@dnsid-ai/transport 0.26.0 → 0.28.0

package/dist/index.cjs

@@ -46,6 +46,7 @@ var fs = __toESM(require("fs"), 1);
 var https = __toESM(require("https"), 1);
 var net2 = __toESM(require("net"), 1);
 var tls = __toESM(require("tls"), 1);
+var import_node_stream = require("stream");
 var import_undici = require("undici");
 var import_protocol2 = require("@dnsid-ai/protocol");
 
@@ -190,7 +191,8 @@ function createSsrfSafeFetch(config = {}, options = {}) {
   const privateAddressHosts = (options.privateAddressHosts ?? []).map(import_protocol2.normalizePrivateAddressHost);
   const connect2 = { lookup: createSsrfSafeLookup(config.dnsServer, privateAddressHosts) };
   if (config.caBundlePath) connect2.ca = [...tls.rootCertificates, fs.readFileSync(config.caBundlePath, "utf8")];
-  const fetchWithSafeLookup = createFetchWithDispatcher(new import_undici.Agent({ connect: connect2 }));
+  const dispatcher = new import_undici.Agent({ connect: connect2 });
+  const fetchWithSafeLookup = createFetchWithDispatcher(dispatcher);
   return async (input, init) => {
     const url = new URL(input instanceof Request ? input.url : input);
     if (isUnsafeIp(url.hostname)) {
@@ -198,6 +200,49 @@ function createSsrfSafeFetch(config = {}, options = {}) {
         code: import_protocol2.VerificationCode.TLSError
       });
     }
+    if (options.decompress === false) {
+      const { url: target, init: normalized } = normalizeFetchArgs(input, { ...init, redirect: "manual" });
+      const request = new Request(target, normalized);
+      const targetUrl = new URL(request.url);
+      const response = await dispatcher.request({
+        origin: targetUrl.origin,
+        path: targetUrl.pathname + targetUrl.search,
+        method: request.method,
+        headers: Object.fromEntries(request.headers),
+        body: request.body ? import_node_stream.Readable.fromWeb(request.body) : void 0,
+        signal: request.signal
+      });
+      const headers = new Headers();
+      for (const [name, value] of Object.entries(response.headers)) {
+        for (const item of Array.isArray(value) ? value : value === void 0 ? [] : [value]) headers.append(name, item);
+      }
+      const noBody = request.method === "HEAD" || [204, 205, 304].includes(response.statusCode);
+      let body = null;
+      if (noBody) await response.body.dump();
+      else {
+        const iterator = response.body[Symbol.asyncIterator]();
+        let canceled = false;
+        response.body.on("error", () => {
+        });
+        body = new ReadableStream({
+          async pull(controller) {
+            try {
+              const { value, done } = await iterator.next();
+              if (canceled) return;
+              if (done) controller.close();
+              else controller.enqueue(new Uint8Array(value));
+            } catch (error) {
+              if (!canceled) controller.error(error);
+            }
+          },
+          cancel() {
+            canceled = true;
+            response.body.destroy();
+          }
+        });
+      }
+      return new Response(body, { status: response.statusCode, statusText: response.statusText, headers });
+    }
     return fetchWithSafeLookup(input, { ...init, redirect: "manual" });
   };
 }
@@ -501,7 +546,8 @@ function fetchWithRedirects(url, opts, depth) {
       signal: opts.signal,
       rejectUnauthorized: true,
       headers: {
-        "User-Agent": DNSID_USER_AGENT
+        "User-Agent": DNSID_USER_AGENT,
+        ...opts.revalidate ? { "Cache-Control": "no-cache" } : {}
       },
       lookup: createSsrfSafeLookup(opts.dnsServer, (opts.privateAddressHosts ?? []).map(import_protocol2.normalizePrivateAddressHost))
     };

package/dist/index.d.cts

@@ -13,6 +13,8 @@ interface FetchResult {
 }
 /** Options controlling {@link fetchJson}. */
 interface HTTPSFetchOptions {
+    /** Bypass local caches and revalidate upstream evidence. */
+    revalidate?: boolean;
     /** Shared verification deadline/cancellation, including redirects. */
     signal?: AbortSignal;
     /** If set, the URL host (and every redirect host) must match this host exactly. */
@@ -33,6 +35,8 @@ interface HTTPSFetchOptions {
 
 /** Explicit exceptions for trusted test/private deployments using {@link createSsrfSafeFetch}. */
 interface SsrfSafeFetchOptions {
+    /** Set false to preserve encoded response bytes and Content-Encoding, for signed-directory verification. Default: true. */
+    decompress?: boolean;
     /**
      * Hostnames, or leading-dot suffixes such as `.test`, whose resolved RFC 1918/ULA private or
      * loopback addresses may be contacted. Link-local and other unsafe ranges remain blocked, IP-literal

package/dist/index.d.ts

@@ -13,6 +13,8 @@ interface FetchResult {
 }
 /** Options controlling {@link fetchJson}. */
 interface HTTPSFetchOptions {
+    /** Bypass local caches and revalidate upstream evidence. */
+    revalidate?: boolean;
     /** Shared verification deadline/cancellation, including redirects. */
     signal?: AbortSignal;
     /** If set, the URL host (and every redirect host) must match this host exactly. */
@@ -33,6 +35,8 @@ interface HTTPSFetchOptions {
 
 /** Explicit exceptions for trusted test/private deployments using {@link createSsrfSafeFetch}. */
 interface SsrfSafeFetchOptions {
+    /** Set false to preserve encoded response bytes and Content-Encoding, for signed-directory verification. Default: true. */
+    decompress?: boolean;
     /**
      * Hostnames, or leading-dot suffixes such as `.test`, whose resolved RFC 1918/ULA private or
      * loopback addresses may be contacted. Link-local and other unsafe ranges remain blocked, IP-literal

package/dist/index.js

@@ -4,6 +4,7 @@ import * as fs from "fs";
 import * as https from "https";
 import * as net2 from "net";
 import * as tls from "tls";
+import { Readable } from "stream";
 import { Agent as Agent2, fetch as undiciFetch } from "undici";
 import { ArgumentError, DNSSECState as DNSSECState2, VerificationCode, VerificationError, normalizePrivateAddressHost } from "@dnsid-ai/protocol";
 
@@ -148,7 +149,8 @@ function createSsrfSafeFetch(config = {}, options = {}) {
   const privateAddressHosts = (options.privateAddressHosts ?? []).map(normalizePrivateAddressHost);
   const connect2 = { lookup: createSsrfSafeLookup(config.dnsServer, privateAddressHosts) };
   if (config.caBundlePath) connect2.ca = [...tls.rootCertificates, fs.readFileSync(config.caBundlePath, "utf8")];
-  const fetchWithSafeLookup = createFetchWithDispatcher(new Agent2({ connect: connect2 }));
+  const dispatcher = new Agent2({ connect: connect2 });
+  const fetchWithSafeLookup = createFetchWithDispatcher(dispatcher);
   return async (input, init) => {
     const url = new URL(input instanceof Request ? input.url : input);
     if (isUnsafeIp(url.hostname)) {
@@ -156,6 +158,49 @@ function createSsrfSafeFetch(config = {}, options = {}) {
         code: VerificationCode.TLSError
       });
     }
+    if (options.decompress === false) {
+      const { url: target, init: normalized } = normalizeFetchArgs(input, { ...init, redirect: "manual" });
+      const request = new Request(target, normalized);
+      const targetUrl = new URL(request.url);
+      const response = await dispatcher.request({
+        origin: targetUrl.origin,
+        path: targetUrl.pathname + targetUrl.search,
+        method: request.method,
+        headers: Object.fromEntries(request.headers),
+        body: request.body ? Readable.fromWeb(request.body) : void 0,
+        signal: request.signal
+      });
+      const headers = new Headers();
+      for (const [name, value] of Object.entries(response.headers)) {
+        for (const item of Array.isArray(value) ? value : value === void 0 ? [] : [value]) headers.append(name, item);
+      }
+      const noBody = request.method === "HEAD" || [204, 205, 304].includes(response.statusCode);
+      let body = null;
+      if (noBody) await response.body.dump();
+      else {
+        const iterator = response.body[Symbol.asyncIterator]();
+        let canceled = false;
+        response.body.on("error", () => {
+        });
+        body = new ReadableStream({
+          async pull(controller) {
+            try {
+              const { value, done } = await iterator.next();
+              if (canceled) return;
+              if (done) controller.close();
+              else controller.enqueue(new Uint8Array(value));
+            } catch (error) {
+              if (!canceled) controller.error(error);
+            }
+          },
+          cancel() {
+            canceled = true;
+            response.body.destroy();
+          }
+        });
+      }
+      return new Response(body, { status: response.statusCode, statusText: response.statusText, headers });
+    }
     return fetchWithSafeLookup(input, { ...init, redirect: "manual" });
   };
 }
@@ -459,7 +504,8 @@ function fetchWithRedirects(url, opts, depth) {
       signal: opts.signal,
       rejectUnauthorized: true,
       headers: {
-        "User-Agent": DNSID_USER_AGENT
+        "User-Agent": DNSID_USER_AGENT,
+        ...opts.revalidate ? { "Cache-Control": "no-cache" } : {}
       },
       lookup: createSsrfSafeLookup(opts.dnsServer, (opts.privateAddressHosts ?? []).map(normalizePrivateAddressHost))
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dnsid-ai/transport",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "Node.js DNS and HTTPS transport implementations for DNSid.",
   "type": "module",
   "types": "./dist/index.d.ts",
@@ -38,7 +38,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@dnsid-ai/protocol": "^0.26.0",
+    "@dnsid-ai/protocol": "^0.28.0",
     "dns-packet": "5.6.1",
     "undici": "^8.11.0"
   },