open-multi-agent-kit 0.90.8 → 0.90.9

package/dist/commands/doctor-provider-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-provider-cli.js","sourceRoot":"","sources":["../../src/commands/doctor-provider-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EACN,4BAA4B,EAC5B,gBAAgB,EAChB,WAAW,GAKX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAE/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AACxD,MAAM,KAAK,GAAG,gJAAgJ,oBAAoB,iBAAiB,CAAC;AACpM,MAAM,IAAI,GAAG;IACZ,mFAAmF;IACnF,EAAE;IACF,KAAK;IACL,EAAE;IACF,qGAAqG;IACrG,4EAA4E;IAC5E,mEAAmE;IACnE,wFAAwF;IACxF,yFAAyF;IACzF,EAAE;IACF,kFAAkF;IAClF,wEAAwE;IACxE,4DAA4D;IAC5D,uGAAuG;CACvG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AA+Bb,SAAS,uBAAuB,CAAC,IAAuB,EAAgB;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;IACjE,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAClF,MAAM,KAAK,GAAG,CAAC,OAAe,EAAgB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAE9E,IAAI,UAA8B,CAAC;IACnC,IAAI,KAAK,GAAwB,CAAC,CAAC;IACnC,IAAI,OAA2B,CAAC;IAChC,IAAI,SAA6B,CAAC;IAClC,IAAI,YAAgC,CAAC;IACrC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,SAAS,GAAG,GAAuB,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACpE,KAAK,EAAE,CAAC;YACR,OAAO,KAAK,CAAC;QAAA,CACb,CAAC;QACF,IAAI,CAAC,SAAS,IAAI,GAAG,KAAK,oBAAoB,EAAE,CAAC;YAChD,UAAU,GAAG,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC,GAAG,oBAAoB,yBAAyB,CAAC,CAAC;QACjF,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC7C,IAAI,GAAG,IAAI,CAAC;QACb,CAAC;aAAM,IAAI,GAAG,KAAK,gBAAgB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;YAC1B,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;gBACpC,OAAO,KAAK,CAAC,4EAA4E,CAAC,CAAC;YAC5F,CAAC;YACD,KAAK,GAAG,MAAM,CAAC,KAAK,CAAwB,CAAC;QAC9C,CAAC;aAAM,IAAI,GAAG,KAAK,gBAAgB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,GAAG,SAAS,EAAE,CAAC;YACtB,IAAI,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,GAAG,KAAK,kBAAkB,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;YAC1B,MAAM,aAAa,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;gBAC5D,OAAO,KAAK,CAAC,wEAAwE,CAAC,CAAC;YACxF,CAAC;YACD,SAAS,GAAG,aAAa,CAAC;QAC3B,CAAC;aAAM,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;YACpC,YAAY,GAAG,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,YAAY;gBAAE,OAAO,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACtE,CAAC;aAAM,IAAI,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1E,UAAU,GAAG,GAAG,CAAC;QAClB,CAAC;aAAM,CAAC;YACP,sEAAsE;YACtE,OAAO,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACpE,CAAC;IACF,CAAC;IACD,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClC,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,KAAK,CACX,SAAS,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,GAAG,oBAAoB,yBAAyB,CACvG,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QACrF,OAAO,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACpE,CAAC;IACD,uEAAuE;IACvE,IAAI,YAAY,KAAK,SAAS;QAAE,KAAK,GAAG,CAAC,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;AAAA,CACvF;AAED,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACxC,YAAY;IACZ,gBAAgB;IAChB,QAAQ;IACR,MAAM;IACN,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,kBAAkB;IAClB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACT,CAAC,CAAC;AACH,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAE3F,SAAS,mBAAmB,CAC3B,eAAmD,EACnD,MAA0B,EAC1B,UAAkB,EACR;IACV,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,SAAS;QAC3D,IAAI,+BAA+B,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,iBAAiB,GAAG,UAAU,KAAK,uBAAuB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,eAAe,CAAC;QAC5G,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,UAAU,MAAM,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,SAAS,kCAAkC,CAAC,QAAgB,EAAoC;IAC/F,IAAI,QAAmC,CAAC;IACxC,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;QACxB,QAAQ,KAAK,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;QAClH,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,IACC,CAAC,KAAK;YACN,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,4BAA4B,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YACrG,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,QAAQ,CAAC,GAAG,EAChC,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1F,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,OAAO,CAAC;IAAA,CACf,CAAC;AAAA,CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,IAAuB,EACvB,SAAS,GAA+B,EAAE,EACN;IACpC,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAErE,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,SAAS,CACR,IAAI,CAAC,SAAS,CACb;YACC,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,EAAE;SACxF,EACD,IAAI,EACJ,CAAC,CACD,CACD,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9E,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,6BAA6B,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpG,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;IACrD,MAAM,kBAAkB,GACvB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,kBAAkB,IAAI,kCAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE;YACjD,KAAK;YACL,OAAO;YACP,YAAY;YACZ,SAAS;YACT,QAAQ;YACR,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,SAAS;YACT,kBAAkB;SAClB,CAAC,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACR,gFAAgF;QAChF,yDAAyD;QACzD,SAAS,CACR,IAAI,CAAC,SAAS,CACb;YACC,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,wBAAwB,EAAE;SAC9F,EACD,IAAI,EACJ,CAAC,CACD,CACD,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;AAAA,CACD","sourcesContent":["/**\n * CLI entry for the provider doctor.\n *\n * Canonical form: `omk provider doctor <provider-id>` with `--level`, `--model`,\n * `--timeout`, and the Level-2 opt-in `--probe-model`. The legacy flag form\n * `omk --doctor-provider <provider-id>` (with `--doctor-level`/`--doctor-model`/\n * `--doctor-timeout`) remains a supported alias.\n *\n * Prints exactly one sanitized JSON document to stdout and reports a stable exit code:\n * 0 = diagnosis ok, 1 = diagnosis failed, 2 = usage error. Usage errors never echo\n * argument values, so mistyped invocations cannot leak credentials.\n */\n\nimport { join } from \"node:path\";\nimport { AuthStorage } from \"../core/auth-storage.ts\";\nimport { ModelRegistry } from \"../core/model-registry.ts\";\nimport {\n\tcanonicalProviderEndpointUrl,\n\tdiagnoseProvider,\n\tgetAgentDir,\n\ttype ProviderDoctorAuthHeaderResolver,\n\ttype ProviderDoctorLevel,\n\ttype ProviderDoctorResult,\n\ttype ProviderDoctorTransport,\n} from \"./doctor-provider.ts\";\nimport { createProviderDoctorTransport } from \"./doctor-provider-transport.ts\";\n\nexport const DOCTOR_PROVIDER_FLAG = \"--doctor-provider\";\nconst USAGE = `Usage: omk provider doctor <provider-id> [--level <0|1>] [--model <model-id>] [--timeout <ms>] [--probe-model <model-id>] (legacy alias: omk ${DOCTOR_PROVIDER_FLAG} <provider-id>)`;\nconst HELP = [\n\t\"Provider doctor: diagnose one provider's configuration and endpoint reachability.\",\n\t\"\",\n\tUSAGE,\n\t\"\",\n\t\"  --level <0|1>             0 = static checks only (default); 1 = adds GET-only reachability probes\",\n\t\"  --model <model-id>        validate a specific model against the provider\",\n\t\"  --timeout <ms>            network probe timeout in milliseconds\",\n\t\"  --probe-model <model-id>  Level 2 (opt-in): one minimal-token generative POST probe;\",\n\t\"                            may incur provider costs and sets costWarning in the output\",\n\t\"\",\n\t\"Levels 0 and 1 are non-generative and GET-only; no tool-call probe is ever sent.\",\n\t\"Output is one sanitized JSON document (credentials are never printed).\",\n\t\"Exit codes: 0 = ok, 1 = diagnosis failed, 2 = usage error.\",\n\t\"Legacy flags --doctor-level/--doctor-model/--doctor-timeout are aliases of --level/--model/--timeout.\",\n].join(\"\\n\");\n\nexport interface DoctorProviderCliOverrides {\n\tagentDir?: string;\n\tkimiConfigPath?: string;\n\ttransport?: ProviderDoctorTransport;\n\t/** Level-2 test seam; production uses AuthStorage + ModelRegistry lazily inside request dispatch. */\n\tresolveAuthHeaders?: ProviderDoctorAuthHeaderResolver;\n\twriteLine?: (line: string) => void;\n}\n\nexport interface DoctorProviderCliOutcome {\n\thandled: boolean;\n\texitCode: number;\n\tresult?: ProviderDoctorResult;\n}\n\ninterface ParsedDoctorArgs {\n\tproviderId: string;\n\tlevel: ProviderDoctorLevel;\n\tmodelId?: string;\n\ttimeoutMs?: number;\n\tprobeModelId?: string;\n}\n\ntype ParseOutcome =\n\t| { kind: \"absent\" }\n\t| { kind: \"help\" }\n\t| { kind: \"error\"; message: string }\n\t| { kind: \"ok\"; parsed: ParsedDoctorArgs };\n\nfunction parseDoctorProviderArgs(args: readonly string[]): ParseOutcome {\n\tconst canonical = args[0] === \"provider\" && args[1] === \"doctor\";\n\tif (!canonical && !args.includes(DOCTOR_PROVIDER_FLAG)) return { kind: \"absent\" };\n\tconst error = (message: string): ParseOutcome => ({ kind: \"error\", message });\n\n\tlet providerId: string | undefined;\n\tlet level: ProviderDoctorLevel = 0;\n\tlet modelId: string | undefined;\n\tlet timeoutMs: number | undefined;\n\tlet probeModelId: string | undefined;\n\tlet help = false;\n\tconst rest = canonical ? args.slice(2) : args;\n\tfor (let index = 0; index < rest.length; index++) {\n\t\tconst arg = rest[index];\n\t\tconst takeValue = (): string | undefined => {\n\t\t\tconst value = rest[index + 1];\n\t\t\tif (value === undefined || value.startsWith(\"--\")) return undefined;\n\t\t\tindex++;\n\t\t\treturn value;\n\t\t};\n\t\tif (!canonical && arg === DOCTOR_PROVIDER_FLAG) {\n\t\t\tproviderId = takeValue();\n\t\t\tif (!providerId) return error(`${DOCTOR_PROVIDER_FLAG} requires a provider id`);\n\t\t} else if (arg === \"--help\" || arg === \"-h\") {\n\t\t\thelp = true;\n\t\t} else if (arg === \"--doctor-level\" || arg === \"--level\") {\n\t\t\tconst value = takeValue();\n\t\t\tif (value !== \"0\" && value !== \"1\") {\n\t\t\t\treturn error(\"--level/--doctor-level must be 0 or 1; Level 2 runs only via --probe-model\");\n\t\t\t}\n\t\t\tlevel = Number(value) as ProviderDoctorLevel;\n\t\t} else if (arg === \"--doctor-model\" || arg === \"--model\") {\n\t\t\tmodelId = takeValue();\n\t\t\tif (!modelId) return error(\"--model/--doctor-model requires a model id\");\n\t\t} else if (arg === \"--doctor-timeout\" || arg === \"--timeout\") {\n\t\t\tconst value = takeValue();\n\t\t\tconst parsedTimeout = value === undefined ? Number.NaN : Number(value);\n\t\t\tif (!Number.isInteger(parsedTimeout) || parsedTimeout <= 0) {\n\t\t\t\treturn error(\"--timeout/--doctor-timeout requires a positive integer of milliseconds\");\n\t\t\t}\n\t\t\ttimeoutMs = parsedTimeout;\n\t\t} else if (arg === \"--probe-model\") {\n\t\t\tprobeModelId = takeValue();\n\t\t\tif (!probeModelId) return error(\"--probe-model requires a model id\");\n\t\t} else if (canonical && providerId === undefined && !arg.startsWith(\"-\")) {\n\t\t\tproviderId = arg;\n\t\t} else {\n\t\t\t// Never echo the offending argument: it may carry a credential value.\n\t\t\treturn error(\"unexpected extra arguments in provider doctor mode\");\n\t\t}\n\t}\n\tif (help) return { kind: \"help\" };\n\tif (!providerId) {\n\t\treturn error(\n\t\t\tcanonical ? \"provider doctor requires a provider id\" : `${DOCTOR_PROVIDER_FLAG} requires a provider id`,\n\t\t);\n\t}\n\tif (modelId !== undefined && probeModelId !== undefined && modelId !== probeModelId) {\n\t\treturn error(\"--model and --probe-model must name the same model\");\n\t}\n\t// Level 2 is reachable only through the explicit --probe-model opt-in.\n\tif (probeModelId !== undefined) level = 2;\n\treturn { kind: \"ok\", parsed: { providerId, level, modelId, timeoutMs, probeModelId } };\n}\n\nconst STRIPPED_REQUEST_HEADERS = new Set([\n\t\"connection\",\n\t\"content-length\",\n\t\"expect\",\n\t\"host\",\n\t\"keep-alive\",\n\t\"proxy-authenticate\",\n\t\"proxy-authorization\",\n\t\"proxy-connection\",\n\t\"te\",\n\t\"trailer\",\n\t\"transfer-encoding\",\n\t\"upgrade\",\n]);\nconst SINGLE_VALUE_CREDENTIAL_HEADERS = new Set([\"authorization\", \"cf-aig-authorization\"]);\n\nfunction safeResolvedHeaders(\n\tresolvedHeaders: Record<string, string> | undefined,\n\tapiKey: string | undefined,\n\tproviderId: string,\n): Headers {\n\tconst headers = new Headers();\n\tconst names = new Set<string>();\n\tfor (const [name, value] of Object.entries(resolvedHeaders ?? {})) {\n\t\tconst normalizedName = name.toLowerCase();\n\t\tif (STRIPPED_REQUEST_HEADERS.has(normalizedName)) continue;\n\t\tif (SINGLE_VALUE_CREDENTIAL_HEADERS.has(normalizedName) && names.has(normalizedName)) {\n\t\t\tthrow new Error(\"provider auth headers conflict\");\n\t\t}\n\t\tnames.add(normalizedName);\n\t\theaders.set(name, value);\n\t}\n\tif (apiKey) {\n\t\tconst authorizationName = providerId === \"cloudflare-ai-gateway\" ? \"cf-aig-authorization\" : \"authorization\";\n\t\tif (!headers.has(authorizationName)) headers.set(authorizationName, `Bearer ${apiKey}`);\n\t}\n\treturn headers;\n}\n\nfunction createProductionAuthHeaderResolver(agentDir: string): ProviderDoctorAuthHeaderResolver {\n\tlet registry: ModelRegistry | undefined;\n\treturn async (target) => {\n\t\tregistry ??= ModelRegistry.create(AuthStorage.create(join(agentDir, \"auth.json\")), join(agentDir, \"models.json\"));\n\t\tconst modelId = target.endpoint.modelId;\n\t\tconst model = modelId ? registry.find(target.providerId, modelId) : undefined;\n\t\tif (\n\t\t\t!model ||\n\t\t\tcanonicalProviderEndpointUrl(model.baseUrl) !== canonicalProviderEndpointUrl(target.endpoint.baseUrl) ||\n\t\t\tmodel.api !== target.endpoint.api\n\t\t) {\n\t\t\tthrow new Error(\"provider auth model unavailable\");\n\t\t}\n\n\t\tconst resolved = await registry.getApiKeyAndHeaders(model);\n\t\tif (!resolved.ok) throw new Error(\"provider auth unavailable\");\n\t\tconst headers = safeResolvedHeaders(resolved.headers, resolved.apiKey, target.providerId);\n\t\tif (target.auth.present && !resolved.apiKey && [...headers].length === 0) {\n\t\t\tthrow new Error(\"provider auth unavailable\");\n\t\t}\n\t\treturn headers;\n\t};\n}\n\n/**\n * Runs the provider doctor when argv is `provider doctor ...` or contains `--doctor-provider`.\n * Returns `{ handled: false }` untouched argv so the regular CLI flow continues.\n */\nexport async function runDoctorProviderCli(\n\targs: readonly string[],\n\toverrides: DoctorProviderCliOverrides = {},\n): Promise<DoctorProviderCliOutcome> {\n\tconst parsed = parseDoctorProviderArgs(args);\n\tif (parsed.kind === \"absent\") return { handled: false, exitCode: 0 };\n\n\tconst writeLine = overrides.writeLine ?? ((line: string) => console.log(line));\n\tif (parsed.kind === \"help\") {\n\t\twriteLine(HELP);\n\t\treturn { handled: true, exitCode: 0 };\n\t}\n\tif (parsed.kind === \"error\") {\n\t\twriteLine(\n\t\t\tJSON.stringify(\n\t\t\t\t{\n\t\t\t\t\tstatus: \"fail\",\n\t\t\t\t\terror: { category: \"config\", code: \"cli-usage\", message: `${parsed.message}. ${USAGE}` },\n\t\t\t\t},\n\t\t\t\tnull,\n\t\t\t\t2,\n\t\t\t),\n\t\t);\n\t\treturn { handled: true, exitCode: 2 };\n\t}\n\n\tconst { providerId, level, modelId, timeoutMs, probeModelId } = parsed.parsed;\n\tconst transport = overrides.transport ?? (level >= 1 ? createProviderDoctorTransport() : undefined);\n\tconst agentDir = overrides.agentDir ?? getAgentDir();\n\tconst resolveAuthHeaders =\n\t\tlevel === 2 ? (overrides.resolveAuthHeaders ?? createProductionAuthHeaderResolver(agentDir)) : undefined;\n\ttry {\n\t\tconst result = await diagnoseProvider(providerId, {\n\t\t\tlevel,\n\t\t\tmodelId,\n\t\t\tprobeModelId,\n\t\t\ttimeoutMs,\n\t\t\tagentDir,\n\t\t\tkimiConfigPath: overrides.kimiConfigPath,\n\t\t\ttransport,\n\t\t\tresolveAuthHeaders,\n\t\t});\n\t\twriteLine(JSON.stringify(result, null, 2));\n\t\treturn { handled: true, exitCode: result.status === \"ok\" ? 0 : 1, result };\n\t} catch {\n\t\t// diagnoseProvider maps every failure internally; this is fail-closed insurance\n\t\t// with a fixed message so nothing sensitive can surface.\n\t\twriteLine(\n\t\t\tJSON.stringify(\n\t\t\t\t{\n\t\t\t\t\tstatus: \"fail\",\n\t\t\t\t\terror: { category: \"unknown\", code: \"unexpected-response\", message: \"Provider doctor failed\" },\n\t\t\t\t},\n\t\t\t\tnull,\n\t\t\t\t2,\n\t\t\t),\n\t\t);\n\t\treturn { handled: true, exitCode: 1 };\n\t}\n}\n"]}

package/dist/commands/doctor-provider-transport.d.ts

@@ -0,0 +1,35 @@
+/**
+ * First-party Level-1/Level-2 transport for the provider doctor.
+ *
+ * Safety properties:
+ * - GET, plus bounded JSON POST for the opt-in Level-2 model probe; redirects are
+ *   never followed (the raw 3xx status is returned).
+ * - POST bodies are capped, must be JSON, and are never echoed anywhere.
+ * - The response is dropped as soon as the status line arrives: no body, headers,
+ *   or error details ever leave this module, and thrown errors use fixed messages.
+ * - Loopback-only policies require every resolved address to be loopback.
+ * - Public policies validate every resolved address against the doctor blocklist and
+ *   pin the socket to one validated address; the hostname is never re-resolved
+ *   (DNS-rebinding safe) and TLS identity is still checked against the original hostname.
+ */
+import { type Socket } from "node:net";
+import { type ProviderDoctorTransport } from "./doctor-provider.ts";
+/** Resolves a hostname to every address it maps to. */
+export type ProviderDoctorLookup = (hostname: string) => Promise<readonly string[]>;
+/** The validated connection target handed to the test-only socket seam. */
+export interface ProviderDoctorPinnedConnection {
+    address: string;
+    port: number;
+    hostname: string;
+}
+export interface ProviderDoctorTransportOptions {
+    /** DNS resolver returning every address for a hostname. Defaults to node:dns lookup({ all: true }). */
+    lookup?: ProviderDoctorLookup;
+    /**
+     * Test-only seam (plain http) that builds the socket for a validated, pinned address.
+     * Production requests always dial the pinned address directly.
+     */
+    createConnection?: (pinned: ProviderDoctorPinnedConnection) => Socket;
+}
+export declare function createProviderDoctorTransport(options?: ProviderDoctorTransportOptions): ProviderDoctorTransport;
+//# sourceMappingURL=doctor-provider-transport.d.ts.map

package/dist/commands/doctor-provider-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-provider-transport.d.ts","sourceRoot":"","sources":["../../src/commands/doctor-provider-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EAAQ,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAE7C,OAAO,EAKN,KAAK,uBAAuB,EAG5B,MAAM,sBAAsB,CAAC;AAE9B,uDAAuD;AACvD,MAAM,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAEpF,2EAA2E;AAC3E,MAAM,WAAW,8BAA8B;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,8BAA8B;IAC9C,uGAAuG;IACvG,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,8BAA8B,KAAK,MAAM,CAAC;CACtE;AA2DD,wBAAgB,6BAA6B,CAAC,OAAO,GAAE,8BAAmC,GAAG,uBAAuB,CA+GnH","sourcesContent":["/**\n * First-party Level-1/Level-2 transport for the provider doctor.\n *\n * Safety properties:\n * - GET, plus bounded JSON POST for the opt-in Level-2 model probe; redirects are\n *   never followed (the raw 3xx status is returned).\n * - POST bodies are capped, must be JSON, and are never echoed anywhere.\n * - The response is dropped as soon as the status line arrives: no body, headers,\n *   or error details ever leave this module, and thrown errors use fixed messages.\n * - Loopback-only policies require every resolved address to be loopback.\n * - Public policies validate every resolved address against the doctor blocklist and\n *   pin the socket to one validated address; the hostname is never re-resolved\n *   (DNS-rebinding safe) and TLS identity is still checked against the original hostname.\n */\n\nimport { lookup as dnsLookup } from \"node:dns/promises\";\nimport { request as httpRequest, type RequestOptions } from \"node:http\";\nimport { request as httpsRequest } from \"node:https\";\nimport { isIP, type Socket } from \"node:net\";\nimport { checkServerIdentity } from \"node:tls\";\nimport {\n\tisBlockedPublicAddress,\n\tisLoopbackAddress,\n\tnormalizedUrlHostname,\n\tProviderDoctorAuthMaterializationError,\n\ttype ProviderDoctorTransport,\n\ttype ProviderDoctorTransportRequest,\n\ttype ProviderDoctorTransportResponse,\n} from \"./doctor-provider.ts\";\n\n/** Resolves a hostname to every address it maps to. */\nexport type ProviderDoctorLookup = (hostname: string) => Promise<readonly string[]>;\n\n/** The validated connection target handed to the test-only socket seam. */\nexport interface ProviderDoctorPinnedConnection {\n\taddress: string;\n\tport: number;\n\thostname: string;\n}\n\nexport interface ProviderDoctorTransportOptions {\n\t/** DNS resolver returning every address for a hostname. Defaults to node:dns lookup({ all: true }). */\n\tlookup?: ProviderDoctorLookup;\n\t/**\n\t * Test-only seam (plain http) that builds the socket for a validated, pinned address.\n\t * Production requests always dial the pinned address directly.\n\t */\n\tcreateConnection?: (pinned: ProviderDoctorPinnedConnection) => Socket;\n}\n\nconst SCHEME_UNSUPPORTED = \"provider doctor transport rejected an unsupported URL scheme\";\nconst METHOD_UNSUPPORTED = \"provider doctor transport only performs GET and bounded POST requests\";\nconst REQUEST_SHAPE_INVALID = \"provider doctor transport rejected an invalid request shape\";\nconst MAX_POST_BODY_BYTES = 4_096;\nconst RESOLUTION_FAILED = \"provider doctor transport could not resolve the endpoint hostname\";\nconst RESOLUTION_BLOCKED = \"provider doctor transport blocked hostname re-resolution\";\nconst ADDRESS_BLOCKED = \"provider doctor transport blocked a resolved address by policy\";\nconst REQUEST_FAILED = \"provider doctor transport request failed\";\nconst REQUEST_ABORTED = \"provider doctor transport request was aborted\";\nconst STRIPPED_REQUEST_HEADERS = new Set([\n\t\"connection\",\n\t\"content-length\",\n\t\"expect\",\n\t\"host\",\n\t\"keep-alive\",\n\t\"proxy-authenticate\",\n\t\"proxy-authorization\",\n\t\"proxy-connection\",\n\t\"te\",\n\t\"trailer\",\n\t\"transfer-encoding\",\n\t\"upgrade\",\n]);\nconst SINGLE_VALUE_CREDENTIAL_HEADERS = new Set([\"authorization\", \"cf-aig-authorization\"]);\nconst ADDITIONAL_AUTHORIZATION_VALUE = /,\\s*[!#$%&'*+.^_`|~0-9A-Za-z-]+\\s+/;\n\nconst defaultLookup: ProviderDoctorLookup = async (hostname) => {\n\tconst results = await dnsLookup(hostname, { all: true, verbatim: true });\n\treturn results.map((result) => result.address);\n};\n\nasync function resolveAddresses(hostname: string, lookup: ProviderDoctorLookup): Promise<readonly string[]> {\n\tif (isIP(hostname) !== 0) return [hostname];\n\tlet addresses: readonly string[];\n\ttry {\n\t\taddresses = await lookup(hostname);\n\t} catch {\n\t\tthrow new Error(RESOLUTION_FAILED);\n\t}\n\tif (addresses.length === 0) throw new Error(RESOLUTION_FAILED);\n\treturn addresses;\n}\n\nfunction assertRequestActive(signal: AbortSignal): void {\n\tif (signal.aborted) throw new Error(REQUEST_ABORTED);\n}\n\nfunction assertAddressesAllowed(\n\taddresses: readonly string[],\n\tpolicy: ProviderDoctorTransportRequest[\"addressPolicy\"],\n): void {\n\tfor (const address of addresses) {\n\t\tconst allowed = policy.kind === \"loopback-only\" ? isLoopbackAddress(address) : !isBlockedPublicAddress(address);\n\t\tif (!allowed) throw new Error(ADDRESS_BLOCKED);\n\t}\n}\n\nexport function createProviderDoctorTransport(options: ProviderDoctorTransportOptions = {}): ProviderDoctorTransport {\n\tconst lookup = options.lookup ?? defaultLookup;\n\n\treturn {\n\t\tpinsResolvedAddress: true,\n\t\tasync request(request: ProviderDoctorTransportRequest): Promise<ProviderDoctorTransportResponse> {\n\t\t\tassertRequestActive(request.signal);\n\t\t\tconst isPost = request.method === \"POST\";\n\t\t\tif (request.method !== \"GET\" && !isPost) throw new Error(METHOD_UNSUPPORTED);\n\t\t\tif (!isPost && request.body !== undefined) throw new Error(REQUEST_SHAPE_INVALID);\n\t\t\tif (isPost) {\n\t\t\t\tif (typeof request.body !== \"string\" || request.contentType !== \"application/json\") {\n\t\t\t\t\tthrow new Error(REQUEST_SHAPE_INVALID);\n\t\t\t\t}\n\t\t\t\tif (Buffer.byteLength(request.body, \"utf-8\") > MAX_POST_BODY_BYTES) {\n\t\t\t\t\tthrow new Error(REQUEST_SHAPE_INVALID);\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst url = request.url;\n\t\t\tconst isHttps = url.protocol === \"https:\";\n\t\t\tif (!isHttps && url.protocol !== \"http:\") throw new Error(SCHEME_UNSUPPORTED);\n\n\t\t\tconst hostname = normalizedUrlHostname(url);\n\t\t\tconst addresses = await resolveAddresses(hostname, lookup);\n\t\t\tassertAddressesAllowed(addresses, request.addressPolicy);\n\t\t\tassertRequestActive(request.signal);\n\t\t\tconst pinned = addresses[0];\n\t\t\tconst port = url.port.length > 0 ? Number(url.port) : isHttps ? 443 : 80;\n\n\t\t\tlet materializedHeaders: Headers;\n\t\t\ttry {\n\t\t\t\tmaterializedHeaders = await request.createHeaders();\n\t\t\t} catch {\n\t\t\t\tthrow new ProviderDoctorAuthMaterializationError();\n\t\t\t}\n\t\t\tassertRequestActive(request.signal);\n\t\t\tconst headers: Record<string, string> = {};\n\t\t\tfor (const [name, value] of materializedHeaders) {\n\t\t\t\tconst normalizedName = name.toLowerCase();\n\t\t\t\tif (STRIPPED_REQUEST_HEADERS.has(normalizedName)) continue;\n\t\t\t\tif (SINGLE_VALUE_CREDENTIAL_HEADERS.has(normalizedName) && ADDITIONAL_AUTHORIZATION_VALUE.test(value)) {\n\t\t\t\t\tthrow new ProviderDoctorAuthMaterializationError();\n\t\t\t\t}\n\t\t\t\theaders[normalizedName] = value;\n\t\t\t}\n\t\t\theaders.host = url.host;\n\t\t\tif (isPost) {\n\t\t\t\theaders[\"content-type\"] = \"application/json\";\n\t\t\t\theaders[\"content-length\"] = String(Buffer.byteLength(request.body as string, \"utf-8\"));\n\t\t\t}\n\n\t\t\tconst base: RequestOptions = {\n\t\t\t\tmethod: request.method,\n\t\t\t\tpath: `${url.pathname}${url.search}`,\n\t\t\t\theaders,\n\t\t\t\tsignal: request.signal,\n\t\t\t\tsetHost: false,\n\t\t\t};\n\t\t\tconst seam = options.createConnection;\n\t\t\tconst requestOptions: RequestOptions = seam\n\t\t\t\t? { ...base, createConnection: () => seam({ address: pinned, port, hostname }) }\n\t\t\t\t: {\n\t\t\t\t\t\t...base,\n\t\t\t\t\t\thost: pinned,\n\t\t\t\t\t\tport,\n\t\t\t\t\t\tagent: false,\n\t\t\t\t\t\t// Fail closed if anything below ever tries to resolve a name again.\n\t\t\t\t\t\tlookup: (_hostname, lookupOptions, callback) => {\n\t\t\t\t\t\t\tconst done = typeof lookupOptions === \"function\" ? lookupOptions : callback;\n\t\t\t\t\t\t\t(done as (error: Error) => void)(new Error(RESOLUTION_BLOCKED));\n\t\t\t\t\t\t},\n\t\t\t\t\t\t...(isHttps\n\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\tservername: isIP(hostname) === 0 ? hostname : \"\",\n\t\t\t\t\t\t\t\t\tcheckServerIdentity: (\n\t\t\t\t\t\t\t\t\t\t_host: string,\n\t\t\t\t\t\t\t\t\t\tcertificate: Parameters<typeof checkServerIdentity>[1],\n\t\t\t\t\t\t\t\t\t) => checkServerIdentity(hostname, certificate),\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t};\n\n\t\t\tassertRequestActive(request.signal);\n\t\t\treturn new Promise<ProviderDoctorTransportResponse>((resolve, reject) => {\n\t\t\t\tlet settled = false;\n\t\t\t\tconst settle = (action: () => void): void => {\n\t\t\t\t\tif (settled) return;\n\t\t\t\t\tsettled = true;\n\t\t\t\t\taction();\n\t\t\t\t};\n\t\t\t\tif (request.signal.aborted) {\n\t\t\t\t\tsettle(() => reject(new Error(REQUEST_ABORTED)));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tconst clientRequest = (isHttps ? httpsRequest : httpRequest)(requestOptions, (response) => {\n\t\t\t\t\tconst status = response.statusCode ?? 0;\n\t\t\t\t\t// Drop the response immediately: the doctor only needs the status,\n\t\t\t\t\t// so no body is ever read or buffered (bounded by construction).\n\t\t\t\t\tresponse.destroy();\n\t\t\t\t\tsettle(() => resolve({ status }));\n\t\t\t\t});\n\t\t\t\tclientRequest.on(\"error\", () => settle(() => reject(new Error(REQUEST_FAILED))));\n\t\t\t\tif (request.signal.aborted) {\n\t\t\t\t\tclientRequest.destroy();\n\t\t\t\t\tsettle(() => reject(new Error(REQUEST_ABORTED)));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tclientRequest.end(isPost ? (request.body as string) : undefined);\n\t\t\t});\n\t\t},\n\t};\n}\n"]}

package/dist/commands/doctor-provider-transport.js

@@ -0,0 +1,185 @@
+/**
+ * First-party Level-1/Level-2 transport for the provider doctor.
+ *
+ * Safety properties:
+ * - GET, plus bounded JSON POST for the opt-in Level-2 model probe; redirects are
+ *   never followed (the raw 3xx status is returned).
+ * - POST bodies are capped, must be JSON, and are never echoed anywhere.
+ * - The response is dropped as soon as the status line arrives: no body, headers,
+ *   or error details ever leave this module, and thrown errors use fixed messages.
+ * - Loopback-only policies require every resolved address to be loopback.
+ * - Public policies validate every resolved address against the doctor blocklist and
+ *   pin the socket to one validated address; the hostname is never re-resolved
+ *   (DNS-rebinding safe) and TLS identity is still checked against the original hostname.
+ */
+import { lookup as dnsLookup } from "node:dns/promises";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { isIP } from "node:net";
+import { checkServerIdentity } from "node:tls";
+import { isBlockedPublicAddress, isLoopbackAddress, normalizedUrlHostname, ProviderDoctorAuthMaterializationError, } from "./doctor-provider.js";
+const SCHEME_UNSUPPORTED = "provider doctor transport rejected an unsupported URL scheme";
+const METHOD_UNSUPPORTED = "provider doctor transport only performs GET and bounded POST requests";
+const REQUEST_SHAPE_INVALID = "provider doctor transport rejected an invalid request shape";
+const MAX_POST_BODY_BYTES = 4_096;
+const RESOLUTION_FAILED = "provider doctor transport could not resolve the endpoint hostname";
+const RESOLUTION_BLOCKED = "provider doctor transport blocked hostname re-resolution";
+const ADDRESS_BLOCKED = "provider doctor transport blocked a resolved address by policy";
+const REQUEST_FAILED = "provider doctor transport request failed";
+const REQUEST_ABORTED = "provider doctor transport request was aborted";
+const STRIPPED_REQUEST_HEADERS = new Set([
+    "connection",
+    "content-length",
+    "expect",
+    "host",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "proxy-connection",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
+const SINGLE_VALUE_CREDENTIAL_HEADERS = new Set(["authorization", "cf-aig-authorization"]);
+const ADDITIONAL_AUTHORIZATION_VALUE = /,\s*[!#$%&'*+.^_`|~0-9A-Za-z-]+\s+/;
+const defaultLookup = async (hostname) => {
+    const results = await dnsLookup(hostname, { all: true, verbatim: true });
+    return results.map((result) => result.address);
+};
+async function resolveAddresses(hostname, lookup) {
+    if (isIP(hostname) !== 0)
+        return [hostname];
+    let addresses;
+    try {
+        addresses = await lookup(hostname);
+    }
+    catch {
+        throw new Error(RESOLUTION_FAILED);
+    }
+    if (addresses.length === 0)
+        throw new Error(RESOLUTION_FAILED);
+    return addresses;
+}
+function assertRequestActive(signal) {
+    if (signal.aborted)
+        throw new Error(REQUEST_ABORTED);
+}
+function assertAddressesAllowed(addresses, policy) {
+    for (const address of addresses) {
+        const allowed = policy.kind === "loopback-only" ? isLoopbackAddress(address) : !isBlockedPublicAddress(address);
+        if (!allowed)
+            throw new Error(ADDRESS_BLOCKED);
+    }
+}
+export function createProviderDoctorTransport(options = {}) {
+    const lookup = options.lookup ?? defaultLookup;
+    return {
+        pinsResolvedAddress: true,
+        async request(request) {
+            assertRequestActive(request.signal);
+            const isPost = request.method === "POST";
+            if (request.method !== "GET" && !isPost)
+                throw new Error(METHOD_UNSUPPORTED);
+            if (!isPost && request.body !== undefined)
+                throw new Error(REQUEST_SHAPE_INVALID);
+            if (isPost) {
+                if (typeof request.body !== "string" || request.contentType !== "application/json") {
+                    throw new Error(REQUEST_SHAPE_INVALID);
+                }
+                if (Buffer.byteLength(request.body, "utf-8") > MAX_POST_BODY_BYTES) {
+                    throw new Error(REQUEST_SHAPE_INVALID);
+                }
+            }
+            const url = request.url;
+            const isHttps = url.protocol === "https:";
+            if (!isHttps && url.protocol !== "http:")
+                throw new Error(SCHEME_UNSUPPORTED);
+            const hostname = normalizedUrlHostname(url);
+            const addresses = await resolveAddresses(hostname, lookup);
+            assertAddressesAllowed(addresses, request.addressPolicy);
+            assertRequestActive(request.signal);
+            const pinned = addresses[0];
+            const port = url.port.length > 0 ? Number(url.port) : isHttps ? 443 : 80;
+            let materializedHeaders;
+            try {
+                materializedHeaders = await request.createHeaders();
+            }
+            catch {
+                throw new ProviderDoctorAuthMaterializationError();
+            }
+            assertRequestActive(request.signal);
+            const headers = {};
+            for (const [name, value] of materializedHeaders) {
+                const normalizedName = name.toLowerCase();
+                if (STRIPPED_REQUEST_HEADERS.has(normalizedName))
+                    continue;
+                if (SINGLE_VALUE_CREDENTIAL_HEADERS.has(normalizedName) && ADDITIONAL_AUTHORIZATION_VALUE.test(value)) {
+                    throw new ProviderDoctorAuthMaterializationError();
+                }
+                headers[normalizedName] = value;
+            }
+            headers.host = url.host;
+            if (isPost) {
+                headers["content-type"] = "application/json";
+                headers["content-length"] = String(Buffer.byteLength(request.body, "utf-8"));
+            }
+            const base = {
+                method: request.method,
+                path: `${url.pathname}${url.search}`,
+                headers,
+                signal: request.signal,
+                setHost: false,
+            };
+            const seam = options.createConnection;
+            const requestOptions = seam
+                ? { ...base, createConnection: () => seam({ address: pinned, port, hostname }) }
+                : {
+                    ...base,
+                    host: pinned,
+                    port,
+                    agent: false,
+                    // Fail closed if anything below ever tries to resolve a name again.
+                    lookup: (_hostname, lookupOptions, callback) => {
+                        const done = typeof lookupOptions === "function" ? lookupOptions : callback;
+                        done(new Error(RESOLUTION_BLOCKED));
+                    },
+                    ...(isHttps
+                        ? {
+                            servername: isIP(hostname) === 0 ? hostname : "",
+                            checkServerIdentity: (_host, certificate) => checkServerIdentity(hostname, certificate),
+                        }
+                        : {}),
+                };
+            assertRequestActive(request.signal);
+            return new Promise((resolve, reject) => {
+                let settled = false;
+                const settle = (action) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    action();
+                };
+                if (request.signal.aborted) {
+                    settle(() => reject(new Error(REQUEST_ABORTED)));
+                    return;
+                }
+                const clientRequest = (isHttps ? httpsRequest : httpRequest)(requestOptions, (response) => {
+                    const status = response.statusCode ?? 0;
+                    // Drop the response immediately: the doctor only needs the status,
+                    // so no body is ever read or buffered (bounded by construction).
+                    response.destroy();
+                    settle(() => resolve({ status }));
+                });
+                clientRequest.on("error", () => settle(() => reject(new Error(REQUEST_FAILED))));
+                if (request.signal.aborted) {
+                    clientRequest.destroy();
+                    settle(() => reject(new Error(REQUEST_ABORTED)));
+                    return;
+                }
+                clientRequest.end(isPost ? request.body : undefined);
+            });
+        },
+    };
+}
+//# sourceMappingURL=doctor-provider-transport.js.map

package/dist/commands/doctor-provider-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-provider-transport.js","sourceRoot":"","sources":["../../src/commands/doctor-provider-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAuB,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,IAAI,EAAe,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EACN,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EACrB,sCAAsC,GAItC,MAAM,sBAAsB,CAAC;AAsB9B,MAAM,kBAAkB,GAAG,8DAA8D,CAAC;AAC1F,MAAM,kBAAkB,GAAG,uEAAuE,CAAC;AACnG,MAAM,qBAAqB,GAAG,6DAA6D,CAAC;AAC5F,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,iBAAiB,GAAG,mEAAmE,CAAC;AAC9F,MAAM,kBAAkB,GAAG,0DAA0D,CAAC;AACtF,MAAM,eAAe,GAAG,gEAAgE,CAAC;AACzF,MAAM,cAAc,GAAG,0CAA0C,CAAC;AAClE,MAAM,eAAe,GAAG,+CAA+C,CAAC;AACxE,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACxC,YAAY;IACZ,gBAAgB;IAChB,QAAQ;IACR,MAAM;IACN,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,kBAAkB;IAClB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACT,CAAC,CAAC;AACH,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAC3F,MAAM,8BAA8B,GAAG,oCAAoC,CAAC;AAE5E,MAAM,aAAa,GAAyB,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAAA,CAC/C,CAAC;AAEF,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,MAA4B,EAA8B;IAC3G,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,SAA4B,CAAC;IACjC,IAAI,CAAC;QACJ,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC/D,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,mBAAmB,CAAC,MAAmB,EAAQ;IACvD,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;AAAA,CACrD;AAED,SAAS,sBAAsB,CAC9B,SAA4B,EAC5B,MAAuD,EAChD;IACP,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAChH,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IAChD,CAAC;AAAA,CACD;AAED,MAAM,UAAU,6BAA6B,CAAC,OAAO,GAAmC,EAAE,EAA2B;IACpH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAE/C,OAAO;QACN,mBAAmB,EAAE,IAAI;QACzB,KAAK,CAAC,OAAO,CAAC,OAAuC,EAA4C;YAChG,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;YACzC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAC7E,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAClF,IAAI,MAAM,EAAE,CAAC;gBACZ,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,KAAK,kBAAkB,EAAE,CAAC;oBACpF,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBACxC,CAAC;gBACD,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,mBAAmB,EAAE,CAAC;oBACpE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBACxC,CAAC;YACF,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAC1C,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAE9E,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC3D,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YACzD,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAEzE,IAAI,mBAA4B,CAAC;YACjC,IAAI,CAAC;gBACJ,mBAAmB,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACR,MAAM,IAAI,sCAAsC,EAAE,CAAC;YACpD,CAAC;YACD,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,mBAAmB,EAAE,CAAC;gBACjD,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC1C,IAAI,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC;oBAAE,SAAS;gBAC3D,IAAI,+BAA+B,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACvG,MAAM,IAAI,sCAAsC,EAAE,CAAC;gBACpD,CAAC;gBACD,OAAO,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC;YACjC,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACxB,IAAI,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;gBAC7C,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAc,EAAE,OAAO,CAAC,CAAC,CAAC;YACxF,CAAC;YAED,MAAM,IAAI,GAAmB;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;gBACpC,OAAO;gBACP,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO,EAAE,KAAK;aACd,CAAC;YACF,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC;YACtC,MAAM,cAAc,GAAmB,IAAI;gBAC1C,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE;gBAChF,CAAC,CAAC;oBACA,GAAG,IAAI;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI;oBACJ,KAAK,EAAE,KAAK;oBACZ,oEAAoE;oBACpE,MAAM,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,CAAC;wBAC/C,MAAM,IAAI,GAAG,OAAO,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;wBAC3E,IAA+B,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;oBAAA,CAChE;oBACD,GAAG,CAAC,OAAO;wBACV,CAAC,CAAC;4BACA,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;4BAChD,mBAAmB,EAAE,CACpB,KAAa,EACb,WAAsD,EACrD,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,WAAW,CAAC;yBAC/C;wBACF,CAAC,CAAC,EAAE,CAAC;iBACN,CAAC;YAEJ,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,OAAO,IAAI,OAAO,CAAkC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;gBACxE,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAQ,EAAE,CAAC;oBAC5C,IAAI,OAAO;wBAAE,OAAO;oBACpB,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM,EAAE,CAAC;gBAAA,CACT,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC5B,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;oBACjD,OAAO;gBACR,CAAC;gBACD,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;oBAC1F,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC;oBACxC,mEAAmE;oBACnE,iEAAiE;oBACjE,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACnB,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBAAA,CAClC,CAAC,CAAC;gBACH,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjF,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC5B,aAAa,CAAC,OAAO,EAAE,CAAC;oBACxB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;oBACjD,OAAO;gBACR,CAAC;gBACD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,OAAO,CAAC,IAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAAA,CACjE,CAAC,CAAC;QAAA,CACH;KACD,CAAC;AAAA,CACF","sourcesContent":["/**\n * First-party Level-1/Level-2 transport for the provider doctor.\n *\n * Safety properties:\n * - GET, plus bounded JSON POST for the opt-in Level-2 model probe; redirects are\n *   never followed (the raw 3xx status is returned).\n * - POST bodies are capped, must be JSON, and are never echoed anywhere.\n * - The response is dropped as soon as the status line arrives: no body, headers,\n *   or error details ever leave this module, and thrown errors use fixed messages.\n * - Loopback-only policies require every resolved address to be loopback.\n * - Public policies validate every resolved address against the doctor blocklist and\n *   pin the socket to one validated address; the hostname is never re-resolved\n *   (DNS-rebinding safe) and TLS identity is still checked against the original hostname.\n */\n\nimport { lookup as dnsLookup } from \"node:dns/promises\";\nimport { request as httpRequest, type RequestOptions } from \"node:http\";\nimport { request as httpsRequest } from \"node:https\";\nimport { isIP, type Socket } from \"node:net\";\nimport { checkServerIdentity } from \"node:tls\";\nimport {\n\tisBlockedPublicAddress,\n\tisLoopbackAddress,\n\tnormalizedUrlHostname,\n\tProviderDoctorAuthMaterializationError,\n\ttype ProviderDoctorTransport,\n\ttype ProviderDoctorTransportRequest,\n\ttype ProviderDoctorTransportResponse,\n} from \"./doctor-provider.ts\";\n\n/** Resolves a hostname to every address it maps to. */\nexport type ProviderDoctorLookup = (hostname: string) => Promise<readonly string[]>;\n\n/** The validated connection target handed to the test-only socket seam. */\nexport interface ProviderDoctorPinnedConnection {\n\taddress: string;\n\tport: number;\n\thostname: string;\n}\n\nexport interface ProviderDoctorTransportOptions {\n\t/** DNS resolver returning every address for a hostname. Defaults to node:dns lookup({ all: true }). */\n\tlookup?: ProviderDoctorLookup;\n\t/**\n\t * Test-only seam (plain http) that builds the socket for a validated, pinned address.\n\t * Production requests always dial the pinned address directly.\n\t */\n\tcreateConnection?: (pinned: ProviderDoctorPinnedConnection) => Socket;\n}\n\nconst SCHEME_UNSUPPORTED = \"provider doctor transport rejected an unsupported URL scheme\";\nconst METHOD_UNSUPPORTED = \"provider doctor transport only performs GET and bounded POST requests\";\nconst REQUEST_SHAPE_INVALID = \"provider doctor transport rejected an invalid request shape\";\nconst MAX_POST_BODY_BYTES = 4_096;\nconst RESOLUTION_FAILED = \"provider doctor transport could not resolve the endpoint hostname\";\nconst RESOLUTION_BLOCKED = \"provider doctor transport blocked hostname re-resolution\";\nconst ADDRESS_BLOCKED = \"provider doctor transport blocked a resolved address by policy\";\nconst REQUEST_FAILED = \"provider doctor transport request failed\";\nconst REQUEST_ABORTED = \"provider doctor transport request was aborted\";\nconst STRIPPED_REQUEST_HEADERS = new Set([\n\t\"connection\",\n\t\"content-length\",\n\t\"expect\",\n\t\"host\",\n\t\"keep-alive\",\n\t\"proxy-authenticate\",\n\t\"proxy-authorization\",\n\t\"proxy-connection\",\n\t\"te\",\n\t\"trailer\",\n\t\"transfer-encoding\",\n\t\"upgrade\",\n]);\nconst SINGLE_VALUE_CREDENTIAL_HEADERS = new Set([\"authorization\", \"cf-aig-authorization\"]);\nconst ADDITIONAL_AUTHORIZATION_VALUE = /,\\s*[!#$%&'*+.^_`|~0-9A-Za-z-]+\\s+/;\n\nconst defaultLookup: ProviderDoctorLookup = async (hostname) => {\n\tconst results = await dnsLookup(hostname, { all: true, verbatim: true });\n\treturn results.map((result) => result.address);\n};\n\nasync function resolveAddresses(hostname: string, lookup: ProviderDoctorLookup): Promise<readonly string[]> {\n\tif (isIP(hostname) !== 0) return [hostname];\n\tlet addresses: readonly string[];\n\ttry {\n\t\taddresses = await lookup(hostname);\n\t} catch {\n\t\tthrow new Error(RESOLUTION_FAILED);\n\t}\n\tif (addresses.length === 0) throw new Error(RESOLUTION_FAILED);\n\treturn addresses;\n}\n\nfunction assertRequestActive(signal: AbortSignal): void {\n\tif (signal.aborted) throw new Error(REQUEST_ABORTED);\n}\n\nfunction assertAddressesAllowed(\n\taddresses: readonly string[],\n\tpolicy: ProviderDoctorTransportRequest[\"addressPolicy\"],\n): void {\n\tfor (const address of addresses) {\n\t\tconst allowed = policy.kind === \"loopback-only\" ? isLoopbackAddress(address) : !isBlockedPublicAddress(address);\n\t\tif (!allowed) throw new Error(ADDRESS_BLOCKED);\n\t}\n}\n\nexport function createProviderDoctorTransport(options: ProviderDoctorTransportOptions = {}): ProviderDoctorTransport {\n\tconst lookup = options.lookup ?? defaultLookup;\n\n\treturn {\n\t\tpinsResolvedAddress: true,\n\t\tasync request(request: ProviderDoctorTransportRequest): Promise<ProviderDoctorTransportResponse> {\n\t\t\tassertRequestActive(request.signal);\n\t\t\tconst isPost = request.method === \"POST\";\n\t\t\tif (request.method !== \"GET\" && !isPost) throw new Error(METHOD_UNSUPPORTED);\n\t\t\tif (!isPost && request.body !== undefined) throw new Error(REQUEST_SHAPE_INVALID);\n\t\t\tif (isPost) {\n\t\t\t\tif (typeof request.body !== \"string\" || request.contentType !== \"application/json\") {\n\t\t\t\t\tthrow new Error(REQUEST_SHAPE_INVALID);\n\t\t\t\t}\n\t\t\t\tif (Buffer.byteLength(request.body, \"utf-8\") > MAX_POST_BODY_BYTES) {\n\t\t\t\t\tthrow new Error(REQUEST_SHAPE_INVALID);\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst url = request.url;\n\t\t\tconst isHttps = url.protocol === \"https:\";\n\t\t\tif (!isHttps && url.protocol !== \"http:\") throw new Error(SCHEME_UNSUPPORTED);\n\n\t\t\tconst hostname = normalizedUrlHostname(url);\n\t\t\tconst addresses = await resolveAddresses(hostname, lookup);\n\t\t\tassertAddressesAllowed(addresses, request.addressPolicy);\n\t\t\tassertRequestActive(request.signal);\n\t\t\tconst pinned = addresses[0];\n\t\t\tconst port = url.port.length > 0 ? Number(url.port) : isHttps ? 443 : 80;\n\n\t\t\tlet materializedHeaders: Headers;\n\t\t\ttry {\n\t\t\t\tmaterializedHeaders = await request.createHeaders();\n\t\t\t} catch {\n\t\t\t\tthrow new ProviderDoctorAuthMaterializationError();\n\t\t\t}\n\t\t\tassertRequestActive(request.signal);\n\t\t\tconst headers: Record<string, string> = {};\n\t\t\tfor (const [name, value] of materializedHeaders) {\n\t\t\t\tconst normalizedName = name.toLowerCase();\n\t\t\t\tif (STRIPPED_REQUEST_HEADERS.has(normalizedName)) continue;\n\t\t\t\tif (SINGLE_VALUE_CREDENTIAL_HEADERS.has(normalizedName) && ADDITIONAL_AUTHORIZATION_VALUE.test(value)) {\n\t\t\t\t\tthrow new ProviderDoctorAuthMaterializationError();\n\t\t\t\t}\n\t\t\t\theaders[normalizedName] = value;\n\t\t\t}\n\t\t\theaders.host = url.host;\n\t\t\tif (isPost) {\n\t\t\t\theaders[\"content-type\"] = \"application/json\";\n\t\t\t\theaders[\"content-length\"] = String(Buffer.byteLength(request.body as string, \"utf-8\"));\n\t\t\t}\n\n\t\t\tconst base: RequestOptions = {\n\t\t\t\tmethod: request.method,\n\t\t\t\tpath: `${url.pathname}${url.search}`,\n\t\t\t\theaders,\n\t\t\t\tsignal: request.signal,\n\t\t\t\tsetHost: false,\n\t\t\t};\n\t\t\tconst seam = options.createConnection;\n\t\t\tconst requestOptions: RequestOptions = seam\n\t\t\t\t? { ...base, createConnection: () => seam({ address: pinned, port, hostname }) }\n\t\t\t\t: {\n\t\t\t\t\t\t...base,\n\t\t\t\t\t\thost: pinned,\n\t\t\t\t\t\tport,\n\t\t\t\t\t\tagent: false,\n\t\t\t\t\t\t// Fail closed if anything below ever tries to resolve a name again.\n\t\t\t\t\t\tlookup: (_hostname, lookupOptions, callback) => {\n\t\t\t\t\t\t\tconst done = typeof lookupOptions === \"function\" ? lookupOptions : callback;\n\t\t\t\t\t\t\t(done as (error: Error) => void)(new Error(RESOLUTION_BLOCKED));\n\t\t\t\t\t\t},\n\t\t\t\t\t\t...(isHttps\n\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\tservername: isIP(hostname) === 0 ? hostname : \"\",\n\t\t\t\t\t\t\t\t\tcheckServerIdentity: (\n\t\t\t\t\t\t\t\t\t\t_host: string,\n\t\t\t\t\t\t\t\t\t\tcertificate: Parameters<typeof checkServerIdentity>[1],\n\t\t\t\t\t\t\t\t\t) => checkServerIdentity(hostname, certificate),\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t};\n\n\t\t\tassertRequestActive(request.signal);\n\t\t\treturn new Promise<ProviderDoctorTransportResponse>((resolve, reject) => {\n\t\t\t\tlet settled = false;\n\t\t\t\tconst settle = (action: () => void): void => {\n\t\t\t\t\tif (settled) return;\n\t\t\t\t\tsettled = true;\n\t\t\t\t\taction();\n\t\t\t\t};\n\t\t\t\tif (request.signal.aborted) {\n\t\t\t\t\tsettle(() => reject(new Error(REQUEST_ABORTED)));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tconst clientRequest = (isHttps ? httpsRequest : httpRequest)(requestOptions, (response) => {\n\t\t\t\t\tconst status = response.statusCode ?? 0;\n\t\t\t\t\t// Drop the response immediately: the doctor only needs the status,\n\t\t\t\t\t// so no body is ever read or buffered (bounded by construction).\n\t\t\t\t\tresponse.destroy();\n\t\t\t\t\tsettle(() => resolve({ status }));\n\t\t\t\t});\n\t\t\t\tclientRequest.on(\"error\", () => settle(() => reject(new Error(REQUEST_FAILED))));\n\t\t\t\tif (request.signal.aborted) {\n\t\t\t\t\tclientRequest.destroy();\n\t\t\t\t\tsettle(() => reject(new Error(REQUEST_ABORTED)));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tclientRequest.end(isPost ? (request.body as string) : undefined);\n\t\t\t});\n\t\t},\n\t};\n}\n"]}

package/dist/commands/doctor-provider.d.ts

@@ -1,19 +1,133 @@
-export type DoctorErrorCategory = "network" | "auth" | "model" | "config" | "unknown";
+export type ProviderOrigin = "native" | "custom-openai-compatible" | "local-proxy" | "unknown";
+export type ProviderDoctorLevel = 0 | 1 | 2;
+export type ProviderDoctorCheckStatus = "ok" | "fail" | "skipped" | "unsupported";
+export type DoctorErrorCategory = "network" | "auth" | "model" | "config" | "server" | "unknown";
+/** Exact endpoint-probe category model from the v0.90.9 design (§10.4). */
+export type EndpointProbeCategory = "ok" | "network" | "auth" | "unsupported-endpoint" | "server";
+export type EndpointProbeResult = {
+    reachable: boolean;
+    authenticated?: boolean;
+    modelsSupported?: boolean;
+    status?: number;
+    category: EndpointProbeCategory;
+};
+export type ProviderDoctorCode = "ok" | "provider-not-found" | "models-config-invalid" | "auth-config-invalid" | "kimi-config-invalid" | "unsupported-level" | "model-provider-mismatch" | "api-missing" | "api-unsupported" | "base-url-missing" | "base-url-invalid" | "url-scheme-unsupported" | "origin-unsupported" | "address-policy-blocked" | "auth-missing" | "auth-materialization-failed" | "transport-required" | "address-pinning-required" | "redirect-blocked" | "authentication-failed" | "endpoint-unsupported" | "request-aborted" | "request-timeout" | "network-failure" | "server-error" | "probe-model-required" | "probe-model-conflict" | "unexpected-response";
+export interface ProviderDoctorEndpoint {
+    baseUrl?: string;
+    api?: string;
+    modelIds?: readonly string[];
+    modelId?: string;
+}
+export type ProviderDoctorHeaderFactory = () => Headers | Promise<Headers>;
+export type ProviderDoctorAuthHeaderResolver = (target: ResolvedProviderTarget) => Headers | Promise<Headers>;
+/** Fixed-message marker used to classify auth resolution without exposing its cause. */
+export declare class ProviderDoctorAuthMaterializationError extends Error {
+    constructor();
+}
+export interface ProviderDoctorCredentialBinding {
+    origin: ProviderOrigin;
+    source: string;
+    baseUrl: string;
+    api: string;
+    modelId: string;
+}
+export interface ProviderDoctorAuth {
+    present: boolean;
+    source?: string;
+    /** Materialized by an injected transport at request time only. */
+    createHeaders?: ProviderDoctorHeaderFactory;
+    /** Exact endpoint provenance that authorizes createHeaders. */
+    binding?: ProviderDoctorCredentialBinding;
+}
+export interface ResolvedProviderTarget {
+    providerId: string;
+    origin: ProviderOrigin;
+    source: string;
+    endpoint: ProviderDoctorEndpoint;
+    auth: ProviderDoctorAuth;
+}
+/** Compatibility name for callers using the design-document terminology. */
+export type ResolvedProviderConfig = ResolvedProviderTarget;
+export type ProviderDoctorAddressPolicy = {
+    kind: "public";
+    requireAddressPinning: true;
+} | {
+    kind: "loopback-only";
+    requireAddressPinning: false;
+};
+export interface ProviderDoctorTransportRequest {
+    url: URL;
+    method: "GET" | "POST";
+    redirect: "manual";
+    signal: AbortSignal;
+    addressPolicy: ProviderDoctorAddressPolicy;
+    createHeaders: ProviderDoctorHeaderFactory;
+    /** Bounded JSON payload; present only for opt-in Level-2 POST model probes. */
+    body?: string;
+    contentType?: "application/json";
+}
+export interface ProviderDoctorTransportResponse {
+    status: number;
+}
+export interface ProviderDoctorTransport {
+    /** Public requests are rejected unless the transport enforces DNS/address pinning. */
+    pinsResolvedAddress?: boolean;
+    request(request: ProviderDoctorTransportRequest): Promise<ProviderDoctorTransportResponse>;
+}
+export interface ProviderDoctorDependencies {
+    transport?: ProviderDoctorTransport;
+    /** Level-2 only. Called by the transport immediately before each request is dispatched. */
+    resolveAuthHeaders?: ProviderDoctorAuthHeaderResolver;
+}
+export interface ProviderDoctorOptions extends ProviderDoctorDependencies {
+    level?: ProviderDoctorLevel;
+    modelId?: string;
+    /** Level-2 opt-in only: the model probed with one minimal-token generative request. */
+    probeModelId?: string;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    agentDir?: string;
+    /** Path to the Kimi CLI config TOML consulted for the kimi-coding provider. Defaults to ~/.kimi/config.toml. */
+    kimiConfigPath?: string;
+}
+export interface ProviderDoctorCheck {
+    name: string;
+    status: ProviderDoctorCheckStatus;
+    code: ProviderDoctorCode;
+    category?: DoctorErrorCategory;
+    message?: string;
+    /** Exact-category endpoint classification for network probe checks. */
+    probe?: EndpointProbeResult;
+}
 export interface ProviderDoctorResult {
     provider: string;
     status: "ok" | "fail";
+    level: ProviderDoctorLevel;
+    origin: ProviderOrigin;
+    source: string;
+    /** Sanitized URL: userinfo, query, and fragment are always removed. */
+    targetUrl?: string;
+    /** Backwards-compatible alias of targetUrl. */
     baseUrl?: string;
+    api?: string;
+    modelId?: string;
+    authPresent: boolean;
+    /** True only when an opt-in Level-2 model probe was dispatched; the request may incur provider costs. */
+    costWarning?: boolean;
     checks: ProviderDoctorCheck[];
     error?: {
         category: DoctorErrorCategory;
+        code: ProviderDoctorCode;
         message: string;
     };
 }
-export interface ProviderDoctorCheck {
-    name: string;
-    status: "ok" | "fail" | "skipped";
-    message?: string;
-}
+/** True when the literal IP address is a loopback address. Non-IP input is never loopback. */
+export declare function isLoopbackAddress(address: string): boolean;
+/** True when the literal IP address must not be dialed for a public origin. Non-IP input fails closed. */
+export declare function isBlockedPublicAddress(address: string): boolean;
 export declare function getAgentDir(): string;
-export declare function diagnoseProvider(providerId: string): Promise<ProviderDoctorResult>;
+export declare function normalizedUrlHostname(url: URL): string;
+export declare function canonicalProviderEndpointUrl(rawUrl: string | undefined): string | undefined;
+export declare function diagnoseResolvedProvider(target: ResolvedProviderTarget, options?: ProviderDoctorOptions, dependencies?: ProviderDoctorDependencies): Promise<ProviderDoctorResult>;
+export declare function diagnoseProvider(providerId: string, options?: ProviderDoctorOptions): Promise<ProviderDoctorResult>;
 //# sourceMappingURL=doctor-provider.d.ts.map