@otonoma/paranet-client 2.16.0-rc.8 → 2.16.0

package/dist/cjs/index.cjs

@@ -7150,16 +7150,36 @@ class HealthClient {
 }
 
 // Wrapper client around the paranet broker and data service.
+// undici is loaded dynamically only in Node.js when insecure mode is needed
+let undiciModule = null;
+async function getUndici() {
+    if (!undiciModule) {
+        undiciModule = await Promise.resolve().then(function () { return require('./index-Dz-_ygkd.cjs'); }).then(function (n) { return n.index; });
+    }
+    return undiciModule;
+}
 class PncpClient {
     constructor(init) {
         this.actorId = init.actorId;
         this.endpoint = init.endpoint;
         this.actorVersion = init.actorVersion;
+        var fetchFn = init.fetch;
+        // Note: insecure TLS bypass only works in Node.js with undici
+        // In browser environments, insecure mode is ignored (browsers don't allow TLS bypass)
+        if (!fetchFn && init.insecure && init.endpoint.startsWith("https") && typeof globalThis.process !== 'undefined' && globalThis.process?.versions?.node) {
+            // Synchronously check if undici is already loaded, otherwise load it lazily on first request
+            fetchFn = async (request, options) => {
+                const undici = await getUndici();
+                var fetchOptions = options || {};
+                fetchOptions.dispatcher = new undici.Agent({ connect: { rejectUnauthorized: false } });
+                return undici.fetch(request, fetchOptions);
+            };
+        }
         // TODO: Consider passing in transport config.
         this.transport = new GrpcWebFetchTransport({
             baseUrl: init.endpoint,
             format: "binary",
-            fetch: init.fetch,
+            fetch: fetchFn,
             // TODO: Consider other methods here.
         });
         this.inner = new BrokerClient(this.transport);
@@ -7266,6 +7286,9 @@ class PncpClient {
             case "password":
                 secret = { oneofKind: "password", password: creds.secret };
                 break;
+            case "jwt":
+                secret = { oneofKind: "jwt", jwt: creds.secret };
+                break;
             default:
                 throw new Error("Invalid creds type");
         }
@@ -7490,6 +7513,7 @@ class BaseClient {
     constructor(init) {
         this.endpoint = cleanUrl(init.endpoint);
         this.actorId = init.actorId;
+        this.insecure = init.insecure ?? false;
     }
     getEndpoint() {
         return this.endpoint;
@@ -7563,14 +7587,27 @@ class BaseClient {
     }
     async fetch(path, method, body, headers) {
         let url = `${this.endpoint}/${path}`;
-        const mkFetch = () => fetch(url, {
+        // Build fetch options, with optional TLS bypass for Node.js
+        let fetchOptions = {
             method,
             body,
             headers: {
                 ...(headers || {}),
                 ...this.getHeaders(),
             },
-        });
+        };
+        // For Node.js: bypass certificate verification if insecure mode is enabled
+        // Must use undici.fetch (not global fetch) for dispatcher option to work
+        // In browser environments, insecure mode is ignored (browsers don't allow TLS bypass)
+        const isNode = typeof globalThis.process !== 'undefined' && globalThis.process?.versions?.node;
+        const mkFetch = async () => {
+            if (this.insecure && isNode) {
+                const undici = await getUndici();
+                fetchOptions.dispatcher = new undici.Agent({ connect: { rejectUnauthorized: false } });
+                return undici.fetch(url, fetchOptions);
+            }
+            return fetch(url, fetchOptions);
+        };
         let response = await mkFetch();
         if (response.status == 401) {
             await this.refreshAuth();