@drawbridge/drawbridge-utils 0.0.155 → 0.0.157

package/dist/axios.cjs

@@ -58,9 +58,14 @@ var isBlockedIPv4 = (ip) => {
   if (a >= 224) return true;
   return false;
 };
+var transition = new import_net.default.BlockList();
+transition.addSubnet("64:ff9b::", 96, "ipv6");
+transition.addSubnet("2002::", 16, "ipv6");
+transition.addSubnet("2001::", 32, "ipv6");
 var isBlockedIPv6 = (ip) => {
   const lower = ip.toLowerCase();
   if (lower === "::1" || lower === "::") return true;
+  if (transition.check(ip, "ipv6")) return true;
   if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
   if (/^fe[89ab]/.test(lower)) return true;
   if (lower.startsWith("ff")) return true;

package/dist/axios.d.cts

@@ -34,12 +34,26 @@ const isBlockedIPv4 = ( ip ) => {
 
 };
 
+// The IPv6 transition mechanisms each carry a v4 address inside the v6 one and
+// a gateway unwraps it, so 10.0.0.1 can arrive dressed as 64:ff9b::a00:1 and
+// pass a check that only knows the plain ranges. No merchant endpoint lives on
+// one — the public internet runs native v6 or v4 — so the three prefixes are
+// refused whole rather than unpacked. BlockList understands every textual form,
+// which the prefix comparisons below do not.
+const transition = new net.BlockList();
+
+transition.addSubnet( '64:ff9b::', 96, 'ipv6' );
+transition.addSubnet( '2002::', 16, 'ipv6' );
+transition.addSubnet( '2001::', 32, 'ipv6' );
+
 const isBlockedIPv6 = ( ip ) => {
 
 	const lower = ip.toLowerCase();
 
 	if( lower === '::1' || lower === '::' ) return true;
 
+	if( transition.check( ip, 'ipv6' ) ) return true;
+
 	// fc00::/7 — unique local addresses
 	if( lower.startsWith( 'fc' ) || lower.startsWith( 'fd' ) ) return true;
 

package/dist/axios.d.ts

@@ -34,12 +34,26 @@ const isBlockedIPv4 = ( ip ) => {
 
 };
 
+// The IPv6 transition mechanisms each carry a v4 address inside the v6 one and
+// a gateway unwraps it, so 10.0.0.1 can arrive dressed as 64:ff9b::a00:1 and
+// pass a check that only knows the plain ranges. No merchant endpoint lives on
+// one — the public internet runs native v6 or v4 — so the three prefixes are
+// refused whole rather than unpacked. BlockList understands every textual form,
+// which the prefix comparisons below do not.
+const transition = new net.BlockList();
+
+transition.addSubnet( '64:ff9b::', 96, 'ipv6' );
+transition.addSubnet( '2002::', 16, 'ipv6' );
+transition.addSubnet( '2001::', 32, 'ipv6' );
+
 const isBlockedIPv6 = ( ip ) => {
 
 	const lower = ip.toLowerCase();
 
 	if( lower === '::1' || lower === '::' ) return true;
 
+	if( transition.check( ip, 'ipv6' ) ) return true;
+
 	// fc00::/7 — unique local addresses
 	if( lower.startsWith( 'fc' ) || lower.startsWith( 'fd' ) ) return true;
 

package/dist/axios.js

@@ -23,9 +23,14 @@ var isBlockedIPv4 = (ip) => {
   if (a >= 224) return true;
   return false;
 };
+var transition = new net.BlockList();
+transition.addSubnet("64:ff9b::", 96, "ipv6");
+transition.addSubnet("2002::", 16, "ipv6");
+transition.addSubnet("2001::", 32, "ipv6");
 var isBlockedIPv6 = (ip) => {
   const lower = ip.toLowerCase();
   if (lower === "::1" || lower === "::") return true;
+  if (transition.check(ip, "ipv6")) return true;
   if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
   if (/^fe[89ab]/.test(lower)) return true;
   if (lower.startsWith("ff")) return true;

package/dist/connections/index.cjs

@@ -4867,9 +4867,14 @@ var isBlockedIPv4 = (ip) => {
   if (a >= 224) return true;
   return false;
 };
+var transition = new import_net.default.BlockList();
+transition.addSubnet("64:ff9b::", 96, "ipv6");
+transition.addSubnet("2002::", 16, "ipv6");
+transition.addSubnet("2001::", 32, "ipv6");
 var isBlockedIPv6 = (ip) => {
   const lower = ip.toLowerCase();
   if (lower === "::1" || lower === "::") return true;
+  if (transition.check(ip, "ipv6")) return true;
   if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
   if (/^fe[89ab]/.test(lower)) return true;
   if (lower.startsWith("ff")) return true;
@@ -4928,12 +4933,13 @@ var pinnedAgent = async (url) => {
 var safeRequest = async ({
   body,
   headers = {},
+  maxContentLength,
   method = "GET",
   query,
   timeout = DEFAULT_TIMEOUT_MS2,
   type = "json",
   url
-}) => {
+}, { transport = axios } = {}) => {
   const full = new URL(url);
   if (query) {
     Object.entries(query).forEach(([key, value]) => full.searchParams.set(key, value));
@@ -4941,7 +4947,7 @@ var safeRequest = async ({
   const { protocol, agent } = await pinnedAgent(full.toString());
   const isForm = type === "form";
   try {
-    const response = await axios({
+    const response = await transport({
       method,
       url: full.toString(),
       headers: {
@@ -4951,6 +4957,7 @@ var safeRequest = async ({
       ...body !== void 0 && {
         data: isForm ? new URLSearchParams(body).toString() : body
       },
+      ...maxContentLength !== void 0 && { maxContentLength },
       timeout,
       maxRedirects: 0,
       httpAgent: protocol === "http:" ? agent : void 0,
@@ -4973,6 +4980,19 @@ var safeRequest = async ({
 };
 
 // lib/connections/providers/webhook.js
+var RESPONSE_LIMIT = 64 * 1024;
+var signature = ({ body, settings }) => {
+  var _a;
+  const timestamp = Math.floor(Date.now() / 1e3);
+  const payload = timestamp + "." + JSON.stringify(body);
+  const previous = ((_a = settings.previous) == null ? void 0 : _a.secret) && new Date(settings.previous.until) > /* @__PURE__ */ new Date() ? [settings.previous.secret] : [];
+  return [
+    "t=" + timestamp,
+    ...[settings.secret, ...previous].map(
+      (secret) => "v1=" + import_node_crypto6.default.createHmac("sha256", secret).update(payload).digest("hex")
+    )
+  ].join(",");
+};
 var webhook_default = {
   // Connecting GENERATES the secret rather than storing one the merchant typed,
   // so the buttons say what actually happens.
@@ -5003,7 +5023,9 @@ var webhook_default = {
       "Press Connect. Drawbridge generates a signing secret and shows it here.",
       "Copy the secret into your own endpoint.",
       "Add a Send webhook step to a workflow and put your endpoint URL on it. The URL belongs to the step rather than the connection, so one connection can serve several endpoints.",
-      "On each request, compute HMAC-SHA256 of the raw body using the secret and compare it against the X-Drawbridge-Signature header before acting on the payload."
+      "On each request, read the X-Drawbridge-Signature header \u2014 `t=<unix seconds>,v1=<hex>` \u2014 and compute HMAC-SHA256 of `<t>.<raw request body>` with the secret. Use the raw bytes, not a re-serialised parse.",
+      "Compare your result against each v1 value with a constant-time comparison, and reject any request whose timestamp is more than five minutes old.",
+      "After you regenerate the secret, the previous one keeps signing for 24 hours (as a second v1), so update your endpoint within that window."
     ]
   },
   // Nothing to be exclusive with — there is no second webhook vendor, and a
@@ -5071,13 +5093,14 @@ var webhook_default = {
         const { headers = {}, method = "POST", url } = step.settings || {};
         const request2 = { method, url: url || null };
         if (!url) return { message: "Outgoing webhook URL is not configured for this step.", request: request2, response: { skipped: true }, skipped: true };
+        if (!/^https:\/\//i.test(url)) return { message: "Outgoing webhook URL must use https.", request: request2, response: { skipped: true }, skipped: true };
         const body = lead || context;
         request2.body = body;
         const outgoing = { ...headers };
         if (settings == null ? void 0 : settings.secret) {
-          outgoing["X-Drawbridge-Signature"] = "sha256=" + import_node_crypto6.default.createHmac("sha256", settings.secret).update(JSON.stringify(body)).digest("hex");
+          outgoing["X-Drawbridge-Signature"] = signature({ body, settings });
         }
-        const response = await send2({ body, headers: outgoing, method, url });
+        const response = await send2({ body, headers: outgoing, maxContentLength: RESPONSE_LIMIT, method, url });
         return { message: "Webhook POSTed to " + url + ".", request: request2, response: response || { delivered: true } };
       }
     }
@@ -5126,7 +5149,7 @@ var webhook_default = {
   // and a task repeating it talks over the button.
   tasks: ({ settings, status } = {}) => ["disconnected", "error"].includes(status) ? [] : (settings == null ? void 0 : settings.secret) ? [
     {
-      message: "Compute HMAC-SHA256( secret, body ) and compare against the X-Drawbridge-Signature header to confirm each payload.",
+      message: 'Compute HMAC-SHA256( secret, t + "." + raw body ) and constant-time compare it against a v1 in the X-Drawbridge-Signature header; reject timestamps older than five minutes.',
       title: "Requests must be verified",
       type: "warning"
     }

package/dist/connections/index.d.cts

@@ -1520,10 +1520,15 @@ const contacts = {
 			remove : async ( { email, id, token }, { fetcher } = {} ) => {
 
 				// NO TOKEN IS A NO-OP HERE, unlike sendgrid and twilio, and the
-				// difference is what the credential is declared to be: hubspotToken
-				// is the one provider field that is not `required`, because this is
-				// internal CRM tooling no merchant sees. A deployment with no portal
-				// is a supported state, not a missing credential.
+				// difference is what the credential is FOR: this is internal CRM
+				// tooling no merchant sees, so a deployment with no portal is a
+				// supported state rather than a missing credential.
+				//
+				// The manifest does mark hubspotToken `required`, and that is not a
+				// contradiction — the flag feeds `isLive` and nothing else, so it
+				// decides whether the admin card reads live. Not live is the honest
+				// badge when nothing will sync. It gates no behaviour, and
+				// saveProviderSettings never consults it, so the row still writes.
 				if( ! token ) return;
 
 				const contact = id || await lookup({ email, fetcher, token });
@@ -5867,6 +5872,39 @@ var shopify = {
 // Webhooks — the only connection with no third party behind it. Connecting
 // generates a signing secret rather than asking for a credential, which is why
 // its one field declares no `input`.
+
+// A receiver owes us a status, not a document. Whatever it returns is buffered
+// whole in the worker and written to the run record, so it is bounded.
+const RESPONSE_LIMIT = 64 * 1024;
+
+// STRIPE-SHAPED: `t=<unix seconds>,v1=<hex>[,v1=<hex>]`, over `<t>.<raw body>`.
+// The timestamp is INSIDE the signed string, so a captured delivery stops
+// verifying once the receiver's tolerance passes — signing the body alone made a
+// replay valid forever. A second v1 carries the previous secret while a
+// regeneration's grace window is open (the api stamps `previous.until`), so a
+// receiver still on the old value keeps verifying mid-rotation instead of
+// failing every delivery between the button press and their config change.
+const signature = ( { body, settings } ) => {
+
+	const timestamp = Math.floor( Date.now() / 1000 );
+
+	const payload = timestamp + '.' + JSON.stringify( body );
+
+	const previous = settings.previous?.secret && new Date( settings.previous.until ) > new Date()
+		? [ settings.previous.secret ]
+		: [];
+
+	return [
+		't=' + timestamp,
+		...[ settings.secret, ...previous ].map( ( secret ) => 'v1=' + crypto
+			.createHmac( 'sha256', secret )
+			.update( payload )
+			.digest( 'hex' )
+		)
+	].join( ',' );
+
+};
+
 var webhook = {
 	// Connecting GENERATES the secret rather than storing one the merchant typed,
 	// so the buttons say what actually happens.
@@ -5897,7 +5935,9 @@ var webhook = {
 			'Press Connect. Drawbridge generates a signing secret and shows it here.',
 			'Copy the secret into your own endpoint.',
 			'Add a Send webhook step to a workflow and put your endpoint URL on it. The URL belongs to the step rather than the connection, so one connection can serve several endpoints.',
-			'On each request, compute HMAC-SHA256 of the raw body using the secret and compare it against the X-Drawbridge-Signature header before acting on the payload.'
+			'On each request, read the X-Drawbridge-Signature header — `t=<unix seconds>,v1=<hex>` — and compute HMAC-SHA256 of `<t>.<raw request body>` with the secret. Use the raw bytes, not a re-serialised parse.',
+			'Compare your result against each v1 value with a constant-time comparison, and reject any request whose timestamp is more than five minutes old.',
+			'After you regenerate the secret, the previous one keeps signing for 24 hours (as a second v1), so update your endpoint within that window.'
 		]
 	},
 	// Nothing to be exclusive with — there is no second webhook vendor, and a
@@ -5970,6 +6010,11 @@ var webhook = {
 
 			if( ! url ) return { message : 'Outgoing webhook URL is not configured for this step.', request, response : { skipped : true }, skipped : true };
 
+			// HTTPS ONLY. The body is the lead — email, phone, address — and a
+			// signature authenticates it without hiding it. The api refuses one on
+			// save; this catches a document written any other way.
+			if( ! /^https:\/\//i.test( url ) ) return { message : 'Outgoing webhook URL must use https.', request, response : { skipped : true }, skipped : true };
+
 			// The LEAD, when there is one, rather than the accumulated context. A
 			// receiver wants the entrant's record, not our internal step state —
 			// and the shell already resolved it, because every hook that names a
@@ -5985,14 +6030,11 @@ var webhook = {
 			// tells the merchant to check it.
 			if( settings?.secret ){
 
-			outgoing[ 'X-Drawbridge-Signature' ] = 'sha256=' + crypto
-			.createHmac( 'sha256', settings.secret )
-			.update( JSON.stringify( body ) )
-			.digest( 'hex' );
+			outgoing[ 'X-Drawbridge-Signature' ] = signature({ body, settings });
 
 			}
 
-			const response = await send({ body, headers : outgoing, method, url });
+			const response = await send({ body, headers : outgoing, maxContentLength : RESPONSE_LIMIT, method, url });
 
 			return { message : 'Webhook POSTed to ' + url + '.', request, response : response || { delivered : true } };
 
@@ -6047,7 +6089,7 @@ var webhook = {
 		: settings?.secret
 		? [
 			{
-				message : 'Compute HMAC-SHA256( secret, body ) and compare against the X-Drawbridge-Signature header to confirm each payload.',
+				message : 'Compute HMAC-SHA256( secret, t + "." + raw body ) and constant-time compare it against a v1 in the X-Drawbridge-Signature header; reject timestamps older than five minutes.',
 				title : 'Requests must be verified',
 				type : 'warning'
 			}

package/dist/connections/index.d.ts

@@ -1520,10 +1520,15 @@ const contacts = {
 			remove : async ( { email, id, token }, { fetcher } = {} ) => {
 
 				// NO TOKEN IS A NO-OP HERE, unlike sendgrid and twilio, and the
-				// difference is what the credential is declared to be: hubspotToken
-				// is the one provider field that is not `required`, because this is
-				// internal CRM tooling no merchant sees. A deployment with no portal
-				// is a supported state, not a missing credential.
+				// difference is what the credential is FOR: this is internal CRM
+				// tooling no merchant sees, so a deployment with no portal is a
+				// supported state rather than a missing credential.
+				//
+				// The manifest does mark hubspotToken `required`, and that is not a
+				// contradiction — the flag feeds `isLive` and nothing else, so it
+				// decides whether the admin card reads live. Not live is the honest
+				// badge when nothing will sync. It gates no behaviour, and
+				// saveProviderSettings never consults it, so the row still writes.
 				if( ! token ) return;
 
 				const contact = id || await lookup({ email, fetcher, token });
@@ -5867,6 +5872,39 @@ var shopify = {
 // Webhooks — the only connection with no third party behind it. Connecting
 // generates a signing secret rather than asking for a credential, which is why
 // its one field declares no `input`.
+
+// A receiver owes us a status, not a document. Whatever it returns is buffered
+// whole in the worker and written to the run record, so it is bounded.
+const RESPONSE_LIMIT = 64 * 1024;
+
+// STRIPE-SHAPED: `t=<unix seconds>,v1=<hex>[,v1=<hex>]`, over `<t>.<raw body>`.
+// The timestamp is INSIDE the signed string, so a captured delivery stops
+// verifying once the receiver's tolerance passes — signing the body alone made a
+// replay valid forever. A second v1 carries the previous secret while a
+// regeneration's grace window is open (the api stamps `previous.until`), so a
+// receiver still on the old value keeps verifying mid-rotation instead of
+// failing every delivery between the button press and their config change.
+const signature = ( { body, settings } ) => {
+
+	const timestamp = Math.floor( Date.now() / 1000 );
+
+	const payload = timestamp + '.' + JSON.stringify( body );
+
+	const previous = settings.previous?.secret && new Date( settings.previous.until ) > new Date()
+		? [ settings.previous.secret ]
+		: [];
+
+	return [
+		't=' + timestamp,
+		...[ settings.secret, ...previous ].map( ( secret ) => 'v1=' + crypto
+			.createHmac( 'sha256', secret )
+			.update( payload )
+			.digest( 'hex' )
+		)
+	].join( ',' );
+
+};
+
 var webhook = {
 	// Connecting GENERATES the secret rather than storing one the merchant typed,
 	// so the buttons say what actually happens.
@@ -5897,7 +5935,9 @@ var webhook = {
 			'Press Connect. Drawbridge generates a signing secret and shows it here.',
 			'Copy the secret into your own endpoint.',
 			'Add a Send webhook step to a workflow and put your endpoint URL on it. The URL belongs to the step rather than the connection, so one connection can serve several endpoints.',
-			'On each request, compute HMAC-SHA256 of the raw body using the secret and compare it against the X-Drawbridge-Signature header before acting on the payload.'
+			'On each request, read the X-Drawbridge-Signature header — `t=<unix seconds>,v1=<hex>` — and compute HMAC-SHA256 of `<t>.<raw request body>` with the secret. Use the raw bytes, not a re-serialised parse.',
+			'Compare your result against each v1 value with a constant-time comparison, and reject any request whose timestamp is more than five minutes old.',
+			'After you regenerate the secret, the previous one keeps signing for 24 hours (as a second v1), so update your endpoint within that window.'
 		]
 	},
 	// Nothing to be exclusive with — there is no second webhook vendor, and a
@@ -5970,6 +6010,11 @@ var webhook = {
 
 			if( ! url ) return { message : 'Outgoing webhook URL is not configured for this step.', request, response : { skipped : true }, skipped : true };
 
+			// HTTPS ONLY. The body is the lead — email, phone, address — and a
+			// signature authenticates it without hiding it. The api refuses one on
+			// save; this catches a document written any other way.
+			if( ! /^https:\/\//i.test( url ) ) return { message : 'Outgoing webhook URL must use https.', request, response : { skipped : true }, skipped : true };
+
 			// The LEAD, when there is one, rather than the accumulated context. A
 			// receiver wants the entrant's record, not our internal step state —
 			// and the shell already resolved it, because every hook that names a
@@ -5985,14 +6030,11 @@ var webhook = {
 			// tells the merchant to check it.
 			if( settings?.secret ){
 
-			outgoing[ 'X-Drawbridge-Signature' ] = 'sha256=' + crypto
-			.createHmac( 'sha256', settings.secret )
-			.update( JSON.stringify( body ) )
-			.digest( 'hex' );
+			outgoing[ 'X-Drawbridge-Signature' ] = signature({ body, settings });
 
 			}
 
-			const response = await send({ body, headers : outgoing, method, url });
+			const response = await send({ body, headers : outgoing, maxContentLength : RESPONSE_LIMIT, method, url });
 
 			return { message : 'Webhook POSTed to ' + url + '.', request, response : response || { delivered : true } };
 
@@ -6047,7 +6089,7 @@ var webhook = {
 		: settings?.secret
 		? [
 			{
-				message : 'Compute HMAC-SHA256( secret, body ) and compare against the X-Drawbridge-Signature header to confirm each payload.',
+				message : 'Compute HMAC-SHA256( secret, t + "." + raw body ) and constant-time compare it against a v1 in the X-Drawbridge-Signature header; reject timestamps older than five minutes.',
 				title : 'Requests must be verified',
 				type : 'warning'
 			}

package/dist/connections/index.js

@@ -4791,9 +4791,14 @@ var isBlockedIPv4 = (ip) => {
   if (a >= 224) return true;
   return false;
 };
+var transition = new net.BlockList();
+transition.addSubnet("64:ff9b::", 96, "ipv6");
+transition.addSubnet("2002::", 16, "ipv6");
+transition.addSubnet("2001::", 32, "ipv6");
 var isBlockedIPv6 = (ip) => {
   const lower = ip.toLowerCase();
   if (lower === "::1" || lower === "::") return true;
+  if (transition.check(ip, "ipv6")) return true;
   if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
   if (/^fe[89ab]/.test(lower)) return true;
   if (lower.startsWith("ff")) return true;
@@ -4852,12 +4857,13 @@ var pinnedAgent = async (url) => {
 var safeRequest = async ({
   body,
   headers = {},
+  maxContentLength,
   method = "GET",
   query,
   timeout = DEFAULT_TIMEOUT_MS2,
   type = "json",
   url
-}) => {
+}, { transport = axios } = {}) => {
   const full = new URL(url);
   if (query) {
     Object.entries(query).forEach(([key, value]) => full.searchParams.set(key, value));
@@ -4865,7 +4871,7 @@ var safeRequest = async ({
   const { protocol, agent } = await pinnedAgent(full.toString());
   const isForm = type === "form";
   try {
-    const response = await axios({
+    const response = await transport({
       method,
       url: full.toString(),
       headers: {
@@ -4875,6 +4881,7 @@ var safeRequest = async ({
       ...body !== void 0 && {
         data: isForm ? new URLSearchParams(body).toString() : body
       },
+      ...maxContentLength !== void 0 && { maxContentLength },
       timeout,
       maxRedirects: 0,
       httpAgent: protocol === "http:" ? agent : void 0,
@@ -4897,6 +4904,19 @@ var safeRequest = async ({
 };
 
 // lib/connections/providers/webhook.js
+var RESPONSE_LIMIT = 64 * 1024;
+var signature = ({ body, settings }) => {
+  var _a;
+  const timestamp = Math.floor(Date.now() / 1e3);
+  const payload = timestamp + "." + JSON.stringify(body);
+  const previous = ((_a = settings.previous) == null ? void 0 : _a.secret) && new Date(settings.previous.until) > /* @__PURE__ */ new Date() ? [settings.previous.secret] : [];
+  return [
+    "t=" + timestamp,
+    ...[settings.secret, ...previous].map(
+      (secret) => "v1=" + crypto2.createHmac("sha256", secret).update(payload).digest("hex")
+    )
+  ].join(",");
+};
 var webhook_default = {
   // Connecting GENERATES the secret rather than storing one the merchant typed,
   // so the buttons say what actually happens.
@@ -4927,7 +4947,9 @@ var webhook_default = {
       "Press Connect. Drawbridge generates a signing secret and shows it here.",
       "Copy the secret into your own endpoint.",
       "Add a Send webhook step to a workflow and put your endpoint URL on it. The URL belongs to the step rather than the connection, so one connection can serve several endpoints.",
-      "On each request, compute HMAC-SHA256 of the raw body using the secret and compare it against the X-Drawbridge-Signature header before acting on the payload."
+      "On each request, read the X-Drawbridge-Signature header \u2014 `t=<unix seconds>,v1=<hex>` \u2014 and compute HMAC-SHA256 of `<t>.<raw request body>` with the secret. Use the raw bytes, not a re-serialised parse.",
+      "Compare your result against each v1 value with a constant-time comparison, and reject any request whose timestamp is more than five minutes old.",
+      "After you regenerate the secret, the previous one keeps signing for 24 hours (as a second v1), so update your endpoint within that window."
     ]
   },
   // Nothing to be exclusive with — there is no second webhook vendor, and a
@@ -4995,13 +5017,14 @@ var webhook_default = {
         const { headers = {}, method = "POST", url } = step.settings || {};
         const request2 = { method, url: url || null };
         if (!url) return { message: "Outgoing webhook URL is not configured for this step.", request: request2, response: { skipped: true }, skipped: true };
+        if (!/^https:\/\//i.test(url)) return { message: "Outgoing webhook URL must use https.", request: request2, response: { skipped: true }, skipped: true };
         const body = lead || context;
         request2.body = body;
         const outgoing = { ...headers };
         if (settings == null ? void 0 : settings.secret) {
-          outgoing["X-Drawbridge-Signature"] = "sha256=" + crypto2.createHmac("sha256", settings.secret).update(JSON.stringify(body)).digest("hex");
+          outgoing["X-Drawbridge-Signature"] = signature({ body, settings });
         }
-        const response = await send2({ body, headers: outgoing, method, url });
+        const response = await send2({ body, headers: outgoing, maxContentLength: RESPONSE_LIMIT, method, url });
         return { message: "Webhook POSTed to " + url + ".", request: request2, response: response || { delivered: true } };
       }
     }
@@ -5050,7 +5073,7 @@ var webhook_default = {
   // and a task repeating it talks over the button.
   tasks: ({ settings, status } = {}) => ["disconnected", "error"].includes(status) ? [] : (settings == null ? void 0 : settings.secret) ? [
     {
-      message: "Compute HMAC-SHA256( secret, body ) and compare against the X-Drawbridge-Signature header to confirm each payload.",
+      message: 'Compute HMAC-SHA256( secret, t + "." + raw body ) and constant-time compare it against a v1 in the X-Drawbridge-Signature header; reject timestamps older than five minutes.',
       title: "Requests must be verified",
       type: "warning"
     }

package/dist/email.cjs

@@ -19,6 +19,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // lib/email.js
 var email_exports = {};
 __export(email_exports, {
+  subAddress: () => subAddress,
   toCanonicalEmail: () => toCanonicalEmail
 });
 module.exports = __toCommonJS(email_exports);
@@ -36,7 +37,20 @@ var toCanonicalEmail = (value) => {
   if (!local) return null;
   return local + "@" + domain;
 };
+var LOCAL_PART_LIMIT = 64;
+var subAddress = (email, tag) => {
+  if (!email || typeof email !== "string") return email;
+  if (!tag || typeof tag !== "string") return email;
+  if (!/^[A-Za-z0-9]+$/.test(tag)) return email;
+  const at = email.lastIndexOf("@");
+  if (at < 1 || at === email.length - 1) return email;
+  const local = email.slice(0, at);
+  if (local.includes("+")) return email;
+  if (local.length + 1 + tag.length > LOCAL_PART_LIMIT) return email;
+  return local + "+" + tag + "@" + email.slice(at + 1);
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  subAddress,
   toCanonicalEmail
 });

package/dist/email.d.cts

@@ -33,4 +33,56 @@ const toCanonicalEmail = ( value ) => {
 
 };
 
-export { toCanonicalEmail };
+// RFC 5322 caps the local part at 64 octets. Everything here is ASCII, so
+// length is octets.
+const LOCAL_PART_LIMIT = 64;
+
+// The inverse of toCanonicalEmail: put a tag INTO the local part rather than
+// strip one out. `subAddress( 'org@send.drwbrdg.com', '507f…' )` gives
+// `org+507f…@send.drwbrdg.com` — RFC 5233 sub-addressing, which Google delivers
+// to the untagged mailbox natively.
+//
+// This is how the platform's lead-facing sender carries the ORGANIZATION.
+// Shopify does the same thing with `store+<shopId>@shopifyemail.com`: one
+// mailbox, one MX record, one authenticated domain, and the tenant rides in the
+// address instead of in infrastructure. There is no per-organization address to
+// store, so there is nothing to migrate or backfill.
+//
+// It is derived at send time, never persisted. Worth settling BEFORE the first
+// send rather than after: the From line is frozen into every message already
+// delivered, so a shared address cannot be split apart retroactively.
+//
+// Returns the address UNCHANGED whenever it cannot be tagged safely — a flat
+// from-address is a working email, a malformed one is a send the provider
+// rejects outright. Callers rely on that: the sender resolvers fall through to
+// their own defaults on a falsy return, and never on a broken string.
+const subAddress = ( email, tag ) => {
+
+	if( ! email || typeof email !== 'string' ) return email;
+	if( ! tag || typeof tag !== 'string' ) return email;
+
+	// Organization ids are 24-char ObjectId hex, and the short-id generator is
+	// base36 — both alphanumeric, both safely atext. Checked rather than assumed
+	// because the api schema types `id` as a bare string with no pattern, and
+	// `formats.documents.insert` spreads caller data OVER the generated id, so a
+	// hand-written id would win.
+	if( ! /^[A-Za-z0-9]+$/.test( tag ) ) return email;
+
+	const at = email.lastIndexOf( '@' );
+
+	if( at < 1 || at === email.length - 1 ) return email;
+
+	const local = email.slice( 0, at );
+
+	// Already tagged. Re-tagging would nest (`org+a+b@`), and the first tag is
+	// the one a receiving mailbox would route on — so the second would be a
+	// silent lie about which tenant the mail belongs to.
+	if( local.includes( '+' ) ) return email;
+
+	if( local.length + 1 + tag.length > LOCAL_PART_LIMIT ) return email;
+
+	return local + '+' + tag + '@' + email.slice( at + 1 );
+
+};
+
+export { subAddress, toCanonicalEmail };

package/dist/email.d.ts

@@ -33,4 +33,56 @@ const toCanonicalEmail = ( value ) => {
 
 };
 
-export { toCanonicalEmail };
+// RFC 5322 caps the local part at 64 octets. Everything here is ASCII, so
+// length is octets.
+const LOCAL_PART_LIMIT = 64;
+
+// The inverse of toCanonicalEmail: put a tag INTO the local part rather than
+// strip one out. `subAddress( 'org@send.drwbrdg.com', '507f…' )` gives
+// `org+507f…@send.drwbrdg.com` — RFC 5233 sub-addressing, which Google delivers
+// to the untagged mailbox natively.
+//
+// This is how the platform's lead-facing sender carries the ORGANIZATION.
+// Shopify does the same thing with `store+<shopId>@shopifyemail.com`: one
+// mailbox, one MX record, one authenticated domain, and the tenant rides in the
+// address instead of in infrastructure. There is no per-organization address to
+// store, so there is nothing to migrate or backfill.
+//
+// It is derived at send time, never persisted. Worth settling BEFORE the first
+// send rather than after: the From line is frozen into every message already
+// delivered, so a shared address cannot be split apart retroactively.
+//
+// Returns the address UNCHANGED whenever it cannot be tagged safely — a flat
+// from-address is a working email, a malformed one is a send the provider
+// rejects outright. Callers rely on that: the sender resolvers fall through to
+// their own defaults on a falsy return, and never on a broken string.
+const subAddress = ( email, tag ) => {
+
+	if( ! email || typeof email !== 'string' ) return email;
+	if( ! tag || typeof tag !== 'string' ) return email;
+
+	// Organization ids are 24-char ObjectId hex, and the short-id generator is
+	// base36 — both alphanumeric, both safely atext. Checked rather than assumed
+	// because the api schema types `id` as a bare string with no pattern, and
+	// `formats.documents.insert` spreads caller data OVER the generated id, so a
+	// hand-written id would win.
+	if( ! /^[A-Za-z0-9]+$/.test( tag ) ) return email;
+
+	const at = email.lastIndexOf( '@' );
+
+	if( at < 1 || at === email.length - 1 ) return email;
+
+	const local = email.slice( 0, at );
+
+	// Already tagged. Re-tagging would nest (`org+a+b@`), and the first tag is
+	// the one a receiving mailbox would route on — so the second would be a
+	// silent lie about which tenant the mail belongs to.
+	if( local.includes( '+' ) ) return email;
+
+	if( local.length + 1 + tag.length > LOCAL_PART_LIMIT ) return email;
+
+	return local + '+' + tag + '@' + email.slice( at + 1 );
+
+};
+
+export { subAddress, toCanonicalEmail };

package/dist/email.js

@@ -13,6 +13,19 @@ var toCanonicalEmail = (value) => {
   if (!local) return null;
   return local + "@" + domain;
 };
+var LOCAL_PART_LIMIT = 64;
+var subAddress = (email, tag) => {
+  if (!email || typeof email !== "string") return email;
+  if (!tag || typeof tag !== "string") return email;
+  if (!/^[A-Za-z0-9]+$/.test(tag)) return email;
+  const at = email.lastIndexOf("@");
+  if (at < 1 || at === email.length - 1) return email;
+  const local = email.slice(0, at);
+  if (local.includes("+")) return email;
+  if (local.length + 1 + tag.length > LOCAL_PART_LIMIT) return email;
+  return local + "+" + tag + "@" + email.slice(at + 1);
+};
 export {
+  subAddress,
   toCanonicalEmail
 };

package/dist/providers.cjs

@@ -4792,9 +4792,14 @@ var isBlockedIPv4 = (ip) => {
   if (a >= 224) return true;
   return false;
 };
+var transition = new import_net.default.BlockList();
+transition.addSubnet("64:ff9b::", 96, "ipv6");
+transition.addSubnet("2002::", 16, "ipv6");
+transition.addSubnet("2001::", 32, "ipv6");
 var isBlockedIPv6 = (ip) => {
   const lower = ip.toLowerCase();
   if (lower === "::1" || lower === "::") return true;
+  if (transition.check(ip, "ipv6")) return true;
   if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
   if (/^fe[89ab]/.test(lower)) return true;
   if (lower.startsWith("ff")) return true;
@@ -4853,12 +4858,13 @@ var pinnedAgent = async (url) => {
 var safeRequest = async ({
   body,
   headers = {},
+  maxContentLength,
   method = "GET",
   query,
   timeout = DEFAULT_TIMEOUT_MS2,
   type = "json",
   url
-}) => {
+}, { transport = axios } = {}) => {
   const full = new URL(url);
   if (query) {
     Object.entries(query).forEach(([key, value]) => full.searchParams.set(key, value));
@@ -4866,7 +4872,7 @@ var safeRequest = async ({
   const { protocol, agent } = await pinnedAgent(full.toString());
   const isForm = type === "form";
   try {
-    const response = await axios({
+    const response = await transport({
       method,
       url: full.toString(),
       headers: {
@@ -4876,6 +4882,7 @@ var safeRequest = async ({
       ...body !== void 0 && {
         data: isForm ? new URLSearchParams(body).toString() : body
       },
+      ...maxContentLength !== void 0 && { maxContentLength },
       timeout,
       maxRedirects: 0,
       httpAgent: protocol === "http:" ? agent : void 0,
@@ -4898,6 +4905,19 @@ var safeRequest = async ({
 };
 
 // lib/connections/providers/webhook.js
+var RESPONSE_LIMIT = 64 * 1024;
+var signature = ({ body, settings }) => {
+  var _a;
+  const timestamp = Math.floor(Date.now() / 1e3);
+  const payload = timestamp + "." + JSON.stringify(body);
+  const previous = ((_a = settings.previous) == null ? void 0 : _a.secret) && new Date(settings.previous.until) > /* @__PURE__ */ new Date() ? [settings.previous.secret] : [];
+  return [
+    "t=" + timestamp,
+    ...[settings.secret, ...previous].map(
+      (secret) => "v1=" + import_node_crypto6.default.createHmac("sha256", secret).update(payload).digest("hex")
+    )
+  ].join(",");
+};
 var webhook_default = {
   // Connecting GENERATES the secret rather than storing one the merchant typed,
   // so the buttons say what actually happens.
@@ -4928,7 +4948,9 @@ var webhook_default = {
       "Press Connect. Drawbridge generates a signing secret and shows it here.",
       "Copy the secret into your own endpoint.",
       "Add a Send webhook step to a workflow and put your endpoint URL on it. The URL belongs to the step rather than the connection, so one connection can serve several endpoints.",
-      "On each request, compute HMAC-SHA256 of the raw body using the secret and compare it against the X-Drawbridge-Signature header before acting on the payload."
+      "On each request, read the X-Drawbridge-Signature header \u2014 `t=<unix seconds>,v1=<hex>` \u2014 and compute HMAC-SHA256 of `<t>.<raw request body>` with the secret. Use the raw bytes, not a re-serialised parse.",
+      "Compare your result against each v1 value with a constant-time comparison, and reject any request whose timestamp is more than five minutes old.",
+      "After you regenerate the secret, the previous one keeps signing for 24 hours (as a second v1), so update your endpoint within that window."
     ]
   },
   // Nothing to be exclusive with — there is no second webhook vendor, and a
@@ -4996,13 +5018,14 @@ var webhook_default = {
         const { headers = {}, method = "POST", url } = step.settings || {};
         const request2 = { method, url: url || null };
         if (!url) return { message: "Outgoing webhook URL is not configured for this step.", request: request2, response: { skipped: true }, skipped: true };
+        if (!/^https:\/\//i.test(url)) return { message: "Outgoing webhook URL must use https.", request: request2, response: { skipped: true }, skipped: true };
         const body = lead || context;
         request2.body = body;
         const outgoing = { ...headers };
         if (settings == null ? void 0 : settings.secret) {
-          outgoing["X-Drawbridge-Signature"] = "sha256=" + import_node_crypto6.default.createHmac("sha256", settings.secret).update(JSON.stringify(body)).digest("hex");
+          outgoing["X-Drawbridge-Signature"] = signature({ body, settings });
         }
-        const response = await send2({ body, headers: outgoing, method, url });
+        const response = await send2({ body, headers: outgoing, maxContentLength: RESPONSE_LIMIT, method, url });
         return { message: "Webhook POSTed to " + url + ".", request: request2, response: response || { delivered: true } };
       }
     }
@@ -5051,7 +5074,7 @@ var webhook_default = {
   // and a task repeating it talks over the button.
   tasks: ({ settings, status } = {}) => ["disconnected", "error"].includes(status) ? [] : (settings == null ? void 0 : settings.secret) ? [
     {
-      message: "Compute HMAC-SHA256( secret, body ) and compare against the X-Drawbridge-Signature header to confirm each payload.",
+      message: 'Compute HMAC-SHA256( secret, t + "." + raw body ) and constant-time compare it against a v1 in the X-Drawbridge-Signature header; reject timestamps older than five minutes.',
       title: "Requests must be verified",
       type: "warning"
     }

package/dist/providers.js

@@ -4746,9 +4746,14 @@ var isBlockedIPv4 = (ip) => {
   if (a >= 224) return true;
   return false;
 };
+var transition = new net.BlockList();
+transition.addSubnet("64:ff9b::", 96, "ipv6");
+transition.addSubnet("2002::", 16, "ipv6");
+transition.addSubnet("2001::", 32, "ipv6");
 var isBlockedIPv6 = (ip) => {
   const lower = ip.toLowerCase();
   if (lower === "::1" || lower === "::") return true;
+  if (transition.check(ip, "ipv6")) return true;
   if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
   if (/^fe[89ab]/.test(lower)) return true;
   if (lower.startsWith("ff")) return true;
@@ -4807,12 +4812,13 @@ var pinnedAgent = async (url) => {
 var safeRequest = async ({
   body,
   headers = {},
+  maxContentLength,
   method = "GET",
   query,
   timeout = DEFAULT_TIMEOUT_MS2,
   type = "json",
   url
-}) => {
+}, { transport = axios } = {}) => {
   const full = new URL(url);
   if (query) {
     Object.entries(query).forEach(([key, value]) => full.searchParams.set(key, value));
@@ -4820,7 +4826,7 @@ var safeRequest = async ({
   const { protocol, agent } = await pinnedAgent(full.toString());
   const isForm = type === "form";
   try {
-    const response = await axios({
+    const response = await transport({
       method,
       url: full.toString(),
       headers: {
@@ -4830,6 +4836,7 @@ var safeRequest = async ({
       ...body !== void 0 && {
         data: isForm ? new URLSearchParams(body).toString() : body
       },
+      ...maxContentLength !== void 0 && { maxContentLength },
       timeout,
       maxRedirects: 0,
       httpAgent: protocol === "http:" ? agent : void 0,
@@ -4852,6 +4859,19 @@ var safeRequest = async ({
 };
 
 // lib/connections/providers/webhook.js
+var RESPONSE_LIMIT = 64 * 1024;
+var signature = ({ body, settings }) => {
+  var _a;
+  const timestamp = Math.floor(Date.now() / 1e3);
+  const payload = timestamp + "." + JSON.stringify(body);
+  const previous = ((_a = settings.previous) == null ? void 0 : _a.secret) && new Date(settings.previous.until) > /* @__PURE__ */ new Date() ? [settings.previous.secret] : [];
+  return [
+    "t=" + timestamp,
+    ...[settings.secret, ...previous].map(
+      (secret) => "v1=" + crypto3.createHmac("sha256", secret).update(payload).digest("hex")
+    )
+  ].join(",");
+};
 var webhook_default = {
   // Connecting GENERATES the secret rather than storing one the merchant typed,
   // so the buttons say what actually happens.
@@ -4882,7 +4902,9 @@ var webhook_default = {
       "Press Connect. Drawbridge generates a signing secret and shows it here.",
       "Copy the secret into your own endpoint.",
       "Add a Send webhook step to a workflow and put your endpoint URL on it. The URL belongs to the step rather than the connection, so one connection can serve several endpoints.",
-      "On each request, compute HMAC-SHA256 of the raw body using the secret and compare it against the X-Drawbridge-Signature header before acting on the payload."
+      "On each request, read the X-Drawbridge-Signature header \u2014 `t=<unix seconds>,v1=<hex>` \u2014 and compute HMAC-SHA256 of `<t>.<raw request body>` with the secret. Use the raw bytes, not a re-serialised parse.",
+      "Compare your result against each v1 value with a constant-time comparison, and reject any request whose timestamp is more than five minutes old.",
+      "After you regenerate the secret, the previous one keeps signing for 24 hours (as a second v1), so update your endpoint within that window."
     ]
   },
   // Nothing to be exclusive with — there is no second webhook vendor, and a
@@ -4950,13 +4972,14 @@ var webhook_default = {
         const { headers = {}, method = "POST", url } = step.settings || {};
         const request2 = { method, url: url || null };
         if (!url) return { message: "Outgoing webhook URL is not configured for this step.", request: request2, response: { skipped: true }, skipped: true };
+        if (!/^https:\/\//i.test(url)) return { message: "Outgoing webhook URL must use https.", request: request2, response: { skipped: true }, skipped: true };
         const body = lead || context;
         request2.body = body;
         const outgoing = { ...headers };
         if (settings == null ? void 0 : settings.secret) {
-          outgoing["X-Drawbridge-Signature"] = "sha256=" + crypto3.createHmac("sha256", settings.secret).update(JSON.stringify(body)).digest("hex");
+          outgoing["X-Drawbridge-Signature"] = signature({ body, settings });
         }
-        const response = await send2({ body, headers: outgoing, method, url });
+        const response = await send2({ body, headers: outgoing, maxContentLength: RESPONSE_LIMIT, method, url });
         return { message: "Webhook POSTed to " + url + ".", request: request2, response: response || { delivered: true } };
       }
     }
@@ -5005,7 +5028,7 @@ var webhook_default = {
   // and a task repeating it talks over the button.
   tasks: ({ settings, status } = {}) => ["disconnected", "error"].includes(status) ? [] : (settings == null ? void 0 : settings.secret) ? [
     {
-      message: "Compute HMAC-SHA256( secret, body ) and compare against the X-Drawbridge-Signature header to confirm each payload.",
+      message: 'Compute HMAC-SHA256( secret, t + "." + raw body ) and constant-time compare it against a v1 in the X-Drawbridge-Signature header; reject timestamps older than five minutes.',
       title: "Requests must be verified",
       type: "warning"
     }

package/dist/safe-http.cjs

@@ -64,9 +64,14 @@ var isBlockedIPv4 = (ip) => {
   if (a >= 224) return true;
   return false;
 };
+var transition = new import_net.default.BlockList();
+transition.addSubnet("64:ff9b::", 96, "ipv6");
+transition.addSubnet("2002::", 16, "ipv6");
+transition.addSubnet("2001::", 32, "ipv6");
 var isBlockedIPv6 = (ip) => {
   const lower = ip.toLowerCase();
   if (lower === "::1" || lower === "::") return true;
+  if (transition.check(ip, "ipv6")) return true;
   if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
   if (/^fe[89ab]/.test(lower)) return true;
   if (lower.startsWith("ff")) return true;
@@ -128,12 +133,13 @@ var pinnedAgent = async (url) => {
 var safeRequest = async ({
   body,
   headers = {},
+  maxContentLength,
   method = "GET",
   query,
   timeout = DEFAULT_TIMEOUT_MS,
   type = "json",
   url
-}) => {
+}, { transport = axios } = {}) => {
   const full = new URL(url);
   if (query) {
     Object.entries(query).forEach(([key, value]) => full.searchParams.set(key, value));
@@ -141,7 +147,7 @@ var safeRequest = async ({
   const { protocol, agent } = await pinnedAgent(full.toString());
   const isForm = type === "form";
   try {
-    const response = await axios({
+    const response = await transport({
       method,
       url: full.toString(),
       headers: {
@@ -151,6 +157,7 @@ var safeRequest = async ({
       ...body !== void 0 && {
         data: isForm ? new URLSearchParams(body).toString() : body
       },
+      ...maxContentLength !== void 0 && { maxContentLength },
       timeout,
       maxRedirects: 0,
       httpAgent: protocol === "http:" ? agent : void 0,

package/dist/safe-http.d.cts

@@ -103,15 +103,21 @@ const pinnedAgent = async ( url ) => {
 // but pins the vetted IP and refuses redirects. A webhook endpoint that
 // 3xx-redirects is treated as a failure — an intentional trade for closing the
 // redirect-to-internal vector.
+//
+// `maxContentLength` bounds the RESPONSE. Unset, the transport's default stands
+// (video assets and scrape targets are legitimately large); a caller that only
+// owes the far side a status — an outgoing webhook — sets it, because whatever
+// comes back is buffered whole in the worker. `transport` is the test seam.
 const safeRequest = async ({
 	body,
 	headers = {},
+	maxContentLength,
 	method = 'GET',
 	query,
 	timeout = DEFAULT_TIMEOUT_MS,
 	type = 'json',
 	url
-}) => {
+}, { transport = axios } = {}) => {
 
 	const full = new URL( url );
 
@@ -126,7 +132,7 @@ const safeRequest = async ({
 
 	try {
 
-		const response = await axios({
+		const response = await transport({
 			method,
 			url : full.toString(),
 			headers : {
@@ -136,6 +142,7 @@ const safeRequest = async ({
 			...( body !== undefined && {
 				data : isForm ? new URLSearchParams( body ).toString() : body
 			}),
+			...( maxContentLength !== undefined && { maxContentLength } ),
 			timeout,
 			maxRedirects : 0,
 			httpAgent : protocol === 'http:' ? agent : undefined,

package/dist/safe-http.d.ts

@@ -103,15 +103,21 @@ const pinnedAgent = async ( url ) => {
 // but pins the vetted IP and refuses redirects. A webhook endpoint that
 // 3xx-redirects is treated as a failure — an intentional trade for closing the
 // redirect-to-internal vector.
+//
+// `maxContentLength` bounds the RESPONSE. Unset, the transport's default stands
+// (video assets and scrape targets are legitimately large); a caller that only
+// owes the far side a status — an outgoing webhook — sets it, because whatever
+// comes back is buffered whole in the worker. `transport` is the test seam.
 const safeRequest = async ({
 	body,
 	headers = {},
+	maxContentLength,
 	method = 'GET',
 	query,
 	timeout = DEFAULT_TIMEOUT_MS,
 	type = 'json',
 	url
-}) => {
+}, { transport = axios } = {}) => {
 
 	const full = new URL( url );
 
@@ -126,7 +132,7 @@ const safeRequest = async ({
 
 	try {
 
-		const response = await axios({
+		const response = await transport({
 			method,
 			url : full.toString(),
 			headers : {
@@ -136,6 +142,7 @@ const safeRequest = async ({
 			...( body !== undefined && {
 				data : isForm ? new URLSearchParams( body ).toString() : body
 			}),
+			...( maxContentLength !== undefined && { maxContentLength } ),
 			timeout,
 			maxRedirects : 0,
 			httpAgent : protocol === 'http:' ? agent : undefined,

package/dist/safe-http.js

@@ -28,9 +28,14 @@ var isBlockedIPv4 = (ip) => {
   if (a >= 224) return true;
   return false;
 };
+var transition = new net.BlockList();
+transition.addSubnet("64:ff9b::", 96, "ipv6");
+transition.addSubnet("2002::", 16, "ipv6");
+transition.addSubnet("2001::", 32, "ipv6");
 var isBlockedIPv6 = (ip) => {
   const lower = ip.toLowerCase();
   if (lower === "::1" || lower === "::") return true;
+  if (transition.check(ip, "ipv6")) return true;
   if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
   if (/^fe[89ab]/.test(lower)) return true;
   if (lower.startsWith("ff")) return true;
@@ -92,12 +97,13 @@ var pinnedAgent = async (url) => {
 var safeRequest = async ({
   body,
   headers = {},
+  maxContentLength,
   method = "GET",
   query,
   timeout = DEFAULT_TIMEOUT_MS,
   type = "json",
   url
-}) => {
+}, { transport = axios } = {}) => {
   const full = new URL(url);
   if (query) {
     Object.entries(query).forEach(([key, value]) => full.searchParams.set(key, value));
@@ -105,7 +111,7 @@ var safeRequest = async ({
   const { protocol, agent } = await pinnedAgent(full.toString());
   const isForm = type === "form";
   try {
-    const response = await axios({
+    const response = await transport({
       method,
       url: full.toString(),
       headers: {
@@ -115,6 +121,7 @@ var safeRequest = async ({
       ...body !== void 0 && {
         data: isForm ? new URLSearchParams(body).toString() : body
       },
+      ...maxContentLength !== void 0 && { maxContentLength },
       timeout,
       maxRedirects: 0,
       httpAgent: protocol === "http:" ? agent : void 0,

package/package.json

@@ -216,5 +216,5 @@
     "prepublishOnly": ". \"$HOME/.nvm/nvm.sh\" && nvm use && tsup && node --test"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.155"
+  "version": "0.0.157"
 }