@ever-works/activepieces-plugin 1.0.10 → 1.0.12

package/dist/index.cjs

@@ -492,6 +492,13 @@ var PLATFORM_DEFAULT_MERGE_POLICY = Object.freeze({
   allowedMergeMethods: ["squash"],
   protectedBranches: ["main", "master", "develop", "stage"]
 });
+var MERGE_POLICY_PROTECTED_BRANCH_FLOOR = Object.freeze([
+  "main",
+  "master",
+  "develop",
+  "stage"
+]);
+var MERGE_POLICY_ALWAYS_APPROVED_BRANCHES = Object.freeze(["main", "master"]);
 var MERGE_APPROVAL_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var TOOL_GRANT_SCOPE_PRECEDENCE = Object.freeze([
   "tenant",
@@ -1204,6 +1211,111 @@ var FLEET_HEALTH_DISK_CRITICAL_MARGIN_BYTES = 1024 ** 3;
 var FLEET_HEALTH_MAX_MIB = 2 ** 40;
 var FLEET_HEALTH_MAX_UPTIME_SEC = 100 * 365 * 24 * 60 * 60;
 var FLEET_HEALTH_BYTES_PER_MIB = 1024 * 1024;
+var FLEET_RUN_TOKEN_ROUTES = Object.freeze([
+  // Works — reads, plus the settings update (its merge / check / command
+  // fields are refused for run tokens by the Works controller).
+  { method: "GET", pathPattern: "/api/works" },
+  { method: "GET", pathPattern: "/api/works/{id}" },
+  { method: "PUT", pathPattern: "/api/works/{id}" },
+  { method: "GET", pathPattern: "/api/works/{id}/config" },
+  { method: "GET", pathPattern: "/api/works/{id}/items" },
+  { method: "GET", pathPattern: "/api/works/{id}/categories-tags" },
+  { method: "GET", pathPattern: "/api/works/{id}/history" },
+  { method: "GET", pathPattern: "/api/works/{id}/generator-form" },
+  { method: "GET", pathPattern: "/api/works/{id}/schedule" },
+  { method: "GET", pathPattern: "/api/works/{id}/comparisons" },
+  { method: "GET", pathPattern: "/api/works/{id}/comparisons/{slug}" },
+  // Knowledge Base (`apps/mcp/src/tools/kb`). A document a run token writes
+  // lands `proposed` (review-gated), see the KB controller. No unlock.
+  { method: "GET", pathPattern: "/api/works/{id}/kb/documents" },
+  { method: "POST", pathPattern: "/api/works/{id}/kb/documents" },
+  { method: "GET", pathPattern: "/api/works/{id}/kb/documents/{docIdOrPath}" },
+  { method: "PATCH", pathPattern: "/api/works/{id}/kb/documents/{docId}" },
+  { method: "POST", pathPattern: "/api/works/{id}/kb/documents/{docId}/lock" },
+  // Deploy — reads and the capability check only.
+  { method: "GET", pathPattern: "/api/deploy/works/{id}/domains" },
+  { method: "GET", pathPattern: "/api/deploy/providers" },
+  { method: "POST", pathPattern: "/api/deploy/works/{id}/check" },
+  // Plugins — read only.
+  { method: "GET", pathPattern: "/api/plugins" },
+  { method: "GET", pathPattern: "/api/plugins/{pluginId}" },
+  // Missions — reads, plus pause (the safe direction).
+  { method: "GET", pathPattern: "/api/me/missions" },
+  { method: "GET", pathPattern: "/api/me/missions/{id}" },
+  { method: "GET", pathPattern: "/api/me/missions/{id}/budget" },
+  { method: "GET", pathPattern: "/api/me/missions/{id}/works" },
+  { method: "POST", pathPattern: "/api/me/missions/{id}/pause" },
+  // Ideas — reads, plus filing a new Idea (a proposal a person builds).
+  { method: "POST", pathPattern: "/api/me/work-proposals" },
+  { method: "GET", pathPattern: "/api/me/work-proposals" },
+  { method: "GET", pathPattern: "/api/me/work-proposals/status" },
+  { method: "GET", pathPattern: "/api/me/work-proposals/preferences" },
+  { method: "GET", pathPattern: "/api/me/work-proposals/{id}" },
+  { method: "GET", pathPattern: "/api/me/work-proposals/{id}/budget" },
+  // Account-wide usage.
+  { method: "GET", pathPattern: "/api/me/usage/account-wide" },
+  // Tasks — reads and collaboration writes. Create / update / transition /
+  // assign / chat carry body refusals for run tokens in the Tasks
+  // controller (no checks, no schedule, no force, no dispatch, no @agent).
+  { method: "GET", pathPattern: "/api/tasks" },
+  { method: "POST", pathPattern: "/api/tasks" },
+  { method: "GET", pathPattern: "/api/tasks/{id}" },
+  { method: "PATCH", pathPattern: "/api/tasks/{id}" },
+  { method: "GET", pathPattern: "/api/tasks/{id}/subtasks" },
+  { method: "GET", pathPattern: "/api/tasks/{id}/activity" },
+  { method: "POST", pathPattern: "/api/tasks/{id}/transition" },
+  { method: "GET", pathPattern: "/api/tasks/{id}/run-candidates" },
+  { method: "GET", pathPattern: "/api/tasks/{id}/pr-status" },
+  { method: "GET", pathPattern: "/api/tasks/{id}/diff" },
+  { method: "POST", pathPattern: "/api/tasks/{id}/assignees" },
+  { method: "POST", pathPattern: "/api/tasks/{id}/reviewers" },
+  { method: "POST", pathPattern: "/api/tasks/{id}/approvers" },
+  { method: "POST", pathPattern: "/api/tasks/{id}/relations" },
+  { method: "GET", pathPattern: "/api/tasks/{id}/escalations" },
+  { method: "GET", pathPattern: "/api/tasks/{id}/chat" },
+  { method: "POST", pathPattern: "/api/tasks/{id}/chat" },
+  { method: "GET", pathPattern: "/api/tasks/{id}/spend" },
+  // Inbox — read only (no reply, no archive / delete / mark-read).
+  { method: "GET", pathPattern: "/api/inbox" },
+  { method: "GET", pathPattern: "/api/inbox/unread-count" },
+  { method: "GET", pathPattern: "/api/inbox/{id}" },
+  // Goals — reads, a draft create, field-limited update, pause, and the
+  // ASKING side of the definition of done (propose, never approve).
+  { method: "GET", pathPattern: "/api/me/goals" },
+  { method: "POST", pathPattern: "/api/me/goals" },
+  { method: "GET", pathPattern: "/api/me/goals/{id}" },
+  { method: "PATCH", pathPattern: "/api/me/goals/{id}" },
+  { method: "GET", pathPattern: "/api/me/goals/{id}/samples" },
+  { method: "POST", pathPattern: "/api/me/goals/{id}/pause" },
+  { method: "POST", pathPattern: "/api/me/goals/{id}/dod/propose" },
+  // Fleet — reads only.
+  { method: "GET", pathPattern: "/api/fleet/nodes" },
+  { method: "GET", pathPattern: "/api/fleet/nodes/{id}" },
+  { method: "GET", pathPattern: "/api/fleet/runner-status" },
+  { method: "GET", pathPattern: "/api/fleet/execution-preferences" },
+  { method: "GET", pathPattern: "/api/fleet/agents/{agentId}/node-affinity" },
+  // Agents — reads, plus cancel and pause (the safe direction).
+  { method: "GET", pathPattern: "/api/agents" },
+  { method: "GET", pathPattern: "/api/agents/{id}" },
+  { method: "GET", pathPattern: "/api/agents/{id}/runs" },
+  { method: "GET", pathPattern: "/api/agents/{id}/runs/{runId}" },
+  { method: "POST", pathPattern: "/api/agents/{id}/runs/{runId}/cancel" },
+  { method: "POST", pathPattern: "/api/agents/{id}/pause" },
+  { method: "GET", pathPattern: "/api/agents/{id}/budget" },
+  // Agent Plugins — read only (installing a package installs instructions).
+  { method: "GET", pathPattern: "/api/agent-plugins" },
+  { method: "GET", pathPattern: "/api/agent-plugins/findings" },
+  { method: "GET", pathPattern: "/api/agent-plugins/catalog" },
+  { method: "GET", pathPattern: "/api/agent-plugins/updates" }
+]);
+var MACHINE_PRINCIPAL_WORK_WRITABLE_FIELDS = Object.freeze(["name", "description"]);
+function splitSegments(normalizedPath) {
+  return normalizedPath.split("/").filter((segment) => segment.length > 0);
+}
+var FLEET_RUN_TOKEN_ROUTE_SHAPES = FLEET_RUN_TOKEN_ROUTES.map((route) => ({
+  method: route.method.toUpperCase(),
+  shape: splitSegments(route.pathPattern).map((part) => /^\{[^}]+\}$/.test(part) ? "*" : part.toLowerCase())
+}));
 var EMAIL_INBOX_DEFAULT_DAILY_CAP = 100;
 var EMAIL_INBOX_BURST_SENDS = 10;
 var EMAIL_INBOX_BURST_RECIPIENTS = 20;
@@ -1745,9 +1857,15 @@ var INTEGRATION_SCOPES = [
   "email:write",
   "events:read",
   "webhooks:manage",
-  "links:write"
+  "links:write",
+  "merges:decide"
+];
+var INTEGRATION_MERGE_DECISION_SCOPE = "merges:decide";
+var INTEGRATION_OPT_IN_SCOPES = [
+  "org:write",
+  "email:write",
+  INTEGRATION_MERGE_DECISION_SCOPE
 ];
-var INTEGRATION_OPT_IN_SCOPES = ["org:write", "email:write"];
 var EVER_GAUZY_PRESET_SCOPES = INTEGRATION_SCOPES.filter(
   (scope) => !INTEGRATION_OPT_IN_SCOPES.includes(scope)
 );
@@ -2540,6 +2658,7 @@ function isSafeWebhookUrl(rawUrl) {
   if (host.startsWith("[") && host.endsWith("]")) {
     host = host.slice(1, -1);
   }
+  host = host.replace(/\.+$/, "");
   if (CLOUD_METADATA_HOSTNAMES.has(host)) {
     return false;
   }
@@ -2569,23 +2688,69 @@ function isPrivateIPv4(ip) {
   if (a === 172 && b >= 16 && b <= 31) return true;
   if (a === 192 && b === 168) return true;
   if (a === 192 && b === 0 && parts[2] === 0) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a === 192 && b === 0 && parts[2] === 2) return true;
+  if (a === 198 && b === 51 && parts[2] === 100) return true;
+  if (a === 203 && b === 0 && parts[2] === 113) return true;
   if (a === 100 && b >= 64 && b <= 127) return true;
   if (a >= 224) return true;
   return false;
 }
-function isPrivateIPv6(ip) {
-  const lower = ip.toLowerCase();
-  if (lower === "::1" || lower === "::") return true;
-  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
-  const firstHextet = lower.split(":", 1)[0];
-  if (/^[0-9a-f]{1,4}$/.test(firstHextet)) {
-    const group0 = parseInt(firstHextet, 16);
-    if ((group0 & 65472) === 65152) return true;
-  }
-  if (lower.startsWith("::ffff:")) {
-    const v4 = lower.slice("::ffff:".length);
-    if ((0, import_net.isIP)(v4) === 4) return isPrivateIPv4(v4);
+function parseIPv6Groups(ip) {
+  let text = ip.trim().toLowerCase();
+  const zone = text.indexOf("%");
+  if (zone >= 0) text = text.slice(0, zone);
+  if ((0, import_net.isIP)(text) !== 6) return null;
+  const lastColon = text.lastIndexOf(":");
+  const tail = text.slice(lastColon + 1);
+  if (tail.includes(".")) {
+    if ((0, import_net.isIP)(tail) !== 4) return null;
+    const [a, b, c, d] = tail.split(".").map((part) => Number(part));
+    text = `${text.slice(0, lastColon + 1)}${(a << 8 | b).toString(16)}:${(c << 8 | d).toString(16)}`;
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return null;
+  const head = halves[0] ? halves[0].split(":") : [];
+  const rest = halves.length === 2 && halves[1] ? halves[1].split(":") : [];
+  const fill = halves.length === 2 ? 8 - head.length - rest.length : 0;
+  if (fill < 0) return null;
+  const groups = [...head, ...new Array(fill).fill("0"), ...rest].map((group) => parseInt(group, 16));
+  if (groups.length !== 8 || groups.some((group) => Number.isNaN(group) || group < 0 || group > 65535)) {
+    return null;
   }
+  return groups;
+}
+function ipv4FromGroups(high, low) {
+  return `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`;
+}
+function embeddedIPv4(ip) {
+  const g = parseIPv6Groups(ip);
+  if (!g) return null;
+  const zeros = (from, to) => g.slice(from, to).every((group) => group === 0);
+  if (zeros(0, 5) && g[5] === 65535) return ipv4FromGroups(g[6], g[7]);
+  if (zeros(0, 4) && g[4] === 65535 && g[5] === 0) return ipv4FromGroups(g[6], g[7]);
+  if (zeros(0, 6) && (g[6] !== 0 || g[7] > 1)) return ipv4FromGroups(g[6], g[7]);
+  if (g[0] === 100 && g[1] === 65435 && zeros(2, 6)) return ipv4FromGroups(g[6], g[7]);
+  if (g[0] === 8194) return ipv4FromGroups(g[1], g[2]);
+  if (g[0] === 8193 && g[1] === 0) return ipv4FromGroups(g[6] ^ 65535, g[7] ^ 65535);
+  return null;
+}
+function isPrivateIPv6(ip) {
+  const g = parseIPv6Groups(ip);
+  if (!g) {
+    const lower = ip.toLowerCase();
+    return lower === "::1" || lower === "::" || lower.startsWith("fc") || lower.startsWith("fd");
+  }
+  if (g.every((group) => group === 0)) return true;
+  if (g.slice(0, 7).every((group) => group === 0) && g[7] === 1) return true;
+  if ((g[0] & 65024) === 64512) return true;
+  if ((g[0] & 65472) === 65152) return true;
+  if ((g[0] & 65472) === 65216) return true;
+  if ((g[0] & 65280) === 65280) return true;
+  if (g[0] === 8193 && g[1] === 3512) return true;
+  if (g[0] === 100 && g[1] === 65435 && g[2] === 1) return true;
+  const v4 = embeddedIPv4(ip);
+  if (v4 && isPrivateIPv4(v4)) return true;
   return false;
 }
 

package/dist/index.js

@@ -465,6 +465,13 @@ var PLATFORM_DEFAULT_MERGE_POLICY = Object.freeze({
   allowedMergeMethods: ["squash"],
   protectedBranches: ["main", "master", "develop", "stage"]
 });
+var MERGE_POLICY_PROTECTED_BRANCH_FLOOR = Object.freeze([
+  "main",
+  "master",
+  "develop",
+  "stage"
+]);
+var MERGE_POLICY_ALWAYS_APPROVED_BRANCHES = Object.freeze(["main", "master"]);
 var MERGE_APPROVAL_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var TOOL_GRANT_SCOPE_PRECEDENCE = Object.freeze([
   "tenant",
@@ -1177,6 +1184,111 @@ var FLEET_HEALTH_DISK_CRITICAL_MARGIN_BYTES = 1024 ** 3;
 var FLEET_HEALTH_MAX_MIB = 2 ** 40;
 var FLEET_HEALTH_MAX_UPTIME_SEC = 100 * 365 * 24 * 60 * 60;
 var FLEET_HEALTH_BYTES_PER_MIB = 1024 * 1024;
+var FLEET_RUN_TOKEN_ROUTES = Object.freeze([
+  // Works — reads, plus the settings update (its merge / check / command
+  // fields are refused for run tokens by the Works controller).
+  { method: "GET", pathPattern: "/api/works" },
+  { method: "GET", pathPattern: "/api/works/{id}" },
+  { method: "PUT", pathPattern: "/api/works/{id}" },
+  { method: "GET", pathPattern: "/api/works/{id}/config" },
+  { method: "GET", pathPattern: "/api/works/{id}/items" },
+  { method: "GET", pathPattern: "/api/works/{id}/categories-tags" },
+  { method: "GET", pathPattern: "/api/works/{id}/history" },
+  { method: "GET", pathPattern: "/api/works/{id}/generator-form" },
+  { method: "GET", pathPattern: "/api/works/{id}/schedule" },
+  { method: "GET", pathPattern: "/api/works/{id}/comparisons" },
+  { method: "GET", pathPattern: "/api/works/{id}/comparisons/{slug}" },
+  // Knowledge Base (`apps/mcp/src/tools/kb`). A document a run token writes
+  // lands `proposed` (review-gated), see the KB controller. No unlock.
+  { method: "GET", pathPattern: "/api/works/{id}/kb/documents" },
+  { method: "POST", pathPattern: "/api/works/{id}/kb/documents" },
+  { method: "GET", pathPattern: "/api/works/{id}/kb/documents/{docIdOrPath}" },
+  { method: "PATCH", pathPattern: "/api/works/{id}/kb/documents/{docId}" },
+  { method: "POST", pathPattern: "/api/works/{id}/kb/documents/{docId}/lock" },
+  // Deploy — reads and the capability check only.
+  { method: "GET", pathPattern: "/api/deploy/works/{id}/domains" },
+  { method: "GET", pathPattern: "/api/deploy/providers" },
+  { method: "POST", pathPattern: "/api/deploy/works/{id}/check" },
+  // Plugins — read only.
+  { method: "GET", pathPattern: "/api/plugins" },
+  { method: "GET", pathPattern: "/api/plugins/{pluginId}" },
+  // Missions — reads, plus pause (the safe direction).
+  { method: "GET", pathPattern: "/api/me/missions" },
+  { method: "GET", pathPattern: "/api/me/missions/{id}" },
+  { method: "GET", pathPattern: "/api/me/missions/{id}/budget" },
+  { method: "GET", pathPattern: "/api/me/missions/{id}/works" },
+  { method: "POST", pathPattern: "/api/me/missions/{id}/pause" },
+  // Ideas — reads, plus filing a new Idea (a proposal a person builds).
+  { method: "POST", pathPattern: "/api/me/work-proposals" },
+  { method: "GET", pathPattern: "/api/me/work-proposals" },
+  { method: "GET", pathPattern: "/api/me/work-proposals/status" },
+  { method: "GET", pathPattern: "/api/me/work-proposals/preferences" },
+  { method: "GET", pathPattern: "/api/me/work-proposals/{id}" },
+  { method: "GET", pathPattern: "/api/me/work-proposals/{id}/budget" },
+  // Account-wide usage.
+  { method: "GET", pathPattern: "/api/me/usage/account-wide" },
+  // Tasks — reads and collaboration writes. Create / update / transition /
+  // assign / chat carry body refusals for run tokens in the Tasks
+  // controller (no checks, no schedule, no force, no dispatch, no @agent).
+  { method: "GET", pathPattern: "/api/tasks" },
+  { method: "POST", pathPattern: "/api/tasks" },
+  { method: "GET", pathPattern: "/api/tasks/{id}" },
+  { method: "PATCH", pathPattern: "/api/tasks/{id}" },
+  { method: "GET", pathPattern: "/api/tasks/{id}/subtasks" },
+  { method: "GET", pathPattern: "/api/tasks/{id}/activity" },
+  { method: "POST", pathPattern: "/api/tasks/{id}/transition" },
+  { method: "GET", pathPattern: "/api/tasks/{id}/run-candidates" },
+  { method: "GET", pathPattern: "/api/tasks/{id}/pr-status" },
+  { method: "GET", pathPattern: "/api/tasks/{id}/diff" },
+  { method: "POST", pathPattern: "/api/tasks/{id}/assignees" },
+  { method: "POST", pathPattern: "/api/tasks/{id}/reviewers" },
+  { method: "POST", pathPattern: "/api/tasks/{id}/approvers" },
+  { method: "POST", pathPattern: "/api/tasks/{id}/relations" },
+  { method: "GET", pathPattern: "/api/tasks/{id}/escalations" },
+  { method: "GET", pathPattern: "/api/tasks/{id}/chat" },
+  { method: "POST", pathPattern: "/api/tasks/{id}/chat" },
+  { method: "GET", pathPattern: "/api/tasks/{id}/spend" },
+  // Inbox — read only (no reply, no archive / delete / mark-read).
+  { method: "GET", pathPattern: "/api/inbox" },
+  { method: "GET", pathPattern: "/api/inbox/unread-count" },
+  { method: "GET", pathPattern: "/api/inbox/{id}" },
+  // Goals — reads, a draft create, field-limited update, pause, and the
+  // ASKING side of the definition of done (propose, never approve).
+  { method: "GET", pathPattern: "/api/me/goals" },
+  { method: "POST", pathPattern: "/api/me/goals" },
+  { method: "GET", pathPattern: "/api/me/goals/{id}" },
+  { method: "PATCH", pathPattern: "/api/me/goals/{id}" },
+  { method: "GET", pathPattern: "/api/me/goals/{id}/samples" },
+  { method: "POST", pathPattern: "/api/me/goals/{id}/pause" },
+  { method: "POST", pathPattern: "/api/me/goals/{id}/dod/propose" },
+  // Fleet — reads only.
+  { method: "GET", pathPattern: "/api/fleet/nodes" },
+  { method: "GET", pathPattern: "/api/fleet/nodes/{id}" },
+  { method: "GET", pathPattern: "/api/fleet/runner-status" },
+  { method: "GET", pathPattern: "/api/fleet/execution-preferences" },
+  { method: "GET", pathPattern: "/api/fleet/agents/{agentId}/node-affinity" },
+  // Agents — reads, plus cancel and pause (the safe direction).
+  { method: "GET", pathPattern: "/api/agents" },
+  { method: "GET", pathPattern: "/api/agents/{id}" },
+  { method: "GET", pathPattern: "/api/agents/{id}/runs" },
+  { method: "GET", pathPattern: "/api/agents/{id}/runs/{runId}" },
+  { method: "POST", pathPattern: "/api/agents/{id}/runs/{runId}/cancel" },
+  { method: "POST", pathPattern: "/api/agents/{id}/pause" },
+  { method: "GET", pathPattern: "/api/agents/{id}/budget" },
+  // Agent Plugins — read only (installing a package installs instructions).
+  { method: "GET", pathPattern: "/api/agent-plugins" },
+  { method: "GET", pathPattern: "/api/agent-plugins/findings" },
+  { method: "GET", pathPattern: "/api/agent-plugins/catalog" },
+  { method: "GET", pathPattern: "/api/agent-plugins/updates" }
+]);
+var MACHINE_PRINCIPAL_WORK_WRITABLE_FIELDS = Object.freeze(["name", "description"]);
+function splitSegments(normalizedPath) {
+  return normalizedPath.split("/").filter((segment) => segment.length > 0);
+}
+var FLEET_RUN_TOKEN_ROUTE_SHAPES = FLEET_RUN_TOKEN_ROUTES.map((route) => ({
+  method: route.method.toUpperCase(),
+  shape: splitSegments(route.pathPattern).map((part) => /^\{[^}]+\}$/.test(part) ? "*" : part.toLowerCase())
+}));
 var EMAIL_INBOX_DEFAULT_DAILY_CAP = 100;
 var EMAIL_INBOX_BURST_SENDS = 10;
 var EMAIL_INBOX_BURST_RECIPIENTS = 20;
@@ -1718,9 +1830,15 @@ var INTEGRATION_SCOPES = [
   "email:write",
   "events:read",
   "webhooks:manage",
-  "links:write"
+  "links:write",
+  "merges:decide"
+];
+var INTEGRATION_MERGE_DECISION_SCOPE = "merges:decide";
+var INTEGRATION_OPT_IN_SCOPES = [
+  "org:write",
+  "email:write",
+  INTEGRATION_MERGE_DECISION_SCOPE
 ];
-var INTEGRATION_OPT_IN_SCOPES = ["org:write", "email:write"];
 var EVER_GAUZY_PRESET_SCOPES = INTEGRATION_SCOPES.filter(
   (scope) => !INTEGRATION_OPT_IN_SCOPES.includes(scope)
 );
@@ -2513,6 +2631,7 @@ function isSafeWebhookUrl(rawUrl) {
   if (host.startsWith("[") && host.endsWith("]")) {
     host = host.slice(1, -1);
   }
+  host = host.replace(/\.+$/, "");
   if (CLOUD_METADATA_HOSTNAMES.has(host)) {
     return false;
   }
@@ -2542,23 +2661,69 @@ function isPrivateIPv4(ip) {
   if (a === 172 && b >= 16 && b <= 31) return true;
   if (a === 192 && b === 168) return true;
   if (a === 192 && b === 0 && parts[2] === 0) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a === 192 && b === 0 && parts[2] === 2) return true;
+  if (a === 198 && b === 51 && parts[2] === 100) return true;
+  if (a === 203 && b === 0 && parts[2] === 113) return true;
   if (a === 100 && b >= 64 && b <= 127) return true;
   if (a >= 224) return true;
   return false;
 }
-function isPrivateIPv6(ip) {
-  const lower = ip.toLowerCase();
-  if (lower === "::1" || lower === "::") return true;
-  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
-  const firstHextet = lower.split(":", 1)[0];
-  if (/^[0-9a-f]{1,4}$/.test(firstHextet)) {
-    const group0 = parseInt(firstHextet, 16);
-    if ((group0 & 65472) === 65152) return true;
-  }
-  if (lower.startsWith("::ffff:")) {
-    const v4 = lower.slice("::ffff:".length);
-    if (isIP(v4) === 4) return isPrivateIPv4(v4);
+function parseIPv6Groups(ip) {
+  let text = ip.trim().toLowerCase();
+  const zone = text.indexOf("%");
+  if (zone >= 0) text = text.slice(0, zone);
+  if (isIP(text) !== 6) return null;
+  const lastColon = text.lastIndexOf(":");
+  const tail = text.slice(lastColon + 1);
+  if (tail.includes(".")) {
+    if (isIP(tail) !== 4) return null;
+    const [a, b, c, d] = tail.split(".").map((part) => Number(part));
+    text = `${text.slice(0, lastColon + 1)}${(a << 8 | b).toString(16)}:${(c << 8 | d).toString(16)}`;
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return null;
+  const head = halves[0] ? halves[0].split(":") : [];
+  const rest = halves.length === 2 && halves[1] ? halves[1].split(":") : [];
+  const fill = halves.length === 2 ? 8 - head.length - rest.length : 0;
+  if (fill < 0) return null;
+  const groups = [...head, ...new Array(fill).fill("0"), ...rest].map((group) => parseInt(group, 16));
+  if (groups.length !== 8 || groups.some((group) => Number.isNaN(group) || group < 0 || group > 65535)) {
+    return null;
   }
+  return groups;
+}
+function ipv4FromGroups(high, low) {
+  return `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`;
+}
+function embeddedIPv4(ip) {
+  const g = parseIPv6Groups(ip);
+  if (!g) return null;
+  const zeros = (from, to) => g.slice(from, to).every((group) => group === 0);
+  if (zeros(0, 5) && g[5] === 65535) return ipv4FromGroups(g[6], g[7]);
+  if (zeros(0, 4) && g[4] === 65535 && g[5] === 0) return ipv4FromGroups(g[6], g[7]);
+  if (zeros(0, 6) && (g[6] !== 0 || g[7] > 1)) return ipv4FromGroups(g[6], g[7]);
+  if (g[0] === 100 && g[1] === 65435 && zeros(2, 6)) return ipv4FromGroups(g[6], g[7]);
+  if (g[0] === 8194) return ipv4FromGroups(g[1], g[2]);
+  if (g[0] === 8193 && g[1] === 0) return ipv4FromGroups(g[6] ^ 65535, g[7] ^ 65535);
+  return null;
+}
+function isPrivateIPv6(ip) {
+  const g = parseIPv6Groups(ip);
+  if (!g) {
+    const lower = ip.toLowerCase();
+    return lower === "::1" || lower === "::" || lower.startsWith("fc") || lower.startsWith("fd");
+  }
+  if (g.every((group) => group === 0)) return true;
+  if (g.slice(0, 7).every((group) => group === 0) && g[7] === 1) return true;
+  if ((g[0] & 65024) === 64512) return true;
+  if ((g[0] & 65472) === 65152) return true;
+  if ((g[0] & 65472) === 65216) return true;
+  if ((g[0] & 65280) === 65280) return true;
+  if (g[0] === 8193 && g[1] === 3512) return true;
+  if (g[0] === 100 && g[1] === 65435 && g[2] === 1) return true;
+  const v4 = embeddedIPv4(ip);
+  if (v4 && isPrivateIPv4(v4)) return true;
   return false;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ever-works/activepieces-plugin",
-	"version": "1.0.10",
+	"version": "1.0.12",
 	"description": "Activepieces Automation Pipeline Plugin - Delegates Work generation steps to Activepieces flows",
 	"author": {
 		"name": "Ever Co. LTD",
@@ -33,10 +33,10 @@
 		"test:coverage": "vitest run --coverage"
 	},
 	"peerDependencies": {
-		"@ever-works/plugin": "^1.2.6"
+		"@ever-works/plugin": "^1.2.9"
 	},
 	"devDependencies": {
-		"@ever-works/plugin": "^1.2.6",
+		"@ever-works/plugin": "^1.2.9",
 		"@types/node": "^26.6.4",
 		"tsup": "^8.0.0",
 		"typescript": "^5.9.3",
@@ -76,8 +76,8 @@
 		"url": "https://github.com/ever-works/ever-works/issues"
 	},
 	"everworksRelease": {
-		"contentHash": "sha256:9ed5f2971d727b8a25c4d16ea0c3d3b868bc88741e9bae48fdd78e2ff153543c",
-		"commit": "eff002871bfd7f9f8e0f984907f45265ae8b01e0",
-		"source": "https://github.com/ever-works/ever-works/tree/eff002871bfd7f9f8e0f984907f45265ae8b01e0/packages/plugins/activepieces"
+		"contentHash": "sha256:ab45e1abb88fc67ca4be7bfc1067bb433885299fb505a706779a0c7347d43834",
+		"commit": "5b5a17e1cdc02e06383d508a6424a863521fc3e0",
+		"source": "https://github.com/ever-works/ever-works/tree/5b5a17e1cdc02e06383d508a6424a863521fc3e0/packages/plugins/activepieces"
 	}
 }