@noidmejs/atomkit-http 0.2.0 → 0.4.0

package/README.md

@@ -17,8 +17,11 @@ const listUsers = {
   url: 'https://api.example.com/users',
   query: { q: '{{params.q}}' },
   auth: { type: 'bearer', token: '{{secret.API_TOKEN}}' },
-  retry: { attempts: 3, backoffMs: 300 },
+  retry: { attempts: 3, backoffMs: 300 }, // GET/HEAD/OPTIONS only, unless you opt in
   cache: { ttlMs: 30000 },
+  timeoutMs: 10000,   // default; never unbounded
+  maxBytes: 5_000_000, // default response cap
+  expose: true,        // REQUIRED to be reachable via handleRequest — default false
   transform: 'data.items',
 };
 ```
@@ -31,7 +34,8 @@ import { createProxy } from '@noidmejs/atomkit-http';
 const proxy = createProxy({
   sources: { listUsers },
   secrets: { API_TOKEN: process.env.API_TOKEN! },
-  allowHosts: ['api.example.com'], // SSRF guard
+  allowHosts: ['api.example.com'], // SSRF guard: where a request may GO
+  authorize: async (req, sourceId, params) => isLoggedIn(req), // WHO may trigger it
 });
 
 // Next route handler / Cloudflare Worker:
@@ -42,6 +46,13 @@ The client POSTs `{ sourceId, params }`; the proxy injects secrets, enforces the
 host allow-list, calls the API, and returns the (transformed) JSON. Tokens stay
 on the server.
 
+> **`handleRequest` authenticates nobody.** The allow-list governs where a request
+> goes, never who may trigger it, and every call spends your server's
+> secret-authenticated upstream quota with caller-chosen params. A source is
+> therefore unreachable unless it sets `expose: true`, and any source returning
+> personal data needs `authorize` (or host auth in front of the route) **plus rate
+> limiting**, which this package does not provide.
+
 ## Client: run a public source directly
 
 ```ts

package/dist/cache.d.ts

@@ -0,0 +1,28 @@
+import type { ResponseCache } from './types.js';
+/** Default cap on entries held by one cache instance. */
+export declare const DEFAULT_MAX_ENTRIES = 500;
+/**
+ * A bounded LRU with TTL eviction and single-flight.
+ *
+ * Replaces a module-global `Map` that was keyed by `source.id + params`, never
+ * evicted, and shared across every `createProxy()` in the process. That map had
+ * three defects this fixes:
+ *
+ *  - **Cross-instance bleed.** Two proxies (say, per tenant) each declaring a
+ *    source named `users` served each other's responses, because neither the URL,
+ *    the auth headers, nor the owning instance were part of the key.
+ *  - **Unbounded growth.** Entries were only ignored after their TTL, never
+ *    deleted, and the key space included client-controlled params — so any caller
+ *    of a public proxy could grow memory until OOM.
+ *  - **Thundering herd.** No in-flight dedup, so every concurrent request for a
+ *    hot key stampeded the upstream the moment its TTL lapsed.
+ */
+export declare function createCache(maxEntries?: number): ResponseCache;
+/** Process-wide fallback used when no per-instance cache is supplied. Bounded and
+ *  evicting, but PREFER a per-instance cache (createProxy makes one for you). */
+export declare const defaultCache: ResponseCache;
+/** Stable, non-secret-bearing cache key: method + fully-resolved URL + a hash of
+ *  the request headers. Two callers with different bearer tokens must never share
+ *  an entry, but the token itself must not sit in a key we may log. */
+export declare function cacheKeyFor(method: string, url: string, headers: Record<string, string>): string;
+//# sourceMappingURL=cache.d.ts.map

package/dist/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,UAAU,GAAE,MAA4B,GAAG,aAAa,CAuCnF;AAED;iFACiF;AACjF,eAAO,MAAM,YAAY,EAAE,aAA6B,CAAC;AAEzD;;uEAEuE;AACvE,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAShG"}

package/dist/cache.js

@@ -0,0 +1,78 @@
+/** Default cap on entries held by one cache instance. */
+export const DEFAULT_MAX_ENTRIES = 500;
+/**
+ * A bounded LRU with TTL eviction and single-flight.
+ *
+ * Replaces a module-global `Map` that was keyed by `source.id + params`, never
+ * evicted, and shared across every `createProxy()` in the process. That map had
+ * three defects this fixes:
+ *
+ *  - **Cross-instance bleed.** Two proxies (say, per tenant) each declaring a
+ *    source named `users` served each other's responses, because neither the URL,
+ *    the auth headers, nor the owning instance were part of the key.
+ *  - **Unbounded growth.** Entries were only ignored after their TTL, never
+ *    deleted, and the key space included client-controlled params — so any caller
+ *    of a public proxy could grow memory until OOM.
+ *  - **Thundering herd.** No in-flight dedup, so every concurrent request for a
+ *    hot key stampeded the upstream the moment its TTL lapsed.
+ */
+export function createCache(maxEntries = DEFAULT_MAX_ENTRIES) {
+    const entries = new Map();
+    const pending = new Map();
+    return {
+        get(key, ttlMs) {
+            const hit = entries.get(key);
+            if (!hit)
+                return undefined;
+            if (Date.now() - hit.at >= ttlMs) {
+                entries.delete(key); // evict on expired read — do not retain forever
+                return undefined;
+            }
+            entries.delete(key); // re-insert to mark most-recently-used
+            entries.set(key, hit);
+            return hit.data;
+        },
+        set(key, data) {
+            entries.delete(key);
+            entries.set(key, { at: Date.now(), data });
+            while (entries.size > maxEntries) {
+                const oldest = entries.keys().next();
+                if (oldest.done)
+                    break;
+                entries.delete(oldest.value);
+            }
+        },
+        inflight(key, run) {
+            const existing = pending.get(key);
+            if (existing)
+                return existing;
+            const p = run().finally(() => pending.delete(key));
+            pending.set(key, p);
+            return p;
+        },
+        clear() {
+            entries.clear();
+        },
+        get size() {
+            return entries.size;
+        },
+    };
+}
+/** Process-wide fallback used when no per-instance cache is supplied. Bounded and
+ *  evicting, but PREFER a per-instance cache (createProxy makes one for you). */
+export const defaultCache = createCache();
+/** Stable, non-secret-bearing cache key: method + fully-resolved URL + a hash of
+ *  the request headers. Two callers with different bearer tokens must never share
+ *  an entry, but the token itself must not sit in a key we may log. */
+export function cacheKeyFor(method, url, headers) {
+    const canonical = Object.keys(headers)
+        .sort()
+        .map((k) => `${k}:${headers[k]}`)
+        .join('\n');
+    // djb2 — not cryptographic; enough to separate credential scopes in-process.
+    let h = 5381;
+    for (let i = 0; i < canonical.length; i++)
+        h = ((h << 5) + h + canonical.charCodeAt(i)) | 0;
+    return `${method} ${url} #${(h >>> 0).toString(36)}`;
+}
+//# sourceMappingURL=cache.js.map

package/dist/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAEA,yDAAyD;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,WAAW,CAAC,UAAU,GAAW,mBAAmB;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyC,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEpD,OAAO;QACL,GAAG,CAAC,GAAG,EAAE,KAAK;YACZ,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,KAAK,EAAE,CAAC;gBACjC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,gDAAgD;gBACrE,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,uCAAuC;YAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACtB,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;QACD,GAAG,CAAC,GAAG,EAAE,IAAI;YACX,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,OAAO,OAAO,CAAC,IAAI,GAAG,UAAU,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;gBACrC,IAAI,MAAM,CAAC,IAAI;oBAAE,MAAM;gBACvB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,QAAQ,CAAI,GAAW,EAAE,GAAqB;YAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAA2B,CAAC;YAC5D,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAqB,CAAC,CAAC;YACxC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK;YACH,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;QACD,IAAI,IAAI;YACN,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;iFACiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAkB,WAAW,EAAE,CAAC;AAEzD;;uEAEuE;AACvE,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,GAAW,EAAE,OAA+B;IACtF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;SACnC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,6EAA6E;IAC7E,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5F,OAAO,GAAG,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export * from './types.js';
 export { interpolate, interpolateDeep, getPath } from './template.js';
-export { runSource } from './run.js';
+export { runSource, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_BYTES } from './run.js';
 export { createProxy, type ProxyConfig } from './proxy.js';
+export { createCache, defaultCache, cacheKeyFor, DEFAULT_MAX_ENTRIES } from './cache.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -2,6 +2,7 @@
 // Call any API by config; keep secrets server-only behind an SSRF-guarded proxy.
 export * from './types.js';
 export { interpolate, interpolateDeep, getPath } from './template.js';
-export { runSource } from './run.js';
+export { runSource, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_BYTES } from './run.js';
 export { createProxy } from './proxy.js';
+export { createCache, defaultCache, cacheKeyFor, DEFAULT_MAX_ENTRIES } from './cache.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,iFAAiF;AACjF,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAoB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,iFAAiF;AACjF,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAoB,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC"}

package/dist/proxy.d.ts

@@ -1,4 +1,4 @@
-import type { DataSource, RunResult } from './types.js';
+import type { DataSource, ResponseCache, RunResult } from './types.js';
 export interface ProxyConfig {
     sources: Record<string, DataSource>;
     /** Server-only secret values referenced as {{secret.NAME}}. Never leaves the server. */
@@ -14,6 +14,18 @@ export interface ProxyConfig {
     onError?: (sourceId: string, result: RunResult) => void;
     /** Max redirect hops the SSRF guard follows before failing (default 5). */
     maxRedirects?: number;
+    /**
+     * Caller authorization for `handleRequest`. Return false to reject with 403.
+     *
+     * The SSRF allow-list governs where a request GOES, never WHO may trigger it.
+     * `handleRequest` authenticates nobody, and every call spends the server's
+     * secret-authenticated upstream quota — so a source returning personal data
+     * needs this hook (or host-level auth in front of the route), plus rate limiting.
+     */
+    authorize?: (req: Request, sourceId: string, params: Record<string, unknown>) => boolean | Promise<boolean>;
+    /** Response cache. Defaults to a fresh per-proxy instance — never shared across
+     *  proxies, so two tenants cannot read each other's cached responses. */
+    cache?: ResponseCache;
 }
 /**
  * A server-side proxy: resolves a named source with secrets injected, enforcing a
@@ -28,5 +40,6 @@ export interface ProxyConfig {
 export declare function createProxy(config: ProxyConfig): {
     resolve: (sourceId: string, params?: Record<string, unknown>) => Promise<RunResult>;
     handleRequest: (req: Request) => Promise<Response>;
+    clearCache: () => void;
 };
 //# sourceMappingURL=proxy.d.ts.map

package/dist/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIxD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACpC,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,yFAAyF;IACzF,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC;IACxD,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AA2BD;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW;wBACZ,MAAM,WAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAQ,OAAO,CAAC,SAAS,CAAC;yBAqBhE,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;EA6B9D"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAKvE,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACpC,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,yFAAyF;IACzF,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC;IACxD,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5G;6EACyE;IACzE,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AA2BD;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW;wBAMZ,MAAM,WAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAQ,OAAO,CAAC,SAAS,CAAC;yBA8BhE,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;sBAmCtC,IAAI;EAK5B"}

package/dist/proxy.js

@@ -1,5 +1,6 @@
 import { interpolate } from './template.js';
 import { runSource } from './run.js';
+import { createCache } from './cache.js';
 /** Generic, non-revealing client message for a failed status. */
 function genericError(status) {
     if (status === 400)
@@ -41,12 +42,18 @@ function hostAllowed(rawUrl, allow) {
  * multi-tenant input without adding IP-pinning + a security review.
  */
 export function createProxy(config) {
+    // One cache per proxy. The old module-global map was keyed by `source.id`
+    // alone, so two proxies both declaring a source named "users" served each
+    // other's cached responses.
+    const cache = config.cache ?? createCache();
     async function resolve(sourceId, params = {}) {
         const source = config.sources[sourceId];
         if (!source)
             return { ok: false, status: 404, error: `unknown source "${sourceId}"` };
-        // Compute the effective host from params (secrets stripped) and allow-list it,
-        // so neither a static URL nor a param-injected one can reach an off-list host.
+        // Cheap pre-check on the secret-stripped URL: reject an off-list host before
+        // any secret is interpolated. NOT sufficient on its own — a secret sitting in
+        // the host position would pass this and then be fetched — so `runSource` also
+        // re-validates the fully-resolved URL immediately before fetch.
         const withoutSecrets = source.url.replace(/\{\{\s*secret\.[\w.$-]+\s*\}\}/g, '');
         const checkUrl = interpolate(withoutSecrets, { params, secret: {} });
         if (!hostAllowed(checkUrl, config.allowHosts))
@@ -55,6 +62,9 @@ export function createProxy(config) {
             params,
             secrets: config.secrets,
             fetchImpl: config.fetchImpl,
+            cache,
+            // Authoritative check against the URL actually fetched, secrets included.
+            allowRequestHost: (u) => hostAllowed(u, config.allowHosts),
             // Re-validate every redirect hop against the SAME allow-list so a 30x can't
             // escape it to a private IP / off-list host.
             allowRedirectHost: (u) => hostAllowed(u, config.allowHosts),
@@ -62,8 +72,13 @@ export function createProxy(config) {
         });
     }
     /** Web-standard handler: POST { sourceId, params } → JSON RunResult. Mount in a
-     *  Next route handler, a Cloudflare Worker, an Express adapter, etc. */
+     *  Next route handler, a Cloudflare Worker, an Express adapter, etc.
+     *
+     *  Only sources declaring `expose: true` are reachable, and `config.authorize`
+     *  (if set) gates every call. This handler has no rate limiting of its own —
+     *  put the host's in front of it. */
     async function handleRequest(req) {
+        const json = (body, status) => new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json', 'cache-control': 'no-store' } });
         let payload = {};
         try {
             payload = (await req.json());
@@ -71,13 +86,18 @@ export function createProxy(config) {
         catch {
             /* invalid body → handled below */
         }
-        if (!payload.sourceId) {
-            return new Response(JSON.stringify({ ok: false, status: 400, error: 'missing sourceId' }), {
-                status: 400,
-                headers: { 'content-type': 'application/json' },
-            });
+        if (!payload.sourceId)
+            return json({ ok: false, status: 400, error: 'missing sourceId' }, 400);
+        const params = payload.params ?? {};
+        // Same response for "no such source" and "not exposed": do not let a caller
+        // enumerate which sources exist.
+        const source = config.sources[payload.sourceId];
+        if (!source || source.expose !== true)
+            return json({ ok: false, status: 404, error: 'not found' }, 404);
+        if (config.authorize && !(await config.authorize(req, payload.sourceId, params))) {
+            return json({ ok: false, status: 403, error: 'forbidden' }, 403);
         }
-        const result = await resolve(payload.sourceId, payload.params ?? {});
+        const result = await resolve(payload.sourceId, params);
         // Redact before crossing to the client: the raw `error` (fetch messages,
         // resolved URLs, upstream bodies) can leak internal hosts or secret-bearing
         // URLs. Log the detail server-side, return a generic message.
@@ -86,11 +106,12 @@ export function createProxy(config) {
             config.onError?.(payload.sourceId, result);
             client = { ok: false, status: result.status, error: genericError(result.status) };
         }
-        return new Response(JSON.stringify(client), {
-            status: result.ok ? 200 : result.status || 500,
-            headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
-        });
+        return json(client, result.ok ? 200 : result.status || 500);
+    }
+    /** Drop every cached response held by this proxy (erasure of cached personal data). */
+    function clearCache() {
+        cache.clear();
     }
-    return { resolve, handleRequest };
+    return { resolve, handleRequest, clearCache };
 }
 //# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAmBrC,iEAAiE;AACjE,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,aAAa,CAAC;IACzC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACzD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,cAAc,CAAC;IAC1C,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,sBAAsB,CAAC;IAChD,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,KAAe;IAClD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACpE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,KAAK,UAAU,OAAO,CAAC,QAAgB,EAAE,SAAkC,EAAE;QAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,mBAAmB,QAAQ,GAAG,EAAE,CAAC;QACtF,+EAA+E;QAC/E,+EAA+E;QAC/E,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,iCAAiC,EAAE,EAAE,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,WAAW,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;QAC5G,OAAO,SAAS,CAAC,MAAM,EAAE;YACvB,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,4EAA4E;YAC5E,6CAA6C;YAC7C,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;YAC3D,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC,CAAC;IACL,CAAC;IAED;4EACwE;IACxE,KAAK,UAAU,aAAa,CAAC,GAAY;QACvC,IAAI,OAAO,GAA4D,EAAE,CAAC;QAC1E,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAE;gBACzF,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACrE,yEAAyE;QACzE,4EAA4E;QAC5E,8DAA8D;QAC9D,IAAI,MAAM,GAAc,MAAM,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACpF,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;YAC1C,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG;YAC9C,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;SAC7E,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC"}
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA+BzC,iEAAiE;AACjE,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,aAAa,CAAC;IACzC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACzD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,cAAc,CAAC;IAC1C,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,sBAAsB,CAAC;IAChD,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,KAAe;IAClD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACpE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,0EAA0E;IAC1E,0EAA0E;IAC1E,4BAA4B;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;IAE5C,KAAK,UAAU,OAAO,CAAC,QAAgB,EAAE,MAAM,GAA4B,EAAE;QAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,mBAAmB,QAAQ,GAAG,EAAE,CAAC;QACtF,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,gEAAgE;QAChE,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,iCAAiC,EAAE,EAAE,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,WAAW,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;QAC5G,OAAO,SAAS,CAAC,MAAM,EAAE;YACvB,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK;YACL,0EAA0E;YAC1E,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;YAC1D,4EAA4E;YAC5E,6CAA6C;YAC7C,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;YAC3D,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC,CAAC;IACL,CAAC;IAED;;;;;yCAKqC;IACrC,KAAK,UAAU,aAAa,CAAC,GAAY;QACvC,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,MAAc,EAAY,EAAE,CACvD,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAE/H,IAAI,OAAO,GAA4D,EAAE,CAAC;QAC1E,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QAEpC,4EAA4E;QAC5E,iCAAiC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QAExG,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACjF,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,yEAAyE;QACzE,4EAA4E;QAC5E,8DAA8D;QAC9D,IAAI,MAAM,GAAc,MAAM,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACpF,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,uFAAuF;IACvF,SAAS,UAAU;QACjB,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;AAChD,CAAC"}

package/dist/run.d.ts

@@ -1,7 +1,17 @@
 import type { DataSource, RunContext, RunResult } from './types.js';
+/** Applied whenever `source.timeoutMs` is unset. An absent timeout let a hung or
+ *  slow-loris upstream hold a request for the platform default (~300s), multiplied
+ *  by every retry — behind a publicly mounted proxy that exhausts sockets. */
+export declare const DEFAULT_TIMEOUT_MS = 10000;
+/** Cap on a buffered upstream response body. The SSRF allow-list constrains WHERE
+ *  a request goes, not how much it returns; without a cap one large (or endless)
+ *  response is fully buffered per concurrent request. */
+export declare const DEFAULT_MAX_BYTES: number;
 /**
- * Resolve a data source: build the request from config, fetch (with retry/backoff/
- * timeout), extract via `transform`, and cache successful GETs for `cache.ttlMs`.
+ * Resolve a data source: build the request from config, fetch (with timeout,
+ * jittered retry, SSRF re-validation), extract via `transform`, and cache
+ * successful GETs for `cache.ttlMs`.
+ *
  * Works client- or server-side; pass `secrets` only on the server.
  */
 export declare function runSource<T = unknown>(source: DataSource, ctx?: RunContext): Promise<RunResult<T>>;

package/dist/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AA8BpE;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,GAAE,UAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CA2E5G"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIpE;;8EAE8E;AAC9E,eAAO,MAAM,kBAAkB,QAAS,CAAC;AACzC;;yDAEyD;AACzD,eAAO,MAAM,iBAAiB,QAAkB,CAAC;AAkFjD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,GAAE,UAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAgI5G"}

package/dist/run.js

@@ -1,5 +1,14 @@
 import { interpolate, interpolateDeep, getPath } from './template.js';
-const memo = new Map();
+import { defaultCache, cacheKeyFor } from './cache.js';
+/** Applied whenever `source.timeoutMs` is unset. An absent timeout let a hung or
+ *  slow-loris upstream hold a request for the platform default (~300s), multiplied
+ *  by every retry — behind a publicly mounted proxy that exhausts sockets. */
+export const DEFAULT_TIMEOUT_MS = 10_000;
+/** Cap on a buffered upstream response body. The SSRF allow-list constrains WHERE
+ *  a request goes, not how much it returns; without a cap one large (or endless)
+ *  response is fully buffered per concurrent request. */
+export const DEFAULT_MAX_BYTES = 5 * 1024 * 1024;
+const IDEMPOTENT = new Set(['GET', 'HEAD', 'OPTIONS']);
 function buildUrl(source, scope) {
     let url = interpolate(source.url, scope);
     const entries = [];
@@ -29,114 +38,220 @@ function buildHeaders(source, scope) {
         h[a.header.toLowerCase()] = interpolate(a.key ?? '', scope);
     return h;
 }
+/** Only a network error, a timeout, 408, 429 or a 5xx can succeed on a retry.
+ *  Re-sending a 400/401/403/404 is guaranteed-futile load on a struggling upstream. */
+function isRetryableStatus(status) {
+    return status === 408 || status === 429 || status >= 500;
+}
+/** `Retry-After: <seconds>` or an HTTP-date. Returns ms, or undefined. */
+function retryAfterMs(res) {
+    const raw = res.headers.get('retry-after');
+    if (!raw)
+        return undefined;
+    const secs = Number(raw);
+    if (Number.isFinite(secs))
+        return Math.max(0, secs * 1000);
+    const when = Date.parse(raw);
+    if (Number.isFinite(when))
+        return Math.max(0, when - Date.now());
+    return undefined;
+}
+/** Full jitter (AWS): random in [0, base * 2^attempt]. A fixed linear backoff made
+ *  a fleet of clients retry in lockstep against an upstream that was already down. */
+function jitteredBackoff(base, attempt) {
+    const ceiling = Math.min(base * 2 ** attempt, 30_000);
+    return Math.random() * ceiling;
+}
+/** Read a response body with a hard byte cap, streaming where possible so an
+ *  endless body is abandoned rather than buffered. */
+async function readCapped(res, maxBytes) {
+    const declared = Number(res.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > maxBytes)
+        throw new Error('response too large');
+    if (!res.body) {
+        const text = await res.text();
+        if (text.length > maxBytes)
+            throw new Error('response too large');
+        return text;
+    }
+    const reader = res.body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > maxBytes) {
+            await reader.cancel();
+            throw new Error('response too large');
+        }
+        chunks.push(value);
+    }
+    const buf = new Uint8Array(total);
+    let off = 0;
+    for (const c of chunks) {
+        buf.set(c, off);
+        off += c.byteLength;
+    }
+    return new TextDecoder().decode(buf);
+}
 /**
- * Resolve a data source: build the request from config, fetch (with retry/backoff/
- * timeout), extract via `transform`, and cache successful GETs for `cache.ttlMs`.
+ * Resolve a data source: build the request from config, fetch (with timeout,
+ * jittered retry, SSRF re-validation), extract via `transform`, and cache
+ * successful GETs for `cache.ttlMs`.
+ *
  * Works client- or server-side; pass `secrets` only on the server.
  */
 export async function runSource(source, ctx = {}) {
+    const started = Date.now();
     const scope = { params: ctx.params ?? {}, secret: ctx.secrets ?? {} };
     const method = source.method ?? 'GET';
-    const cacheKey = source.cache?.ttlMs && method === 'GET' ? `${source.id}:${JSON.stringify(ctx.params ?? {})}` : '';
-    if (cacheKey) {
-        const hit = memo.get(cacheKey);
-        if (hit && Date.now() - hit.at < source.cache.ttlMs)
-            return { ok: true, status: 200, data: hit.data };
+    const timeoutMs = source.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const maxBytes = source.maxBytes ?? DEFAULT_MAX_BYTES;
+    let url;
+    try {
+        url = buildUrl(source, scope);
+    }
+    catch {
+        return { ok: false, status: 0, error: 'invalid url', attempts: 0, durationMs: Date.now() - started };
     }
-    const url = buildUrl(source, scope);
     const headers = buildHeaders(source, scope);
-    let body;
-    if (source.body !== undefined && method !== 'GET' && method !== 'HEAD') {
-        const b = interpolateDeep(source.body, scope);
-        body = typeof b === 'string' ? b : JSON.stringify(b);
-        if (typeof b !== 'string' && !headers['content-type'])
-            headers['content-type'] = 'application/json';
+    // SSRF: validate the URL we are ACTUALLY about to fetch — after secrets are
+    // interpolated — not a secret-stripped surrogate checked by the caller.
+    if (ctx.allowRequestHost && !ctx.allowRequestHost(url)) {
+        return { ok: false, status: 403, error: 'host not allowed', attempts: 0, durationMs: Date.now() - started };
     }
-    const f = ctx.fetchImpl ?? fetch;
-    const attempts = Math.max(1, source.retry?.attempts ?? 1);
-    const backoff = source.retry?.backoffMs ?? 300;
-    const guardRedirects = typeof ctx.allowRedirectHost === 'function';
-    const maxRedirects = Math.max(0, ctx.maxRedirects ?? 5);
-    let last = { ok: false, status: 0, error: 'not run' };
-    for (let i = 0; i < attempts; i++) {
-        const ctrl = source.timeoutMs ? new AbortController() : null;
-        const timer = ctrl ? setTimeout(() => ctrl.abort(), source.timeoutMs) : null;
-        try {
-            // Redirect handling. Default: let the platform follow (redirect:'follow').
-            // When an SSRF guard is supplied, follow MANUALLY and re-validate each hop —
-            // an allow-listed host can otherwise 30x-redirect to a private IP / off-list
-            // host and the platform would follow it, bypassing the allow-list.
-            const originHost = (() => { try {
-                return new URL(url).host;
-            }
-            catch {
-                return '';
-            } })();
-            let curUrl = url;
-            let curMethod = method;
-            let curHeaders = { ...headers };
-            let curBody = body;
-            let res = await f(curUrl, {
-                method: curMethod, headers: curHeaders, body: curBody,
-                signal: ctrl?.signal ?? null, redirect: guardRedirects ? 'manual' : 'follow',
-            });
-            if (guardRedirects) {
-                let hops = 0;
-                while (res.status >= 300 && res.status < 400 && res.headers.get('location')) {
-                    if (hops++ >= maxRedirects) {
-                        if (timer)
+    // Key on the resolved request, so two sources sharing an `id` — or two tenants
+    // with different credentials — can never read each other's entries.
+    const cache = ctx.cache ?? defaultCache;
+    const ttlMs = source.cache?.ttlMs;
+    const useCache = !!ttlMs && method === 'GET';
+    const key = useCache ? cacheKeyFor(method, url, headers) : '';
+    if (useCache) {
+        const hit = cache.get(key, ttlMs);
+        if (hit !== undefined)
+            return { ok: true, status: 200, data: hit, cached: true, attempts: 0, durationMs: Date.now() - started };
+    }
+    const exec = async () => {
+        // Re-check after winning the single-flight race: the first caller may have
+        // already populated the entry while we queued behind it.
+        if (useCache) {
+            const hit = cache.get(key, ttlMs);
+            if (hit !== undefined)
+                return { ok: true, status: 200, data: hit, cached: true, attempts: 0, durationMs: Date.now() - started };
+        }
+        let body;
+        if (source.body !== undefined && method !== 'GET' && method !== 'HEAD') {
+            const b = interpolateDeep(source.body, scope);
+            body = typeof b === 'string' ? b : JSON.stringify(b);
+            if (typeof b !== 'string' && !headers['content-type'])
+                headers['content-type'] = 'application/json';
+        }
+        const f = ctx.fetchImpl ?? fetch;
+        const requested = Math.max(1, source.retry?.attempts ?? 1);
+        // A non-idempotent verb is not retried unless the caller asserts it is safe:
+        // a write that landed upstream but timed out here would otherwise run twice.
+        const canRetry = IDEMPOTENT.has(method) || source.retry?.retryNonIdempotent === true;
+        const attempts = canRetry ? requested : 1;
+        const backoff = source.retry?.backoffMs ?? 300;
+        const guardRedirects = typeof ctx.allowRedirectHost === 'function';
+        const maxRedirects = Math.max(0, ctx.maxRedirects ?? 5);
+        let last = { ok: false, status: 0, error: 'not run' };
+        let tried = 0;
+        for (let i = 0; i < attempts; i++) {
+            tried = i + 1;
+            // Always abort: an unset timeoutMs previously meant no AbortController at all.
+            const ctrl = new AbortController();
+            const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+            let waitMs;
+            try {
+                // Redirect handling. Default: let the platform follow (redirect:'follow').
+                // When an SSRF guard is supplied, follow MANUALLY and re-validate each hop —
+                // an allow-listed host can otherwise 30x-redirect to a private IP / off-list
+                // host and the platform would follow it, bypassing the allow-list.
+                const originHost = (() => { try {
+                    return new URL(url).host;
+                }
+                catch {
+                    return '';
+                } })();
+                let curUrl = url;
+                let curMethod = method;
+                const curHeaders = { ...headers };
+                let curBody = body;
+                let res = await f(curUrl, {
+                    method: curMethod, headers: curHeaders, body: curBody,
+                    signal: ctrl.signal, redirect: guardRedirects ? 'manual' : 'follow',
+                });
+                if (guardRedirects) {
+                    let hops = 0;
+                    while (res.status >= 300 && res.status < 400 && res.headers.get('location')) {
+                        if (hops++ >= maxRedirects) {
                             clearTimeout(timer);
-                        return { ok: false, status: 0, error: 'too many redirects' };
-                    }
-                    let loc;
-                    try {
-                        loc = new URL(res.headers.get('location'), curUrl).toString();
-                    }
-                    catch {
-                        if (timer)
+                            return { ok: false, status: 0, error: 'too many redirects', attempts: tried, durationMs: Date.now() - started };
+                        }
+                        let loc;
+                        try {
+                            loc = new URL(res.headers.get('location'), curUrl).toString();
+                        }
+                        catch {
                             clearTimeout(timer);
-                        return { ok: false, status: 0, error: 'invalid redirect location' };
-                    }
-                    if (!ctx.allowRedirectHost(loc)) {
-                        if (timer)
+                            return { ok: false, status: 0, error: 'invalid redirect location', attempts: tried, durationMs: Date.now() - started };
+                        }
+                        if (!ctx.allowRedirectHost(loc)) {
                             clearTimeout(timer);
-                        return { ok: false, status: 403, error: 'redirect host not allowed' };
-                    }
-                    // Cross-host hop → drop credentials so bearer/cookie can't leak off-origin.
-                    if (new URL(loc).host !== originHost) {
-                        delete curHeaders['authorization'];
-                        delete curHeaders['cookie'];
+                            return { ok: false, status: 403, error: 'redirect host not allowed', attempts: tried, durationMs: Date.now() - started };
+                        }
+                        // Cross-host hop → drop credentials so bearer/cookie can't leak off-origin.
+                        if (new URL(loc).host !== originHost) {
+                            delete curHeaders['authorization'];
+                            delete curHeaders['cookie'];
+                        }
+                        // 303 (and 301/302 on a non-idempotent method) → switch to GET, drop body;
+                        // 307/308 preserve method + body.
+                        if (res.status !== 307 && res.status !== 308 && curMethod !== 'GET' && curMethod !== 'HEAD') {
+                            curMethod = 'GET';
+                            curBody = undefined;
+                        }
+                        curUrl = loc;
+                        res = await f(curUrl, { method: curMethod, headers: curHeaders, body: curBody, signal: ctrl.signal, redirect: 'manual' });
                     }
-                    // 303 (and 301/302 on a non-idempotent method) → switch to GET, drop body;
-                    // 307/308 preserve method + body.
-                    if (res.status !== 307 && res.status !== 308 && curMethod !== 'GET' && curMethod !== 'HEAD') {
-                        curMethod = 'GET';
-                        curBody = undefined;
-                    }
-                    curUrl = loc;
-                    res = await f(curUrl, { method: curMethod, headers: curHeaders, body: curBody, signal: ctrl?.signal ?? null, redirect: 'manual' });
+                }
+                if (!res.ok) {
+                    clearTimeout(timer);
+                    last = { ok: false, status: res.status, error: `HTTP ${res.status}`, attempts: tried, durationMs: Date.now() - started };
+                    if (!isRetryableStatus(res.status))
+                        return last; // futile to re-send
+                    waitMs = retryAfterMs(res); // honour the upstream's own pacing
+                }
+                else {
+                    const text = await readCapped(res, maxBytes);
+                    clearTimeout(timer);
+                    const ct = res.headers.get('content-type') ?? '';
+                    const raw = ct.includes('json') ? (text ? JSON.parse(text) : undefined) : text;
+                    const data = (source.transform ? getPath(raw, source.transform) : raw);
+                    if (useCache)
+                        cache.set(key, data);
+                    return { ok: true, status: res.status, data, cached: false, attempts: tried, durationMs: Date.now() - started };
                 }
             }
-            if (timer)
+            catch (e) {
                 clearTimeout(timer);
-            const ct = res.headers.get('content-type') ?? '';
-            const raw = ct.includes('json') ? await res.json() : await res.text();
-            const data = (source.transform ? getPath(raw, source.transform) : raw);
-            last = { ok: res.ok, status: res.status, data, error: res.ok ? undefined : `HTTP ${res.status}` };
-            if (res.ok) {
-                if (cacheKey)
-                    memo.set(cacheKey, { at: Date.now(), data });
-                return last;
+                const aborted = e instanceof Error && e.name === 'AbortError';
+                last = {
+                    ok: false, status: 0,
+                    error: aborted ? `timeout after ${timeoutMs}ms` : e instanceof Error ? e.message : 'fetch failed',
+                    attempts: tried, durationMs: Date.now() - started,
+                };
             }
+            if (i < attempts - 1)
+                await new Promise((r) => setTimeout(r, waitMs ?? jitteredBackoff(backoff, i)));
         }
-        catch (e) {
-            if (timer)
-                clearTimeout(timer);
-            last = { ok: false, status: 0, error: e instanceof Error ? e.message : 'fetch failed' };
-        }
-        if (i < attempts - 1)
-            await new Promise((r) => setTimeout(r, backoff * (i + 1)));
-    }
-    return last;
+        return { ...last, attempts: tried, durationMs: Date.now() - started };
+    };
+    // Share one in-flight upstream request per cache key: when a hot key expires,
+    // concurrent callers await the same promise instead of stampeding the upstream.
+    return useCache ? cache.inflight(key, exec) : exec();
 }
 //# sourceMappingURL=run.js.map

package/dist/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAEtE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyC,CAAC;AAE9D,SAAS,QAAQ,CAAC,MAAkB,EAAE,KAA8B;IAClE,IAAI,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAClG,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,MAAkB,EAAE,KAA8B;IACtE,MAAM,CAAC,GAA2B,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtG,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK;QAAE,CAAC,CAAC,eAAe,CAAC,GAAG,UAAU,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;SAC7F,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO;QAAE,CAAC,CAAC,eAAe,CAAC,GAAG,SAAS,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;SACjJ,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM;QAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACvG,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAc,MAAkB,EAAE,MAAkB,EAAE;IACnF,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnH,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,KAAM,CAAC,KAAM;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAS,EAAE,CAAC;IAC/G,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,IAAwB,CAAC;IAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACvE,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9C,IAAI,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IACtG,CAAC;IAED,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,GAAG,CAAC;IAC/C,MAAM,cAAc,GAAG,OAAO,GAAG,CAAC,iBAAiB,KAAK,UAAU,CAAC;IACnE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC;IACxD,IAAI,IAAI,GAAiB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAEpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,IAAI,CAAC;YACH,2EAA2E;YAC3E,6EAA6E;YAC7E,6EAA6E;YAC7E,mEAAmE;YACnE,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAAC,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,EAAE,CAAC;YAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,IAAI,MAAM,GAAG,GAAG,CAAC;YACjB,IAAI,SAAS,GAAG,MAAM,CAAC;YACvB,IAAI,UAAU,GAA2B,EAAE,GAAG,OAAO,EAAE,CAAC;YACxD,IAAI,OAAO,GAAG,IAAI,CAAC;YACnB,IAAI,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,EAAE;gBACxB,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO;gBACrD,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;aAC7E,CAAC,CAAC;YACH,IAAI,cAAc,EAAE,CAAC;gBACnB,IAAI,IAAI,GAAG,CAAC,CAAC;gBACb,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5E,IAAI,IAAI,EAAE,IAAI,YAAY,EAAE,CAAC;wBAAC,IAAI,KAAK;4BAAE,YAAY,CAAC,KAAK,CAAC,CAAC;wBAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;oBAAC,CAAC;oBAC7H,IAAI,GAAW,CAAC;oBAChB,IAAI,CAAC;wBAAC,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;oBAAC,CAAC;oBACvE,MAAM,CAAC;wBAAC,IAAI,KAAK;4BAAE,YAAY,CAAC,KAAK,CAAC,CAAC;wBAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;oBAAC,CAAC;oBAC9G,IAAI,CAAC,GAAG,CAAC,iBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;wBAAC,IAAI,KAAK;4BAAE,YAAY,CAAC,KAAK,CAAC,CAAC;wBAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;oBAAC,CAAC;oBAC5I,4EAA4E;oBAC5E,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;wBAAC,OAAO,UAAU,CAAC,eAAe,CAAC,CAAC;wBAAC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;oBAAC,CAAC;oBAC1G,2EAA2E;oBAC3E,kCAAkC;oBAClC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;wBAAC,SAAS,GAAG,KAAK,CAAC;wBAAC,OAAO,GAAG,SAAS,CAAC;oBAAC,CAAC;oBACxI,MAAM,GAAG,GAAG,CAAC;oBACb,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACrI,CAAC;YACH,CAAC;YACD,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACtE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAM,CAAC;YAC5E,IAAI,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YAClG,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,QAAQ;oBAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3D,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC;YAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEvD;;8EAE8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC;;yDAEyD;AACzD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEvD,SAAS,QAAQ,CAAC,MAAkB,EAAE,KAA8B;IAClE,IAAI,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAClG,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,MAAkB,EAAE,KAA8B;IACtE,MAAM,CAAC,GAA2B,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtG,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK;QAAE,CAAC,CAAC,eAAe,CAAC,GAAG,UAAU,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;SAC7F,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO;QAAE,CAAC,CAAC,eAAe,CAAC,GAAG,SAAS,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;SACjJ,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM;QAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACvG,OAAO,CAAC,CAAC;AACX,CAAC;AAED;uFACuF;AACvF,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;AAC3D,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,GAAa;IACjC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;sFACsF;AACtF,SAAS,eAAe,CAAC,IAAY,EAAE,OAAe;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,OAAO,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC;AACjC,CAAC;AAED;sDACsD;AACtD,KAAK,UAAU,UAAU,CAAC,GAAa,EAAE,QAAgB;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC5F,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAAC,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC;IAAC,CAAC;IACjE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAc,MAAkB,EAAE,GAAG,GAAe,EAAE;IACnF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IAEtD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IACvG,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAE5C,4EAA4E;IAC5E,wEAAwE;IACxE,IAAI,GAAG,CAAC,gBAAgB,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAC9G,CAAC;IAED,+EAA+E;IAC/E,oEAAoE;IACpE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,YAAY,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,IAAI,MAAM,KAAK,KAAK,CAAC;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAM,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IACvI,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,IAA2B,EAAE;QAC7C,2EAA2E;QAC3E,yDAAyD;QACzD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAM,CAAC,CAAC;YACnC,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QACvI,CAAC;QAED,IAAI,IAAwB,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACvE,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC9C,IAAI,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACrD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;gBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QACtG,CAAC;QAED,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;QAC3D,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,CAAC;QACrF,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,GAAG,CAAC;QAC/C,MAAM,cAAc,GAAG,OAAO,GAAG,CAAC,iBAAiB,KAAK,UAAU,CAAC;QACnE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC;QACxD,IAAI,IAAI,GAAiB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACpE,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,+EAA+E;YAC/E,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;YACxD,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,2EAA2E;gBAC3E,6EAA6E;gBAC7E,6EAA6E;gBAC7E,mEAAmE;gBACnE,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;oBAAC,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,EAAE,CAAC;gBAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxF,IAAI,MAAM,GAAG,GAAG,CAAC;gBACjB,IAAI,SAAS,GAAG,MAAM,CAAC;gBACvB,MAAM,UAAU,GAA2B,EAAE,GAAG,OAAO,EAAE,CAAC;gBAC1D,IAAI,OAAO,GAAG,IAAI,CAAC;gBACnB,IAAI,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,EAAE;oBACxB,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO;oBACrD,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;iBACpE,CAAC,CAAC;gBACH,IAAI,cAAc,EAAE,CAAC;oBACnB,IAAI,IAAI,GAAG,CAAC,CAAC;oBACb,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC5E,IAAI,IAAI,EAAE,IAAI,YAAY,EAAE,CAAC;4BAAC,YAAY,CAAC,KAAK,CAAC,CAAC;4BAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;wBAAC,CAAC;wBACrK,IAAI,GAAW,CAAC;wBAChB,IAAI,CAAC;4BAAC,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;wBAAC,CAAC;wBACvE,MAAM,CAAC;4BAAC,YAAY,CAAC,KAAK,CAAC,CAAC;4BAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;wBAAC,CAAC;wBACtJ,IAAI,CAAC,GAAG,CAAC,iBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;4BAAC,YAAY,CAAC,KAAK,CAAC,CAAC;4BAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;wBAAC,CAAC;wBACpL,4EAA4E;wBAC5E,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;4BAAC,OAAO,UAAU,CAAC,eAAe,CAAC,CAAC;4BAAC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;wBAAC,CAAC;wBAC1G,2EAA2E;wBAC3E,kCAAkC;wBAClC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;4BAAC,SAAS,GAAG,KAAK,CAAC;4BAAC,OAAO,GAAG,SAAS,CAAC;wBAAC,CAAC;wBACxI,MAAM,GAAG,GAAG,CAAC;wBACb,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;oBAC5H,CAAC;gBACH,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,IAAI,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;oBACzH,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;wBAAE,OAAO,IAAI,CAAC,CAAC,oBAAoB;oBACrE,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,mCAAmC;gBACjE,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;oBAC7C,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;oBACjD,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBAC/E,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAM,CAAC;oBAC5E,IAAI,QAAQ;wBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;oBACnC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;gBAClH,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC;gBAC9D,IAAI,GAAG;oBACL,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;oBACpB,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc;oBACjG,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;iBAClD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC;gBAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IACxE,CAAC,CAAC;IAEF,8EAA8E;IAC9E,gFAAgF;IAChF,OAAO,QAAQ,CAAC,CAAC,CAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAA2B,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAClF,CAAC"}

package/dist/types.d.ts

@@ -14,10 +14,32 @@ export interface AuthConfig {
 export interface RetryConfig {
     attempts?: number;
     backoffMs?: number;
+    /**
+     * Retry non-idempotent verbs (POST/PUT/PATCH/DELETE). Default false.
+     *
+     * A write that SUCCEEDED upstream but timed out client-side is indistinguishable
+     * from one that never landed, so retrying it silently duplicates the write. Only
+     * enable when the upstream is idempotent (e.g. you send an idempotency key).
+     */
+    retryNonIdempotent?: boolean;
 }
 export interface CacheConfig {
     ttlMs?: number;
 }
+/**
+ * A bounded, TTL-evicting response cache with single-flight. Create one PER
+ * proxy/tenant: entries are keyed by the fully-resolved request (method + URL +
+ * a hash of auth headers), never by `source.id` alone.
+ */
+export interface ResponseCache {
+    get(key: string, ttlMs: number): unknown | undefined;
+    set(key: string, data: unknown): void;
+    /** Share one in-flight request per key (stops a TTL-expiry stampede). */
+    inflight<T>(key: string, run: () => Promise<T>): Promise<T>;
+    /** Drop all entries — required for erasure of cached personal data. */
+    clear(): void;
+    readonly size: number;
+}
 /** A declarative data source. url/headers/query/body may contain {{params.x}}
  *  and (server-side only) {{secret.X}} template references. */
 export interface DataSource {
@@ -28,9 +50,20 @@ export interface DataSource {
     query?: Record<string, string>;
     body?: unknown;
     auth?: AuthConfig;
+    /** Per-request timeout. Defaults to `DEFAULT_TIMEOUT_MS` (10s) — never unbounded. */
     timeoutMs?: number;
     retry?: RetryConfig;
     cache?: CacheConfig;
+    /** Cap on the upstream response body in bytes. Default `DEFAULT_MAX_BYTES` (5 MiB). */
+    maxBytes?: number;
+    /**
+     * Reachable through `createProxy().handleRequest`? Default FALSE.
+     *
+     * `handleRequest` performs no authentication of its own, and each call spends the
+     * server's secret-authenticated upstream quota. Opting a source in makes it
+     * invokable by any client that can reach the route, with attacker-chosen params.
+     */
+    expose?: boolean;
     /** Dot/bracket path into the JSON response to extract, e.g. "data.items". */
     transform?: string;
 }
@@ -50,11 +83,27 @@ export interface RunContext {
     allowRedirectHost?: (url: string) => boolean;
     /** Max redirect hops to follow when `allowRedirectHost` is set (default 5). */
     maxRedirects?: number;
+    /**
+     * SSRF hardening for the INITIAL request. Checked against the fully-resolved URL
+     * — after `{{secret.X}}` interpolation — immediately before fetch. The proxy used
+     * to allow-list a secret-STRIPPED surrogate while `runSource` fetched the real
+     * one, so a secret in the host position (`api.example.com{{secret.SUFFIX}}`)
+     * passed the check and reached a different host.
+     */
+    allowRequestHost?: (url: string) => boolean;
+    /** Per-instance response cache. Omit to use the process-wide default cache. */
+    cache?: ResponseCache;
 }
 export interface RunResult<T = unknown> {
     ok: boolean;
     status: number;
     data?: T;
     error?: string;
+    /** Observability: how many attempts were made (1 = no retry). */
+    attempts?: number;
+    /** Observability: served from cache without an upstream request. */
+    cached?: boolean;
+    /** Observability: wall-clock ms for the whole resolve. */
+    durationMs?: number;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAExF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpC,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;+DAC+D;AAC/D,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,SAAS,CAAC,CAAC,GAAG,OAAO;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAExF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpC,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IACrD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IACtC,yEAAyE;IACzE,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5D,uEAAuE;IACvE,KAAK,IAAI,IAAI,CAAC;IACd,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;+DAC+D;AAC/D,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5C,+EAA+E;IAC/E,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,SAAS,CAAC,CAAC,GAAG,OAAO;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noidmejs/atomkit-http",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Declarative HTTP/backend connector: call any API by config (all verbs, headers, query, body, auth, retries, cache, transforms). Secrets stay server-only via a proxy with an SSRF host allow-list + per-redirect-hop re-validation.",
   "keywords": ["atomkit", "http", "connector", "declarative", "fetch", "api", "proxy", "ssrf", "no-code"],
   "license": "MIT",
@@ -14,12 +14,12 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "test": "node test/http.test.mjs",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build && npm test"
   },
-  "devDependencies": { "typescript": "^5.6.0", "@types/node": "^20.0.0" },
+  "devDependencies": { "typescript": "^7.0.0", "@types/node": "^22.0.0" },
   "publishConfig": { "access": "public" },
   "repository": { "type": "git", "url": "git+https://github.com/noidme-git/atomkit-http.git" },
   "bugs": { "url": "https://github.com/noidme-git/atomkit-http/issues" },
   "homepage": "https://github.com/noidme-git/atomkit-http#readme",
-  "engines": { "node": ">=18" }
+  "engines": { "node": ">=22" }
 }