import { Effect, Layer, Schema } from "effect";import { FetchHttpClient, HttpClient } from "effect/unstable/http"; export class HostedOutboundRequestBlocked extends Schema.TaggedErrorClass<HostedOutboundRequestBlocked>()(  "HostedOutboundRequestBlocked",  {    url: Schema.String,    reason: Schema.String,  },) {} export interface HostedHttpClientOptions {  readonly allowLocalNetwork?: boolean;  readonly maxRedirects?: number;  readonly fetch?: typeof globalThis.fetch;} const parseIpv4 = (hostname: string): readonly [number, number, number, number] | null => {  const parts = hostname.split(".");  if (parts.length !== 4) return null;  const parsed: number[] = [];  for (const part of parts) {    if (!/^\d+$/.test(part)) return null;    const value = Number(part);    if (!Number.isInteger(value) || value < 0 || value > 255) return null;    parsed.push(value);  }  return parsed as [number, number, number, number];}; const parseIpv4MappedIpv6 = (  hostname: string,): readonly [number, number, number, number] | null => {  const prefix = "::ffff:";  if (!hostname.startsWith(prefix)) return null;  const embedded = hostname.slice(prefix.length);  const dotted = parseIpv4(embedded);  if (dotted) return dotted;   const parts = embedded.split(":");  if (parts.length !== 2) return null;   const words = parts.map((part) => Number.parseInt(part, 16));  if (    words.some(      (word, index) =>        parts[index] === "" ||        !/^[0-9a-f]+$/i.test(parts[index]) ||        !Number.isInteger(word) ||        word < 0 ||        word > 0xffff,    )  ) {    return null;  }   const [high, low] = words;  return [high >> 8, high & 0xff, low >> 8, low & 0xff];}; const isPrivateIpv4 = ([a, b]: readonly [number, number, number, number]): boolean =>  a === 0 ||  a === 10 ||  a === 127 ||  (a === 169 && b === 254) ||  (a === 172 && b >= 16 && b <= 31) ||  (a === 192 && b === 168); const isBlockedMetadataHostname = (hostname: string): boolean => {  const normalized = hostname.toLowerCase();  return (    normalized === "metadata.google.internal" ||    normalized === "metadata" ||    normalized === "instance-data" ||    normalized === "169.254.169.254"  );}; const isLocalOrPrivateHostname = (hostname: string): boolean => {  const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");  if (normalized === "localhost" || normalized.endsWith(".localhost")) return true;  const ipv4 = parseIpv4(normalized);  if (ipv4) return isPrivateIpv4(ipv4);  const mappedIpv4 = parseIpv4MappedIpv6(normalized);  if (mappedIpv4) return isPrivateIpv4(mappedIpv4);  return (    normalized === "::1" ||    normalized.startsWith("fe80:") ||    normalized.startsWith("fc") ||    normalized.startsWith("fd")  );}; export const validateHostedOutboundUrl = (  value: string,  options: HostedHttpClientOptions = {},): Effect.Effect<void, HostedOutboundRequestBlocked> =>  Effect.gen(function* () {    const url = yield* Effect.try({      try: () => new URL(value),      catch: () =>        new HostedOutboundRequestBlocked({          url: value,          reason: "URL is invalid",        }),    });     if (url.protocol !== "http:" && url.protocol !== "https:") {      return yield* new HostedOutboundRequestBlocked({        url: value,        reason: "Only HTTP and HTTPS outbound requests are allowed",      });    }     if (isBlockedMetadataHostname(url.hostname)) {      return yield* new HostedOutboundRequestBlocked({        url: value,        reason: "Metadata service addresses are not allowed",      });    }     if (!options.allowLocalNetwork && isLocalOrPrivateHostname(url.hostname)) {      return yield* new HostedOutboundRequestBlocked({        url: value,        reason: "Local and private network addresses are not allowed",      });    }  }); const CREDENTIAL_HEADERS = ["authorization", "proxy-authorization", "cookie"] as const; const stripCredentialHeaders = (init: RequestInit | undefined): RequestInit => {  const headers = new Headers(init?.headers);  for (const name of CREDENTIAL_HEADERS) headers.delete(name);  return { ...init, headers };}; const guardFetch = (  underlying: typeof globalThis.fetch,  options: HostedHttpClientOptions,): typeof globalThis.fetch =>  (async (input, init) => {    const maxRedirects = options.maxRedirects ?? 10;    let current: Parameters<typeof globalThis.fetch>[0] | URL = input;    let currentInit = init;    for (let redirects = 0; redirects <= maxRedirects; redirects++) {      const url = current instanceof Request ? current.url : String(current);      Effect.runSync(validateHostedOutboundUrl(url, options));      const response = await underlying(current, {        ...currentInit,        redirect: "manual",      });      if (        response.status >= 300 &&        response.status < 400 &&        response.headers.has("location") &&        redirects < maxRedirects      ) {        const next = new URL(response.headers.get("location")!, url);        // Cross-origin redirects are followed (the loop re-validates every        // hop), but credentials minted for the original origin must not leak        // to the redirect target — same as fetch/curl behavior.        if (next.origin !== new URL(url).origin) {          currentInit = stripCredentialHeaders(currentInit);        }        current = next.toString();        continue;      }      return response;    }    return await underlying(current, { ...currentInit, redirect: "manual" });  }) as typeof globalThis.fetch; export const makeHostedHttpClientLayer = (  options: HostedHttpClientOptions = {},): Layer.Layer<HttpClient.HttpClient> =>  FetchHttpClient.layer.pipe(    Layer.provide(      options.fetch        ? Layer.succeed(FetchHttpClient.Fetch)(guardFetch(options.fetch, options))        : Layer.effect(            FetchHttpClient.Fetch,            Effect.map(Effect.service(FetchHttpClient.Fetch), (underlying) =>              guardFetch(underlying, options),            ),          ),    ),  );