@jami-studio/core 0.92.25 → 0.92.26

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @agent-native/core
 
+## 0.92.26
+
+### Patch Changes
+
+- 64f78fe: ssrfSafeFetch trusts the deployment's OWN configured origins (APP_URL, BETTER_AUTH_URL, WEBHOOK_BASE_URL, WORKSPACE_GATEWAY_URL, workspace app manifest URLs). These are operator configuration, not user input, so a fetch to them is a self-call — the private-address guard was blocking every workspace-internal A2A call (call-agent to a sibling app) on local dev and self-hosted private networks. Only exact origin matches are trusted; redirect hops are still re-validated, so a trusted origin cannot 30x into the private network, and the default posture with no configured origins is unchanged.
+
 ## 0.92.25
 
 ### Patch Changes

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.92.25",
+  "version": "0.92.26",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/studio-jami/jami-studio#readme",
   "bugs": {

package/corpus/core/src/extensions/url-safety.ts

@@ -1,306 +1,363 @@
-const METADATA_HOSTS = [
-  "metadata.google.internal",
-  "metadata.google.internal.",
-];
-
-const DNS_REBIND_SUFFIXES = [
-  ".nip.io",
-  ".sslip.io",
-  ".xip.io",
-  ".localtest.me",
-  ".lvh.me",
-];
-
-function isPrivateIpv4(a: number, b: number, c = 0, d = 0): boolean {
-  if (![a, b, c, d].every((part) => part >= 0 && part <= 255)) return true;
-  if (a === 127) return true;
-  if (a === 10) return true;
-  if (a === 172 && b >= 16 && b <= 31) return true;
-  if (a === 192 && b === 168) return true;
-  if (a === 169 && b === 254) return true;
-  if (a === 0) return true;
-  if (a === 100 && b >= 64 && b <= 127) return true;
-  if (a === 192 && b === 0) return true;
-  if (a === 198 && (b === 18 || b === 19)) return true;
-  if (a === 192 && b === 0 && c === 2) return true;
-  if (a === 198 && b === 51 && c === 100) return true;
-  if (a === 203 && b === 0 && c === 113) return true;
-  if (a >= 224) return true;
-  return false;
-}
-
-function isPrivateIpv4MappedHex(host: string): boolean {
-  const mapped = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
-  if (!mapped) return false;
-  const high = Number.parseInt(mapped[1], 16);
-  const low = Number.parseInt(mapped[2], 16);
-  if (high < 0 || high > 0xffff || low < 0 || low > 0xffff) return false;
-  const a = (high >> 8) & 0xff;
-  const b = high & 0xff;
-  const c = (low >> 8) & 0xff;
-  const d = low & 0xff;
-  return isPrivateIpv4(a, b, c, d);
-}
-
-function isPrivateHost(hostname: string): boolean {
-  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  if (
-    host === "localhost" ||
-    host === "::1" ||
-    host === "::0" ||
-    host === "::"
-  ) {
-    return true;
-  }
-  if (METADATA_HOSTS.includes(host)) return true;
-
-  // IPv6 ULA/link-local/multicast.
-  if (/^f[cd]/.test(host) || /^fe[89ab]/.test(host)) return true;
-  if (/^ff/i.test(host)) return true;
-
-  // IPv4-mapped IPv6. URL parsing may preserve dotted form in some runtimes
-  // or normalize it to hex, e.g. [::ffff:127.0.0.1] -> ::ffff:7f00:1.
-  const v4mappedDotted = host.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
-  if (v4mappedDotted) {
-    const [a, b, c, d] = v4mappedDotted[1].split(".").map(Number);
-    if (isPrivateIpv4(a, b, c, d)) return true;
-  }
-  if (isPrivateIpv4MappedHex(host)) return true;
-
-  // Dotted IPv4. URL parsing normalizes shorthand/octal/hex IPv4 forms to
-  // dotted decimal before we reach this point.
-  const parts = host.split(".");
-  if (parts.length === 4 && parts.every((p) => /^\d+$/.test(p))) {
-    const [a, b, c, d] = parts.map(Number);
-    if (isPrivateIpv4(a, b, c, d)) return true;
-  }
-
-  // Decimal integer IPv4.
-  if (/^\d+$/.test(host)) {
-    const num = Number(host);
-    if (num >= 0 && num <= 0xffffffff) {
-      const a = (num >>> 24) & 0xff;
-      const b = (num >>> 16) & 0xff;
-      const c = (num >>> 8) & 0xff;
-      const d = num & 0xff;
-      if (isPrivateIpv4(a, b, c, d)) return true;
-    }
-  }
-
-  return false;
-}
-
-export function isBlockedExtensionUrl(url: string): boolean {
-  try {
-    const parsed = new URL(url);
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      return true;
-    }
-    const host = parsed.hostname.toLowerCase();
-    if (isPrivateHost(host)) return true;
-    if (
-      DNS_REBIND_SUFFIXES.some((suffix) => {
-        const bare = suffix.slice(1);
-        return host === bare || host.endsWith(suffix);
-      })
-    ) {
-      return true;
-    }
-  } catch {
-    return true;
-  }
-  return false;
-}
-
-function isIpLiteralHost(hostname: string): boolean {
-  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  if (host.includes(":")) return true;
-  const parts = host.split(".");
-  return parts.length === 4 && parts.every((p) => /^\d+$/.test(p));
-}
-
-/**
- * Async SSRF guard for environments that can resolve DNS. The synchronous
- * guard catches literals and known rebinding domains; this closes the common
- * "public hostname resolves to a private address" gap before dispatch.
- */
-export async function isBlockedExtensionUrlWithDns(
-  url: string,
-): Promise<boolean> {
-  if (isBlockedExtensionUrl(url)) return true;
-
-  let hostname: string;
-  try {
-    hostname = new URL(url).hostname.toLowerCase();
-  } catch {
-    return true;
-  }
-  if (!hostname || isIpLiteralHost(hostname)) return false;
-
-  try {
-    const { lookup } = await import("node:dns/promises");
-    const records = await lookup(hostname, { all: true, verbatim: true });
-    return records.some((record) => isPrivateHost(record.address));
-  } catch {
-    // Some edge runtimes do not expose DNS lookup. Keep the deterministic
-    // parser-based protections instead of failing every outbound request.
-    return false;
-  }
-}
-
-/**
- * Build an undici Dispatcher whose connect-time DNS lookup runs through a
- * private-IP guard. This closes the TOCTOU gap where:
- *   1. We resolve hostname → public IP and pass.
- *   2. Between that lookup and the actual connect, DNS rebinding flips the
- *      record to a private IP.
- *   3. fetch() resolves again and connects to the private IP.
- *
- * With a custom dispatcher, the same lookup that produces the IP also gates
- * the connect: if the IP is in the private set, the connect throws.
- *
- * Returns `null` if undici / node:dns are not available (e.g. some edge
- * runtimes); the caller should fall back to the regular `fetch` path —
- * `isBlockedExtensionUrlWithDns` will still have caught most rebinding cases.
- */
-export async function createSsrfSafeDispatcher(): Promise<unknown | null> {
-  // Keep the optional undici import opaque to Vite/Rolldown. A static
-  // `import("undici")` makes browser builds try to resolve and bundle undici
-  // even though this dispatcher is only useful in Node server runtimes.
-  let undici: any;
-  let dnsModule: any;
-  try {
-    const runtimeImport = new Function(
-      "specifier",
-      "return import(specifier)",
-    ) as (specifier: string) => Promise<any>;
-    undici = await runtimeImport("undici");
-    dnsModule = await import("node:dns");
-  } catch {
-    return null;
-  }
-
-  const { Agent } = undici;
-  const { lookup } = dnsModule;
-  if (!Agent || !lookup) return null;
-
-  return new Agent({
-    connect: {
-      // Override DNS lookup at connect time so the IP we hand to undici's
-      // socket is the one we authorized. Reject any record in the private
-      // set BEFORE the TCP handshake.
-      lookup: (
-        hostname: string,
-        options: any,
-        callback: (
-          err: NodeJS.ErrnoException | null,
-          address?: string | { address: string; family: number }[],
-          family?: number,
-        ) => void,
-      ) => {
-        lookup(
-          hostname,
-          { all: true, verbatim: true },
-          (err: NodeJS.ErrnoException | null, addresses: any) => {
-            if (err) return callback(err);
-            const list: { address: string; family: number }[] = Array.isArray(
-              addresses,
-            )
-              ? addresses
-              : [{ address: addresses, family: 4 }];
-            for (const record of list) {
-              if (isPrivateHost(record.address)) {
-                const e = new Error(
-                  `Connect blocked: ${hostname} resolved to private address ${record.address}`,
-                ) as NodeJS.ErrnoException;
-                e.code = "EAI_BLOCKED";
-                return callback(e);
-              }
-            }
-            // Mirror Node's lookup behavior: when `all` is true, return the
-            // array; otherwise the first entry. undici's connect honors
-            // `options.all`.
-            if (options && options.all) {
-              return callback(null, list as any);
-            }
-            const first = list[0];
-            return callback(null, first.address, first.family);
-          },
-        );
-      },
-    },
-  });
-}
-
-/**
- * SSRF-safe `fetch` for any server-side request to a user/agent-supplied URL.
- *
- * Applies the same protections the extension proxy uses, so every call site
- * that fetches an untrusted URL gets them without re-implementing the loop:
- *   1. Pre-flight DNS-aware private-address check (isBlockedExtensionUrlWithDns)
- *      on the initial URL and on every redirect hop.
- *   2. A connect-time dispatcher that re-checks the resolved IP at TCP-connect
- *      time (closes the DNS-rebinding TOCTOU) when undici is available.
- *   3. Manual redirect handling — a public URL cannot 30x-redirect into the
- *      private network because each hop is re-validated before it is followed.
- *
- * Throws an Error whose message starts with "SSRF blocked:" when a target
- * (initial or via redirect) resolves to a private/internal address, or when the
- * redirect limit is exceeded. Otherwise returns the final Response.
- *
- * `httpsOnly` extends the per-hop validation to the URL scheme: redirects are
- * followed only to `https:` targets, so an HTTPS-only caller cannot be
- * downgraded to plain HTTP by a 30x from the (untrusted) origin.
- */
-export async function ssrfSafeFetch(
-  url: string,
-  init: RequestInit = {},
-  options: { maxRedirects?: number; httpsOnly?: boolean } = {},
-): Promise<Response> {
-  const maxRedirects = options.maxRedirects ?? 3;
-  const dispatcher = (await createSsrfSafeDispatcher()) ?? undefined;
-
-  let currentUrl = url;
-  for (let hop = 0; hop <= maxRedirects; hop++) {
-    if (options.httpsOnly && new URL(currentUrl).protocol !== "https:") {
-      throw new Error(
-        `SSRF blocked: refusing to fetch non-HTTPS address (${currentUrl})`,
-      );
-    }
-    if (await isBlockedExtensionUrlWithDns(currentUrl)) {
-      throw new Error(
-        `SSRF blocked: refusing to fetch private/internal address (${currentUrl})`,
-      );
-    }
-    const fetchOpts: RequestInit & { dispatcher?: unknown } = {
-      ...init,
-      redirect: "manual",
-    };
-    if (dispatcher) fetchOpts.dispatcher = dispatcher;
-
-    const response = await fetch(currentUrl, fetchOpts);
-    if (response.status >= 300 && response.status < 400) {
-      const location = response.headers.get("location");
-      if (!location) return response;
-      // Drain the redirect body so the hop's connection is released instead
-      // of being held until GC.
-      await response.body?.cancel().catch(() => {});
-      currentUrl = new URL(location, currentUrl).href;
-      continue;
-    }
-    return response;
-  }
-  throw new Error(
-    `SSRF blocked: too many redirects (>${maxRedirects}) while fetching ${url}`,
-  );
-}
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Legacy aliases — predate the Tools → Extensions rename. Templates import
-// these via the legacy `@agent-native/core/tools/url-safety` subpath; keep
-// the names exported so they keep resolving until every consumer updates.
-// ─────────────────────────────────────────────────────────────────────────────
-
-export { isBlockedExtensionUrl as isBlockedToolUrl };
-export { isBlockedExtensionUrlWithDns as isBlockedToolUrlWithDns };
-export { ssrfSafeFetch as ssrfSafeToolFetch };
+const METADATA_HOSTS = [
+  "metadata.google.internal",
+  "metadata.google.internal.",
+];
+
+const DNS_REBIND_SUFFIXES = [
+  ".nip.io",
+  ".sslip.io",
+  ".xip.io",
+  ".localtest.me",
+  ".lvh.me",
+];
+
+function isPrivateIpv4(a: number, b: number, c = 0, d = 0): boolean {
+  if (![a, b, c, d].every((part) => part >= 0 && part <= 255)) return true;
+  if (a === 127) return true;
+  if (a === 10) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 0) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a === 192 && b === 0) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a === 192 && b === 0 && c === 2) return true;
+  if (a === 198 && b === 51 && c === 100) return true;
+  if (a === 203 && b === 0 && c === 113) return true;
+  if (a >= 224) return true;
+  return false;
+}
+
+function isPrivateIpv4MappedHex(host: string): boolean {
+  const mapped = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+  if (!mapped) return false;
+  const high = Number.parseInt(mapped[1], 16);
+  const low = Number.parseInt(mapped[2], 16);
+  if (high < 0 || high > 0xffff || low < 0 || low > 0xffff) return false;
+  const a = (high >> 8) & 0xff;
+  const b = high & 0xff;
+  const c = (low >> 8) & 0xff;
+  const d = low & 0xff;
+  return isPrivateIpv4(a, b, c, d);
+}
+
+function isPrivateHost(hostname: string): boolean {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (
+    host === "localhost" ||
+    host === "::1" ||
+    host === "::0" ||
+    host === "::"
+  ) {
+    return true;
+  }
+  if (METADATA_HOSTS.includes(host)) return true;
+
+  // IPv6 ULA/link-local/multicast.
+  if (/^f[cd]/.test(host) || /^fe[89ab]/.test(host)) return true;
+  if (/^ff/i.test(host)) return true;
+
+  // IPv4-mapped IPv6. URL parsing may preserve dotted form in some runtimes
+  // or normalize it to hex, e.g. [::ffff:127.0.0.1] -> ::ffff:7f00:1.
+  const v4mappedDotted = host.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+  if (v4mappedDotted) {
+    const [a, b, c, d] = v4mappedDotted[1].split(".").map(Number);
+    if (isPrivateIpv4(a, b, c, d)) return true;
+  }
+  if (isPrivateIpv4MappedHex(host)) return true;
+
+  // Dotted IPv4. URL parsing normalizes shorthand/octal/hex IPv4 forms to
+  // dotted decimal before we reach this point.
+  const parts = host.split(".");
+  if (parts.length === 4 && parts.every((p) => /^\d+$/.test(p))) {
+    const [a, b, c, d] = parts.map(Number);
+    if (isPrivateIpv4(a, b, c, d)) return true;
+  }
+
+  // Decimal integer IPv4.
+  if (/^\d+$/.test(host)) {
+    const num = Number(host);
+    if (num >= 0 && num <= 0xffffffff) {
+      const a = (num >>> 24) & 0xff;
+      const b = (num >>> 16) & 0xff;
+      const c = (num >>> 8) & 0xff;
+      const d = num & 0xff;
+      if (isPrivateIpv4(a, b, c, d)) return true;
+    }
+  }
+
+  return false;
+}
+
+export function isBlockedExtensionUrl(url: string): boolean {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return true;
+    }
+    const host = parsed.hostname.toLowerCase();
+    if (isPrivateHost(host)) return true;
+    if (
+      DNS_REBIND_SUFFIXES.some((suffix) => {
+        const bare = suffix.slice(1);
+        return host === bare || host.endsWith(suffix);
+      })
+    ) {
+      return true;
+    }
+  } catch {
+    return true;
+  }
+  return false;
+}
+
+function isIpLiteralHost(hostname: string): boolean {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (host.includes(":")) return true;
+  const parts = host.split(".");
+  return parts.length === 4 && parts.every((p) => /^\d+$/.test(p));
+}
+
+/**
+ * Async SSRF guard for environments that can resolve DNS. The synchronous
+ * guard catches literals and known rebinding domains; this closes the common
+ * "public hostname resolves to a private address" gap before dispatch.
+ */
+export async function isBlockedExtensionUrlWithDns(
+  url: string,
+): Promise<boolean> {
+  if (isBlockedExtensionUrl(url)) return true;
+
+  let hostname: string;
+  try {
+    hostname = new URL(url).hostname.toLowerCase();
+  } catch {
+    return true;
+  }
+  if (!hostname || isIpLiteralHost(hostname)) return false;
+
+  try {
+    const { lookup } = await import("node:dns/promises");
+    const records = await lookup(hostname, { all: true, verbatim: true });
+    return records.some((record) => isPrivateHost(record.address));
+  } catch {
+    // Some edge runtimes do not expose DNS lookup. Keep the deterministic
+    // parser-based protections instead of failing every outbound request.
+    return false;
+  }
+}
+
+/**
+ * Origins the deployment itself declares as its own surfaces. These come from
+ * operator-controlled configuration (env), NOT from user/agent input, so a
+ * fetch to them is a self-call, not an SSRF: cross-app A2A on a workspace
+ * (call-agent) targets sibling apps at the deployment's own base URL, and in
+ * local dev / self-hosted private networks that origin is a loopback or
+ * RFC-1918 address the private-address guard would otherwise block — which
+ * broke every workspace-internal agent call on `wrangler pages dev` and the
+ * dev gateway. Only EXACT origin matches (scheme + host + port) are trusted;
+ * everything else keeps the full SSRF policy (including redirect hops).
+ */
+export function trustedInternalOrigins(): Set<string> {
+  const origins = new Set<string>();
+  const addUrl = (value: unknown) => {
+    if (typeof value !== "string" || !value.trim()) return;
+    try {
+      origins.add(new URL(value).origin);
+    } catch {
+      // Ignore malformed configured URLs — they never matched anything.
+    }
+  };
+  const env = (globalThis as any)?.process?.env ?? {};
+  addUrl(env.APP_URL);
+  addUrl(env.BETTER_AUTH_URL);
+  addUrl(env.WEBHOOK_BASE_URL);
+  addUrl(env.WORKSPACE_GATEWAY_URL);
+  const manifestJson = env.AGENT_NATIVE_WORKSPACE_APPS_JSON;
+  if (typeof manifestJson === "string" && manifestJson.trim()) {
+    try {
+      const apps = JSON.parse(manifestJson);
+      if (Array.isArray(apps)) {
+        for (const app of apps) addUrl(app?.url);
+      }
+    } catch {
+      // Malformed manifest — no trusted origins from it.
+    }
+  }
+  return origins;
+}
+
+/** True when `url`'s origin exactly matches a configured internal origin. */
+export function isTrustedInternalUrl(url: string): boolean {
+  try {
+    return trustedInternalOrigins().has(new URL(url).origin);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Build an undici Dispatcher whose connect-time DNS lookup runs through a
+ * private-IP guard. This closes the TOCTOU gap where:
+ *   1. We resolve hostname → public IP and pass.
+ *   2. Between that lookup and the actual connect, DNS rebinding flips the
+ *      record to a private IP.
+ *   3. fetch() resolves again and connects to the private IP.
+ *
+ * With a custom dispatcher, the same lookup that produces the IP also gates
+ * the connect: if the IP is in the private set, the connect throws.
+ *
+ * Returns `null` if undici / node:dns are not available (e.g. some edge
+ * runtimes); the caller should fall back to the regular `fetch` path —
+ * `isBlockedExtensionUrlWithDns` will still have caught most rebinding cases.
+ */
+export async function createSsrfSafeDispatcher(): Promise<unknown | null> {
+  // Keep the optional undici import opaque to Vite/Rolldown. A static
+  // `import("undici")` makes browser builds try to resolve and bundle undici
+  // even though this dispatcher is only useful in Node server runtimes.
+  let undici: any;
+  let dnsModule: any;
+  try {
+    const runtimeImport = new Function(
+      "specifier",
+      "return import(specifier)",
+    ) as (specifier: string) => Promise<any>;
+    undici = await runtimeImport("undici");
+    dnsModule = await import("node:dns");
+  } catch {
+    return null;
+  }
+
+  const { Agent } = undici;
+  const { lookup } = dnsModule;
+  if (!Agent || !lookup) return null;
+
+  return new Agent({
+    connect: {
+      // Override DNS lookup at connect time so the IP we hand to undici's
+      // socket is the one we authorized. Reject any record in the private
+      // set BEFORE the TCP handshake.
+      lookup: (
+        hostname: string,
+        options: any,
+        callback: (
+          err: NodeJS.ErrnoException | null,
+          address?: string | { address: string; family: number }[],
+          family?: number,
+        ) => void,
+      ) => {
+        lookup(
+          hostname,
+          { all: true, verbatim: true },
+          (err: NodeJS.ErrnoException | null, addresses: any) => {
+            if (err) return callback(err);
+            const list: { address: string; family: number }[] = Array.isArray(
+              addresses,
+            )
+              ? addresses
+              : [{ address: addresses, family: 4 }];
+            for (const record of list) {
+              if (isPrivateHost(record.address)) {
+                const e = new Error(
+                  `Connect blocked: ${hostname} resolved to private address ${record.address}`,
+                ) as NodeJS.ErrnoException;
+                e.code = "EAI_BLOCKED";
+                return callback(e);
+              }
+            }
+            // Mirror Node's lookup behavior: when `all` is true, return the
+            // array; otherwise the first entry. undici's connect honors
+            // `options.all`.
+            if (options && options.all) {
+              return callback(null, list as any);
+            }
+            const first = list[0];
+            return callback(null, first.address, first.family);
+          },
+        );
+      },
+    },
+  });
+}
+
+/**
+ * SSRF-safe `fetch` for any server-side request to a user/agent-supplied URL.
+ *
+ * Applies the same protections the extension proxy uses, so every call site
+ * that fetches an untrusted URL gets them without re-implementing the loop:
+ *   1. Pre-flight DNS-aware private-address check (isBlockedExtensionUrlWithDns)
+ *      on the initial URL and on every redirect hop.
+ *   2. A connect-time dispatcher that re-checks the resolved IP at TCP-connect
+ *      time (closes the DNS-rebinding TOCTOU) when undici is available.
+ *   3. Manual redirect handling — a public URL cannot 30x-redirect into the
+ *      private network because each hop is re-validated before it is followed.
+ *
+ * Throws an Error whose message starts with "SSRF blocked:" when a target
+ * (initial or via redirect) resolves to a private/internal address, or when the
+ * redirect limit is exceeded. Otherwise returns the final Response.
+ *
+ * `httpsOnly` extends the per-hop validation to the URL scheme: redirects are
+ * followed only to `https:` targets, so an HTTPS-only caller cannot be
+ * downgraded to plain HTTP by a 30x from the (untrusted) origin.
+ */
+export async function ssrfSafeFetch(
+  url: string,
+  init: RequestInit = {},
+  options: { maxRedirects?: number; httpsOnly?: boolean } = {},
+): Promise<Response> {
+  const maxRedirects = options.maxRedirects ?? 3;
+  const dispatcher = (await createSsrfSafeDispatcher()) ?? undefined;
+
+  let currentUrl = url;
+  for (let hop = 0; hop <= maxRedirects; hop++) {
+    if (options.httpsOnly && new URL(currentUrl).protocol !== "https:") {
+      throw new Error(
+        `SSRF blocked: refusing to fetch non-HTTPS address (${currentUrl})`,
+      );
+    }
+    // The deployment's own configured origins are self-calls (workspace A2A,
+    // self-dispatch), not attacker-controlled targets — skip only the
+    // private-address block for exact origin matches. Each redirect hop is
+    // still re-validated, so a trusted origin cannot 30x into the private
+    // network.
+    const trustedHop = isTrustedInternalUrl(currentUrl);
+    if (!trustedHop && (await isBlockedExtensionUrlWithDns(currentUrl))) {
+      throw new Error(
+        `SSRF blocked: refusing to fetch private/internal address (${currentUrl})`,
+      );
+    }
+    const fetchOpts: RequestInit & { dispatcher?: unknown } = {
+      ...init,
+      redirect: "manual",
+    };
+    // The connect-time guard would also reject a trusted internal origin's
+    // loopback/private IP at the TCP layer — attach it only to untrusted hops.
+    if (dispatcher && !trustedHop) fetchOpts.dispatcher = dispatcher;
+
+    const response = await fetch(currentUrl, fetchOpts);
+    if (response.status >= 300 && response.status < 400) {
+      const location = response.headers.get("location");
+      if (!location) return response;
+      // Drain the redirect body so the hop's connection is released instead
+      // of being held until GC.
+      await response.body?.cancel().catch(() => {});
+      currentUrl = new URL(location, currentUrl).href;
+      continue;
+    }
+    return response;
+  }
+  throw new Error(
+    `SSRF blocked: too many redirects (>${maxRedirects}) while fetching ${url}`,
+  );
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Legacy aliases — predate the Tools → Extensions rename. Templates import
+// these via the legacy `@agent-native/core/tools/url-safety` subpath; keep
+// the names exported so they keep resolving until every consumer updates.
+// ─────────────────────────────────────────────────────────────────────────────
+
+export { isBlockedExtensionUrl as isBlockedToolUrl };
+export { isBlockedExtensionUrlWithDns as isBlockedToolUrlWithDns };
+export { ssrfSafeFetch as ssrfSafeToolFetch };

package/corpus/templates/content/actions/list-comments.ts

@@ -32,12 +32,11 @@ function parseMentions(value: string | null): Mention[] {
 export default defineAction({
   description: "List all comments on a document, grouped by thread.",
   schema: z.object({
-    documentId: z.string().optional().describe("Document ID (required)"),
+    documentId: z.string().min(1).describe("Document ID (required)"),
   }),
   http: { method: "GET" },
   run: async (args) => {
     const documentId = args.documentId;
-    if (!documentId) throw new Error("--documentId is required");
 
     const access = await assertAccess("document", documentId, "viewer");
     const ownerEmail = access.resource.ownerEmail as string;

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,10 +77,10 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;
 //# sourceMappingURL=awareness.d.ts.map

package/dist/collab/awareness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"awareness.d.ts","sourceRoot":"","sources":["../../src/collab/awareness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAgB3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAOD,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAElE,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,MAAM,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAOD,wBAAgB,mBAAmB,IAAI,YAAY,CAElD;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,cAAc,GAAG,SAAS,GAChC,IAAI,CAON;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,EAClD,KAAK,CAAC,EAAE,cAAc,GACrB,IAAI,CAgBN;AAoBD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,MAAmB,GAC7B,IAAI,CAON;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE1E;AAiBD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAO1E;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,IAAI,CAOnE;AAkCD;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;kBAwDa,MAAM;eAAS,MAAM;;GAoB1D,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;kBAYM,MAAM;kBAAY,MAAM;;GAMvD,CAAC"}
+{"version":3,"file":"awareness.d.ts","sourceRoot":"","sources":["../../src/collab/awareness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAgB3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAOD,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAElE,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,MAAM,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAOD,wBAAgB,mBAAmB,IAAI,YAAY,CAElD;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,cAAc,GAAG,SAAS,GAChC,IAAI,CAON;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,EAClD,KAAK,CAAC,EAAE,cAAc,GACrB,IAAI,CAgBN;AAoBD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,MAAmB,GAC7B,IAAI,CAON;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE1E;AAiBD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAO1E;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,IAAI,CAOnE;AAkCD;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;kBAwDa,MAAM;eAAS,MAAM;;;GAoB1D,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;kBAYM,MAAM;kBAAY,MAAM;;;GAMvD,CAAC"}

package/dist/extensions/url-safety.d.ts

@@ -5,6 +5,20 @@ export declare function isBlockedExtensionUrl(url: string): boolean;
  * "public hostname resolves to a private address" gap before dispatch.
  */
 export declare function isBlockedExtensionUrlWithDns(url: string): Promise<boolean>;
+/**
+ * Origins the deployment itself declares as its own surfaces. These come from
+ * operator-controlled configuration (env), NOT from user/agent input, so a
+ * fetch to them is a self-call, not an SSRF: cross-app A2A on a workspace
+ * (call-agent) targets sibling apps at the deployment's own base URL, and in
+ * local dev / self-hosted private networks that origin is a loopback or
+ * RFC-1918 address the private-address guard would otherwise block — which
+ * broke every workspace-internal agent call on `wrangler pages dev` and the
+ * dev gateway. Only EXACT origin matches (scheme + host + port) are trusted;
+ * everything else keeps the full SSRF policy (including redirect hops).
+ */
+export declare function trustedInternalOrigins(): Set<string>;
+/** True when `url`'s origin exactly matches a configured internal origin. */
+export declare function isTrustedInternalUrl(url: string): boolean;
 /**
  * Build an undici Dispatcher whose connect-time DNS lookup runs through a
  * private-IP guard. This closes the TOCTOU gap where:

package/dist/extensions/url-safety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url-safety.d.ts","sourceRoot":"","sources":["../../src/extensions/url-safety.ts"],"names":[],"mappings":"AA4FA,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAoB1D;AASD;;;;GAIG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAoBlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAmExE;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,WAAgB,EACtB,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3D,OAAO,CAAC,QAAQ,CAAC,CAqCnB;AAQD,OAAO,EAAE,qBAAqB,IAAI,gBAAgB,EAAE,CAAC;AACrD,OAAO,EAAE,4BAA4B,IAAI,uBAAuB,EAAE,CAAC;AACnE,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,CAAC"}
+{"version":3,"file":"url-safety.d.ts","sourceRoot":"","sources":["../../src/extensions/url-safety.ts"],"names":[],"mappings":"AA4FA,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAoB1D;AASD;;;;GAIG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAoBlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,IAAI,GAAG,CAAC,MAAM,CAAC,CA2BpD;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMzD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAmExE;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,WAAgB,EACtB,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3D,OAAO,CAAC,QAAQ,CAAC,CA6CnB;AAQD,OAAO,EAAE,qBAAqB,IAAI,gBAAgB,EAAE,CAAC;AACrD,OAAO,EAAE,4BAA4B,IAAI,uBAAuB,EAAE,CAAC;AACnE,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,CAAC"}

package/dist/extensions/url-safety.js

@@ -157,6 +157,58 @@ export async function isBlockedExtensionUrlWithDns(url) {
         return false;
     }
 }
+/**
+ * Origins the deployment itself declares as its own surfaces. These come from
+ * operator-controlled configuration (env), NOT from user/agent input, so a
+ * fetch to them is a self-call, not an SSRF: cross-app A2A on a workspace
+ * (call-agent) targets sibling apps at the deployment's own base URL, and in
+ * local dev / self-hosted private networks that origin is a loopback or
+ * RFC-1918 address the private-address guard would otherwise block — which
+ * broke every workspace-internal agent call on `wrangler pages dev` and the
+ * dev gateway. Only EXACT origin matches (scheme + host + port) are trusted;
+ * everything else keeps the full SSRF policy (including redirect hops).
+ */
+export function trustedInternalOrigins() {
+    const origins = new Set();
+    const addUrl = (value) => {
+        if (typeof value !== "string" || !value.trim())
+            return;
+        try {
+            origins.add(new URL(value).origin);
+        }
+        catch {
+            // Ignore malformed configured URLs — they never matched anything.
+        }
+    };
+    const env = globalThis?.process?.env ?? {};
+    addUrl(env.APP_URL);
+    addUrl(env.BETTER_AUTH_URL);
+    addUrl(env.WEBHOOK_BASE_URL);
+    addUrl(env.WORKSPACE_GATEWAY_URL);
+    const manifestJson = env.AGENT_NATIVE_WORKSPACE_APPS_JSON;
+    if (typeof manifestJson === "string" && manifestJson.trim()) {
+        try {
+            const apps = JSON.parse(manifestJson);
+            if (Array.isArray(apps)) {
+                for (const app of apps)
+                    addUrl(app?.url);
+            }
+        }
+        catch {
+            // Malformed manifest — no trusted origins from it.
+        }
+    }
+    return origins;
+}
+/** True when `url`'s origin exactly matches a configured internal origin. */
+export function isTrustedInternalUrl(url) {
+    try {
+        return trustedInternalOrigins().has(new URL(url).origin);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Build an undici Dispatcher whose connect-time DNS lookup runs through a
  * private-IP guard. This closes the TOCTOU gap where:
@@ -250,14 +302,22 @@ export async function ssrfSafeFetch(url, init = {}, options = {}) {
         if (options.httpsOnly && new URL(currentUrl).protocol !== "https:") {
             throw new Error(`SSRF blocked: refusing to fetch non-HTTPS address (${currentUrl})`);
         }
-        if (await isBlockedExtensionUrlWithDns(currentUrl)) {
+        // The deployment's own configured origins are self-calls (workspace A2A,
+        // self-dispatch), not attacker-controlled targets — skip only the
+        // private-address block for exact origin matches. Each redirect hop is
+        // still re-validated, so a trusted origin cannot 30x into the private
+        // network.
+        const trustedHop = isTrustedInternalUrl(currentUrl);
+        if (!trustedHop && (await isBlockedExtensionUrlWithDns(currentUrl))) {
             throw new Error(`SSRF blocked: refusing to fetch private/internal address (${currentUrl})`);
         }
         const fetchOpts = {
             ...init,
             redirect: "manual",
         };
-        if (dispatcher)
+        // The connect-time guard would also reject a trusted internal origin's
+        // loopback/private IP at the TCP layer — attach it only to untrusted hops.
+        if (dispatcher && !trustedHop)
             fetchOpts.dispatcher = dispatcher;
         const response = await fetch(currentUrl, fetchOpts);
         if (response.status >= 300 && response.status < 400) {

package/dist/extensions/url-safety.js.map

@@ -1 +1 @@
-{"version":3,"file":"url-safety.js","sourceRoot":"","sources":["../../src/extensions/url-safety.ts"],"names":[],"mappings":"AAAA,MAAM,cAAc,GAAG;IACrB,0BAA0B;IAC1B,2BAA2B;CAC5B,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,SAAS;IACT,WAAW;IACX,SAAS;IACT,eAAe;IACf,SAAS;CACV,CAAC;AAEF,SAAS,aAAa,CAAC,CAAS,EAAE,CAAS,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC;IACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,MAAM;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC;IACrB,OAAO,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IACE,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,IAAI,EACb,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,iCAAiC;IACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IAED,wBAAwB;IACxB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;YAC7B,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC;YACrB,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,aAAa,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,IACE,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7B,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC,CAAC,EACF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAW;IAEX,IAAI,qBAAqB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,sEAAsE;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,oEAAoE;IACpE,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,MAAW,CAAC;IAChB,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,QAAQ,CAChC,WAAW,EACX,0BAA0B,CACY,CAAC;QACzC,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvC,SAAS,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7B,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEnC,OAAO,IAAI,KAAK,CAAC;QACf,OAAO,EAAE;YACP,oEAAoE;YACpE,oEAAoE;YACpE,gCAAgC;YAChC,MAAM,EAAE,CACN,QAAgB,EAChB,OAAY,EACZ,QAIS,EACT,EAAE;gBACF,MAAM,CACJ,QAAQ,EACR,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAC7B,CAAC,GAAiC,EAAE,SAAc,EAAE,EAAE;oBACpD,IAAI,GAAG;wBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC9B,MAAM,IAAI,GAA0C,KAAK,CAAC,OAAO,CAC/D,SAAS,CACV;wBACC,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;oBACxC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;wBAC1B,IAAI,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;4BAClC,MAAM,CAAC,GAAG,IAAI,KAAK,CACjB,oBAAoB,QAAQ,gCAAgC,MAAM,CAAC,OAAO,EAAE,CACpD,CAAC;4BAC3B,CAAC,CAAC,IAAI,GAAG,aAAa,CAAC;4BACvB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;wBACrB,CAAC;oBACH,CAAC;oBACD,gEAAgE;oBAChE,4DAA4D;oBAC5D,iBAAiB;oBACjB,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;wBAC3B,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAW,CAAC,CAAC;oBACrC,CAAC;oBACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;oBACtB,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACrD,CAAC,CACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,IAAI,GAAgB,EAAE,EACtB,OAAO,GAAmD,EAAE;IAE5D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,CAAC,MAAM,wBAAwB,EAAE,CAAC,IAAI,SAAS,CAAC;IAEnE,IAAI,UAAU,GAAG,GAAG,CAAC;IACrB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,YAAY,EAAE,GAAG,EAAE,EAAE,CAAC;QAC7C,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,sDAAsD,UAAU,GAAG,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,6DAA6D,UAAU,GAAG,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAA2C;YACxD,GAAG,IAAI;YACP,QAAQ,EAAE,QAAQ;SACnB,CAAC;QACF,IAAI,UAAU;YAAE,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC;QAElD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC/B,sEAAsE;YACtE,0BAA0B;YAC1B,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC9C,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC;YAChD,SAAS;QACX,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CACb,sCAAsC,YAAY,oBAAoB,GAAG,EAAE,CAC5E,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,gFAAgF;AAEhF,OAAO,EAAE,qBAAqB,IAAI,gBAAgB,EAAE,CAAC;AACrD,OAAO,EAAE,4BAA4B,IAAI,uBAAuB,EAAE,CAAC;AACnE,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,CAAC","sourcesContent":["const METADATA_HOSTS = [\r\n  \"metadata.google.internal\",\r\n  \"metadata.google.internal.\",\r\n];\r\n\r\nconst DNS_REBIND_SUFFIXES = [\r\n  \".nip.io\",\r\n  \".sslip.io\",\r\n  \".xip.io\",\r\n  \".localtest.me\",\r\n  \".lvh.me\",\r\n];\r\n\r\nfunction isPrivateIpv4(a: number, b: number, c = 0, d = 0): boolean {\r\n  if (![a, b, c, d].every((part) => part >= 0 && part <= 255)) return true;\r\n  if (a === 127) return true;\r\n  if (a === 10) return true;\r\n  if (a === 172 && b >= 16 && b <= 31) return true;\r\n  if (a === 192 && b === 168) return true;\r\n  if (a === 169 && b === 254) return true;\r\n  if (a === 0) return true;\r\n  if (a === 100 && b >= 64 && b <= 127) return true;\r\n  if (a === 192 && b === 0) return true;\r\n  if (a === 198 && (b === 18 || b === 19)) return true;\r\n  if (a === 192 && b === 0 && c === 2) return true;\r\n  if (a === 198 && b === 51 && c === 100) return true;\r\n  if (a === 203 && b === 0 && c === 113) return true;\r\n  if (a >= 224) return true;\r\n  return false;\r\n}\r\n\r\nfunction isPrivateIpv4MappedHex(host: string): boolean {\r\n  const mapped = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);\r\n  if (!mapped) return false;\r\n  const high = Number.parseInt(mapped[1], 16);\r\n  const low = Number.parseInt(mapped[2], 16);\r\n  if (high < 0 || high > 0xffff || low < 0 || low > 0xffff) return false;\r\n  const a = (high >> 8) & 0xff;\r\n  const b = high & 0xff;\r\n  const c = (low >> 8) & 0xff;\r\n  const d = low & 0xff;\r\n  return isPrivateIpv4(a, b, c, d);\r\n}\r\n\r\nfunction isPrivateHost(hostname: string): boolean {\r\n  const host = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\r\n  if (\r\n    host === \"localhost\" ||\r\n    host === \"::1\" ||\r\n    host === \"::0\" ||\r\n    host === \"::\"\r\n  ) {\r\n    return true;\r\n  }\r\n  if (METADATA_HOSTS.includes(host)) return true;\r\n\r\n  // IPv6 ULA/link-local/multicast.\r\n  if (/^f[cd]/.test(host) || /^fe[89ab]/.test(host)) return true;\r\n  if (/^ff/i.test(host)) return true;\r\n\r\n  // IPv4-mapped IPv6. URL parsing may preserve dotted form in some runtimes\r\n  // or normalize it to hex, e.g. [::ffff:127.0.0.1] -> ::ffff:7f00:1.\r\n  const v4mappedDotted = host.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\r\n  if (v4mappedDotted) {\r\n    const [a, b, c, d] = v4mappedDotted[1].split(\".\").map(Number);\r\n    if (isPrivateIpv4(a, b, c, d)) return true;\r\n  }\r\n  if (isPrivateIpv4MappedHex(host)) return true;\r\n\r\n  // Dotted IPv4. URL parsing normalizes shorthand/octal/hex IPv4 forms to\r\n  // dotted decimal before we reach this point.\r\n  const parts = host.split(\".\");\r\n  if (parts.length === 4 && parts.every((p) => /^\\d+$/.test(p))) {\r\n    const [a, b, c, d] = parts.map(Number);\r\n    if (isPrivateIpv4(a, b, c, d)) return true;\r\n  }\r\n\r\n  // Decimal integer IPv4.\r\n  if (/^\\d+$/.test(host)) {\r\n    const num = Number(host);\r\n    if (num >= 0 && num <= 0xffffffff) {\r\n      const a = (num >>> 24) & 0xff;\r\n      const b = (num >>> 16) & 0xff;\r\n      const c = (num >>> 8) & 0xff;\r\n      const d = num & 0xff;\r\n      if (isPrivateIpv4(a, b, c, d)) return true;\r\n    }\r\n  }\r\n\r\n  return false;\r\n}\r\n\r\nexport function isBlockedExtensionUrl(url: string): boolean {\r\n  try {\r\n    const parsed = new URL(url);\r\n    if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\r\n      return true;\r\n    }\r\n    const host = parsed.hostname.toLowerCase();\r\n    if (isPrivateHost(host)) return true;\r\n    if (\r\n      DNS_REBIND_SUFFIXES.some((suffix) => {\r\n        const bare = suffix.slice(1);\r\n        return host === bare || host.endsWith(suffix);\r\n      })\r\n    ) {\r\n      return true;\r\n    }\r\n  } catch {\r\n    return true;\r\n  }\r\n  return false;\r\n}\r\n\r\nfunction isIpLiteralHost(hostname: string): boolean {\r\n  const host = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\r\n  if (host.includes(\":\")) return true;\r\n  const parts = host.split(\".\");\r\n  return parts.length === 4 && parts.every((p) => /^\\d+$/.test(p));\r\n}\r\n\r\n/**\r\n * Async SSRF guard for environments that can resolve DNS. The synchronous\r\n * guard catches literals and known rebinding domains; this closes the common\r\n * \"public hostname resolves to a private address\" gap before dispatch.\r\n */\r\nexport async function isBlockedExtensionUrlWithDns(\r\n  url: string,\r\n): Promise<boolean> {\r\n  if (isBlockedExtensionUrl(url)) return true;\r\n\r\n  let hostname: string;\r\n  try {\r\n    hostname = new URL(url).hostname.toLowerCase();\r\n  } catch {\r\n    return true;\r\n  }\r\n  if (!hostname || isIpLiteralHost(hostname)) return false;\r\n\r\n  try {\r\n    const { lookup } = await import(\"node:dns/promises\");\r\n    const records = await lookup(hostname, { all: true, verbatim: true });\r\n    return records.some((record) => isPrivateHost(record.address));\r\n  } catch {\r\n    // Some edge runtimes do not expose DNS lookup. Keep the deterministic\r\n    // parser-based protections instead of failing every outbound request.\r\n    return false;\r\n  }\r\n}\r\n\r\n/**\r\n * Build an undici Dispatcher whose connect-time DNS lookup runs through a\r\n * private-IP guard. This closes the TOCTOU gap where:\r\n *   1. We resolve hostname → public IP and pass.\r\n *   2. Between that lookup and the actual connect, DNS rebinding flips the\r\n *      record to a private IP.\r\n *   3. fetch() resolves again and connects to the private IP.\r\n *\r\n * With a custom dispatcher, the same lookup that produces the IP also gates\r\n * the connect: if the IP is in the private set, the connect throws.\r\n *\r\n * Returns `null` if undici / node:dns are not available (e.g. some edge\r\n * runtimes); the caller should fall back to the regular `fetch` path —\r\n * `isBlockedExtensionUrlWithDns` will still have caught most rebinding cases.\r\n */\r\nexport async function createSsrfSafeDispatcher(): Promise<unknown | null> {\r\n  // Keep the optional undici import opaque to Vite/Rolldown. A static\r\n  // `import(\"undici\")` makes browser builds try to resolve and bundle undici\r\n  // even though this dispatcher is only useful in Node server runtimes.\r\n  let undici: any;\r\n  let dnsModule: any;\r\n  try {\r\n    const runtimeImport = new Function(\r\n      \"specifier\",\r\n      \"return import(specifier)\",\r\n    ) as (specifier: string) => Promise<any>;\r\n    undici = await runtimeImport(\"undici\");\r\n    dnsModule = await import(\"node:dns\");\r\n  } catch {\r\n    return null;\r\n  }\r\n\r\n  const { Agent } = undici;\r\n  const { lookup } = dnsModule;\r\n  if (!Agent || !lookup) return null;\r\n\r\n  return new Agent({\r\n    connect: {\r\n      // Override DNS lookup at connect time so the IP we hand to undici's\r\n      // socket is the one we authorized. Reject any record in the private\r\n      // set BEFORE the TCP handshake.\r\n      lookup: (\r\n        hostname: string,\r\n        options: any,\r\n        callback: (\r\n          err: NodeJS.ErrnoException | null,\r\n          address?: string | { address: string; family: number }[],\r\n          family?: number,\r\n        ) => void,\r\n      ) => {\r\n        lookup(\r\n          hostname,\r\n          { all: true, verbatim: true },\r\n          (err: NodeJS.ErrnoException | null, addresses: any) => {\r\n            if (err) return callback(err);\r\n            const list: { address: string; family: number }[] = Array.isArray(\r\n              addresses,\r\n            )\r\n              ? addresses\r\n              : [{ address: addresses, family: 4 }];\r\n            for (const record of list) {\r\n              if (isPrivateHost(record.address)) {\r\n                const e = new Error(\r\n                  `Connect blocked: ${hostname} resolved to private address ${record.address}`,\r\n                ) as NodeJS.ErrnoException;\r\n                e.code = \"EAI_BLOCKED\";\r\n                return callback(e);\r\n              }\r\n            }\r\n            // Mirror Node's lookup behavior: when `all` is true, return the\r\n            // array; otherwise the first entry. undici's connect honors\r\n            // `options.all`.\r\n            if (options && options.all) {\r\n              return callback(null, list as any);\r\n            }\r\n            const first = list[0];\r\n            return callback(null, first.address, first.family);\r\n          },\r\n        );\r\n      },\r\n    },\r\n  });\r\n}\r\n\r\n/**\r\n * SSRF-safe `fetch` for any server-side request to a user/agent-supplied URL.\r\n *\r\n * Applies the same protections the extension proxy uses, so every call site\r\n * that fetches an untrusted URL gets them without re-implementing the loop:\r\n *   1. Pre-flight DNS-aware private-address check (isBlockedExtensionUrlWithDns)\r\n *      on the initial URL and on every redirect hop.\r\n *   2. A connect-time dispatcher that re-checks the resolved IP at TCP-connect\r\n *      time (closes the DNS-rebinding TOCTOU) when undici is available.\r\n *   3. Manual redirect handling — a public URL cannot 30x-redirect into the\r\n *      private network because each hop is re-validated before it is followed.\r\n *\r\n * Throws an Error whose message starts with \"SSRF blocked:\" when a target\r\n * (initial or via redirect) resolves to a private/internal address, or when the\r\n * redirect limit is exceeded. Otherwise returns the final Response.\r\n *\r\n * `httpsOnly` extends the per-hop validation to the URL scheme: redirects are\r\n * followed only to `https:` targets, so an HTTPS-only caller cannot be\r\n * downgraded to plain HTTP by a 30x from the (untrusted) origin.\r\n */\r\nexport async function ssrfSafeFetch(\r\n  url: string,\r\n  init: RequestInit = {},\r\n  options: { maxRedirects?: number; httpsOnly?: boolean } = {},\r\n): Promise<Response> {\r\n  const maxRedirects = options.maxRedirects ?? 3;\r\n  const dispatcher = (await createSsrfSafeDispatcher()) ?? undefined;\r\n\r\n  let currentUrl = url;\r\n  for (let hop = 0; hop <= maxRedirects; hop++) {\r\n    if (options.httpsOnly && new URL(currentUrl).protocol !== \"https:\") {\r\n      throw new Error(\r\n        `SSRF blocked: refusing to fetch non-HTTPS address (${currentUrl})`,\r\n      );\r\n    }\r\n    if (await isBlockedExtensionUrlWithDns(currentUrl)) {\r\n      throw new Error(\r\n        `SSRF blocked: refusing to fetch private/internal address (${currentUrl})`,\r\n      );\r\n    }\r\n    const fetchOpts: RequestInit & { dispatcher?: unknown } = {\r\n      ...init,\r\n      redirect: \"manual\",\r\n    };\r\n    if (dispatcher) fetchOpts.dispatcher = dispatcher;\r\n\r\n    const response = await fetch(currentUrl, fetchOpts);\r\n    if (response.status >= 300 && response.status < 400) {\r\n      const location = response.headers.get(\"location\");\r\n      if (!location) return response;\r\n      // Drain the redirect body so the hop's connection is released instead\r\n      // of being held until GC.\r\n      await response.body?.cancel().catch(() => {});\r\n      currentUrl = new URL(location, currentUrl).href;\r\n      continue;\r\n    }\r\n    return response;\r\n  }\r\n  throw new Error(\r\n    `SSRF blocked: too many redirects (>${maxRedirects}) while fetching ${url}`,\r\n  );\r\n}\r\n\r\n// ─────────────────────────────────────────────────────────────────────────────\r\n// Legacy aliases — predate the Tools → Extensions rename. Templates import\r\n// these via the legacy `@agent-native/core/tools/url-safety` subpath; keep\r\n// the names exported so they keep resolving until every consumer updates.\r\n// ─────────────────────────────────────────────────────────────────────────────\r\n\r\nexport { isBlockedExtensionUrl as isBlockedToolUrl };\r\nexport { isBlockedExtensionUrlWithDns as isBlockedToolUrlWithDns };\r\nexport { ssrfSafeFetch as ssrfSafeToolFetch };\r\n"]}
+{"version":3,"file":"url-safety.js","sourceRoot":"","sources":["../../src/extensions/url-safety.ts"],"names":[],"mappings":"AAAA,MAAM,cAAc,GAAG;IACrB,0BAA0B;IAC1B,2BAA2B;CAC5B,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,SAAS;IACT,WAAW;IACX,SAAS;IACT,eAAe;IACf,SAAS;CACV,CAAC;AAEF,SAAS,aAAa,CAAC,CAAS,EAAE,CAAS,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC;IACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,MAAM;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC;IACrB,OAAO,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IACE,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,IAAI,EACb,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,iCAAiC;IACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IAED,wBAAwB;IACxB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;YAC7B,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC;YACrB,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,aAAa,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,IACE,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7B,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC,CAAC,EACF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAW;IAEX,IAAI,qBAAqB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,sEAAsE;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,EAAE;QAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,OAAO;QACvD,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC,CAAC;IACF,MAAM,GAAG,GAAI,UAAkB,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IACpD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpB,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,GAAG,CAAC,gCAAgC,CAAC;IAC1D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACtC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,KAAK,MAAM,GAAG,IAAI,IAAI;oBAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,CAAC;QACH,OAAO,sBAAsB,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,oEAAoE;IACpE,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,MAAW,CAAC;IAChB,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,QAAQ,CAChC,WAAW,EACX,0BAA0B,CACY,CAAC;QACzC,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvC,SAAS,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7B,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEnC,OAAO,IAAI,KAAK,CAAC;QACf,OAAO,EAAE;YACP,oEAAoE;YACpE,oEAAoE;YACpE,gCAAgC;YAChC,MAAM,EAAE,CACN,QAAgB,EAChB,OAAY,EACZ,QAIS,EACT,EAAE;gBACF,MAAM,CACJ,QAAQ,EACR,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAC7B,CAAC,GAAiC,EAAE,SAAc,EAAE,EAAE;oBACpD,IAAI,GAAG;wBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC9B,MAAM,IAAI,GAA0C,KAAK,CAAC,OAAO,CAC/D,SAAS,CACV;wBACC,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;oBACxC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;wBAC1B,IAAI,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;4BAClC,MAAM,CAAC,GAAG,IAAI,KAAK,CACjB,oBAAoB,QAAQ,gCAAgC,MAAM,CAAC,OAAO,EAAE,CACpD,CAAC;4BAC3B,CAAC,CAAC,IAAI,GAAG,aAAa,CAAC;4BACvB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;wBACrB,CAAC;oBACH,CAAC;oBACD,gEAAgE;oBAChE,4DAA4D;oBAC5D,iBAAiB;oBACjB,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;wBAC3B,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAW,CAAC,CAAC;oBACrC,CAAC;oBACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;oBACtB,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACrD,CAAC,CACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,IAAI,GAAgB,EAAE,EACtB,OAAO,GAAmD,EAAE;IAE5D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,CAAC,MAAM,wBAAwB,EAAE,CAAC,IAAI,SAAS,CAAC;IAEnE,IAAI,UAAU,GAAG,GAAG,CAAC;IACrB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,YAAY,EAAE,GAAG,EAAE,EAAE,CAAC;QAC7C,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,sDAAsD,UAAU,GAAG,CACpE,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,kEAAkE;QAClE,uEAAuE;QACvE,sEAAsE;QACtE,WAAW;QACX,MAAM,UAAU,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CACb,6DAA6D,UAAU,GAAG,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAA2C;YACxD,GAAG,IAAI;YACP,QAAQ,EAAE,QAAQ;SACnB,CAAC;QACF,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,UAAU,IAAI,CAAC,UAAU;YAAE,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC;QAEjE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC/B,sEAAsE;YACtE,0BAA0B;YAC1B,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC9C,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC;YAChD,SAAS;QACX,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CACb,sCAAsC,YAAY,oBAAoB,GAAG,EAAE,CAC5E,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,gFAAgF;AAEhF,OAAO,EAAE,qBAAqB,IAAI,gBAAgB,EAAE,CAAC;AACrD,OAAO,EAAE,4BAA4B,IAAI,uBAAuB,EAAE,CAAC;AACnE,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,CAAC","sourcesContent":["const METADATA_HOSTS = [\n  \"metadata.google.internal\",\n  \"metadata.google.internal.\",\n];\n\nconst DNS_REBIND_SUFFIXES = [\n  \".nip.io\",\n  \".sslip.io\",\n  \".xip.io\",\n  \".localtest.me\",\n  \".lvh.me\",\n];\n\nfunction isPrivateIpv4(a: number, b: number, c = 0, d = 0): boolean {\n  if (![a, b, c, d].every((part) => part >= 0 && part <= 255)) return true;\n  if (a === 127) return true;\n  if (a === 10) return true;\n  if (a === 172 && b >= 16 && b <= 31) return true;\n  if (a === 192 && b === 168) return true;\n  if (a === 169 && b === 254) return true;\n  if (a === 0) return true;\n  if (a === 100 && b >= 64 && b <= 127) return true;\n  if (a === 192 && b === 0) return true;\n  if (a === 198 && (b === 18 || b === 19)) return true;\n  if (a === 192 && b === 0 && c === 2) return true;\n  if (a === 198 && b === 51 && c === 100) return true;\n  if (a === 203 && b === 0 && c === 113) return true;\n  if (a >= 224) return true;\n  return false;\n}\n\nfunction isPrivateIpv4MappedHex(host: string): boolean {\n  const mapped = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);\n  if (!mapped) return false;\n  const high = Number.parseInt(mapped[1], 16);\n  const low = Number.parseInt(mapped[2], 16);\n  if (high < 0 || high > 0xffff || low < 0 || low > 0xffff) return false;\n  const a = (high >> 8) & 0xff;\n  const b = high & 0xff;\n  const c = (low >> 8) & 0xff;\n  const d = low & 0xff;\n  return isPrivateIpv4(a, b, c, d);\n}\n\nfunction isPrivateHost(hostname: string): boolean {\n  const host = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n  if (\n    host === \"localhost\" ||\n    host === \"::1\" ||\n    host === \"::0\" ||\n    host === \"::\"\n  ) {\n    return true;\n  }\n  if (METADATA_HOSTS.includes(host)) return true;\n\n  // IPv6 ULA/link-local/multicast.\n  if (/^f[cd]/.test(host) || /^fe[89ab]/.test(host)) return true;\n  if (/^ff/i.test(host)) return true;\n\n  // IPv4-mapped IPv6. URL parsing may preserve dotted form in some runtimes\n  // or normalize it to hex, e.g. [::ffff:127.0.0.1] -> ::ffff:7f00:1.\n  const v4mappedDotted = host.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n  if (v4mappedDotted) {\n    const [a, b, c, d] = v4mappedDotted[1].split(\".\").map(Number);\n    if (isPrivateIpv4(a, b, c, d)) return true;\n  }\n  if (isPrivateIpv4MappedHex(host)) return true;\n\n  // Dotted IPv4. URL parsing normalizes shorthand/octal/hex IPv4 forms to\n  // dotted decimal before we reach this point.\n  const parts = host.split(\".\");\n  if (parts.length === 4 && parts.every((p) => /^\\d+$/.test(p))) {\n    const [a, b, c, d] = parts.map(Number);\n    if (isPrivateIpv4(a, b, c, d)) return true;\n  }\n\n  // Decimal integer IPv4.\n  if (/^\\d+$/.test(host)) {\n    const num = Number(host);\n    if (num >= 0 && num <= 0xffffffff) {\n      const a = (num >>> 24) & 0xff;\n      const b = (num >>> 16) & 0xff;\n      const c = (num >>> 8) & 0xff;\n      const d = num & 0xff;\n      if (isPrivateIpv4(a, b, c, d)) return true;\n    }\n  }\n\n  return false;\n}\n\nexport function isBlockedExtensionUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n      return true;\n    }\n    const host = parsed.hostname.toLowerCase();\n    if (isPrivateHost(host)) return true;\n    if (\n      DNS_REBIND_SUFFIXES.some((suffix) => {\n        const bare = suffix.slice(1);\n        return host === bare || host.endsWith(suffix);\n      })\n    ) {\n      return true;\n    }\n  } catch {\n    return true;\n  }\n  return false;\n}\n\nfunction isIpLiteralHost(hostname: string): boolean {\n  const host = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n  if (host.includes(\":\")) return true;\n  const parts = host.split(\".\");\n  return parts.length === 4 && parts.every((p) => /^\\d+$/.test(p));\n}\n\n/**\n * Async SSRF guard for environments that can resolve DNS. The synchronous\n * guard catches literals and known rebinding domains; this closes the common\n * \"public hostname resolves to a private address\" gap before dispatch.\n */\nexport async function isBlockedExtensionUrlWithDns(\n  url: string,\n): Promise<boolean> {\n  if (isBlockedExtensionUrl(url)) return true;\n\n  let hostname: string;\n  try {\n    hostname = new URL(url).hostname.toLowerCase();\n  } catch {\n    return true;\n  }\n  if (!hostname || isIpLiteralHost(hostname)) return false;\n\n  try {\n    const { lookup } = await import(\"node:dns/promises\");\n    const records = await lookup(hostname, { all: true, verbatim: true });\n    return records.some((record) => isPrivateHost(record.address));\n  } catch {\n    // Some edge runtimes do not expose DNS lookup. Keep the deterministic\n    // parser-based protections instead of failing every outbound request.\n    return false;\n  }\n}\n\n/**\n * Origins the deployment itself declares as its own surfaces. These come from\n * operator-controlled configuration (env), NOT from user/agent input, so a\n * fetch to them is a self-call, not an SSRF: cross-app A2A on a workspace\n * (call-agent) targets sibling apps at the deployment's own base URL, and in\n * local dev / self-hosted private networks that origin is a loopback or\n * RFC-1918 address the private-address guard would otherwise block — which\n * broke every workspace-internal agent call on `wrangler pages dev` and the\n * dev gateway. Only EXACT origin matches (scheme + host + port) are trusted;\n * everything else keeps the full SSRF policy (including redirect hops).\n */\nexport function trustedInternalOrigins(): Set<string> {\n  const origins = new Set<string>();\n  const addUrl = (value: unknown) => {\n    if (typeof value !== \"string\" || !value.trim()) return;\n    try {\n      origins.add(new URL(value).origin);\n    } catch {\n      // Ignore malformed configured URLs — they never matched anything.\n    }\n  };\n  const env = (globalThis as any)?.process?.env ?? {};\n  addUrl(env.APP_URL);\n  addUrl(env.BETTER_AUTH_URL);\n  addUrl(env.WEBHOOK_BASE_URL);\n  addUrl(env.WORKSPACE_GATEWAY_URL);\n  const manifestJson = env.AGENT_NATIVE_WORKSPACE_APPS_JSON;\n  if (typeof manifestJson === \"string\" && manifestJson.trim()) {\n    try {\n      const apps = JSON.parse(manifestJson);\n      if (Array.isArray(apps)) {\n        for (const app of apps) addUrl(app?.url);\n      }\n    } catch {\n      // Malformed manifest — no trusted origins from it.\n    }\n  }\n  return origins;\n}\n\n/** True when `url`'s origin exactly matches a configured internal origin. */\nexport function isTrustedInternalUrl(url: string): boolean {\n  try {\n    return trustedInternalOrigins().has(new URL(url).origin);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Build an undici Dispatcher whose connect-time DNS lookup runs through a\n * private-IP guard. This closes the TOCTOU gap where:\n *   1. We resolve hostname → public IP and pass.\n *   2. Between that lookup and the actual connect, DNS rebinding flips the\n *      record to a private IP.\n *   3. fetch() resolves again and connects to the private IP.\n *\n * With a custom dispatcher, the same lookup that produces the IP also gates\n * the connect: if the IP is in the private set, the connect throws.\n *\n * Returns `null` if undici / node:dns are not available (e.g. some edge\n * runtimes); the caller should fall back to the regular `fetch` path —\n * `isBlockedExtensionUrlWithDns` will still have caught most rebinding cases.\n */\nexport async function createSsrfSafeDispatcher(): Promise<unknown | null> {\n  // Keep the optional undici import opaque to Vite/Rolldown. A static\n  // `import(\"undici\")` makes browser builds try to resolve and bundle undici\n  // even though this dispatcher is only useful in Node server runtimes.\n  let undici: any;\n  let dnsModule: any;\n  try {\n    const runtimeImport = new Function(\n      \"specifier\",\n      \"return import(specifier)\",\n    ) as (specifier: string) => Promise<any>;\n    undici = await runtimeImport(\"undici\");\n    dnsModule = await import(\"node:dns\");\n  } catch {\n    return null;\n  }\n\n  const { Agent } = undici;\n  const { lookup } = dnsModule;\n  if (!Agent || !lookup) return null;\n\n  return new Agent({\n    connect: {\n      // Override DNS lookup at connect time so the IP we hand to undici's\n      // socket is the one we authorized. Reject any record in the private\n      // set BEFORE the TCP handshake.\n      lookup: (\n        hostname: string,\n        options: any,\n        callback: (\n          err: NodeJS.ErrnoException | null,\n          address?: string | { address: string; family: number }[],\n          family?: number,\n        ) => void,\n      ) => {\n        lookup(\n          hostname,\n          { all: true, verbatim: true },\n          (err: NodeJS.ErrnoException | null, addresses: any) => {\n            if (err) return callback(err);\n            const list: { address: string; family: number }[] = Array.isArray(\n              addresses,\n            )\n              ? addresses\n              : [{ address: addresses, family: 4 }];\n            for (const record of list) {\n              if (isPrivateHost(record.address)) {\n                const e = new Error(\n                  `Connect blocked: ${hostname} resolved to private address ${record.address}`,\n                ) as NodeJS.ErrnoException;\n                e.code = \"EAI_BLOCKED\";\n                return callback(e);\n              }\n            }\n            // Mirror Node's lookup behavior: when `all` is true, return the\n            // array; otherwise the first entry. undici's connect honors\n            // `options.all`.\n            if (options && options.all) {\n              return callback(null, list as any);\n            }\n            const first = list[0];\n            return callback(null, first.address, first.family);\n          },\n        );\n      },\n    },\n  });\n}\n\n/**\n * SSRF-safe `fetch` for any server-side request to a user/agent-supplied URL.\n *\n * Applies the same protections the extension proxy uses, so every call site\n * that fetches an untrusted URL gets them without re-implementing the loop:\n *   1. Pre-flight DNS-aware private-address check (isBlockedExtensionUrlWithDns)\n *      on the initial URL and on every redirect hop.\n *   2. A connect-time dispatcher that re-checks the resolved IP at TCP-connect\n *      time (closes the DNS-rebinding TOCTOU) when undici is available.\n *   3. Manual redirect handling — a public URL cannot 30x-redirect into the\n *      private network because each hop is re-validated before it is followed.\n *\n * Throws an Error whose message starts with \"SSRF blocked:\" when a target\n * (initial or via redirect) resolves to a private/internal address, or when the\n * redirect limit is exceeded. Otherwise returns the final Response.\n *\n * `httpsOnly` extends the per-hop validation to the URL scheme: redirects are\n * followed only to `https:` targets, so an HTTPS-only caller cannot be\n * downgraded to plain HTTP by a 30x from the (untrusted) origin.\n */\nexport async function ssrfSafeFetch(\n  url: string,\n  init: RequestInit = {},\n  options: { maxRedirects?: number; httpsOnly?: boolean } = {},\n): Promise<Response> {\n  const maxRedirects = options.maxRedirects ?? 3;\n  const dispatcher = (await createSsrfSafeDispatcher()) ?? undefined;\n\n  let currentUrl = url;\n  for (let hop = 0; hop <= maxRedirects; hop++) {\n    if (options.httpsOnly && new URL(currentUrl).protocol !== \"https:\") {\n      throw new Error(\n        `SSRF blocked: refusing to fetch non-HTTPS address (${currentUrl})`,\n      );\n    }\n    // The deployment's own configured origins are self-calls (workspace A2A,\n    // self-dispatch), not attacker-controlled targets — skip only the\n    // private-address block for exact origin matches. Each redirect hop is\n    // still re-validated, so a trusted origin cannot 30x into the private\n    // network.\n    const trustedHop = isTrustedInternalUrl(currentUrl);\n    if (!trustedHop && (await isBlockedExtensionUrlWithDns(currentUrl))) {\n      throw new Error(\n        `SSRF blocked: refusing to fetch private/internal address (${currentUrl})`,\n      );\n    }\n    const fetchOpts: RequestInit & { dispatcher?: unknown } = {\n      ...init,\n      redirect: \"manual\",\n    };\n    // The connect-time guard would also reject a trusted internal origin's\n    // loopback/private IP at the TCP layer — attach it only to untrusted hops.\n    if (dispatcher && !trustedHop) fetchOpts.dispatcher = dispatcher;\n\n    const response = await fetch(currentUrl, fetchOpts);\n    if (response.status >= 300 && response.status < 400) {\n      const location = response.headers.get(\"location\");\n      if (!location) return response;\n      // Drain the redirect body so the hop's connection is released instead\n      // of being held until GC.\n      await response.body?.cancel().catch(() => {});\n      currentUrl = new URL(location, currentUrl).href;\n      continue;\n    }\n    return response;\n  }\n  throw new Error(\n    `SSRF blocked: too many redirects (>${maxRedirects}) while fetching ${url}`,\n  );\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Legacy aliases — predate the Tools → Extensions rename. Templates import\n// these via the legacy `@agent-native/core/tools/url-safety` subpath; keep\n// the names exported so they keep resolving until every consumer updates.\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport { isBlockedExtensionUrl as isBlockedToolUrl };\nexport { isBlockedExtensionUrlWithDns as isBlockedToolUrlWithDns };\nexport { ssrfSafeFetch as ssrfSafeToolFetch };\n"]}

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,12 +17,12 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
-    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
+    error?: undefined;
 }>;
 export default _default;
 //# sourceMappingURL=upload-image.d.ts.map

package/dist/observability/routes.d.ts

@@ -41,16 +41,16 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+    error?: undefined;
     ok?: undefined;
 } | {
-    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
+    error?: undefined;
     ok?: undefined;
 } | {
     summary?: undefined;
@@ -59,10 +59,10 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     error: any;
     ok?: undefined;
 } | {
-    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
+    error?: undefined;
     ok: boolean;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/progress/routes.d.ts

@@ -15,7 +15,7 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/resources/handlers.d.ts

@@ -52,8 +52,8 @@ export declare function handleDeleteResource(event: any): Promise<{
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>;
 /** POST /_agent-native/resources/upload — upload a file as a resource */
 export declare function handleUploadResource(event: any): Promise<import("./store.js").Resource | {
@@ -74,10 +74,10 @@ export declare function handleUploadResource(event: any): Promise<import("./stor
     runId: string | null;
     expiresAt: number | null;
     metadata: string | null;
-    error?: undefined;
     url: string;
     provider: string;
     storageSetupRequired?: undefined;
+    error?: undefined;
 } | {
     error: string;
     storageSetupRequired: boolean;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,11 +27,11 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
+    error?: undefined;
 }>>;
 export {};
 //# sourceMappingURL=agent-engine-api-key-route.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jami-studio/core",
-  "version": "0.92.25",
+  "version": "0.92.26",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/studio-jami/jami-studio#readme",
   "bugs": {