feat(validator): OTE validator, discovery package and fetcher Worker

[hhkaos]

Closes #60.

A public page that answers "is this document a valid OTE feed or event?" with nothing to install — the objective referee to link to from an issue instead of an argument.

What is here

Component	Role
apps/validator	The page. Three modes: URL, file upload, paste. Served at /validator/.
packages/discover-feed	Pure feed discovery: bytes + content-type + base URL → candidate feed URLs. No network.
workers/fetch-url	Cloudflare Worker, the only component with network access.

The first commit (refactor(feed-urls)) is pre-existing work that was sitting uncommitted in the working tree — the custom-domain URL logic extracted out of apps/publish into its own package. Kept separate so it can be reviewed on its own.

Decisions worth reviewing

• @opentechevents/validate reused verbatim. A validator holding a second opinion about validity would leave the format without a referee.
• Discovery and validation are two verdicts, never merged. A page with a typo'd <link> gets "no OTE feed discovered", not "invalid". A page declaring several feeds stops and asks rather than picking the first.
• MUST and SHOULD stay apart. Schema violations make a document invalid; unmet recommendations do not.
• Upload and paste never touch the network — verified by a test that deletes globalThis.fetch and validates a fixture anyway.
• Media type matching is lax while opentechevents-spec#6 is open: application/ote+json and application/feed+json both accepted, and the UI says which one was served.

SSRF

The Worker is a public endpoint that fetches whatever URL a stranger passes, so src/ssrf.ts is the point of the component: scheme allowlist, resolve first and judge the resolved IP (never the hostname — the attacker owns their DNS zone), per-hop revalidated redirects, no credentials forwarded, blocked non-HTTP ports, a 5 MB cap applied while streaming, timeouts and per-IP rate limiting.

Verified against the deployed Worker, not only in tests:

Probe	Result
file:///etc/passwd	blocked-scheme
http://169.254.169.254/latest/meta-data/	blocked-address
hostname resolving to 127.0.0.1	blocked-address
public URL redirecting to a private IP	blocked-address
50 MB response	cut at the cap, never buffered

Known residual risk, documented: a Worker cannot pin a connection to the IP it validated, so DNS rebinding is not fully excluded.

Two traps unit tests cannot catch

Both were found only by loading the real page, and both are commented at the call site:

1. Passing the global fetch by reference throws Illegal invocation in a browser and in the Workers runtime. Node tolerates it, so 63 tests passed against code that could not make a single request.
2. ajv compiles schemas with new Function, so the page CSP needs 'unsafe-eval'; without it the module throws at import and the page silently registers no listeners. boot-errors.js now makes that state announce itself. The durable fix is build-time standalone validators, which would let the CSP drop 'unsafe-eval'.

Deployment state

• Worker deployed: https://ote-fetch-url.hhkaos.workers.dev, plus the fetch.opentechevents.org custom domain, declared in wrangler.jsonc (live once the .org delegation to Cloudflare lands).
• OTE_FETCH_ENDPOINT repository variable points the page at the Worker; deploy-tools.yml bakes it into both the bundle and the CSP connect-src, so the two cannot drift.
• localhost:8000 is currently in the Worker's CORS allowlist for local development — say the word and it comes out.

Checks

pnpm install --frozen-lockfile, lint, build, typecheck and the full suite (1066 tests across 18 projects) pass on this branch. Both commits are independently installable — the lockfile was regenerated for each.

🤖 Generated with Claude Code