@intentface/latch-net 0.9.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Intentface
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,31 @@
+# @intentface/latch-net
+
+Network-safety primitives for Latch — SSRF guards and a DNS-pinned egress `fetch`, shared by every host that opens an outbound connection on a model's behalf.
+
+The root export has **zero third-party dependencies** (Node built-ins only), so any package can depend on it without pulling weight in. The pinned fetch, which needs `undici`, sits behind the `/pinned` subpath.
+
+## What it does
+
+- **`assertPublicUrl`** — the front-line check. Parses the URL and rejects any host that is, or resolves to, a private, loopback, link-local or otherwise internal address. Returns the parsed `URL` so the caller can keep using it.
+- **`isBlockedHost` / `isBlockedResolved` / `isPrivateV4`** — the predicates behind it. The string-level one is deliberately conservative, covering `.localhost` and `.local` names, IPv6 literals in any spelling, and the integer and hex encodings of an IPv4 address. The resolving one is the rebinding backstop.
+- **`isHostAllowed`** — positive allowlist matching (an exact host, or `.suffix` for subdomains), used to bound which hosts a tenant may reach at all. It complements the blocklist rather than replacing it.
+- **`createPinnedFetch` / `pinnedFetch`** (`@intentface/latch-net/pinned`) — a `fetch` that vets addresses **inside** the lookup the connection itself uses.
+
+## Why the pinned fetch exists
+
+Checking a hostname and then handing it to `fetch` leaves a gap: `fetch` performs its own second DNS lookup, so a name that resolves public during the check and private when the socket opens defeats the guard. That is DNS rebinding, and it is a time-of-check/time-of-use bug, not a weak blocklist.
+
+`createPinnedFetch` closes the gap by validating in the undici connector's `lookup`, so there is no distance between validating and connecting. TLS is untouched: SNI and certificate validation stay against the original hostname, and redirect hops dispatch through the same agent, so every hop is connect-vetted too.
+
+```ts
+import { assertPublicUrl } from "@intentface/latch-net";
+import { createPinnedFetch } from "@intentface/latch-net/pinned";
+
+await assertPublicUrl(url); // throws on private / non-public targets
+const fetch = createPinnedFetch();
+const response = await fetch(url, { redirect: "follow" });
+```
+
+## Where it fits
+
+An optional peer of `@intentface/latch-core`, required by its `web_fetch` harness tool. `latch-mcp` uses the allowlist to bound MCP server hosts, and any host tool that fetches a user-supplied URL should route through it.

package/dist/allowlist.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Positive host allowlist shared by hosts that gate outbound connections on a
+ * per-tenant list (MCP servers, OpenAPI backends). Complements the SSRF
+ * blocklist in ./ssrf.ts: the allowlist says which hosts a tenant may reach at
+ * all; the blocklist rejects private/internal addresses regardless.
+ */
+/** True if `host` is permitted by the allowlist (exact, or `.suffix` subdomain). */
+export declare function isHostAllowed(host: string, allowed: string[]): boolean;
+//# sourceMappingURL=allowlist.d.ts.map

package/dist/allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.d.ts","sourceRoot":"","sources":["../src/allowlist.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAStE"}

package/dist/allowlist.js

@@ -0,0 +1,19 @@
+/**
+ * Positive host allowlist shared by hosts that gate outbound connections on a
+ * per-tenant list (MCP servers, OpenAPI backends). Complements the SSRF
+ * blocklist in ./ssrf.ts: the allowlist says which hosts a tenant may reach at
+ * all; the blocklist rejects private/internal addresses regardless.
+ */
+/** True if `host` is permitted by the allowlist (exact, or `.suffix` subdomain). */
+export function isHostAllowed(host, allowed) {
+    // Strip one trailing DNS dot: `URL.hostname` preserves it for a FQDN like
+    // `api.example.com.`, which must match the same allowlist entries.
+    const h = host.toLowerCase().replace(/\.$/, "");
+    return allowed.some((entry) => {
+        const a = entry.toLowerCase();
+        if (a.startsWith("."))
+            return h === a.slice(1) || h.endsWith(a);
+        return h === a;
+    });
+}
+//# sourceMappingURL=allowlist.js.map

package/dist/allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.js","sourceRoot":"","sources":["../src/allowlist.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAiB;IAC3D,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @intentface/latch-net
+ *
+ * Network-safety primitives shared across the Latch stack. This root export
+ * has zero third-party dependencies (Node built-ins only), so any host
+ * package can depend on it without pulling heavier packages in; the
+ * DNS-pinned egress fetch, which pulls in `undici`, lives behind the
+ * `@intentface/latch-net/pinned` subpath.
+ */
+export { isPrivateV4, isBlockedHost, isBlockedResolved, assertPublicUrl, } from "./ssrf.js";
+export { isHostAllowed } from "./allowlist.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,eAAe,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,12 @@
+/**
+ * @intentface/latch-net
+ *
+ * Network-safety primitives shared across the Latch stack. This root export
+ * has zero third-party dependencies (Node built-ins only), so any host
+ * package can depend on it without pulling heavier packages in; the
+ * DNS-pinned egress fetch, which pulls in `undici`, lives behind the
+ * `@intentface/latch-net/pinned` subpath.
+ */
+export { isPrivateV4, isBlockedHost, isBlockedResolved, assertPublicUrl, } from "./ssrf.js";
+export { isHostAllowed } from "./allowlist.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,eAAe,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/pinned-fetch.d.ts

@@ -0,0 +1,72 @@
+import { buildConnector } from "undici";
+/**
+ * DNS-pinned SSRF-safe fetch.
+ *
+ * The guards in `ssrf.ts` validate a hostname and then hand it to `fetch`,
+ * which performs its OWN second DNS lookup — a name that resolves public
+ * during the check and private when the connection opens (DNS rebinding /
+ * TOCTOU) defeats them. This module closes that gap by vetting addresses
+ * INSIDE the lookup the connection itself uses (undici `Agent` →
+ * `buildConnector` → `net`/`tls.connect` `lookup`), so there is no
+ * validate-vs-connect distance at all. TLS is untouched: undici sets
+ * `servername` from the URL host before the lookup runs, so SNI and
+ * certificate validation stay against the original hostname and
+ * `rejectUnauthorized` keeps its default.
+ *
+ * Lives behind the `@intentface/latch-net/pinned` subpath (not the root
+ * export) because it pulls in `undici` — the root entry stays third-party-free.
+ *
+ * Redirect hops dispatch through the same agent, so with `redirect: "follow"`
+ * every hop is connect-vetted too (call sites here still use "error"/"manual"
+ * for better messages and header hygiene).
+ */
+/**
+ * Input is `string | URL` only — undici's `fetch` rejects `Request` objects
+ * built by another fetch implementation (cross-realm brand check), so the
+ * type must not admit them.
+ */
+export type FetchLike = (input: string | URL, init?: RequestInit) => Promise<Response>;
+export interface PinnedFetch extends FetchLike {
+    /** Close the underlying Agent (keep-alive sockets would hold a test's event loop). */
+    close(): Promise<void>;
+}
+type Addr = {
+    address: string;
+    family: number;
+};
+/**
+ * Callback-style resolver, injectable for tests. Always invoked with
+ * `all: true`; other options (`family`, `hints`) pass through from `net`.
+ */
+export type BaseLookup = (hostname: string, options: {
+    all: true;
+    family?: number;
+    hints?: number;
+}, callback: (err: NodeJS.ErrnoException | null, addresses?: Addr[]) => void) => void;
+export interface PinnedFetchOptions {
+    /**
+     * Skip the private-address vetting (trusted local backend, tests against
+     * 127.0.0.1 servers). The pinning path itself is unchanged.
+     */
+    allowPrivate?: boolean;
+    /** Test seam; defaults to `node:dns` `lookup`. */
+    lookup?: BaseLookup;
+    /**
+     * Extra socket/TLS options for the connector (tests: a fixture `ca`).
+     * `autoSelectFamily` is widened in explicitly: it IS typed in the union's
+     * `TcpNetConnectOpts` member, but that member requires `port`, so a partial
+     * options object can never select it.
+     */
+    connect?: buildConnector.BuildOptions & {
+        autoSelectFamily?: boolean;
+    };
+}
+/**
+ * Build a fetch whose connections resolve through the vetting lookup above.
+ * One shared `Agent` per instance — pooled keep-alive sockets are safe to
+ * reuse because they were vetted when they connected.
+ */
+export declare function createPinnedFetch(options?: PinnedFetchOptions): PinnedFetch;
+export declare const pinnedFetch: FetchLike;
+export {};
+//# sourceMappingURL=pinned-fetch.d.ts.map

package/dist/pinned-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinned-fetch.d.ts","sourceRoot":"","sources":["../src/pinned-fetch.ts"],"names":[],"mappings":"AAEA,OAAO,EAAS,cAAc,EAAwB,MAAM,QAAQ,CAAC;AAIrE;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,CACtB,KAAK,EAAE,MAAM,GAAG,GAAG,EACnB,IAAI,CAAC,EAAE,WAAW,KACf,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC5C,sFAAsF;IACtF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,KAAK,IAAI,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhD;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EACvD,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,IAAI,KACtE,IAAI,CAAC;AAEV,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,kDAAkD;IAClD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC,YAAY,GAAG;QAAE,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACxE;AA0DD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,kBAAuB,GAAG,WAAW,CA6B/E;AASD,eAAO,MAAM,WAAW,EAAE,SACqB,CAAC"}

package/dist/pinned-fetch.js

@@ -0,0 +1,91 @@
+import { lookup as dnsLookup } from "node:dns";
+import { isIP } from "node:net";
+import { Agent, buildConnector, fetch as undiciFetch } from "undici";
+import { isBlockedHost, isPrivateV4, isPrivateV6, parseIPv6 } from "./ssrf.js";
+function isPrivateAddress({ address, family }) {
+    if (family === 4)
+        return isPrivateV4(address);
+    const bytes = parseIPv6(address);
+    return bytes ? isPrivateV6(bytes) : true; // unparseable resolver output → fail closed
+}
+/**
+ * Wrap a resolver so every address it returns is classified before the socket
+ * ever sees it: error (fail closed) on lookup failure, an empty answer, or —
+ * unless `allowPrivate` — any private/internal address. Node calls the lookup
+ * in two shapes depending on `options.all` (`autoSelectFamily` uses the array
+ * form); both are honored.
+ */
+function vettingLookup(base, allowPrivate) {
+    return (hostname, options, callback) => {
+        base(hostname, { ...options, all: true }, (err, addresses) => {
+            if (err)
+                return callback(err);
+            const addrs = addresses ?? [];
+            if (addrs.length === 0) {
+                return callback(new Error(`lookup returned no addresses: ${hostname}`));
+            }
+            if (!allowPrivate) {
+                const bad = addrs.find(isPrivateAddress);
+                if (bad) {
+                    return callback(new Error(`Blocked private/internal address: ${hostname} -> ${bad.address}`));
+                }
+            }
+            if (options.all)
+                return callback(null, addrs);
+            // Scalar shape: honor a requested family even if the base resolver
+            // ignored the forwarded option (real dns.lookup honors it; the contract
+            // on BaseLookup doesn't require it). No cross-family fallback — handing
+            // back the wrong family is worse than failing, and real dns.lookup
+            // reports ENOTFOUND for a family with no answers.
+            const pick = options.family
+                ? addrs.find((a) => a.family === options.family)
+                : addrs[0];
+            if (!pick) {
+                return callback(new Error(`lookup returned no addresses for family ${options.family}: ${hostname}`));
+            }
+            callback(null, pick.address, pick.family);
+        });
+    };
+}
+/**
+ * Build a fetch whose connections resolve through the vetting lookup above.
+ * One shared `Agent` per instance — pooled keep-alive sockets are safe to
+ * reuse because they were vetted when they connected.
+ */
+export function createPinnedFetch(options = {}) {
+    const { allowPrivate = false, lookup = dnsLookup } = options;
+    const base = buildConnector({
+        ...options.connect,
+        // Passed through to net/tls.connect; spread AFTER options.connect so a
+        // caller can never displace the vetting resolver. (Cast for the same
+        // BuildOptions-union reason as `autoSelectFamily` above.)
+        lookup: vettingLookup(lookup, allowPrivate),
+    });
+    // net.connect skips `lookup` entirely for IP-literal hosts — vet those here.
+    const connector = (opts, cb) => {
+        const host = opts.hostname.replace(/^\[|\]$/g, "");
+        if (!allowPrivate && isIP(host) !== 0 && isBlockedHost(host)) {
+            cb(new Error(`Blocked private/internal address: ${host}`), null);
+            return;
+        }
+        base(opts, cb);
+    };
+    const agent = new Agent({ connect: connector });
+    // undici's fetch, not the global: mixing this Agent into Node's bundled
+    // fetch is cross-version undici and unsupported. Types differ from lib.dom
+    // but the runtime objects are the same implementation Node bundles.
+    const fn = (input, init) => undiciFetch(input, {
+        ...init,
+        dispatcher: agent,
+    });
+    return Object.assign(fn, { close: () => agent.close() });
+}
+/**
+ * Shared default instance, constructed lazily (no Agent at import time).
+ * Deliberately exposed WITHOUT `close()` — it is shared, so no caller may
+ * tear it down under the others; a long-lived server never closes it, and
+ * idle keep-alive sockets expire on undici's own timeout.
+ */
+let shared;
+export const pinnedFetch = (input, init) => (shared ??= createPinnedFetch())(input, init);
+//# sourceMappingURL=pinned-fetch.js.map

package/dist/pinned-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinned-fetch.js","sourceRoot":"","sources":["../src/pinned-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAoE/E,SAAS,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAQ;IACjD,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,4CAA4C;AACxF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,IAAgB,EAAE,YAAqB;IAC5D,OAAO,CACL,QAAgB,EAChB,OAA2C,EAC3C,QAAyE,EACnE,EAAE;QACR,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;YAC3D,IAAI,GAAG;gBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,SAAS,IAAI,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBACzC,IAAI,GAAG,EAAE,CAAC;oBACR,OAAO,QAAQ,CACb,IAAI,KAAK,CACP,qCAAqC,QAAQ,OAAO,GAAG,CAAC,OAAO,EAAE,CAClE,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,OAAO,CAAC,GAAG;gBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC9C,mEAAmE;YACnE,wEAAwE;YACxE,wEAAwE;YACxE,mEAAmE;YACnE,kDAAkD;YAClD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM;gBACzB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;gBAChD,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACb,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,QAAQ,CACb,IAAI,KAAK,CACP,2CAA2C,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CACzE,CACF,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA8B,EAAE;IAChE,MAAM,EAAE,YAAY,GAAG,KAAK,EAAE,MAAM,GAAG,SAAkC,EAAE,GACzE,OAAO,CAAC;IACV,MAAM,IAAI,GAAG,cAAc,CAAC;QAC1B,GAAG,OAAO,CAAC,OAAO;QAClB,uEAAuE;QACvE,qEAAqE;QACrE,0DAA0D;QAC1D,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC;KACb,CAAC,CAAC;IAClC,6EAA6E;IAC7E,MAAM,SAAS,GAA6B,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,EAAE,CAAC,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACjB,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAChD,wEAAwE;IACxE,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,EAAE,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACpC,WAAW,CAAC,KAA0C,EAAE;QACtD,GAAI,IAAuE;QAC3E,UAAU,EAAE,KAAK;KAClB,CAAiC,CAAC;IACrC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,IAAI,MAA+B,CAAC;AACpC,MAAM,CAAC,MAAM,WAAW,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACpD,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC"}

package/dist/ssrf.d.ts

@@ -0,0 +1,53 @@
+/**
+ * SSRF guards for any Latch host that opens an outbound connection to a
+ * config- or agent-supplied URL (MCP servers, OpenAPI backends, the renderer's
+ * fetch service). A URL could point at internal/cloud-metadata addresses, so
+ * there are two layers: a string-level blocklist for encoded/literal private
+ * hosts, and a DNS-resolution backstop for public names that resolve private.
+ *
+ * These are best-effort and deliberately conservative (they err toward
+ * blocking). They complement, but do not replace, a positive allowlist — see
+ * `@intentface/latch-mcp`'s per-tenant `allowedHosts`.
+ *
+ * These checks validate at CHECK time, not CONNECT time — on their own they
+ * do not close DNS rebinding (a name that resolves public here but private
+ * when the request opens). For that, route the request through the pinned
+ * fetch in `pinned-fetch.ts` (`@intentface/latch-net/pinned`), which vets
+ * addresses inside the lookup the connection itself uses; the checks here
+ * remain useful as early, well-messaged pre-flight gates.
+ */
+/** True if a dotted-decimal IPv4 (or a short form like 127.1) is private/loopback/link-local. */
+export declare function isPrivateV4(ip: string): boolean;
+/**
+ * Parse an IPv6 literal into its 16 bytes — compressed (`::1`), fully expanded
+ * (`0:0:0:0:0:0:0:1`), or with an embedded IPv4 tail (`::ffff:127.0.0.1`).
+ * Returns null for anything that isn't a valid IPv6 literal. One parser so every
+ * spelling (not just `::`-prefixed hex) is classified the same way.
+ */
+export declare function parseIPv6(input: string): number[] | null;
+/**
+ * True if a 16-byte IPv6 address is unspecified/loopback/ULA/link-local, or an
+ * IPv4-mapped/compatible address whose embedded IPv4 is private.
+ */
+export declare function isPrivateV6(b: number[]): boolean;
+/**
+ * String-level blocklist: trailing-dot, bracketed IPv6 (loopback/ULA/link-local
+ * + IPv4-mapped/compatible, dotted or hex), bare integer / hex encodings of
+ * IPv4 (2130706433, 0x7f000001), short dotted forms (127.1). Best-effort and
+ * conservative — strictly more blocking. `isBlockedResolved` backs this up to
+ * defeat DNS rebinding.
+ */
+export declare function isBlockedHost(host: string): boolean;
+/**
+ * DNS-rebinding backstop: resolve the hostname and reject if ANY resolved
+ * address is private/loopback/link-local. The string check above cannot catch
+ * `http://public-name/` that resolves to 169.254.169.254 — this does.
+ */
+export declare function isBlockedResolved(hostname: string): Promise<boolean>;
+/**
+ * Convenience for callers that want one hard gate: parse `input`, then reject a
+ * private/internal literal (`isBlockedHost`) or a name that resolves private
+ * (`isBlockedResolved`). Returns the parsed `URL` on success; throws otherwise.
+ */
+export declare function assertPublicUrl(input: string | URL): Promise<URL>;
+//# sourceMappingURL=ssrf.d.ts.map

package/dist/ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.d.ts","sourceRoot":"","sources":["../src/ssrf.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AAEH,iGAAiG;AACjG,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAa/C;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAgCxD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAUhD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAanD;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAa1E;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAYvE"}

package/dist/ssrf.js

@@ -0,0 +1,173 @@
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+/**
+ * SSRF guards for any Latch host that opens an outbound connection to a
+ * config- or agent-supplied URL (MCP servers, OpenAPI backends, the renderer's
+ * fetch service). A URL could point at internal/cloud-metadata addresses, so
+ * there are two layers: a string-level blocklist for encoded/literal private
+ * hosts, and a DNS-resolution backstop for public names that resolve private.
+ *
+ * These are best-effort and deliberately conservative (they err toward
+ * blocking). They complement, but do not replace, a positive allowlist — see
+ * `@intentface/latch-mcp`'s per-tenant `allowedHosts`.
+ *
+ * These checks validate at CHECK time, not CONNECT time — on their own they
+ * do not close DNS rebinding (a name that resolves public here but private
+ * when the request opens). For that, route the request through the pinned
+ * fetch in `pinned-fetch.ts` (`@intentface/latch-net/pinned`), which vets
+ * addresses inside the lookup the connection itself uses; the checks here
+ * remain useful as early, well-messaged pre-flight gates.
+ */
+/** True if a dotted-decimal IPv4 (or a short form like 127.1) is private/loopback/link-local. */
+export function isPrivateV4(ip) {
+    const parts = ip.split(".");
+    if (parts.length < 2 || parts.length > 4 || !parts.every((p) => /^\d{1,3}$/.test(p)))
+        return false;
+    const a = Number(parts[0]);
+    const b = parts.length >= 2 ? Number(parts[1]) : 0;
+    if (a === 127 || a === 10 || a === 0)
+        return true; // loopback, private, "this host"
+    if (a === 192 && b === 168)
+        return true;
+    if (a === 169 && b === 254)
+        return true; // link-local incl. 169.254.169.254 (cloud metadata)
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    if (a === 100 && b >= 64 && b <= 127)
+        return true; // CGNAT 100.64.0.0/10 (carrier / internal)
+    if (a === 198 && (b === 18 || b === 19))
+        return true; // benchmarking 198.18.0.0/15
+    if (a >= 224)
+        return true; // multicast 224/4 + reserved/broadcast 240/4 (incl. 255.255.255.255)
+    return false;
+}
+/**
+ * Parse an IPv6 literal into its 16 bytes — compressed (`::1`), fully expanded
+ * (`0:0:0:0:0:0:0:1`), or with an embedded IPv4 tail (`::ffff:127.0.0.1`).
+ * Returns null for anything that isn't a valid IPv6 literal. One parser so every
+ * spelling (not just `::`-prefixed hex) is classified the same way.
+ */
+export function parseIPv6(input) {
+    let h = input.toLowerCase().split("%")[0]; // drop any zone id
+    // Rewrite an embedded IPv4 tail (::ffff:127.0.0.1) as its two hextets so the
+    // rest parses uniformly as hex groups.
+    const dotted = h.match(/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+    if (dotted) {
+        const o = dotted[1].split(".").map(Number);
+        if (o.some((x) => x > 255))
+            return null;
+        const hextets = `${(((o[0] << 8) | o[1]) >>> 0).toString(16)}:${(((o[2] << 8) | o[3]) >>> 0).toString(16)}`;
+        h = h.slice(0, h.length - dotted[1].length) + hextets;
+    }
+    const halves = h.split("::");
+    if (halves.length > 2)
+        return null;
+    const toBytes = (s) => {
+        if (s === "")
+            return [];
+        const out = [];
+        for (const g of s.split(":")) {
+            if (!/^[0-9a-f]{1,4}$/.test(g))
+                return null;
+            const n = Number.parseInt(g, 16);
+            out.push((n >> 8) & 255, n & 255);
+        }
+        return out;
+    };
+    const head = toBytes(halves[0]);
+    const rest = toBytes(halves[1] ?? "");
+    if (!head || !rest)
+        return null;
+    const known = head.length + rest.length;
+    if (halves.length === 2) {
+        const gap = 16 - known; // "::" expands to this many zero bytes
+        return gap < 0 ? null : [...head, ...Array(gap).fill(0), ...rest];
+    }
+    return known === 16 ? [...head, ...rest] : null;
+}
+/**
+ * True if a 16-byte IPv6 address is unspecified/loopback/ULA/link-local, or an
+ * IPv4-mapped/compatible address whose embedded IPv4 is private.
+ */
+export function isPrivateV6(b) {
+    if (b.every((x) => x === 0))
+        return true; // :: unspecified
+    if (b.slice(0, 15).every((x) => x === 0) && b[15] === 1)
+        return true; // ::1 loopback
+    // IPv4-mapped ::ffff:0:0/96 and IPv4-compatible ::/96 → classify embedded v4.
+    const mapped = b.slice(0, 10).every((x) => x === 0) && b[10] === 0xff && b[11] === 0xff;
+    const compat = b.slice(0, 12).every((x) => x === 0);
+    if (mapped || compat)
+        return isPrivateV4(b.slice(12).join("."));
+    if ((b[0] & 0xfe) === 0xfc)
+        return true; // ULA fc00::/7
+    if (b[0] === 0xfe && (b[1] & 0xc0) === 0x80)
+        return true; // link-local fe80::/10
+    return false;
+}
+/**
+ * String-level blocklist: trailing-dot, bracketed IPv6 (loopback/ULA/link-local
+ * + IPv4-mapped/compatible, dotted or hex), bare integer / hex encodings of
+ * IPv4 (2130706433, 0x7f000001), short dotted forms (127.1). Best-effort and
+ * conservative — strictly more blocking. `isBlockedResolved` backs this up to
+ * defeat DNS rebinding.
+ */
+export function isBlockedHost(host) {
+    let h = host.toLowerCase().replace(/\.$/, "");
+    if (h.startsWith("[") && h.endsWith("]"))
+        h = h.slice(1, -1); // unwrap IPv6 literal
+    // `.localhost` subdomains are reserved to resolve loopback (RFC 6761).
+    if (h === "localhost" || h.endsWith(".localhost") || h.endsWith(".local") || h === "::1" || h === "::")
+        return true;
+    if (h.includes(":")) {
+        // Parse the full IPv6 literal (any spelling) and classify its bytes. A
+        // non-parseable colon-host falls through to false (names hit the resolver).
+        const bytes = parseIPv6(h);
+        return bytes ? isPrivateV6(bytes) : false;
+    }
+    if (/^\d+$/.test(h) || /^0x[0-9a-f]+$/.test(h))
+        return true; // bare int / hex = encoded IPv4
+    return isPrivateV4(h);
+}
+/**
+ * DNS-rebinding backstop: resolve the hostname and reject if ANY resolved
+ * address is private/loopback/link-local. The string check above cannot catch
+ * `http://public-name/` that resolves to 169.254.169.254 — this does.
+ */
+export async function isBlockedResolved(hostname) {
+    if (isIP(hostname))
+        return false; // literal IPs already handled by isBlockedHost
+    try {
+        const addrs = await lookup(hostname, { all: true });
+        return addrs.some(({ address, family }) => {
+            if (family === 4)
+                return isPrivateV4(address);
+            const bytes = parseIPv6(address); // same classifier as the literal path
+            return bytes ? isPrivateV6(bytes) : false;
+        });
+    }
+    catch {
+        return true; // fail closed — a lookup error must not open the gate (a
+        // rebinding/flaky resolver could otherwise slip a private target through)
+    }
+}
+/**
+ * Convenience for callers that want one hard gate: parse `input`, then reject a
+ * private/internal literal (`isBlockedHost`) or a name that resolves private
+ * (`isBlockedResolved`). Returns the parsed `URL` on success; throws otherwise.
+ */
+export async function assertPublicUrl(input) {
+    let url;
+    try {
+        url = typeof input === "string" ? new URL(input) : input;
+    }
+    catch {
+        throw new Error(`Invalid URL: ${String(input)}`);
+    }
+    const host = url.hostname;
+    if (isBlockedHost(host) || (await isBlockedResolved(host))) {
+        throw new Error(`Blocked private/internal address: ${host}`);
+    }
+    return url;
+}
+//# sourceMappingURL=ssrf.js.map

package/dist/ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../src/ssrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC;;;;;;;;;;;;;;;;;GAiBG;AAEH,iGAAiG;AACjG,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnG,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,iCAAiC;IACpF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,oDAAoD;IAC7F,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAC9F,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,6BAA6B;IACnF,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,qEAAqE;IAChG,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB;IAC9D,6EAA6E;IAC7E,uCAAuC;IACvC,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAChE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5G,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,CAAC,CAAS,EAAmB,EAAE;QAC7C,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACxC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,uCAAuC;QAC/D,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,CAAW;IACrC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,iBAAiB;IAC3D,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,eAAe;IACrF,8EAA8E;IAC9E,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC;IACxF,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,IAAI,MAAM,IAAI,MAAM;QAAE,OAAO,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,eAAe;IACxD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;IACjF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB;IACpF,uEAAuE;IACvE,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpH,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,uEAAuE;QACvE,4EAA4E;QAC5E,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5C,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,gCAAgC;IAC7F,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IACtD,IAAI,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,+CAA+C;IACjF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;YACxC,IAAI,MAAM,KAAK,CAAC;gBAAE,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,sCAAsC;YACxE,OAAO,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,yDAAyD;QACtE,0EAA0E;IAC5E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAmB;IACvD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@intentface/latch-net",
+  "version": "0.9.1",
+  "description": "Network-safety primitives for Latch — SSRF guards (private-IP blocklist + DNS-rebinding backstop) and a DNS-pinned egress fetch, shared by every host that opens an outbound connection.",
+  "keywords": [
+    "ai",
+    "ai-sdk",
+    "agents",
+    "llm",
+    "ssrf",
+    "fetch",
+    "security"
+  ],
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./pinned": {
+      "types": "./dist/pinned-fetch.d.ts",
+      "import": "./dist/pinned-fetch.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "engines": {
+    "node": ">=20.18.1"
+  },
+  "dependencies": {
+    "undici": "^7.28.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22",
+    "typescript": "^5.7.0",
+    "vitest": "^4"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Intentface/intentface-latch.git",
+    "directory": "packages/net"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
+}