@cosmicdrift/kumiko-framework 0.373.0 → 0.377.0

package/dist/files/provider-resolver.js

@@ -110,7 +110,7 @@ export function makeFileProviderResolver(deps) {
                 db: deps.db,
                 secrets: deps.secrets,
             });
-            return createFileProviderForTenant({ config, registry: deps.registry, secrets: deps.secrets, _userId: SYSTEM_USER_ID }, tenantId);
+            return createFileProviderForTenant({ config, registry: deps.registry, secrets: deps.secrets, auditUserId: SYSTEM_USER_ID }, tenantId);
         })();
         built.catch(() => {
             if (cache.get(tenantId) === built)

package/dist/http/egress.d.ts

@@ -0,0 +1,14 @@
+import { type EgressPolicy, type ResolvedHost } from "./policy.ts";
+type PinnedRequestInit = RequestInit & {
+    tls?: {
+        servername: string;
+    };
+};
+export declare function egress(policy: EgressPolicy): (raw: string, init?: RequestInit) => Promise<Response>;
+export declare function withOriginalUrl(res: Response, originalUrl: URL): Response;
+export declare function buildPinnedRequest(url: URL, resolved: ResolvedHost, init: RequestInit | undefined): {
+    url: URL;
+    init: PinnedRequestInit;
+};
+export declare function withManualRedirect(init: RequestInit | undefined): RequestInit;
+export {};

package/dist/http/egress.js

@@ -0,0 +1,144 @@
+import { assertAllowedTarget, assertHttpScheme, assertValidInternalPolicy, resolvePublicHost, } from "./policy.js";
+const MAX_INTERNAL_REDIRECTS = 5;
+// Single exported way to speak outward. The policy is named once, at bind
+// time, and cannot drift from the request that follows it.
+export function egress(policy) {
+    if (policy.kind === "internal")
+        assertValidInternalPolicy(policy);
+    return (raw, init) => runEgress(policy, raw, init);
+}
+async function runEgress(policy, raw, init) {
+    const url = new URL(raw);
+    assertHttpScheme(url);
+    if (policy.kind === "internal") {
+        assertAllowedTarget(url, policy);
+        return fetchWithAllowlistedRedirects(url, policy, init);
+    }
+    // external + tenant-supplied: deny private/reserved/link-local ranges,
+    // pin the connect to the exact address that passed that check (closes the
+    // DNS-rebinding TOCTOU, see buildPinnedRequest), and never follow a
+    // redirect — a 3xx could point anywhere, including back into the denied
+    // ranges above. The caller sees the 3xx response itself and, to follow it,
+    // is expected to call `egress()` again with the Location header — which
+    // re-runs this same resolve-and-pin check against the new host.
+    const resolved = await resolvePublicHost(url);
+    const pinned = buildPinnedRequest(url, resolved, init);
+    const res = await fetch(pinned.url, withManualRedirect(pinned.init));
+    return withOriginalUrl(res, url);
+}
+// fetch() reports `res.url` as the address it actually connected to — the
+// pinned IP literal, not the hostname the caller asked for. Left alone, a
+// caller resolving a relative Location header the normal way
+// (`new URL(location, res.url)`) would resolve it against the IP instead of
+// the original host, and the re-invoked egress() call would then pin and
+// SNI-validate against that IP, breaking virtual hosting and TLS for
+// essentially every real server. Overwriting `.url` back to the original
+// request URL keeps that caller pattern working exactly as it would without
+// IP pinning.
+export function withOriginalUrl(res, originalUrl) {
+    Object.defineProperty(res, "url", { value: originalUrl.toString(), configurable: true });
+    return res;
+}
+// Rewrites the request to connect directly to `resolved.address` — the
+// exact address `resolvePublicHost` just validated — instead of handing
+// `fetch()` the original hostname and letting it resolve again. That second
+// resolution is the DNS-rebinding window: fetch-by-IP removes it entirely,
+// since there is no hostname left for fetch to look up. The original
+// hostname is preserved in the Host header (virtual hosting) and in
+// `tls.servername` (TLS SNI, and certificate validation still checks the
+// real hostname — not the IP we dial).
+export function buildPinnedRequest(url, resolved, init) {
+    const pinnedHost = resolved.family === 6 ? `[${resolved.address}]` : resolved.address;
+    const pinnedUrl = new URL(url.toString());
+    pinnedUrl.hostname = pinnedHost;
+    if (pinnedUrl.hostname !== pinnedHost) {
+        // The WHATWG URL hostname setter silently no-ops on invalid input
+        // instead of throwing. If that ever happened here, the request would
+        // silently fall back to the original (unpinned) hostname — reopening
+        // the rebinding window this function exists to close. Fail loudly.
+        throw new Error(`egress: failed to pin connection to resolved address ${resolved.address}`);
+    }
+    const headers = new Headers(init?.headers);
+    headers.set("host", url.host);
+    const pinnedInit = { ...init, headers };
+    if (url.protocol === "https:") {
+        pinnedInit.tls = { servername: url.hostname };
+    }
+    return { url: pinnedUrl, init: pinnedInit };
+}
+// Applied last, after spreading the caller's `init` — a caller cannot
+// override the policy's redirect handling by passing its own `redirect`
+// option. Used by both the external/tenant-supplied fetch above and the
+// internal redirect loop below, so it is not part of the package's public
+// barrel (not re-exported from index.ts) but is a plain named export for
+// that shared use and for pinning the invariant directly in
+// ./__tests__/egress.test.ts.
+export function withManualRedirect(init) {
+    return { ...init, redirect: "manual" };
+}
+const ORIGIN_CHANGE_SAFE_HEADERS = new Set([
+    "content-type",
+    "accept",
+    "accept-encoding",
+    "accept-language",
+    "user-agent",
+]);
+// Allowlist, not denylist: any credential-bearing header we have not thought
+// of (x-api-key, custom tokens) must not follow a redirect to another origin.
+function stripToSafeHeaders(init) {
+    const kept = new Headers();
+    for (const [name, value] of new Headers(init?.headers)) {
+        if (ORIGIN_CHANGE_SAFE_HEADERS.has(name))
+            kept.set(name, value);
+    }
+    return { ...init, headers: kept };
+}
+// `internal` is the only kind that permits redirects (it is the only kind
+// with an allowlist to re-validate them against). Each hop's Location is
+// resolved, restricted to the current hop's host and checked against the
+// policy before it is followed, capped at MAX_INTERNAL_REDIRECTS.
+// `init` (method, body) is replayed verbatim on every hop — unlike a browser,
+// this does not downgrade POST to GET on a 301/302/303. Headers are replayed
+// only while the origin is unchanged; once a hop leaves the original origin
+// (scheme or port differs), credential headers are dropped for the rest of the
+// chain. The body is still replayed to the new origin (as fetch does on
+// 307/308); use allowOrigins to forbid such hops entirely.
+async function fetchWithAllowlistedRedirects(url, policy, init) {
+    let current = url;
+    let hopInit = init;
+    let strippedInit;
+    for (let hop = 0; hop <= MAX_INTERNAL_REDIRECTS; hop++) {
+        const res = await fetch(current, withManualRedirect(hopInit));
+        if (res.status < 300 || res.status >= 400)
+            return res;
+        const location = res.headers.get("location");
+        if (!location)
+            return res; // 3xx without Location — nothing to follow
+        let next;
+        try {
+            next = new URL(location, current);
+        }
+        catch {
+            throw new Error(`egress(internal): redirect Location header is not a resolvable URL: ${location}`);
+        }
+        assertHttpScheme(next);
+        // Hosts may differ in the allowlist; credentials must still not hop
+        // between them.
+        if (next.hostname.toLowerCase() !== current.hostname.toLowerCase()) {
+            throw new Error(`egress(internal): redirect crosses host (${current.hostname} -> ${next.hostname}), not followed`);
+        }
+        try {
+            assertAllowedTarget(next, policy);
+        }
+        catch {
+            // Prefix is the contract consumers match on (chat-webhook-sender); origins only, no path/query.
+            throw new Error(`egress(internal): redirect target not in allowlist (${current.origin} -> ${next.origin}), not followed`);
+        }
+        if (next.origin !== url.origin) {
+            strippedInit ??= stripToSafeHeaders(init);
+            hopInit = strippedInit;
+        }
+        current = next;
+    }
+    throw new Error(`egress(internal): exceeded ${MAX_INTERNAL_REDIRECTS} redirects`);
+}

package/dist/http/index.d.ts

@@ -1,2 +1,3 @@
-export type { EgressPolicy, ResolvedHost } from "@cosmicdrift/kumiko-http";
-export { BlockedHostError, buildPinnedRequest, egress, HostResolutionError, isPublicHost, resolvePublicHost, resolvePublicHostname, } from "@cosmicdrift/kumiko-http";
+export { buildPinnedRequest, egress } from "./egress.ts";
+export type { EgressPolicy, ResolvedHost } from "./policy.ts";
+export { BlockedHostError, HostResolutionError, isPublicHost, resolvePublicHost, resolvePublicHostname, } from "./policy.ts";

package/dist/http/index.js

@@ -1 +1,2 @@
-export { BlockedHostError, buildPinnedRequest, egress, HostResolutionError, isPublicHost, resolvePublicHost, resolvePublicHostname, } from "@cosmicdrift/kumiko-http";
+export { buildPinnedRequest, egress } from "./egress.js";
+export { BlockedHostError, HostResolutionError, isPublicHost, resolvePublicHost, resolvePublicHostname, } from "./policy.js";

package/dist/http/policy.d.ts

@@ -0,0 +1,30 @@
+import { lookup } from "node:dns/promises";
+export type EgressPolicy = {
+    readonly kind: "external";
+} | {
+    readonly kind: "internal";
+    readonly allowHosts?: readonly string[];
+    readonly allowOrigins?: readonly string[];
+} | {
+    readonly kind: "tenant-supplied";
+};
+export declare function isBlockedIp(ip: string): boolean;
+export declare function assertHttpScheme(url: URL): void;
+export interface ResolvedHost {
+    readonly address: string;
+    readonly family: 4 | 6;
+}
+export declare class BlockedHostError extends Error {
+    constructor(message: string);
+}
+export declare class HostResolutionError extends Error {
+    constructor(message: string);
+}
+export declare function resolvePublicHostname(rawHost: string, lookupFn?: typeof lookup): Promise<ResolvedHost>;
+export declare function resolvePublicHost(url: URL, lookupFn?: typeof lookup): Promise<ResolvedHost>;
+export declare function isPublicHost(raw: string, lookupFn?: typeof lookup): Promise<boolean>;
+export type InternalEgressPolicy = Extract<EgressPolicy, {
+    kind: "internal";
+}>;
+export declare function assertValidInternalPolicy(policy: InternalEgressPolicy): void;
+export declare function assertAllowedTarget(url: URL, policy: InternalEgressPolicy): void;

package/dist/http/policy.js

@@ -0,0 +1,299 @@
+// Egress trust boundary. `EgressPolicy` and the checks below back the single
+// exported way to speak outward, `egress()` in ./egress.ts. Only `isPublicHost`
+// reaches the package's public barrel (index.ts), as a boolean pre-check for
+// create-time validation — call sites otherwise bind a policy once via
+// `egress(policy)` and never see the range table or the allowlist check
+// directly.
+//
+// `external` and `tenant-supplied` resolve to the identical set of checks
+// below (deny private/reserved/link-local + no redirects). They stay
+// separate policy kinds because they carry different trust semantics — a
+// tenant-controlled URL is adversary-input in a way a hardcoded external
+// endpoint is not.
+//
+// DNS-rebinding protection: `resolvePublicHost` resolves the hostname
+// exactly once, validates every returned address, and hands back the one
+// address ./egress.ts connects to directly (fetch-by-IP, with the original
+// hostname preserved for the Host header and TLS SNI/cert validation).
+// There is no second resolution for an attacker-controlled DNS answer to
+// swap in between check and connect — see `resolvePublicHost` below for the
+// mechanism and ../__tests__/egress.test.ts / policy.test.ts for the tests
+// pinning it.
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+export function isBlockedIp(ip) {
+    const kind = isIP(ip);
+    if (kind === 4)
+        return isBlockedV4(ip);
+    if (kind === 6)
+        return isBlockedV6(ip);
+    return true; // not parseable as an IP -> fail closed
+}
+function inRange(n, [min, max]) {
+    return n >= min && n <= max;
+}
+// Each entry: first-octet range, an optional second-octet range for ranges
+// narrower than a full /8, and an optional third-octet range for the one
+// entry (192.0.0.0/24) narrower than a full /16. Table form keeps the range
+// list scannable as data rather than as a chain of near-identical `if`s.
+const BLOCKED_V4_RANGES = [
+    { a: [0, 0] }, // 0.0.0.0/8 "this host"
+    { a: [10, 10] }, // 10/8 private
+    { a: [127, 127] }, // loopback
+    { a: [169, 169], b: [254, 254] }, // link-local + cloud metadata (169.254.169.254)
+    { a: [172, 172], b: [16, 31] }, // 172.16/12 private
+    { a: [192, 192], b: [0, 0], c: [0, 0] }, // 192.0.0.0/24 IETF protocol assignments
+    { a: [192, 192], b: [168, 168] }, // 192.168/16 private
+    { a: [198, 198], b: [18, 19] }, // 198.18.0.0/15 benchmarking (RFC 2544)
+    { a: [100, 100], b: [64, 127] }, // 100.64/10 CGNAT
+    { a: [224, 255] }, // multicast/reserved — also covers 240.0.0.0/4 and the broadcast address
+];
+function isBlockedV4(ip) {
+    const [a = 0, b = 0, c = 0] = ip.split(".").map(Number);
+    return BLOCKED_V4_RANGES.some((range) => inRange(a, range.a) &&
+        (range.b === undefined || inRange(b, range.b)) &&
+        (range.c === undefined || inRange(c, range.c)));
+}
+// WHATWG URL host-parsing always serializes IPv6 into the canonical
+// compressed lowercase form (RFC 5952) regardless of the input shape —
+// uncompressed groups, embedded IPv4-dotted notation, mixed case all collapse
+// to one string. isBlockedV6 below only has to handle that one shape, so any
+// caller-supplied IPv6 literal is normalized through `new URL()` first.
+function canonicalIPv6(ip) {
+    try {
+        return new URL(`http://[${ip}]/`).hostname.replace(/^\[/, "").replace(/\]$/, "");
+    }
+    catch {
+        return ip; // unparsable — falls through to the (fail-closed) checks below
+    }
+}
+const HEX_GROUP_RE = /^[0-9a-f]{1,4}$/;
+// Expands a canonicalized (RFC 5952) IPv6 literal into its 8 explicit
+// 16-bit groups. Compression ("::") swallows a variable number of the
+// trailing zero groups an embedded IPv4 address produces — e.g.
+// `64:ff9b::0.0.0.1` canonicalizes to `64:ff9b::1` (one group, not two) —
+// so matching by regex on the compressed string misses those forms.
+// Expanding first lets every embedded-v4 check below match by fixed group
+// *position* regardless of how much of the address compressed away.
+// Returns null for anything that isn't well-formed hex-group IPv6 (e.g. a
+// zone id), which isBlockedV6 treats as fail-closed.
+function expandGroups(ip) {
+    const parts = ip.split("::");
+    if (parts.length > 2)
+        return null;
+    const toGroups = (segment) => (segment ? segment.split(":") : []);
+    const head = toGroups(parts[0]);
+    if (parts.length === 1) {
+        if (head.length !== 8 || !head.every((g) => HEX_GROUP_RE.test(g)))
+            return null;
+        return head.map((g) => Number.parseInt(g, 16));
+    }
+    const tail = toGroups(parts[1]);
+    const missing = 8 - head.length - tail.length;
+    if (missing < 0 || ![...head, ...tail].every((g) => HEX_GROUP_RE.test(g)))
+        return null;
+    return [...head, ...Array(missing).fill("0"), ...tail].map((g) => Number.parseInt(g, 16));
+}
+// Decodes the two 16-bit groups at `at`/`at+1` back into dotted-decimal, for
+// the v4 range rules.
+function decodeEmbeddedV4(groups, at) {
+    const hi = groups[at] ?? 0;
+    const lo = groups[at + 1] ?? 0;
+    return `${hi >>> 8}.${hi & 0xff}.${lo >>> 8}.${lo & 0xff}`;
+}
+// Every "IPv4-in-IPv6" encoding a URL literal can carry, as the fixed
+// leading groups (in expanded, 8-group form) and the group index the
+// embedded IPv4 address starts at. Matching by expanded position instead of
+// regex on the compressed string is what makes a single-group-compressed
+// embed (see expandGroups above) match the same as an uncompressed one.
+const EMBEDDED_V4_FORMS = [
+    { prefix: [0, 0, 0, 0, 0, 0], at: 6 }, // ::a.b.c.d — deprecated IPv4-compatible (RFC 4291)
+    { prefix: [0, 0, 0, 0, 0, 0xffff], at: 6 }, // ::ffff:a.b.c.d — IPv4-mapped (RFC 4291)
+    { prefix: [0, 0, 0, 0, 0xffff, 0], at: 6 }, // ::ffff:0:a.b.c.d — IPv4-translated (RFC 8215)
+    { prefix: [0x64, 0xff9b, 0, 0, 0, 0], at: 6 }, // 64:ff9b::a.b.c.d — NAT64 well-known prefix (RFC 6052)
+    { prefix: [0x64, 0xff9b, 1], at: 6 }, // 64:ff9b:1::a.b.c.d — NAT64 local-use prefix (RFC 8215)
+    { prefix: [0x2002], at: 1 }, // 2002:a.b.c.d:: — 6to4 (RFC 3056)
+];
+function matchesPrefix(groups, prefix) {
+    return prefix.every((value, index) => groups[index] === value);
+}
+const BLOCKED_V6_EXACT = new Set(["::1", "::"]); // loopback / unspecified
+// All three ranges expressed on the first 16-bit group ("head"), so they
+// share one table instead of three near-identical `if`s:
+//   fc00::/7   unique-local           -> head 0xfc00-0xfdff
+//   fe80::/10  link-local             -> head 0xfe80-0xfebf
+//   fec0::/10  deprecated site-local (RFC 3879, 2004) — no DNS server hands
+//              this out today, but this is an exported security boundary,
+//              so block it rather than lean on the deprecation.
+const BLOCKED_V6_HEAD_RANGES = [
+    [0xfc00, 0xfdff],
+    [0xfe80, 0xfebf],
+    [0xfec0, 0xfeff],
+];
+function isBlockedV6(ip) {
+    const lower = canonicalIPv6(ip.toLowerCase());
+    if (BLOCKED_V6_EXACT.has(lower))
+        return true;
+    const groups = expandGroups(lower);
+    if (!groups)
+        return true; // not well-formed IPv6 -> fail closed
+    const embedded = EMBEDDED_V4_FORMS.find((form) => matchesPrefix(groups, form.prefix));
+    if (embedded)
+        return isBlockedV4(decodeEmbeddedV4(groups, embedded.at));
+    const head = groups[0] ?? 0;
+    return BLOCKED_V6_HEAD_RANGES.some((range) => inRange(head, range));
+}
+function stripBrackets(host) {
+    return host.replace(/^\[/, "").replace(/\]$/, "");
+}
+export function assertHttpScheme(url) {
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new Error(`egress: unsupported scheme ${url.protocol}`);
+    }
+}
+// Denies private/reserved/link-local ranges for `external` and
+// `tenant-supplied`, and pins the exact address ./egress.ts must connect to.
+// Resolves the hostname's A/AAAA records (or reads the literal IP directly),
+// rejects if ANY resolved address falls in a denied range — a host with one
+// public and one private record must not pass — and returns ONE validated
+// address from that same resolution. Reusing that address for the connect,
+// instead of letting `fetch()` resolve the hostname again, is what closes
+// the DNS-rebinding window: there is no second lookup left for an
+// attacker-controlled DNS server to answer differently.
+//
+// Thrown for a host that is itself a blocked IP-literal, or that resolves to
+// one — a policy verdict, not a network condition. Retrying will not help;
+// callers should surface this as a rejected configuration.
+export class BlockedHostError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "BlockedHostError";
+    }
+}
+// Thrown when the resolver itself failed or returned nothing — a network
+// condition, not a policy verdict. Callers that retry (e.g. an inbound-mail
+// poll) should treat this as transient, unlike BlockedHostError.
+export class HostResolutionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "HostResolutionError";
+    }
+}
+// Resolves a bare hostname or IP-literal (no scheme, no URL parsing) exactly
+// once and returns the single validated address the caller must connect to
+// — the same DNS-rebinding-closing mechanism as resolvePublicHost below,
+// factored out for callers that only ever have a host (SMTP/IMAP tenant
+// config), never a full URL.
+//
+// `lookupFn` defaults to the real resolver and exists only so tests can pin
+// deterministic, network-free answers — production call sites never pass it.
+export async function resolvePublicHostname(rawHost, lookupFn = lookup) {
+    const host = stripBrackets(rawHost);
+    const ipVersion = isIP(host);
+    if (ipVersion !== 0) {
+        if (isBlockedIp(host))
+            throw new BlockedHostError(`egress: host is not a public address: ${host}`);
+        return { address: host, family: ipVersion === 6 ? 6 : 4 };
+    }
+    let addresses;
+    try {
+        addresses = await lookupFn(host, { all: true });
+    }
+    catch {
+        throw new HostResolutionError(`egress: DNS resolution failed for host: ${host}`);
+    }
+    if (addresses.length === 0) {
+        throw new HostResolutionError(`egress: DNS resolution returned no records for host: ${host}`);
+    }
+    const blocked = addresses.find((a) => isBlockedIp(a.address));
+    if (blocked) {
+        throw new BlockedHostError(`egress: host resolves to a non-public address: ${host} -> ${blocked.address}`);
+    }
+    // IPv4 first: hosts and runners without an IPv6 route would otherwise get an unreachable pinned address.
+    const chosen = addresses.find((address) => address.family === 4) ?? addresses[0];
+    if (!chosen) {
+        throw new HostResolutionError(`egress: DNS resolution returned no records for host: ${host}`);
+    }
+    return { address: chosen.address, family: chosen.family === 6 ? 6 : 4 };
+}
+export async function resolvePublicHost(url, lookupFn = lookup) {
+    if (url.username || url.password) {
+        throw new Error("egress: URLs with embedded credentials are not supported");
+    }
+    return resolvePublicHostname(url.hostname, lookupFn);
+}
+// Create-time validation for tenant-supplied URLs (e.g. webhook registration)
+// where rejecting at registration is better UX than failing later at fetch
+// time. Runs the same resolution as `egress()` without connecting anywhere,
+// and never throws — bad input (unparsable URL, non-http(s) scheme, embedded
+// credentials, DNS failure, blocked range) all just resolve to `false`.
+//
+// A `true` only holds at the moment of the check: DNS can change afterwards,
+// so this is a UX pre-check, not a substitute for the fetch-time check.
+// Outbound requests to tenant-supplied URLs MUST still go through
+// `egress({ kind: "tenant-supplied" })`, never a plain `fetch()`.
+export async function isPublicHost(raw, lookupFn = lookup) {
+    try {
+        const url = new URL(raw);
+        assertHttpScheme(url);
+        await resolvePublicHost(url, lookupFn);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isHostEntryWellFormed(entry) {
+    if (entry.includes("/") || entry.includes("@") || entry.includes("://"))
+        return false;
+    if (!entry.includes(":"))
+        return true;
+    return isIP(stripBrackets(entry)) === 6;
+}
+function isOriginEntryWellFormed(entry) {
+    let parsed;
+    try {
+        parsed = new URL(entry);
+    }
+    catch {
+        return false;
+    }
+    return ((parsed.protocol === "http:" || parsed.protocol === "https:") &&
+        !parsed.username &&
+        !parsed.password &&
+        parsed.pathname === "/" &&
+        !parsed.search &&
+        !parsed.hash);
+}
+// Runs once at bind time so a misconfigured allowlist fails at startup, not
+// on the first request.
+export function assertValidInternalPolicy(policy) {
+    const allowHosts = policy.allowHosts ?? [];
+    const allowOrigins = policy.allowOrigins ?? [];
+    if (allowHosts.length === 0 && allowOrigins.length === 0) {
+        throw new Error("egress(internal): allowHosts or allowOrigins must list at least one entry");
+    }
+    for (const entry of allowHosts) {
+        if (!isHostEntryWellFormed(entry)) {
+            throw new Error(`egress(internal): allowHosts entry must be a bare hostname, got "${entry}" (use allowOrigins to pin scheme and port)`);
+        }
+    }
+    // The entry is named by index only: it may carry credentials that must not reach startup logs.
+    allowOrigins.forEach((entry, index) => {
+        if (!isOriginEntryWellFormed(entry)) {
+            throw new Error(`egress(internal): allowOrigins[${index}] must be an http(s) origin like "https://host:port" without path, query or credentials`);
+        }
+    });
+}
+// Explicit allowlist check for `internal` — no range check, since `internal`
+// targets are deliberately private/cluster-local. The hostname (not the
+// resolved IP) must match `allowHosts` (any port/scheme) or the full origin
+// (scheme + host + port) must match `allowOrigins`.
+export function assertAllowedTarget(url, policy) {
+    const host = stripBrackets(url.hostname).toLowerCase();
+    const hostAllowed = (policy.allowHosts ?? []).some((entry) => stripBrackets(entry).toLowerCase() === host);
+    const originAllowed = (policy.allowOrigins ?? []).some((entry) => new URL(entry).origin === url.origin);
+    if (!hostAllowed && !originAllowed) {
+        throw new Error(`egress: target not in allowlist: ${url.origin}`);
+    }
+}

package/dist/i18n/required-surface-keys.js

@@ -45,6 +45,19 @@ function pushKey(out, value, treatAsKey = false) {
 function editFieldName(f) {
     return typeof f === "string" ? f : f.field;
 }
+// Placeholder, affix texts and the fill button label of a field spec; a `{ field }`
+// affix reads another form field and is no key.
+function pushEditFieldTextKeys(out, spec, treatAsKey = false) {
+    // skip: shorthand field name carries no texts
+    if (typeof spec === "string")
+        return;
+    pushKey(out, spec.placeholder, treatAsKey);
+    for (const affix of [spec.prefix, spec.suffix]) {
+        if (typeof affix === "string")
+            pushKey(out, affix, treatAsKey);
+    }
+    pushKey(out, spec.fillAction?.label, treatAsKey);
+}
 // Group titles are translated exactly like the section title (computeEditViewModel).
 function pushSectionTitles(out, section, treatAsKey = false) {
     pushKey(out, section.title, treatAsKey);
@@ -67,15 +80,20 @@ function pushActionFormShapedKeys(out, featureName, step) {
         pushSectionTitles(out, section);
         for (const f of sectionFieldSpecs(section)) {
             out.add(fieldLabelKey(featureName, ACTION_FORM_ENTITY, editFieldName(f)));
+            pushEditFieldTextKeys(out, f);
         }
     }
 }
 function pushRowActionKeys(out, action) {
     pushKey(out, action.label);
-    if (action.kind === "writeHandler" || action.kind === undefined) {
+    if (action.kind === "writeHandler" ||
+        action.kind === "clientAction" ||
+        action.kind === undefined) {
         pushKey(out, action.confirm);
         pushKey(out, action.confirmLabel);
     }
+    if (action.kind === "clientAction")
+        pushKey(out, action.successMessage);
     if (action.kind === "drawer") {
         pushKey(out, action.title);
         pushKey(out, action.subtitle);
@@ -90,6 +108,8 @@ function pushDashboardScreenKeys(out, dashboard) {
         pushKey(out, option.label);
     pushKey(out, dashboard.scope?.badge);
     pushKey(out, dashboard.scope?.notice);
+    for (const action of dashboard.actions ?? [])
+        pushRowActionKeys(out, action);
 }
 function pushDashboardPanelKeys(out, panel) {
     // skip: custom-Panel übersetzt sich selbst, kein Key hier
@@ -98,8 +118,12 @@ function pushDashboardPanelKeys(out, panel) {
     pushKey(out, panel.label);
     if (panel.kind === "chart" || panel.kind === "stat-group")
         pushKey(out, panel.subtitle);
-    if (panel.kind === "chart")
+    if (panel.kind === "text")
+        pushDashboardTextBlockKeys(out, panel);
+    if (panel.kind === "chart") {
+        pushKey(out, panel.unit);
         pushDashboardChartRangeKeys(out, panel);
+    }
     if (panel.kind === "chart" ||
         panel.kind === "list" ||
         panel.kind === "feed" ||
@@ -107,6 +131,9 @@ function pushDashboardPanelKeys(out, panel) {
         pushKey(out, panel.emptyLabel);
         pushKey(out, panel.emptyHint);
     }
+    pushDashboardChildLabelKeys(out, panel);
+}
+function pushDashboardChildLabelKeys(out, panel) {
     if (panel.kind === "stat-group") {
         for (const stat of panel.stats)
             pushKey(out, stat.label);
@@ -119,6 +146,20 @@ function pushDashboardPanelKeys(out, panel) {
         }
     }
 }
+function pushDashboardTextBlockKeys(out, panel) {
+    for (const block of panel.blocks) {
+        // skip: code is shown verbatim, not translated
+        if (block.kind === "code")
+            continue;
+        if (block.kind === "list") {
+            for (const item of block.items)
+                pushKey(out, item);
+        }
+        else {
+            pushKey(out, block.text);
+        }
+    }
+}
 function pushDashboardChartRangeKeys(out, panel) {
     for (const option of panel.ranges?.options ?? [])
         pushKey(out, option.label);
@@ -243,6 +284,7 @@ export function requiredKeysFromScreen(featureName, screen, options = {}) {
                     continue; // rejected at boot, unreachable here
                 pushSectionTitles(out, section);
                 for (const f of sectionFieldSpecs(section)) {
+                    pushEditFieldTextKeys(out, f);
                     const fieldName = editFieldName(f);
                     const override = edit.fieldLabels?.[fieldName];
                     if (override !== undefined)
@@ -260,6 +302,10 @@ export function requiredKeysFromScreen(featureName, screen, options = {}) {
             pushKey(out, form.summary?.subtitle);
             for (const action of form.footerActions ?? [])
                 pushKey(out, action.label);
+            for (const link of form.successLinks ?? [])
+                pushKey(out, link.label);
+            for (const fact of form.successFacts ?? [])
+                pushKey(out, fact.label);
             for (const fieldName of Object.keys(form.fields)) {
                 const override = form.fieldLabels?.[fieldName];
                 if (override !== undefined)
@@ -276,6 +322,7 @@ export function requiredKeysFromScreen(featureName, screen, options = {}) {
                     continue; // rejected at boot, unreachable here
                 pushSectionTitles(out, section);
                 for (const f of sectionFieldSpecs(section)) {
+                    pushEditFieldTextKeys(out, f);
                     const fieldName = editFieldName(f);
                     const override = form.fieldLabels?.[fieldName];
                     if (override !== undefined)
@@ -328,6 +375,7 @@ export function requiredKeysFromScreen(featureName, screen, options = {}) {
                 pushSectionTitles(out, section, treatDotFormAsKey);
                 pushKey(out, section.description, treatDotFormAsKey);
                 for (const f of sectionFieldSpecs(section)) {
+                    pushEditFieldTextKeys(out, f, treatDotFormAsKey);
                     const fieldName = editFieldName(f);
                     const override = config.fieldLabels?.[fieldName];
                     if (override !== undefined)
@@ -366,6 +414,7 @@ export function requiredKeysFromScreen(featureName, screen, options = {}) {
                     pushKey(out, section.submitLabel);
                     // kumiko-lint-ignore section-fields-raw writeForm sections carry no groups (EditWriteFormSection)
                     for (const f of section.fields) {
+                        pushEditFieldTextKeys(out, f);
                         const fieldName = editFieldName(f);
                         out.add(fieldLabelKey(featureName, WRITE_FORM_SECTION_ENTITY, fieldName));
                     }
@@ -373,6 +422,7 @@ export function requiredKeysFromScreen(featureName, screen, options = {}) {
                 }
                 pushSectionTitles(out, section);
                 for (const f of sectionFieldSpecs(section)) {
+                    pushEditFieldTextKeys(out, f);
                     const fieldName = editFieldName(f);
                     const override = detail.fieldLabels?.[fieldName];
                     if (override !== undefined)