import { p as finiteSecondsToTimerSafeMilliseconds } from "./number-coercion-CJQ8TR--.js";
import { x as ssrfPolicyFromHttpBaseUrlFakeIpHostnameAllowlist } from "./ssrf-CvPEXMGn.js";
import { a as withStrictGuardedFetchMode, o as withTrustedEnvProxyGuardedFetchMode, r as fetchWithSsrFGuard } from "./fetch-guard-CQ_cMV3y.js";
import { g as readPositiveIntegerParam } from "./common-BQninTbY.js";
//#region src/agents/tools/web-guarded-fetch.ts
const WEB_TOOLS_SELF_HOSTED_NETWORK_SSRF_POLICY = {
	dangerouslyAllowPrivateNetwork: true,
	allowRfc2544BenchmarkRange: true,
	allowIpv6UniqueLocalRange: true
};
function resolveTimeoutMs(params) {
	const timeoutMs = readPositiveIntegerParam(params, "timeoutMs");
	if (timeoutMs !== void 0) return timeoutMs;
	const timeoutSeconds = readPositiveIntegerParam(params, "timeoutSeconds");
	if (timeoutSeconds !== void 0) return finiteSecondsToTimerSafeMilliseconds(timeoutSeconds, { floorSeconds: true });
}
async function fetchWithWebToolsNetworkGuard(params) {
	const { timeoutSeconds, useEnvProxy, ...rest } = params;
	const resolved = {
		...rest,
		timeoutMs: resolveTimeoutMs({
			timeoutMs: rest.timeoutMs,
			timeoutSeconds
		})
	};
	return fetchWithSsrFGuard(useEnvProxy ? withTrustedEnvProxyGuardedFetchMode(resolved) : withStrictGuardedFetchMode(resolved));
}
async function withWebToolsNetworkGuard(params, run) {
	const { response, finalUrl, release } = await fetchWithWebToolsNetworkGuard(params);
	try {
		return await run({
			response,
			finalUrl
		});
	} finally {
		await release();
	}
}
async function withTrustedWebToolsEndpoint(params, run) {
	const trustedPolicy = ssrfPolicyFromHttpBaseUrlFakeIpHostnameAllowlist(params.url) ?? {};
	return await withWebToolsNetworkGuard({
		...params,
		policy: trustedPolicy,
		useEnvProxy: true
	}, run);
}
async function withSelfHostedWebToolsEndpoint(params, run) {
	return await withWebToolsNetworkGuard({
		...params,
		policy: WEB_TOOLS_SELF_HOSTED_NETWORK_SSRF_POLICY,
		useEnvProxy: true
	}, run);
}
async function withStrictWebToolsEndpoint(params, run) {
	return await withWebToolsNetworkGuard(params, run);
}
//#endregion
export { withTrustedWebToolsEndpoint as i, withSelfHostedWebToolsEndpoint as n, withStrictWebToolsEndpoint as r, fetchWithWebToolsNetworkGuard as t };
