lifecycleion 0.0.18 → 0.0.20

package/dist/lib/http-client-node/index.d.cts

@@ -1,4 +1,5 @@
-import { H as HTTPAdapter, A as AdapterType, a as AdapterRequest, b as AdapterResponse } from '../../types-CWw885iO.cjs';
+import { H as HTTPAdapter, A as AdapterType, a as AdapterRequest, b as AdapterResponse } from '../../types-6G59m8U9.cjs';
+export { c as AdapterProgressEvent, d as HTTPMethod, S as StreamResponseCancel, e as StreamResponseContext, f as StreamResponseFactory, g as StreamResponseInfo, W as WritableLike } from '../../types-6G59m8U9.cjs';
 import '../../types-BW0vnSzd.cjs';
 
 interface NodeAdapterConfig {
@@ -48,6 +49,36 @@ interface NodeAdapterConfig {
      * routes by Host, also set defaultHeaders: { host: 'billing.internal' }.
      */
     servername?: string;
+    /**
+     * Certificate revocation list(s), used to reject a server certificate whose
+     * serial has been revoked even though its chain and hostname still check out.
+     * A revoked certificate fails the handshake with `CERT_REVOKED`.
+     *
+     * Accepts whatever your CA tooling produced. A PEM string holding SEVERAL
+     * concatenated CRLs — the format Apache's `SSLCARevocationFile`, nginx's
+     * `ssl_crl` and HAProxy's `crl-file` all expect, and what `openssl ca
+     * -gencrl` output is usually assembled into — is split into the array Node
+     * requires. A single CRL, a DER `Buffer`, or an array you built yourself is
+     * passed through untouched.
+     *
+     * The split exists because Node reads only the FIRST CRL of a concatenated
+     * string and silently ignores the rest, unlike `ca`, which reads every
+     * certificate in a bundle. See docs/http-client.md.
+     *
+     * Two things to know before using this:
+     *
+     * - **Every certificate in the chain needs a covering CRL.** Node enables
+     *   `X509_V_FLAG_CRL_CHECK_ALL`, so supplying a CRL for one root while
+     *   connecting through another fails with `UNABLE_TO_GET_CRL` even when
+     *   nothing was revoked. Cover every root you talk to, or scope the client.
+     * - **CRLs expire.** Past `nextUpdate` the handshake fails with
+     *   `CRL_HAS_EXPIRED`, including for certificates that were never revoked.
+     *   Re-pass a fresh CRL before then; the refresh cadence is yours to own.
+     *
+     * Both failures are fail-closed, so a stale CRL never silently stops
+     * enforcing — but both can take out healthy connections.
+     */
+    crl?: string | Buffer | Array<string | Buffer>;
     /**
      * Set to false to accept self-signed certificates in dev/test environments.
      * Defaults to true (Node.js default — rejects invalid certs).
@@ -61,4 +92,4 @@ declare class NodeAdapter implements HTTPAdapter {
     send(request: AdapterRequest): Promise<AdapterResponse>;
 }
 
-export { NodeAdapter, type NodeAdapterConfig };
+export { AdapterRequest, AdapterResponse, AdapterType, HTTPAdapter, NodeAdapter, type NodeAdapterConfig };

package/dist/lib/http-client-node/index.d.ts

@@ -1,4 +1,5 @@
-import { H as HTTPAdapter, A as AdapterType, a as AdapterRequest, b as AdapterResponse } from '../../types-Mso0dYOS.js';
+import { H as HTTPAdapter, A as AdapterType, a as AdapterRequest, b as AdapterResponse } from '../../types-CG10j6Lc.js';
+export { c as AdapterProgressEvent, d as HTTPMethod, S as StreamResponseCancel, e as StreamResponseContext, f as StreamResponseFactory, g as StreamResponseInfo, W as WritableLike } from '../../types-CG10j6Lc.js';
 import '../../types-BW0vnSzd.js';
 
 interface NodeAdapterConfig {
@@ -48,6 +49,36 @@ interface NodeAdapterConfig {
      * routes by Host, also set defaultHeaders: { host: 'billing.internal' }.
      */
     servername?: string;
+    /**
+     * Certificate revocation list(s), used to reject a server certificate whose
+     * serial has been revoked even though its chain and hostname still check out.
+     * A revoked certificate fails the handshake with `CERT_REVOKED`.
+     *
+     * Accepts whatever your CA tooling produced. A PEM string holding SEVERAL
+     * concatenated CRLs — the format Apache's `SSLCARevocationFile`, nginx's
+     * `ssl_crl` and HAProxy's `crl-file` all expect, and what `openssl ca
+     * -gencrl` output is usually assembled into — is split into the array Node
+     * requires. A single CRL, a DER `Buffer`, or an array you built yourself is
+     * passed through untouched.
+     *
+     * The split exists because Node reads only the FIRST CRL of a concatenated
+     * string and silently ignores the rest, unlike `ca`, which reads every
+     * certificate in a bundle. See docs/http-client.md.
+     *
+     * Two things to know before using this:
+     *
+     * - **Every certificate in the chain needs a covering CRL.** Node enables
+     *   `X509_V_FLAG_CRL_CHECK_ALL`, so supplying a CRL for one root while
+     *   connecting through another fails with `UNABLE_TO_GET_CRL` even when
+     *   nothing was revoked. Cover every root you talk to, or scope the client.
+     * - **CRLs expire.** Past `nextUpdate` the handshake fails with
+     *   `CRL_HAS_EXPIRED`, including for certificates that were never revoked.
+     *   Re-pass a fresh CRL before then; the refresh cadence is yours to own.
+     *
+     * Both failures are fail-closed, so a stale CRL never silently stops
+     * enforcing — but both can take out healthy connections.
+     */
+    crl?: string | Buffer | Array<string | Buffer>;
     /**
      * Set to false to accept self-signed certificates in dev/test environments.
      * Defaults to true (Node.js default — rejects invalid certs).
@@ -61,4 +92,4 @@ declare class NodeAdapter implements HTTPAdapter {
     send(request: AdapterRequest): Promise<AdapterResponse>;
 }
 
-export { NodeAdapter, type NodeAdapterConfig };
+export { AdapterRequest, AdapterResponse, AdapterType, HTTPAdapter, NodeAdapter, type NodeAdapterConfig };

package/dist/lib/http-client-node/index.js

@@ -325,13 +325,17 @@ var CERT_ERROR_CODES = /* @__PURE__ */ new Set([
   "ERR_SSL_TLSV13_ALERT_CERTIFICATE_REQUIRED",
   "ERR_SSL_PEER_DID_NOT_RETURN_A_CERTIFICATE",
   "SELF_SIGNED_CERT_IN_CHAIN",
-  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"
+  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+  "CERT_REVOKED"
 ]);
 function isTLSCertificateError(error) {
   const code = error.code ?? "";
   if (CERT_ERROR_CODES.has(code)) {
     return true;
   }
+  if (code.includes("CRL")) {
+    return true;
+  }
   if ((code.startsWith("ERR_TLS_") || code.startsWith("ERR_SSL_")) && code.includes("CERT")) {
     return true;
   }
@@ -368,20 +372,6 @@ function materializeNodeRequestHeaders(headers) {
 
 // src/lib/http-client/utils.ts
 import qs from "qs";
-
-// src/lib/domain-utils/domain-utils.ts
-import { getDomain, getSubdomain, getPublicSuffix } from "tldts";
-
-// src/lib/domain-utils/helpers.ts
-import { toASCII } from "tr46";
-var INTERNAL_PSEUDO_TLDS = Object.freeze(
-  /* @__PURE__ */ new Set(["localhost", "local", "test", "internal"])
-);
-
-// src/lib/domain-utils/domain-utils.ts
-import { getDomain as getDomain2, getSubdomain as getSubdomain2 } from "tldts";
-
-// src/lib/http-client/utils.ts
 function resolveAbsoluteURL(url, baseURL) {
   if (!url) {
     return url;
@@ -471,6 +461,9 @@ var NodeAdapter = class {
         }
         httpsOptions.rejectUnauthorized = true;
       }
+      if (this._config.crl !== void 0) {
+        httpsOptions.crl = normalizeCRL(this._config.crl);
+      }
       if (this._config.rejectUnauthorized === false) {
         httpsOptions.rejectUnauthorized = false;
       }
@@ -994,6 +987,36 @@ async function streamResponseBody(res, writable, totalBytes, onProgress) {
     res.on("close", onResponseClose);
   });
 }
+var PEM_CRL_HEADER = "-----BEGIN X509 CRL-----";
+var PEM_CRL_BLOCK = /-----BEGIN X509 CRL-----[\s\S]*?-----END X509 CRL-----/g;
+var RESIDUE_OUTSIDE_PEM_BLOCKS = /\S/;
+function normalizeCRL(crl) {
+  if (Array.isArray(crl)) {
+    return crl.flatMap((entry) => normalizeCRLEntry(entry));
+  }
+  return normalizeCRLEntry(crl);
+}
+function normalizeCRLEntry(entry) {
+  if (typeof entry === "string") {
+    return splitCRLString(entry);
+  }
+  const text = entry.toString("latin1");
+  if (!text.includes(PEM_CRL_HEADER)) {
+    return entry;
+  }
+  const split = splitCRLString(text);
+  return Array.isArray(split) ? split : entry;
+}
+function splitCRLString(crl) {
+  const blocks = crl.match(PEM_CRL_BLOCK) ?? [];
+  const residue = crl.replace(PEM_CRL_BLOCK, "");
+  if (RESIDUE_OUTSIDE_PEM_BLOCKS.test(residue)) {
+    throw new Error(
+      "NodeAdapter: the `crl` value contains content outside any complete -----BEGIN/END X509 CRL----- block. Only PEM CRL blocks separated by whitespace are accepted, because a truncated CRL and a line of commentary are indistinguishable \u2014 accepting the second would mean silently dropping the first and enforcing an incomplete revocation set. Common causes: a partial download, a clipped or mistyped delimiter, or decoded text from `openssl ... -text`, which must be stripped before the bundle is passed here."
+    );
+  }
+  return blocks.length > 1 ? blocks : crl;
+}
 function normalizeResponseHeaders(headers) {
   const result = {};
   for (const [key, value] of Object.entries(headers)) {