@dnsid-ai/sdk 0.21.0 → 0.22.0

package/dist/node.cjs

@@ -318,6 +318,7 @@ var dnsidEnvironmentVariables = {
   kuUrl: "DNSID_KU_URL",
   dnsServer: "DNSID_DNS_SERVER",
   caBundlePath: "DNSID_CA_BUNDLE",
+  privateAddressHosts: "DNSID_PRIVATE_HOSTS",
   dnssecMode: "DNSID_DNSSEC_MODE",
   publicUrl: "DNSID_PUBLIC_URL",
   keyStorePath: "DNSID_KEY_STORE",
@@ -335,6 +336,7 @@ var environmentSchema = {
   kuUrl: stringField(dnsidEnvironmentVariables.kuUrl),
   dnsServer: stringField(dnsidEnvironmentVariables.dnsServer),
   caBundlePath: stringField(dnsidEnvironmentVariables.caBundlePath),
+  privateAddressHosts: listField(dnsidEnvironmentVariables.privateAddressHosts),
   dnssecMode: dnssecModeField(dnsidEnvironmentVariables.dnssecMode),
   publicUrl: stringField(dnsidEnvironmentVariables.publicUrl),
   keyStorePath: stringField(dnsidEnvironmentVariables.keyStorePath),
@@ -359,7 +361,7 @@ function configFromEnvironment(envOrOptions = process.env, options = {}) {
       kuUrl: parsed.kuUrl
     }),
     verification: defined({ dnssecMode: parsed.dnssecMode }),
-    transport: defined({ dnsServer: parsed.dnsServer, caBundlePath: parsed.caBundlePath })
+    transport: defined({ dnsServer: parsed.dnsServer, caBundlePath: parsed.caBundlePath, privateAddressHosts: parsed.privateAddressHosts })
   };
   return {
     config,
@@ -406,6 +408,15 @@ function requireFields(parsed, fields) {
 function stringField(variable) {
   return { variable, parse: (value) => value };
 }
+function listField(variable) {
+  return {
+    variable,
+    parse(value) {
+      const items = value.split(",").map((item) => item.trim()).filter(Boolean);
+      return items.length > 0 ? items : void 0;
+    }
+  };
+}
 function positiveIntField(variable) {
   return {
     variable,
@@ -436,18 +447,18 @@ function protocolStatusUrl(registryUrl, domain) {
 // src/node.ts
 async function createNodeIdentityManager(config, deps = {}) {
   const { transport, ...core } = (0, import_protocol3.validateDnsidConfig)(config);
-  const { dnsServer, caBundlePath, allowedUnsafeHosts } = transport;
+  const { dnsServer, caBundlePath, privateAddressHosts } = transport;
   if (dnsServer !== void 0 && deps.dnsResolver && deps.fetchJson) {
     throw new import_protocol3.ArgumentError("config.transport.dnsServer has no SDK-managed consumer when both dnsResolver and fetchJson are injected");
   }
   if (caBundlePath !== void 0 && deps.fetchJson) {
     throw new import_protocol3.ArgumentError("config.transport.caBundlePath has no SDK-managed consumer when fetchJson is injected");
   }
-  if (allowedUnsafeHosts !== void 0 && deps.fetchJson) {
-    throw new import_protocol3.ArgumentError("config.transport.allowedUnsafeHosts has no SDK-managed consumer when fetchJson is injected");
+  if (privateAddressHosts !== void 0 && deps.fetchJson) {
+    throw new import_protocol3.ArgumentError("config.transport.privateAddressHosts has no SDK-managed consumer when fetchJson is injected");
   }
   const transportModule = deps.fetchJson && deps.dnsResolver ? null : await loadNodeTransport();
-  const fetchJson = deps.fetchJson ?? ((url, fetchOptions) => transportModule.fetchJson(url, { ...fetchOptions, dnsServer, caBundlePath, allowedUnsafeHosts }));
+  const fetchJson = deps.fetchJson ?? ((url, fetchOptions) => transportModule.fetchJson(url, { ...fetchOptions, dnsServer, caBundlePath, privateAddressHosts }));
   const dnsResolver = deps.dnsResolver ?? transportModule.createDefaultDnsResolver({ dnsServer });
   return new import_protocol3.IdentityManager(core, { ...deps, dnsResolver, fetchJson });
 }

package/dist/node.d.cts

@@ -61,6 +61,7 @@ declare const dnsidEnvironmentVariables: {
     readonly kuUrl: "DNSID_KU_URL";
     readonly dnsServer: "DNSID_DNS_SERVER";
     readonly caBundlePath: "DNSID_CA_BUNDLE";
+    readonly privateAddressHosts: "DNSID_PRIVATE_HOSTS";
     readonly dnssecMode: "DNSID_DNSSEC_MODE";
     readonly publicUrl: "DNSID_PUBLIC_URL";
     readonly keyStorePath: "DNSID_KEY_STORE";
@@ -85,6 +86,7 @@ declare const environmentSchema: {
     kuUrl: EnvironmentField<string>;
     dnsServer: EnvironmentField<string>;
     caBundlePath: EnvironmentField<string>;
+    privateAddressHosts: EnvironmentField<string[] | undefined>;
     dnssecMode: EnvironmentField<DNSSECMode>;
     publicUrl: EnvironmentField<string>;
     keyStorePath: EnvironmentField<string>;
@@ -155,7 +157,7 @@ interface CreateNodeIdentityManagerFromDnsidOptions {
  *
  * `config.transport` configures only the SDK-managed defaults: `dnsServer` applies to whichever of
  * `dnsResolver`/`fetchJson` is not injected and is rejected when both are; `caBundlePath` and
- * `allowedUnsafeHosts` apply to the default fetcher and are rejected when `fetchJson` is injected. Injected dependencies are never
+ * `privateAddressHosts` apply to the default fetcher and are rejected when `fetchJson` is injected. Injected dependencies are never
  * inspected or modified. `@dnsid-ai/transport` is an optional peer; install it or inject both
  * dependencies. The system resolver reports `UNKNOWN`; `validated`/`required` DNSSEC modes need a
  * DNSSEC-aware resolver.

package/dist/node.d.ts

@@ -61,6 +61,7 @@ declare const dnsidEnvironmentVariables: {
     readonly kuUrl: "DNSID_KU_URL";
     readonly dnsServer: "DNSID_DNS_SERVER";
     readonly caBundlePath: "DNSID_CA_BUNDLE";
+    readonly privateAddressHosts: "DNSID_PRIVATE_HOSTS";
     readonly dnssecMode: "DNSID_DNSSEC_MODE";
     readonly publicUrl: "DNSID_PUBLIC_URL";
     readonly keyStorePath: "DNSID_KEY_STORE";
@@ -85,6 +86,7 @@ declare const environmentSchema: {
     kuUrl: EnvironmentField<string>;
     dnsServer: EnvironmentField<string>;
     caBundlePath: EnvironmentField<string>;
+    privateAddressHosts: EnvironmentField<string[] | undefined>;
     dnssecMode: EnvironmentField<DNSSECMode>;
     publicUrl: EnvironmentField<string>;
     keyStorePath: EnvironmentField<string>;
@@ -155,7 +157,7 @@ interface CreateNodeIdentityManagerFromDnsidOptions {
  *
  * `config.transport` configures only the SDK-managed defaults: `dnsServer` applies to whichever of
  * `dnsResolver`/`fetchJson` is not injected and is rejected when both are; `caBundlePath` and
- * `allowedUnsafeHosts` apply to the default fetcher and are rejected when `fetchJson` is injected. Injected dependencies are never
+ * `privateAddressHosts` apply to the default fetcher and are rejected when `fetchJson` is injected. Injected dependencies are never
  * inspected or modified. `@dnsid-ai/transport` is an optional peer; install it or inject both
  * dependencies. The system resolver reports `UNKNOWN`; `validated`/`required` DNSSEC modes need a
  * DNSSEC-aware resolver.

package/dist/node.js

@@ -277,6 +277,7 @@ var dnsidEnvironmentVariables = {
   kuUrl: "DNSID_KU_URL",
   dnsServer: "DNSID_DNS_SERVER",
   caBundlePath: "DNSID_CA_BUNDLE",
+  privateAddressHosts: "DNSID_PRIVATE_HOSTS",
   dnssecMode: "DNSID_DNSSEC_MODE",
   publicUrl: "DNSID_PUBLIC_URL",
   keyStorePath: "DNSID_KEY_STORE",
@@ -294,6 +295,7 @@ var environmentSchema = {
   kuUrl: stringField(dnsidEnvironmentVariables.kuUrl),
   dnsServer: stringField(dnsidEnvironmentVariables.dnsServer),
   caBundlePath: stringField(dnsidEnvironmentVariables.caBundlePath),
+  privateAddressHosts: listField(dnsidEnvironmentVariables.privateAddressHosts),
   dnssecMode: dnssecModeField(dnsidEnvironmentVariables.dnssecMode),
   publicUrl: stringField(dnsidEnvironmentVariables.publicUrl),
   keyStorePath: stringField(dnsidEnvironmentVariables.keyStorePath),
@@ -318,7 +320,7 @@ function configFromEnvironment(envOrOptions = process.env, options = {}) {
       kuUrl: parsed.kuUrl
     }),
     verification: defined({ dnssecMode: parsed.dnssecMode }),
-    transport: defined({ dnsServer: parsed.dnsServer, caBundlePath: parsed.caBundlePath })
+    transport: defined({ dnsServer: parsed.dnsServer, caBundlePath: parsed.caBundlePath, privateAddressHosts: parsed.privateAddressHosts })
   };
   return {
     config,
@@ -365,6 +367,15 @@ function requireFields(parsed, fields) {
 function stringField(variable) {
   return { variable, parse: (value) => value };
 }
+function listField(variable) {
+  return {
+    variable,
+    parse(value) {
+      const items = value.split(",").map((item) => item.trim()).filter(Boolean);
+      return items.length > 0 ? items : void 0;
+    }
+  };
+}
 function positiveIntField(variable) {
   return {
     variable,
@@ -395,18 +406,18 @@ function protocolStatusUrl(registryUrl, domain) {
 // src/node.ts
 async function createNodeIdentityManager(config, deps = {}) {
   const { transport, ...core } = validateDnsidConfig(config);
-  const { dnsServer, caBundlePath, allowedUnsafeHosts } = transport;
+  const { dnsServer, caBundlePath, privateAddressHosts } = transport;
   if (dnsServer !== void 0 && deps.dnsResolver && deps.fetchJson) {
     throw new ArgumentError2("config.transport.dnsServer has no SDK-managed consumer when both dnsResolver and fetchJson are injected");
   }
   if (caBundlePath !== void 0 && deps.fetchJson) {
     throw new ArgumentError2("config.transport.caBundlePath has no SDK-managed consumer when fetchJson is injected");
   }
-  if (allowedUnsafeHosts !== void 0 && deps.fetchJson) {
-    throw new ArgumentError2("config.transport.allowedUnsafeHosts has no SDK-managed consumer when fetchJson is injected");
+  if (privateAddressHosts !== void 0 && deps.fetchJson) {
+    throw new ArgumentError2("config.transport.privateAddressHosts has no SDK-managed consumer when fetchJson is injected");
   }
   const transportModule = deps.fetchJson && deps.dnsResolver ? null : await loadNodeTransport();
-  const fetchJson = deps.fetchJson ?? ((url, fetchOptions) => transportModule.fetchJson(url, { ...fetchOptions, dnsServer, caBundlePath, allowedUnsafeHosts }));
+  const fetchJson = deps.fetchJson ?? ((url, fetchOptions) => transportModule.fetchJson(url, { ...fetchOptions, dnsServer, caBundlePath, privateAddressHosts }));
   const dnsResolver = deps.dnsResolver ?? transportModule.createDefaultDnsResolver({ dnsServer });
   return new IdentityManager(core, { ...deps, dnsResolver, fetchJson });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dnsid-ai/sdk",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Runtime-neutral DNSid SDK entrypoint with optional Node.js convenience helpers.",
   "type": "module",
   "types": "./dist/index.d.ts",
@@ -39,15 +39,15 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@dnsid-ai/protocol": "^0.21.0",
-    "@dnsid-ai/http-signatures": "^0.21.0",
-    "@dnsid-ai/jose": "^0.21.0",
-    "@dnsid-ai/log-c2sp-tlog": "^0.21.0",
-    "@dnsid-ai/registry": "^0.21.0",
-    "@dnsid-ai/web-bot-auth": "^0.21.0"
+    "@dnsid-ai/protocol": "^0.22.0",
+    "@dnsid-ai/http-signatures": "^0.22.0",
+    "@dnsid-ai/jose": "^0.22.0",
+    "@dnsid-ai/log-c2sp-tlog": "^0.22.0",
+    "@dnsid-ai/registry": "^0.22.0",
+    "@dnsid-ai/web-bot-auth": "^0.22.0"
   },
   "peerDependencies": {
-    "@dnsid-ai/transport": "^0.21.0"
+    "@dnsid-ai/transport": "^0.22.0"
   },
   "peerDependenciesMeta": {
     "@dnsid-ai/transport": {