@yedoma-labs/tanur-ssrf 0.0.0-stage → 1.0.0

package/dist/index.cjs

@@ -0,0 +1,720 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let node_dns_promises = require("node:dns/promises");
+let node_http = require("node:http");
+let node_https = require("node:https");
+let node_zlib = require("node:zlib");
+// src/errors.ts
+/**
+* Typed error thrown by the safe fetch. Messages never contain the URL, its
+* query string or any credentials; they only name the blocked host or address.
+*/
+var SafeFetchError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "SafeFetchError";
+		this.code = code;
+	}
+};
+// src/body.ts
+/**
+* Reads a Response body into memory, failing once more than `maxBytes` bytes arrive.
+* The stream is cancelled at the limit, so an oversized body is not buffered.
+*/
+async function readBodyWithLimit(response, maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) throw new TypeError("maxBytes must be a non-negative integer");
+	if (response.body === null) return /* @__PURE__ */ new Uint8Array(0);
+	const reader = response.body.getReader();
+	const chunks = [];
+	let total = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		total += value.byteLength;
+		if (total > maxBytes) {
+			await reader.cancel();
+			throw new SafeFetchError("BODY_TOO_LARGE", `Response body exceeds ${maxBytes} bytes`);
+		}
+		chunks.push(value);
+	}
+	const result = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		result.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return result;
+}
+// src/ip.ts
+const IPV4_PART = /^(?:0|[1-9]\d{0,2})$/;
+const IPV6_GROUP = /^[0-9a-fA-F]{1,4}$/;
+/**
+* Parses a dotted-decimal IPv4 address. Leading zeros are rejected because
+* they are ambiguous (octal in some resolvers).
+*/
+function parseIpv4(text) {
+	const parts = text.split(".");
+	if (parts.length !== 4) return;
+	const bytes = /* @__PURE__ */ new Uint8Array(4);
+	for (let index = 0; index < 4; index++) {
+		const part = parts[index];
+		if (part === void 0 || !IPV4_PART.test(part)) return;
+		const value = Number(part);
+		if (value > 255) return;
+		bytes[index] = value;
+	}
+	return bytes;
+}
+/** Parses 8 groups of 16 bits from a side of an IPv6 literal. */
+function parseGroups(side, allowIpv4Tail) {
+	if (side === "") return [];
+	const parts = side.split(":");
+	const groups = [];
+	for (let index = 0; index < parts.length; index++) {
+		const part = parts[index];
+		if (part === void 0) return;
+		if (allowIpv4Tail && index === parts.length - 1 && part.includes(".")) {
+			const v4 = parseIpv4(part);
+			if (v4 === void 0) return;
+			groups.push(byteAt(v4, 0) << 8 | byteAt(v4, 1), byteAt(v4, 2) << 8 | byteAt(v4, 3));
+			continue;
+		}
+		if (!IPV6_GROUP.test(part)) return;
+		groups.push(Number.parseInt(part, 16));
+	}
+	return groups;
+}
+/**
+* Parses an IPv6 literal (without brackets or zone id). Supports `::`
+* compression and an embedded dotted IPv4 tail. Zone ids are rejected.
+*/
+function parseIpv6(text) {
+	if (text.includes("%") || !text.includes(":")) return;
+	const compressionAt = text.indexOf("::");
+	if (compressionAt !== text.lastIndexOf("::")) return;
+	let groups;
+	if (compressionAt === -1) {
+		const all = parseGroups(text, true);
+		if (all === void 0 || all.length !== 8) return;
+		groups = all;
+	} else {
+		const head = parseGroups(text.slice(0, compressionAt), false);
+		const tail = parseGroups(text.slice(compressionAt + 2), true);
+		if (head === void 0 || tail === void 0) return;
+		const missing = 8 - head.length - tail.length;
+		if (missing < 1) return;
+		groups = [
+			...head,
+			...new Array(missing).fill(0),
+			...tail
+		];
+	}
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	for (let index = 0; index < 8; index++) {
+		const group = groups[index] ?? 0;
+		bytes[index * 2] = group >> 8;
+		bytes[index * 2 + 1] = group & 255;
+	}
+	return bytes;
+}
+/** Parses an IPv4 or IPv6 literal. Returns undefined for anything else. */
+function parseIp(text) {
+	if (text.includes(":")) {
+		const bytes = parseIpv6(text);
+		return bytes === void 0 ? void 0 : {
+			family: 6,
+			bytes
+		};
+	}
+	const bytes = parseIpv4(text);
+	return bytes === void 0 ? void 0 : {
+		family: 4,
+		bytes
+	};
+}
+function byteAt(bytes, index) {
+	return bytes[index] ?? 0;
+}
+function u32(a, b, c, d) {
+	return (a << 24 | b << 16 | c << 8 | d) >>> 0;
+}
+const BLOCKED_IPV4 = [
+	{
+		network: u32(0, 0, 0, 0),
+		prefix: 8,
+		name: "unspecified network (0.0.0.0/8)"
+	},
+	{
+		network: u32(10, 0, 0, 0),
+		prefix: 8,
+		name: "private (10.0.0.0/8)"
+	},
+	{
+		network: u32(100, 64, 0, 0),
+		prefix: 10,
+		name: "shared address space (100.64.0.0/10)"
+	},
+	{
+		network: u32(127, 0, 0, 0),
+		prefix: 8,
+		name: "loopback (127.0.0.0/8)"
+	},
+	{
+		network: u32(169, 254, 0, 0),
+		prefix: 16,
+		name: "link-local (169.254.0.0/16)"
+	},
+	{
+		network: u32(172, 16, 0, 0),
+		prefix: 12,
+		name: "private (172.16.0.0/12)"
+	},
+	{
+		network: u32(192, 0, 0, 0),
+		prefix: 24,
+		name: "IETF protocol assignments (192.0.0.0/24)"
+	},
+	{
+		network: u32(192, 0, 2, 0),
+		prefix: 24,
+		name: "documentation (192.0.2.0/24)"
+	},
+	{
+		network: u32(192, 168, 0, 0),
+		prefix: 16,
+		name: "private (192.168.0.0/16)"
+	},
+	{
+		network: u32(198, 18, 0, 0),
+		prefix: 15,
+		name: "benchmarking (198.18.0.0/15)"
+	},
+	{
+		network: u32(198, 51, 100, 0),
+		prefix: 24,
+		name: "documentation (198.51.100.0/24)"
+	},
+	{
+		network: u32(203, 0, 113, 0),
+		prefix: 24,
+		name: "documentation (203.0.113.0/24)"
+	},
+	{
+		network: u32(224, 0, 0, 0),
+		prefix: 4,
+		name: "multicast (224.0.0.0/4)"
+	},
+	{
+		network: u32(240, 0, 0, 0),
+		prefix: 4,
+		name: "reserved (240.0.0.0/4)"
+	},
+	{
+		network: u32(255, 255, 255, 255),
+		prefix: 32,
+		name: "broadcast (255.255.255.255)"
+	}
+];
+function ipv4Value(bytes) {
+	return u32(byteAt(bytes, 0), byteAt(bytes, 1), byteAt(bytes, 2), byteAt(bytes, 3));
+}
+function inPrefix(value, network, prefix) {
+	const mask = 4294967295 << 32 - prefix >>> 0;
+	return (value & mask) >>> 0 === (network & mask) >>> 0;
+}
+/** Returns the name of the blocked IPv4 range, or undefined if the address is public. */
+function classifyIpv4(bytes) {
+	const value = ipv4Value(bytes);
+	for (const range of BLOCKED_IPV4) if (inPrefix(value, range.network, range.prefix)) return range.name;
+}
+/** True if bytes[from..to) are all zero. */
+function zeroBetween(bytes, from, to) {
+	for (let index = from; index < to; index++) if (byteAt(bytes, index) !== 0) return false;
+	return true;
+}
+function bytesEqual(bytes, expected) {
+	return expected.every((value, index) => byteAt(bytes, index) === value);
+}
+function classifyEmbeddedIpv4(bytes, start, label) {
+	const reason = classifyIpv4(bytes.subarray(start, start + 4));
+	return reason === void 0 ? void 0 : `${label}, embedded address in ${reason}`;
+}
+/**
+* Returns the name of the blocked IPv6 range, or undefined if the address is public.
+* Embedded IPv4 forms (mapped, NAT64, 6to4) are classified by their IPv4 address.
+*/
+function classifyIpv6(bytes) {
+	if (zeroBetween(bytes, 0, 12)) {
+		if (zeroBetween(bytes, 12, 15) && byteAt(bytes, 15) === 1) return "loopback (::1)";
+		return "unspecified or IPv4-compatible (::/96)";
+	}
+	if (zeroBetween(bytes, 0, 10) && bytesEqual(bytes.subarray(10, 12), [255, 255])) {
+		const reason = classifyIpv4(bytes.subarray(12, 16));
+		return reason === void 0 ? void 0 : `IPv4-mapped, ${reason}`;
+	}
+	if (zeroBetween(bytes, 0, 8) && bytesEqual(bytes.subarray(8, 12), [
+		255,
+		255,
+		0,
+		0
+	])) return "IPv4-translated (::ffff:0:0:0/96)";
+	if (bytesEqual(bytes, [
+		0,
+		100,
+		255,
+		155
+	]) && zeroBetween(bytes, 4, 12)) return classifyEmbeddedIpv4(bytes, 12, "NAT64 (64:ff9b::/96)");
+	if (bytesEqual(bytes, [32, 2])) return classifyEmbeddedIpv4(bytes, 2, "6to4 (2002::/16)");
+	if (bytesEqual(bytes, [
+		32,
+		1,
+		0,
+		0
+	])) return "Teredo (2001::/32)";
+	if (bytesEqual(bytes, [1, 0]) && zeroBetween(bytes, 2, 8)) return "discard-only (100::/64)";
+	if (bytesEqual(bytes, [
+		32,
+		1,
+		13,
+		184
+	])) return "documentation (2001:db8::/32)";
+	const first = byteAt(bytes, 0);
+	const second = byteAt(bytes, 1);
+	if ((first & 254) === 252) return "unique local (fc00::/7)";
+	if (first === 254 && (second & 192) === 128) return "link-local (fe80::/10)";
+	if (first === 254 && (second & 192) === 192) return "site-local (fec0::/10)";
+	if (first === 255) return "multicast (ff00::/8)";
+}
+/**
+* Returns a description of the blocked range the address falls into, or
+* undefined if the address is globally routable (as far as this list knows).
+*/
+function getBlockedRange(ip) {
+	return ip.family === 4 ? classifyIpv4(ip.bytes) : classifyIpv6(ip.bytes);
+}
+// src/types.ts
+const DEFAULT_ALLOWED_PROTOCOLS = ["https:", "http:"];
+const DEFAULT_ALLOWED_PORTS = [80, 443];
+const DEFAULT_BLOCKED_HOSTNAMES = [
+	"localhost",
+	"metadata.google.internal",
+	".localhost",
+	".internal"
+];
+// src/policy.ts
+const DEFAULT_PORTS = {
+	"http:": 80,
+	"https:": 443
+};
+const PROTOCOL_PATTERN = /^[a-z][a-z0-9+.-]*:$/;
+const defaultResolver = (hostname) => (0, node_dns_promises.lookup)(hostname, {
+	all: true,
+	verbatim: true
+});
+/** Validates caller options and applies defaults. Invalid options throw TypeError. */
+function resolveOptions(options) {
+	const allowedProtocols = [...options.allowedProtocols ?? DEFAULT_ALLOWED_PROTOCOLS];
+	for (const protocol of allowedProtocols) if (!PROTOCOL_PATTERN.test(protocol)) throw new TypeError(`Invalid protocol in allowedProtocols: ${protocol}`);
+	const allowedPorts = [...options.allowedPorts ?? DEFAULT_ALLOWED_PORTS];
+	for (const port of allowedPorts) if (!Number.isInteger(port) || port < 1 || port > 65535) throw new TypeError(`Invalid port in allowedPorts: ${String(port)}`);
+	const blockedHostnames = (options.blockedHostnames ?? DEFAULT_BLOCKED_HOSTNAMES).map((entry) => entry.toLowerCase().replace(/\.$/, ""));
+	const maxRedirects = options.maxRedirects ?? 5;
+	if (!Number.isSafeInteger(maxRedirects) || maxRedirects < 0) throw new TypeError("maxRedirects must be a non-negative integer");
+	const timeoutMs = options.timeoutMs ?? 1e4;
+	if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2147483647) throw new TypeError("timeoutMs must be a positive number of milliseconds");
+	const maxBytes = options.maxBytes;
+	if (maxBytes !== void 0 && (!Number.isSafeInteger(maxBytes) || maxBytes < 0)) throw new TypeError("maxBytes must be a non-negative integer");
+	const resolver = options.resolver ?? defaultResolver;
+	if (typeof resolver !== "function") throw new TypeError("resolver must be a function");
+	return {
+		allowedProtocols,
+		allowPrivateNetworks: options.allowPrivateNetworks ?? false,
+		allowedPorts,
+		blockedHostnames,
+		maxRedirects,
+		timeoutMs,
+		maxBytes,
+		resolver
+	};
+}
+/** Parses a URL, with or without base. Never echoes the input in the error. */
+function parseUrl(input, base) {
+	try {
+		return new URL(input, base);
+	} catch {
+		throw new SafeFetchError("INVALID_URL", "Invalid URL");
+	}
+}
+/**
+* Lowercases, strips IPv6 brackets and one trailing dot. Rejects names that
+* are empty after normalization.
+*/
+function normalizeHostname(rawHostname) {
+	let hostname = rawHostname.toLowerCase();
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
+	if (hostname.endsWith(".")) hostname = hostname.slice(0, -1);
+	if (hostname === "" || hostname.endsWith(".")) throw new SafeFetchError("INVALID_URL", "Invalid URL");
+	return hostname;
+}
+function isBlockedHostname(hostname, blocked) {
+	return blocked.some((entry) => {
+		if (entry.startsWith(".")) return hostname === entry.slice(1) || hostname.endsWith(entry);
+		return hostname === entry;
+	});
+}
+function assertNoCredentials(url) {
+	if (url.username !== "" || url.password !== "") throw new SafeFetchError("INVALID_URL", "URLs with credentials are not allowed");
+}
+function raceAbort(promise, signal) {
+	if (signal.aborted) {
+		promise.catch(() => void 0);
+		return Promise.reject(new DOMException("The operation was aborted", "AbortError"));
+	}
+	return new Promise((resolve, reject) => {
+		const onAbort = () => reject(new DOMException("The operation was aborted", "AbortError"));
+		signal.addEventListener("abort", onAbort, { once: true });
+		promise.then((value) => {
+			signal.removeEventListener("abort", onAbort);
+			resolve(value);
+		}, (error) => {
+			signal.removeEventListener("abort", onAbort);
+			reject(error);
+		});
+	});
+}
+async function resolveAddresses(options, hostname, signal) {
+	let answers;
+	try {
+		answers = await raceAbort(options.resolver(hostname), signal);
+	} catch (error) {
+		if (signal.aborted) throw error;
+		throw new SafeFetchError("DNS_FAILURE", `DNS lookup failed for ${hostname}`);
+	}
+	if (!Array.isArray(answers) || answers.length === 0) throw new SafeFetchError("DNS_FAILURE", `DNS lookup returned no addresses for ${hostname}`);
+	return answers.map((answer) => {
+		if (typeof answer?.address !== "string") throw new SafeFetchError("BLOCKED_ADDRESS", `Resolver returned a non-IP value for ${hostname}`);
+		return answer.address;
+	});
+}
+/**
+* Validates one URL hop and resolves it to exactly one pinned address.
+*
+* Every address returned for the hostname is checked. If any of them is blocked,
+* the whole hop is rejected, so a mixed answer cannot be used to smuggle a private
+* address past the check.
+*/
+async function resolveTarget(url, options, signal) {
+	assertNoCredentials(url);
+	const protocol = url.protocol;
+	if (protocol !== "http:" && protocol !== "https:" || !options.allowedProtocols.includes(protocol)) throw new SafeFetchError("PROTOCOL_NOT_ALLOWED", `Protocol not allowed: ${protocol}`);
+	const port = url.port === "" ? DEFAULT_PORTS[protocol] : Number(url.port);
+	if (!options.allowedPorts.includes(port)) throw new SafeFetchError("PORT_NOT_ALLOWED", `Port not allowed: ${String(port)}`);
+	const hostname = normalizeHostname(url.hostname);
+	const literal = parseIp(hostname);
+	if (literal === void 0 && isBlockedHostname(hostname, options.blockedHostnames)) throw new SafeFetchError("BLOCKED_HOSTNAME", `Hostname not allowed: ${hostname}`);
+	const candidates = literal === void 0 ? await resolveAddresses(options, hostname, signal) : [hostname];
+	if (candidates.length === 0) throw new SafeFetchError("DNS_FAILURE", `DNS lookup returned no addresses for ${hostname}`);
+	let pinned;
+	for (const candidate of candidates) {
+		const ip = parseIp(candidate);
+		if (ip === void 0) throw new SafeFetchError("BLOCKED_ADDRESS", `Not a valid IP address for ${hostname}`);
+		if (!options.allowPrivateNetworks) {
+			const range = getBlockedRange(ip);
+			if (range !== void 0) throw new SafeFetchError("BLOCKED_ADDRESS", `Address ${candidate} of ${hostname} is in a blocked range: ${range}`);
+		}
+		pinned ??= {
+			address: candidate,
+			family: ip.family
+		};
+	}
+	if (pinned === void 0) throw new SafeFetchError("DNS_FAILURE", `DNS lookup returned no addresses for ${hostname}`);
+	return {
+		url,
+		protocol,
+		hostname,
+		isIpLiteral: literal !== void 0,
+		port,
+		path: `${url.pathname}${url.search}`,
+		address: pinned.address,
+		family: pinned.family
+	};
+}
+// src/transport.ts
+const NULL_BODY_STATUS = /* @__PURE__ */ new Set([
+	204,
+	205,
+	304
+]);
+/** Lookup that returns exactly the address validated in resolveTarget. Node never re-resolves. */
+function pinnedLookup(target) {
+	return ((_hostname, options, callback) => {
+		const done = callback;
+		if (options.all === true) done(null, [{
+			address: target.address,
+			family: target.family
+		}]);
+		else done(null, target.address, target.family);
+	});
+}
+function hostHeaderValue(target) {
+	const host = target.hostname.includes(":") ? `[${target.hostname}]` : target.hostname;
+	return target.port === (target.protocol === "https:" ? 443 : 80) ? host : `${host}:${target.port}`;
+}
+/**
+* Sends one request to the pinned address. `agent: false` prevents socket reuse,
+* so a socket validated under one policy can never serve a request under another.
+*/
+function sendRequest(target, request, signal) {
+	return new Promise((resolve, reject) => {
+		const headers = {
+			...request.headers,
+			host: hostHeaderValue(target)
+		};
+		if (request.body !== void 0) headers["content-length"] = String(request.body.byteLength);
+		const options = {
+			protocol: target.protocol,
+			hostname: target.hostname,
+			port: target.port,
+			path: target.path,
+			method: request.method,
+			headers,
+			agent: false,
+			signal,
+			lookup: pinnedLookup(target)
+		};
+		if (target.protocol === "https:" && !target.isIpLiteral) options.servername = target.hostname;
+		const outgoing = (target.protocol === "https:" ? node_https.request : node_http.request)(options, resolve);
+		outgoing.on("error", reject);
+		outgoing.end(request.body);
+	});
+}
+function parseContentEncoding(value) {
+	if (value === void 0) return;
+	const token = value.trim().toLowerCase();
+	if (token === "" || token === "identity") return;
+	if (token === "gzip" || token === "x-gzip") return "gzip";
+	if (token === "deflate") return "deflate";
+	if (token === "br") return "br";
+	throw new SafeFetchError("NETWORK_ERROR", "Unsupported content-encoding in response");
+}
+function createDecoder(encoding) {
+	switch (encoding) {
+		case "gzip": return (0, node_zlib.createGunzip)();
+		case "deflate": return (0, node_zlib.createInflate)();
+		case "br": return (0, node_zlib.createBrotliDecompress)();
+	}
+}
+function safeStatusText(message) {
+	return message !== void 0 && /^[\x20-\x7e]*$/.test(message) ? message : "";
+}
+function createBodyStream(source, ctx) {
+	const iterator = source[Symbol.asyncIterator]();
+	let received = 0;
+	return new ReadableStream({
+		async pull(controller) {
+			try {
+				const next = await iterator.next();
+				if (next.done === true) {
+					ctx.onSettled();
+					controller.close();
+					return;
+				}
+				const chunk = next.value;
+				received += chunk.byteLength;
+				if (ctx.maxBytes !== void 0 && received > ctx.maxBytes) throw new SafeFetchError("BODY_TOO_LARGE", `Response body exceeds ${ctx.maxBytes} bytes`);
+				controller.enqueue(chunk);
+			} catch (error) {
+				ctx.onSettled();
+				source.destroy();
+				controller.error(ctx.toError(error));
+			}
+		},
+		cancel() {
+			ctx.onSettled();
+			source.destroy();
+		}
+	});
+}
+/**
+* Converts a Node response into a fetch-compatible Response. Redirects must
+* already have been handled by the caller. Decodes gzip, deflate and br bodies.
+*/
+function toResponse(incoming, ctx) {
+	const status = incoming.statusCode ?? 0;
+	if (status < 200 || status > 599) {
+		incoming.destroy();
+		throw new SafeFetchError("NETWORK_ERROR", "Invalid HTTP status in response");
+	}
+	const headers = new Headers();
+	for (const [name, value] of Object.entries(incoming.headers)) {
+		if (value === void 0) continue;
+		for (const item of Array.isArray(value) ? value : [value]) headers.append(name, item);
+	}
+	if (ctx.method === "HEAD" || NULL_BODY_STATUS.has(status)) {
+		incoming.resume();
+		ctx.onSettled();
+		return buildResponse(null, status, incoming.statusMessage, headers, ctx);
+	}
+	const encoding = parseContentEncoding(incoming.headers["content-encoding"]);
+	if (encoding === void 0) {
+		const declared = Number(incoming.headers["content-length"]);
+		if (ctx.maxBytes !== void 0 && Number.isFinite(declared) && declared > ctx.maxBytes) {
+			incoming.destroy();
+			throw new SafeFetchError("BODY_TOO_LARGE", `Response body exceeds ${ctx.maxBytes} bytes`);
+		}
+	} else {
+		headers.delete("content-encoding");
+		headers.delete("content-length");
+	}
+	incoming.on("error", () => void 0);
+	let source = incoming;
+	if (encoding !== void 0) {
+		const decoder = createDecoder(encoding);
+		decoder.on("error", () => incoming.destroy());
+		source = incoming.pipe(decoder);
+		incoming.on("error", (error) => decoder.destroy(error));
+	}
+	return buildResponse(createBodyStream(source, ctx), status, incoming.statusMessage, headers, ctx);
+}
+function buildResponse(body, status, statusMessage, headers, ctx) {
+	const response = new Response(body, {
+		status,
+		statusText: safeStatusText(statusMessage),
+		headers
+	});
+	Object.defineProperty(response, "url", { value: ctx.url.href });
+	Object.defineProperty(response, "redirected", { value: ctx.redirected });
+	return response;
+}
+// src/safe-fetch.ts
+const REDIRECT_STATUSES = /* @__PURE__ */ new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+/** Request headers that are never forwarded. Host is always set to the validated target. */
+const DROPPED_REQUEST_HEADERS = /* @__PURE__ */ new Set([
+	"host",
+	"content-length",
+	"transfer-encoding",
+	"connection"
+]);
+/** Credentials are not sent to a different origin after a redirect, matching fetch. */
+const CROSS_ORIGIN_HEADERS = [
+	"authorization",
+	"cookie",
+	"proxy-authorization"
+];
+/**
+* Creates a fetch-compatible function that validates every URL, resolves each
+* hostname once, connects to the validated IP only, and validates every redirect.
+*
+* Throws SafeFetchError for policy violations. Throws TypeError for invalid options
+* or unsupported body types.
+*/
+function createSafeFetch(options = {}) {
+	const config = resolveOptions(options);
+	return (input, init) => fetchSafely(config, input, init);
+}
+async function toBytes(body) {
+	if (typeof body === "string") return new TextEncoder().encode(body);
+	if (body instanceof ArrayBuffer) return new Uint8Array(body.slice(0));
+	if (ArrayBuffer.isView(body)) return new Uint8Array(body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength));
+	if (body instanceof URLSearchParams) return new TextEncoder().encode(body.toString());
+	if (body instanceof Blob) return new Uint8Array(await body.arrayBuffer());
+	throw new TypeError("Unsupported request body; use a string, ArrayBuffer, ArrayBufferView, URLSearchParams or Blob");
+}
+async function prepareRequest(input, init) {
+	const url = parseUrl(typeof input === "string" ? input : input instanceof URL ? input.href : input.url);
+	const method = (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
+	const merged = new Headers(input instanceof Request ? input.headers : void 0);
+	if (init?.headers !== void 0) new Headers(init.headers).forEach((value, key) => merged.set(key, value));
+	const headers = {};
+	merged.forEach((value, key) => {
+		if (!DROPPED_REQUEST_HEADERS.has(key)) headers[key] = value;
+	});
+	headers["accept-encoding"] ??= "identity";
+	let body = init?.body === void 0 || init.body === null ? void 0 : await toBytes(init.body);
+	if (body === void 0 && input instanceof Request && method !== "GET" && method !== "HEAD") body = new Uint8Array(await input.arrayBuffer());
+	if (body !== void 0 && (method === "GET" || method === "HEAD")) throw new TypeError("Request with GET or HEAD method cannot have a body");
+	return {
+		url,
+		method,
+		headers,
+		body
+	};
+}
+async function fetchSafely(config, input, init) {
+	const request = await prepareRequest(input, init);
+	const callerSignal = init?.signal ?? void 0;
+	const controller = new AbortController();
+	let timedOut = false;
+	let settled = false;
+	const onCallerAbort = () => controller.abort();
+	const timer = setTimeout(() => {
+		timedOut = true;
+		controller.abort();
+	}, config.timeoutMs);
+	callerSignal?.addEventListener("abort", onCallerAbort, { once: true });
+	if (callerSignal?.aborted === true) controller.abort();
+	const settle = () => {
+		if (settled) return;
+		settled = true;
+		clearTimeout(timer);
+		callerSignal?.removeEventListener("abort", onCallerAbort);
+	};
+	const toError = (error) => {
+		if (error instanceof SafeFetchError) return error;
+		if (callerSignal?.aborted === true) return callerSignal.reason;
+		if (timedOut) return new SafeFetchError("TIMEOUT", `Request timed out after ${config.timeoutMs} ms`);
+		return new SafeFetchError("NETWORK_ERROR", "Network request failed");
+	};
+	try {
+		let url = request.url;
+		let method = request.method;
+		let headers = request.headers;
+		let body = request.body;
+		let redirects = 0;
+		for (;;) {
+			const incoming = await sendRequest(await resolveTarget(url, config, controller.signal), {
+				method,
+				headers,
+				body
+			}, controller.signal);
+			const status = incoming.statusCode ?? 0;
+			if (!REDIRECT_STATUSES.has(status)) return toResponse(incoming, {
+				url,
+				redirected: redirects > 0,
+				method,
+				maxBytes: config.maxBytes,
+				onSettled: settle,
+				toError
+			});
+			const location = incoming.headers.location;
+			incoming.destroy();
+			if (location === void 0) throw new SafeFetchError("REDIRECT_WITHOUT_LOCATION", "Redirect response has no Location header");
+			if (redirects >= config.maxRedirects) throw new SafeFetchError("REDIRECT_LIMIT", `Redirect limit of ${config.maxRedirects} exceeded`);
+			redirects++;
+			const next = parseUrl(location, url);
+			const nextHeaders = { ...headers };
+			if (status === 303 && method !== "HEAD" || (status === 301 || status === 302) && method === "POST") {
+				method = "GET";
+				body = void 0;
+				delete nextHeaders["content-type"];
+			}
+			if (next.origin !== url.origin) for (const name of CROSS_ORIGIN_HEADERS) delete nextHeaders[name];
+			headers = nextHeaders;
+			url = next;
+		}
+	} catch (error) {
+		settle();
+		throw toError(error);
+	}
+}
+exports.SafeFetchError = SafeFetchError;
+exports.createSafeFetch = createSafeFetch;
+exports.readBodyWithLimit = readBodyWithLimit;
+
+//# sourceMappingURL=index.cjs.map