;QAAA,CACH;KACD,CAAC;AAAA,CACF","sourcesContent":["/**\n * First-party Level-1/Level-2 transport for the provider doctor.\n *\n * Safety properties:\n * - GET, plus bounded JSON POST for the opt-in Level-2 model probe; redirects are\n *   never followed (the raw 3xx status is returned).\n * - POST bodies are capped, must be JSON, and are never echoed anywhere.\n * - The response is dropped as soon as the status line arrives: no body, headers,\n *   or error details ever leave this module, and thrown errors use fixed messages.\n * - Loopback-only policies require every resolved address to be loopback.\n * - Public policies validate every resolved address against the doctor blocklist and\n *   pin the socket to one validated address; the hostname is never re-resolved\n *   (DNS-rebinding safe) and TLS identity is still checked against the original hostname.\n */\n\nimport { lookup as dnsLookup } from \"node:dns/promises\";\nimport { request as httpRequest, type RequestOptions } from \"node:http\";\nimport { request as httpsRequest } from \"node:https\";\nimport { isIP, type Socket } from \"node:net\";\nimport { checkServerIdentity } from \"node:tls\";\nimport {\n\tisBlockedPublicAddress,\n\tisLoopbackAddress,\n\tnormalizedUrlHostname,\n\tProviderDoctorAuthMaterializationError,\n\ttype ProviderDoctorTransport,\n\ttype ProviderDoctorTransportRequest,\n\ttype ProviderDoctorTransportResponse,\n} from \"./doctor-provider.ts\";\n\n/** Resolves a hostname to every address it maps to. */\nexport type ProviderDoctorLookup = (hostname: string) => Promise<readonly string[]>;\n\n/** The validated connection target handed to the test-only socket seam. */\nexport interface ProviderDoctorPinnedConnection {\n\taddress: string;\n\tport: number;\n\thostname: string;\n}\n\nexport interface ProviderDoctorTransportOptions {\n\t/** DNS resolver returning every address for a hostname. Defaults to node:dns lookup({ all: true }). */\n\tlookup?: ProviderDoctorLookup;\n\t/**\n\t * Test-only seam (plain http) that builds the socket for a validated, pinned address.\n\t * Production requests always dial the pinned address directly.\n\t */\n\tcreateConnection?: (pinned: ProviderDoctorPinnedConnection) => Socket;\n}\n\nconst SCHEME_UNSUPPORTED = \"provider doctor transport rejected an unsupported URL scheme\";\nconst METHOD_UNSUPPORTED = \"provider doctor transport only performs GET and bounded POST requests\";\nconst REQUEST_SHAPE_INVALID = \"provider doctor transport rejected an invalid request shape\";\nconst MAX_POST_BODY_BYTES = 4_096;\nconst RESOLUTION_FAILED = \"provider doctor transport could not resolve the endpoint hostname\";\nconst RESOLUTION_BLOCKED = \"provider doctor transport blocked hostname re-resolution\";\nconst ADDRESS_BLOCKED = \"provider doctor transport blocked a resolved address by policy\";\nconst REQUEST_FAILED = \"provider doctor transport request failed\";\nconst REQUEST_ABORTED = \"provider doctor transport request was aborted\";\nconst STRIPPED_REQUEST_HEADERS = new Set([\n\t\"connection\",\n\t\"content-length\",\n\t\"expect\",\n\t\"host\",\n\t\"keep-alive\",\n\t\"proxy-authenticate\",\n\t\"proxy-authorization\",\n\t\"proxy-connection\",\n\t\"te\",\n\t\"trailer\",\n\t\"transfer-encoding\",\n\t\"upgrade\",\n]);\nconst SINGLE_VALUE_CREDENTIAL_HEADERS = new Set([\"authorization\", \"cf-aig-authorization\"]);\nconst ADDITIONAL_AUTHORIZATION_VALUE = /,\\s*[!#$%&'*+.^_`|~0-9A-Za-z-]+\\s+/;\n\nconst defaultLookup: ProviderDoctorLookup = async (hostname) => {\n\tconst results = await dnsLookup(hostname, { all: true, verbatim: true });\n\treturn results.map((result) => result.address);\n};\n\nasync function resolveAddresses(hostname: string, lookup: ProviderDoctorLookup): Promise<readonly string[]> {\n\tif (isIP(hostname) !== 0) return [hostname];\n\tlet addresses: readonly string[];\n\ttry {\n\t\taddresses = await lookup(hostname);\n\t} catch {\n\t\tthrow new Error(RESOLUTION_FAILED);\n\t}\n\tif (addresses.length === 0) throw new Error(RESOLUTION_FAILED);\n\treturn addresses;\n}\n\nfunction assertRequestActive(signal: AbortSignal): void {\n\tif (signal.aborted) throw new Error(REQUEST_ABORTED);\n}\n\nfunction assertAddressesAllowed(\n\taddresses: readonly string[],\n\tpolicy: ProviderDoctorTransportRequest[\"addressPolicy\"],\n): void {\n\tfor (const address of addresses) {\n\t\tconst allowed = policy.kind === \"loopback-only\" ? isLoopbackAddress(address) : !isBlockedPublicAddress(address);\n\t\tif (!allowed) throw new Error(ADDRESS_BLOCKED);\n\t}\n}\n\nexport function createProviderDoctorTransport(options: ProviderDoctorTransportOptions = {}): ProviderDoctorTransport {\n\tconst lookup = options.lookup ?? defaultLookup;\n\n\treturn {\n\t\tpinsResolvedAddress: true,\n\t\tasync request(request: ProviderDoctorTransportRequest): Promise<ProviderDoctorTransportResponse> {\n\t\t\tassertRequestActive(request.signal);\n\t\t\tconst isPost = request.method === \"POST\";\n\t\t\tif (request.method !== \"GET\" && !isPost) throw new Error(METHOD_UNSUPPORTED);\n\t\t\tif (!isPost && request.body !== undefined) throw new Error(REQUEST_SHAPE_INVALID);\n\t\t\tif (isPost) {\n\t\t\t\tif (typeof request.body !== \"string\" || request.contentType !== \"application/json\") {\n\t\t\t\t\tthrow new Error(REQUEST_SHAPE_INVALID);\n\t\t\t\t}\n\t\t\t\tif (Buffer.byteLength(request.body, \"utf-8\") > MAX_POST_BODY_BYTES) {\n\t\t\t\t\tthrow new Error(REQUEST_SHAPE_INVALID);\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst url = request.url;\n\t\t\tconst isHttps = url.protocol === \"https:\";\n\t\t\tif (!isHttps && url.protocol !== \"http:\") throw new Error(SCHEME_UNSUPPORTED);\n\n\t\t\tconst hostname = normalizedUrlHostname(url);\n\t\t\tconst addresses = await resolveAddresses(hostname, lookup);\n\t\t\tassertAddressesAllowed(addresses, request.addressPolicy);\n\t\t\tassertRequestActive(request.signal);\n\t\t\tconst pinned = addresses[0];\n\t\t\tconst port = url.port.length > 0 ? Number(url.port) : isHttps ? 443 : 80;\n\n\t\t\tlet materializedHeaders: Headers;\n\t\t\ttry {\n\t\t\t\tmaterializedHeaders = await request.createHeaders();\n\t\t\t} catch {\n\t\t\t\tthrow new ProviderDoctorAuthMaterializationError();\n\t\t\t}\n\t\t\tassertRequestActive(request.signal);\n\t\t\tconst headers: Record<string, string> = {};\n\t\t\tfor (const [name, value] of materializedHeaders) {\n\t\t\t\tconst normalizedName = name.toLowerCase();\n\t\t\t\tif (STRIPPED_REQUEST_HEADERS.has(normalizedName)) continue;\n\t\t\t\tif (SINGLE_VALUE_CREDENTIAL_HEADERS.has(normalizedName) && ADDITIONAL_AUTHORIZATION_VALUE.test(value)) {\n\t\t\t\t\tthrow new ProviderDoctorAuthMaterializationError();\n\t\t\t\t}\n\t\t\t\theaders[normalizedName] = value;\n\t\t\t}\n\t\t\theaders.host = url.host;\n\t\t\tif (isPost) {\n\t\t\t\theaders[\"content-type\"] = \"application/json\";\n\t\t\t\theaders[\"content-length\"] = String(Buffer.byteLength(request.body as string, \"utf-8\"));\n\t\t\t}\n\n\t\t\tconst base: RequestOptions = {\n\t\t\t\tmethod: request.method,\n\t\t\t\tpath: `${url.pathname}${url.search}`,\n\t\t\t\theaders,\n\t\t\t\tsignal: request.signal,\n\t\t\t\tsetHost: false,\n\t\t\t};\n\t\t\tconst seam = options.createConnection;\n\t\t\tconst requestOptions: RequestOptions = seam\n\t\t\t\t? { ...base, createConnection: () => seam({ address: pinned, port, hostname }) }\n\t\t\t\t: {\n\t\t\t\t\t\t...base,\n\t\t\t\t\t\thost: pinned,\n\t\t\t\t\t\tport,\n\t\t\t\t\t\tagent: false,\n\t\t\t\t\t\t// Fail closed if anything below ever tries to resolve a name again.\n\t\t\t\t\t\tlookup: (_hostname, lookupOptions, callback) => {\n\t\t\t\t\t\t\tconst done = typeof lookupOptions === \"function\" ? lookupOptions : callback;\n\t\t\t\t\t\t\t(done as (error: Error) => void)(new Error(RESOLUTION_BLOCKED));\n\t\t\t\t\t\t},\n\t\t\t\t\t\t...(isHttps\n\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\tservername: isIP(hostname) === 0 ? hostname : \"\",\n\t\t\t\t\t\t\t\t\tcheckServerIdentity: (\n\t\t\t\t\t\t\t\t\t\t_host: string,\n\t\t\t\t\t\t\t\t\t\tcertificate: Parameters<typeof checkServerIdentity>[1],\n\t\t\t\t\t\t\t\t\t) => checkServerIdentity(hostname, certificate),\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t};\n\n\t\t\tassertRequestActive(request.signal);\n\t\t\treturn new Promise<ProviderDoctorTransportResponse>((resolve, reject) => {\n\t\t\t\tlet settled = false;\n\t\t\t\tconst settle = (action: () => void): void => {\n\t\t\t\t\tif (settled) return;\n\t\t\t\t\tsettled = true;\n\t\t\t\t\taction();\n\t\t\t\t};\n\t\t\t\tif (request.signal.aborted) {\n\t\t\t\t\tsettle(() => reject(new Error(REQUEST_ABORTED)));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tconst clientRequest = (isHttps ? httpsRequest : httpRequest)(requestOptions, (response) => {\n\t\t\t\t\tconst status = response.statusCode ?? 0;\n\t\t\t\t\t// Drop the response immediately: the doctor only needs the status,\n\t\t\t\t\t// so no body is ever read or buffered (bounded by construction).\n\t\t\t\t\tresponse.destroy();\n\t\t\t\t\tsettle(() => resolve({ status }));\n\t\t\t\t});\n\t\t\t\tclientRequest.on(\"error\", () => settle(() => reject(new Error(REQUEST_FAILED))));\n\t\t\t\tif (request.signal.aborted) {\n\t\t\t\t\tclientRequest.destroy();\n\t\t\t\t\tsettle(() => reject(new Error(REQUEST_ABORTED)));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tclientRequest.end(isPost ? (request.body as string) : undefined);\n\t\t\t});\n\t\t},\n\t};\n}\n"]}