nduka 1.0.0

package/dist/connectors/audit.d.ts

@@ -0,0 +1,32 @@
+import { DatabaseManager } from '../database/index.js';
+export type ConnectorAuditStatus = 'allowed' | 'blocked' | 'failed' | 'succeeded';
+export interface ConnectorAuditInput {
+    connectorName: string;
+    actorJid?: string | null;
+    status: ConnectorAuditStatus;
+    host?: string | null;
+    path?: string | null;
+    httpStatus?: number | null;
+    durationMs?: number | null;
+    error?: string | null;
+}
+export interface ConnectorAuditRow extends Required<Omit<ConnectorAuditInput, 'actorJid' | 'host' | 'path' | 'httpStatus' | 'durationMs' | 'error'>> {
+    id: number;
+    actorJid: string | null;
+    host: string | null;
+    path: string | null;
+    httpStatus: number | null;
+    durationMs: number | null;
+    error: string | null;
+    createdAt: number;
+}
+export declare class ConnectorAuditStore {
+    private db;
+    private initialized;
+    constructor(db?: DatabaseManager);
+    private init;
+    record(input: ConnectorAuditInput): void;
+    recent(limit?: number): ConnectorAuditRow[];
+    formatRecent(limit?: number): string;
+}
+//# sourceMappingURL=audit.d.ts.map

package/dist/connectors/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/connectors/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;AAElF,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CAAC,IAAI,CAAC,mBAAmB,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,YAAY,GAAG,YAAY,GAAG,OAAO,CAAC,CAAC;IAClJ,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAWD,qBAAa,mBAAmB;IAGlB,OAAO,CAAC,EAAE;IAFtB,OAAO,CAAC,WAAW,CAAS;gBAER,EAAE,kBAAgC;IAItD,OAAO,CAAC,IAAI;IAqBZ,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI;IAkBxC,MAAM,CAAC,KAAK,SAAK,GAAG,iBAAiB,EAAE;IAoBvC,YAAY,CAAC,KAAK,SAAK,GAAG,MAAM;CAUjC"}

package/dist/connectors/audit.js

@@ -0,0 +1,77 @@
+import { DatabaseManager } from '../database/index.js';
+function sanitizeText(value, max = 240) {
+    if (!value)
+        return null;
+    const clean = value
+        .replace(/[\r\n\t]+/g, ' ')
+        .replace(/(bearer|token|secret|password|api[_-]?key)\s*[=:]\s*\S+/gi, '$1=[redacted]')
+        .trim();
+    return clean.length > max ? `${clean.slice(0, max - 1)}…` : clean;
+}
+export class ConnectorAuditStore {
+    db;
+    initialized = false;
+    constructor(db = DatabaseManager.getInstance()) {
+        this.db = db;
+        this.init();
+    }
+    init() {
+        if (this.initialized)
+            return;
+        this.db.getDb().exec(`
+      CREATE TABLE IF NOT EXISTS connector_audit_events (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        connector_name TEXT NOT NULL,
+        actor_jid TEXT,
+        status TEXT NOT NULL,
+        host TEXT,
+        path TEXT,
+        http_status INTEGER,
+        duration_ms INTEGER,
+        error TEXT,
+        created_at INTEGER NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_connector_audit_time ON connector_audit_events(created_at);
+      CREATE INDEX IF NOT EXISTS idx_connector_audit_name_time ON connector_audit_events(connector_name, created_at);
+    `);
+        this.initialized = true;
+    }
+    record(input) {
+        this.db.getDb().prepare(`
+      INSERT INTO connector_audit_events (
+        connector_name, actor_jid, status, host, path, http_status, duration_ms, error, created_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(input.connectorName, input.actorJid || null, input.status, sanitizeText(input.host, 120), sanitizeText(input.path, 240), input.httpStatus ?? null, input.durationMs ?? null, sanitizeText(input.error, 240), Date.now());
+    }
+    recent(limit = 20) {
+        const rows = this.db.getDb().prepare(`
+      SELECT
+        id,
+        connector_name as connectorName,
+        actor_jid as actorJid,
+        status,
+        host,
+        path,
+        http_status as httpStatus,
+        duration_ms as durationMs,
+        error,
+        created_at as createdAt
+      FROM connector_audit_events
+      ORDER BY created_at DESC, id DESC
+      LIMIT ?
+    `).all(Math.max(1, Math.min(limit, 100)));
+        return rows;
+    }
+    formatRecent(limit = 20) {
+        const rows = this.recent(limit);
+        if (rows.length === 0)
+            return 'No connector audit events recorded yet.';
+        return ['🔎 Connector Audit', '', ...rows.map((row) => {
+                const status = row.httpStatus ? `${row.status} ${row.httpStatus}` : row.status;
+                const host = row.host ? ` ${row.host}` : '';
+                const error = row.error ? ` — ${row.error}` : '';
+                return `#${row.id} ${row.connectorName}: ${status}${host}${error}`;
+            })].join('\n');
+    }
+}
+//# sourceMappingURL=audit.js.map

package/dist/connectors/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/connectors/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AA0BvD,SAAS,YAAY,CAAC,KAAgC,EAAE,GAAG,GAAG,GAAG;IAC/D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,KAAK;SAChB,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;SAC1B,OAAO,CAAC,2DAA2D,EAAE,eAAe,CAAC;SACrF,IAAI,EAAE,CAAC;IACV,OAAO,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AACpE,CAAC;AAED,MAAM,OAAO,mBAAmB;IAGV;IAFZ,WAAW,GAAG,KAAK,CAAC;IAE5B,YAAoB,KAAK,eAAe,CAAC,WAAW,EAAE;QAAlC,OAAE,GAAF,EAAE,CAAgC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAEO,IAAI;QACV,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAC7B,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;KAepB,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,MAAM,CAAC,KAA0B;QAC/B,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC;;;;KAIvB,CAAC,CAAC,GAAG,CACJ,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,QAAQ,IAAI,IAAI,EACtB,KAAK,CAAC,MAAM,EACZ,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,EAC7B,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,EAC7B,KAAK,CAAC,UAAU,IAAI,IAAI,EACxB,KAAK,CAAC,UAAU,IAAI,IAAI,EACxB,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,EAC9B,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,GAAG,EAAE;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;KAepC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAwB,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY,CAAC,KAAK,GAAG,EAAE;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,yCAAyC,CAAC;QACxE,OAAO,CAAC,oBAAoB,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACpD,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC/E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,OAAO,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,aAAa,KAAK,MAAM,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;YACrE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;CACF"}

package/dist/connectors/config.d.ts

@@ -0,0 +1,9 @@
+import { type ConnectorManifest } from './manifest.js';
+export declare const DEFAULT_CONNECTOR_MANIFEST: ConnectorManifest;
+export declare function connectorManifestPath(): string;
+export declare function loadConnectorManifest(path?: string): ConnectorManifest;
+export declare function ensureConnectorManifest(path?: string, force?: boolean): 'created' | 'updated' | 'skipped';
+export declare function formatConnectorManifestStatus(path?: string): string;
+export declare function formatConnectorList(path?: string): string;
+export declare function previewConnectorUrl(name: string, args: Record<string, unknown>, path?: string): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/connectors/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/connectors/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAiD,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAGtG,eAAO,MAAM,0BAA0B,EAAE,iBAIxC,CAAC;AAEF,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAMD,wBAAgB,qBAAqB,CAAC,IAAI,SAA0B,GAAG,iBAAiB,CAKvF;AAED,wBAAgB,uBAAuB,CAAC,IAAI,SAA0B,EAAE,KAAK,UAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAMxH;AAED,wBAAgB,6BAA6B,CAAC,IAAI,SAA0B,GAAG,MAAM,CAUpF;AAED,wBAAgB,mBAAmB,CAAC,IAAI,SAA0B,GAAG,MAAM,CAI1E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,SAA0B,GAAG,MAAM,CAgBvH"}

package/dist/connectors/config.js

@@ -0,0 +1,66 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { renderConnectorUrl, validateConnectorManifest } from './manifest.js';
+import { assertSafeConnectorUrl } from './url-guard.js';
+export const DEFAULT_CONNECTOR_MANIFEST = {
+    version: 1,
+    enabled: false,
+    connectors: [],
+};
+export function connectorManifestPath() {
+    return resolve(process.cwd(), process.env.CHATBOT_CONNECTORS_PATH || './config/connectors.chatbot.json');
+}
+function parseJsonFile(path) {
+    return JSON.parse(readFileSync(path, 'utf8'));
+}
+export function loadConnectorManifest(path = connectorManifestPath()) {
+    if (!existsSync(path))
+        return DEFAULT_CONNECTOR_MANIFEST;
+    const manifest = parseJsonFile(path);
+    validateConnectorManifest(manifest);
+    return manifest;
+}
+export function ensureConnectorManifest(path = connectorManifestPath(), force = false) {
+    const existed = existsSync(path);
+    if (existed && !force)
+        return 'skipped';
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${JSON.stringify(DEFAULT_CONNECTOR_MANIFEST, null, 2)}\n`, 'utf8');
+    return existed ? 'updated' : 'created';
+}
+export function formatConnectorManifestStatus(path = connectorManifestPath()) {
+    const exists = existsSync(path);
+    const manifest = loadConnectorManifest(path);
+    return [
+        '🔌 Connector Manifest',
+        `Path: ${path}`,
+        `Exists: ${exists ? 'yes' : 'no'}`,
+        `Enabled: ${manifest.enabled ? 'yes' : 'no'}`,
+        `Connectors: ${manifest.connectors.length}`,
+    ].join('\n');
+}
+export function formatConnectorList(path = connectorManifestPath()) {
+    const manifest = loadConnectorManifest(path);
+    if (manifest.connectors.length === 0)
+        return 'No custom connectors configured.';
+    return ['🔌 Custom Connectors', '', ...manifest.connectors.map((connector) => `- ${connector.name}: ${connector.method} ${connector.allowedHosts.join(', ')}`)].join('\n');
+}
+export function previewConnectorUrl(name, args, path = connectorManifestPath()) {
+    const manifest = loadConnectorManifest(path);
+    const connector = manifest.connectors.find((item) => item.name === name.trim().toLowerCase());
+    if (!connector)
+        throw new Error(`Unknown connector: ${name}`);
+    const url = renderConnectorUrl(connector.urlTemplate, args);
+    assertSafeConnectorUrl({ url, allowedHosts: connector.allowedHosts });
+    return [
+        '🔌 Connector Preview',
+        `Name: ${connector.name}`,
+        `Enabled: ${manifest.enabled ? 'yes' : 'no'}`,
+        `Method: ${connector.method}`,
+        `Host: ${url.hostname}`,
+        `Path: ${url.pathname}${url.search ? '?…' : ''}`,
+        '',
+        'No network request was made.',
+    ].join('\n');
+}
+//# sourceMappingURL=config.js.map

package/dist/connectors/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/connectors/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAA0B,MAAM,eAAe,CAAC;AACtG,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,OAAO,EAAE,CAAC;IACV,OAAO,EAAE,KAAK;IACd,UAAU,EAAE,EAAE;CACf,CAAC;AAEF,MAAM,UAAU,qBAAqB;IACnC,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,kCAAkC,CAAC,CAAC;AAC3G,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAI,GAAG,qBAAqB,EAAE;IAClE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,0BAA0B,CAAC;IACzD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAsB,CAAC;IAC1D,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACpC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAI,GAAG,qBAAqB,EAAE,EAAE,KAAK,GAAG,KAAK;IACnF,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,OAAO,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IACxC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxF,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,IAAI,GAAG,qBAAqB,EAAE;IAC1E,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO;QACL,uBAAuB;QACvB,SAAS,IAAI,EAAE;QACf,WAAW,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QAClC,YAAY,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QAC7C,eAAe,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE;KAC5C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAI,GAAG,qBAAqB,EAAE;IAChE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kCAAkC,CAAC;IAChF,OAAO,CAAC,sBAAsB,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7K,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,IAA6B,EAAE,IAAI,GAAG,qBAAqB,EAAE;IAC7G,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9F,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC5D,sBAAsB,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;IACtE,OAAO;QACL,sBAAsB;QACtB,SAAS,SAAS,CAAC,IAAI,EAAE;QACzB,YAAY,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QAC7C,WAAW,SAAS,CAAC,MAAM,EAAE;QAC7B,SAAS,GAAG,CAAC,QAAQ,EAAE;QACvB,SAAS,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAChD,EAAE;QACF,8BAA8B;KAC/B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/connectors/dns-guard.d.ts

@@ -0,0 +1,7 @@
+export interface ConnectorDnsAddress {
+    address: string;
+    family: 4 | 6;
+}
+export type ConnectorDnsLookup = (host: string) => Promise<ConnectorDnsAddress[]>;
+export declare function assertSafeResolvedHost(host: string, lookupImpl?: ConnectorDnsLookup): Promise<void>;
+//# sourceMappingURL=dns-guard.d.ts.map

package/dist/connectors/dns-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-guard.d.ts","sourceRoot":"","sources":["../../src/connectors/dns-guard.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;CACf;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;AA+ClF,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,GAAE,kBAAkC,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBxH"}

package/dist/connectors/dns-guard.js

@@ -0,0 +1,70 @@
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+function cleanHost(host) {
+    return host.trim().toLowerCase().replace(/^\[|\]$/g, '').replace(/\.$/, '');
+}
+function defaultLookup(host) {
+    return lookup(host, { all: true, verbatim: false });
+}
+function ipv4Parts(address) {
+    const parts = address.split('.').map((part) => Number(part));
+    if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255))
+        return null;
+    return parts;
+}
+function isUnsafeIpv4(address) {
+    const parts = ipv4Parts(address);
+    if (!parts)
+        return true;
+    const [a, b, c] = parts;
+    return a === 0 || a === 10 || a === 127 ||
+        (a === 100 && b >= 64 && b <= 127) ||
+        (a === 169 && b === 254) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && (b === 0 || b === 168)) ||
+        (a === 198 && (b === 18 || b === 19 || (b === 51 && c === 100))) ||
+        (a === 203 && b === 0 && c === 113) ||
+        a >= 224;
+}
+function mappedIpv4(address) {
+    const lower = address.toLowerCase();
+    const prefix = '::ffff:';
+    if (!lower.startsWith(prefix))
+        return null;
+    const candidate = lower.slice(prefix.length);
+    return ipv4Parts(candidate) ? candidate : null;
+}
+function isUnsafeIpv6(address) {
+    const lower = address.toLowerCase();
+    const mapped = mappedIpv4(lower);
+    if (mapped)
+        return isUnsafeIpv4(mapped);
+    return lower === '::' || lower === '::1' ||
+        lower.startsWith('fc') || lower.startsWith('fd') ||
+        lower.startsWith('fe80:') || lower.startsWith('ff');
+}
+export async function assertSafeResolvedHost(host, lookupImpl = defaultLookup) {
+    const clean = cleanHost(host);
+    if (isIP(clean))
+        throw new Error('Connector DNS host must not be an IP literal.');
+    const addresses = await lookupImpl(clean);
+    if (!Array.isArray(addresses) || addresses.length === 0) {
+        throw new Error(`Connector DNS lookup returned no addresses for ${clean}.`);
+    }
+    for (const item of addresses) {
+        if (!item || typeof item.address !== 'string') {
+            throw new Error(`Connector DNS lookup returned an invalid address for ${clean}.`);
+        }
+        const version = isIP(item.address);
+        if (version === 4 && isUnsafeIpv4(item.address)) {
+            throw new Error(`Connector DNS resolved to an unsafe IPv4 address for ${clean}.`);
+        }
+        if (version === 6 && isUnsafeIpv6(item.address)) {
+            throw new Error(`Connector DNS resolved to an unsafe IPv6 address for ${clean}.`);
+        }
+        if (!version) {
+            throw new Error(`Connector DNS returned an invalid IP address for ${clean}.`);
+        }
+    }
+}
+//# sourceMappingURL=dns-guard.js.map

package/dist/connectors/dns-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-guard.js","sourceRoot":"","sources":["../../src/connectors/dns-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAShC,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAmC,CAAC;AACxF,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACxB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QACrC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC;QAClC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;QACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACrC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC;QACnC,CAAC,IAAI,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,MAAM;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK;QACtC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAChD,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAY,EAAE,aAAiC,aAAa;IACvG,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAElF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,kDAAkD,KAAK,GAAG,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,wDAAwD,KAAK,GAAG,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,wDAAwD,KAAK,GAAG,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,wDAAwD,KAAK,GAAG,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,oDAAoD,KAAK,GAAG,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/connectors/executor.d.ts

@@ -0,0 +1,30 @@
+import { ConnectorAuditStore } from './audit.js';
+import { type ConnectorDnsLookup } from './dns-guard.js';
+import { type ConnectorManifestItem } from './manifest.js';
+export interface ConnectorExecutionResult {
+    ok: boolean;
+    status: number;
+    url: string;
+    contentType: string;
+    body: string;
+    truncated: boolean;
+}
+export interface ConnectorExecutionContext {
+    actorJid?: string | null;
+    audit?: ConnectorAuditStore | null;
+    dnsLookup?: ConnectorDnsLookup | null;
+}
+export interface ConnectorFetchResponse {
+    status: number;
+    headers: {
+        get(name: string): string | null;
+    };
+    arrayBuffer(): Promise<ArrayBuffer>;
+}
+export type ConnectorFetch = (url: string, init: {
+    method: 'GET';
+    redirect: 'manual';
+    signal?: AbortSignal;
+}) => Promise<ConnectorFetchResponse>;
+export declare function executeConnectorGet(item: ConnectorManifestItem, args: Record<string, unknown>, fetchImpl?: ConnectorFetch, context?: ConnectorExecutionContext): Promise<ConnectorExecutionResult>;
+//# sourceMappingURL=executor.d.ts.map

package/dist/connectors/executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/connectors/executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,EAA0B,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAA6C,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEtG,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,SAAS,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC9C,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;CACrC;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAuCjJ,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,qBAAqB,EAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,GAAE,cAA+B,EAC1C,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,wBAAwB,CAAC,CAkCnC"}

package/dist/connectors/executor.js

@@ -0,0 +1,80 @@
+import { assertSafeConnectorUrl } from './url-guard.js';
+import { assertSafeResolvedHost } from './dns-guard.js';
+import { renderConnectorUrl, validateConnectorItem } from './manifest.js';
+function defaultFetch() {
+    const fn = globalThis.fetch;
+    if (!fn)
+        throw new Error('No fetch implementation is available.');
+    return fn;
+}
+function assertContentType(contentType) {
+    const type = contentType.split(';')[0].trim().toLowerCase();
+    if (!type)
+        return;
+    if (type === 'application/json' || type === 'text/plain' || type === 'text/markdown' || type === 'text/csv')
+        return;
+    if (type.endsWith('+json'))
+        return;
+    throw new Error(`Unsupported connector response content type: ${contentType}`);
+}
+function decodeLimited(buffer, maxBytes) {
+    const bytes = new Uint8Array(buffer);
+    const limited = bytes.slice(0, maxBytes);
+    return { body: new TextDecoder('utf-8', { fatal: false }).decode(limited), truncated: bytes.length > maxBytes };
+}
+function auditPath(url) {
+    return `${url.pathname}${url.search ? '?…' : ''}`;
+}
+function recordAudit(context, item, status, url, extra = {}) {
+    context?.audit?.record({
+        connectorName: item.name,
+        actorJid: context.actorJid || null,
+        status,
+        host: url?.hostname || null,
+        path: url ? auditPath(url) : null,
+        httpStatus: extra.httpStatus ?? null,
+        durationMs: extra.durationMs ?? null,
+        error: extra.error ?? null,
+    });
+}
+export async function executeConnectorGet(item, args, fetchImpl = defaultFetch(), context) {
+    const started = Date.now();
+    let url = null;
+    let guardPassed = false;
+    try {
+        validateConnectorItem(item);
+        url = renderConnectorUrl(item.urlTemplate, args);
+        assertSafeConnectorUrl({ url, allowedHosts: item.allowedHosts });
+        await assertSafeResolvedHost(url.hostname, context?.dnsLookup || undefined);
+        guardPassed = true;
+        recordAudit(context, item, 'allowed', url);
+        const timeoutMs = item.timeoutMs ?? 10000;
+        const maxBytes = item.maxBytes ?? 50000;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+            const response = await fetchImpl(url.toString(), { method: 'GET', redirect: 'manual', signal: controller.signal });
+            if (response.status >= 300 && response.status < 400)
+                throw new Error('Connector redirects are not followed.');
+            if (response.status < 200 || response.status >= 300)
+                throw new Error(`Connector request failed with status ${response.status}.`);
+            const contentType = response.headers.get('content-type') || '';
+            assertContentType(contentType);
+            const declaredLength = Number(response.headers.get('content-length') || 0);
+            if (declaredLength > maxBytes)
+                throw new Error(`Connector response too large: ${declaredLength} bytes.`);
+            const decoded = decodeLimited(await response.arrayBuffer(), maxBytes);
+            recordAudit(context, item, 'succeeded', url, { httpStatus: response.status, durationMs: Date.now() - started });
+            return { ok: true, status: response.status, url: url.toString(), contentType, body: decoded.body, truncated: decoded.truncated };
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    catch (err) {
+        const message = err.message;
+        recordAudit(context, item, url && guardPassed ? 'failed' : 'blocked', url, { durationMs: Date.now() - started, error: message });
+        throw err;
+    }
+}
+//# sourceMappingURL=executor.js.map

package/dist/connectors/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../src/connectors/executor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAA2B,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAA8B,MAAM,eAAe,CAAC;AAyBtG,SAAS,YAAY;IACnB,MAAM,EAAE,GAAG,UAAU,CAAC,KAA8C,CAAC;IACrE,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAClE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO;IACpH,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO;IACnC,MAAM,IAAI,KAAK,CAAC,gDAAgD,WAAW,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB,EAAE,QAAgB;IAC1D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACzC,OAAO,EAAE,IAAI,EAAE,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;AAClH,CAAC;AAED,SAAS,SAAS,CAAC,GAAQ;IACzB,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,WAAW,CAAC,OAA8C,EAAE,IAA2B,EAAE,MAAsD,EAAE,GAAe,EAAE,QAA2F,EAAE;IACtQ,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,IAAI,CAAC,IAAI;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,MAAM;QACN,IAAI,EAAE,GAAG,EAAE,QAAQ,IAAI,IAAI;QAC3B,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;QACjC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA2B,EAC3B,IAA6B,EAC7B,YAA4B,YAAY,EAAE,EAC1C,OAAmC;IAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,GAAG,GAAe,IAAI,CAAC;IAC3B,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC5B,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACjD,sBAAsB,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACjE,MAAM,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,IAAI,SAAS,CAAC,CAAC;QAC5E,WAAW,GAAG,IAAI,CAAC;QACnB,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YACnH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC9G,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YACjI,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC/D,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAC/B,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3E,IAAI,cAAc,GAAG,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,cAAc,SAAS,CAAC,CAAC;YACzG,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAC;YACtE,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;YAChH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QACnI,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAI,GAAa,CAAC,OAAO,CAAC;QACvC,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACjI,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/connectors/manifest.d.ts

@@ -0,0 +1,18 @@
+export interface ConnectorManifestItem {
+    name: string;
+    description?: string;
+    method: 'GET';
+    urlTemplate: string;
+    allowedHosts: string[];
+    timeoutMs?: number;
+    maxBytes?: number;
+}
+export interface ConnectorManifest {
+    version: 1;
+    enabled: boolean;
+    connectors: ConnectorManifestItem[];
+}
+export declare function renderConnectorUrl(template: string, args: Record<string, unknown>): URL;
+export declare function validateConnectorItem(item: ConnectorManifestItem): void;
+export declare function validateConnectorManifest(manifest: ConnectorManifest): void;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/connectors/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/connectors/manifest.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,KAAK,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,qBAAqB,EAAE,CAAC;CACrC;AAcD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,GAAG,CAUvF;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAoBvE;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAW3E"}

package/dist/connectors/manifest.js

@@ -0,0 +1,72 @@
+const NAME_RE = /^[a-z][a-z0-9_-]{0,40}$/;
+const HOST_RE = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i;
+const TEMPLATE_RE = /\{([a-zA-Z][a-zA-Z0-9_]{0,40})\}/g;
+function cleanHost(host) {
+    return host.trim().toLowerCase().replace(/\.$/, '');
+}
+function assertPlainObject(value, label) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw new Error(`${label} must be an object.`);
+}
+export function renderConnectorUrl(template, args) {
+    const rendered = template.replace(TEMPLATE_RE, (_, key) => {
+        const value = args[key];
+        if (value === undefined || value === null)
+            throw new Error(`Missing parameter: ${key}`);
+        if (!['string', 'number', 'boolean'].includes(typeof value))
+            throw new Error(`Parameter must be primitive: ${key}`);
+        const text = String(value);
+        if (text.length > 500)
+            throw new Error(`Parameter too long: ${key}`);
+        return encodeURIComponent(text);
+    });
+    return new URL(rendered);
+}
+export function validateConnectorItem(item) {
+    assertPlainObject(item, 'Connector');
+    if (!NAME_RE.test(item.name || ''))
+        throw new Error(`Invalid connector name: ${item.name}`);
+    if (item.method !== 'GET')
+        throw new Error(`Connector ${item.name} may only use GET.`);
+    if (typeof item.urlTemplate !== 'string' || item.urlTemplate.length < 1)
+        throw new Error(`Connector ${item.name} needs urlTemplate.`);
+    const previewUrl = renderConnectorUrl(item.urlTemplate, Object.fromEntries([...item.urlTemplate.matchAll(TEMPLATE_RE)].map((m) => [m[1], 'value'])));
+    if (previewUrl.protocol !== 'https:')
+        throw new Error(`Connector ${item.name} must use https.`);
+    if (previewUrl.username || previewUrl.password)
+        throw new Error(`Connector ${item.name} must not include URL credentials.`);
+    if (previewUrl.hash)
+        throw new Error(`Connector ${item.name} must not include fragments.`);
+    const host = cleanHost(previewUrl.hostname);
+    if (!HOST_RE.test(host))
+        throw new Error(`Connector ${item.name} must use a DNS host.`);
+    const allowed = (item.allowedHosts || []).map(cleanHost);
+    if (!allowed.includes(host))
+        throw new Error(`Connector ${item.name} host must be allowed: ${host}`);
+    for (const allowedHost of allowed)
+        if (!HOST_RE.test(allowedHost))
+            throw new Error(`Invalid allowed host: ${allowedHost}`);
+    const timeout = item.timeoutMs ?? 10000;
+    if (!Number.isInteger(timeout) || timeout < 500 || timeout > 30000)
+        throw new Error(`Connector ${item.name} timeout must be 500-30000ms.`);
+    const maxBytes = item.maxBytes ?? 50000;
+    if (!Number.isInteger(maxBytes) || maxBytes < 100 || maxBytes > 200000)
+        throw new Error(`Connector ${item.name} maxBytes must be 100-200000.`);
+}
+export function validateConnectorManifest(manifest) {
+    assertPlainObject(manifest, 'Connector manifest');
+    if (manifest.version !== 1)
+        throw new Error('Connector manifest version must be 1.');
+    if (typeof manifest.enabled !== 'boolean')
+        throw new Error('Connector manifest enabled must be boolean.');
+    if (!Array.isArray(manifest.connectors))
+        throw new Error('Connector manifest connectors must be an array.');
+    const names = new Set();
+    for (const item of manifest.connectors) {
+        validateConnectorItem(item);
+        if (names.has(item.name))
+            throw new Error(`Duplicate connector name: ${item.name}`);
+        names.add(item.name);
+    }
+}
+//# sourceMappingURL=manifest.js.map

package/dist/connectors/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/connectors/manifest.ts"],"names":[],"mappings":"AAgBA,MAAM,OAAO,GAAG,yBAAyB,CAAC;AAC1C,MAAM,OAAO,GAAG,2DAA2D,CAAC;AAC5E,MAAM,WAAW,GAAG,mCAAmC,CAAC;AAExD,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;AAC1H,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,IAA6B;IAChF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,GAAW,EAAE,EAAE;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC;QACpH,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;QACrE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAA2B;IAC/D,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5F,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,oBAAoB,CAAC,CAAC;IACvF,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,qBAAqB,CAAC,CAAC;IACtI,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACrJ,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,kBAAkB,CAAC,CAAC;IAChG,IAAI,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,oCAAoC,CAAC,CAAC;IAC5H,IAAI,UAAU,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,8BAA8B,CAAC,CAAC;IAE3F,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,uBAAuB,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,0BAA0B,IAAI,EAAE,CAAC,CAAC;IACrG,KAAK,MAAM,WAAW,IAAI,OAAO;QAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,WAAW,EAAE,CAAC,CAAC;IAE3H,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,+BAA+B,CAAC,CAAC;IAC3I,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,GAAG,IAAI,QAAQ,GAAG,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,+BAA+B,CAAC,CAAC;AACjJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAA2B;IACnE,iBAAiB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACrF,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC1G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC5G,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACvC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/connectors/runner.d.ts

@@ -0,0 +1,17 @@
+import { ConnectorAuditStore } from './audit.js';
+import { type ConnectorExecutionResult, type ConnectorFetch } from './executor.js';
+import { type ConnectorManifest, type ConnectorManifestItem } from './manifest.js';
+import type { ConnectorDnsLookup } from './dns-guard.js';
+export declare class ConnectorRunner {
+    private manifest;
+    private fetchImpl?;
+    private audit?;
+    private dnsLookup?;
+    private byName;
+    constructor(manifest: ConnectorManifest, fetchImpl?: ConnectorFetch | undefined, audit?: ConnectorAuditStore | undefined, dnsLookup?: ConnectorDnsLookup | undefined);
+    enabled(): boolean;
+    list(): ConnectorManifestItem[];
+    get(name: string): ConnectorManifestItem | null;
+    execute(name: string, args: Record<string, unknown>, actorJid?: string | null): Promise<ConnectorExecutionResult>;
+}
+//# sourceMappingURL=runner.d.ts.map

package/dist/connectors/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/connectors/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAuB,KAAK,wBAAwB,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AACxG,OAAO,EAA6B,KAAK,iBAAiB,EAAE,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC9G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,qBAAa,eAAe;IAGd,OAAO,CAAC,QAAQ;IAAqB,OAAO,CAAC,SAAS,CAAC;IAAkB,OAAO,CAAC,KAAK,CAAC;IAAuB,OAAO,CAAC,SAAS,CAAC;IAF5I,OAAO,CAAC,MAAM,CAA4C;gBAEtC,QAAQ,EAAE,iBAAiB,EAAU,SAAS,CAAC,EAAE,cAAc,YAAA,EAAU,KAAK,CAAC,EAAE,mBAAmB,YAAA,EAAU,SAAS,CAAC,EAAE,kBAAkB,YAAA;IAKhK,OAAO,IAAI,OAAO;IAIlB,IAAI,IAAI,qBAAqB,EAAE;IAI/B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI;IAIzC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAMxH"}

package/dist/connectors/runner.js

@@ -0,0 +1,36 @@
+import { executeConnectorGet } from './executor.js';
+import { validateConnectorManifest } from './manifest.js';
+export class ConnectorRunner {
+    manifest;
+    fetchImpl;
+    audit;
+    dnsLookup;
+    byName = new Map();
+    constructor(manifest, fetchImpl, audit, dnsLookup) {
+        this.manifest = manifest;
+        this.fetchImpl = fetchImpl;
+        this.audit = audit;
+        this.dnsLookup = dnsLookup;
+        validateConnectorManifest(manifest);
+        for (const connector of manifest.connectors)
+            this.byName.set(connector.name, connector);
+    }
+    enabled() {
+        return this.manifest.enabled;
+    }
+    list() {
+        return Array.from(this.byName.values()).map((item) => ({ ...item, allowedHosts: [...item.allowedHosts] }));
+    }
+    get(name) {
+        return this.byName.get(name.trim().toLowerCase()) || null;
+    }
+    async execute(name, args, actorJid) {
+        if (!this.manifest.enabled)
+            throw new Error('Connector manifest is disabled.');
+        const item = this.get(name);
+        if (!item)
+            throw new Error(`Unknown connector: ${name}`);
+        return executeConnectorGet(item, args, this.fetchImpl, { actorJid, audit: this.audit, dnsLookup: this.dnsLookup });
+    }
+}
+//# sourceMappingURL=runner.js.map

package/dist/connectors/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/connectors/runner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAsD,MAAM,eAAe,CAAC;AACxG,OAAO,EAAE,yBAAyB,EAAsD,MAAM,eAAe,CAAC;AAG9G,MAAM,OAAO,eAAe;IAGN;IAAqC;IAAoC;IAAqC;IAF1H,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;IAE1D,YAAoB,QAA2B,EAAU,SAA0B,EAAU,KAA2B,EAAU,SAA8B;QAA5I,aAAQ,GAAR,QAAQ,CAAmB;QAAU,cAAS,GAAT,SAAS,CAAiB;QAAU,UAAK,GAAL,KAAK,CAAsB;QAAU,cAAS,GAAT,SAAS,CAAqB;QAC9J,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACpC,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,IAAI;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7G,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAA6B,EAAE,QAAwB;QACjF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACrH,CAAC;CACF"}

package/dist/connectors/url-guard.d.ts

@@ -0,0 +1,7 @@
+export interface ConnectorUrlGuardInput {
+    url: URL;
+    allowedHosts: string[];
+}
+export declare function assertSafeConnectorUrl(input: ConnectorUrlGuardInput): void;
+export declare function assertSafeRedirectUrl(previous: URL, next: URL, allowedHosts: string[]): void;
+//# sourceMappingURL=url-guard.d.ts.map

package/dist/connectors/url-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-guard.d.ts","sourceRoot":"","sources":["../../src/connectors/url-guard.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,GAAG,CAAC;IACT,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAuBD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,sBAAsB,GAAG,IAAI,CAgB1E;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAG5F"}