@lastshotlabs/slingshot-embeds
npm install @lastshotlabs/slingshot-embeds
Functions
Section titled “Functions”createEmbedsPlugin
Section titled “createEmbedsPlugin”Create the slingshot-embeds plugin for URL unfurling.
Returns a stateless plugin that exposes a POST /embeds/unfurl endpoint
(mount path is configurable). The endpoint accepts { url: string },
validates the URL against SSRF rules and domain lists, fetches the page
server-side, parses OG/meta tags, and returns structured metadata.
Results are cached in-memory with a configurable TTL.
function createEmbedsPlugin(rawConfig?: unknown): SlingshotPluginSource: packages/slingshot-embeds/src/plugin.ts
parseOgMetadata
Section titled “parseOgMetadata”Extract the <head> section from an HTML document.
Stops at </head> or <body to avoid scanning large document bodies.
Returns the full string if no <head> boundary is found.
function parseOgMetadata(html: string, pageUrl?: string): Partial<UnfurlResult>Source: packages/slingshot-embeds/src/lib/htmlParser.ts
unfurl
Section titled “unfurl”Default maximum number of redirects to follow before aborting.
async function unfurl(url: string, config: { timeoutMs: number; maxResponseBytes: number; maxRedirects?: number },): Promise<UnfurlResult>Source: packages/slingshot-embeds/src/lib/unfurl.ts
validateUrl
Section titled “validateUrl”SSRF (Server-Side Request Forgery) protection for URL unfurling.
Validates user-supplied URLs before they are fetched server-side. Blocks private/reserved IP ranges, non-HTTP protocols, and domain allow/block lists.
DNS rebinding protection is handled by resolveAndValidate, which
resolves the hostname to all its A/AAAA records before each fetch hop and
rejects any that resolve to private/reserved ranges. This prevents attacks
where a hostname initially resolves to a public IP but switches to a private
one between the SSRF check and the actual connection.
function validateUrl(url: string, config: { allowedDomains?: string[]; blockedDomains?: string[] },): ValidateUrlResultSource: packages/slingshot-embeds/src/lib/ssrfGuard.ts
Constants
Section titled “Constants”embedsPluginConfigSchema
Section titled “embedsPluginConfigSchema”Structured metadata extracted from a URL via OG/meta tag parsing.
All fields except url are optional because a target page may not
include any metadata tags.
Source: packages/slingshot-embeds/src/types.ts
Interfaces
Section titled “Interfaces”UnfurlResult
Section titled “UnfurlResult”Structured metadata extracted from a URL via OG/meta tag parsing.
All fields except url are optional because a target page may not
include any metadata tags.
Source: packages/slingshot-embeds/src/types.ts
EmbedsPluginConfig
Section titled “EmbedsPluginConfig”Structured metadata extracted from a URL via OG/meta tag parsing.
All fields except url are optional because a target page may not
include any metadata tags.
Source: packages/slingshot-embeds/src/types.ts