@drawbridge/drawbridge-utils 0.0.87 → 0.0.89

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/axios.cjs +11 -3
  2. package/dist/axios.d.cts +19 -3
  3. package/dist/axios.d.ts +19 -3
  4. package/dist/axios.js +10 -2
  5. package/package.json +1 -1
package/dist/axios.cjs CHANGED
@@ -36,7 +36,8 @@ __export(axios_exports, {
36
36
  module.exports = __toCommonJS(axios_exports);
37
37
  var import_axios = __toESM(require("axios"), 1);
38
38
  var import_dns = __toESM(require("dns"), 1);
39
- var import_https = __toESM(require("https"), 1);
39
+ var http = __toESM(require("http"), 1);
40
+ var https = __toESM(require("https"), 1);
40
41
  var import_net = __toESM(require("net"), 1);
41
42
  var dnsLookup = import_dns.default.promises.lookup;
42
43
  var isBlockedIPv4 = (ip) => {
@@ -101,7 +102,7 @@ var safeGet = async (url, axiosOptions = {}) => {
101
102
  }
102
103
  ;
103
104
  const pinned = records[0];
104
- const agent = new import_https.default.Agent({
105
+ const agent = new https.Agent({
105
106
  lookup: (hostname, options, callback) => {
106
107
  if (options == null ? void 0 : options.all) {
107
108
  callback(null, [{ address: pinned.address, family: pinned.family }]);
@@ -112,6 +113,9 @@ var safeGet = async (url, axiosOptions = {}) => {
112
113
  }
113
114
  });
114
115
  return import_axios.default.get(url, {
116
+ // Default bound for user-supplied URLs; callers override via
117
+ // axiosOptions.timeout (listed first so the spread wins).
118
+ timeout: 15e3,
115
119
  ...axiosOptions,
116
120
  httpsAgent: agent,
117
121
  maxRedirects: 0,
@@ -122,7 +126,11 @@ var safeGet = async (url, axiosOptions = {}) => {
122
126
  var safe = {
123
127
  get: safeGet
124
128
  };
125
- var axios = import_axios.default;
129
+ var axios = import_axios.default.create({
130
+ timeout: 3e4,
131
+ httpAgent: new http.Agent({ keepAlive: true, maxSockets: 128 }),
132
+ httpsAgent: new https.Agent({ keepAlive: true, maxSockets: 128 })
133
+ });
126
134
  // Annotate the CommonJS export names for ESM import in node:
127
135
  0 && (module.exports = {
128
136
  axios,
package/dist/axios.d.cts CHANGED
@@ -1,6 +1,7 @@
1
1
  import axiosLib from 'axios';
2
2
  import dns from 'dns';
3
- import https from 'https';
3
+ import * as http from 'node:http';
4
+ import * as https from 'node:https';
4
5
  import net from 'net';
5
6
 
6
7
  const dnsLookup = dns.promises.lookup;
@@ -130,6 +131,9 @@ const safeGet = async ( url, axiosOptions = {} ) => {
130
131
  });
131
132
 
132
133
  return axiosLib.get( url, {
134
+ // Default bound for user-supplied URLs; callers override via
135
+ // axiosOptions.timeout (listed first so the spread wins).
136
+ timeout : 15000,
133
137
  ...axiosOptions,
134
138
  httpsAgent : agent,
135
139
  maxRedirects : 0,
@@ -145,9 +149,21 @@ const safe = {
145
149
  get : safeGet
146
150
  };
147
151
 
148
- // Raw axios passthrough. Use for trusted/hardcoded URLs (Google APIs, Stripe, etc.).
152
+ // Raw axios instance for trusted/hardcoded URLs (Google APIs, Stripe, etc.).
149
153
  // await axios.get( 'https://api.stripe.com/...' );
150
154
  // await axios.post( ... );
151
- const axios = axiosLib;
155
+ //
156
+ // Bounded by default so a forgotten per-call override can never hang a request
157
+ // handler or queue worker indefinitely (the classic unguarded-await failure
158
+ // under load). Every call site can still override: per-request `timeout`,
159
+ // `signal` (used by streaming downloads whose 30s would be wrong), and
160
+ // per-request `httpAgent`/`httpsAgent` (used by the SSRF-pinned agents) all
161
+ // take precedence over these defaults. Audited 2026-07-24: every existing
162
+ // call site already sets its own bound, so this changes no current behavior.
163
+ const axios = axiosLib.create({
164
+ timeout : 30000,
165
+ httpAgent : new http.Agent({ keepAlive : true, maxSockets : 128 }),
166
+ httpsAgent : new https.Agent({ keepAlive : true, maxSockets : 128 })
167
+ });
152
168
 
153
169
  export { axios, isBlockedIP, safe };
package/dist/axios.d.ts CHANGED
@@ -1,6 +1,7 @@
1
1
  import axiosLib from 'axios';
2
2
  import dns from 'dns';
3
- import https from 'https';
3
+ import * as http from 'node:http';
4
+ import * as https from 'node:https';
4
5
  import net from 'net';
5
6
 
6
7
  const dnsLookup = dns.promises.lookup;
@@ -130,6 +131,9 @@ const safeGet = async ( url, axiosOptions = {} ) => {
130
131
  });
131
132
 
132
133
  return axiosLib.get( url, {
134
+ // Default bound for user-supplied URLs; callers override via
135
+ // axiosOptions.timeout (listed first so the spread wins).
136
+ timeout : 15000,
133
137
  ...axiosOptions,
134
138
  httpsAgent : agent,
135
139
  maxRedirects : 0,
@@ -145,9 +149,21 @@ const safe = {
145
149
  get : safeGet
146
150
  };
147
151
 
148
- // Raw axios passthrough. Use for trusted/hardcoded URLs (Google APIs, Stripe, etc.).
152
+ // Raw axios instance for trusted/hardcoded URLs (Google APIs, Stripe, etc.).
149
153
  // await axios.get( 'https://api.stripe.com/...' );
150
154
  // await axios.post( ... );
151
- const axios = axiosLib;
155
+ //
156
+ // Bounded by default so a forgotten per-call override can never hang a request
157
+ // handler or queue worker indefinitely (the classic unguarded-await failure
158
+ // under load). Every call site can still override: per-request `timeout`,
159
+ // `signal` (used by streaming downloads whose 30s would be wrong), and
160
+ // per-request `httpAgent`/`httpsAgent` (used by the SSRF-pinned agents) all
161
+ // take precedence over these defaults. Audited 2026-07-24: every existing
162
+ // call site already sets its own bound, so this changes no current behavior.
163
+ const axios = axiosLib.create({
164
+ timeout : 30000,
165
+ httpAgent : new http.Agent({ keepAlive : true, maxSockets : 128 }),
166
+ httpsAgent : new https.Agent({ keepAlive : true, maxSockets : 128 })
167
+ });
152
168
 
153
169
  export { axios, isBlockedIP, safe };
package/dist/axios.js CHANGED
@@ -1,7 +1,8 @@
1
1
  // lib/axios.js
2
2
  import axiosLib from "axios";
3
3
  import dns from "dns";
4
- import https from "https";
4
+ import * as http from "http";
5
+ import * as https from "https";
5
6
  import net from "net";
6
7
  var dnsLookup = dns.promises.lookup;
7
8
  var isBlockedIPv4 = (ip) => {
@@ -77,6 +78,9 @@ var safeGet = async (url, axiosOptions = {}) => {
77
78
  }
78
79
  });
79
80
  return axiosLib.get(url, {
81
+ // Default bound for user-supplied URLs; callers override via
82
+ // axiosOptions.timeout (listed first so the spread wins).
83
+ timeout: 15e3,
80
84
  ...axiosOptions,
81
85
  httpsAgent: agent,
82
86
  maxRedirects: 0,
@@ -87,7 +91,11 @@ var safeGet = async (url, axiosOptions = {}) => {
87
91
  var safe = {
88
92
  get: safeGet
89
93
  };
90
- var axios = axiosLib;
94
+ var axios = axiosLib.create({
95
+ timeout: 3e4,
96
+ httpAgent: new http.Agent({ keepAlive: true, maxSockets: 128 }),
97
+ httpsAgent: new https.Agent({ keepAlive: true, maxSockets: 128 })
98
+ });
91
99
  export {
92
100
  axios,
93
101
  isBlockedIP,
package/package.json CHANGED
@@ -164,5 +164,5 @@
164
164
  "test": ". \"$HOME/.nvm/nvm.sh\" && nvm use && node --test"
165
165
  },
166
166
  "types": "dist/index.d.ts",
167
- "version": "0.0.87"
167
+ "version": "0.0.89"
168
168
  }