@fluid-app/exigo-connection-sdk 0.1.6 → 0.1.8

package/README.md

@@ -13,6 +13,8 @@ pnpm add @fluid-app/exigo-connection-sdk
 # Only for apps that query the SQL replica:
 pnpm add mssql
 pnpm add -D @types/mssql
+# Only for apps that reach Exigo through Fluid's egress proxy:
+pnpm add undici
 ```
 
 | Import                                 | Provides                                           | Needs `mssql` |
@@ -114,6 +116,47 @@ The client:
 `get`, `delete` take `params`, `query`, `headers`, `timeoutMs` and `signal`;
 `post`, `put`, `patch` also take a `body`, sent as JSON.
 
+### Through Fluid's egress proxy (Mist apps)
+
+Exigo allowlists callers by source IP, and a Mist app on Vercel has no fixed
+outbound IP. Fluid's egress proxy (`services/egress-proxy`) lends it one: a
+CONNECT-only forward proxy whose static IP Exigo tenants allowlist. TLS stays
+end to end between the app and Exigo, so the proxy never sees the Exigo
+credentials.
+
+```bash
+pnpm add undici
+```
+
+```ts
+const exigo = createExigoRestClient(rest, {
+  egressProxy: process.env.FLUID_EGRESS_PROXY_URL
+    ? {
+        url: process.env.FLUID_EGRESS_PROXY_URL,
+        // The install webhook's authentication_token (dit_…).
+        token: installation.authenticationToken,
+      }
+    : undefined,
+});
+```
+
+- Fluid sets `FLUID_EGRESS_PROXY_URL` on a droplet-linked Mist app when its
+  environment has a proxy. `fluid mist env pull` leaves it out on purpose: the
+  proxy refuses callers off Fluid's platform, so local runs call Exigo
+  directly, and the code above does that when the variable is unset.
+- The proxy authenticates the droplet installation token, and lets through
+  only droplets and Exigo hosts on its own allowlists.
+- The URL must be `https` (`http` only for a loopback proxy run locally),
+  since the CONNECT request carries the token outside the tunnel.
+- A refusal throws `ExigoProxyError`, a subclass of `ExigoConnectionError`
+  whose `status` is the proxy's answer: 407 for a token it does not accept, 403
+  for a droplet or host it does not let through, 502 or 504 when it could not
+  reach Exigo, 503 when it could not verify the token or is at capacity.
+- Clients built with the same proxy URL and token share one agent, so a
+  client per request still reuses open tunnels.
+- REST only. The proxy does not carry the SQL replica's port, and `mssql`
+  cannot use a proxy.
+
 ## 3. SQL
 
 ```ts
@@ -179,6 +222,7 @@ Authorization header.
 | `ExigoAuthError`        | REST 401/403, or a SQL login failure                  |
 | `ExigoTimeoutError`     | a REST call, SQL connect or SQL query ran too long    |
 | `ExigoConnectionError`  | DNS, refused connection, TLS, network                 |
+| `ExigoProxyError`       | the egress proxy refused the tunnel (`status`)        |
 | `ExigoApiError`         | REST answered with an error or a body that isn't JSON |
 
 `source` is `"rest"` or `"sql"` on the auth, timeout and connection errors.

package/dist/errors.d.mts

@@ -52,6 +52,20 @@ declare class ExigoConnectionError extends ExigoError {
   readonly source: ExigoSource;
   constructor(message: string, source: ExigoSource, options?: ExigoErrorOptions);
 }
+/**
+* Fluid's egress proxy refused to open a tunnel to Exigo. `status` is the
+* proxy's answer to CONNECT: 407 for a token it does not accept, 403 for a
+* droplet or host it does not let through, 502/504 when it could not reach
+* Exigo, 503 when it could not verify the token or is at capacity.
+*/
+declare class ExigoProxyError extends ExigoConnectionError {
+  name: string;
+  /** The proxy's HTTP status for the CONNECT request. */
+  readonly status: number;
+  constructor(message: string, source: ExigoSource, options: ExigoErrorOptions & {
+    readonly status: number;
+  });
+}
 interface ExigoApiErrorDetails {
   readonly status: number;
   readonly method: string;
@@ -76,4 +90,4 @@ declare class ExigoApiError extends ExigoError {
   constructor(message: string, details: ExigoApiErrorDetails);
 }
 //#endregion
-export { ExigoApiError, ExigoApiErrorDetails, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoErrorOptions, ExigoSource, ExigoTimeoutError };
+export { ExigoApiError, ExigoApiErrorDetails, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoErrorOptions, ExigoProxyError, ExigoSource, ExigoTimeoutError };

package/dist/errors.mjs

@@ -49,6 +49,21 @@ var ExigoConnectionError = class extends ExigoError {
 	}
 };
 /**
+* Fluid's egress proxy refused to open a tunnel to Exigo. `status` is the
+* proxy's answer to CONNECT: 407 for a token it does not accept, 403 for a
+* droplet or host it does not let through, 502/504 when it could not reach
+* Exigo, 503 when it could not verify the token or is at capacity.
+*/
+var ExigoProxyError = class extends ExigoConnectionError {
+	name = "ExigoProxyError";
+	/** The proxy's HTTP status for the CONNECT request. */
+	status;
+	constructor(message, source, options) {
+		super(message, source, options);
+		this.status = options.status;
+	}
+};
+/**
 * The REST API answered, but not with a usable result: a non-2xx status other
 * than an auth refusal, or a success whose body is not JSON (Exigo serves an
 * HTML page for a wrong URL with a 200).
@@ -70,4 +85,4 @@ var ExigoApiError = class extends ExigoError {
 	}
 };
 //#endregion
-export { ExigoApiError, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoTimeoutError };
+export { ExigoApiError, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoProxyError, ExigoTimeoutError };

package/dist/index.d.mts

@@ -1,3 +1,3 @@
 import { ExigoCredentialResolver, ExigoCredentials, ExigoRestCredentials, ExigoSqlCredentials, assertExigoRestCredentials, assertExigoSqlCredentials, defineExigoCredentials } from "./credentials.mjs";
-import { ExigoApiError, ExigoApiErrorDetails, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoErrorOptions, ExigoSource, ExigoTimeoutError } from "./errors.mjs";
-export { ExigoApiError, ExigoApiErrorDetails, ExigoAuthError, ExigoConnectionError, type ExigoCredentialResolver, type ExigoCredentials, ExigoCredentialsError, ExigoError, ExigoErrorOptions, type ExigoRestCredentials, ExigoSource, type ExigoSqlCredentials, ExigoTimeoutError, assertExigoRestCredentials, assertExigoSqlCredentials, defineExigoCredentials };
+import { ExigoApiError, ExigoApiErrorDetails, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoErrorOptions, ExigoProxyError, ExigoSource, ExigoTimeoutError } from "./errors.mjs";
+export { ExigoApiError, ExigoApiErrorDetails, ExigoAuthError, ExigoConnectionError, type ExigoCredentialResolver, type ExigoCredentials, ExigoCredentialsError, ExigoError, ExigoErrorOptions, ExigoProxyError, type ExigoRestCredentials, ExigoSource, type ExigoSqlCredentials, ExigoTimeoutError, assertExigoRestCredentials, assertExigoSqlCredentials, defineExigoCredentials };

package/dist/index.mjs

@@ -1,3 +1,3 @@
-import { ExigoApiError, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoTimeoutError } from "./errors.mjs";
+import { ExigoApiError, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoProxyError, ExigoTimeoutError } from "./errors.mjs";
 import { assertExigoRestCredentials, assertExigoSqlCredentials, defineExigoCredentials } from "./credentials.mjs";
-export { ExigoApiError, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoTimeoutError, assertExigoRestCredentials, assertExigoSqlCredentials, defineExigoCredentials };
+export { ExigoApiError, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoProxyError, ExigoTimeoutError, assertExigoRestCredentials, assertExigoSqlCredentials, defineExigoCredentials };

package/dist/rest.d.mts

@@ -1,5 +1,5 @@
 import { ExigoRestCredentials } from "./credentials.mjs";
-import { ExigoApiError, ExigoApiErrorDetails, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoErrorOptions, ExigoSource, ExigoTimeoutError } from "./errors.mjs";
+import { ExigoApiError, ExigoApiErrorDetails, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoErrorOptions, ExigoProxyError, ExigoSource, ExigoTimeoutError } from "./errors.mjs";
 
 //#region src/rest.d.ts
 declare const EXIGO_API_VERSION = "3.0";
@@ -21,11 +21,43 @@ interface ExigoRequestOptions {
 }
 type ExigoMethodOptions = Omit<ExigoRequestOptions, "body">;
 type ExigoBodyMethodOptions = ExigoRequestOptions;
+/**
+* Fluid's egress proxy: a CONNECT-only forward proxy with a static outbound IP
+* that Exigo tenants allowlist, for apps on hosts whose egress IPs are not
+* Fluid's (Mist apps on Vercel). TLS stays end to end between the app and
+* Exigo; the proxy never sees the Exigo credentials.
+*/
+interface ExigoEgressProxy {
+  /**
+  * The proxy URL, which Fluid provides to a droplet-linked Mist app as
+  * `FLUID_EGRESS_PROXY_URL`. Must be https: the CONNECT request carries the
+  * token outside the tunnel. Plain http is accepted only for a loopback host,
+  * such as a proxy run locally.
+  */
+  readonly url: string;
+  /**
+  * The droplet installation token (`dit_…`, the `authentication_token` of the
+  * install webhook) the proxy authenticates the app with. A `Bearer ` prefix
+  * is optional.
+  */
+  readonly token: string;
+}
 interface ExigoRestClientOptions {
   /** Per-request timeout. Defaults to {@link DEFAULT_EXIGO_TIMEOUT_MS}. */
   readonly timeoutMs?: number;
-  /** For tests and instrumentation. Defaults to the global `fetch`. */
+  /**
+  * For tests and instrumentation. Defaults to the global `fetch`, or to
+  * undici's when `egressProxy` is set; a custom one then receives the proxy
+  * as the `dispatcher` init option.
+  */
   readonly fetch?: typeof fetch;
+  /**
+  * Sends every request through Fluid's egress proxy. Needs the `undici`
+  * package. Leave it unset to call Exigo directly, as in local development,
+  * where Fluid withholds the proxy URL because the proxy refuses callers off
+  * its own platform.
+  */
+  readonly egressProxy?: ExigoEgressProxy;
 }
 interface ExigoRestClient {
   /** The normalized base URL, including the API version. */
@@ -62,4 +94,4 @@ declare function normalizeExigoBaseUrl(baseUrl: string): string;
 */
 declare function createExigoRestClient(credentials: ExigoRestCredentials | null | undefined, options?: ExigoRestClientOptions): ExigoRestClient;
 //#endregion
-export { DEFAULT_EXIGO_TIMEOUT_MS, EXIGO_API_VERSION, ExigoApiError, ExigoApiErrorDetails, ExigoAuthError, ExigoBodyMethodOptions, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoErrorOptions, ExigoHttpMethod, ExigoMethodOptions, ExigoQueryValue, ExigoRequestOptions, ExigoRestClient, ExigoRestClientOptions, type ExigoRestCredentials, ExigoSource, ExigoTimeoutError, createExigoRestClient, normalizeExigoBaseUrl };
+export { DEFAULT_EXIGO_TIMEOUT_MS, EXIGO_API_VERSION, ExigoApiError, ExigoApiErrorDetails, ExigoAuthError, ExigoBodyMethodOptions, ExigoConnectionError, ExigoCredentialsError, ExigoEgressProxy, ExigoError, ExigoErrorOptions, ExigoHttpMethod, ExigoMethodOptions, ExigoProxyError, ExigoQueryValue, ExigoRequestOptions, ExigoRestClient, ExigoRestClientOptions, type ExigoRestCredentials, ExigoSource, ExigoTimeoutError, createExigoRestClient, normalizeExigoBaseUrl };

package/dist/rest.mjs

@@ -1,4 +1,4 @@
-import { ExigoApiError, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoTimeoutError } from "./errors.mjs";
+import { ExigoApiError, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoProxyError, ExigoTimeoutError } from "./errors.mjs";
 import { assertExigoRestCredentials } from "./credentials.mjs";
 //#region src/rest.ts
 /**
@@ -11,7 +11,8 @@ import { assertExigoRestCredentials } from "./credentials.mjs";
 * in each app.
 *
 * Uses the global `fetch`, so it runs on Node 20+ (Cloud Run, Vercel's Node
-* runtime) without Node-only APIs.
+* runtime) without Node-only APIs. Routing through Fluid's egress proxy is the
+* exception: it needs `undici`, loaded only when `egressProxy` is set.
 */
 const EXIGO_API_VERSION = "3.0";
 const DEFAULT_EXIGO_TIMEOUT_MS = 15e3;
@@ -136,6 +137,75 @@ function validTimeout(timeoutMs) {
 	if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_TIMEOUT_MS) throw new TypeError(`Exigo timeoutMs must be a positive number up to ${MAX_TIMEOUT_MS}, got ${timeoutMs}.`);
 	return timeoutMs;
 }
+/** Same rule as the base URL: the CONNECT request carries the token in clear. */
+function normalizeEgressProxyUrl(proxyUrl) {
+	let url;
+	try {
+		url = new URL(proxyUrl.trim());
+	} catch {
+		throw new ExigoCredentialsError("Exigo egressProxy.url is not a valid URL.", ["egressProxy.url"]);
+	}
+	const loopbackHttp = url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname);
+	if (url.protocol !== "https:" && !loopbackHttp) throw new ExigoCredentialsError("Exigo egressProxy.url must be an https URL; the CONNECT request carries the token.", ["egressProxy.url"]);
+	if (url.username || url.password) throw new ExigoCredentialsError("Exigo egressProxy.url must not carry credentials; pass the token instead.", ["egressProxy.url"]);
+	return url.origin;
+}
+function normalizeEgressProxyToken(token) {
+	const bare = token.replace(/^\s*Bearer(?:\s+|$)/i, "").trim();
+	if (bare === "" || /\s/.test(bare)) throw new ExigoCredentialsError("Exigo egressProxy.token must be the droplet installation token (dit_…).", ["egressProxy.token"]);
+	return bare;
+}
+/**
+* One proxy agent per proxy URL and token, shared by every client that uses
+* them, so a droplet building a client per request still reuses its tunnels.
+*/
+const proxyTransports = /* @__PURE__ */ new Map();
+async function loadUndici() {
+	try {
+		return await import("undici");
+	} catch (error) {
+		throw new ExigoError("Routing Exigo calls through egressProxy needs the undici package. Install it next to @fluid-app/exigo-connection-sdk.", { cause: error });
+	}
+}
+function proxyTransport(proxyUrl, token) {
+	const key = `${proxyUrl}\n${token}`;
+	let transport = proxyTransports.get(key);
+	if (!transport) {
+		transport = loadUndici().then((undici) => ({
+			fetch: undici.fetch,
+			dispatcher: new undici.ProxyAgent({
+				uri: proxyUrl,
+				token: `Bearer ${token}`
+			})
+		}));
+		transport.catch(() => proxyTransports.delete(key));
+		proxyTransports.set(key, transport);
+	}
+	return transport;
+}
+/** undici reports a refused CONNECT as `Proxy response (407) !== 200 ...`. */
+function proxyRefusalStatus(error) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current instanceof Error && !seen.has(current)) {
+		seen.add(current);
+		const match = /Proxy response \((\d{3})\)/.exec(current.message);
+		if (match) return Number(match[1]);
+		current = current.cause;
+	}
+	return null;
+}
+function describeProxyRefusal(status, host, proxyHost) {
+	const prefix = `Fluid's egress proxy at ${proxyHost} refused the tunnel to ${host} (HTTP ${status})`;
+	switch (status) {
+		case 407: return `${prefix}: it did not accept the token. Pass the droplet installation token (dit_…) as egressProxy.token.`;
+		case 403: return `${prefix}: this droplet may not egress through it, or ${host} is not on its allowlist.`;
+		case 502: return `${prefix}: it could not reach Exigo.`;
+		case 503: return `${prefix}: it could not verify the token with Fluid or is at capacity. Retry.`;
+		case 504: return `${prefix}: its connection to Exigo timed out. Retry.`;
+		default: return `${prefix}.`;
+	}
+}
 /**
 * Creates a client for one set of REST credentials.
 *
@@ -149,9 +219,26 @@ function createExigoRestClient(credentials, options = {}) {
 	const baseUrl = normalizeExigoBaseUrl(credentials.baseUrl);
 	const host = new URL(baseUrl).host;
 	const authorization = authorizationHeader(credentials);
-	const secrets = [credentials.password, authorization.replace(/^Basic /, "")];
+	const egressProxy = options.egressProxy ? {
+		url: normalizeEgressProxyUrl(options.egressProxy.url),
+		token: normalizeEgressProxyToken(options.egressProxy.token)
+	} : null;
+	const proxyHost = egressProxy ? new URL(egressProxy.url).host : null;
+	const secrets = [
+		credentials.password,
+		authorization.replace(/^Basic /, ""),
+		...egressProxy ? [egressProxy.token] : []
+	];
 	const defaultTimeout = validTimeout(options.timeoutMs ?? 15e3);
-	const fetchImpl = options.fetch ?? globalThis.fetch;
+	async function send(url, init) {
+		if (!egressProxy) return (options.fetch ?? globalThis.fetch)(url, init);
+		const transport = await proxyTransport(egressProxy.url, egressProxy.token);
+		const proxiedInit = {
+			...init,
+			dispatcher: transport.dispatcher
+		};
+		return (options.fetch ?? transport.fetch)(url, proxiedInit);
+	}
 	async function request(method, path, requestOptions = {}) {
 		const relative = expandPath(path, requestOptions.params);
 		const url = new URL(`${baseUrl}${relative}`);
@@ -178,7 +265,7 @@ function createExigoRestClient(credentials, options = {}) {
 		let response;
 		let text;
 		try {
-			response = await fetchImpl(url, {
+			response = await send(url, {
 				method,
 				headers,
 				body,
@@ -191,7 +278,15 @@ function createExigoRestClient(credentials, options = {}) {
 				timeoutMs
 			});
 			if (callerSignal?.aborted) throw callerSignal.reason;
-			throw new ExigoConnectionError(`Could not reach Exigo at ${host}: ${describeNetworkFailure(error)}`, "rest", { cause: error });
+			if (error instanceof ExigoError) throw error;
+			if (proxyHost) {
+				const status = proxyRefusalStatus(error);
+				if (status !== null) throw new ExigoProxyError(describeProxyRefusal(status, host, proxyHost), "rest", {
+					cause: error,
+					status
+				});
+			}
+			throw new ExigoConnectionError(`Could not reach Exigo at ${host}${proxyHost ? ` through the egress proxy at ${proxyHost}` : ""}: ${redact(describeNetworkFailure(error), secrets)}`, "rest", { cause: error });
 		} finally {
 			clearTimeout(timer);
 			callerSignal?.removeEventListener("abort", onCallerAbort);
@@ -228,4 +323,4 @@ function createExigoRestClient(credentials, options = {}) {
 	};
 }
 //#endregion
-export { DEFAULT_EXIGO_TIMEOUT_MS, EXIGO_API_VERSION, ExigoApiError, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoTimeoutError, createExigoRestClient, normalizeExigoBaseUrl };
+export { DEFAULT_EXIGO_TIMEOUT_MS, EXIGO_API_VERSION, ExigoApiError, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoProxyError, ExigoTimeoutError, createExigoRestClient, normalizeExigoBaseUrl };

package/dist/sql.d.mts

@@ -1,5 +1,5 @@
 import { ExigoSqlCredentials } from "./credentials.mjs";
-import { ExigoApiError, ExigoApiErrorDetails, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoErrorOptions, ExigoSource, ExigoTimeoutError } from "./errors.mjs";
+import { ExigoApiError, ExigoApiErrorDetails, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoErrorOptions, ExigoProxyError, ExigoSource, ExigoTimeoutError } from "./errors.mjs";
 import { ConnectionPool, ConnectionPool as ConnectionPool$1 } from "mssql";
 
 //#region src/sql.d.ts
@@ -50,4 +50,4 @@ declare function closeExigoPool(credentials: Pick<ExigoSqlCredentials, "host" |
 /** Closes every pool this package opened; for shutdown hooks and tests. */
 declare function closeAllExigoPools(): Promise<void>;
 //#endregion
-export { type ConnectionPool, EXIGO_SQL_DEFAULTS, ExigoApiError, ExigoApiErrorDetails, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoErrorOptions, ExigoPoolOptions, ExigoSource, type ExigoSqlCredentials, ExigoTimeoutError, closeAllExigoPools, closeExigoPool, getExigoPool, translateExigoSqlError };
+export { type ConnectionPool, EXIGO_SQL_DEFAULTS, ExigoApiError, ExigoApiErrorDetails, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoErrorOptions, ExigoPoolOptions, ExigoProxyError, ExigoSource, type ExigoSqlCredentials, ExigoTimeoutError, closeAllExigoPools, closeExigoPool, getExigoPool, translateExigoSqlError };

package/dist/sql.mjs

@@ -1,4 +1,4 @@
-import { ExigoApiError, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoTimeoutError } from "./errors.mjs";
+import { ExigoApiError, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoProxyError, ExigoTimeoutError } from "./errors.mjs";
 import { assertExigoSqlCredentials } from "./credentials.mjs";
 import { createHash } from "node:crypto";
 //#region src/sql.ts
@@ -292,4 +292,4 @@ async function closeEntry(entry) {
 	await pool.close();
 }
 //#endregion
-export { EXIGO_SQL_DEFAULTS, ExigoApiError, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoTimeoutError, closeAllExigoPools, closeExigoPool, getExigoPool, translateExigoSqlError };
+export { EXIGO_SQL_DEFAULTS, ExigoApiError, ExigoAuthError, ExigoConnectionError, ExigoCredentialsError, ExigoError, ExigoProxyError, ExigoTimeoutError, closeAllExigoPools, closeExigoPool, getExigoPool, translateExigoSqlError };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fluid-app/exigo-connection-sdk",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Exigo REST client, SQL pool and credential interface for Fluid droplets and Mist apps",
   "license": "UNLICENSED",
   "repository": {
@@ -41,11 +41,13 @@
     "mssql": "^12.7.2",
     "tsdown": "^0.21.0",
     "typescript": "^5",
+    "undici": "^7.28.0",
     "vitest": "^4.0.18"
   },
   "peerDependencies": {
     "@types/mssql": ">=9",
-    "mssql": ">=11 <13"
+    "mssql": ">=11 <13",
+    "undici": ">=6 <8"
   },
   "peerDependenciesMeta": {
     "@types/mssql": {
@@ -53,6 +55,9 @@
     },
     "mssql": {
       "optional": true
+    },
+    "undici": {
+      "optional": true
     }
   },
   "scripts": {