Allow integrations to parse XML responses with fast-xml-parser

[aisstephane]

Integration scripts run in a sandboxed runner that only allows a fixed set of npm packages (currently url, crypto, nango, zod, unzipper, soap, botbuilder). Today there's no allowlisted way to parse an XML response inside a sync or action, so any provider whose API returns XML can't be handled cleanly from a template.

fast-xml-parser is already a dependency in the repo (pinned to 5.5.9 in server, shared, cli, and runner), so this doesn't pull in anything new. It just needs to be added to the integration runtime allowlist so scripts can do import { XMLParser } from 'fast-xml-parser'.

Use case

Netvisor's API returns XML rather than JSON. Parsing those responses from a sync/action is currently blocked by the allowlist.

Proposed change

Add fast-xml-parser to the allowlist in the four places a runtime package has to be registered, mirroring how soap and unzipper are already wired up:

• packages/cli/lib/zeroYaml/constants.ts (allowedPackages)
• packages/cli/lib/services/compile.service.ts (ALLOWED_IMPORTS)
• packages/cli/lib/services/dryrun.service.ts (require shim)
• packages/runner/lib/exec.ts (require shim)

This is being implemented alongside the Netvisor integration.

[linear-code]

NAN-5787

[ryanmettler]

Happy to take this on if it's still open — it's unblocked, well-specified work and a clean first contribution for me.

One correction from scoping it against the code: fast-xml-parser (5.5.9) is currently only in packages/server and packages/shared, not in packages/cli or packages/runner — so I'd add it as a dependency in those two and register it the same way unzipper is exposed in the require allowlist (a static import returned from the shim in runner/lib/exec.ts and cli/…/dryrun.service.ts, plus the two compile allowlists ALLOWED_IMPORTS and allowedPackages). I'd pin 5.5.9 to match server/shared.

Is the Netvisor integration this was filed alongside still in flight, or is the allowlist piece free to take on its own? Happy to scope it to just the allowlist change so Netvisor can land separately.