@unifiedcommerce/core 0.0.1

package/dist/modules/webhooks/schema.d.ts

@@ -0,0 +1,404 @@
+export declare const webhookEndpoints: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "webhook_endpoints";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "webhook_endpoints";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        organizationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "organization_id";
+            tableName: "webhook_endpoints";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        url: import("drizzle-orm/pg-core").PgColumn<{
+            name: "url";
+            tableName: "webhook_endpoints";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        secret: import("drizzle-orm/pg-core").PgColumn<{
+            name: "secret";
+            tableName: "webhook_endpoints";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        events: import("drizzle-orm/pg-core").PgColumn<{
+            name: "events";
+            tableName: "webhook_endpoints";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: string[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: string[];
+        }>;
+        isActive: import("drizzle-orm/pg-core").PgColumn<{
+            name: "is_active";
+            tableName: "webhook_endpoints";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        metadata: import("drizzle-orm/pg-core").PgColumn<{
+            name: "metadata";
+            tableName: "webhook_endpoints";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+    };
+    dialect: "pg";
+}>;
+/**
+ * Tracks processed incoming webhook events for idempotency.
+ * Prevents double-processing when Stripe (or other providers) retry delivery.
+ */
+export declare const processedWebhookEvents: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "processed_webhook_events";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "processed_webhook_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        eventId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "event_id";
+            tableName: "processed_webhook_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        provider: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider";
+            tableName: "processed_webhook_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        eventType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "event_type";
+            tableName: "processed_webhook_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        processedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "processed_at";
+            tableName: "processed_webhook_events";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export declare const webhookDeliveries: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "webhook_deliveries";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "webhook_deliveries";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        endpointId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "endpoint_id";
+            tableName: "webhook_deliveries";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        eventName: import("drizzle-orm/pg-core").PgColumn<{
+            name: "event_name";
+            tableName: "webhook_deliveries";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        payload: import("drizzle-orm/pg-core").PgColumn<{
+            name: "payload";
+            tableName: "webhook_deliveries";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: unknown;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        statusCode: import("drizzle-orm/pg-core").PgColumn<{
+            name: "status_code";
+            tableName: "webhook_deliveries";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        attemptCount: import("drizzle-orm/pg-core").PgColumn<{
+            name: "attempt_count";
+            tableName: "webhook_deliveries";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        nextRetryAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "next_retry_at";
+            tableName: "webhook_deliveries";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        deliveredAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "delivered_at";
+            tableName: "webhook_deliveries";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        failedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "failed_at";
+            tableName: "webhook_deliveries";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "webhook_deliveries";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/modules/webhooks/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/modules/webhooks/schema.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgB5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMjC,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAa5B,CAAC"}

package/dist/modules/webhooks/schema.js

@@ -0,0 +1,40 @@
+import { boolean, index, integer, jsonb, pgTable, text, timestamp, uuid, } from "drizzle-orm/pg-core";
+import { organization } from "../../auth/auth-schema";
+export const webhookEndpoints = pgTable("webhook_endpoints", {
+    id: uuid("id").defaultRandom().primaryKey(),
+    organizationId: text("organization_id")
+        .notNull()
+        .references(() => organization.id, { onDelete: "cascade" }),
+    url: text("url").notNull(),
+    secret: text("secret").notNull(),
+    events: jsonb("events").$type().notNull(),
+    isActive: boolean("is_active").notNull().default(true),
+    metadata: jsonb("metadata").$type().default({}),
+}, (table) => ({
+    orgIdx: index("idx_webhook_endpoints_org").on(table.organizationId),
+}));
+/**
+ * Tracks processed incoming webhook events for idempotency.
+ * Prevents double-processing when Stripe (or other providers) retry delivery.
+ */
+export const processedWebhookEvents = pgTable("processed_webhook_events", {
+    id: uuid("id").defaultRandom().primaryKey(),
+    eventId: text("event_id").notNull().unique(),
+    provider: text("provider").notNull(), // "stripe", "paypal", etc.
+    eventType: text("event_type").notNull(),
+    processedAt: timestamp("processed_at", { withTimezone: true }).defaultNow().notNull(),
+});
+export const webhookDeliveries = pgTable("webhook_deliveries", {
+    id: uuid("id").defaultRandom().primaryKey(),
+    endpointId: uuid("endpoint_id")
+        .references(() => webhookEndpoints.id)
+        .notNull(),
+    eventName: text("event_name").notNull(),
+    payload: jsonb("payload").notNull(),
+    statusCode: integer("status_code"),
+    attemptCount: integer("attempt_count").notNull().default(0),
+    nextRetryAt: timestamp("next_retry_at", { withTimezone: true }),
+    deliveredAt: timestamp("delivered_at", { withTimezone: true }),
+    failedAt: timestamp("failed_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).defaultNow().notNull(),
+});

package/dist/modules/webhooks/service.d.ts

@@ -0,0 +1,23 @@
+import type { Actor } from "../../auth/types";
+import { type Result } from "../../kernel/result";
+import type { TxContext } from "../../kernel/database/tx-context";
+import type { WebhooksRepository, WebhookEndpoint } from "./repository";
+interface WebhookServiceDeps {
+    repository: WebhooksRepository;
+}
+export declare class WebhookService {
+    private deps;
+    private readonly repo;
+    constructor(deps: WebhookServiceDeps);
+    createEndpoint(input: {
+        url: string;
+        secret: string;
+        events: string[];
+        metadata?: Record<string, unknown>;
+    }, actor?: Actor | null, ctx?: TxContext): Promise<Result<WebhookEndpoint>>;
+    listEndpoints(ctx?: TxContext): Promise<Result<WebhookEndpoint[]>>;
+    deleteEndpoint(id: string, ctx?: TxContext): Promise<Result<void>>;
+    getEndpointsForEvent(eventName: string, ctx?: TxContext): Promise<Result<WebhookEndpoint[]>>;
+}
+export {};
+//# sourceMappingURL=service.d.ts.map

package/dist/modules/webhooks/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/webhooks/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AA4CxE,UAAU,kBAAkB;IAC1B,UAAU,EAAE,kBAAkB,CAAC;CAChC;AAED,qBAAa,cAAc;IAGb,OAAO,CAAC,IAAI;IAFxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;gBAEtB,IAAI,EAAE,kBAAkB;IAItC,cAAc,CAClB,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAyB7B,aAAa,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IAKlE,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAUlE,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;CAItC"}

package/dist/modules/webhooks/service.js

@@ -0,0 +1,92 @@
+import { resolveOrgId } from "../../auth/org";
+import { CommerceNotFoundError, CommerceValidationError } from "../../kernel/errors";
+import { Err, Ok } from "../../kernel/result";
+/**
+ * Checks whether a URL points to a private/internal IP address.
+ * Blocks: loopback (127.x), link-local (169.254.x), private (10.x, 172.16-31.x, 192.168.x),
+ * cloud metadata (169.254.169.254, metadata.google.internal), and localhost.
+ */
+function isPrivateUrl(urlStr) {
+    try {
+        const parsed = new URL(urlStr);
+        // Strip IPv6 brackets: URL.hostname returns "[::1]" not "::1"
+        const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+        // Loopback (IPv4 + IPv6)
+        if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1")
+            return true;
+        if (hostname.endsWith(".localhost"))
+            return true;
+        // IPv6 loopback and link-local patterns
+        if (hostname.startsWith("::ffff:"))
+            return true; // IPv6-mapped IPv4 (e.g., ::ffff:127.0.0.1)
+        if (hostname.startsWith("fe80:"))
+            return true; // IPv6 link-local
+        if (hostname === "::")
+            return true; // Unspecified address
+        // Cloud metadata endpoints
+        if (hostname === "169.254.169.254")
+            return true;
+        if (hostname === "metadata.google.internal")
+            return true;
+        // Private IP ranges (RFC 1918 + link-local)
+        const parts = hostname.split(".").map(Number);
+        if (parts.length === 4 && parts.every((n) => !isNaN(n))) {
+            const [a, b] = parts;
+            if (a === 10)
+                return true;
+            if (a === 172 && b !== undefined && b >= 16 && b <= 31)
+                return true;
+            if (a === 192 && b === 168)
+                return true;
+            if (a === 169 && b === 254)
+                return true;
+            if (a === 127)
+                return true; // Full 127.0.0.0/8 range
+            if (a === 0)
+                return true;
+        }
+        return false;
+    }
+    catch {
+        return true; // Invalid URLs are blocked
+    }
+}
+export class WebhookService {
+    deps;
+    repo;
+    constructor(deps) {
+        this.deps = deps;
+        this.repo = deps.repository;
+    }
+    async createEndpoint(input, actor, ctx) {
+        if (isPrivateUrl(input.url)) {
+            return Err(new CommerceValidationError("Webhook URL must not point to a private or internal address."));
+        }
+        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const endpoint = await this.repo.createEndpoint({
+            organizationId: orgId,
+            url: input.url,
+            secret: input.secret,
+            events: input.events,
+            isActive: true,
+            metadata: input.metadata ?? {},
+        }, ctx);
+        return Ok(endpoint);
+    }
+    async listEndpoints(ctx) {
+        const endpoints = await this.repo.findAllEndpoints(ctx);
+        return Ok(endpoints);
+    }
+    async deleteEndpoint(id, ctx) {
+        const existing = await this.repo.findEndpointById(id, ctx);
+        if (!existing) {
+            return Err(new CommerceNotFoundError("Webhook endpoint not found."));
+        }
+        await this.repo.deleteEndpoint(id, ctx);
+        return Ok(undefined);
+    }
+    async getEndpointsForEvent(eventName, ctx) {
+        const endpoints = await this.repo.findEndpointsForEvent(eventName, ctx);
+        return Ok(endpoints);
+    }
+}

package/dist/modules/webhooks/signing.d.ts

@@ -0,0 +1,2 @@
+export declare function signWebhookPayload(secret: string, payload: unknown): string;
+//# sourceMappingURL=signing.d.ts.map

package/dist/modules/webhooks/signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../../src/modules/webhooks/signing.ts"],"names":[],"mappings":"AAEA,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAG3E"}

package/dist/modules/webhooks/signing.js

@@ -0,0 +1,5 @@
+import { createHmac } from "node:crypto";
+export function signWebhookPayload(secret, payload) {
+    const body = typeof payload === "string" ? payload : JSON.stringify(payload);
+    return createHmac("sha256", secret).update(body).digest("hex");
+}

package/dist/modules/webhooks/ssrf-guard.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Shared SSRF prevention utilities.
+ *
+ * Used by both webhook delivery (DNS rebinding check) and connector URL
+ * validation (store URL check) to reject private/internal IP addresses.
+ */
+/**
+ * Returns true if the given IP address falls within a private, loopback,
+ * link-local, or otherwise non-routable range.
+ */
+export declare function isPrivateIp(ip: string): boolean;
+/**
+ * Checks whether a URL string points to a private/internal IP address or
+ * hostname. This performs a string-level check only (no DNS resolution).
+ *
+ * For DNS rebinding protection, use `isPrivateIp` after resolving the hostname.
+ */
+export declare function isPrivateUrl(urlStr: string): boolean;
+//# sourceMappingURL=ssrf-guard.d.ts.map

package/dist/modules/webhooks/ssrf-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-guard.d.ts","sourceRoot":"","sources":["../../../src/modules/webhooks/ssrf-guard.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAY/C;AAmBD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAsBpD"}

package/dist/modules/webhooks/ssrf-guard.js

@@ -0,0 +1,79 @@
+/**
+ * Shared SSRF prevention utilities.
+ *
+ * Used by both webhook delivery (DNS rebinding check) and connector URL
+ * validation (store URL check) to reject private/internal IP addresses.
+ */
+/**
+ * Returns true if the given IP address falls within a private, loopback,
+ * link-local, or otherwise non-routable range.
+ */
+export function isPrivateIp(ip) {
+    // IPv6 loopback / link-local / mapped
+    if (ip === "::1" || ip === "::")
+        return true;
+    if (ip.startsWith("fe80:"))
+        return true;
+    // IPv6-mapped IPv4 (e.g. ::ffff:127.0.0.1) — extract the IPv4 portion
+    const mappedMatch = ip.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
+    if (mappedMatch) {
+        return isPrivateIpv4(mappedMatch[1]);
+    }
+    return isPrivateIpv4(ip);
+}
+function isPrivateIpv4(ip) {
+    const parts = ip.split(".").map(Number);
+    if (parts.length !== 4 || parts.some((n) => isNaN(n)))
+        return false;
+    const [a, b] = parts;
+    if (a === undefined || b === undefined)
+        return false;
+    if (a === 127)
+        return true; // loopback 127.0.0.0/8
+    if (a === 10)
+        return true; // RFC 1918 class A
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // RFC 1918 class B
+    if (a === 192 && b === 168)
+        return true; // RFC 1918 class C
+    if (a === 169 && b === 254)
+        return true; // link-local / AWS IMDS
+    if (a === 0)
+        return true; // unspecified
+    return false;
+}
+/**
+ * Checks whether a URL string points to a private/internal IP address or
+ * hostname. This performs a string-level check only (no DNS resolution).
+ *
+ * For DNS rebinding protection, use `isPrivateIp` after resolving the hostname.
+ */
+export function isPrivateUrl(urlStr) {
+    try {
+        const parsed = new URL(urlStr);
+        const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+        // Direct hostname matches
+        if (hostname === "localhost" || hostname.endsWith(".localhost"))
+            return true;
+        if (hostname === "::1" || hostname === "::")
+            return true;
+        if (hostname.startsWith("::ffff:"))
+            return true;
+        if (hostname.startsWith("fe80:"))
+            return true;
+        if (hostname.endsWith(".local"))
+            return true;
+        if (hostname.endsWith(".internal"))
+            return true;
+        // Cloud metadata endpoints
+        if (hostname === "169.254.169.254")
+            return true;
+        if (hostname === "metadata.google.internal")
+            return true;
+        // Check if hostname is a raw IP in private ranges
+        return isPrivateIpv4(hostname);
+    }
+    catch {
+        return true; // Invalid URLs are blocked
+    }
+}