@revenexx/integrations-node-sdk 1.6.0 → 1.8.0

package/dist/{chunk-WB3BYMLA.js → chunk-5BCAXRU3.js}

@@ -14,15 +14,23 @@ function extractCredentialManifests(credentials) {
 
 // src/manifest.ts
 var MANIFEST_VERSION = "v0-draft";
+var PACKAGE_ICON = /^lucide:[a-z0-9]+(-[a-z0-9]+)*$/;
+var PHP_TRIM = /^[ \t\n\r\0\v]+|[ \t\n\r\0\v]+$/g;
+function packageIconProblem(icon) {
+  if (icon === void 0 || PACKAGE_ICON.test(icon)) return void 0;
+  return `package.json "revenexx.icon" must be a Lucide icon name such as "lucide:bell", got "${icon}".`;
+}
 function parsePackageMeta(raw) {
   const obj = raw && typeof raw === "object" ? raw : {};
   const str = (v) => typeof v === "string" ? v.trim() : "";
   const revenexx = obj.revenexx && typeof obj.revenexx === "object" ? obj.revenexx : {};
   const displayName = str(revenexx.displayName);
+  const icon = typeof revenexx.icon === "string" ? revenexx.icon.replace(PHP_TRIM, "") : "";
   return {
     name: str(obj.name),
     version: str(obj.version),
-    displayName: displayName !== "" ? displayName : void 0
+    displayName: displayName !== "" ? displayName : void 0,
+    icon: icon !== "" ? icon : void 0
   };
 }
 function buildManifest(nodes, credentials = [], templates = []) {
@@ -45,6 +53,7 @@ export {
   extractCredentialManifest,
   extractCredentialManifests,
   MANIFEST_VERSION,
+  packageIconProblem,
   parsePackageMeta,
   buildManifest
 };

package/dist/cli.cjs

@@ -93,15 +93,23 @@ function extractCredentialManifests(credentials) {
 
 // src/manifest.ts
 var MANIFEST_VERSION = "v0-draft";
+var PACKAGE_ICON = /^lucide:[a-z0-9]+(-[a-z0-9]+)*$/;
+var PHP_TRIM = /^[ \t\n\r\0\v]+|[ \t\n\r\0\v]+$/g;
+function packageIconProblem(icon) {
+  if (icon === void 0 || PACKAGE_ICON.test(icon)) return void 0;
+  return `package.json "revenexx.icon" must be a Lucide icon name such as "lucide:bell", got "${icon}".`;
+}
 function parsePackageMeta(raw) {
   const obj = raw && typeof raw === "object" ? raw : {};
   const str = (v) => typeof v === "string" ? v.trim() : "";
   const revenexx = obj.revenexx && typeof obj.revenexx === "object" ? obj.revenexx : {};
   const displayName = str(revenexx.displayName);
+  const icon = typeof revenexx.icon === "string" ? revenexx.icon.replace(PHP_TRIM, "") : "";
   return {
     name: str(obj.name),
     version: str(obj.version),
-    displayName: displayName !== "" ? displayName : void 0
+    displayName: displayName !== "" ? displayName : void 0,
+    icon: icon !== "" ? icon : void 0
   };
 }
 function buildManifest(nodes, credentials = [], templates = []) {
@@ -136,6 +144,14 @@ function readPackageJson(root) {
   }
 }
 async function runManifest() {
+  const pkg = readPackageJson(projectRoot);
+  const meta = parsePackageMeta(pkg);
+  const iconProblem = packageIconProblem(meta.icon);
+  if (iconProblem) fail(iconProblem);
+  const declaredIcon = pkg?.revenexx?.icon;
+  if (declaredIcon != null && typeof declaredIcon !== "string") {
+    console.warn('\u26A0 package.json "revenexx.icon" is not text \u2014 the folder will show no icon.');
+  }
   const distEntry = (0, import_node_path2.resolve)(projectRoot, "dist", "index.js");
   if (!fs2.existsSync(distEntry)) {
     fail("dist/index.js is missing. Run the build (tsup) before `rvnxx-nodes manifest`.");
@@ -152,7 +168,6 @@ async function runManifest() {
   }
   const credentials = mod.CREDENTIALS ?? [];
   const templates = mod.TEMPLATES ?? [];
-  const meta = parsePackageMeta(readPackageJson(projectRoot));
   const hasPackage = meta.name !== "" && meta.version !== "";
   if (hasPackage && !meta.displayName) {
     console.warn(

package/dist/cli.js

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import {
   buildManifest,
+  packageIconProblem,
   parsePackageMeta
-} from "./chunk-WB3BYMLA.js";
+} from "./chunk-5BCAXRU3.js";
 
 // src/cli.ts
 import * as fs2 from "fs";
@@ -76,6 +77,14 @@ function readPackageJson(root) {
   }
 }
 async function runManifest() {
+  const pkg = readPackageJson(projectRoot);
+  const meta = parsePackageMeta(pkg);
+  const iconProblem = packageIconProblem(meta.icon);
+  if (iconProblem) fail(iconProblem);
+  const declaredIcon = pkg?.revenexx?.icon;
+  if (declaredIcon != null && typeof declaredIcon !== "string") {
+    console.warn('\u26A0 package.json "revenexx.icon" is not text \u2014 the folder will show no icon.');
+  }
   const distEntry = resolve2(projectRoot, "dist", "index.js");
   if (!fs2.existsSync(distEntry)) {
     fail("dist/index.js is missing. Run the build (tsup) before `rvnxx-nodes manifest`.");
@@ -92,7 +101,6 @@ async function runManifest() {
   }
   const credentials = mod.CREDENTIALS ?? [];
   const templates = mod.TEMPLATES ?? [];
-  const meta = parsePackageMeta(readPackageJson(projectRoot));
   const hasPackage = meta.name !== "" && meta.version !== "";
   if (hasPackage && !meta.displayName) {
     console.warn(

package/dist/index.cjs

@@ -61,6 +61,7 @@ __export(index_exports, {
   extractCredentialManifests: () => extractCredentialManifests,
   extractManifest: () => extractManifest,
   extractManifests: () => extractManifests,
+  headerCrossesOrigin: () => headerCrossesOrigin,
   httpErrorResult: () => httpErrorResult,
   isBlockedAddress: () => isBlockedAddress,
   isNodeWithIteration: () => isNodeWithIteration,
@@ -69,6 +70,7 @@ __export(index_exports, {
   maxBytesConfigField: () => maxBytesConfigField,
   normalizeCredentialType: () => normalizeCredentialType,
   normalizeLocalized: () => normalizeLocalized,
+  packageIconProblem: () => packageIconProblem,
   parsePackageMeta: () => parsePackageMeta,
   readArrayBuffer: () => readArrayBuffer,
   readJsonOrText: () => readJsonOrText,
@@ -474,6 +476,26 @@ var DEFAULT_TIMEOUT_MS = 3e4;
 var MAX_TIMEOUT_MS = 12e4;
 var MAX_REDIRECTS = 5;
 var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var CROSS_ORIGIN_SAFE_HEADERS = /* @__PURE__ */ new Set([
+  "accept",
+  "accept-encoding",
+  "accept-language",
+  "content-encoding",
+  "content-language",
+  "content-type",
+  "idempotency-key",
+  "if-match",
+  "if-modified-since",
+  "if-none-match",
+  "if-range",
+  "if-unmodified-since",
+  "range",
+  "soapaction",
+  "user-agent"
+]);
+function headerCrossesOrigin(name) {
+  return CROSS_ORIGIN_SAFE_HEADERS.has(name.trim().toLowerCase());
+}
 var DEFAULT_RETRY_ATTEMPTS = 0;
 var MAX_RETRY_ATTEMPTS = 5;
 var DEFAULT_RETRY_DELAY_MS = 1e3;
@@ -556,9 +578,9 @@ async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
       headers.delete("content-length");
     }
     if (nextUrl.origin !== base.origin) {
-      headers.delete("authorization");
-      headers.delete("cookie");
-      headers.delete("proxy-authorization");
+      for (const name of [...headers.keys()]) {
+        if (!headerCrossesOrigin(name)) headers.delete(name);
+      }
     }
     currentUrl = nextUrl;
     currentInit = { ...currentInit, method, body, headers, redirect: "manual" };
@@ -791,15 +813,23 @@ async function withRetry(fn, policy, hooks) {
 
 // src/manifest.ts
 var MANIFEST_VERSION = "v0-draft";
+var PACKAGE_ICON = /^lucide:[a-z0-9]+(-[a-z0-9]+)*$/;
+var PHP_TRIM = /^[ \t\n\r\0\v]+|[ \t\n\r\0\v]+$/g;
+function packageIconProblem(icon) {
+  if (icon === void 0 || PACKAGE_ICON.test(icon)) return void 0;
+  return `package.json "revenexx.icon" must be a Lucide icon name such as "lucide:bell", got "${icon}".`;
+}
 function parsePackageMeta(raw) {
   const obj = raw && typeof raw === "object" ? raw : {};
   const str = (v) => typeof v === "string" ? v.trim() : "";
   const revenexx = obj.revenexx && typeof obj.revenexx === "object" ? obj.revenexx : {};
   const displayName = str(revenexx.displayName);
+  const icon = typeof revenexx.icon === "string" ? revenexx.icon.replace(PHP_TRIM, "") : "";
   return {
     name: str(obj.name),
     version: str(obj.version),
-    displayName: displayName !== "" ? displayName : void 0
+    displayName: displayName !== "" ? displayName : void 0,
+    icon: icon !== "" ? icon : void 0
   };
 }
 function buildManifest(nodes, credentials = [], templates = []) {
@@ -1106,6 +1136,7 @@ function base64Url(buf) {
   extractCredentialManifests,
   extractManifest,
   extractManifests,
+  headerCrossesOrigin,
   httpErrorResult,
   isBlockedAddress,
   isNodeWithIteration,
@@ -1114,6 +1145,7 @@ function base64Url(buf) {
   maxBytesConfigField,
   normalizeCredentialType,
   normalizeLocalized,
+  packageIconProblem,
   parsePackageMeta,
   readArrayBuffer,
   readJsonOrText,

package/dist/index.d.cts

@@ -771,6 +771,18 @@ declare const DEFAULT_TIMEOUT_MS = 30000;
 declare const MAX_TIMEOUT_MS = 120000;
 /** Maximum number of redirect hops `safeFetch` follows before giving up. */
 declare const MAX_REDIRECTS = 5;
+/**
+ * Whether a request header with this name goes on to the next hop when
+ * {@link safeFetch} follows a redirect to another origin — `true` for `Accept`,
+ * `Accept-Encoding`, `Accept-Language`, `Content-Encoding`, `Content-Language`,
+ * `Content-Type`, `Idempotency-Key`, `If-Match`, `If-Modified-Since`,
+ * `If-None-Match`, `If-Range`, `If-Unmodified-Since`, `Range`, `SOAPAction` and
+ * `User-Agent`, in any case, and `false` for every other name. The keep-list is by
+ * name, so it can only keep a secret out of the headers it drops: a credential
+ * whose header name the author chooses must refuse a name this answers `true`
+ * for, or its key would cross with the harmless headers.
+ */
+declare function headerCrossesOrigin(name: string): boolean;
 declare const DEFAULT_RETRY_ATTEMPTS = 0;
 declare const MAX_RETRY_ATTEMPTS = 5;
 declare const DEFAULT_RETRY_DELAY_MS = 1000;
@@ -1023,9 +1035,10 @@ interface NodeManifest {
  * The registry-relevant fields of a node package's `package.json`, as read by
  * the CLI. `name`/`version` identify the package; `displayName` is the
  * human-readable bundle label shown in the editor's node palette (e.g.
- * „Business Central"). All three are read straight from `package.json` by the
- * integrations server on upload — the CLI reads them only to warn about a
- * missing label and to annotate the manifest log line.
+ * „Business Central"); `icon` marks its folder there. All four are read straight
+ * from `package.json` by the integrations server on upload — the CLI reads them
+ * only to warn about a missing label, to annotate the manifest log line, and to
+ * stop on an icon the server would refuse.
  *
  * The label lives under a namespaced `revenexx` group in `package.json`
  * (`{ "revenexx": { "displayName": "…" } }`), not a bespoke top-level key, so
@@ -1036,14 +1049,34 @@ interface NodePackageMeta {
     version: string;
     /** Human-readable bundle label (e.g. „Business Central"); optional. */
     displayName?: string;
+    /**
+     * The glyph that marks the package's folder in the studio's palette, as
+     * `lucide:<kebab-name>` (e.g. `lucide:bell`); optional. Declared by a package
+     * holding several services, which has no one vendor logo to mark its folder
+     * with — a package that is one vendor leaves it out. Trimmed, and a value that
+     * is not a string counts as none, as the server reads it; whether it is well
+     * formed is {@link packageIconProblem}'s question.
+     */
+    icon?: string;
 }
+/**
+ * Why a declared `revenexx.icon` would be refused by the registry, or
+ * `undefined` when it is fine (or absent). Lets the build stop where the author
+ * can still fix it, rather than at upload. Takes the icon as
+ * {@link parsePackageMeta} returns it — trimmed as the registry trims it; an
+ * untrimmed raw value can be refused here although the registry accepts it.
+ */
+declare function packageIconProblem(icon: string | undefined): string | undefined;
 /**
  * Extracts {@link NodePackageMeta} from parsed `package.json` contents, keeping
  * only the registry-relevant fields and coercing anything malformed to a safe
- * shape. All three fields are trimmed; a blank or whitespace-only value becomes
- * `''` (`name`/`version`) or `undefined` (`displayName`, matching how the server
- * treats it), so whitespace can't masquerade as a present value in tooling.
- * The bundle label is read from the `revenexx` group (`revenexx.displayName`).
+ * shape. All four fields are trimmed — the icon of ASCII whitespace only, as the
+ * server's PHP `trim()` does, so a pasted no-break space is refused here as it
+ * is there rather than trimmed away; a blank or whitespace-only value becomes
+ * `''` (`name`/`version`) or `undefined` (`displayName`, `icon`, matching how the
+ * server treats them), so whitespace can't masquerade as a present value in
+ * tooling. The bundle label and the folder icon are read from the `revenexx`
+ * group (`revenexx.displayName`, `revenexx.icon`).
  * Does not validate that `name`/`version` are present — the integrations server
  * enforces that on upload; this is a typed, lenient read for tooling.
  */
@@ -1218,4 +1251,4 @@ declare abstract class OAuth2AuthCodeCredential extends BaseCredential implement
     test(_ctx: ICredentialContext, config: Config): Promise<ICredentialTestResult>;
 }
 
-export { ApiKeyCredential, BaseCredential, BasicAuthCredential, type ConfigType, type CredentialAuthKind, type CredentialFieldType, DEFAULT_MAX_RESPONSE_BYTES, DEFAULT_RETRY_ATTEMPTS, DEFAULT_RETRY_DELAY_MS, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, type DataType, type IConfigField, type IConfigFieldBase, type IConfigOption, type IConfigValidation, type ICredential, type ICredentialContext, type ICredentialDescription, type ICredentialField, type ICredentialOAuthAuthorize, type ICredentialResolveResult, type ICredentialTestResult, type IImage, type IInputPort, type INode, type INodeAuthorContext, type INodeContext, type INodeDescription, type INodeResult, type INodeState, type INodeWithIteration, type IOutputField, type IOutputPort, type IShowIfCondition, type ITemplateDescription, type ITemplateTrigger, type ImageCategory, type LocalizedString, type LookupAddress, type LookupFn, MANIFEST_VERSION, MAX_REDIRECTS, MAX_RESPONSE_BYTES, MAX_RETRY_ATTEMPTS, MAX_TIMEOUT_MS, type NodeCategory, NodeError, type NodeErrorOutput, type NodeManifest, type NodePackageMeta, OAuth2AuthCodeCredential, OAuth2ClientCredentialsCredential, type OAuthTokenResponse, OPERATORS, type Operator, type OutputKind, type RetryHooks, type RetryPolicy, RetryableError, type SafeFetchOptions, type SafeFetchRetry, SimpleValueCredential, type TemplateLevel, type TemplateTriggerType, VALUELESS_OPERATORS, assertPublicUrl, backoffDelay, buildManifest, clampResponseBytes, errorPort, errorResult, evaluate, extractCredentialManifest, extractCredentialManifests, extractManifest, extractManifests, httpErrorResult, isBlockedAddress, isNodeWithIteration, isOAuthAuthorizeCredential, isOperator, maxBytesConfigField, normalizeCredentialType, normalizeLocalized, parsePackageMeta, readArrayBuffer, readJsonOrText, readText, retryConfigFields, safeFetch, settingApplies, sleepWithSignal, takesValue, timeoutConfigField, toErrorOutput, toErrorResult, withRetry };
+export { ApiKeyCredential, BaseCredential, BasicAuthCredential, type ConfigType, type CredentialAuthKind, type CredentialFieldType, DEFAULT_MAX_RESPONSE_BYTES, DEFAULT_RETRY_ATTEMPTS, DEFAULT_RETRY_DELAY_MS, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, type DataType, type IConfigField, type IConfigFieldBase, type IConfigOption, type IConfigValidation, type ICredential, type ICredentialContext, type ICredentialDescription, type ICredentialField, type ICredentialOAuthAuthorize, type ICredentialResolveResult, type ICredentialTestResult, type IImage, type IInputPort, type INode, type INodeAuthorContext, type INodeContext, type INodeDescription, type INodeResult, type INodeState, type INodeWithIteration, type IOutputField, type IOutputPort, type IShowIfCondition, type ITemplateDescription, type ITemplateTrigger, type ImageCategory, type LocalizedString, type LookupAddress, type LookupFn, MANIFEST_VERSION, MAX_REDIRECTS, MAX_RESPONSE_BYTES, MAX_RETRY_ATTEMPTS, MAX_TIMEOUT_MS, type NodeCategory, NodeError, type NodeErrorOutput, type NodeManifest, type NodePackageMeta, OAuth2AuthCodeCredential, OAuth2ClientCredentialsCredential, type OAuthTokenResponse, OPERATORS, type Operator, type OutputKind, type RetryHooks, type RetryPolicy, RetryableError, type SafeFetchOptions, type SafeFetchRetry, SimpleValueCredential, type TemplateLevel, type TemplateTriggerType, VALUELESS_OPERATORS, assertPublicUrl, backoffDelay, buildManifest, clampResponseBytes, errorPort, errorResult, evaluate, extractCredentialManifest, extractCredentialManifests, extractManifest, extractManifests, headerCrossesOrigin, httpErrorResult, isBlockedAddress, isNodeWithIteration, isOAuthAuthorizeCredential, isOperator, maxBytesConfigField, normalizeCredentialType, normalizeLocalized, packageIconProblem, parsePackageMeta, readArrayBuffer, readJsonOrText, readText, retryConfigFields, safeFetch, settingApplies, sleepWithSignal, takesValue, timeoutConfigField, toErrorOutput, toErrorResult, withRetry };

package/dist/index.d.ts

@@ -771,6 +771,18 @@ declare const DEFAULT_TIMEOUT_MS = 30000;
 declare const MAX_TIMEOUT_MS = 120000;
 /** Maximum number of redirect hops `safeFetch` follows before giving up. */
 declare const MAX_REDIRECTS = 5;
+/**
+ * Whether a request header with this name goes on to the next hop when
+ * {@link safeFetch} follows a redirect to another origin — `true` for `Accept`,
+ * `Accept-Encoding`, `Accept-Language`, `Content-Encoding`, `Content-Language`,
+ * `Content-Type`, `Idempotency-Key`, `If-Match`, `If-Modified-Since`,
+ * `If-None-Match`, `If-Range`, `If-Unmodified-Since`, `Range`, `SOAPAction` and
+ * `User-Agent`, in any case, and `false` for every other name. The keep-list is by
+ * name, so it can only keep a secret out of the headers it drops: a credential
+ * whose header name the author chooses must refuse a name this answers `true`
+ * for, or its key would cross with the harmless headers.
+ */
+declare function headerCrossesOrigin(name: string): boolean;
 declare const DEFAULT_RETRY_ATTEMPTS = 0;
 declare const MAX_RETRY_ATTEMPTS = 5;
 declare const DEFAULT_RETRY_DELAY_MS = 1000;
@@ -1023,9 +1035,10 @@ interface NodeManifest {
  * The registry-relevant fields of a node package's `package.json`, as read by
  * the CLI. `name`/`version` identify the package; `displayName` is the
  * human-readable bundle label shown in the editor's node palette (e.g.
- * „Business Central"). All three are read straight from `package.json` by the
- * integrations server on upload — the CLI reads them only to warn about a
- * missing label and to annotate the manifest log line.
+ * „Business Central"); `icon` marks its folder there. All four are read straight
+ * from `package.json` by the integrations server on upload — the CLI reads them
+ * only to warn about a missing label, to annotate the manifest log line, and to
+ * stop on an icon the server would refuse.
  *
  * The label lives under a namespaced `revenexx` group in `package.json`
  * (`{ "revenexx": { "displayName": "…" } }`), not a bespoke top-level key, so
@@ -1036,14 +1049,34 @@ interface NodePackageMeta {
     version: string;
     /** Human-readable bundle label (e.g. „Business Central"); optional. */
     displayName?: string;
+    /**
+     * The glyph that marks the package's folder in the studio's palette, as
+     * `lucide:<kebab-name>` (e.g. `lucide:bell`); optional. Declared by a package
+     * holding several services, which has no one vendor logo to mark its folder
+     * with — a package that is one vendor leaves it out. Trimmed, and a value that
+     * is not a string counts as none, as the server reads it; whether it is well
+     * formed is {@link packageIconProblem}'s question.
+     */
+    icon?: string;
 }
+/**
+ * Why a declared `revenexx.icon` would be refused by the registry, or
+ * `undefined` when it is fine (or absent). Lets the build stop where the author
+ * can still fix it, rather than at upload. Takes the icon as
+ * {@link parsePackageMeta} returns it — trimmed as the registry trims it; an
+ * untrimmed raw value can be refused here although the registry accepts it.
+ */
+declare function packageIconProblem(icon: string | undefined): string | undefined;
 /**
  * Extracts {@link NodePackageMeta} from parsed `package.json` contents, keeping
  * only the registry-relevant fields and coercing anything malformed to a safe
- * shape. All three fields are trimmed; a blank or whitespace-only value becomes
- * `''` (`name`/`version`) or `undefined` (`displayName`, matching how the server
- * treats it), so whitespace can't masquerade as a present value in tooling.
- * The bundle label is read from the `revenexx` group (`revenexx.displayName`).
+ * shape. All four fields are trimmed — the icon of ASCII whitespace only, as the
+ * server's PHP `trim()` does, so a pasted no-break space is refused here as it
+ * is there rather than trimmed away; a blank or whitespace-only value becomes
+ * `''` (`name`/`version`) or `undefined` (`displayName`, `icon`, matching how the
+ * server treats them), so whitespace can't masquerade as a present value in
+ * tooling. The bundle label and the folder icon are read from the `revenexx`
+ * group (`revenexx.displayName`, `revenexx.icon`).
  * Does not validate that `name`/`version` are present — the integrations server
  * enforces that on upload; this is a typed, lenient read for tooling.
  */
@@ -1218,4 +1251,4 @@ declare abstract class OAuth2AuthCodeCredential extends BaseCredential implement
     test(_ctx: ICredentialContext, config: Config): Promise<ICredentialTestResult>;
 }
 
-export { ApiKeyCredential, BaseCredential, BasicAuthCredential, type ConfigType, type CredentialAuthKind, type CredentialFieldType, DEFAULT_MAX_RESPONSE_BYTES, DEFAULT_RETRY_ATTEMPTS, DEFAULT_RETRY_DELAY_MS, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, type DataType, type IConfigField, type IConfigFieldBase, type IConfigOption, type IConfigValidation, type ICredential, type ICredentialContext, type ICredentialDescription, type ICredentialField, type ICredentialOAuthAuthorize, type ICredentialResolveResult, type ICredentialTestResult, type IImage, type IInputPort, type INode, type INodeAuthorContext, type INodeContext, type INodeDescription, type INodeResult, type INodeState, type INodeWithIteration, type IOutputField, type IOutputPort, type IShowIfCondition, type ITemplateDescription, type ITemplateTrigger, type ImageCategory, type LocalizedString, type LookupAddress, type LookupFn, MANIFEST_VERSION, MAX_REDIRECTS, MAX_RESPONSE_BYTES, MAX_RETRY_ATTEMPTS, MAX_TIMEOUT_MS, type NodeCategory, NodeError, type NodeErrorOutput, type NodeManifest, type NodePackageMeta, OAuth2AuthCodeCredential, OAuth2ClientCredentialsCredential, type OAuthTokenResponse, OPERATORS, type Operator, type OutputKind, type RetryHooks, type RetryPolicy, RetryableError, type SafeFetchOptions, type SafeFetchRetry, SimpleValueCredential, type TemplateLevel, type TemplateTriggerType, VALUELESS_OPERATORS, assertPublicUrl, backoffDelay, buildManifest, clampResponseBytes, errorPort, errorResult, evaluate, extractCredentialManifest, extractCredentialManifests, extractManifest, extractManifests, httpErrorResult, isBlockedAddress, isNodeWithIteration, isOAuthAuthorizeCredential, isOperator, maxBytesConfigField, normalizeCredentialType, normalizeLocalized, parsePackageMeta, readArrayBuffer, readJsonOrText, readText, retryConfigFields, safeFetch, settingApplies, sleepWithSignal, takesValue, timeoutConfigField, toErrorOutput, toErrorResult, withRetry };
+export { ApiKeyCredential, BaseCredential, BasicAuthCredential, type ConfigType, type CredentialAuthKind, type CredentialFieldType, DEFAULT_MAX_RESPONSE_BYTES, DEFAULT_RETRY_ATTEMPTS, DEFAULT_RETRY_DELAY_MS, DEFAULT_RETRY_POLICY, DEFAULT_TIMEOUT_MS, type DataType, type IConfigField, type IConfigFieldBase, type IConfigOption, type IConfigValidation, type ICredential, type ICredentialContext, type ICredentialDescription, type ICredentialField, type ICredentialOAuthAuthorize, type ICredentialResolveResult, type ICredentialTestResult, type IImage, type IInputPort, type INode, type INodeAuthorContext, type INodeContext, type INodeDescription, type INodeResult, type INodeState, type INodeWithIteration, type IOutputField, type IOutputPort, type IShowIfCondition, type ITemplateDescription, type ITemplateTrigger, type ImageCategory, type LocalizedString, type LookupAddress, type LookupFn, MANIFEST_VERSION, MAX_REDIRECTS, MAX_RESPONSE_BYTES, MAX_RETRY_ATTEMPTS, MAX_TIMEOUT_MS, type NodeCategory, NodeError, type NodeErrorOutput, type NodeManifest, type NodePackageMeta, OAuth2AuthCodeCredential, OAuth2ClientCredentialsCredential, type OAuthTokenResponse, OPERATORS, type Operator, type OutputKind, type RetryHooks, type RetryPolicy, RetryableError, type SafeFetchOptions, type SafeFetchRetry, SimpleValueCredential, type TemplateLevel, type TemplateTriggerType, VALUELESS_OPERATORS, assertPublicUrl, backoffDelay, buildManifest, clampResponseBytes, errorPort, errorResult, evaluate, extractCredentialManifest, extractCredentialManifests, extractManifest, extractManifests, headerCrossesOrigin, httpErrorResult, isBlockedAddress, isNodeWithIteration, isOAuthAuthorizeCredential, isOperator, maxBytesConfigField, normalizeCredentialType, normalizeLocalized, packageIconProblem, parsePackageMeta, readArrayBuffer, readJsonOrText, readText, retryConfigFields, safeFetch, settingApplies, sleepWithSignal, takesValue, timeoutConfigField, toErrorOutput, toErrorResult, withRetry };

package/dist/index.js

@@ -5,8 +5,9 @@ import {
   extractCredentialManifests,
   extractManifest,
   extractManifests,
+  packageIconProblem,
   parsePackageMeta
-} from "./chunk-WB3BYMLA.js";
+} from "./chunk-5BCAXRU3.js";
 
 // src/types.ts
 function isNodeWithIteration(node) {
@@ -383,6 +384,26 @@ var DEFAULT_TIMEOUT_MS = 3e4;
 var MAX_TIMEOUT_MS = 12e4;
 var MAX_REDIRECTS = 5;
 var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var CROSS_ORIGIN_SAFE_HEADERS = /* @__PURE__ */ new Set([
+  "accept",
+  "accept-encoding",
+  "accept-language",
+  "content-encoding",
+  "content-language",
+  "content-type",
+  "idempotency-key",
+  "if-match",
+  "if-modified-since",
+  "if-none-match",
+  "if-range",
+  "if-unmodified-since",
+  "range",
+  "soapaction",
+  "user-agent"
+]);
+function headerCrossesOrigin(name) {
+  return CROSS_ORIGIN_SAFE_HEADERS.has(name.trim().toLowerCase());
+}
 var DEFAULT_RETRY_ATTEMPTS = 0;
 var MAX_RETRY_ATTEMPTS = 5;
 var DEFAULT_RETRY_DELAY_MS = 1e3;
@@ -465,9 +486,9 @@ async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
       headers.delete("content-length");
     }
     if (nextUrl.origin !== base.origin) {
-      headers.delete("authorization");
-      headers.delete("cookie");
-      headers.delete("proxy-authorization");
+      for (const name of [...headers.keys()]) {
+        if (!headerCrossesOrigin(name)) headers.delete(name);
+      }
     }
     currentUrl = nextUrl;
     currentInit = { ...currentInit, method, body, headers, redirect: "manual" };
@@ -987,6 +1008,7 @@ export {
   extractCredentialManifests,
   extractManifest,
   extractManifests,
+  headerCrossesOrigin,
   httpErrorResult,
   isBlockedAddress,
   isNodeWithIteration,
@@ -995,6 +1017,7 @@ export {
   maxBytesConfigField,
   normalizeCredentialType,
   normalizeLocalized,
+  packageIconProblem,
   parsePackageMeta,
   readArrayBuffer,
   readJsonOrText,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revenexx/integrations-node-sdk",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "description": "TypeScript interfaces and utilities for Revenexx integration nodes",
   "license": "MIT",
   "author": "revenexx GmbH",