n8n-nodes-ai-trader 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 nova969
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,75 @@
+# AI-Trader Public Fetch
+
+Configurable bounded public HTTPS fetch for self-hosted n8n.
+Early release for self-hosted n8n. Transport and node loading are tested locally;
+acceptance on the intended live server is still pending.
+
+## Sources and security
+
+Built-in choices: Binance time, metadata for BTCEUR/ETHEUR/SOLEUR/XRPEUR/ADAEUR,
+hourly candles for those symbols, Bitcoin Core, Bitcoin Optech and Fed monetary.
+Additional Allowed HTTPS Target accepts a URL only when it is also listed in
+Options → Additional Allowed HTTPS URLs. List one exact complete URL per line.
+Matching normalizes the URL but includes its path and query; no wildcards.
+
+HTTPS port443, no URL credentials or fragments, and public-only DNS answers are
+mandatory. One validated IP is pinned; TLS certificates, hostname validation and
+SNI remain enabled. Environment proxies are not used. TLS/DNS protections cannot
+be disabled. This node does not trade, store data, manage provider state or retry.
+
+## Options
+
+| Setting | Default | Behavior |
+| --- | --- | --- |
+| Maximum Response Size (MiB) | 2 | Positive whole MiB, for example10; streaming byte limit. |
+| Total Timeout (Seconds) | 20 | Positive finite milliseconds-precise budget for DNS, TLS, headers, body and all redirects. |
+| Additional Allowed HTTPS URLs | Empty | One exact additional target per line. |
+| Follow Redirects | Off | Every hop must be explicitly allowed and pass fresh DNS/TLS checks. |
+| Maximum Redirects | 3 when enabled | Integer1–20; deadline never resets. |
+| HTTP Status Handling | Return All Statuses | Preserve final status and selected headers for downstream policy. |
+| Accepted HTTP Status Codes | 200 | Require Selected Statuses accepts comma-separated codes such as200,201,304; other final statuses throw. |
+
+Size/deadline cannot be disabled: zero, infinity and invalid values fail before
+network access. Budgets must fit Node's safe buffer/timer ranges. Existing node
+configurations without options retain2MiB/20seconds/no redirects.
+Changing options does not change the AI-Trader collector policy automatically.
+
+## Output
+
+sourceId, statusCode, selected headers, receivedAt (UTC), bodyBase64, bodyBytes,
+sha256, redirectCount and policy with effective limits/settings.
+Policy diagnostics omit URLs and input items.
+
+Return All Statuses preserves the original behavior: read200 bodies; other
+statuses return an empty body and close the connection. Require Selected Statuses
+reads accepted2xx bodies and returns accepted other statuses with empty bodies;
+unaccepted final statuses throw. Enabled redirect handling precedes final-status
+selection. Missing/disallowed locations or excessive hops fail.
+
+Only complete identity-encoded bodies are accepted. Declared Content-Length and
+streaming overflow are checked. SHA256 hashes exact returned bytes, including
+an empty body for a discarded provider error; decimal strings are not parsed.
+Exactly one input item is accepted. Use Return All Statuses when downstream
+workflows need Retry-After, durable429/418 cooldowns and403/451 manual blocks.
+
+## Installation and release
+
+Intended route: Settings → Community nodes → Install an approved npm name/version.
+[Official guide](https://docs.n8n.io/integrations/community-nodes/installation-and-management/gui-installation.md).
+
+Licensed under MIT; see LICENSE. This license covers this node package only.
+Package: n8n-nodes-ai-trader, published by nova969. npm publication
+does not imply n8n verification or live compatibility. Manual custom-directory
+copying is not the intended route. Future rollback: restore consumer workflows
+while inactive, then uninstall via Community nodes; preserve data and unrelated
+workflows. Activation is separate.
+
+## Development
+
+Node>=22, no runtime dependencies; CommonJS source is under dist/.
+npm test uses local fixtures only. TLS tests need OpenSSL and temporary local
+certificates. Run npm pack --ignore-scripts and inspect the actual archive.
+
+Expected files: package.json, README.md, LICENSE, dist/fetch.cjs and
+dist/nodes/AiPublicFetch/AiPublicFetch.node.js. Exclude tests, handoff/audit notes,
+exports, logs, .env and .npmrc. Re-audit every changed release.

package/dist/fetch.cjs

@@ -0,0 +1,203 @@
+'use strict';
+const https = require('node:https');
+const dns = require('node:dns').promises;
+const { isIP } = require('node:net');
+const { createHash } = require('node:crypto');
+const { constants: bufferConstants } = require('node:buffer');
+const MAX_BYTES = 2 * 1024 * 1024;
+const DEADLINE_MS = 20_000;
+const SYMBOLS = Object.freeze(['BTCEUR', 'ETHEUR', 'SOLEUR', 'XRPEUR', 'ADAEUR']);
+const FEEDS = Object.freeze({
+  'bitcoin-core': 'https://bitcoincore.org/en/feed.xml',
+  'bitcoin-optech': 'https://bitcoinops.org/feed.xml',
+  'fed-monetary': 'https://www.federalreserve.gov/feeds/press_monetary.xml',
+});
+
+function httpsTarget(value) {
+  let url;
+  try { url = new URL(value); } catch { throw new Error('Invalid HTTPS target'); }
+  if (url.protocol !== 'https:' || (url.port && url.port !== '443')) throw new Error('HTTPS port 443 is required');
+  if (url.username || url.password) throw new Error('URL credentials are not allowed');
+  if (url.hash) throw new Error('URL fragments are not allowed');
+  return url;
+}
+function transportPolicy(options = {}) {
+  const keys = ['maxBytes', 'deadlineMs', 'followRedirects', 'maxRedirects', 'allowedUrls', 'statusMode', 'acceptedStatusCodes'];
+  if (!options || typeof options !== 'object' || Array.isArray(options)) throw new Error('Invalid transport options');
+  if (Object.keys(options).some(key => !keys.includes(key))) throw new Error('Unsupported transport option');
+  const policy = { maxBytes: MAX_BYTES, deadlineMs: DEADLINE_MS, followRedirects: false,
+    maxRedirects: 3, allowedUrls: [], statusMode: 'allStatuses', acceptedStatusCodes: [200], ...options };
+  if (!Number.isSafeInteger(policy.maxBytes) || policy.maxBytes < 1 || policy.maxBytes > bufferConstants.MAX_LENGTH) throw new Error('Invalid byte limit');
+  if (!Number.isSafeInteger(policy.deadlineMs) || policy.deadlineMs < 1 || policy.deadlineMs > 2147483647) throw new Error('Invalid deadline');
+  if (typeof policy.followRedirects !== 'boolean') throw new Error('Invalid redirect setting');
+  if (!Number.isSafeInteger(policy.maxRedirects) || policy.maxRedirects < (policy.followRedirects ? 1 : 0) || policy.maxRedirects > 20) throw new Error('Invalid redirect limit');
+  if (!Array.isArray(policy.allowedUrls) || policy.allowedUrls.some(url => typeof url !== 'string')) throw new Error('Invalid target allowlist');
+  policy.allowedUrls = [...new Set(policy.allowedUrls.map(url => httpsTarget(url).href))];
+  if (!['allStatuses', 'selectedStatuses'].includes(policy.statusMode)) throw new Error('Invalid status mode');
+  if (!Array.isArray(policy.acceptedStatusCodes) || !policy.acceptedStatusCodes.length ||
+      policy.acceptedStatusCodes.some(code => !Number.isInteger(code) || code < 100 || code > 599)) throw new Error('Invalid accepted status codes');
+  policy.acceptedStatusCodes = [...new Set(policy.acceptedStatusCodes)];
+  return policy;
+}
+function targetFor(source, params = {}, allowedUrls = []) {
+  if (source === 'custom') {
+    if (Object.keys(params).some(key => key !== 'url')) throw new Error('Unapproved parameter');
+    const url = httpsTarget(params.url);
+    if (!allowedUrls.includes(url.href)) throw new Error('Target is not in the explicit allowlist');
+    return url;
+  }
+  if (Object.keys(params).some(key => !['symbol', 'limit', 'startTime', 'endTime'].includes(key))) throw new Error('Unapproved parameter');
+  if (Object.hasOwn(FEEDS, source)) {
+    if (Object.keys(params).length) throw new Error('Feed parameters are not allowed');
+    return new URL(FEEDS[source]);
+  }
+  const paths = { 'binance-time': 'time', 'binance-exchange-info': 'exchangeInfo', 'binance-klines': 'klines' };
+  if (!Object.hasOwn(paths, source)) throw new Error('Unapproved source');
+  const url = new URL(`https://data-api.binance.vision/api/v3/${paths[source]}`);
+  if (source !== 'binance-klines' && Object.keys(params).length) throw new Error('Endpoint parameters are not allowed');
+  if (source === 'binance-exchange-info') url.searchParams.set('symbols', JSON.stringify(SYMBOLS));
+  if (source === 'binance-klines') {
+    if (!SYMBOLS.includes(params.symbol)) throw new Error('Unapproved symbol');
+    const limit = params.limit ?? 2;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000) throw new Error('Invalid limit');
+    url.searchParams.set('symbol', params.symbol);
+    url.searchParams.set('interval', '1h');
+    url.searchParams.set('limit', String(limit));
+    for (const key of ['startTime', 'endTime']) if (params[key] !== undefined) {
+      if (!Number.isSafeInteger(params[key]) || params[key] < 0) throw new Error(`Invalid ${key}`);
+      url.searchParams.set(key, String(params[key]));
+    }
+    if (params.startTime !== undefined && params.endTime !== undefined && params.startTime > params.endTime) throw new Error('Invalid time window');
+  }
+  return url;
+}
+
+function inV4Range(value, base, bits) {
+  return (value >>> (32 - bits)) === (base >>> (32 - bits));
+}
+function isPublicAddress(address) {
+  if (typeof address !== 'string' || address.includes('%')) return false;
+  const family = isIP(address);
+  if (family === 4) {
+    const value = address.split('.').reduce((sum, part) => (sum * 256 + Number(part)) >>> 0, 0);
+    return ![
+      [0x00000000, 8], [0x0a000000, 8], [0x64400000, 10], [0x7f000000, 8],
+      [0xa9fe0000, 16], [0xac100000, 12], [0xc0000000, 24], [0xc0000200, 24],
+      [0xc0586300, 24], [0xc0a80000, 16], [0xc6120000, 15], [0xc6336400, 24],
+      [0xcb007100, 24], [0xe0000000, 4], [0xf0000000, 4],
+    ].some(([base, bits]) => inV4Range(value, base, bits));
+  }
+  if (family !== 6 || address.includes('.')) return false;
+  const halves = address.toLowerCase().split('::');
+  const left = halves[0] ? halves[0].split(':') : [];
+  const right = halves[1] ? halves[1].split(':') : [];
+  const words = halves.length === 2 ? [...left, ...Array(8 - left.length - right.length).fill('0'), ...right] : left;
+  const value = words.reduce((sum, word) => (sum << 16n) | BigInt(`0x${word}`), 0n);
+  // Conservative public-only policy: global unicast, excluding special-use,
+  // documentation and transition ranges. Deliberately stricter than is_global.
+  const within = (base, bits) => (value >> BigInt(128 - bits)) === (base >> BigInt(128 - bits));
+  return within(0x20000000000000000000000000000000n, 3)
+    && !within(0x20010000000000000000000000000000n, 23)
+    && !within(0x20010db8000000000000000000000000n, 32)
+    && !within(0x20020000000000000000000000000000n, 16)
+    && !within(0x3fff0000000000000000000000000000n, 20);
+}
+
+// Dependency injection is limited to the library's I/O boundary. The n8n node
+// always uses native I/O. User policy can change budgets/targets, never TLS/DNS checks.
+async function fetchPublic(source, params = {}, dependencies = {}, options = {}) {
+  const policy = transportPolicy(options);
+  const initialUrl = targetFor(source, params, policy.allowedUrls);
+  const allowed = new Set([initialUrl.href, ...policy.allowedUrls]);
+  const resolve = dependencies.resolve ?? (host => dns.lookup(host, { all: true, verbatim: true }));
+  const request = dependencies.request ?? https.request;
+  const deadlineMs = dependencies.deadlineMs ?? policy.deadlineMs;
+  if (!Number.isFinite(deadlineMs) || deadlineMs <= 0 || deadlineMs > policy.deadlineMs) throw new Error('Invalid deadline');
+  return new Promise((resolveResult, rejectResult) => {
+    let req, res, done = false, attempt = 0, redirectCount = 0;
+    const finish = (error, result) => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      if (error || result?.statusCode !== 200) { res?.destroy(); req?.destroy(); }
+      if (error) rejectResult(error); else resolveResult(result);
+    };
+    const timer = setTimeout(() => finish(new Error('Total fetch deadline exceeded')), deadlineMs);
+    const open = url => {
+      const currentAttempt = ++attempt;
+      const current = () => !done && attempt === currentAttempt;
+      Promise.resolve().then(() => current() ? resolve(url.hostname) : []).then(addresses => {
+      if (!current()) return;
+      if (!Array.isArray(addresses) || !addresses.length || addresses.some(item => !isPublicAddress(item.address))) throw new Error('Unsafe or missing DNS address');
+      const address = addresses[0].address;
+      const family = isIP(address);
+      req = request({
+        hostname: url.hostname, port: 443, path: url.pathname + url.search,
+        method: 'GET', servername: url.hostname, rejectUnauthorized: true, agent: false,
+        lookup: (_host, options, callback) => options?.all
+          ? callback(null, [{ address, family }]) : callback(null, address, family),
+        headers: { 'User-Agent': 'CryptoLab/0.1 (public-feed research)',
+          Accept: source.startsWith('binance-') ? 'application/json' : 'application/rss+xml, application/atom+xml, application/xml, text/xml',
+          'Accept-Encoding': 'identity' },
+      }, response => {
+        if (!current()) { response.destroy(); return; }
+        res = response;
+        res.on('error', error => { if (current()) finish(error); });
+        res.on('aborted', () => { if (current()) finish(new Error('Incomplete response')); });
+        const headers = {};
+        for (const name of ['date', 'etag', 'last-modified', 'retry-after', 'x-mbx-used-weight-1m', 'content-type']) {
+          const value = res.headers[name];
+          if (typeof value === 'string') headers[name] = value;
+        }
+        const result = body => ({ sourceId: source, statusCode: res.statusCode, headers,
+          receivedAt: new Date().toISOString(), bodyBase64: body.toString('base64'),
+          bodyBytes: body.length, sha256: createHash('sha256').update(body).digest('hex'), redirectCount,
+          policy: { maxBytes: policy.maxBytes, deadlineMs, followRedirects: policy.followRedirects,
+            maxRedirects: policy.followRedirects ? policy.maxRedirects : 0,
+            statusMode: policy.statusMode, acceptedStatusCodes: policy.acceptedStatusCodes,
+            allowedTargetCount: allowed.size } });
+        if (policy.followRedirects && [301, 302, 303, 307, 308].includes(res.statusCode)) {
+          try {
+            if (redirectCount >= policy.maxRedirects) throw new Error('Redirect limit exceeded');
+            if (typeof res.headers.location !== 'string') throw new Error('Invalid redirect location');
+            const next = httpsTarget(new URL(res.headers.location, url).href);
+            if (!allowed.has(next.href)) throw new Error('Redirect target is not in the explicit allowlist');
+            redirectCount += 1;
+            // Invalidate old events before destroying the previous response.
+            attempt += 1; res.destroy(); req?.destroy(); open(next);
+          } catch (error) { finish(error); }
+          return;
+        }
+        if (policy.statusMode === 'selectedStatuses' && !policy.acceptedStatusCodes.includes(res.statusCode)) {
+          finish(new Error(`Unaccepted HTTP ${res.statusCode}`)); return;
+        }
+        const readBody = res.statusCode === 200 || (policy.statusMode === 'selectedStatuses' &&
+          res.statusCode >= 200 && res.statusCode < 300);
+        if (!readBody) { finish(null, result(Buffer.alloc(0))); return; }
+        const encoding = res.headers['content-encoding'];
+        if (encoding && encoding.toLowerCase().trim() !== 'identity') { finish(new Error('Unsupported content encoding')); return; }
+        const length = res.headers['content-length'];
+        if (length !== undefined && (!/^\d+$/.test(length) || BigInt(length) > BigInt(policy.maxBytes))) { finish(new Error('Body byte limit exceeded')); return; }
+        let size = 0;
+        const chunks = [];
+        res.on('data', chunk => {
+          if (!current()) return;
+          size += chunk.length;
+          if (size > policy.maxBytes) { finish(new Error('Body byte limit exceeded')); return; }
+          chunks.push(chunk);
+        });
+        res.on('end', () => {
+          if (!current()) return;
+          if (!res.complete || (length !== undefined && BigInt(length) !== BigInt(size))) finish(new Error('Incomplete response'));
+          else finish(null, result(Buffer.concat(chunks, size)));
+        });
+        res.on('close', () => { if (current() && !response.complete) finish(new Error('Incomplete response')); });
+      });
+      req.on('error', error => { if (current()) finish(error); });
+      req.end();
+      }).catch(error => { if (current()) finish(error); });
+    };
+    open(initialUrl);
+  });
+}
+module.exports = { fetchPublic, targetFor, isPublicAddress, transportPolicy, SYMBOLS, MAX_BYTES, DEADLINE_MS };

package/dist/nodes/AiPublicFetch/AiPublicFetch.node.js

@@ -0,0 +1,100 @@
+'use strict';
+const { fetchPublic, SYMBOLS } = require('../../fetch.cjs');
+class AiPublicFetch {
+  constructor() {
+    this.description = {
+      displayName: 'AI-Trader Public Fetch', name: 'aiPublicFetch', group: ['input'],
+      version: 1, description: 'Bounded HTTPS fetch from explicitly approved public sources',
+      defaults: { name: 'AI-Trader Public Fetch' }, inputs: ['main'], outputs: ['main'],
+      properties: [
+        { displayName: 'Source', name: 'source', type: 'options', default: 'binance-time',
+          options: [
+            { name: 'Binance Server Time', value: 'binance-time' },
+            { name: 'Binance Five EUR Symbols Metadata', value: 'binance-exchange-info' },
+            { name: 'Binance Hourly Candles', value: 'binance-klines' },
+            { name: 'Bitcoin Core', value: 'bitcoin-core' },
+            { name: 'Bitcoin Optech', value: 'bitcoin-optech' },
+            { name: 'Federal Reserve Monetary', value: 'fed-monetary' },
+            { name: 'Additional Allowed HTTPS Target', value: 'custom' },
+          ] },
+        { displayName: 'HTTPS URL', name: 'url', type: 'string', default: '',
+          description: 'Must exactly match an entry in Additional Allowed HTTPS URLs',
+          displayOptions: { show: { source: ['custom'] } } },
+        { displayName: 'Symbol', name: 'symbol', type: 'options', default: 'BTCEUR',
+          options: SYMBOLS.map(value => ({ name: value, value })),
+          displayOptions: { show: { source: ['binance-klines'] } } },
+        { displayName: 'Limit', name: 'limit', type: 'number', default: 2,
+          typeOptions: { minValue: 1, maxValue: 1000, numberPrecision: 0 },
+          displayOptions: { show: { source: ['binance-klines'] } } },
+        { displayName: 'Start Time (UTC Epoch Milliseconds)', name: 'startTime', type: 'string', default: '',
+          displayOptions: { show: { source: ['binance-klines'] } } },
+        { displayName: 'End Time (UTC Epoch Milliseconds)', name: 'endTime', type: 'string', default: '',
+          displayOptions: { show: { source: ['binance-klines'] } } },
+        { displayName: 'Options', name: 'options', type: 'collection', default: {},
+          placeholder: 'Add Option', options: [
+            { displayName: 'Maximum Response Size (MiB)', name: 'maxResponseMiB', type: 'number', default: 2,
+              typeOptions: { minValue: 1, numberPrecision: 0 }, description: 'Required finite receive limit; 1 MiB is 1048576 bytes' },
+            { displayName: 'Total Timeout (Seconds)', name: 'totalTimeoutSeconds', type: 'number', default: 20,
+              typeOptions: { minValue: 0.001, maxValue: 2147483.647, numberPrecision: 3 },
+              description: 'One deadline for DNS, TLS, headers, body and the complete redirect chain' },
+            { displayName: 'Additional Allowed HTTPS URLs', name: 'allowedUrls', type: 'string', default: '',
+              typeOptions: { rows: 4 }, description: 'One exact HTTPS URL per line. TLS and public-address checks always apply.' },
+            { displayName: 'Follow Redirects', name: 'followRedirects', type: 'boolean', default: false,
+              description: 'Every target must be explicitly allowed and pass DNS/TLS checks' },
+            { displayName: 'Maximum Redirects', name: 'maxRedirects', type: 'number', default: 3,
+              typeOptions: { minValue: 1, maxValue: 20, numberPrecision: 0 },
+              displayOptions: { show: { followRedirects: [true] } } },
+            { displayName: 'HTTP Status Handling', name: 'statusMode', type: 'options', default: 'allStatuses',
+              options: [{ name: 'Return All Statuses', value: 'allStatuses' },
+                { name: 'Require Selected Statuses', value: 'selectedStatuses' }] },
+            { displayName: 'Accepted HTTP Status Codes', name: 'acceptedStatusCodes', type: 'string', default: '200',
+              description: 'Comma-separated codes; non-selected statuses stop the request',
+              displayOptions: { show: { statusMode: ['selectedStatuses'] } } },
+          ] },
+      ],
+    };
+  }
+  async execute() {
+    const output = [];
+    const input = this.getInputData();
+    if (input.length !== 1) throw new Error('Exactly one input item is required; apply provider policy between requests');
+    for (let i = 0; i < input.length; i++) {
+      const source = this.getNodeParameter('source', i);
+      if (!['binance-time', 'binance-exchange-info', 'binance-klines', 'bitcoin-core', 'bitcoin-optech', 'fed-monetary', 'custom'].includes(source)) throw new Error('Unapproved source');
+      const params = {};
+      if (source === 'custom') params.url = this.getNodeParameter('url', i);
+      if (source === 'binance-klines') {
+        params.symbol = this.getNodeParameter('symbol', i);
+        params.limit = this.getNodeParameter('limit', i);
+        for (const key of ['startTime', 'endTime']) {
+          const raw = this.getNodeParameter(key, i);
+          if (raw !== '') {
+            if (typeof raw !== 'string' || !/^\d+$/.test(raw)) throw new Error(`Invalid ${key}`);
+            params[key] = Number(raw);
+          }
+        }
+      }
+      // Fail closed. Status results must be handled by the collector's durable
+      // cooldown/block policy before another request; this node never retries.
+      const options = this.getNodeParameter('options', i, {});
+      if (!options || typeof options !== 'object' || Array.isArray(options)) throw new Error('Invalid options');
+      const known = ['maxResponseMiB', 'totalTimeoutSeconds', 'allowedUrls', 'followRedirects', 'maxRedirects', 'statusMode', 'acceptedStatusCodes'];
+      if (Object.keys(options).some(key => !known.includes(key))) throw new Error('Unsupported option');
+      const maxResponseMiB = options.maxResponseMiB ?? 2;
+      const seconds = options.totalTimeoutSeconds ?? 20;
+      if (!Number.isSafeInteger(maxResponseMiB) || maxResponseMiB < 1) throw new Error('Invalid byte limit');
+      if (typeof seconds !== 'number' || !Number.isFinite(seconds)) throw new Error('Invalid deadline');
+      const allowedUrls = options.allowedUrls ?? '';
+      const statusCodes = options.acceptedStatusCodes ?? '200';
+      if (typeof allowedUrls !== 'string' || typeof statusCodes !== 'string' ||
+          !/^\s*\d{3}(\s*,\s*\d{3})*\s*$/.test(statusCodes)) throw new Error('Invalid allowlist or status codes');
+      const policy = { maxBytes: maxResponseMiB * 1024 * 1024, deadlineMs: Math.round(seconds * 1000),
+        allowedUrls: allowedUrls.split(/\r?\n/).map(value => value.trim()).filter(Boolean),
+        followRedirects: options.followRedirects ?? false, maxRedirects: options.maxRedirects ?? 3,
+        statusMode: options.statusMode ?? 'allStatuses', acceptedStatusCodes: statusCodes.split(',').map(value => Number(value.trim())) };
+      output.push({ json: await fetchPublic(source, params, {}, policy), pairedItem: { item: i } });
+    }
+    return [output];
+  }
+}
+module.exports = { AiPublicFetch };

package/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "n8n-nodes-ai-trader",
+  "version": "0.2.0",
+  "description": "Configurable bounded public HTTPS fetch node for AI-Trader",
+  "keywords": ["n8n-community-node-package", "n8n", "https"],
+  "license": "MIT",
+  "author": "nova969",
+  "engines": { "node": ">=22" },
+  "files": ["dist", "README.md", "LICENSE"],
+  "scripts": { "test": "node --test test/*.test.cjs" },
+  "n8n": {
+    "n8nNodesApiVersion": 1,
+    "nodes": ["dist/nodes/AiPublicFetch/AiPublicFetch.node.js"]
+  }
+}