@agent-native/core 0.121.2 → 0.122.1

package/dist/eject/provider-api-definitions.d.ts

@@ -20,6 +20,7 @@ export declare function listProviderApiCatalog(providerId?: ProviderApiId | stri
     defaultHeaders: Record<string, string>;
     examples: readonly import("@agent-native/core/provider-api/runtime").ProviderApiExample[];
     notes: readonly string[];
+    accessErrorGuidance: string | null;
     corpusRecipes: readonly import("@agent-native/core/provider-api/runtime").ProviderApiCorpusRecipe[];
     templateUses: readonly WorkspaceConnectionTemplateUse[];
 }[];

package/dist/eject/provider-api-definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-api-definitions.d.ts","sourceRoot":"","sources":["../../src/eject/provider-api-definitions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAC7F,OAAO,EAGL,0BAA0B,IAAI,iCAAiC,EAC/D,yBAAyB,IAAI,gCAAgC,EAC7D,oBAAoB,IAAI,2BAA2B,EAEnD,yBAAyB,IAAI,gCAAgC,EAC7D,sBAAsB,IAAI,6BAA6B,EAEvD,wBAAwB,IAAI,+BAA+B,EAC3D,kCAAkC,IAAI,yCAAyC,EAC/E,2BAA2B,IAAI,kCAAkC,EACjE,yBAAyB,IAAI,gCAAgC,EAC7D,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC/B,MAAM,yCAAyC,CAAC;AAEjD,cAAc,yCAAyC,CAAC;AAMxD,eAAO,MAAM,oBAAoB,EAAE,iBAAiB,EA8BnD,CAAC;AAiBF,wBAAgB,uBAAuB,CACrC,SAAS,GAAE,SAAS,iBAAiB,EAAO,GAC3C,iBAAiB,EAAE,CAErB;AAED,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,aAAa,GAAG,MAAM,EAClC,SAAS,GAAE,SAAS,iBAAiB,EAAO,GAC3C,iBAAiB,CAEnB;AAED,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,8BAA8B,EAC3C,SAAS,GAAE,SAAS,iBAAiB,EAAO,GAC3C,aAAa,EAAE,CAOjB;AAED,wBAAgB,sBAAsB,CACpC,UAAU,CAAC,EAAE,aAAa,GAAG,MAAM,EACnC,OAAO,GAAE,UAAU,CAAC,OAAO,6BAA6B,CAAC,CAAC,CAAC,CAAM;;;;;;;;;;;;;;;;;IAMlE;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,yBAAyB,GACjC,kBAAkB,CAEpB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAC1D,OAAO,GAAE,yBAA4C,GACpD,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAKhD;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAC5D,OAAO,EAAE,yBAAyB,GACjC,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAKrD;AAED,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,UAAU,CAAC,OAAO,yCAAyC,CAAC,CAAC,CAAC,CAAC,EACrE,OAAO,EAAE,yBAAyB,GACjC,UAAU,CAAC,OAAO,yCAAyC,CAAC,CAK9D;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAC5D,OAAO,EAAE,yBAAyB,GACjC,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAKrD;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,UAAU,CAAC,OAAO,kCAAkC,CAAC,CAAC,CAAC,CAAC,EAC9D,OAAO,EAAE,yBAAyB,GACjC,UAAU,CAAC,OAAO,kCAAkC,CAAC,CAKvD;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,UAAU,CAAC,OAAO,+BAA+B,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,EAAE,yBAAyB,GACjC,UAAU,CAAC,OAAO,+BAA+B,CAAC,CAKpD;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAC5D,OAAO,EAAE,yBAAyB,GACjC,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAKrD;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAAC,CAAC,CAAC,EAC7D,OAAO,EAAE,yBAAyB,GACjC,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAKtD"}
+{"version":3,"file":"provider-api-definitions.d.ts","sourceRoot":"","sources":["../../src/eject/provider-api-definitions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAC7F,OAAO,EAGL,0BAA0B,IAAI,iCAAiC,EAC/D,yBAAyB,IAAI,gCAAgC,EAC7D,oBAAoB,IAAI,2BAA2B,EAEnD,yBAAyB,IAAI,gCAAgC,EAC7D,sBAAsB,IAAI,6BAA6B,EAEvD,wBAAwB,IAAI,+BAA+B,EAC3D,kCAAkC,IAAI,yCAAyC,EAC/E,2BAA2B,IAAI,kCAAkC,EACjE,yBAAyB,IAAI,gCAAgC,EAC7D,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC/B,MAAM,yCAAyC,CAAC;AAEjD,cAAc,yCAAyC,CAAC;AAMxD,eAAO,MAAM,oBAAoB,EAAE,iBAAiB,EA8BnD,CAAC;AAiBF,wBAAgB,uBAAuB,CACrC,SAAS,GAAE,SAAS,iBAAiB,EAAO,GAC3C,iBAAiB,EAAE,CAErB;AAED,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,aAAa,GAAG,MAAM,EAClC,SAAS,GAAE,SAAS,iBAAiB,EAAO,GAC3C,iBAAiB,CAEnB;AAED,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,8BAA8B,EAC3C,SAAS,GAAE,SAAS,iBAAiB,EAAO,GAC3C,aAAa,EAAE,CAOjB;AAED,wBAAgB,sBAAsB,CACpC,UAAU,CAAC,EAAE,aAAa,GAAG,MAAM,EACnC,OAAO,GAAE,UAAU,CAAC,OAAO,6BAA6B,CAAC,CAAC,CAAC,CAAM;;;;;;;;;;;;;;;;;;IAMlE;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,yBAAyB,GACjC,kBAAkB,CAEpB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAC1D,OAAO,GAAE,yBAA4C,GACpD,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAKhD;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAC5D,OAAO,EAAE,yBAAyB,GACjC,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAKrD;AAED,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,UAAU,CAAC,OAAO,yCAAyC,CAAC,CAAC,CAAC,CAAC,EACrE,OAAO,EAAE,yBAAyB,GACjC,UAAU,CAAC,OAAO,yCAAyC,CAAC,CAK9D;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAC5D,OAAO,EAAE,yBAAyB,GACjC,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAKrD;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,UAAU,CAAC,OAAO,kCAAkC,CAAC,CAAC,CAAC,CAAC,EAC9D,OAAO,EAAE,yBAAyB,GACjC,UAAU,CAAC,OAAO,kCAAkC,CAAC,CAKvD;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,UAAU,CAAC,OAAO,+BAA+B,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,EAAE,yBAAyB,GACjC,UAAU,CAAC,OAAO,+BAA+B,CAAC,CAKpD;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAC5D,OAAO,EAAE,yBAAyB,GACjC,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAKrD;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAAC,CAAC,CAAC,EAC7D,OAAO,EAAE,yBAAyB,GACjC,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAKtD"}

package/dist/extensions/url-safety.d.ts

@@ -5,22 +5,7 @@ export declare function isBlockedExtensionUrl(url: string): boolean;
  * "public hostname resolves to a private address" gap before dispatch.
  */
 export declare function isBlockedExtensionUrlWithDns(url: string): Promise<boolean>;
-/**
- * Build an undici Dispatcher whose connect-time DNS lookup runs through a
- * private-IP guard. This closes the TOCTOU gap where:
- *   1. We resolve hostname → public IP and pass.
- *   2. Between that lookup and the actual connect, DNS rebinding flips the
- *      record to a private IP.
- *   3. fetch() resolves again and connects to the private IP.
- *
- * With a custom dispatcher, the same lookup that produces the IP also gates
- * the connect: if the IP is in the private set, the connect throws.
- *
- * Returns `null` if undici / node:dns are not available (e.g. some edge
- * runtimes); the caller should fall back to the regular `fetch` path —
- * `isBlockedExtensionUrlWithDns` will still have caught most rebinding cases.
- */
-export declare function createSsrfSafeDispatcher(): Promise<unknown | null>;
+export declare function createSsrfSafeDispatcher(allowedPrivateOrigins?: readonly string[]): Promise<unknown | null>;
 /**
  * SSRF-safe `fetch` for any server-side request to a user/agent-supplied URL.
  *
@@ -50,6 +35,14 @@ export declare function ssrfSafeFetch(url: string, init?: RequestInit, options?:
     maxRedirects?: number;
     httpsOnly?: boolean;
     assertUrlAllowed?: (url: string) => void | Promise<void>;
+    /**
+     * Exact origins that may resolve to a private address. A workspace runs
+     * every app on loopback behind one gateway, so sibling A2A calls are
+     * private by construction; without this they are indistinguishable from an
+     * SSRF attempt and get blocked. Only ever pass origins the deployment
+     * itself configured (never a request-supplied value).
+     */
+    allowedPrivateOrigins?: readonly string[];
 }): Promise<Response>;
 export { isBlockedExtensionUrl as isBlockedToolUrl };
 export { isBlockedExtensionUrlWithDns as isBlockedToolUrlWithDns };

package/dist/extensions/url-safety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url-safety.d.ts","sourceRoot":"","sources":["../../src/extensions/url-safety.ts"],"names":[],"mappings":"AA4FA,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAoB1D;AASD;;;;GAIG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAoBlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAmExE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,WAAgB,EACtB,OAAO,GAAE;IACP,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD,GACL,OAAO,CAAC,QAAQ,CAAC,CAsCnB;AAQD,OAAO,EAAE,qBAAqB,IAAI,gBAAgB,EAAE,CAAC;AACrD,OAAO,EAAE,4BAA4B,IAAI,uBAAuB,EAAE,CAAC;AACnE,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,CAAC"}
+{"version":3,"file":"url-safety.d.ts","sourceRoot":"","sources":["../../src/extensions/url-safety.ts"],"names":[],"mappings":"AA4FA,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAoB1D;AASD;;;;GAIG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAoBlB;AAwCD,wBAAsB,wBAAwB,CAC5C,qBAAqB,GAAE,SAAS,MAAM,EAAO,GAC5C,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAyEzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,WAAgB,EACtB,OAAO,GAAE;IACP,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,GACL,OAAO,CAAC,QAAQ,CAAC,CA8DnB;AAQD,OAAO,EAAE,qBAAqB,IAAI,gBAAgB,EAAE,CAAC;AACrD,OAAO,EAAE,4BAA4B,IAAI,uBAAuB,EAAE,CAAC;AACnE,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,CAAC"}

package/dist/extensions/url-safety.js

@@ -172,7 +172,27 @@ export async function isBlockedExtensionUrlWithDns(url) {
  * runtimes); the caller should fall back to the regular `fetch` path —
  * `isBlockedExtensionUrlWithDns` will still have caught most rebinding cases.
  */
-export async function createSsrfSafeDispatcher() {
+function normalizeLookupHostname(hostname) {
+    return hostname.toLowerCase().replace(/^\[|\]$/g, "");
+}
+function normalizeAllowedPrivateOriginKeys(origins) {
+    const keys = new Set();
+    for (const origin of origins) {
+        try {
+            const parsed = new URL(origin);
+            if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+                continue;
+            }
+            const port = parsed.port || (parsed.protocol === "https:" ? "443" : "80");
+            keys.add(`${normalizeLookupHostname(parsed.hostname)}:${port}`);
+        }
+        catch {
+            // Ignore malformed deployment configuration and retain the private-IP guard.
+        }
+    }
+    return keys;
+}
+export async function createSsrfSafeDispatcher(allowedPrivateOrigins = []) {
     // Keep the optional undici import opaque to Vite/Rolldown. A static
     // `import("undici")` makes browser builds try to resolve and bundle undici
     // even though this dispatcher is only useful in Node server runtimes.
@@ -188,6 +208,7 @@ export async function createSsrfSafeDispatcher() {
     }
     const { Agent } = undici;
     const { lookup } = dnsModule;
+    const allowedPrivateOriginKeys = normalizeAllowedPrivateOriginKeys(allowedPrivateOrigins);
     if (!Agent || !lookup)
         return null;
     return new Agent({
@@ -203,7 +224,8 @@ export async function createSsrfSafeDispatcher() {
                         ? addresses
                         : [{ address: addresses, family: 4 }];
                     for (const record of list) {
-                        if (isPrivateHost(record.address)) {
+                        const allowedOrigin = allowedPrivateOriginKeys.has(`${normalizeLookupHostname(hostname)}:${String(options?.port ?? "")}`);
+                        if (isPrivateHost(record.address) && !allowedOrigin) {
                             const e = new Error(`Connect blocked: ${hostname} resolved to private address ${record.address}`);
                             e.code = "EAI_BLOCKED";
                             return callback(e);
@@ -249,14 +271,36 @@ export async function createSsrfSafeDispatcher() {
  */
 export async function ssrfSafeFetch(url, init = {}, options = {}) {
     const maxRedirects = options.maxRedirects ?? 3;
-    const dispatcher = (await createSsrfSafeDispatcher()) ?? undefined;
+    const dispatcher = (await createSsrfSafeDispatcher(options.allowedPrivateOrigins)) ??
+        undefined;
+    const allowedPrivateOrigins = new Set((options.allowedPrivateOrigins ?? [])
+        .map((origin) => {
+        try {
+            return new URL(origin).origin;
+        }
+        catch {
+            return "";
+        }
+    })
+        .filter(Boolean));
+    const isAllowedPrivateOrigin = (candidate) => {
+        if (allowedPrivateOrigins.size === 0)
+            return false;
+        try {
+            return allowedPrivateOrigins.has(new URL(candidate).origin);
+        }
+        catch {
+            return false;
+        }
+    };
     let currentUrl = url;
     for (let hop = 0; hop <= maxRedirects; hop++) {
         await options.assertUrlAllowed?.(currentUrl);
         if (options.httpsOnly && new URL(currentUrl).protocol !== "https:") {
             throw new Error(`SSRF blocked: refusing to fetch non-HTTPS address (${currentUrl})`);
         }
-        if (await isBlockedExtensionUrlWithDns(currentUrl)) {
+        if (!isAllowedPrivateOrigin(currentUrl) &&
+            (await isBlockedExtensionUrlWithDns(currentUrl))) {
             throw new Error(`SSRF blocked: refusing to fetch private/internal address (${currentUrl})`);
         }
         const fetchOpts = {

package/dist/extensions/url-safety.js.map

@@ -1 +1 @@
-{"version":3,"file":"url-safety.js","sourceRoot":"","sources":["../../src/extensions/url-safety.ts"],"names":[],"mappings":"AAAA,MAAM,cAAc,GAAG;IACrB,0BAA0B;IAC1B,2BAA2B;CAC5B,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,SAAS;IACT,WAAW;IACX,SAAS;IACT,eAAe;IACf,SAAS;CACV,CAAC;AAEF,SAAS,aAAa,CAAC,CAAS,EAAE,CAAS,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC;IACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,MAAM;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC;IACrB,OAAO,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IACE,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,IAAI,EACb,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,iCAAiC;IACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IAED,wBAAwB;IACxB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;YAC7B,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC;YACrB,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,aAAa,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,IACE,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7B,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC,CAAC,EACF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAW;IAEX,IAAI,qBAAqB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,sEAAsE;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,oEAAoE;IACpE,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,MAAW,CAAC;IAChB,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,QAAQ,CAChC,WAAW,EACX,0BAA0B,CACY,CAAC;QACzC,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvC,SAAS,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7B,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEnC,OAAO,IAAI,KAAK,CAAC;QACf,OAAO,EAAE;YACP,oEAAoE;YACpE,oEAAoE;YACpE,gCAAgC;YAChC,MAAM,EAAE,CACN,QAAgB,EAChB,OAAY,EACZ,QAIS,EACT,EAAE;gBACF,MAAM,CACJ,QAAQ,EACR,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAC7B,CAAC,GAAiC,EAAE,SAAc,EAAE,EAAE;oBACpD,IAAI,GAAG;wBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC9B,MAAM,IAAI,GAA0C,KAAK,CAAC,OAAO,CAC/D,SAAS,CACV;wBACC,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;oBACxC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;wBAC1B,IAAI,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;4BAClC,MAAM,CAAC,GAAG,IAAI,KAAK,CACjB,oBAAoB,QAAQ,gCAAgC,MAAM,CAAC,OAAO,EAAE,CACpD,CAAC;4BAC3B,CAAC,CAAC,IAAI,GAAG,aAAa,CAAC;4BACvB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;wBACrB,CAAC;oBACH,CAAC;oBACD,gEAAgE;oBAChE,4DAA4D;oBAC5D,iBAAiB;oBACjB,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;wBAC3B,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAW,CAAC,CAAC;oBACrC,CAAC;oBACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;oBACtB,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACrD,CAAC,CACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,IAAI,GAAgB,EAAE,EACtB,OAAO,GAIH,EAAE;IAEN,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,CAAC,MAAM,wBAAwB,EAAE,CAAC,IAAI,SAAS,CAAC;IAEnE,IAAI,UAAU,GAAG,GAAG,CAAC;IACrB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,YAAY,EAAE,GAAG,EAAE,EAAE,CAAC;QAC7C,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,sDAAsD,UAAU,GAAG,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,6DAA6D,UAAU,GAAG,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAA2C;YACxD,GAAG,IAAI;YACP,QAAQ,EAAE,QAAQ;SACnB,CAAC;QACF,IAAI,UAAU;YAAE,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC;QAElD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC/B,sEAAsE;YACtE,0BAA0B;YAC1B,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC9C,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC;YAChD,SAAS;QACX,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CACb,sCAAsC,YAAY,oBAAoB,GAAG,EAAE,CAC5E,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,gFAAgF;AAEhF,OAAO,EAAE,qBAAqB,IAAI,gBAAgB,EAAE,CAAC;AACrD,OAAO,EAAE,4BAA4B,IAAI,uBAAuB,EAAE,CAAC;AACnE,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,CAAC","sourcesContent":["const METADATA_HOSTS = [\n  \"metadata.google.internal\",\n  \"metadata.google.internal.\",\n];\n\nconst DNS_REBIND_SUFFIXES = [\n  \".nip.io\",\n  \".sslip.io\",\n  \".xip.io\",\n  \".localtest.me\",\n  \".lvh.me\",\n];\n\nfunction isPrivateIpv4(a: number, b: number, c = 0, d = 0): boolean {\n  if (![a, b, c, d].every((part) => part >= 0 && part <= 255)) return true;\n  if (a === 127) return true;\n  if (a === 10) return true;\n  if (a === 172 && b >= 16 && b <= 31) return true;\n  if (a === 192 && b === 168) return true;\n  if (a === 169 && b === 254) return true;\n  if (a === 0) return true;\n  if (a === 100 && b >= 64 && b <= 127) return true;\n  if (a === 192 && b === 0) return true;\n  if (a === 198 && (b === 18 || b === 19)) return true;\n  if (a === 192 && b === 0 && c === 2) return true;\n  if (a === 198 && b === 51 && c === 100) return true;\n  if (a === 203 && b === 0 && c === 113) return true;\n  if (a >= 224) return true;\n  return false;\n}\n\nfunction isPrivateIpv4MappedHex(host: string): boolean {\n  const mapped = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);\n  if (!mapped) return false;\n  const high = Number.parseInt(mapped[1], 16);\n  const low = Number.parseInt(mapped[2], 16);\n  if (high < 0 || high > 0xffff || low < 0 || low > 0xffff) return false;\n  const a = (high >> 8) & 0xff;\n  const b = high & 0xff;\n  const c = (low >> 8) & 0xff;\n  const d = low & 0xff;\n  return isPrivateIpv4(a, b, c, d);\n}\n\nfunction isPrivateHost(hostname: string): boolean {\n  const host = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n  if (\n    host === \"localhost\" ||\n    host === \"::1\" ||\n    host === \"::0\" ||\n    host === \"::\"\n  ) {\n    return true;\n  }\n  if (METADATA_HOSTS.includes(host)) return true;\n\n  // IPv6 ULA/link-local/multicast.\n  if (/^f[cd]/.test(host) || /^fe[89ab]/.test(host)) return true;\n  if (/^ff/i.test(host)) return true;\n\n  // IPv4-mapped IPv6. URL parsing may preserve dotted form in some runtimes\n  // or normalize it to hex, e.g. [::ffff:127.0.0.1] -> ::ffff:7f00:1.\n  const v4mappedDotted = host.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n  if (v4mappedDotted) {\n    const [a, b, c, d] = v4mappedDotted[1].split(\".\").map(Number);\n    if (isPrivateIpv4(a, b, c, d)) return true;\n  }\n  if (isPrivateIpv4MappedHex(host)) return true;\n\n  // Dotted IPv4. URL parsing normalizes shorthand/octal/hex IPv4 forms to\n  // dotted decimal before we reach this point.\n  const parts = host.split(\".\");\n  if (parts.length === 4 && parts.every((p) => /^\\d+$/.test(p))) {\n    const [a, b, c, d] = parts.map(Number);\n    if (isPrivateIpv4(a, b, c, d)) return true;\n  }\n\n  // Decimal integer IPv4.\n  if (/^\\d+$/.test(host)) {\n    const num = Number(host);\n    if (num >= 0 && num <= 0xffffffff) {\n      const a = (num >>> 24) & 0xff;\n      const b = (num >>> 16) & 0xff;\n      const c = (num >>> 8) & 0xff;\n      const d = num & 0xff;\n      if (isPrivateIpv4(a, b, c, d)) return true;\n    }\n  }\n\n  return false;\n}\n\nexport function isBlockedExtensionUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n      return true;\n    }\n    const host = parsed.hostname.toLowerCase();\n    if (isPrivateHost(host)) return true;\n    if (\n      DNS_REBIND_SUFFIXES.some((suffix) => {\n        const bare = suffix.slice(1);\n        return host === bare || host.endsWith(suffix);\n      })\n    ) {\n      return true;\n    }\n  } catch {\n    return true;\n  }\n  return false;\n}\n\nfunction isIpLiteralHost(hostname: string): boolean {\n  const host = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n  if (host.includes(\":\")) return true;\n  const parts = host.split(\".\");\n  return parts.length === 4 && parts.every((p) => /^\\d+$/.test(p));\n}\n\n/**\n * Async SSRF guard for environments that can resolve DNS. The synchronous\n * guard catches literals and known rebinding domains; this closes the common\n * \"public hostname resolves to a private address\" gap before dispatch.\n */\nexport async function isBlockedExtensionUrlWithDns(\n  url: string,\n): Promise<boolean> {\n  if (isBlockedExtensionUrl(url)) return true;\n\n  let hostname: string;\n  try {\n    hostname = new URL(url).hostname.toLowerCase();\n  } catch {\n    return true;\n  }\n  if (!hostname || isIpLiteralHost(hostname)) return false;\n\n  try {\n    const { lookup } = await import(\"node:dns/promises\");\n    const records = await lookup(hostname, { all: true, verbatim: true });\n    return records.some((record) => isPrivateHost(record.address));\n  } catch {\n    // Some edge runtimes do not expose DNS lookup. Keep the deterministic\n    // parser-based protections instead of failing every outbound request.\n    return false;\n  }\n}\n\n/**\n * Build an undici Dispatcher whose connect-time DNS lookup runs through a\n * private-IP guard. This closes the TOCTOU gap where:\n *   1. We resolve hostname → public IP and pass.\n *   2. Between that lookup and the actual connect, DNS rebinding flips the\n *      record to a private IP.\n *   3. fetch() resolves again and connects to the private IP.\n *\n * With a custom dispatcher, the same lookup that produces the IP also gates\n * the connect: if the IP is in the private set, the connect throws.\n *\n * Returns `null` if undici / node:dns are not available (e.g. some edge\n * runtimes); the caller should fall back to the regular `fetch` path —\n * `isBlockedExtensionUrlWithDns` will still have caught most rebinding cases.\n */\nexport async function createSsrfSafeDispatcher(): Promise<unknown | null> {\n  // Keep the optional undici import opaque to Vite/Rolldown. A static\n  // `import(\"undici\")` makes browser builds try to resolve and bundle undici\n  // even though this dispatcher is only useful in Node server runtimes.\n  let undici: any;\n  let dnsModule: any;\n  try {\n    const runtimeImport = new Function(\n      \"specifier\",\n      \"return import(specifier)\",\n    ) as (specifier: string) => Promise<any>;\n    undici = await runtimeImport(\"undici\");\n    dnsModule = await import(\"node:dns\");\n  } catch {\n    return null;\n  }\n\n  const { Agent } = undici;\n  const { lookup } = dnsModule;\n  if (!Agent || !lookup) return null;\n\n  return new Agent({\n    connect: {\n      // Override DNS lookup at connect time so the IP we hand to undici's\n      // socket is the one we authorized. Reject any record in the private\n      // set BEFORE the TCP handshake.\n      lookup: (\n        hostname: string,\n        options: any,\n        callback: (\n          err: NodeJS.ErrnoException | null,\n          address?: string | { address: string; family: number }[],\n          family?: number,\n        ) => void,\n      ) => {\n        lookup(\n          hostname,\n          { all: true, verbatim: true },\n          (err: NodeJS.ErrnoException | null, addresses: any) => {\n            if (err) return callback(err);\n            const list: { address: string; family: number }[] = Array.isArray(\n              addresses,\n            )\n              ? addresses\n              : [{ address: addresses, family: 4 }];\n            for (const record of list) {\n              if (isPrivateHost(record.address)) {\n                const e = new Error(\n                  `Connect blocked: ${hostname} resolved to private address ${record.address}`,\n                ) as NodeJS.ErrnoException;\n                e.code = \"EAI_BLOCKED\";\n                return callback(e);\n              }\n            }\n            // Mirror Node's lookup behavior: when `all` is true, return the\n            // array; otherwise the first entry. undici's connect honors\n            // `options.all`.\n            if (options && options.all) {\n              return callback(null, list as any);\n            }\n            const first = list[0];\n            return callback(null, first.address, first.family);\n          },\n        );\n      },\n    },\n  });\n}\n\n/**\n * SSRF-safe `fetch` for any server-side request to a user/agent-supplied URL.\n *\n * Applies the same protections the extension proxy uses, so every call site\n * that fetches an untrusted URL gets them without re-implementing the loop:\n *   1. Pre-flight DNS-aware private-address check (isBlockedExtensionUrlWithDns)\n *      on the initial URL and on every redirect hop.\n *   2. A connect-time dispatcher that re-checks the resolved IP at TCP-connect\n *      time (closes the DNS-rebinding TOCTOU) when undici is available.\n *   3. Manual redirect handling — a public URL cannot 30x-redirect into the\n *      private network because each hop is re-validated before it is followed.\n *\n * Throws an Error whose message starts with \"SSRF blocked:\" when a target\n * (initial or via redirect) resolves to a private/internal address, or when the\n * redirect limit is exceeded. Otherwise returns the final Response.\n *\n * `httpsOnly` extends the per-hop validation to the URL scheme: redirects are\n * followed only to `https:` targets, so an HTTPS-only caller cannot be\n * downgraded to plain HTTP by a 30x from the (untrusted) origin.\n *\n * `assertUrlAllowed` lets callers layer a stricter destination policy (for\n * example, a credential's origin allowlist) on top of the SSRF checks. It runs\n * before the initial request and before every redirect hop, so sensitive\n * headers and bodies are never forwarded to a destination the caller rejects.\n */\nexport async function ssrfSafeFetch(\n  url: string,\n  init: RequestInit = {},\n  options: {\n    maxRedirects?: number;\n    httpsOnly?: boolean;\n    assertUrlAllowed?: (url: string) => void | Promise<void>;\n  } = {},\n): Promise<Response> {\n  const maxRedirects = options.maxRedirects ?? 3;\n  const dispatcher = (await createSsrfSafeDispatcher()) ?? undefined;\n\n  let currentUrl = url;\n  for (let hop = 0; hop <= maxRedirects; hop++) {\n    await options.assertUrlAllowed?.(currentUrl);\n    if (options.httpsOnly && new URL(currentUrl).protocol !== \"https:\") {\n      throw new Error(\n        `SSRF blocked: refusing to fetch non-HTTPS address (${currentUrl})`,\n      );\n    }\n    if (await isBlockedExtensionUrlWithDns(currentUrl)) {\n      throw new Error(\n        `SSRF blocked: refusing to fetch private/internal address (${currentUrl})`,\n      );\n    }\n    const fetchOpts: RequestInit & { dispatcher?: unknown } = {\n      ...init,\n      redirect: \"manual\",\n    };\n    if (dispatcher) fetchOpts.dispatcher = dispatcher;\n\n    const response = await fetch(currentUrl, fetchOpts);\n    if (response.status >= 300 && response.status < 400) {\n      const location = response.headers.get(\"location\");\n      if (!location) return response;\n      // Drain the redirect body so the hop's connection is released instead\n      // of being held until GC.\n      await response.body?.cancel().catch(() => {});\n      currentUrl = new URL(location, currentUrl).href;\n      continue;\n    }\n    return response;\n  }\n  throw new Error(\n    `SSRF blocked: too many redirects (>${maxRedirects}) while fetching ${url}`,\n  );\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Legacy aliases — predate the Tools → Extensions rename. Templates import\n// these via the legacy `@agent-native/core/tools/url-safety` subpath; keep\n// the names exported so they keep resolving until every consumer updates.\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport { isBlockedExtensionUrl as isBlockedToolUrl };\nexport { isBlockedExtensionUrlWithDns as isBlockedToolUrlWithDns };\nexport { ssrfSafeFetch as ssrfSafeToolFetch };\n"]}
+{"version":3,"file":"url-safety.js","sourceRoot":"","sources":["../../src/extensions/url-safety.ts"],"names":[],"mappings":"AAAA,MAAM,cAAc,GAAG;IACrB,0BAA0B;IAC1B,2BAA2B;CAC5B,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,SAAS;IACT,WAAW;IACX,SAAS;IACT,eAAe;IACf,SAAS;CACV,CAAC;AAEF,SAAS,aAAa,CAAC,CAAS,EAAE,CAAS,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC;IACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,MAAM;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC;IACrB,OAAO,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IACE,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,IAAI,EACb,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,iCAAiC;IACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IAED,wBAAwB;IACxB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;YAC7B,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC;YACrB,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,aAAa,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,IACE,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7B,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC,CAAC,EACF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAW;IAEX,IAAI,qBAAqB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,sEAAsE;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,iCAAiC,CACxC,OAA0B;IAE1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAChE,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC1E,IAAI,CAAC,GAAG,CAAC,GAAG,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,qBAAqB,GAAsB,EAAE;IAE7C,oEAAoE;IACpE,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,MAAW,CAAC;IAChB,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,QAAQ,CAChC,WAAW,EACX,0BAA0B,CACY,CAAC;QACzC,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvC,SAAS,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7B,MAAM,wBAAwB,GAAG,iCAAiC,CAChE,qBAAqB,CACtB,CAAC;IACF,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEnC,OAAO,IAAI,KAAK,CAAC;QACf,OAAO,EAAE;YACP,oEAAoE;YACpE,oEAAoE;YACpE,gCAAgC;YAChC,MAAM,EAAE,CACN,QAAgB,EAChB,OAAY,EACZ,QAIS,EACT,EAAE;gBACF,MAAM,CACJ,QAAQ,EACR,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAC7B,CAAC,GAAiC,EAAE,SAAc,EAAE,EAAE;oBACpD,IAAI,GAAG;wBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC9B,MAAM,IAAI,GAA0C,KAAK,CAAC,OAAO,CAC/D,SAAS,CACV;wBACC,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;oBACxC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;wBAC1B,MAAM,aAAa,GAAG,wBAAwB,CAAC,GAAG,CAChD,GAAG,uBAAuB,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,CACtE,CAAC;wBACF,IAAI,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;4BACpD,MAAM,CAAC,GAAG,IAAI,KAAK,CACjB,oBAAoB,QAAQ,gCAAgC,MAAM,CAAC,OAAO,EAAE,CACpD,CAAC;4BAC3B,CAAC,CAAC,IAAI,GAAG,aAAa,CAAC;4BACvB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;wBACrB,CAAC;oBACH,CAAC;oBACD,gEAAgE;oBAChE,4DAA4D;oBAC5D,iBAAiB;oBACjB,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;wBAC3B,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAW,CAAC,CAAC;oBACrC,CAAC;oBACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;oBACtB,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACrD,CAAC,CACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,IAAI,GAAgB,EAAE,EACtB,OAAO,GAYH,EAAE;IAEN,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GACd,CAAC,MAAM,wBAAwB,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC/D,SAAS,CAAC;IACZ,MAAM,qBAAqB,GAAG,IAAI,GAAG,CACnC,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC;SAClC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACd,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;SACD,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;IACF,MAAM,sBAAsB,GAAG,CAAC,SAAiB,EAAW,EAAE;QAC5D,IAAI,qBAAqB,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,IAAI,CAAC;YACH,OAAO,qBAAqB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,UAAU,GAAG,GAAG,CAAC;IACrB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,YAAY,EAAE,GAAG,EAAE,EAAE,CAAC;QAC7C,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,sDAAsD,UAAU,GAAG,CACpE,CAAC;QACJ,CAAC;QACD,IACE,CAAC,sBAAsB,CAAC,UAAU,CAAC;YACnC,CAAC,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC,EAChD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,6DAA6D,UAAU,GAAG,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAA2C;YACxD,GAAG,IAAI;YACP,QAAQ,EAAE,QAAQ;SACnB,CAAC;QACF,IAAI,UAAU;YAAE,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC;QAElD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC/B,sEAAsE;YACtE,0BAA0B;YAC1B,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC9C,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC;YAChD,SAAS;QACX,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CACb,sCAAsC,YAAY,oBAAoB,GAAG,EAAE,CAC5E,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,gFAAgF;AAEhF,OAAO,EAAE,qBAAqB,IAAI,gBAAgB,EAAE,CAAC;AACrD,OAAO,EAAE,4BAA4B,IAAI,uBAAuB,EAAE,CAAC;AACnE,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,CAAC","sourcesContent":["const METADATA_HOSTS = [\n  \"metadata.google.internal\",\n  \"metadata.google.internal.\",\n];\n\nconst DNS_REBIND_SUFFIXES = [\n  \".nip.io\",\n  \".sslip.io\",\n  \".xip.io\",\n  \".localtest.me\",\n  \".lvh.me\",\n];\n\nfunction isPrivateIpv4(a: number, b: number, c = 0, d = 0): boolean {\n  if (![a, b, c, d].every((part) => part >= 0 && part <= 255)) return true;\n  if (a === 127) return true;\n  if (a === 10) return true;\n  if (a === 172 && b >= 16 && b <= 31) return true;\n  if (a === 192 && b === 168) return true;\n  if (a === 169 && b === 254) return true;\n  if (a === 0) return true;\n  if (a === 100 && b >= 64 && b <= 127) return true;\n  if (a === 192 && b === 0) return true;\n  if (a === 198 && (b === 18 || b === 19)) return true;\n  if (a === 192 && b === 0 && c === 2) return true;\n  if (a === 198 && b === 51 && c === 100) return true;\n  if (a === 203 && b === 0 && c === 113) return true;\n  if (a >= 224) return true;\n  return false;\n}\n\nfunction isPrivateIpv4MappedHex(host: string): boolean {\n  const mapped = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);\n  if (!mapped) return false;\n  const high = Number.parseInt(mapped[1], 16);\n  const low = Number.parseInt(mapped[2], 16);\n  if (high < 0 || high > 0xffff || low < 0 || low > 0xffff) return false;\n  const a = (high >> 8) & 0xff;\n  const b = high & 0xff;\n  const c = (low >> 8) & 0xff;\n  const d = low & 0xff;\n  return isPrivateIpv4(a, b, c, d);\n}\n\nfunction isPrivateHost(hostname: string): boolean {\n  const host = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n  if (\n    host === \"localhost\" ||\n    host === \"::1\" ||\n    host === \"::0\" ||\n    host === \"::\"\n  ) {\n    return true;\n  }\n  if (METADATA_HOSTS.includes(host)) return true;\n\n  // IPv6 ULA/link-local/multicast.\n  if (/^f[cd]/.test(host) || /^fe[89ab]/.test(host)) return true;\n  if (/^ff/i.test(host)) return true;\n\n  // IPv4-mapped IPv6. URL parsing may preserve dotted form in some runtimes\n  // or normalize it to hex, e.g. [::ffff:127.0.0.1] -> ::ffff:7f00:1.\n  const v4mappedDotted = host.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n  if (v4mappedDotted) {\n    const [a, b, c, d] = v4mappedDotted[1].split(\".\").map(Number);\n    if (isPrivateIpv4(a, b, c, d)) return true;\n  }\n  if (isPrivateIpv4MappedHex(host)) return true;\n\n  // Dotted IPv4. URL parsing normalizes shorthand/octal/hex IPv4 forms to\n  // dotted decimal before we reach this point.\n  const parts = host.split(\".\");\n  if (parts.length === 4 && parts.every((p) => /^\\d+$/.test(p))) {\n    const [a, b, c, d] = parts.map(Number);\n    if (isPrivateIpv4(a, b, c, d)) return true;\n  }\n\n  // Decimal integer IPv4.\n  if (/^\\d+$/.test(host)) {\n    const num = Number(host);\n    if (num >= 0 && num <= 0xffffffff) {\n      const a = (num >>> 24) & 0xff;\n      const b = (num >>> 16) & 0xff;\n      const c = (num >>> 8) & 0xff;\n      const d = num & 0xff;\n      if (isPrivateIpv4(a, b, c, d)) return true;\n    }\n  }\n\n  return false;\n}\n\nexport function isBlockedExtensionUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n      return true;\n    }\n    const host = parsed.hostname.toLowerCase();\n    if (isPrivateHost(host)) return true;\n    if (\n      DNS_REBIND_SUFFIXES.some((suffix) => {\n        const bare = suffix.slice(1);\n        return host === bare || host.endsWith(suffix);\n      })\n    ) {\n      return true;\n    }\n  } catch {\n    return true;\n  }\n  return false;\n}\n\nfunction isIpLiteralHost(hostname: string): boolean {\n  const host = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n  if (host.includes(\":\")) return true;\n  const parts = host.split(\".\");\n  return parts.length === 4 && parts.every((p) => /^\\d+$/.test(p));\n}\n\n/**\n * Async SSRF guard for environments that can resolve DNS. The synchronous\n * guard catches literals and known rebinding domains; this closes the common\n * \"public hostname resolves to a private address\" gap before dispatch.\n */\nexport async function isBlockedExtensionUrlWithDns(\n  url: string,\n): Promise<boolean> {\n  if (isBlockedExtensionUrl(url)) return true;\n\n  let hostname: string;\n  try {\n    hostname = new URL(url).hostname.toLowerCase();\n  } catch {\n    return true;\n  }\n  if (!hostname || isIpLiteralHost(hostname)) return false;\n\n  try {\n    const { lookup } = await import(\"node:dns/promises\");\n    const records = await lookup(hostname, { all: true, verbatim: true });\n    return records.some((record) => isPrivateHost(record.address));\n  } catch {\n    // Some edge runtimes do not expose DNS lookup. Keep the deterministic\n    // parser-based protections instead of failing every outbound request.\n    return false;\n  }\n}\n\n/**\n * Build an undici Dispatcher whose connect-time DNS lookup runs through a\n * private-IP guard. This closes the TOCTOU gap where:\n *   1. We resolve hostname → public IP and pass.\n *   2. Between that lookup and the actual connect, DNS rebinding flips the\n *      record to a private IP.\n *   3. fetch() resolves again and connects to the private IP.\n *\n * With a custom dispatcher, the same lookup that produces the IP also gates\n * the connect: if the IP is in the private set, the connect throws.\n *\n * Returns `null` if undici / node:dns are not available (e.g. some edge\n * runtimes); the caller should fall back to the regular `fetch` path —\n * `isBlockedExtensionUrlWithDns` will still have caught most rebinding cases.\n */\nfunction normalizeLookupHostname(hostname: string): string {\n  return hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n}\n\nfunction normalizeAllowedPrivateOriginKeys(\n  origins: readonly string[],\n): Set<string> {\n  const keys = new Set<string>();\n  for (const origin of origins) {\n    try {\n      const parsed = new URL(origin);\n      if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n        continue;\n      }\n      const port = parsed.port || (parsed.protocol === \"https:\" ? \"443\" : \"80\");\n      keys.add(`${normalizeLookupHostname(parsed.hostname)}:${port}`);\n    } catch {\n      // Ignore malformed deployment configuration and retain the private-IP guard.\n    }\n  }\n  return keys;\n}\n\nexport async function createSsrfSafeDispatcher(\n  allowedPrivateOrigins: readonly string[] = [],\n): Promise<unknown | null> {\n  // Keep the optional undici import opaque to Vite/Rolldown. A static\n  // `import(\"undici\")` makes browser builds try to resolve and bundle undici\n  // even though this dispatcher is only useful in Node server runtimes.\n  let undici: any;\n  let dnsModule: any;\n  try {\n    const runtimeImport = new Function(\n      \"specifier\",\n      \"return import(specifier)\",\n    ) as (specifier: string) => Promise<any>;\n    undici = await runtimeImport(\"undici\");\n    dnsModule = await import(\"node:dns\");\n  } catch {\n    return null;\n  }\n\n  const { Agent } = undici;\n  const { lookup } = dnsModule;\n  const allowedPrivateOriginKeys = normalizeAllowedPrivateOriginKeys(\n    allowedPrivateOrigins,\n  );\n  if (!Agent || !lookup) return null;\n\n  return new Agent({\n    connect: {\n      // Override DNS lookup at connect time so the IP we hand to undici's\n      // socket is the one we authorized. Reject any record in the private\n      // set BEFORE the TCP handshake.\n      lookup: (\n        hostname: string,\n        options: any,\n        callback: (\n          err: NodeJS.ErrnoException | null,\n          address?: string | { address: string; family: number }[],\n          family?: number,\n        ) => void,\n      ) => {\n        lookup(\n          hostname,\n          { all: true, verbatim: true },\n          (err: NodeJS.ErrnoException | null, addresses: any) => {\n            if (err) return callback(err);\n            const list: { address: string; family: number }[] = Array.isArray(\n              addresses,\n            )\n              ? addresses\n              : [{ address: addresses, family: 4 }];\n            for (const record of list) {\n              const allowedOrigin = allowedPrivateOriginKeys.has(\n                `${normalizeLookupHostname(hostname)}:${String(options?.port ?? \"\")}`,\n              );\n              if (isPrivateHost(record.address) && !allowedOrigin) {\n                const e = new Error(\n                  `Connect blocked: ${hostname} resolved to private address ${record.address}`,\n                ) as NodeJS.ErrnoException;\n                e.code = \"EAI_BLOCKED\";\n                return callback(e);\n              }\n            }\n            // Mirror Node's lookup behavior: when `all` is true, return the\n            // array; otherwise the first entry. undici's connect honors\n            // `options.all`.\n            if (options && options.all) {\n              return callback(null, list as any);\n            }\n            const first = list[0];\n            return callback(null, first.address, first.family);\n          },\n        );\n      },\n    },\n  });\n}\n\n/**\n * SSRF-safe `fetch` for any server-side request to a user/agent-supplied URL.\n *\n * Applies the same protections the extension proxy uses, so every call site\n * that fetches an untrusted URL gets them without re-implementing the loop:\n *   1. Pre-flight DNS-aware private-address check (isBlockedExtensionUrlWithDns)\n *      on the initial URL and on every redirect hop.\n *   2. A connect-time dispatcher that re-checks the resolved IP at TCP-connect\n *      time (closes the DNS-rebinding TOCTOU) when undici is available.\n *   3. Manual redirect handling — a public URL cannot 30x-redirect into the\n *      private network because each hop is re-validated before it is followed.\n *\n * Throws an Error whose message starts with \"SSRF blocked:\" when a target\n * (initial or via redirect) resolves to a private/internal address, or when the\n * redirect limit is exceeded. Otherwise returns the final Response.\n *\n * `httpsOnly` extends the per-hop validation to the URL scheme: redirects are\n * followed only to `https:` targets, so an HTTPS-only caller cannot be\n * downgraded to plain HTTP by a 30x from the (untrusted) origin.\n *\n * `assertUrlAllowed` lets callers layer a stricter destination policy (for\n * example, a credential's origin allowlist) on top of the SSRF checks. It runs\n * before the initial request and before every redirect hop, so sensitive\n * headers and bodies are never forwarded to a destination the caller rejects.\n */\nexport async function ssrfSafeFetch(\n  url: string,\n  init: RequestInit = {},\n  options: {\n    maxRedirects?: number;\n    httpsOnly?: boolean;\n    assertUrlAllowed?: (url: string) => void | Promise<void>;\n    /**\n     * Exact origins that may resolve to a private address. A workspace runs\n     * every app on loopback behind one gateway, so sibling A2A calls are\n     * private by construction; without this they are indistinguishable from an\n     * SSRF attempt and get blocked. Only ever pass origins the deployment\n     * itself configured (never a request-supplied value).\n     */\n    allowedPrivateOrigins?: readonly string[];\n  } = {},\n): Promise<Response> {\n  const maxRedirects = options.maxRedirects ?? 3;\n  const dispatcher =\n    (await createSsrfSafeDispatcher(options.allowedPrivateOrigins)) ??\n    undefined;\n  const allowedPrivateOrigins = new Set(\n    (options.allowedPrivateOrigins ?? [])\n      .map((origin) => {\n        try {\n          return new URL(origin).origin;\n        } catch {\n          return \"\";\n        }\n      })\n      .filter(Boolean),\n  );\n  const isAllowedPrivateOrigin = (candidate: string): boolean => {\n    if (allowedPrivateOrigins.size === 0) return false;\n    try {\n      return allowedPrivateOrigins.has(new URL(candidate).origin);\n    } catch {\n      return false;\n    }\n  };\n\n  let currentUrl = url;\n  for (let hop = 0; hop <= maxRedirects; hop++) {\n    await options.assertUrlAllowed?.(currentUrl);\n    if (options.httpsOnly && new URL(currentUrl).protocol !== \"https:\") {\n      throw new Error(\n        `SSRF blocked: refusing to fetch non-HTTPS address (${currentUrl})`,\n      );\n    }\n    if (\n      !isAllowedPrivateOrigin(currentUrl) &&\n      (await isBlockedExtensionUrlWithDns(currentUrl))\n    ) {\n      throw new Error(\n        `SSRF blocked: refusing to fetch private/internal address (${currentUrl})`,\n      );\n    }\n    const fetchOpts: RequestInit & { dispatcher?: unknown } = {\n      ...init,\n      redirect: \"manual\",\n    };\n    if (dispatcher) fetchOpts.dispatcher = dispatcher;\n\n    const response = await fetch(currentUrl, fetchOpts);\n    if (response.status >= 300 && response.status < 400) {\n      const location = response.headers.get(\"location\");\n      if (!location) return response;\n      // Drain the redirect body so the hop's connection is released instead\n      // of being held until GC.\n      await response.body?.cancel().catch(() => {});\n      currentUrl = new URL(location, currentUrl).href;\n      continue;\n    }\n    return response;\n  }\n  throw new Error(\n    `SSRF blocked: too many redirects (>${maxRedirects}) while fetching ${url}`,\n  );\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Legacy aliases — predate the Tools → Extensions rename. Templates import\n// these via the legacy `@agent-native/core/tools/url-safety` subpath; keep\n// the names exported so they keep resolving until every consumer updates.\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport { isBlockedExtensionUrl as isBlockedToolUrl };\nexport { isBlockedExtensionUrlWithDns as isBlockedToolUrlWithDns };\nexport { ssrfSafeFetch as ssrfSafeToolFetch };\n"]}

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,12 +17,12 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
+    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
-    error?: undefined;
 }>;
 export default _default;
 //# sourceMappingURL=upload-image.d.ts.map

package/dist/integrations/webhook-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-handler.d.ts","sourceRoot":"","sources":["../../src/integrations/webhook-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAElC,OAAO,EAIL,KAAK,mBAAmB,EAEzB,MAAM,6BAA6B,CAAC;AAcrC,OAAO,KAAK,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAOL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAiCtC,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,eAAe,EACf,uBAAuB,EACxB,MAAM,YAAY,CAAC;AAsBpB,MAAM,MAAM,sCAAsC,GAAG;IACnD,IAAI,EAAE,mBAAmB,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,eAAe,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GACpC;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IACE,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,sCAAsC,CAAC;IAChD,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AA6CN,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,eAAe,CAAC;IACzB,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,CAAC,EACH,WAAW,GACX,MAAM,GACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtD,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,yEAAyE;IACzE,aAAa,CAAC,EAAE,CACd,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,eAAe,KACrB,OAAO,CACR;QACE,OAAO,EAAE,IAAI,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GACD;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CACrB,CAAC;CACH;AAyDD,wBAAsB,wBAAwB,CAC5C,YAAY,EAAE,qBAAqB,CAAC,QAAQ,CAAC,EAC7C,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAyB7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CA0E5C;AAkHD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAgCrD;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,4BAA4B,CAAC,CAgBvC;AA4vCD,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,sCAAsC,EAC/C,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAsEf"}
+{"version":3,"file":"webhook-handler.d.ts","sourceRoot":"","sources":["../../src/integrations/webhook-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAElC,OAAO,EAIL,KAAK,mBAAmB,EAEzB,MAAM,6BAA6B,CAAC;AAerC,OAAO,KAAK,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAOL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAqCtC,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,eAAe,EACf,uBAAuB,EACxB,MAAM,YAAY,CAAC;AAoCpB,MAAM,MAAM,sCAAsC,GAAG;IACnD,IAAI,EAAE,mBAAmB,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,eAAe,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GACpC;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IACE,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,sCAAsC,CAAC;IAChD,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AA6CN,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,eAAe,CAAC;IACzB,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,CAAC,EACH,WAAW,GACX,MAAM,GACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtD,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,yEAAyE;IACzE,aAAa,CAAC,EAAE,CACd,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,eAAe,KACrB,OAAO,CACR;QACE,OAAO,EAAE,IAAI,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GACD;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CACrB,CAAC;CACH;AAyDD,wBAAsB,wBAAwB,CAC5C,YAAY,EAAE,qBAAqB,CAAC,QAAQ,CAAC,EAC7C,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAyB7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CA0E5C;AAkHD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAgCrD;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,4BAA4B,CAAC,CAgBvC;AA+xCD,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,sCAAsC,EAC/C,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAsEf"}

package/dist/integrations/webhook-handler.js

@@ -1,5 +1,6 @@
 import { buildA2AVerifiedMutationReceipt, extractA2AArtifactIdentities, guardA2AArtifactResponse, } from "../a2a/artifact-response.js";
 import { collectFinalResponseTextFromAgentEvents } from "../a2a/response-text.js";
+import { isInBackgroundFunctionRuntime } from "../agent/durable-background.js";
 import { formatLlmCredentialErrorMessage, isLlmCredentialError, } from "../agent/engine/credential-errors.js";
 import { getConfiguredEngineNameForRequest, getStoredModelForEngine, normalizeModelForEngine, resolveEngine, } from "../agent/engine/index.js";
 import { resolveMainChatMaxOutputTokens } from "../agent/engine/output-tokens.js";
@@ -9,7 +10,7 @@ import { startRun } from "../agent/run-manager.js";
 import { buildCurrentTimeUserContext, buildRuntimeContextPrompt, } from "../agent/runtime-context.js";
 import { buildAssistantMessage, extractThreadMeta, threadDataToEngineMessages, } from "../agent/thread-data-builder.js";
 import { attachToolSearch } from "../agent/tool-search.js";
-import { createThread, getThread } from "../chat-threads/store.js";
+import { createThread, getThread, grantThreadUserShare, } from "../chat-threads/store.js";
 import { updateThreadData } from "../chat-threads/store.js";
 import { isLocalDatabase } from "../db/client.js";
 import { getOrgA2ASecret, resolveOrgIdForEmail } from "../org/context.js";
@@ -29,6 +30,18 @@ const PROCESSOR_DISPATCH_SETTLE_WAIT_MS = 1_500;
 const DEFERRED_RESPONSE_DISPATCH_SETTLE_WAIT_MS = 1_500;
 const DEFERRED_RESPONSE_MAX_HANDLER_MS = 2_500;
 const EMPTY_INTEGRATION_RESPONSE_MESSAGE = "The model finished without a visible answer. Try again, or open the thread in Dispatch to inspect the run.";
+const CUTOFF_INTEGRATION_RESPONSE_MESSAGE = "I ran out of time on this one before I could write up an answer — it needed more research than a single run allows. " +
+    "Open the thread in Dispatch to see what I gathered, or ask me again in smaller pieces (one source at a time works best).";
+/**
+ * True when the run stopped at a continuation boundary rather than finishing:
+ * the run-manager's soft timeout emits `auto_continue` and aborts the loop, and
+ * the loop itself emits one when it hits an internal step budget. The run's
+ * status is still "completed", so without this check a cut-off research request
+ * is reported to the user as a model that answered with nothing.
+ */
+function endedAtContinuationBoundary(run) {
+    return run.events.some((runEvent) => runEvent.event.type === "auto_continue");
+}
 /**
  * Build a stable per-event dedup key from the incoming message. The same
  * key is computed for every retry of the same event from the platform —
@@ -503,6 +516,18 @@ async function processIncomingMessage(incoming, options, opts = {}) {
         await releaseApplicableIntegrationBudgets(budgetReservations.reservations);
         throw error;
     }
+    // Channel conversations run as the integration service principal, so the
+    // thread is owned by `integration@<platform>` and not by the human who asked.
+    // The "Open thread" deep link we hand back would then 404 for them and the
+    // chat surface would silently render an empty new chat, so grant each
+    // verified participant an explicit share on the thread they are driving.
+    if (incoming.senderVerified === true &&
+        incoming.senderEmail &&
+        incoming.senderEmail.trim().toLowerCase() !== ownerEmail.toLowerCase()) {
+        await grantThreadUserShare(threadId, incoming.senderEmail, "editor", ownerEmail).catch((error) => {
+            console.warn(`[integrations] Could not grant ${incoming.platform} sender access to thread ${threadId}:`, error instanceof Error ? error.message : error);
+        });
+    }
     const existingMessages = [];
     if (thread?.threadData) {
         existingMessages.push(...threadDataToEngineMessages(thread.threadData));
@@ -714,7 +739,10 @@ async function processIncomingMessage(incoming, options, opts = {}) {
                     }
                     else {
                         responseText =
-                            verifiedMutationReceipt ?? EMPTY_INTEGRATION_RESPONSE_MESSAGE;
+                            verifiedMutationReceipt ??
+                                (endedAtContinuationBoundary(completedRun)
+                                    ? CUTOFF_INTEGRATION_RESPONSE_MESSAGE
+                                    : EMPTY_INTEGRATION_RESPONSE_MESSAGE);
                     }
                 }
                 if (approval?.type === "approval_required") {
@@ -948,13 +976,22 @@ async function processIncomingMessage(incoming, options, opts = {}) {
                 resolve(outcome);
             }
         }, 
-        // Integration workers are ordinary self-dispatched serverless requests,
-        // not a Netlify background-function route. Without the hosted soft
-        // timeout, a wedged model connection can outlive the worker and leave
-        // Slack's native stream in "working" forever when the host kills the
-        // process. Checkpoint at the foreground-safe boundary so onComplete can
-        // always close the provider progress surface before the function wall.
-        { useHostedSoftTimeoutDefault: true });
+        // Without the hosted soft timeout, a wedged model connection can outlive
+        // the worker and leave Slack's native stream in "working" forever when
+        // the host kills the process. Checkpoint at the safe boundary so
+        // onComplete can always close the provider progress surface first.
+        //
+        // Which boundary that is depends on where this task is actually running:
+        // when durable dispatch routes it to the emitted `-background` function
+        // it has ~15min, and clamping it to the 40s foreground budget anyway cut
+        // off every research-shaped request (multi-source sweeps, long tool
+        // chains) with no visible answer. `isInBackgroundFunctionRuntime()` is
+        // the runtime proof — never a config guess — so the wider ceiling is
+        // taken only where the ~60s synchronous wall genuinely does not apply.
+        {
+            useHostedSoftTimeoutDefault: true,
+            backgroundFunction: isInBackgroundFunctionRuntime(),
+        });
     });
 }
 function buildProviderConversationContext(incoming) {