@dnsid-ai/transport 0.26.0 → 0.27.0

package/dist/index.cjs

@@ -46,6 +46,7 @@ var fs = __toESM(require("fs"), 1);
 var https = __toESM(require("https"), 1);
 var net2 = __toESM(require("net"), 1);
 var tls = __toESM(require("tls"), 1);
+var import_node_stream = require("stream");
 var import_undici = require("undici");
 var import_protocol2 = require("@dnsid-ai/protocol");
 
@@ -190,7 +191,8 @@ function createSsrfSafeFetch(config = {}, options = {}) {
   const privateAddressHosts = (options.privateAddressHosts ?? []).map(import_protocol2.normalizePrivateAddressHost);
   const connect2 = { lookup: createSsrfSafeLookup(config.dnsServer, privateAddressHosts) };
   if (config.caBundlePath) connect2.ca = [...tls.rootCertificates, fs.readFileSync(config.caBundlePath, "utf8")];
-  const fetchWithSafeLookup = createFetchWithDispatcher(new import_undici.Agent({ connect: connect2 }));
+  const dispatcher = new import_undici.Agent({ connect: connect2 });
+  const fetchWithSafeLookup = createFetchWithDispatcher(dispatcher);
   return async (input, init) => {
     const url = new URL(input instanceof Request ? input.url : input);
     if (isUnsafeIp(url.hostname)) {
@@ -198,6 +200,26 @@ function createSsrfSafeFetch(config = {}, options = {}) {
         code: import_protocol2.VerificationCode.TLSError
       });
     }
+    if (options.decompress === false) {
+      const { url: target, init: normalized } = normalizeFetchArgs(input, { ...init, redirect: "manual" });
+      const request = new Request(target, normalized);
+      const targetUrl = new URL(request.url);
+      const response = await dispatcher.request({
+        origin: targetUrl.origin,
+        path: targetUrl.pathname + targetUrl.search,
+        method: request.method,
+        headers: Object.fromEntries(request.headers),
+        body: request.body ? import_node_stream.Readable.fromWeb(request.body) : void 0,
+        signal: request.signal
+      });
+      const headers = new Headers();
+      for (const [name, value] of Object.entries(response.headers)) {
+        for (const item of Array.isArray(value) ? value : value === void 0 ? [] : [value]) headers.append(name, item);
+      }
+      const noBody = request.method === "HEAD" || [204, 205, 304].includes(response.statusCode);
+      if (noBody) await response.body.dump();
+      return new Response(noBody ? null : import_node_stream.Readable.toWeb(response.body), { status: response.statusCode, statusText: response.statusText, headers });
+    }
     return fetchWithSafeLookup(input, { ...init, redirect: "manual" });
   };
 }

package/dist/index.d.cts

@@ -33,6 +33,8 @@ interface HTTPSFetchOptions {
 
 /** Explicit exceptions for trusted test/private deployments using {@link createSsrfSafeFetch}. */
 interface SsrfSafeFetchOptions {
+    /** Set false to preserve encoded response bytes and Content-Encoding, for signed-directory verification. Default: true. */
+    decompress?: boolean;
     /**
      * Hostnames, or leading-dot suffixes such as `.test`, whose resolved RFC 1918/ULA private or
      * loopback addresses may be contacted. Link-local and other unsafe ranges remain blocked, IP-literal

package/dist/index.d.ts

@@ -33,6 +33,8 @@ interface HTTPSFetchOptions {
 
 /** Explicit exceptions for trusted test/private deployments using {@link createSsrfSafeFetch}. */
 interface SsrfSafeFetchOptions {
+    /** Set false to preserve encoded response bytes and Content-Encoding, for signed-directory verification. Default: true. */
+    decompress?: boolean;
     /**
      * Hostnames, or leading-dot suffixes such as `.test`, whose resolved RFC 1918/ULA private or
      * loopback addresses may be contacted. Link-local and other unsafe ranges remain blocked, IP-literal

package/dist/index.js

@@ -4,6 +4,7 @@ import * as fs from "fs";
 import * as https from "https";
 import * as net2 from "net";
 import * as tls from "tls";
+import { Readable } from "stream";
 import { Agent as Agent2, fetch as undiciFetch } from "undici";
 import { ArgumentError, DNSSECState as DNSSECState2, VerificationCode, VerificationError, normalizePrivateAddressHost } from "@dnsid-ai/protocol";
 
@@ -148,7 +149,8 @@ function createSsrfSafeFetch(config = {}, options = {}) {
   const privateAddressHosts = (options.privateAddressHosts ?? []).map(normalizePrivateAddressHost);
   const connect2 = { lookup: createSsrfSafeLookup(config.dnsServer, privateAddressHosts) };
   if (config.caBundlePath) connect2.ca = [...tls.rootCertificates, fs.readFileSync(config.caBundlePath, "utf8")];
-  const fetchWithSafeLookup = createFetchWithDispatcher(new Agent2({ connect: connect2 }));
+  const dispatcher = new Agent2({ connect: connect2 });
+  const fetchWithSafeLookup = createFetchWithDispatcher(dispatcher);
   return async (input, init) => {
     const url = new URL(input instanceof Request ? input.url : input);
     if (isUnsafeIp(url.hostname)) {
@@ -156,6 +158,26 @@ function createSsrfSafeFetch(config = {}, options = {}) {
         code: VerificationCode.TLSError
       });
     }
+    if (options.decompress === false) {
+      const { url: target, init: normalized } = normalizeFetchArgs(input, { ...init, redirect: "manual" });
+      const request = new Request(target, normalized);
+      const targetUrl = new URL(request.url);
+      const response = await dispatcher.request({
+        origin: targetUrl.origin,
+        path: targetUrl.pathname + targetUrl.search,
+        method: request.method,
+        headers: Object.fromEntries(request.headers),
+        body: request.body ? Readable.fromWeb(request.body) : void 0,
+        signal: request.signal
+      });
+      const headers = new Headers();
+      for (const [name, value] of Object.entries(response.headers)) {
+        for (const item of Array.isArray(value) ? value : value === void 0 ? [] : [value]) headers.append(name, item);
+      }
+      const noBody = request.method === "HEAD" || [204, 205, 304].includes(response.statusCode);
+      if (noBody) await response.body.dump();
+      return new Response(noBody ? null : Readable.toWeb(response.body), { status: response.statusCode, statusText: response.statusText, headers });
+    }
     return fetchWithSafeLookup(input, { ...init, redirect: "manual" });
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dnsid-ai/transport",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "Node.js DNS and HTTPS transport implementations for DNSid.",
   "type": "module",
   "types": "./dist/index.d.ts",
@@ -38,7 +38,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@dnsid-ai/protocol": "^0.26.0",
+    "@dnsid-ai/protocol": "^0.27.0",
     "dns-packet": "5.6.1",
     "undici": "^8.11.0"
   },