distopia 0.4.0 → 0.5.0

package/dist/index.cjs

@@ -3,8 +3,9 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 let oxfmt = require("oxfmt");
 let oxlint = require("oxlint");
 let node_dns = require("node:dns");
+let zod = require("zod");
 //#region package.json
-var version = "0.4.0";
+var version = "0.5.0";
 //#endregion
 //#region ../template/src/oxfmt.ts
 const config = (0, oxfmt.defineConfig)({
@@ -61,7 +62,7 @@ function isLocalIPv4(host) {
 		c,
 		d
 	]) if (!Number.isInteger(v) || v < 0 || v > 255) return false;
-	return a === 0 || a === 127 || a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254;
+	return a === 0 || a === 127 || a === 10 || a === 100 && b >= 64 && b <= 127 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254;
 }
 function isLocalIPv6(addr) {
 	const h = addr.toLowerCase();
@@ -90,12 +91,23 @@ async function isLocalUrl(url) {
 	if (/^\d/.test(hostname)) return isLocalIPv4(hostname);
 	return await isLocalHostname(hostname);
 }
+async function isHttpProtocol(url) {
+	const protocol = URL.parse(url.toString())?.protocol;
+	return protocol === "http:" || protocol === "https:";
+}
 //#endregion
 //#region ../../src/infrastructure/http/src/dns.ts
 async function isLocalHostname(hostname) {
 	const [v4, v6] = await Promise.all([node_dns.promises.resolve4(hostname).catch(() => []), node_dns.promises.resolve6(hostname).catch(() => [])]);
 	return v4.some((ip) => isLocalIPv4(ip)) || v6.some((ip) => isLocalIPv6(ip));
 }
+async function resolveHostnameToSafeIp(hostname) {
+	const [v4, v6] = await Promise.all([node_dns.promises.resolve4(hostname).catch(() => []), node_dns.promises.resolve6(hostname).catch(() => [])]);
+	if (v4.some((ip) => isLocalIPv4(ip)) || v6.some((ip) => isLocalIPv6(ip))) return null;
+	if (v4[0] !== void 0) return v4[0];
+	if (v6[0] !== void 0) return v6[0];
+	return null;
+}
 //#endregion
 //#region ../../src/infrastructure/http/src/redirect.ts
 const DEFAULT_MAX_REDIRECT = 10;
@@ -125,29 +137,65 @@ const DEFAULT_TIMEOUT = 10 * 1e3;
 const DISCORD_TIMEOUT = 30 * 1e3;
 //#endregion
 //#region ../../src/infrastructure/http/src/safefetch.ts
-const DISCORD_DOMAINS = [
+const ALLOW_DISCORD_DOMAINS = [
 	"discord.com",
 	"discordapp.com",
 	"discord.gg"
 ];
+async function resolveToPinnedUrl(url, init) {
+	const { hostname, host, protocol } = new URL(url);
+	if (hostname === "localhost" || hostname.endsWith(".localhost")) return new LocalAddressError(`${url} is local address.`);
+	if (hostname.startsWith("[") && hostname.endsWith("]")) {
+		if (isLocalIPv6(hostname.slice(1, -1))) return new LocalAddressError(`${url} is local address.`);
+		return {
+			url,
+			init
+		};
+	}
+	if (/^\d/.test(hostname)) {
+		if (isLocalIPv4(hostname)) return new LocalAddressError(`${url} is local address.`);
+		return {
+			url,
+			init
+		};
+	}
+	const resolvedIp = await resolveHostnameToSafeIp(hostname);
+	if (resolvedIp === null) return new LocalAddressError(`${url} is local address.`);
+	const pinnedUrlObj = new URL(url);
+	pinnedUrlObj.hostname = resolvedIp.includes(":") ? `[${resolvedIp}]` : resolvedIp;
+	const headers = new Headers(init.headers);
+	headers.set("Host", host);
+	const pinnedInit = {
+		...init,
+		headers,
+		...protocol === "https:" ? { tls: { serverName: hostname } } : {}
+	};
+	return {
+		url: pinnedUrlObj.href,
+		init: pinnedInit
+	};
+}
 async function safeFetchForDiscord(input, init) {
-	if (await isLocalUrl(input)) return new LocalAddressError(`${input} is local address.`);
 	const hostname = new URL(input).hostname;
-	if (!DISCORD_DOMAINS.includes(hostname)) return new InvalidDomainError(`${hostname} is not discord domain.`);
-	return await fetch(input, {
-		...init,
-		signal: AbortSignal.timeout(DISCORD_TIMEOUT)
+	if (!ALLOW_DISCORD_DOMAINS.includes(hostname)) return new InvalidDomainError(`${hostname} is not discord domain.`);
+	const pinned = await resolveToPinnedUrl(input, init ?? {});
+	if (pinned instanceof LocalAddressError) return pinned;
+	return await fetch(pinned.url, {
+		...pinned.init,
+		signal: AbortSignal.timeout(DISCORD_TIMEOUT),
+		redirect: "manual"
 	});
 }
-async function safeFetch(input, init) {
+async function safeFetch(input, init, options) {
 	let reqUrl = input;
-	let currentInit = init;
+	let currentInit = init ?? {};
 	let redirectCount = 0;
 	let response;
 	while (true) {
-		if (await isLocalUrl(reqUrl)) return new LocalAddressError(`${reqUrl} is local address.`);
-		response = await fetch(reqUrl, {
-			...currentInit,
+		const pinned = await resolveToPinnedUrl(reqUrl, currentInit);
+		if (pinned instanceof LocalAddressError) return pinned;
+		response = await fetch(pinned.url, {
+			...pinned.init,
 			signal: AbortSignal.timeout(DEFAULT_TIMEOUT),
 			redirect: "manual"
 		});
@@ -162,9 +210,10 @@ async function safeFetch(input, init) {
 			} catch {
 				return new HeaderError(`${location} is invalid.`);
 			}
-			if (url.protocol !== "http:" && url.protocol !== "https:") return new HeaderError(`${url.protocol} is not allowed.`);
+			if (options?.detectDiscordProtocol && url.protocol === "discord://") return response;
+			if (!await isHttpProtocol(url)) return new HeaderError(`${url.protocol} is not allowed.`);
 			if (new URL(reqUrl).origin !== url.origin) {
-				const headers = new Headers(currentInit?.headers);
+				const headers = new Headers(currentInit.headers);
 				headers.delete("authorization");
 				headers.delete("cookie");
 				currentInit = {
@@ -174,66 +223,89 @@ async function safeFetch(input, init) {
 			}
 			reqUrl = url.href;
 			redirectCount += 1;
-		} else return response;
+		} else {
+			const finalUrl = reqUrl;
+			return new Proxy(response, { get(target, prop) {
+				if (prop === "url") return finalUrl;
+				const value = Reflect.get(target, prop, target);
+				return typeof value === "function" ? value.bind(target) : value;
+			} });
+		}
 		if (redirectCount > 10) return new RedirectError(`Redirect count is over 10`);
 	}
 }
 //#endregion
+//#region ../../src/infrastructure/http/src/safeurl.ts
+function safeUrl(strings, ...values) {
+	let result = "";
+	for (const [index, str] of strings.entries()) {
+		result += str;
+		const value = values[index];
+		if (value !== void 0) result += encodeURIComponent(value);
+	}
+	return result;
+}
+const safeUrlSchema = zod.z.string().refine((url) => {
+	const parsed = URL.parse(url);
+	return parsed !== null && (parsed.protocol === "http:" || parsed.protocol === "https:");
+}, { message: "URL must be a valid http or https URL" }).transform((url) => url);
+function validateSafeUrl(url) {
+	const result = safeUrlSchema.safeParse(url);
+	return result.success ? result.data : null;
+}
+//#endregion
 //#region ../../src/infrastructure/http/src/invite.ts
-const DISCORD_INVITE_LINK_START = [
-	"https://discord.com/invite/",
-	"https://ptb.discord.com/invite/",
-	"https://canary.discord.com/invite/"
+const DISCORD_DOMAINS = [
+	"discord.com",
+	"ptb.discord.com",
+	"canary.discord.com"
 ];
-async function isUsedCf(res) {
-	try {
-		const response = res.clone();
-		if (response.status !== 403) return false;
-		const { JSDOM } = await import("jsdom");
-		return new JSDOM(await response.text()).window.document.querySelector("title")?.textContent === "Just a moment...";
-	} catch {
-		return false;
-	}
+const INVITE_PROTOCOL = [
+	"discord:",
+	"http:",
+	"https:"
+];
+async function isDiscordInviteLink(url) {
+	const parsedUrl = URL.parse(url.toString());
+	if (parsedUrl === null) return false;
+	return INVITE_PROTOCOL.includes(parsedUrl.protocol) && DISCORD_DOMAINS.includes(parsedUrl.host) && parsedUrl.pathname.startsWith("/invite/");
+}
+function isUsedCf(res) {
+	return res.headers.get("cf-mitigated") === "challenge";
 }
 async function isInviteLink(url) {
-	const response = await safeFetch(url, {
+	const safeUrl = validateSafeUrl(url);
+	if (safeUrl === null) return new LocalAddressError(`${url} is not a safe URL.`);
+	const response = await safeFetch(safeUrl, {
 		method: "GET",
 		headers: { "User-Agent": "Mozilla/5.0" }
-	});
+	}, { detectDiscordProtocol: true });
 	if (response instanceof Error) return response;
 	const resUrl = response.url;
+	const location = response.headers.get("location");
 	return {
-		content: DISCORD_INVITE_LINK_START.some((value) => resUrl.startsWith(value)),
-		isUsedCf: await isUsedCf(response)
+		content: await isDiscordInviteLink(resUrl) || location !== null && await isDiscordInviteLink(location),
+		isUsedCf: isUsedCf(response)
 	};
 }
 //#endregion
-//#region ../../src/infrastructure/http/src/safeurl.ts
-function safeUrl(strings, ...values) {
-	let result = "";
-	for (const [index, str] of strings.entries()) {
-		result += str;
-		const value = values[index];
-		if (value !== void 0) result += encodeURIComponent(value);
-	}
-	return result;
-}
-//#endregion
 //#region src/index.ts
 const DISTOPIA_VERSION = version;
 //#endregion
+exports.ALLOW_DISCORD_DOMAINS = ALLOW_DISCORD_DOMAINS;
 exports.BodySizeError = BodySizeError;
 exports.DEFAULT_MAX_REDIRECT = DEFAULT_MAX_REDIRECT;
 exports.DEFAULT_TIMEOUT = DEFAULT_TIMEOUT;
 exports.DISCORD_DOMAINS = DISCORD_DOMAINS;
-exports.DISCORD_INVITE_LINK_START = DISCORD_INVITE_LINK_START;
 exports.DISCORD_TIMEOUT = DISCORD_TIMEOUT;
 exports.DISTOPIA_VERSION = DISTOPIA_VERSION;
 exports.HeaderError = HeaderError;
+exports.INVITE_PROTOCOL = INVITE_PROTOCOL;
 exports.InvalidDomainError = InvalidDomainError;
 exports.LocalAddressError = LocalAddressError;
 exports.MAX_BYTES = MAX_BYTES;
 exports.RedirectError = RedirectError;
+exports.isHttpProtocol = isHttpProtocol;
 exports.isInviteLink = isInviteLink;
 exports.isLocalHostname = isLocalHostname;
 exports.isLocalIPv4 = isLocalIPv4;
@@ -243,6 +315,8 @@ exports.isUsedCf = isUsedCf;
 exports.isValidSize = isValidSize;
 exports.oxfmtCfg = config;
 exports.oxlintCfg = config$1;
+exports.resolveHostnameToSafeIp = resolveHostnameToSafeIp;
 exports.safeFetch = safeFetch;
 exports.safeFetchForDiscord = safeFetchForDiscord;
 exports.safeUrl = safeUrl;
+exports.validateSafeUrl = validateSafeUrl;

package/dist/index.d.cts

@@ -41,14 +41,16 @@ declare class RedirectError extends Error {}
 //#endregion
 //#region ../../src/infrastructure/http/src/dns.d.ts
 declare function isLocalHostname(hostname: string): Promise<boolean>;
+declare function resolveHostnameToSafeIp(hostname: string): Promise<string | null>;
 //#endregion
 //#region ../../src/infrastructure/http/src/invite.d.ts
 type IsInviteLink = {
   content: boolean;
   isUsedCf: boolean;
 };
-declare const DISCORD_INVITE_LINK_START: string[];
-declare function isUsedCf(res: Response): Promise<boolean>;
+declare const DISCORD_DOMAINS: string[];
+declare const INVITE_PROTOCOL: string[];
+declare function isUsedCf(res: Response): boolean;
 declare function isInviteLink(url: string): Promise<IsInviteLink | LocalAddressError | HeaderError | RedirectError | BodySizeError>;
 //#endregion
 //#region ../../src/infrastructure/http/src/redirect.d.ts
@@ -60,11 +62,15 @@ type Branded<T, Brand> = T & {
 };
 type SafeUrl = Branded<string, "distopiaSafeUrl">;
 declare function safeUrl(strings: TemplateStringsArray, ...values: (string | number)[]): SafeUrl;
+declare function validateSafeUrl(url: string): SafeUrl | null;
 //#endregion
 //#region ../../src/infrastructure/http/src/safefetch.d.ts
-declare const DISCORD_DOMAINS: string[];
+type SafeFetchOptions = {
+  detectDiscordProtocol?: boolean;
+};
+declare const ALLOW_DISCORD_DOMAINS: string[];
 declare function safeFetchForDiscord(input: SafeUrl, init?: RequestInit): Promise<Response | LocalAddressError | InvalidDomainError>;
-declare function safeFetch(input: SafeUrl, init?: RequestInit): Promise<Response | LocalAddressError | HeaderError | RedirectError | BodySizeError>;
+declare function safeFetch(input: SafeUrl, init?: RequestInit, options?: SafeFetchOptions): Promise<Response | LocalAddressError | HeaderError | RedirectError | BodySizeError>;
 //#endregion
 //#region ../../src/infrastructure/http/src/size.d.ts
 declare const MAX_BYTES: number;
@@ -78,8 +84,9 @@ declare const DISCORD_TIMEOUT: number;
 declare function isLocalIPv4(host: string): boolean;
 declare function isLocalIPv6(addr: string): boolean;
 declare function isLocalUrl(url: string): Promise<boolean>;
+declare function isHttpProtocol(url: string | URL): Promise<boolean>;
 //#endregion
 //#region src/index.d.ts
 declare const DISTOPIA_VERSION: string;
 //#endregion
-export { BodySizeError, Branded, DEFAULT_MAX_REDIRECT, DEFAULT_TIMEOUT, DISCORD_DOMAINS, DISCORD_INVITE_LINK_START, DISCORD_TIMEOUT, DISTOPIA_VERSION, HeaderError, InvalidDomainError, IsInviteLink, LocalAddressError, MAX_BYTES, RedirectError, SafeUrl, isInviteLink, isLocalHostname, isLocalIPv4, isLocalIPv6, isLocalUrl, isUsedCf, isValidSize, config as oxfmtCfg, config$1 as oxlintCfg, safeFetch, safeFetchForDiscord, safeUrl };
+export { ALLOW_DISCORD_DOMAINS, BodySizeError, Branded, DEFAULT_MAX_REDIRECT, DEFAULT_TIMEOUT, DISCORD_DOMAINS, DISCORD_TIMEOUT, DISTOPIA_VERSION, HeaderError, INVITE_PROTOCOL, InvalidDomainError, IsInviteLink, LocalAddressError, MAX_BYTES, RedirectError, SafeFetchOptions, SafeUrl, isHttpProtocol, isInviteLink, isLocalHostname, isLocalIPv4, isLocalIPv6, isLocalUrl, isUsedCf, isValidSize, config as oxfmtCfg, config$1 as oxlintCfg, resolveHostnameToSafeIp, safeFetch, safeFetchForDiscord, safeUrl, validateSafeUrl };

package/dist/index.d.mts

@@ -41,14 +41,16 @@ declare class RedirectError extends Error {}
 //#endregion
 //#region ../../src/infrastructure/http/src/dns.d.ts
 declare function isLocalHostname(hostname: string): Promise<boolean>;
+declare function resolveHostnameToSafeIp(hostname: string): Promise<string | null>;
 //#endregion
 //#region ../../src/infrastructure/http/src/invite.d.ts
 type IsInviteLink = {
   content: boolean;
   isUsedCf: boolean;
 };
-declare const DISCORD_INVITE_LINK_START: string[];
-declare function isUsedCf(res: Response): Promise<boolean>;
+declare const DISCORD_DOMAINS: string[];
+declare const INVITE_PROTOCOL: string[];
+declare function isUsedCf(res: Response): boolean;
 declare function isInviteLink(url: string): Promise<IsInviteLink | LocalAddressError | HeaderError | RedirectError | BodySizeError>;
 //#endregion
 //#region ../../src/infrastructure/http/src/redirect.d.ts
@@ -60,11 +62,15 @@ type Branded<T, Brand> = T & {
 };
 type SafeUrl = Branded<string, "distopiaSafeUrl">;
 declare function safeUrl(strings: TemplateStringsArray, ...values: (string | number)[]): SafeUrl;
+declare function validateSafeUrl(url: string): SafeUrl | null;
 //#endregion
 //#region ../../src/infrastructure/http/src/safefetch.d.ts
-declare const DISCORD_DOMAINS: string[];
+type SafeFetchOptions = {
+  detectDiscordProtocol?: boolean;
+};
+declare const ALLOW_DISCORD_DOMAINS: string[];
 declare function safeFetchForDiscord(input: SafeUrl, init?: RequestInit): Promise<Response | LocalAddressError | InvalidDomainError>;
-declare function safeFetch(input: SafeUrl, init?: RequestInit): Promise<Response | LocalAddressError | HeaderError | RedirectError | BodySizeError>;
+declare function safeFetch(input: SafeUrl, init?: RequestInit, options?: SafeFetchOptions): Promise<Response | LocalAddressError | HeaderError | RedirectError | BodySizeError>;
 //#endregion
 //#region ../../src/infrastructure/http/src/size.d.ts
 declare const MAX_BYTES: number;
@@ -78,8 +84,9 @@ declare const DISCORD_TIMEOUT: number;
 declare function isLocalIPv4(host: string): boolean;
 declare function isLocalIPv6(addr: string): boolean;
 declare function isLocalUrl(url: string): Promise<boolean>;
+declare function isHttpProtocol(url: string | URL): Promise<boolean>;
 //#endregion
 //#region src/index.d.ts
 declare const DISTOPIA_VERSION: string;
 //#endregion
-export { BodySizeError, Branded, DEFAULT_MAX_REDIRECT, DEFAULT_TIMEOUT, DISCORD_DOMAINS, DISCORD_INVITE_LINK_START, DISCORD_TIMEOUT, DISTOPIA_VERSION, HeaderError, InvalidDomainError, IsInviteLink, LocalAddressError, MAX_BYTES, RedirectError, SafeUrl, isInviteLink, isLocalHostname, isLocalIPv4, isLocalIPv6, isLocalUrl, isUsedCf, isValidSize, config as oxfmtCfg, config$1 as oxlintCfg, safeFetch, safeFetchForDiscord, safeUrl };
+export { ALLOW_DISCORD_DOMAINS, BodySizeError, Branded, DEFAULT_MAX_REDIRECT, DEFAULT_TIMEOUT, DISCORD_DOMAINS, DISCORD_TIMEOUT, DISTOPIA_VERSION, HeaderError, INVITE_PROTOCOL, InvalidDomainError, IsInviteLink, LocalAddressError, MAX_BYTES, RedirectError, SafeFetchOptions, SafeUrl, isHttpProtocol, isInviteLink, isLocalHostname, isLocalIPv4, isLocalIPv6, isLocalUrl, isUsedCf, isValidSize, config as oxfmtCfg, config$1 as oxlintCfg, resolveHostnameToSafeIp, safeFetch, safeFetchForDiscord, safeUrl, validateSafeUrl };

package/dist/index.mjs

@@ -2,8 +2,9 @@
 import { defineConfig } from "oxfmt";
 import { defineConfig as defineConfig$1 } from "oxlint";
 import { promises } from "node:dns";
+import { z } from "zod";
 //#region package.json
-var version = "0.4.0";
+var version = "0.5.0";
 //#endregion
 //#region ../template/src/oxfmt.ts
 const config = defineConfig({
@@ -60,7 +61,7 @@ function isLocalIPv4(host) {
 		c,
 		d
 	]) if (!Number.isInteger(v) || v < 0 || v > 255) return false;
-	return a === 0 || a === 127 || a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254;
+	return a === 0 || a === 127 || a === 10 || a === 100 && b >= 64 && b <= 127 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254;
 }
 function isLocalIPv6(addr) {
 	const h = addr.toLowerCase();
@@ -89,12 +90,23 @@ async function isLocalUrl(url) {
 	if (/^\d/.test(hostname)) return isLocalIPv4(hostname);
 	return await isLocalHostname(hostname);
 }
+async function isHttpProtocol(url) {
+	const protocol = URL.parse(url.toString())?.protocol;
+	return protocol === "http:" || protocol === "https:";
+}
 //#endregion
 //#region ../../src/infrastructure/http/src/dns.ts
 async function isLocalHostname(hostname) {
 	const [v4, v6] = await Promise.all([promises.resolve4(hostname).catch(() => []), promises.resolve6(hostname).catch(() => [])]);
 	return v4.some((ip) => isLocalIPv4(ip)) || v6.some((ip) => isLocalIPv6(ip));
 }
+async function resolveHostnameToSafeIp(hostname) {
+	const [v4, v6] = await Promise.all([promises.resolve4(hostname).catch(() => []), promises.resolve6(hostname).catch(() => [])]);
+	if (v4.some((ip) => isLocalIPv4(ip)) || v6.some((ip) => isLocalIPv6(ip))) return null;
+	if (v4[0] !== void 0) return v4[0];
+	if (v6[0] !== void 0) return v6[0];
+	return null;
+}
 //#endregion
 //#region ../../src/infrastructure/http/src/redirect.ts
 const DEFAULT_MAX_REDIRECT = 10;
@@ -124,29 +136,65 @@ const DEFAULT_TIMEOUT = 10 * 1e3;
 const DISCORD_TIMEOUT = 30 * 1e3;
 //#endregion
 //#region ../../src/infrastructure/http/src/safefetch.ts
-const DISCORD_DOMAINS = [
+const ALLOW_DISCORD_DOMAINS = [
 	"discord.com",
 	"discordapp.com",
 	"discord.gg"
 ];
+async function resolveToPinnedUrl(url, init) {
+	const { hostname, host, protocol } = new URL(url);
+	if (hostname === "localhost" || hostname.endsWith(".localhost")) return new LocalAddressError(`${url} is local address.`);
+	if (hostname.startsWith("[") && hostname.endsWith("]")) {
+		if (isLocalIPv6(hostname.slice(1, -1))) return new LocalAddressError(`${url} is local address.`);
+		return {
+			url,
+			init
+		};
+	}
+	if (/^\d/.test(hostname)) {
+		if (isLocalIPv4(hostname)) return new LocalAddressError(`${url} is local address.`);
+		return {
+			url,
+			init
+		};
+	}
+	const resolvedIp = await resolveHostnameToSafeIp(hostname);
+	if (resolvedIp === null) return new LocalAddressError(`${url} is local address.`);
+	const pinnedUrlObj = new URL(url);
+	pinnedUrlObj.hostname = resolvedIp.includes(":") ? `[${resolvedIp}]` : resolvedIp;
+	const headers = new Headers(init.headers);
+	headers.set("Host", host);
+	const pinnedInit = {
+		...init,
+		headers,
+		...protocol === "https:" ? { tls: { serverName: hostname } } : {}
+	};
+	return {
+		url: pinnedUrlObj.href,
+		init: pinnedInit
+	};
+}
 async function safeFetchForDiscord(input, init) {
-	if (await isLocalUrl(input)) return new LocalAddressError(`${input} is local address.`);
 	const hostname = new URL(input).hostname;
-	if (!DISCORD_DOMAINS.includes(hostname)) return new InvalidDomainError(`${hostname} is not discord domain.`);
-	return await fetch(input, {
-		...init,
-		signal: AbortSignal.timeout(DISCORD_TIMEOUT)
+	if (!ALLOW_DISCORD_DOMAINS.includes(hostname)) return new InvalidDomainError(`${hostname} is not discord domain.`);
+	const pinned = await resolveToPinnedUrl(input, init ?? {});
+	if (pinned instanceof LocalAddressError) return pinned;
+	return await fetch(pinned.url, {
+		...pinned.init,
+		signal: AbortSignal.timeout(DISCORD_TIMEOUT),
+		redirect: "manual"
 	});
 }
-async function safeFetch(input, init) {
+async function safeFetch(input, init, options) {
 	let reqUrl = input;
-	let currentInit = init;
+	let currentInit = init ?? {};
 	let redirectCount = 0;
 	let response;
 	while (true) {
-		if (await isLocalUrl(reqUrl)) return new LocalAddressError(`${reqUrl} is local address.`);
-		response = await fetch(reqUrl, {
-			...currentInit,
+		const pinned = await resolveToPinnedUrl(reqUrl, currentInit);
+		if (pinned instanceof LocalAddressError) return pinned;
+		response = await fetch(pinned.url, {
+			...pinned.init,
 			signal: AbortSignal.timeout(DEFAULT_TIMEOUT),
 			redirect: "manual"
 		});
@@ -161,9 +209,10 @@ async function safeFetch(input, init) {
 			} catch {
 				return new HeaderError(`${location} is invalid.`);
 			}
-			if (url.protocol !== "http:" && url.protocol !== "https:") return new HeaderError(`${url.protocol} is not allowed.`);
+			if (options?.detectDiscordProtocol && url.protocol === "discord://") return response;
+			if (!await isHttpProtocol(url)) return new HeaderError(`${url.protocol} is not allowed.`);
 			if (new URL(reqUrl).origin !== url.origin) {
-				const headers = new Headers(currentInit?.headers);
+				const headers = new Headers(currentInit.headers);
 				headers.delete("authorization");
 				headers.delete("cookie");
 				currentInit = {
@@ -173,52 +222,73 @@ async function safeFetch(input, init) {
 			}
 			reqUrl = url.href;
 			redirectCount += 1;
-		} else return response;
+		} else {
+			const finalUrl = reqUrl;
+			return new Proxy(response, { get(target, prop) {
+				if (prop === "url") return finalUrl;
+				const value = Reflect.get(target, prop, target);
+				return typeof value === "function" ? value.bind(target) : value;
+			} });
+		}
 		if (redirectCount > 10) return new RedirectError(`Redirect count is over 10`);
 	}
 }
 //#endregion
+//#region ../../src/infrastructure/http/src/safeurl.ts
+function safeUrl(strings, ...values) {
+	let result = "";
+	for (const [index, str] of strings.entries()) {
+		result += str;
+		const value = values[index];
+		if (value !== void 0) result += encodeURIComponent(value);
+	}
+	return result;
+}
+const safeUrlSchema = z.string().refine((url) => {
+	const parsed = URL.parse(url);
+	return parsed !== null && (parsed.protocol === "http:" || parsed.protocol === "https:");
+}, { message: "URL must be a valid http or https URL" }).transform((url) => url);
+function validateSafeUrl(url) {
+	const result = safeUrlSchema.safeParse(url);
+	return result.success ? result.data : null;
+}
+//#endregion
 //#region ../../src/infrastructure/http/src/invite.ts
-const DISCORD_INVITE_LINK_START = [
-	"https://discord.com/invite/",
-	"https://ptb.discord.com/invite/",
-	"https://canary.discord.com/invite/"
+const DISCORD_DOMAINS = [
+	"discord.com",
+	"ptb.discord.com",
+	"canary.discord.com"
 ];
-async function isUsedCf(res) {
-	try {
-		const response = res.clone();
-		if (response.status !== 403) return false;
-		const { JSDOM } = await import("jsdom");
-		return new JSDOM(await response.text()).window.document.querySelector("title")?.textContent === "Just a moment...";
-	} catch {
-		return false;
-	}
+const INVITE_PROTOCOL = [
+	"discord:",
+	"http:",
+	"https:"
+];
+async function isDiscordInviteLink(url) {
+	const parsedUrl = URL.parse(url.toString());
+	if (parsedUrl === null) return false;
+	return INVITE_PROTOCOL.includes(parsedUrl.protocol) && DISCORD_DOMAINS.includes(parsedUrl.host) && parsedUrl.pathname.startsWith("/invite/");
+}
+function isUsedCf(res) {
+	return res.headers.get("cf-mitigated") === "challenge";
 }
 async function isInviteLink(url) {
-	const response = await safeFetch(url, {
+	const safeUrl = validateSafeUrl(url);
+	if (safeUrl === null) return new LocalAddressError(`${url} is not a safe URL.`);
+	const response = await safeFetch(safeUrl, {
 		method: "GET",
 		headers: { "User-Agent": "Mozilla/5.0" }
-	});
+	}, { detectDiscordProtocol: true });
 	if (response instanceof Error) return response;
 	const resUrl = response.url;
+	const location = response.headers.get("location");
 	return {
-		content: DISCORD_INVITE_LINK_START.some((value) => resUrl.startsWith(value)),
-		isUsedCf: await isUsedCf(response)
+		content: await isDiscordInviteLink(resUrl) || location !== null && await isDiscordInviteLink(location),
+		isUsedCf: isUsedCf(response)
 	};
 }
 //#endregion
-//#region ../../src/infrastructure/http/src/safeurl.ts
-function safeUrl(strings, ...values) {
-	let result = "";
-	for (const [index, str] of strings.entries()) {
-		result += str;
-		const value = values[index];
-		if (value !== void 0) result += encodeURIComponent(value);
-	}
-	return result;
-}
-//#endregion
 //#region src/index.ts
 const DISTOPIA_VERSION = version;
 //#endregion
-export { BodySizeError, DEFAULT_MAX_REDIRECT, DEFAULT_TIMEOUT, DISCORD_DOMAINS, DISCORD_INVITE_LINK_START, DISCORD_TIMEOUT, DISTOPIA_VERSION, HeaderError, InvalidDomainError, LocalAddressError, MAX_BYTES, RedirectError, isInviteLink, isLocalHostname, isLocalIPv4, isLocalIPv6, isLocalUrl, isUsedCf, isValidSize, config as oxfmtCfg, config$1 as oxlintCfg, safeFetch, safeFetchForDiscord, safeUrl };
+export { ALLOW_DISCORD_DOMAINS, BodySizeError, DEFAULT_MAX_REDIRECT, DEFAULT_TIMEOUT, DISCORD_DOMAINS, DISCORD_TIMEOUT, DISTOPIA_VERSION, HeaderError, INVITE_PROTOCOL, InvalidDomainError, LocalAddressError, MAX_BYTES, RedirectError, isHttpProtocol, isInviteLink, isLocalHostname, isLocalIPv4, isLocalIPv6, isLocalUrl, isUsedCf, isValidSize, config as oxfmtCfg, config$1 as oxlintCfg, resolveHostnameToSafeIp, safeFetch, safeFetchForDiscord, safeUrl, validateSafeUrl };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "distopia",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Library for Distopia.",
   "keywords": [
     "distopia",
@@ -38,13 +38,12 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@types/jsdom": "28.0.3",
     "@types/node": "24.13.2",
-    "jsdom": "29.1.1",
     "jsr": "0.14.3",
-    "oxfmt": "0.54.0",
-    "oxlint": "1.60.0",
-    "tsdown": "0.22.2"
+    "oxfmt": "0.56.0",
+    "oxlint": "1.71.0",
+    "tsdown": "0.22.2",
+    "zod": "4.4.3"
   },
   "devDependencies": {
     "bun": "1.3.13"