@keynv/testers 0.1.0-rc.23

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025-2026 keynv-labs and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/http.d.ts

@@ -0,0 +1,36 @@
+import { z } from 'zod';
+import type { Tester } from './types.js';
+declare const Target: z.ZodObject<{
+    url: z.ZodString;
+    method: z.ZodDefault<z.ZodEnum<["GET", "POST", "HEAD"]>>;
+    /**
+     *  - 'basic'  : secret.value is the password; target.user is the username.
+     *  - 'bearer' : secret.value is the token.
+     *  - 'header' : secret.value is the value for header `target.header_name`.
+     */
+    auth: z.ZodEnum<["basic", "bearer", "header"]>;
+    user: z.ZodOptional<z.ZodString>;
+    header_name: z.ZodOptional<z.ZodString>;
+    expect_status_min: z.ZodDefault<z.ZodNumber>;
+    expect_status_max: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    url: string;
+    method: "GET" | "POST" | "HEAD";
+    auth: "basic" | "bearer" | "header";
+    expect_status_min: number;
+    expect_status_max: number;
+    user?: string | undefined;
+    header_name?: string | undefined;
+}, {
+    url: string;
+    auth: "basic" | "bearer" | "header";
+    method?: "GET" | "POST" | "HEAD" | undefined;
+    user?: string | undefined;
+    header_name?: string | undefined;
+    expect_status_min?: number | undefined;
+    expect_status_max?: number | undefined;
+}>;
+type HttpTarget = z.infer<typeof Target>;
+export declare const httpTester: Tester<HttpTarget>;
+export {};
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAA8B,MAAM,EAAE,MAAM,YAAY,CAAC;AAErE,QAAA,MAAM,MAAM;;;IAGV;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;EAMH,CAAC;AAEH,KAAK,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAEzC,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,UAAU,CA2DzC,CAAC"}

package/dist/http.js

@@ -0,0 +1,80 @@
+import { z } from 'zod';
+import { isBlockedUrlResolved } from './ssrf.js';
+const Target = z.object({
+    url: z.string().url(),
+    method: z.enum(['GET', 'POST', 'HEAD']).default('GET'),
+    /**
+     *  - 'basic'  : secret.value is the password; target.user is the username.
+     *  - 'bearer' : secret.value is the token.
+     *  - 'header' : secret.value is the value for header `target.header_name`.
+     */
+    auth: z.enum(['basic', 'bearer', 'header']),
+    user: z.string().optional(),
+    header_name: z.string().min(1).optional(),
+    expect_status_min: z.coerce.number().int().min(100).max(599).default(200),
+    expect_status_max: z.coerce.number().int().min(100).max(599).default(299),
+});
+export const httpTester = {
+    type: 'http',
+    schema: Target,
+    async test(secret, target) {
+        if (await isBlockedUrlResolved(target.url)) {
+            return {
+                ok: false,
+                latency_ms: 0,
+                error: 'Target URL is blocked (private/internal IP or metadata endpoint).',
+            };
+        }
+        const start = Date.now();
+        const headers = {};
+        switch (target.auth) {
+            case 'basic': {
+                if (!target.user)
+                    return failBadTarget('basic auth requires target.user', start);
+                const encoded = Buffer.from(`${target.user}:${secret.value}`).toString('base64');
+                headers['authorization'] = `Basic ${encoded}`;
+                break;
+            }
+            case 'bearer':
+                headers['authorization'] = `Bearer ${secret.value}`;
+                break;
+            case 'header': {
+                if (!target.header_name) {
+                    return failBadTarget('header auth requires target.header_name', start);
+                }
+                headers[target.header_name.toLowerCase()] = secret.value;
+                break;
+            }
+        }
+        try {
+            const res = await fetch(target.url, {
+                method: target.method,
+                headers,
+                signal: AbortSignal.timeout(5000),
+                // Do NOT follow redirects: the SSRF pre-check only validated the
+                // original URL, and following a 3xx could land on an internal
+                // address and leak the auth header cross-origin. A redirect is
+                // treated as a (non-2xx) result.
+                redirect: 'manual',
+            });
+            const ok = res.status >= target.expect_status_min && res.status <= target.expect_status_max;
+            return {
+                ok,
+                latency_ms: Date.now() - start,
+                info: { status: res.status },
+                ...(ok ? {} : { error: `HTTP ${res.status}` }),
+            };
+        }
+        catch (err) {
+            return {
+                ok: false,
+                latency_ms: Date.now() - start,
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+    },
+};
+function failBadTarget(message, start) {
+    return { ok: false, latency_ms: Date.now() - start, error: message };
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAGjD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACtD;;;;OAIG;IACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACzE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;CAC1E,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,UAAU,GAAuB;IAC5C,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,MAAM;IACd,KAAK,CAAC,IAAI,CAAC,MAAsB,EAAE,MAAkB;QACnD,IAAI,MAAM,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,CAAC;gBACb,KAAK,EAAE,mEAAmE;aAC3E,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI;oBAAE,OAAO,aAAa,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;gBACjF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACjF,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,OAAO,EAAE,CAAC;gBAC9C,MAAM;YACR,CAAC;YACD,KAAK,QAAQ;gBACX,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,CAAC,KAAK,EAAE,CAAC;gBACpD,MAAM;YACR,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;oBACxB,OAAO,aAAa,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;gBACzE,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBACzD,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;gBAClC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO;gBACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;gBACjC,iEAAiE;gBACjE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,iCAAiC;gBACjC,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;YACH,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,iBAAiB,IAAI,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,iBAAiB,CAAC;YAC5F,OAAO;gBACL,EAAE;gBACF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;gBAC5B,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;aAC/C,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC;AAEF,SAAS,aAAa,CAAC,OAAe,EAAE,KAAa;IACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACvE,CAAC"}

package/dist/http.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=http.test.d.ts.map

package/dist/http.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.test.d.ts","sourceRoot":"","sources":["../src/http.test.ts"],"names":[],"mappings":""}

package/dist/http.test.js

@@ -0,0 +1,71 @@
+import { createServer } from 'node:http';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+process.env['KEYNV_ALLOW_LOOPBACK_TESTERS'] = '1';
+import { httpTester } from './http.js';
+let server;
+let url;
+beforeEach(async () => {
+    server = createServer((req, res) => {
+        const auth = req.headers.authorization ?? '';
+        const apiKey = req.headers['x-api-key'] ?? '';
+        if (auth === 'Bearer good-token' || apiKey === 'good-key') {
+            res.statusCode = 200;
+            res.end('ok');
+            return;
+        }
+        if (auth === `Basic ${Buffer.from('alice:good-pass').toString('base64')}`) {
+            res.statusCode = 200;
+            res.end('ok');
+            return;
+        }
+        res.statusCode = 401;
+        res.end('unauthorized');
+    });
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const addr = server.address();
+    if (typeof addr === 'object' && addr)
+        url = `http://127.0.0.1:${addr.port}/`;
+});
+afterEach(async () => {
+    await new Promise((resolve) => server.close(() => resolve()));
+});
+describe('httpTester', () => {
+    it('returns ok for a valid bearer token (200 OK)', async () => {
+        const r = await httpTester.test({ alias: '@x.dev.api', value: 'good-token' }, { url, method: 'GET', auth: 'bearer', expect_status_min: 200, expect_status_max: 299 });
+        expect(r.ok).toBe(true);
+        expect(r.info?.['status']).toBe(200);
+    });
+    it('returns fail for a wrong bearer token (401)', async () => {
+        const r = await httpTester.test({ alias: '@x.dev.api', value: 'wrong-token' }, { url, method: 'GET', auth: 'bearer', expect_status_min: 200, expect_status_max: 299 });
+        expect(r.ok).toBe(false);
+        expect(r.error).toMatch(/401/);
+    });
+    it('handles basic auth', async () => {
+        const r = await httpTester.test({ alias: '@x.dev.api', value: 'good-pass' }, {
+            url,
+            method: 'GET',
+            auth: 'basic',
+            user: 'alice',
+            expect_status_min: 200,
+            expect_status_max: 299,
+        });
+        expect(r.ok).toBe(true);
+    });
+    it('handles custom-header auth', async () => {
+        const r = await httpTester.test({ alias: '@x.dev.api', value: 'good-key' }, {
+            url,
+            method: 'GET',
+            auth: 'header',
+            header_name: 'x-api-key',
+            expect_status_min: 200,
+            expect_status_max: 299,
+        });
+        expect(r.ok).toBe(true);
+    });
+    it('rejects basic auth without user', async () => {
+        const r = await httpTester.test({ alias: '@x.dev.api', value: 'p' }, { url, method: 'GET', auth: 'basic', expect_status_min: 200, expect_status_max: 299 });
+        expect(r.ok).toBe(false);
+        expect(r.error).toMatch(/target\.user|blocked/i);
+    });
+});
+//# sourceMappingURL=http.test.js.map

package/dist/http.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.test.js","sourceRoot":"","sources":["../src/http.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,YAAY,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAErE,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,GAAG,GAAG,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,IAAI,MAAc,CAAC;AACnB,IAAI,GAAW,CAAC;AAEhB,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,IAAI,KAAK,mBAAmB,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1D,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC1E,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;QACrB,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI;QAAE,GAAG,GAAG,oBAAoB,IAAI,CAAC,IAAI,GAAG,CAAC;AAC/E,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,CAC7B,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,EAC5C,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,CACvF,CAAC;QACF,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,CAC7B,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,EAC7C,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,CACvF,CAAC;QACF,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;QAClC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,CAC7B,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,EAC3C;YACE,GAAG;YACH,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,OAAO;YACb,iBAAiB,EAAE,GAAG;YACtB,iBAAiB,EAAE,GAAG;SACvB,CACF,CAAC;QACF,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,CAC7B,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,EAC1C;YACE,GAAG;YACH,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,WAAW;YACxB,iBAAiB,EAAE,GAAG;YACtB,iBAAiB,EAAE,GAAG;SACvB,CACF,CAAC;QACF,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,CAC7B,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,EACnC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,CACtF,CAAC;QACF,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+import { httpTester } from './http.js';
+import { mysqlTester } from './mysql.js';
+import { postgresTester } from './postgres.js';
+import { redisTester } from './redis.js';
+import { sshTester } from './ssh.js';
+import type { Tester, TesterType } from './types.js';
+export type { ResolvedSecret, Tester, TesterTarget, TesterType, TestResult, } from './types.js';
+export { DEFAULT_TIMEOUT_MS, testerEnum } from './types.js';
+export { runTest, type RunArgs } from './run.js';
+export { sanitizeResult } from './sanitize.js';
+export declare const testers: ReadonlyArray<Tester>;
+export declare function findTester(type: TesterType): Tester | null;
+export { postgresTester, mysqlTester, redisTester, sshTester, httpTester };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAErD,YAAY,EACV,cAAc,EACd,MAAM,EACN,YAAY,EACZ,UAAU,EACV,UAAU,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,eAAO,MAAM,OAAO,EAAE,aAAa,CAAC,MAAM,CAMzC,CAAC;AAEF,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAE1D;AAED,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC"}

package/dist/index.js

@@ -0,0 +1,20 @@
+import { httpTester } from './http.js';
+import { mysqlTester } from './mysql.js';
+import { postgresTester } from './postgres.js';
+import { redisTester } from './redis.js';
+import { sshTester } from './ssh.js';
+export { DEFAULT_TIMEOUT_MS, testerEnum } from './types.js';
+export { runTest } from './run.js';
+export { sanitizeResult } from './sanitize.js';
+export const testers = [
+    postgresTester,
+    mysqlTester,
+    redisTester,
+    sshTester,
+    httpTester,
+];
+export function findTester(type) {
+    return testers.find((t) => t.type === type) ?? null;
+}
+export { postgresTester, mysqlTester, redisTester, sshTester, httpTester };
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAUrC,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAgB,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,CAAC,MAAM,OAAO,GAA0B;IAC5C,cAAwB;IACxB,WAAqB;IACrB,WAAqB;IACrB,SAAmB;IACnB,UAAoB;CACrB,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AACtD,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC"}

package/dist/mysql.d.ts

@@ -0,0 +1,25 @@
+import { z } from 'zod';
+import type { Tester } from './types.js';
+declare const Target: z.ZodObject<{
+    host: z.ZodString;
+    port: z.ZodDefault<z.ZodNumber>;
+    database: z.ZodOptional<z.ZodString>;
+    user: z.ZodString;
+    ssl: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    user: string;
+    host: string;
+    port: number;
+    database?: string | undefined;
+    ssl?: boolean | undefined;
+}, {
+    user: string;
+    host: string;
+    port?: number | undefined;
+    database?: string | undefined;
+    ssl?: boolean | undefined;
+}>;
+type MysqlTarget = z.infer<typeof Target>;
+export declare const mysqlTester: Tester<MysqlTarget>;
+export {};
+//# sourceMappingURL=mysql.d.ts.map

package/dist/mysql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mysql.d.ts","sourceRoot":"","sources":["../src/mysql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAA8B,MAAM,EAAE,MAAM,YAAY,CAAC;AAErE,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;EAMV,CAAC;AAEH,KAAK,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAE1C,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,WAAW,CA+C3C,CAAC"}

package/dist/mysql.js

@@ -0,0 +1,60 @@
+import { z } from 'zod';
+import { isBlockedHostResolved } from './ssrf.js';
+const Target = z.object({
+    host: z.string().min(1),
+    port: z.coerce.number().int().min(1).max(65535).default(3306),
+    database: z.string().min(1).optional(),
+    user: z.string().min(1),
+    ssl: z.coerce.boolean().optional(),
+});
+export const mysqlTester = {
+    type: 'mysql',
+    schema: Target,
+    async test(secret, target) {
+        if (await isBlockedHostResolved(target.host)) {
+            return {
+                ok: false,
+                latency_ms: 0,
+                error: 'Target host is blocked (private/internal IP or metadata endpoint).',
+            };
+        }
+        const start = Date.now();
+        const mysql = await import('mysql2/promise');
+        const conn = await mysql
+            .createConnection({
+            host: target.host,
+            port: target.port,
+            ...(target.database ? { database: target.database } : {}),
+            user: target.user,
+            password: secret.value,
+            ...(target.ssl !== false ? { ssl: {} } : {}),
+            connectTimeout: 5000,
+        })
+            .catch((err) => {
+            return {
+                __error__: err instanceof Error ? err.message : String(err),
+            };
+        });
+        if ('__error__' in conn) {
+            return { ok: false, latency_ms: Date.now() - start, error: conn.__error__ };
+        }
+        try {
+            const [rows] = await conn.query('SELECT VERSION() AS v');
+            const v = rows[0]?.v;
+            return { ok: true, latency_ms: Date.now() - start, info: { server_version: v } };
+        }
+        catch (err) {
+            return {
+                ok: false,
+                latency_ms: Date.now() - start,
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+        finally {
+            await conn.end().catch(() => {
+                /* ignore */
+            });
+        }
+    },
+};
+//# sourceMappingURL=mysql.js.map

package/dist/mysql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mysql.js","sourceRoot":"","sources":["../src/mysql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAGlD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,WAAW,GAAwB;IAC9C,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,MAAM;IACd,KAAK,CAAC,IAAI,CAAC,MAAsB,EAAE,MAAmB;QACpD,IAAI,MAAM,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,CAAC;gBACb,KAAK,EAAE,oEAAoE;aAC5E,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,KAAK;aACrB,gBAAgB,CAAC;YAChB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,KAAK;YACtB,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,cAAc,EAAE,IAAI;SACrB,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,OAAO;gBACL,SAAS,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACnC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACL,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;YACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACzD,MAAM,CAAC,GAAI,IAA6B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC/C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,CAAC;QACnF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC1B,YAAY;YACd,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/postgres.d.ts

@@ -0,0 +1,25 @@
+import { z } from 'zod';
+import type { Tester } from './types.js';
+declare const Target: z.ZodObject<{
+    host: z.ZodString;
+    port: z.ZodDefault<z.ZodNumber>;
+    database: z.ZodString;
+    user: z.ZodString;
+    ssl: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    user: string;
+    host: string;
+    port: number;
+    database: string;
+    ssl?: boolean | undefined;
+}, {
+    user: string;
+    host: string;
+    database: string;
+    port?: number | undefined;
+    ssl?: boolean | undefined;
+}>;
+type PostgresTarget = z.infer<typeof Target>;
+export declare const postgresTester: Tester<PostgresTarget>;
+export {};
+//# sourceMappingURL=postgres.d.ts.map

package/dist/postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../src/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAA8B,MAAM,EAAE,MAAM,YAAY,CAAC;AAErE,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;EAMV,CAAC;AAEH,KAAK,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAE7C,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,cAAc,CA8CjD,CAAC"}

package/dist/postgres.js

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+import { isBlockedHostResolved } from './ssrf.js';
+const Target = z.object({
+    host: z.string().min(1),
+    port: z.coerce.number().int().min(1).max(65535).default(5432),
+    database: z.string().min(1),
+    user: z.string().min(1),
+    ssl: z.coerce.boolean().optional(),
+});
+export const postgresTester = {
+    type: 'postgres',
+    schema: Target,
+    async test(secret, target) {
+        if (await isBlockedHostResolved(target.host)) {
+            return {
+                ok: false,
+                latency_ms: 0,
+                error: 'Target host is blocked (private/internal IP or metadata endpoint).',
+            };
+        }
+        const start = Date.now();
+        // Lazy-load to keep the dep optional for environments that don't
+        // exercise this tester (e.g., running only the http tester).
+        const { Client } = await import('pg');
+        const client = new Client({
+            host: target.host,
+            port: target.port,
+            database: target.database,
+            user: target.user,
+            password: secret.value,
+            ssl: target.ssl ?? true,
+            connectionTimeoutMillis: 5000,
+            statement_timeout: 5000,
+        });
+        try {
+            await client.connect();
+            const r = await client.query('SELECT 1 AS ok, version() AS v');
+            const ok = r.rows[0]?.ok === 1;
+            return {
+                ok,
+                latency_ms: Date.now() - start,
+                ...(ok ? { info: { server_version: r.rows[0]?.v } } : {}),
+            };
+        }
+        catch (err) {
+            return {
+                ok: false,
+                latency_ms: Date.now() - start,
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+        finally {
+            await client.end().catch(() => {
+                /* ignore */
+            });
+        }
+    },
+};
+//# sourceMappingURL=postgres.js.map

package/dist/postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../src/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAGlD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,cAAc,GAA2B;IACpD,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,MAAM;IACd,KAAK,CAAC,IAAI,CAAC,MAAsB,EAAE,MAAsB;QACvD,IAAI,MAAM,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,CAAC;gBACb,KAAK,EAAE,oEAAoE;aAC5E,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,iEAAiE;QACjE,6DAA6D;QAC7D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;YACxB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,KAAK;YACtB,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI;YACvB,uBAAuB,EAAE,IAAI;YAC7B,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,KAAK,CAA4B,gCAAgC,CAAC,CAAC;YAC1F,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC/B,OAAO;gBACL,EAAE;gBACF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC5B,YAAY;YACd,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/redis.d.ts

@@ -0,0 +1,25 @@
+import { z } from 'zod';
+import type { Tester } from './types.js';
+declare const Target: z.ZodObject<{
+    host: z.ZodString;
+    port: z.ZodDefault<z.ZodNumber>;
+    db: z.ZodDefault<z.ZodNumber>;
+    user: z.ZodOptional<z.ZodString>;
+    tls: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    host: string;
+    port: number;
+    db: number;
+    user?: string | undefined;
+    tls?: boolean | undefined;
+}, {
+    host: string;
+    user?: string | undefined;
+    port?: number | undefined;
+    db?: number | undefined;
+    tls?: boolean | undefined;
+}>;
+type RedisTarget = z.infer<typeof Target>;
+export declare const redisTester: Tester<RedisTarget>;
+export {};
+//# sourceMappingURL=redis.d.ts.map

package/dist/redis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../src/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAA8B,MAAM,EAAE,MAAM,YAAY,CAAC;AAErE,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;EAMV,CAAC;AAEH,KAAK,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAE1C,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,WAAW,CA2C3C,CAAC"}

package/dist/redis.js

@@ -0,0 +1,57 @@
+import { z } from 'zod';
+import { isBlockedHostResolved } from './ssrf.js';
+const Target = z.object({
+    host: z.string().min(1),
+    port: z.coerce.number().int().min(1).max(65535).default(6379),
+    db: z.coerce.number().int().min(0).max(15).default(0),
+    user: z.string().optional(),
+    tls: z.coerce.boolean().optional(),
+});
+export const redisTester = {
+    type: 'redis',
+    schema: Target,
+    async test(secret, target) {
+        if (await isBlockedHostResolved(target.host)) {
+            return {
+                ok: false,
+                latency_ms: 0,
+                error: 'Target host is blocked (private/internal IP or metadata endpoint).',
+            };
+        }
+        const start = Date.now();
+        const { default: Redis } = await import('ioredis');
+        const client = new Redis({
+            host: target.host,
+            port: target.port,
+            db: target.db,
+            ...(target.user ? { username: target.user } : {}),
+            password: secret.value,
+            ...(target.tls ? { tls: {} } : {}),
+            lazyConnect: true,
+            maxRetriesPerRequest: 0,
+            connectTimeout: 5000,
+        });
+        try {
+            await client.connect();
+            const pong = await client.ping();
+            const ok = pong === 'PONG';
+            return { ok, latency_ms: Date.now() - start };
+        }
+        catch (err) {
+            return {
+                ok: false,
+                latency_ms: Date.now() - start,
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+        finally {
+            try {
+                client.disconnect();
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    },
+};
+//# sourceMappingURL=redis.js.map

package/dist/redis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.js","sourceRoot":"","sources":["../src/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAGlD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7D,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,WAAW,GAAwB;IAC9C,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,MAAM;IACd,KAAK,CAAC,IAAI,CAAC,MAAsB,EAAE,MAAmB;QACpD,IAAI,MAAM,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,CAAC;gBACb,KAAK,EAAE,oEAAoE;aAC5E,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,QAAQ,EAAE,MAAM,CAAC,KAAK;YACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,CAAC;YACvB,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,EAAE,GAAG,IAAI,KAAK,MAAM,CAAC;YAC3B,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/run.d.ts

@@ -0,0 +1,16 @@
+import type { ResolvedSecret, TestResult, Tester, TesterTarget } from './types.js';
+export interface RunArgs {
+    tester: Tester;
+    secret: ResolvedSecret;
+    target: TesterTarget;
+    timeoutMs?: number;
+}
+/**
+ * Validates the target against the tester's schema, invokes test()
+ * with a hard timeout, and runs the result through the sanitizer.
+ *
+ * The runner never touches network state itself — it's a thin
+ * orchestration layer so testers stay focused on protocol mechanics.
+ */
+export declare function runTest(args: RunArgs): Promise<TestResult>;
+//# sourceMappingURL=run.d.ts.map

package/dist/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAGnF,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAmBD;;;;;;GAMG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAsBhE"}

package/dist/run.js

@@ -0,0 +1,50 @@
+import { sanitizeResult } from './sanitize.js';
+import { DEFAULT_TIMEOUT_MS } from './types.js';
+function withTimeout(promise, ms) {
+    return new Promise((resolve, reject) => {
+        const t = setTimeout(() => reject(new Error(`tester timed out after ${ms}ms`)), ms);
+        t.unref();
+        promise.then((v) => {
+            clearTimeout(t);
+            resolve(v);
+        }, (err) => {
+            clearTimeout(t);
+            reject(err);
+        });
+    });
+}
+/**
+ * Validates the target against the tester's schema, invokes test()
+ * with a hard timeout, and runs the result through the sanitizer.
+ *
+ * The runner never touches network state itself — it's a thin
+ * orchestration layer so testers stay focused on protocol mechanics.
+ */
+export async function runTest(args) {
+    const start = Date.now();
+    const parsed = args.tester.schema.safeParse(args.target);
+    if (!parsed.success) {
+        return {
+            ok: false,
+            latency_ms: Date.now() - start,
+            error: `invalid target: ${formatZodIssues(parsed.error)}`,
+        };
+    }
+    const timeoutMs = args.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    let result;
+    try {
+        result = await withTimeout(args.tester.test(args.secret, parsed.data), timeoutMs);
+    }
+    catch (err) {
+        result = {
+            ok: false,
+            latency_ms: Date.now() - start,
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+    return sanitizeResult(result, args.secret);
+}
+function formatZodIssues(error) {
+    return error.issues.map((i) => `${i.path.join('.') || '<root>'}: ${i.message}`).join('; ');
+}
+//# sourceMappingURL=run.js.map