@noidmejs/atomkit-http 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 noidmejs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,67 @@
+# @noidmejs/atomkit-http
+
+**Declarative HTTP / backend connector.** Call any API by config — every verb,
+headers, query, body, auth, retries, cache, response transforms — and keep secrets
+**server-only** behind a proxy with an **SSRF host allow-list**.
+
+```bash
+npm i @noidmejs/atomkit-http
+```
+
+## Define a source
+
+```ts
+const listUsers = {
+  id: 'listUsers',
+  method: 'GET',
+  url: 'https://api.example.com/users',
+  query: { q: '{{params.q}}' },
+  auth: { type: 'bearer', token: '{{secret.API_TOKEN}}' },
+  retry: { attempts: 3, backoffMs: 300 },
+  cache: { ttlMs: 30000 },
+  transform: 'data.items',
+};
+```
+
+## Server: the proxy (secrets never reach the client)
+
+```ts
+import { createProxy } from '@noidmejs/atomkit-http';
+
+const proxy = createProxy({
+  sources: { listUsers },
+  secrets: { API_TOKEN: process.env.API_TOKEN! },
+  allowHosts: ['api.example.com'], // SSRF guard
+});
+
+// Next route handler / Cloudflare Worker:
+export const POST = (req: Request) => proxy.handleRequest(req);
+```
+
+The client POSTs `{ sourceId, params }`; the proxy injects secrets, enforces the
+host allow-list, calls the API, and returns the (transformed) JSON. Tokens stay
+on the server.
+
+## Client: run a public source directly
+
+```ts
+import { runSource } from '@noidmejs/atomkit-http';
+const res = await runSource(publicSource, { params: { q: 'hi' } });
+// res: { ok, status, data, error }
+```
+
+## Config
+
+`DataSource`: `method`, `url`, `headers`, `query`, `body`, `auth`
+(`bearer` / `basic` / `apiKey`), `timeoutMs`, `retry`, `cache`, `transform`
+(JSON path). `{{params.x}}` interpolates caller params; `{{secret.X}}` resolves
+**server-side only**, in the proxy.
+
+## Security status (v0.1 — read this)
+
+Hostname allow-list SSRF tier + server-only secrets + prototype-pollution-guarded
+templating. It is **not yet pen-tested**, and it does **not** pin DNS/IPs (a
+resolved hostname could still point at a private IP). Do not expose it to
+untrusted multi-tenant input without adding IP-pinning and a security review.
+
+MIT © noidmejs

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export * from './types.js';
+export { interpolate, interpolateDeep, getPath } from './template.js';
+export { runSource } from './run.js';
+export { createProxy, type ProxyConfig } from './proxy.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+// @noidmejs/atomkit-http — declarative HTTP/backend connector.
+// Call any API by config; keep secrets server-only behind an SSRF-guarded proxy.
+export * from './types.js';
+export { interpolate, interpolateDeep, getPath } from './template.js';
+export { runSource } from './run.js';
+export { createProxy } from './proxy.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,iFAAiF;AACjF,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAoB,MAAM,YAAY,CAAC"}

package/dist/proxy.d.ts

@@ -0,0 +1,24 @@
+import type { DataSource, RunResult } from './types.js';
+export interface ProxyConfig {
+    sources: Record<string, DataSource>;
+    /** Server-only secret values referenced as {{secret.NAME}}. Never leaves the server. */
+    secrets?: Record<string, string>;
+    /** Allow-listed request hosts — exact ("api.example.com") or suffix (".example.com"). */
+    allowHosts: string[];
+    fetchImpl?: typeof fetch;
+}
+/**
+ * A server-side proxy: resolves a named source with secrets injected, enforcing a
+ * host allow-list (SSRF guard). The client calls `resolve(sourceId, params)` and
+ * never sees secrets.
+ *
+ * SECURITY (v0.1): this is the hostname allow-list tier — it blocks off-list and
+ * param-injected hosts, but does NOT yet pin DNS/IPs (a resolved host could still
+ * point at a private IP). It is NOT pen-tested. Do not expose to untrusted
+ * multi-tenant input without adding IP-pinning + a security review.
+ */
+export declare function createProxy(config: ProxyConfig): {
+    resolve: (sourceId: string, params?: Record<string, unknown>) => Promise<RunResult>;
+    handleRequest: (req: Request) => Promise<Response>;
+};
+//# sourceMappingURL=proxy.d.ts.map

package/dist/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIxD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACpC,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,yFAAyF;IACzF,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAiBD;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW;wBACZ,MAAM,WAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAQ,OAAO,CAAC,SAAS,CAAC;yBAahE,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;EAqB9D"}

package/dist/proxy.js

@@ -0,0 +1,66 @@
+import { interpolate } from './template.js';
+import { runSource } from './run.js';
+function hostAllowed(rawUrl, allow) {
+    let host;
+    try {
+        const u = new URL(rawUrl);
+        if (u.protocol !== 'https:' && u.protocol !== 'http:')
+            return false;
+        host = u.hostname.toLowerCase();
+    }
+    catch {
+        return false;
+    }
+    return allow.some((a) => {
+        const s = a.toLowerCase();
+        return s.startsWith('.') ? host === s.slice(1) || host.endsWith(s) : host === s;
+    });
+}
+/**
+ * A server-side proxy: resolves a named source with secrets injected, enforcing a
+ * host allow-list (SSRF guard). The client calls `resolve(sourceId, params)` and
+ * never sees secrets.
+ *
+ * SECURITY (v0.1): this is the hostname allow-list tier — it blocks off-list and
+ * param-injected hosts, but does NOT yet pin DNS/IPs (a resolved host could still
+ * point at a private IP). It is NOT pen-tested. Do not expose to untrusted
+ * multi-tenant input without adding IP-pinning + a security review.
+ */
+export function createProxy(config) {
+    async function resolve(sourceId, params = {}) {
+        const source = config.sources[sourceId];
+        if (!source)
+            return { ok: false, status: 404, error: `unknown source "${sourceId}"` };
+        // Compute the effective host from params (secrets stripped) and allow-list it,
+        // so neither a static URL nor a param-injected one can reach an off-list host.
+        const withoutSecrets = source.url.replace(/\{\{\s*secret\.[\w.$-]+\s*\}\}/g, '');
+        const checkUrl = interpolate(withoutSecrets, { params, secret: {} });
+        if (!hostAllowed(checkUrl, config.allowHosts))
+            return { ok: false, status: 403, error: 'host not allowed' };
+        return runSource(source, { params, secrets: config.secrets, fetchImpl: config.fetchImpl });
+    }
+    /** Web-standard handler: POST { sourceId, params } → JSON RunResult. Mount in a
+     *  Next route handler, a Cloudflare Worker, an Express adapter, etc. */
+    async function handleRequest(req) {
+        let payload = {};
+        try {
+            payload = (await req.json());
+        }
+        catch {
+            /* invalid body → handled below */
+        }
+        if (!payload.sourceId) {
+            return new Response(JSON.stringify({ ok: false, status: 400, error: 'missing sourceId' }), {
+                status: 400,
+                headers: { 'content-type': 'application/json' },
+            });
+        }
+        const result = await resolve(payload.sourceId, payload.params ?? {});
+        return new Response(JSON.stringify(result), {
+            status: result.ok ? 200 : result.status || 500,
+            headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
+        });
+    }
+    return { resolve, handleRequest };
+}
+//# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAWrC,SAAS,WAAW,CAAC,MAAc,EAAE,KAAe;IAClD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACpE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,KAAK,UAAU,OAAO,CAAC,QAAgB,EAAE,SAAkC,EAAE;QAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,mBAAmB,QAAQ,GAAG,EAAE,CAAC;QACtF,+EAA+E;QAC/E,+EAA+E;QAC/E,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,iCAAiC,EAAE,EAAE,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,WAAW,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;QAC5G,OAAO,SAAS,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED;4EACwE;IACxE,KAAK,UAAU,aAAa,CAAC,GAAY;QACvC,IAAI,OAAO,GAA4D,EAAE,CAAC;QAC1E,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAE;gBACzF,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;YAC1C,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG;YAC9C,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;SAC7E,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC"}

package/dist/run.d.ts

@@ -0,0 +1,8 @@
+import type { DataSource, RunContext, RunResult } from './types.js';
+/**
+ * Resolve a data source: build the request from config, fetch (with retry/backoff/
+ * timeout), extract via `transform`, and cache successful GETs for `cache.ttlMs`.
+ * Works client- or server-side; pass `secrets` only on the server.
+ */
+export declare function runSource<T = unknown>(source: DataSource, ctx?: RunContext): Promise<RunResult<T>>;
+//# sourceMappingURL=run.d.ts.map

package/dist/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AA8BpE;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,GAAE,UAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CA2C5G"}

package/dist/run.js

@@ -0,0 +1,84 @@
+import { interpolate, interpolateDeep, getPath } from './template.js';
+const memo = new Map();
+function buildUrl(source, scope) {
+    let url = interpolate(source.url, scope);
+    const entries = [];
+    for (const [k, v] of Object.entries(source.query ?? {}))
+        entries.push([k, interpolate(v, scope)]);
+    if (source.auth?.type === 'apiKey' && source.auth.queryParam) {
+        entries.push([source.auth.queryParam, interpolate(source.auth.key ?? '', scope)]);
+    }
+    if (entries.length) {
+        const u = new URL(url);
+        for (const [k, v] of entries)
+            u.searchParams.set(k, v);
+        url = u.toString();
+    }
+    return url;
+}
+function buildHeaders(source, scope) {
+    const h = {};
+    for (const [k, v] of Object.entries(source.headers ?? {}))
+        h[k.toLowerCase()] = interpolate(v, scope);
+    const a = source.auth;
+    if (a?.type === 'bearer' && a.token)
+        h['authorization'] = `Bearer ${interpolate(a.token, scope)}`;
+    else if (a?.type === 'basic')
+        h['authorization'] = `Basic ${btoa(`${interpolate(a.username ?? '', scope)}:${interpolate(a.password ?? '', scope)}`)}`;
+    else if (a?.type === 'apiKey' && a.header)
+        h[a.header.toLowerCase()] = interpolate(a.key ?? '', scope);
+    return h;
+}
+/**
+ * Resolve a data source: build the request from config, fetch (with retry/backoff/
+ * timeout), extract via `transform`, and cache successful GETs for `cache.ttlMs`.
+ * Works client- or server-side; pass `secrets` only on the server.
+ */
+export async function runSource(source, ctx = {}) {
+    const scope = { params: ctx.params ?? {}, secret: ctx.secrets ?? {} };
+    const method = source.method ?? 'GET';
+    const cacheKey = source.cache?.ttlMs && method === 'GET' ? `${source.id}:${JSON.stringify(ctx.params ?? {})}` : '';
+    if (cacheKey) {
+        const hit = memo.get(cacheKey);
+        if (hit && Date.now() - hit.at < source.cache.ttlMs)
+            return { ok: true, status: 200, data: hit.data };
+    }
+    const url = buildUrl(source, scope);
+    const headers = buildHeaders(source, scope);
+    let body;
+    if (source.body !== undefined && method !== 'GET' && method !== 'HEAD') {
+        const b = interpolateDeep(source.body, scope);
+        body = typeof b === 'string' ? b : JSON.stringify(b);
+        if (typeof b !== 'string' && !headers['content-type'])
+            headers['content-type'] = 'application/json';
+    }
+    const f = ctx.fetchImpl ?? fetch;
+    const attempts = Math.max(1, source.retry?.attempts ?? 1);
+    const backoff = source.retry?.backoffMs ?? 300;
+    let last = { ok: false, status: 0, error: 'not run' };
+    for (let i = 0; i < attempts; i++) {
+        try {
+            const ctrl = source.timeoutMs ? new AbortController() : null;
+            const timer = ctrl ? setTimeout(() => ctrl.abort(), source.timeoutMs) : null;
+            const res = await f(url, { method, headers, body, signal: ctrl?.signal ?? null });
+            if (timer)
+                clearTimeout(timer);
+            const ct = res.headers.get('content-type') ?? '';
+            const raw = ct.includes('json') ? await res.json() : await res.text();
+            const data = (source.transform ? getPath(raw, source.transform) : raw);
+            last = { ok: res.ok, status: res.status, data, error: res.ok ? undefined : `HTTP ${res.status}` };
+            if (res.ok) {
+                if (cacheKey)
+                    memo.set(cacheKey, { at: Date.now(), data });
+                return last;
+            }
+        }
+        catch (e) {
+            last = { ok: false, status: 0, error: e instanceof Error ? e.message : 'fetch failed' };
+        }
+        if (i < attempts - 1)
+            await new Promise((r) => setTimeout(r, backoff * (i + 1)));
+    }
+    return last;
+}
+//# sourceMappingURL=run.js.map

package/dist/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAEtE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyC,CAAC;AAE9D,SAAS,QAAQ,CAAC,MAAkB,EAAE,KAA8B;IAClE,IAAI,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAClG,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,MAAkB,EAAE,KAA8B;IACtE,MAAM,CAAC,GAA2B,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtG,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK;QAAE,CAAC,CAAC,eAAe,CAAC,GAAG,UAAU,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;SAC7F,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO;QAAE,CAAC,CAAC,eAAe,CAAC,GAAG,SAAS,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;SACjJ,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM;QAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACvG,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAc,MAAkB,EAAE,MAAkB,EAAE;IACnF,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnH,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,KAAM,CAAC,KAAM;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAS,EAAE,CAAC;IAC/G,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,IAAwB,CAAC;IAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACvE,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9C,IAAI,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IACtG,CAAC;IAED,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,GAAG,CAAC;IAC/C,IAAI,IAAI,GAAiB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAEpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;YAClF,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACtE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAM,CAAC;YAC5E,IAAI,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YAClG,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,QAAQ;oBAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3D,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC;YAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/template.d.ts

@@ -0,0 +1,4 @@
+export declare function getPath(obj: unknown, path: string): unknown;
+export declare function interpolate(input: string, ctx: Record<string, unknown>): string;
+export declare function interpolateDeep(value: unknown, ctx: Record<string, unknown>): unknown;
+//# sourceMappingURL=template.d.ts.map

package/dist/template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../src/template.ts"],"names":[],"mappings":"AAEA,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAQ3D;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAK/E;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CASrF"}

package/dist/template.js

@@ -0,0 +1,33 @@
+// Safe {{path}} interpolation over a context (NO eval). Paths dot-walk the
+// context (e.g. params.id, secret.KEY) with a prototype-pollution guard.
+export function getPath(obj, path) {
+    let cur = obj;
+    for (const seg of path.split(/[.[\]]+/).filter(Boolean)) {
+        if (cur == null)
+            return undefined;
+        if (seg === '__proto__' || seg === 'constructor' || seg === 'prototype')
+            return undefined;
+        cur = cur[seg];
+    }
+    return cur;
+}
+export function interpolate(input, ctx) {
+    return input.replace(/\{\{\s*([\w.$-]+)\s*\}\}/g, (_m, path) => {
+        const v = getPath(ctx, path);
+        return v == null ? '' : String(v);
+    });
+}
+export function interpolateDeep(value, ctx) {
+    if (typeof value === 'string')
+        return interpolate(value, ctx);
+    if (Array.isArray(value))
+        return value.map((v) => interpolateDeep(v, ctx));
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value))
+            out[k] = interpolateDeep(v, ctx);
+        return out;
+    }
+    return value;
+}
+//# sourceMappingURL=template.js.map

package/dist/template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"template.js","sourceRoot":"","sources":["../src/template.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,yEAAyE;AACzE,MAAM,UAAU,OAAO,CAAC,GAAY,EAAE,IAAY;IAChD,IAAI,GAAG,GAAY,GAAG,CAAC;IACvB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,IAAI,GAAG,IAAI,IAAI;YAAE,OAAO,SAAS,CAAC;QAClC,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC;QAC1F,GAAG,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,GAA4B;IACrE,OAAO,KAAK,CAAC,OAAO,CAAC,2BAA2B,EAAE,CAAC,EAAE,EAAE,IAAY,EAAE,EAAE;QACrE,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,GAA4B;IAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3E,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7E,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,50 @@
+export type HttpVerb = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS';
+export interface AuthConfig {
+    type: 'bearer' | 'basic' | 'apiKey';
+    /** bearer token (may be a {{secret.X}} reference — resolved server-side only). */
+    token?: string;
+    /** basic auth. */
+    username?: string;
+    password?: string;
+    /** apiKey: the value + where it goes (a header name OR a query param name). */
+    key?: string;
+    header?: string;
+    queryParam?: string;
+}
+export interface RetryConfig {
+    attempts?: number;
+    backoffMs?: number;
+}
+export interface CacheConfig {
+    ttlMs?: number;
+}
+/** A declarative data source. url/headers/query/body may contain {{params.x}}
+ *  and (server-side only) {{secret.X}} template references. */
+export interface DataSource {
+    id: string;
+    method?: HttpVerb;
+    url: string;
+    headers?: Record<string, string>;
+    query?: Record<string, string>;
+    body?: unknown;
+    auth?: AuthConfig;
+    timeoutMs?: number;
+    retry?: RetryConfig;
+    cache?: CacheConfig;
+    /** Dot/bracket path into the JSON response to extract, e.g. "data.items". */
+    transform?: string;
+}
+export interface RunContext {
+    params?: Record<string, unknown>;
+    /** Server-only secret values referenced as {{secret.NAME}}. Never pass on the client. */
+    secrets?: Record<string, string>;
+    /** Override fetch (for tests / custom runtimes). */
+    fetchImpl?: typeof fetch;
+}
+export interface RunResult<T = unknown> {
+    ok: boolean;
+    status: number;
+    data?: T;
+    error?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAExF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpC,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;+DAC+D;AAC/D,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS,CAAC,CAAC,GAAG,OAAO;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "@noidmejs/atomkit-http",
+  "version": "0.1.0",
+  "description": "Declarative HTTP/backend connector: call any API by config (all verbs, headers, query, body, auth, retries, cache, transforms). Secrets stay server-only via a proxy with an SSRF host allow-list.",
+  "keywords": ["atomkit", "http", "connector", "declarative", "fetch", "api", "proxy", "ssrf", "no-code"],
+  "license": "MIT",
+  "author": "noidmejs",
+  "type": "module",
+  "sideEffects": false,
+  "files": ["dist"],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": { ".": { "types": "./dist/index.d.ts", "default": "./dist/index.js" } },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "node test/http.test.mjs",
+    "prepublishOnly": "npm run build"
+  },
+  "devDependencies": { "typescript": "^5.6.0", "@types/node": "^20.0.0" },
+  "publishConfig": { "access": "public" },
+  "repository": { "type": "git", "url": "git+https://github.com/noidme-git/atomkit-http.git" },
+  "engines": { "node": ">=18" }
+}