webpeel 0.19.4 → 0.20.0

package/dist/server/middleware/rate-limit.js

@@ -1,168 +0,0 @@
-/**
- * Sliding window rate limiting middleware
- */
-import '../types.js'; // Augments Express.Request with requestId
-export class RateLimiter {
-    store = new Map();
-    windowMs;
-    constructor(windowMs = 60000) {
-        this.windowMs = windowMs;
-    }
-    /**
-     * Check if request is allowed under rate limit
-     * @param cost - Number of credits this request costs (default: 1)
-     */
-    checkLimit(identifier, limit, cost = 1) {
-        const now = Date.now();
-        const windowStart = now - this.windowMs;
-        // Get or create entry
-        let entry = this.store.get(identifier);
-        if (!entry) {
-            entry = { timestamps: [] };
-            this.store.set(identifier, entry);
-        }
-        // Remove timestamps outside the window
-        entry.timestamps = entry.timestamps.filter(ts => ts > windowStart);
-        // Check if limit would be exceeded by this request's cost
-        if (entry.timestamps.length + cost > limit) {
-            const oldestTimestamp = entry.timestamps[0];
-            const retryAfter = oldestTimestamp
-                ? Math.ceil((oldestTimestamp + this.windowMs - now) / 1000)
-                : 1;
-            return {
-                allowed: false,
-                remaining: Math.max(0, limit - entry.timestamps.length),
-                retryAfter,
-            };
-        }
-        // Add `cost` timestamps to represent the weight of this request
-        for (let i = 0; i < cost; i++) {
-            entry.timestamps.push(now);
-        }
-        return {
-            allowed: true,
-            remaining: limit - entry.timestamps.length,
-        };
-    }
-    /**
-     * Clean up old entries (call periodically)
-     */
-    cleanup() {
-        const now = Date.now();
-        const windowStart = now - this.windowMs;
-        for (const [identifier, entry] of this.store.entries()) {
-            entry.timestamps = entry.timestamps.filter(ts => ts > windowStart);
-            if (entry.timestamps.length === 0) {
-                this.store.delete(identifier);
-            }
-        }
-    }
-}
-/**
- * Hourly burst limits per tier.
- * These are the hard caps enforced by the in-memory sliding window.
- * Free: 50/hr, Pro: 100/hr, Max: 500/hr (matches pricing page + stripe.ts).
- */
-const TIER_BURST_LIMITS = {
-    free: 50,
-    pro: 100,
-    max: 500,
-    admin: 999999,
-};
-/**
- * System/documentation endpoints that should be exempt from rate limiting.
- * These are low-cost informational endpoints that should never be throttled.
- */
-const EXEMPT_PATHS = [
-    '/health',
-    '/openapi.json',
-    '/openapi.yaml',
-    '/docs',
-    '/v1/usage',
-    '/v1/me',
-    '/v1/keys',
-    '/v1/activity',
-    '/v1/stats',
-];
-export function createRateLimitMiddleware(limiter) {
-    return (req, res, next) => {
-        try {
-            // Skip rate limiting for system/documentation endpoints
-            if (EXEMPT_PATHS.some(p => req.path === p || req.path.startsWith(p + '/'))) {
-                return next();
-            }
-            // Use API key or real client IP as identifier.
-            // Prefer Cloudflare CF-Connecting-IP, then x-forwarded-for first
-            // entry (real client), then x-real-ip, then req.ip.
-            const forwardedFor = req.headers['x-forwarded-for'];
-            const firstForwardedIp = typeof forwardedFor === 'string'
-                ? forwardedFor.split(',')[0].trim()
-                : Array.isArray(forwardedFor) ? forwardedFor[0] : undefined;
-            const clientIp = req.headers['cf-connecting-ip']
-                || firstForwardedIp
-                || req.headers['x-real-ip']
-                || req.ip
-                || 'unknown';
-            const identifier = req.auth?.keyInfo?.key || clientIp;
-            // Use tier-based hourly burst limits (matches the 1-hour sliding window)
-            const limit = TIER_BURST_LIMITS[req.auth?.tier || 'free'] || 50;
-            // Weighted cost based on route — heavier operations consume more credits
-            let cost = 1;
-            const path = req.path;
-            if (path.includes('/crawl') || path.includes('/map'))
-                cost = 5;
-            else if (path.includes('/batch'))
-                cost = 2;
-            else if (path.includes('/screenshot'))
-                cost = 2;
-            else if (req.query.render === 'true' || req.body?.render === true)
-                cost = 3;
-            const result = limiter.checkLimit(identifier, limit, cost);
-            // Calculate reset timestamp
-            const now = Date.now();
-            const resetTimestamp = Math.ceil((now + limiter['windowMs']) / 1000);
-            // Set rate limit headers on ALL responses
-            res.setHeader('X-RateLimit-Limit', limit.toString());
-            res.setHeader('X-RateLimit-Remaining', Math.max(0, result.remaining).toString());
-            res.setHeader('X-RateLimit-Reset', resetTimestamp.toString());
-            // Add plan header if authenticated
-            if (req.auth?.tier) {
-                res.setHeader('X-WebPeel-Plan', req.auth.tier);
-            }
-            if (!result.allowed) {
-                const retryAfterSecs = result.retryAfter;
-                res.setHeader('Retry-After', retryAfterSecs.toString());
-                const tier = req.auth?.tier || 'free';
-                const upgradeHint = tier === 'free'
-                    ? ' Upgrade to Pro ($9/mo) for 100/hr burst limit → https://webpeel.dev/pricing'
-                    : tier === 'pro'
-                        ? ' Upgrade to Max ($29/mo) for 500/hr burst limit → https://webpeel.dev/pricing'
-                        : '';
-                res.status(429).json({
-                    success: false,
-                    error: {
-                        type: 'rate_limited',
-                        message: `Hourly rate limit exceeded (${limit} requests/hr on ${tier} plan). Try again in ${retryAfterSecs}s.`,
-                        hint: `Retry after ${retryAfterSecs} seconds.${upgradeHint}`,
-                        docs: 'https://webpeel.dev/docs/errors#rate-limited',
-                    },
-                    metadata: { requestId: req.requestId },
-                });
-                return; // Stop processing - rate limit exceeded
-            }
-            next();
-        }
-        catch (_error) {
-            res.status(500).json({
-                success: false,
-                error: {
-                    type: 'internal_error',
-                    message: 'Rate limiting failed',
-                    docs: 'https://webpeel.dev/docs/errors#internal-error',
-                },
-                metadata: { requestId: req.requestId },
-            });
-        }
-    };
-}
-//# sourceMappingURL=rate-limit.js.map

package/dist/server/middleware/rate-limit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/server/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,aAAa,CAAC,CAAC,0CAA0C;AAMhE,MAAM,OAAO,WAAW;IACd,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC1C,QAAQ,CAAS;IAEzB,YAAY,WAAmB,KAAK;QAClC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,UAAkB,EAAE,KAAa,EAAE,OAAe,CAAC;QAK5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;QAExC,sBAAsB;QACtB,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC;QAED,uCAAuC;QACvC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC;QAEnE,0DAA0D;QAC1D,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;YAC3C,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5C,MAAM,UAAU,GAAG,eAAe;gBAChC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,eAAe,GAAG,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;gBAC3D,CAAC,CAAC,CAAC,CAAC;YAEN,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;gBACvD,UAAU;aACX,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM;SAC3C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;QAExC,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACvD,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC;YACnE,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,iBAAiB,GAA2B;IAChD,IAAI,EAAE,EAAE;IACR,GAAG,EAAE,GAAG;IACR,GAAG,EAAE,GAAG;IACR,KAAK,EAAE,MAAM;CACd,CAAC;AAEF;;;GAGG;AACH,MAAM,YAAY,GAAG;IACnB,SAAS;IACT,eAAe;IACf,eAAe;IACf,OAAO;IACP,WAAW;IACX,QAAQ;IACR,UAAU;IACV,cAAc;IACd,WAAW;CACZ,CAAC;AAEF,MAAM,UAAU,yBAAyB,CAAC,OAAoB;IAC5D,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,IAAI,CAAC;YACH,wDAAwD;YACxD,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC3E,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,+CAA+C;YAC/C,iEAAiE;YACjE,oDAAoD;YACpD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACpD,MAAM,gBAAgB,GAAG,OAAO,YAAY,KAAK,QAAQ;gBACvD,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;gBACnC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAE9D,MAAM,QAAQ,GAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAY;mBACvD,gBAAgB;mBACf,GAAG,CAAC,OAAO,CAAC,WAAW,CAAY;mBACpC,GAAG,CAAC,EAAE;mBACN,SAAS,CAAC;YACf,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,QAAQ,CAAC;YAEtD,yEAAyE;YACzE,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAEhE,yEAAyE;YACzE,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,IAAI,GAAG,CAAC,CAAC;iBAC1D,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,IAAI,GAAG,CAAC,CAAC;iBACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAAE,IAAI,GAAG,CAAC,CAAC;iBAC3C,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAK,GAAG,CAAC,IAAY,EAAE,MAAM,KAAK,IAAI;gBAAE,IAAI,GAAG,CAAC,CAAC;YAErF,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAE3D,4BAA4B;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAErE,0CAA0C;YAC1C,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACjF,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC;YAE9D,mCAAmC;YACnC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,cAAc,GAAG,MAAM,CAAC,UAAW,CAAC;gBAC1C,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACxD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC;gBACtC,MAAM,WAAW,GAAG,IAAI,KAAK,MAAM;oBACjC,CAAC,CAAC,8EAA8E;oBAChF,CAAC,CAAC,IAAI,KAAK,KAAK;wBAChB,CAAC,CAAC,+EAA+E;wBACjF,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,cAAc;wBACpB,OAAO,EAAE,+BAA+B,KAAK,mBAAmB,IAAI,wBAAwB,cAAc,IAAI;wBAC9G,IAAI,EAAE,eAAe,cAAc,YAAY,WAAW,EAAE;wBAC5D,IAAI,EAAE,8CAA8C;qBACrD;oBACD,QAAQ,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;iBACvC,CAAC,CAAC;gBACH,OAAO,CAAC,wCAAwC;YAClD,CAAC;YAED,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,sBAAsB;oBAC/B,IAAI,EAAE,gDAAgD;iBACvD;gBACD,QAAQ,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;aACvC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/middleware/url-validator.d.ts

@@ -1,16 +0,0 @@
-/**
- * URL validation middleware to prevent SSRF attacks
- * Validates URLs BEFORE any network request is made
- */
-/**
- * Validate URL to prevent SSRF attacks
- * Blocks localhost, private IPs, link-local addresses, and non-HTTP(S) protocols
- */
-export declare function validateUrlForSSRF(urlString: string): void;
-/**
- * SSRF Error class
- */
-export declare class SSRFError extends Error {
-    constructor(message: string);
-}
-//# sourceMappingURL=url-validator.d.ts.map

package/dist/server/middleware/url-validator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"url-validator.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/url-validator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAgC1D;AAED;;GAEG;AACH,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B"}

package/dist/server/middleware/url-validator.js

@@ -1,187 +0,0 @@
-/**
- * URL validation middleware to prevent SSRF attacks
- * Validates URLs BEFORE any network request is made
- */
-/**
- * Validate URL to prevent SSRF attacks
- * Blocks localhost, private IPs, link-local addresses, and non-HTTP(S) protocols
- */
-export function validateUrlForSSRF(urlString) {
-    // Parse URL
-    let url;
-    try {
-        url = new URL(urlString);
-    }
-    catch {
-        throw new Error('Invalid URL format');
-    }
-    // Only allow HTTP(S)
-    if (!['http:', 'https:'].includes(url.protocol)) {
-        throw new SSRFError('Cannot fetch localhost, private networks, or non-HTTP URLs');
-    }
-    const hostname = url.hostname.toLowerCase();
-    // Block localhost patterns
-    const localhostPatterns = ['localhost', '0.0.0.0'];
-    if (localhostPatterns.some(pattern => hostname === pattern || hostname.endsWith('.' + pattern))) {
-        throw new SSRFError('Cannot fetch localhost, private networks, or non-HTTP URLs');
-    }
-    // Parse and validate IP addresses
-    const ipv4Info = parseIPv4(hostname);
-    if (ipv4Info) {
-        validateIPv4ForSSRF(ipv4Info);
-    }
-    // Validate IPv6
-    if (hostname.includes(':')) {
-        validateIPv6ForSSRF(hostname);
-    }
-}
-/**
- * SSRF Error class
- */
-export class SSRFError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'SSRFError';
-    }
-}
-/**
- * Parse IPv4 address in any format (dotted, hex, octal, decimal)
- */
-function parseIPv4(hostname) {
-    const cleaned = hostname.replace(/^\[|\]$/g, '');
-    // Standard dotted notation: 192.168.1.1
-    const dottedRegex = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
-    const dottedMatch = cleaned.match(dottedRegex);
-    if (dottedMatch) {
-        const octets = dottedMatch.slice(1).map(Number);
-        if (octets.every(o => o >= 0 && o <= 255)) {
-            return octets;
-        }
-        throw new SSRFError('Cannot fetch localhost, private networks, or non-HTTP URLs');
-    }
-    // Hex notation: 0x7f000001
-    if (/^0x[0-9a-fA-F]+$/.test(cleaned)) {
-        const num = parseInt(cleaned, 16);
-        return [
-            (num >>> 24) & 0xff,
-            (num >>> 16) & 0xff,
-            (num >>> 8) & 0xff,
-            num & 0xff,
-        ];
-    }
-    // Octal notation
-    if (/^0[0-7]/.test(cleaned)) {
-        if (/^0[0-7]+$/.test(cleaned)) {
-            const num = parseInt(cleaned, 8);
-            if (num <= 0xffffffff) {
-                return [
-                    (num >>> 24) & 0xff,
-                    (num >>> 16) & 0xff,
-                    (num >>> 8) & 0xff,
-                    num & 0xff,
-                ];
-            }
-        }
-        const parts = cleaned.split('.');
-        if (parts.length === 4) {
-            const octets = parts.map(p => parseInt(p, /^0[0-7]/.test(p) ? 8 : 10));
-            if (octets.every(o => o >= 0 && o <= 255)) {
-                return octets;
-            }
-        }
-    }
-    // Decimal notation: 2130706433
-    if (/^\d+$/.test(cleaned)) {
-        const num = parseInt(cleaned, 10);
-        if (num <= 0xffffffff) {
-            return [
-                (num >>> 24) & 0xff,
-                (num >>> 16) & 0xff,
-                (num >>> 8) & 0xff,
-                num & 0xff,
-            ];
-        }
-    }
-    return null;
-}
-/**
- * Validate IPv4 address against private/reserved ranges
- */
-function validateIPv4ForSSRF(octets) {
-    const [a, b, c, d] = octets;
-    // Loopback: 127.0.0.0/8
-    if (a === 127) {
-        throw new SSRFError('Cannot fetch localhost, private networks, or non-HTTP URLs');
-    }
-    // Private: 10.0.0.0/8
-    if (a === 10) {
-        throw new SSRFError('Cannot fetch localhost, private networks, or non-HTTP URLs');
-    }
-    // Private: 172.16.0.0/12
-    if (a === 172 && b >= 16 && b <= 31) {
-        throw new SSRFError('Cannot fetch localhost, private networks, or non-HTTP URLs');
-    }
-    // Private: 192.168.0.0/16
-    if (a === 192 && b === 168) {
-        throw new SSRFError('Cannot fetch localhost, private networks, or non-HTTP URLs');
-    }
-    // Link-local: 169.254.0.0/16 (includes AWS metadata endpoint)
-    if (a === 169 && b === 254) {
-        throw new SSRFError('Cannot fetch localhost, private networks, or non-HTTP URLs');
-    }
-    // Broadcast: 255.255.255.255
-    if (a === 255 && b === 255 && c === 255 && d === 255) {
-        throw new SSRFError('Cannot fetch localhost, private networks, or non-HTTP URLs');
-    }
-    // This network: 0.0.0.0/8
-    if (a === 0) {
-        throw new SSRFError('Cannot fetch localhost, private networks, or non-HTTP URLs');
-    }
-}
-/**
- * Validate IPv6 address against private/reserved ranges
- */
-function validateIPv6ForSSRF(hostname) {
-    const addr = hostname.replace(/^\[|\]$/g, '').toLowerCase();
-    // Loopback: ::1
-    if (addr === '::1' || addr === '0:0:0:0:0:0:0:1') {
-        throw new SSRFError('Cannot fetch localhost, private networks, or non-HTTP URLs');
-    }
-    // IPv6 mapped IPv4: ::ffff:192.168.1.1
-    if (addr.startsWith('::ffff:')) {
-        const ipv4Part = addr.substring(7);
-        if (ipv4Part.includes('.')) {
-            const parts = ipv4Part.split('.');
-            if (parts.length === 4) {
-                const octets = parts.map(p => parseInt(p, 10));
-                if (octets.every(o => !isNaN(o) && o >= 0 && o <= 255)) {
-                    validateIPv4ForSSRF(octets);
-                }
-            }
-        }
-        else {
-            const hexStr = ipv4Part.replace(/:/g, '');
-            if (/^[0-9a-f]{1,8}$/.test(hexStr)) {
-                const num = parseInt(hexStr, 16);
-                const octets = [
-                    (num >>> 24) & 0xff,
-                    (num >>> 16) & 0xff,
-                    (num >>> 8) & 0xff,
-                    num & 0xff,
-                ];
-                validateIPv4ForSSRF(octets);
-            }
-        }
-        throw new SSRFError('Cannot fetch localhost, private networks, or non-HTTP URLs');
-    }
-    // Unique local addresses: fc00::/7
-    if (addr.startsWith('fc') || addr.startsWith('fd')) {
-        throw new SSRFError('Cannot fetch localhost, private networks, or non-HTTP URLs');
-    }
-    // Link-local: fe80::/10
-    if (addr.startsWith('fe8') || addr.startsWith('fe9') ||
-        addr.startsWith('fea') || addr.startsWith('feb')) {
-        throw new SSRFError('Cannot fetch localhost, private networks, or non-HTTP URLs');
-    }
-}
-//# sourceMappingURL=url-validator.js.map

package/dist/server/middleware/url-validator.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"url-validator.js","sourceRoot":"","sources":["../../../src/server/middleware/url-validator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,YAAY;IACZ,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,qBAAqB;IACrB,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE5C,2BAA2B;IAC3B,MAAM,iBAAiB,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACnD,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IAED,kCAAkC;IAClC,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,QAAQ,EAAE,CAAC;QACb,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,gBAAgB;IAChB,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAEjD,wCAAwC;IACxC,MAAM,WAAW,GAAG,8CAA8C,CAAC;IACnE,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IAED,2BAA2B;IAC3B,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAClC,OAAO;YACL,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI;YACnB,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI;YACnB,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI;YAClB,GAAG,GAAG,IAAI;SACX,CAAC;IACJ,CAAC;IAED,iBAAiB;IACjB,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACjC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;gBACtB,OAAO;oBACL,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI;oBACnB,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI;oBACnB,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI;oBAClB,GAAG,GAAG,IAAI;iBACX,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACvE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC1C,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;YACtB,OAAO;gBACL,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI;gBACnB,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI;gBACnB,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI;gBAClB,GAAG,GAAG,IAAI;aACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAgB;IAC3C,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;IAE5B,wBAAwB;IACxB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IAED,sBAAsB;IACtB,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IAED,0BAA0B;IAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IAED,8DAA8D;IAC9D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IAED,6BAA6B;IAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QACrD,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IAED,0BAA0B;IAC1B,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACZ,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAE5D,gBAAgB;IAChB,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IAED,uCAAuC;IACvC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEnC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC/C,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;oBACvD,mBAAmB,CAAC,MAAM,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1C,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACjC,MAAM,MAAM,GAAG;oBACb,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI;oBACnB,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI;oBACnB,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI;oBAClB,GAAG,GAAG,IAAI;iBACX,CAAC;gBACF,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IAED,mCAAmC;IACnC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IAED,wBAAwB;IACxB,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;AACH,CAAC"}