v1.14.0

Minor Changes

• 77bc5ee: safeFetch's timeoutMs now also bounds the answer's body, as a limit on how long it may go silent (IN-36). Up to the headers it is one budget per attempt, shared by the lookup and every redirect hop instead of starting again at each hop. Once the headers are in, each read of the body may wait timeoutMs for the next chunk: an answer that starts and then stalls ends as NodeError('TIMEOUT') in whatever reads it — readArrayBuffer, readText, readJsonOrText or the response's own text()/json() — and its connection is closed; until now it held the step until the run was cancelled. A download that keeps arriving is not cut off, however long it takes in total. A cancellation during the answer still ends it as the cancellation. The response safeFetch returns is now a copy of the runtime's, with the same status, headers and url. timeoutConfigField's description says what the setting covers to the workflow author.
• f608870: New exports for a connection safeFetch does not make (PO-698). guardedLookup(port, options) is a socket lookup, shaped like net.LookupFunction, that judges every address a name resolves to by the rule safeFetch connects under: one private or reserved answer refuses the name with BLOCKED_ADDRESS, an address on the run's allow-list passes for its port, the refusal is logged for the operator, and an approved name answers every address so a socket can fall back from one to the next. The caller may choose the refusal's words (refusal), refuse listed addresses for a client a VPN route cannot carry (unroutable) and name the log line's noun (noun). guardRelaxedForLocalDev() is the RVNXX_SSRF_ALLOW_PRIVATE switch as every part of the guard reads it, announced once per process. safeFetch's own dispatcher now runs on the same judgement; what it refuses and how it says so are unchanged. The switch's one-time warning now reads "allowing private/loopback targets for web requests and connections" instead of "fetch targets".
• e965f51: rvnxx-nodes manifest now stops when a node carries a name the registry would refuse on upload, before it writes dist/manifest.json (PO-744). That covers the slug, the version, a port's name, sourceFromConfig and fallback name, and a setting's key, dependsOn, showIf key and credentialType, nested settings included. Each refused value is printed with its node, the field's path and the pattern; until now such a package built, tested and previewed green and failed only on upload with a 422. A port called notFound is the usual case: a setting may be camelCase, a port name must be kebab-case (not-found). This is an error rather than a warning, because the registry already refuses these names: none of the 364 nodes in the 25 node packages, checked against their local builds, trips it. The check is exported as nodeManifestProblems, and the four patterns as SLUG_PATTERN, NAMESPACED_SLUG_PATTERN, SEMVER_PATTERN and CONFIG_KEY_PATTERN, in the registry schema's own text.