@sdxc/outbound 2026.10.24 → 2026.10.25

package/README.md

@@ -102,6 +102,9 @@ Answers the final response whatever its status. Beside every `checkUrl` option:
 - `maxRedirects`: default `5`.
 - `resolve`: when `true`, resolves every hop's name with `resolveHost` and refuses it unless every
   address is public. Default `false`; skipped with `hosts: "any"`.
+- `sign`: `(request) => Promise<Result<Request, Error>>`, run on each hop's request before it is
+  sent, such as `webBotAuthSigner` from `@sdxc/http-signatures/web-bot-auth`. A failure stops the
+  walk as `signing-failed`.
 
 ### `resolveHost(url: URL, options?: { signal?: AbortSignal }): Promise<Result<string[], OutboundError>>`
 
@@ -145,6 +148,7 @@ for `invalid-url`, or `""` for a body with no URL), and `retryable`.
 | `refused-host`        | No          | A reserved name, a single label, or no address    |
 | `refused-address`     | No          | A non-public literal, or a non-public DNS answer  |
 | `too-many-redirects`  | No          | The chain ran past `maxRedirects`                 |
+| `signing-failed`      | No          | The `sign` option answered a failure              |
 | `too-large`           | No          | The body passed `maxBytes`                        |
 | `timeout`             | Yes         | The deadline passed                               |
 | `network`             | Yes         | `fetch` rejected, a body broke off, or DNS failed |

package/dist/error.d.ts

@@ -7,11 +7,11 @@
  * @copyright Sergio Xalambrí 2026
  */
 /**
- * Why an outbound request was refused or failed. Each `refused-*` code is decided
- * before a request leaves; `timeout` and `network` are the only outcomes a retry can
- * change.
+ * Why an outbound request was refused or failed. Each `refused-*` code, and
+ * `signing-failed`, is decided before a request leaves; `timeout` and `network` are the
+ * only outcomes a retry can change.
  */
-export type OutboundErrorCode = "invalid-url" | "refused-scheme" | "refused-credentials" | "refused-port" | "refused-host" | "refused-address" | "too-many-redirects" | "too-large" | "timeout" | "network";
+export type OutboundErrorCode = "invalid-url" | "refused-scheme" | "refused-credentials" | "refused-port" | "refused-host" | "refused-address" | "too-many-redirects" | "signing-failed" | "too-large" | "timeout" | "network";
 /** Returned inside a `Failure` by every function in this package, never thrown. */
 export declare class OutboundError extends Error {
     name: string;

package/dist/follow.d.ts

@@ -30,6 +30,12 @@ export interface FollowOptions extends CheckOptions {
     resolve?: boolean;
     /** The caller's own abort, combined with `timeout`. */
     signal?: AbortSignal;
+    /**
+     * Signs each hop's request before it is sent, such as with a Web Bot Auth signature, so
+     * every origin in the chain receives a signature over its own authority. A failure
+     * stops the walk as `signing-failed`.
+     */
+    sign?: (request: Request) => Promise<Result<Request, Error>>;
 }
 /** The last response of a chain, where it came from, and how many hops it took. */
 export interface Followed {

package/dist/follow.js

@@ -40,15 +40,25 @@ export async function follow(input, options = {}) {
             if (isFailure(resolved))
                 return resolved;
         }
+        let request = new Request(url, {
+            method: options.method ?? "GET",
+            headers,
+            signal,
+            redirect: "manual",
+            credentials: "omit",
+        });
+        if (options.sign) {
+            let signed = await options.sign(request);
+            if (isFailure(signed)) {
+                return failure(new OutboundError("signing-failed", url.href, `Could not sign ${url.href}`, {
+                    cause: signed.error,
+                }));
+            }
+            request = signed.data;
+        }
         let response;
         try {
-            response = await fetch(url, {
-                method: options.method ?? "GET",
-                headers,
-                signal,
-                redirect: "manual",
-                credentials: "omit",
-            });
+            response = await fetch(request);
         }
         catch (error) {
             return failure(failedWith(url.href, error));

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@sdxc/outbound",
-	"version": "2026.10.24",
+	"version": "2026.10.25",
 	"description": "Check, follow and read URLs a stranger chose: public hosts on every redirect, one deadline, bounded bodies",
 	"license": "MIT",
 	"type": "module",
@@ -8,12 +8,12 @@
 		".": "./dist/index.js"
 	},
 	"dependencies": {
-		"@sdxc/doh": "2026.10.24",
+		"@sdxc/doh": "2026.10.25",
 		"@sdxc/duration": "2026.10.13",
 		"@sdxc/ip": "2026.10.13",
 		"@sdxc/result": "2026.10.13"
 	},
-	"gitHead": "f9db0f8f1f51a256e74b94b0f4b1db4be9880370",
+	"gitHead": "1440b969c0a3e3808dfcee3f17d2ef43915f32a8",
 	"publishConfig": {
 		"access": "public"
 	},