@kya-os/mcp 1.9.0 → 1.10.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +32 -0
- package/README.md +1 -1
- package/dist/middleware/with-kya-os.config-types.d.ts +8 -1
- package/dist/middleware/with-kya-os.config-types.d.ts.map +1 -1
- package/dist/middleware/with-kya-os.config-types.js.map +1 -1
- package/dist/proof/generator.d.ts +18 -1
- package/dist/proof/generator.d.ts.map +1 -1
- package/dist/proof/generator.js +17 -2
- package/dist/proof/generator.js.map +1 -1
- package/dist/utils/safe-fetch-transports.d.ts +15 -2
- package/dist/utils/safe-fetch-transports.d.ts.map +1 -1
- package/dist/utils/safe-fetch-transports.js +66 -32
- package/dist/utils/safe-fetch-transports.js.map +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,38 @@ Versioning: https://semver.org/spec/v2.0.0.html
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [1.10.1] - 2026-07-08
|
|
11
|
+
|
|
12
|
+
### Fixed
|
|
13
|
+
|
|
14
|
+
- **Cloudflare Worker / workerd bundle compatibility.** `safe-fetch-transports`
|
|
15
|
+
statically imported `node:dns/promises` and `node:https` at the module top
|
|
16
|
+
level, so anything that builds a `SafeFetch` — including the Entity Card /
|
|
17
|
+
VC-JWT verification path (card resolution + status-list revocation) — required
|
|
18
|
+
those node built-ins at bundle time and broke workerd builds. They now load
|
|
19
|
+
**lazily** (only when a node code path actually runs), so the module bundles
|
|
20
|
+
cleanly for workerd / browser. `selectDefaultTransport` transparently falls
|
|
21
|
+
back to `fetchTransport` where `node:https` is absent. The SSRF policy
|
|
22
|
+
(resolve-and-pin, private-range denial, redirect + size + timeout guards) is
|
|
23
|
+
unchanged; a Worker injects its own DNS seam (or uses trusted origins +
|
|
24
|
+
`fetchTransport`) to avoid `node:dns` at runtime.
|
|
25
|
+
|
|
26
|
+
## [1.10.0] - 2026-07-08
|
|
27
|
+
|
|
28
|
+
### Added
|
|
29
|
+
|
|
30
|
+
- **`ProofGenerator` accepts a non-extractable signing key.**
|
|
31
|
+
`ProofAgentIdentity.privateKey` and `KyaOsIdentityConfig.privateKey` now
|
|
32
|
+
accept a `CryptoKey` handle in addition to a base64 private-key string. A
|
|
33
|
+
non-extractable WebCrypto key (e.g. a passkey-PRF-derived or HSM/KMS-fronted
|
|
34
|
+
key) can now produce `org.kya-os/proof` proofs without the secret ever being
|
|
35
|
+
materialized by the caller — realizing the signer-hook model the spec already
|
|
36
|
+
describes (§4.5) — end-to-end through `withKyaOs`. Both key forms yield an
|
|
37
|
+
equally valid, verifier-accepted proof. Backward-compatible: existing string
|
|
38
|
+
keys are unaffected (the string path is byte-for-byte unchanged); the only
|
|
39
|
+
source-level impact is that external code which reads `.privateKey` expecting
|
|
40
|
+
a `string` now sees a `string | CryptoKey` union.
|
|
41
|
+
|
|
10
42
|
## [1.9.0] - 2026-07-07
|
|
11
43
|
|
|
12
44
|
Entity Card (`@kya-os/mcp/card`) — a typed, DID-anchored, per-request
|
package/README.md
CHANGED
|
@@ -172,7 +172,7 @@ Also available: [outbound-delegation](./examples/outbound-delegation/) (gateway
|
|
|
172
172
|
| Capability | How it works |
|
|
173
173
|
|-----------|-------------|
|
|
174
174
|
| **Cryptographic identity** | Ed25519 (EdDSA) and P-256 (ES256, FIPS-eligible) key pairs, `did:key` / `did:web` resolution, optional `did:cheqd` resolver support |
|
|
175
|
-
| **Entity Card** | Typed, DID-anchored identity: fluent `card()` builder, `
|
|
175
|
+
| **Entity Card** | Typed, DID-anchored identity: fluent `card()` builder, `requireProof` per-request holder-of-key guard, CIMD OAuth on-ramp (`client_id` ⇄ `did:web`, MCP's default client auth), and `withKyaOsCard` projections that embed into MCP `server.json` / Server Cards (draft SEP-2127), A2A AgentCards, and NANDA AgentFacts |
|
|
176
176
|
| **Signed proofs** | Detached JWS over JCS-canonicalized request/response hashes |
|
|
177
177
|
| **Delegation credentials** | W3C Verifiable Credentials with scope constraints, rooted at a Responsible Party |
|
|
178
178
|
| **Revocation** | StatusList2021 bitstring with cascading revocation |
|
|
@@ -16,7 +16,14 @@ import type { DelegationCredential } from "../types/protocol.js";
|
|
|
16
16
|
export interface KyaOsIdentityConfig {
|
|
17
17
|
did: string;
|
|
18
18
|
kid: string;
|
|
19
|
-
|
|
19
|
+
/**
|
|
20
|
+
* The Ed25519 signing key: a base64 raw private key, or a `CryptoKey` handle
|
|
21
|
+
* — including a non-extractable one (passkey-PRF- or HSM/KMS-fronted). The key
|
|
22
|
+
* is used only to sign per-request proofs (via {@link ProofGenerator}), so a
|
|
23
|
+
* handle lets a deployment keep secret key material inside its trust boundary
|
|
24
|
+
* end-to-end, per SPEC §4.5. See {@link ProofAgentIdentity.privateKey}.
|
|
25
|
+
*/
|
|
26
|
+
privateKey: string | CryptoKey;
|
|
20
27
|
publicKey: string;
|
|
21
28
|
agentName?: string;
|
|
22
29
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"with-kya-os.config-types.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.config-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"with-kya-os.config-types.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.config-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,cAAc,kDAAmD,CAAC;AAC/E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CACvB,cAAc,EAAE,oBAAoB,KACjC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACrC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,WAAW;IAC1B,0CAA0C;IAC1C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,sCAAsC;IACtC,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC5C;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC;;;;;;;;;;;;;;;OAeG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wCAAwC;IACxC,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"with-kya-os.config-types.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.config-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;
|
|
1
|
+
{"version":3,"file":"with-kya-os.config-types.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.config-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA6BH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,YAAY,CAAU,CAAC"}
|
|
@@ -33,7 +33,16 @@ export declare const LEGACY_PROOF_META_KEY = "proof";
|
|
|
33
33
|
export interface ProofAgentIdentity {
|
|
34
34
|
did: string;
|
|
35
35
|
kid: string;
|
|
36
|
-
|
|
36
|
+
/**
|
|
37
|
+
* The Ed25519 signing key. Either the base64-encoded raw private key (the
|
|
38
|
+
* historical form), or a `CryptoKey` handle — including a **non-extractable**
|
|
39
|
+
* WebCrypto key (e.g. a passkey-PRF-derived or HSM/KMS-fronted key). Passing a
|
|
40
|
+
* handle keeps secret key material inside the caller's trust boundary and
|
|
41
|
+
* hands the library only a signer, per SPEC §4.5 ("implementations that …
|
|
42
|
+
* hold agent secret keys … are non-conformant") and the KMS/HSM signer-hook
|
|
43
|
+
* guidance. Either form produces an equally valid, verifier-accepted proof.
|
|
44
|
+
*/
|
|
45
|
+
privateKey: string | CryptoKey;
|
|
37
46
|
publicKey: string;
|
|
38
47
|
}
|
|
39
48
|
export interface ToolRequest {
|
|
@@ -97,6 +106,14 @@ export declare class ProofGenerator {
|
|
|
97
106
|
*/
|
|
98
107
|
hashRequest(request: ToolRequest): Promise<string>;
|
|
99
108
|
private generateCanonicalHashes;
|
|
109
|
+
/**
|
|
110
|
+
* Resolve the identity's signing key into the form jose signs with. A base64
|
|
111
|
+
* string is imported as a PKCS#8 key (the historical path); a `CryptoKey`
|
|
112
|
+
* handle — including a non-extractable one (passkey-PRF- or HSM/KMS-fronted)
|
|
113
|
+
* — is used as-is. Either way the caller never has to materialize secret key
|
|
114
|
+
* bytes for the library, per SPEC §4.5.
|
|
115
|
+
*/
|
|
116
|
+
private resolveSigningKey;
|
|
100
117
|
private generateJWS;
|
|
101
118
|
private formatPrivateKeyAsPEM;
|
|
102
119
|
verifyProof(proof: DetachedProof, request: ToolRequest, response?: ToolResponse): Promise<boolean>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/proof/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EACV,aAAa,EAEb,cAAc,EACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,UAAU,CAAC;AAE7C,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/proof/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EACV,aAAa,EAEb,cAAc,EACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,UAAU,CAAC;AAE7C,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,aAAa,CAAC;QACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,GAC3C,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBzD;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,cAAc,CAAiB;gBAE3B,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc;IAKxE;;;;;;;;;;;;OAYG;IACG,aAAa,CACjB,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,aAAa,CAAC;IAsBzB;;;OAGG;IACG,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;YAI1C,uBAAuB;IASrC;;;;;;OAMG;YACW,iBAAiB;YAOjB,WAAW;IA2CzB,OAAO,CAAC,qBAAqB;IAqBvB,WAAW,CACf,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,YAAY,GACtB,OAAO,CAAC,OAAO,CAAC;IA4BnB,OAAO,CAAC,oBAAoB;CAc7B;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,cAAc,EACvB,cAAc,EAAE,cAAc,EAC9B,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,YAAY,CAAC,CAMvB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GACrB;IACD,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAQA"}
|
package/dist/proof/generator.js
CHANGED
|
@@ -108,10 +108,25 @@ export class ProofGenerator {
|
|
|
108
108
|
async generateCanonicalHashes(request, response) {
|
|
109
109
|
return computeCanonicalHashes(request, response, (bytes) => this.cryptoProvider.hash(bytes));
|
|
110
110
|
}
|
|
111
|
+
/**
|
|
112
|
+
* Resolve the identity's signing key into the form jose signs with. A base64
|
|
113
|
+
* string is imported as a PKCS#8 key (the historical path); a `CryptoKey`
|
|
114
|
+
* handle — including a non-extractable one (passkey-PRF- or HSM/KMS-fronted)
|
|
115
|
+
* — is used as-is. Either way the caller never has to materialize secret key
|
|
116
|
+
* bytes for the library, per SPEC §4.5.
|
|
117
|
+
*/
|
|
118
|
+
async resolveSigningKey() {
|
|
119
|
+
const key = this.identity.privateKey;
|
|
120
|
+
return typeof key === 'string'
|
|
121
|
+
? importPKCS8(this.formatPrivateKeyAsPEM(key), 'EdDSA')
|
|
122
|
+
: key;
|
|
123
|
+
}
|
|
111
124
|
async generateJWS(meta) {
|
|
112
125
|
try {
|
|
113
|
-
|
|
114
|
-
|
|
126
|
+
// jose's CompactSign owns the JWS signing-input construction, so
|
|
127
|
+
// canonicalization stays inside the library and the signing input is the
|
|
128
|
+
// same regardless of how the signing key was supplied.
|
|
129
|
+
const privateKey = await this.resolveSigningKey();
|
|
115
130
|
const payload = {
|
|
116
131
|
aud: meta.audience,
|
|
117
132
|
sub: meta.did,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../src/proof/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAOjD,OAAO,EAAE,aAAa,EAAmB,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAE3F;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;
|
|
1
|
+
{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../src/proof/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAOjD,OAAO,EAAE,aAAa,EAAmB,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAE3F;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAuC7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAoB,EACpB,QAAkC,EAClC,IAA4C;IAE5C,MAAM,gBAAgB,GAAG;QACvB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAC5B,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,YAAY,CAAC,gBAAsD,CAAC,CACrE,CACF,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAC7B,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,YAAY,CAAC,QAAQ,CAAC,IAA0C,CAAC,CAClE,CACF,CAAC;IACF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,QAAQ,CAAqB;IAC7B,cAAc,CAAiB;IAEvC,YAAY,QAA4B,EAAE,cAA8B;QACtE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,aAAa,CACjB,OAAoB,EACpB,QAAkC,EAClC,OAAuB,EACvB,UAAwB,EAAE;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAErE,MAAM,IAAI,GAAc;YACtB,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;YACtB,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;YACtB,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACjC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;gBACvC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,OAAO;SACX,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAEzC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,OAAoB;QACpC,OAAO,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;IACnE,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,OAAoB,EACpB,QAAuB;QAEvB,OAAO,sBAAsB,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CACzD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAChC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,iBAAiB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACrC,OAAO,OAAO,GAAG,KAAK,QAAQ;YAC5B,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;YACvD,CAAC,CAAC,GAAG,CAAC;IACV,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAe;QACvC,IAAI,CAAC;YACH,iEAAiE;YACjE,yEAAyE;YACzE,uDAAuD;YACvD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAElD,MAAM,OAAO,GAAG;gBACd,GAAG,EAAE,IAAI,CAAC,QAAQ;gBAClB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC3E,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9C,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;gBAChE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;aAC5C,CAAC;YAEF,6EAA6E;YAC7E,gFAAgF;YAChF,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAA6C,CAAC,CAAC;YACrF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAEhE,MAAM,GAAG,GAAG,MAAM,IAAI,WAAW,CAAC,YAAY,CAAC;iBAC5C,kBAAkB,CAAC;gBAClB,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;aACvB,CAAC;iBACD,IAAI,CAAC,UAAU,CAAC,CAAC;YAEpB,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,qBAAqB,CAAC,gBAAwB;QACpD,MAAM,OAAO,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAEhD,2BAA2B;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAErD,0CAA0C;QAC1C,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,wBAAwB,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAErD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;QAE1E,OAAO,CACL,+BAA+B;YAC/B,YAAY;YACZ,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CACf,KAAoB,EACpB,OAAoB,EACpB,QAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAE7E,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC1C,IACE,cAAc,CAAC,YAAY,KAAK,SAAS;oBACzC,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,cAAc,CAAC,YAAY,EACvD,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAE7D,OAAO,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE;gBACtD,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;gBAC9B,GAAG,EAAE,OAAO;aACb,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,eAAuB;QAClD,MAAM,cAAc,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;QAEtD,IAAI,cAAc,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,OAAO;YACL,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,SAAS;YACd,CAAC,EAAE,wBAAwB,CAAC,cAAc,CAAC;YAC3C,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;SACvB,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAoB,EACpB,IAAa,EACb,QAA4B,EAC5B,OAAuB,EACvB,cAA8B,EAC9B,UAAwB,EAAE;IAE1B,MAAM,QAAQ,GAAiB,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACtF,QAAQ,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC;IAC1B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAoB,EACpB,QAAsB;IAKtB,OAAO;QACL,OAAO,EAAE;YACP,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,QAAQ,EAAE,QAAQ,CAAC,IAAI;KACxB,CAAC;AACJ,CAAC"}
|
|
@@ -9,6 +9,7 @@
|
|
|
9
9
|
* already run in the policy layer via `resolveAndPin`). All addressing policy lives in
|
|
10
10
|
* `./ip-classifier`; the seam vocabulary lives in `./safe-fetch-types`. No crypto here.
|
|
11
11
|
*/
|
|
12
|
+
import type { LookupFunction } from 'node:net';
|
|
12
13
|
import type { DnsLookup, SafeFetchTransport } from './safe-fetch-types.js';
|
|
13
14
|
/** Default DNS seam — resolve every address (`all: true`) for full SSRF screening. */
|
|
14
15
|
export declare const defaultLookup: DnsLookup;
|
|
@@ -29,12 +30,24 @@ export declare const defaultLookup: DnsLookup;
|
|
|
29
30
|
* `node:https` works; the first-party escape hatch avoids the window for a caller's own origin.
|
|
30
31
|
*/
|
|
31
32
|
export declare const fetchTransport: SafeFetchTransport;
|
|
33
|
+
/**
|
|
34
|
+
* Build the custom `node:https` lookup that pins the connection to the pre-validated IP for BOTH
|
|
35
|
+
* call-shapes (closing the DNS-rebinding TOCTOU window). Node ≥20 defaults to
|
|
36
|
+
* `autoSelectFamily=true`, which invokes a custom lookup with `{ all: true }` and expects an ARRAY
|
|
37
|
+
* of `{ address, family }`; a scalar 3-arg callback yields "Invalid IP address: undefined" and
|
|
38
|
+
* breaks every real request. Honour the array form when `all` is asked, the scalar form otherwise.
|
|
39
|
+
* Exported for direct unit testing (the request wiring around it is integration-only — no TLS in
|
|
40
|
+
* the unit suite). Not re-exported from the package barrels; the public surface is unchanged.
|
|
41
|
+
*/
|
|
42
|
+
export declare function buildPinnedLookup(pinnedAddress: string, family: 4 | 6): LookupFunction;
|
|
32
43
|
/** Default transport — node:https pinned to the validated IP, TLS SNI preserved, body-capped. */
|
|
33
44
|
export declare const nodeHttpsTransport: SafeFetchTransport;
|
|
34
45
|
/**
|
|
35
46
|
* Pick the default transport: the `node:https` pinned transport when it is available, else the
|
|
36
|
-
* fetch-based transport.
|
|
37
|
-
*
|
|
47
|
+
* fetch-based transport. The `node:https` check is deferred to request time (it lazy-loads), so a
|
|
48
|
+
* runtime without `node:https` (workerd) transparently gets `fetchTransport`. This only covers
|
|
49
|
+
* ABSENCE of `node:https`; a runtime where the pinned path is present-but-broken (e.g. the Vercel
|
|
50
|
+
* Node serverless runtime) must still pass `transport: fetchTransport` explicitly.
|
|
38
51
|
*/
|
|
39
52
|
export declare function selectDefaultTransport(): SafeFetchTransport;
|
|
40
53
|
//# sourceMappingURL=safe-fetch-transports.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"safe-fetch-transports.d.ts","sourceRoot":"","sources":["../../src/utils/safe-fetch-transports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;
|
|
1
|
+
{"version":3,"file":"safe-fetch-transports.d.ts","sourceRoot":"","sources":["../../src/utils/safe-fetch-transports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAe,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AA2CxF,sFAAsF;AACtF,eAAO,MAAM,aAAa,EAAE,SAI3B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc,EAAE,kBAG5B,CAAC;AA2BF;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,cAAc,CAUtF;AAED,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,EAAE,kBA+BhC,CAAC;AAgBF;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,kBAAkB,CAK3D"}
|
|
@@ -9,10 +9,25 @@
|
|
|
9
9
|
* already run in the policy layer via `resolveAndPin`). All addressing policy lives in
|
|
10
10
|
* `./ip-classifier`; the seam vocabulary lives in `./safe-fetch-types`. No crypto here.
|
|
11
11
|
*/
|
|
12
|
-
|
|
13
|
-
|
|
12
|
+
let dnsLookupPromise;
|
|
13
|
+
/**
|
|
14
|
+
* Lazily load (and cache) `node:dns/promises`' `lookup`. Where `node:dns` is absent (workerd),
|
|
15
|
+
* fail with a guiding error rather than a cryptic module-resolution reject: a Worker should inject
|
|
16
|
+
* its own `lookup` seam (e.g. DNS-over-HTTPS) or use trusted origins + `fetchTransport`.
|
|
17
|
+
*/
|
|
18
|
+
function loadNodeDnsLookup() {
|
|
19
|
+
return (dnsLookupPromise ??= import('node:dns/promises').then((m) => m.lookup, (cause) => {
|
|
20
|
+
throw new Error('safe-fetch: node:dns is unavailable in this runtime — inject a `lookup` seam (e.g. DNS-over-HTTPS) or use trusted origins with fetchTransport', { cause });
|
|
21
|
+
}));
|
|
22
|
+
}
|
|
23
|
+
let nodeHttpsPromise;
|
|
24
|
+
/** Lazily load (and cache) `node:https`; resolves to `null` where it's absent (workerd). */
|
|
25
|
+
function loadNodeHttps() {
|
|
26
|
+
return (nodeHttpsPromise ??= import('node:https').then((m) => m, () => null));
|
|
27
|
+
}
|
|
14
28
|
/** Default DNS seam — resolve every address (`all: true`) for full SSRF screening. */
|
|
15
29
|
export const defaultLookup = async (hostname) => {
|
|
30
|
+
const nodeDnsLookup = await loadNodeDnsLookup();
|
|
16
31
|
const resolved = await nodeDnsLookup(hostname, { all: true, verbatim: true });
|
|
17
32
|
return resolved.map((entry) => ({ address: entry.address, family: entry.family }));
|
|
18
33
|
};
|
|
@@ -61,42 +76,56 @@ async function readCapped(response, maxBytes) {
|
|
|
61
76
|
text: () => Promise.resolve(body),
|
|
62
77
|
};
|
|
63
78
|
}
|
|
64
|
-
/**
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
79
|
+
/**
|
|
80
|
+
* Build the custom `node:https` lookup that pins the connection to the pre-validated IP for BOTH
|
|
81
|
+
* call-shapes (closing the DNS-rebinding TOCTOU window). Node ≥20 defaults to
|
|
82
|
+
* `autoSelectFamily=true`, which invokes a custom lookup with `{ all: true }` and expects an ARRAY
|
|
83
|
+
* of `{ address, family }`; a scalar 3-arg callback yields "Invalid IP address: undefined" and
|
|
84
|
+
* breaks every real request. Honour the array form when `all` is asked, the scalar form otherwise.
|
|
85
|
+
* Exported for direct unit testing (the request wiring around it is integration-only — no TLS in
|
|
86
|
+
* the unit suite). Not re-exported from the package barrels; the public surface is unchanged.
|
|
87
|
+
*/
|
|
88
|
+
export function buildPinnedLookup(pinnedAddress, family) {
|
|
89
|
+
return (_hostname, options, cb) => {
|
|
73
90
|
if (typeof options === 'object' && options?.all) {
|
|
74
91
|
cb(null, [
|
|
75
|
-
{ address:
|
|
92
|
+
{ address: pinnedAddress, family },
|
|
76
93
|
]);
|
|
77
94
|
}
|
|
78
95
|
else {
|
|
79
|
-
cb(null,
|
|
96
|
+
cb(null, pinnedAddress, family);
|
|
80
97
|
}
|
|
81
98
|
};
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
99
|
+
}
|
|
100
|
+
/** Default transport — node:https pinned to the validated IP, TLS SNI preserved, body-capped. */
|
|
101
|
+
export const nodeHttpsTransport = async (url, init) => {
|
|
102
|
+
const https = await loadNodeHttps();
|
|
103
|
+
if (!https) {
|
|
104
|
+
throw new Error('safe-fetch: node:https is unavailable in this runtime; pass transport: fetchTransport');
|
|
105
|
+
}
|
|
106
|
+
const httpsRequest = https.request;
|
|
107
|
+
return new Promise((resolve, reject) => {
|
|
108
|
+
const family = init.family === 6 ? 6 : 4;
|
|
109
|
+
const pinnedLookup = buildPinnedLookup(init.pinnedAddress, family);
|
|
110
|
+
const req = httpsRequest(url, { method: 'GET', servername: init.hostname, signal: init.signal, lookup: pinnedLookup }, (res) => {
|
|
111
|
+
const chunks = [];
|
|
112
|
+
let size = 0;
|
|
113
|
+
res.on('data', (chunk) => {
|
|
114
|
+
size += chunk.length;
|
|
115
|
+
if (size > init.maxBytes) {
|
|
116
|
+
req.destroy();
|
|
117
|
+
reject(new Error(`safe-fetch: response body exceeds size cap ${init.maxBytes}`));
|
|
118
|
+
return;
|
|
119
|
+
}
|
|
120
|
+
chunks.push(chunk);
|
|
121
|
+
});
|
|
122
|
+
res.on('end', () => resolve(toRawResponse(res, chunks)));
|
|
123
|
+
res.on('error', reject);
|
|
93
124
|
});
|
|
94
|
-
|
|
95
|
-
|
|
125
|
+
req.on('error', reject);
|
|
126
|
+
req.end();
|
|
96
127
|
});
|
|
97
|
-
|
|
98
|
-
req.end();
|
|
99
|
-
});
|
|
128
|
+
};
|
|
100
129
|
/** Project a node:http IncomingMessage + buffered chunks into the RawResponse shape. */
|
|
101
130
|
function toRawResponse(res, chunks) {
|
|
102
131
|
return {
|
|
@@ -112,10 +141,15 @@ function toRawResponse(res, chunks) {
|
|
|
112
141
|
}
|
|
113
142
|
/**
|
|
114
143
|
* Pick the default transport: the `node:https` pinned transport when it is available, else the
|
|
115
|
-
* fetch-based transport.
|
|
116
|
-
*
|
|
144
|
+
* fetch-based transport. The `node:https` check is deferred to request time (it lazy-loads), so a
|
|
145
|
+
* runtime without `node:https` (workerd) transparently gets `fetchTransport`. This only covers
|
|
146
|
+
* ABSENCE of `node:https`; a runtime where the pinned path is present-but-broken (e.g. the Vercel
|
|
147
|
+
* Node serverless runtime) must still pass `transport: fetchTransport` explicitly.
|
|
117
148
|
*/
|
|
118
149
|
export function selectDefaultTransport() {
|
|
119
|
-
return
|
|
150
|
+
return async (url, init) => {
|
|
151
|
+
const https = await loadNodeHttps();
|
|
152
|
+
return https ? nodeHttpsTransport(url, init) : fetchTransport(url, init);
|
|
153
|
+
};
|
|
120
154
|
}
|
|
121
155
|
//# sourceMappingURL=safe-fetch-transports.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"safe-fetch-transports.js","sourceRoot":"","sources":["../../src/utils/safe-fetch-transports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;
|
|
1
|
+
{"version":3,"file":"safe-fetch-transports.js","sourceRoot":"","sources":["../../src/utils/safe-fetch-transports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAmBH,IAAI,gBAAoD,CAAC;AACzD;;;;GAIG;AACH,SAAS,iBAAiB;IACxB,OAAO,CAAC,gBAAgB,KAAK,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAC3D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EACf,CAAC,KAAK,EAAE,EAAE;QACR,MAAM,IAAI,KAAK,CACb,+IAA+I,EAC/I,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC,CACF,CAAC,CAAC;AACL,CAAC;AAGD,IAAI,gBAAuD,CAAC;AAC5D,4FAA4F;AAC5F,SAAS,aAAa;IACpB,OAAO,CAAC,gBAAgB,KAAK,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CACpD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EACR,GAAG,EAAE,CAAC,IAAI,CACX,CAAC,CAAC;AACL,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAc,KAAK,EAAE,QAAQ,EAAE,EAAE;IACzD,MAAM,aAAa,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACrF,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,cAAc,GAAuB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACpE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9F,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,0FAA0F;AAC1F,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAE,QAAgB;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,MAAM,EAAE,CAAC;QACX,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,8CAA8C,QAAQ,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACtD,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,aAAqB,EAAE,MAAa;IACpE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE;QAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,GAAG,EAAE,CAAC;YAC/C,EAAkF,CAAC,IAAI,EAAE;gBACxF,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,kBAAkB,GAAuB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACxE,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC;IACnC,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,GAAG,GAAG,YAAY,CACtB,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,EACvF,CAAC,GAAoB,EAAE,EAAE;YACvB,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBACrB,IAAI,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACzB,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,MAAM,CAAC,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;oBACjF,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YACzD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,wFAAwF;AACxF,SAAS,aAAa,CAAC,GAAoB,EAAE,MAAgB;IAC3D,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;QAC3B,OAAO,EAAE;YACP,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;gBACZ,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;YACrE,CAAC;SACF;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3E,CAAC,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED