nlcurl 0.6.0 → 0.7.0

package/dist/dns/doh-resolver.d.ts

@@ -0,0 +1,52 @@
+import type { DoHConfig, DNSRecord } from "./types.js";
+/**
+ * DNS-over-HTTPS resolver for encrypted DNS resolution.
+ *
+ * Usage:
+ * ```typescript
+ * const resolver = new DoHResolver({ server: "https://1.1.1.1/dns-query" });
+ * const records = await resolver.query("example.com", "A");
+ * ```
+ */
+export declare class DoHResolver {
+    private readonly serverUrl;
+    private readonly method;
+    private readonly timeout;
+    private readonly bootstrap;
+    private queryId;
+    constructor(config: DoHConfig);
+    /**
+     * Sends a DNS query over HTTPS and returns the parsed answer records.
+     *
+     * @param name   Domain name to resolve.
+     * @param type   Record type: "A", "AAAA", "HTTPS", or "SVCB".
+     * @param signal Optional AbortSignal for cancellation.
+     * @returns Array of raw DNS records from the answer section.
+     */
+    query(name: string, type: "A" | "AAAA" | "HTTPS" | "SVCB", signal?: AbortSignal): Promise<DNSRecord[]>;
+    /**
+     * Sends the DNS wire-format query to the DoH server.
+     */
+    private sendQuery;
+    /**
+     * GET method: base64url-encode the DNS query in the `dns` query parameter.
+     */
+    private sendGET;
+    /**
+     * POST method: send DNS wire-format directly in the request body.
+     */
+    private sendPOST;
+    /**
+     * Make the HTTPS request with timeout and abort support.
+     */
+    private httpRequest;
+    /**
+     * Resolves the DoH server hostname to an IP address (bootstrap).
+     * Uses the system DNS resolver for this bootstrap step to avoid
+     * a circular dependency (we can't use DoH to resolve the DoH server).
+     *
+     * If the server URL already uses an IP address, returns it directly.
+     */
+    private resolveServerHost;
+}
+//# sourceMappingURL=doh-resolver.d.ts.map

package/dist/dns/doh-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doh-resolver.d.ts","sourceRoot":"","sources":["../../src/dns/doh-resolver.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AASvD;;;;;;;;GAQG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAM;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;IACpC,OAAO,CAAC,OAAO,CAAK;gBAER,MAAM,EAAE,SAAS;IAO7B;;;;;;;OAOG;IACG,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAS5G;;OAEG;YACW,SAAS;IASvB;;OAEG;IACH,OAAO,CAAC,OAAO;IAqBf;;OAEG;IACH,OAAO,CAAC,QAAQ;IAmBhB;;OAEG;IACH,OAAO,CAAC,WAAW;IA+EnB;;;;;;OAMG;YACW,iBAAiB;CAmBhC"}

package/dist/dns/doh-resolver.js

@@ -0,0 +1,192 @@
+/**
+ * DNS-over-HTTPS (DoH) resolver implementing RFC 8484.
+ *
+ * Sends DNS queries over HTTPS to a configured DoH server, providing
+ * encrypted DNS resolution for privacy. Supports both GET (wire-format
+ * in query parameter) and POST (wire-format in body) methods.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc8484
+ */
+import * as https from "node:https";
+import * as http from "node:http";
+import { lookup } from "node:dns/promises";
+import { buildDNSQuery, parseDNSResponse } from "./codec.js";
+import { RTYPE } from "./types.js";
+const DOH_CONTENT_TYPE = "application/dns-message";
+const DEFAULT_TIMEOUT = 5000;
+/** Cache of bootstrapped DoH server IP → avoid infinite recursion. */
+const bootstrapCache = new Map();
+/**
+ * DNS-over-HTTPS resolver for encrypted DNS resolution.
+ *
+ * Usage:
+ * ```typescript
+ * const resolver = new DoHResolver({ server: "https://1.1.1.1/dns-query" });
+ * const records = await resolver.query("example.com", "A");
+ * ```
+ */
+export class DoHResolver {
+    serverUrl;
+    method;
+    timeout;
+    bootstrap;
+    queryId = 0;
+    constructor(config) {
+        this.serverUrl = new URL(config.server);
+        this.method = config.method ?? "POST";
+        this.timeout = config.timeout ?? DEFAULT_TIMEOUT;
+        this.bootstrap = config.bootstrap ?? true;
+    }
+    /**
+     * Sends a DNS query over HTTPS and returns the parsed answer records.
+     *
+     * @param name   Domain name to resolve.
+     * @param type   Record type: "A", "AAAA", "HTTPS", or "SVCB".
+     * @param signal Optional AbortSignal for cancellation.
+     * @returns Array of raw DNS records from the answer section.
+     */
+    async query(name, type, signal) {
+        const rtype = RTYPE[type];
+        const id = this.queryId++ & 0xffff;
+        const queryPacket = buildDNSQuery(name, rtype, id);
+        const responseData = await this.sendQuery(queryPacket, signal);
+        return parseDNSResponse(responseData);
+    }
+    /**
+     * Sends the DNS wire-format query to the DoH server.
+     */
+    async sendQuery(packet, signal) {
+        const host = await this.resolveServerHost();
+        if (this.method === "GET") {
+            return this.sendGET(packet, host, signal);
+        }
+        return this.sendPOST(packet, host, signal);
+    }
+    /**
+     * GET method: base64url-encode the DNS query in the `dns` query parameter.
+     */
+    sendGET(packet, host, signal) {
+        const encoded = packet.toString("base64url");
+        const url = new URL(this.serverUrl.toString());
+        url.searchParams.set("dns", encoded);
+        return this.httpRequest({
+            method: "GET",
+            hostname: host,
+            port: parseInt(this.serverUrl.port) || 443,
+            path: `${url.pathname}${url.search}`,
+            headers: {
+                accept: DOH_CONTENT_TYPE,
+                host: this.serverUrl.hostname,
+            },
+        }, undefined, signal);
+    }
+    /**
+     * POST method: send DNS wire-format directly in the request body.
+     */
+    sendPOST(packet, host, signal) {
+        return this.httpRequest({
+            method: "POST",
+            hostname: host,
+            port: parseInt(this.serverUrl.port) || 443,
+            path: this.serverUrl.pathname,
+            headers: {
+                "content-type": DOH_CONTENT_TYPE,
+                accept: DOH_CONTENT_TYPE,
+                "content-length": packet.length.toString(),
+                host: this.serverUrl.hostname,
+            },
+        }, packet, signal);
+    }
+    /**
+     * Make the HTTPS request with timeout and abort support.
+     */
+    httpRequest(options, body, signal) {
+        return new Promise((resolve, reject) => {
+            if (signal?.aborted) {
+                reject(new Error("DoH query aborted"));
+                return;
+            }
+            const isHTTPS = this.serverUrl.protocol === "https:";
+            const requestFn = isHTTPS ? https.request : http.request;
+            const tlsOpts = isHTTPS
+                ? {
+                    ...options,
+                    rejectUnauthorized: true,
+                    servername: this.serverUrl.hostname,
+                }
+                : options;
+            const req = requestFn(tlsOpts, (res) => {
+                if (res.statusCode !== 200) {
+                    req.destroy();
+                    reject(new Error(`DoH server returned HTTP ${res.statusCode}`));
+                    return;
+                }
+                const contentType = res.headers["content-type"];
+                if (contentType && !contentType.includes(DOH_CONTENT_TYPE)) {
+                    req.destroy();
+                    reject(new Error(`DoH server returned unexpected content-type: ${contentType}`));
+                    return;
+                }
+                const chunks = [];
+                let totalSize = 0;
+                const MAX_DNS_RESPONSE = 65535;
+                res.on("data", (chunk) => {
+                    totalSize += chunk.length;
+                    if (totalSize > MAX_DNS_RESPONSE) {
+                        req.destroy();
+                        reject(new Error("DoH response exceeds maximum DNS message size"));
+                        return;
+                    }
+                    chunks.push(chunk);
+                });
+                res.on("end", () => {
+                    resolve(Buffer.concat(chunks));
+                });
+                res.on("error", reject);
+            });
+            req.on("error", reject);
+            const timer = setTimeout(() => {
+                req.destroy();
+                reject(new Error("DoH query timed out"));
+            }, this.timeout);
+            req.once("close", () => clearTimeout(timer));
+            if (signal) {
+                const onAbort = () => {
+                    clearTimeout(timer);
+                    req.destroy();
+                    reject(new Error("DoH query aborted"));
+                };
+                signal.addEventListener("abort", onAbort, { once: true });
+                req.once("close", () => signal.removeEventListener("abort", onAbort));
+            }
+            if (body) {
+                req.write(body);
+            }
+            req.end();
+        });
+    }
+    /**
+     * Resolves the DoH server hostname to an IP address (bootstrap).
+     * Uses the system DNS resolver for this bootstrap step to avoid
+     * a circular dependency (we can't use DoH to resolve the DoH server).
+     *
+     * If the server URL already uses an IP address, returns it directly.
+     */
+    async resolveServerHost() {
+        const host = this.serverUrl.hostname;
+        if (/^\d+\.\d+\.\d+\.\d+$/.test(host) || host.includes(":")) {
+            return host;
+        }
+        const cached = bootstrapCache.get(host);
+        if (cached)
+            return cached;
+        if (!this.bootstrap) {
+            return host;
+        }
+        const result = await lookup(host, { family: 0 });
+        const address = Array.isArray(result) ? result[0].address : result.address;
+        bootstrapCache.set(host, address);
+        return address;
+    }
+}
+//# sourceMappingURL=doh-resolver.js.map

package/dist/dns/doh-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doh-resolver.js","sourceRoot":"","sources":["../../src/dns/doh-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AACpC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE7D,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AACnD,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,sEAAsE;AACtE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEjD;;;;;;;;GAQG;AACH,MAAM,OAAO,WAAW;IACL,SAAS,CAAM;IACf,MAAM,CAAiB;IACvB,OAAO,CAAS;IAChB,SAAS,CAAU;IAC5B,OAAO,GAAG,CAAC,CAAC;IAEpB,YAAY,MAAiB;QAC3B,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;QACtC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,eAAe,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,IAAqC,EAAE,MAAoB;QACnF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC;QACnC,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAEnD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,MAAoB;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE5C,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACK,OAAO,CAAC,MAAc,EAAE,IAAY,EAAE,MAAoB;QAChE,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAErC,OAAO,IAAI,CAAC,WAAW,CACrB;YACE,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,GAAG;YAC1C,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;YACpC,OAAO,EAAE;gBACP,MAAM,EAAE,gBAAgB;gBACxB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ;aAC9B;SACF,EACD,SAAS,EACT,MAAM,CACP,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,QAAQ,CAAC,MAAc,EAAE,IAAY,EAAE,MAAoB;QACjE,OAAO,IAAI,CAAC,WAAW,CACrB;YACE,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,GAAG;YAC1C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ;YAC7B,OAAO,EAAE;gBACP,cAAc,EAAE,gBAAgB;gBAChC,MAAM,EAAE,gBAAgB;gBACxB,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC1C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ;aAC9B;SACF,EACD,MAAM,EACN,MAAM,CACP,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,OAA6B,EAAE,IAAwB,EAAE,MAAoB;QAC/F,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC;YACrD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;YAEzD,MAAM,OAAO,GAAyB,OAAO;gBAC3C,CAAC,CAAC;oBACE,GAAG,OAAO;oBACV,kBAAkB,EAAE,IAAI;oBACxB,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ;iBACpC;gBACH,CAAC,CAAC,OAAO,CAAC;YAEZ,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACrC,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBAC3B,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;oBAChE,OAAO;gBACT,CAAC;gBAED,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;gBAChD,IAAI,WAAW,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBAC3D,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,MAAM,CAAC,IAAI,KAAK,CAAC,gDAAgD,WAAW,EAAE,CAAC,CAAC,CAAC;oBACjF,OAAO;gBACT,CAAC;gBAED,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,IAAI,SAAS,GAAG,CAAC,CAAC;gBAClB,MAAM,gBAAgB,GAAG,KAAK,CAAC;gBAE/B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC/B,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;oBAC1B,IAAI,SAAS,GAAG,gBAAgB,EAAE,CAAC;wBACjC,GAAG,CAAC,OAAO,EAAE,CAAC;wBACd,MAAM,CAAC,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC,CAAC;wBACnE,OAAO;oBACT,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;gBAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjC,CAAC,CAAC,CAAC;gBAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAExB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAC3C,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAEjB,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YAE7C,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,GAAG,EAAE;oBACnB,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBACzC,CAAC,CAAC;gBACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1D,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,IAAI,EAAE,CAAC;gBACT,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;YACD,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,iBAAiB;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;QAErC,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAC5E,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClC,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/dns/https-rr.d.ts

@@ -0,0 +1,51 @@
+import { type SVCBRecord, type DoHConfig, type ResolvedAddress } from "./types.js";
+/**
+ * Result of an HTTPS-RR lookup, combining SVCB records with address hints.
+ */
+export interface HTTPSRRResult {
+    /** Parsed SVCB/HTTPS records, sorted by priority (lowest first). */
+    svcb: SVCBRecord[];
+    /** ECH config list from the highest-priority record that has one. */
+    echConfigList?: Buffer;
+    /** ALPN protocols from the highest-priority ServiceMode record. */
+    alpn?: string[];
+    /** IP address hints extracted from SVCB records + A/AAAA. */
+    addresses: ResolvedAddress[];
+    /** Port override from the SVCB record, if any. */
+    port?: number;
+}
+/**
+ * Resolver for HTTPS/SVCB DNS Resource Records (RFC 9460).
+ *
+ * Supports two modes:
+ * 1. **System DNS** — Uses `node:dns` (resolveAny or raw query).
+ * 2. **DoH** — Uses a DoHResolver for encrypted HTTPS-RR queries.
+ */
+export declare class HTTPSRRResolver {
+    private readonly dohResolver?;
+    private readonly systemResolver;
+    constructor(dohConfig?: DoHConfig);
+    /**
+     * Queries HTTPS records for a hostname and parses the results.
+     *
+     * @param hostname The domain to look up HTTPS records for.
+     * @param signal   Optional AbortSignal for cancellation.
+     * @returns Parsed HTTPS-RR result with SVCB params, or null if no records found.
+     */
+    resolve(hostname: string, signal?: AbortSignal): Promise<HTTPSRRResult | null>;
+    /**
+     * Resolves HTTPS records via DoH.
+     */
+    private resolveViaDoH;
+    /**
+     * Resolves HTTPS records via the system DNS resolver.
+     * Uses raw DNS query + decode since node:dns doesn't natively support type 65.
+     */
+    private resolveViaSystem;
+    /**
+     * Parses a native Node.js HTTPS DNS record into our SVCBRecord format.
+     * Node.js 22+ may return HTTPS records with a specific structure.
+     */
+    private parseNativeHTTPSRecord;
+}
+//# sourceMappingURL=https-rr.d.ts.map

package/dist/dns/https-rr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"https-rr.d.ts","sourceRoot":"","sources":["../../src/dns/https-rr.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAS,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAE1F;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,6DAA6D;IAC7D,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAW;gBAE9B,SAAS,CAAC,EAAE,SAAS;IAOjC;;;;;;OAMG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA+CpF;;OAEG;YACW,aAAa;IAK3B;;;OAGG;YACW,gBAAgB;IAU9B;;;OAGG;IACH,OAAO,CAAC,sBAAsB;CAc/B"}

package/dist/dns/https-rr.js

@@ -0,0 +1,127 @@
+/**
+ * HTTPS Resource Record resolver (RFC 9460).
+ *
+ * Queries HTTPS/SVCB DNS records to discover:
+ * - ECH (Encrypted Client Hello) configuration keys
+ * - ALPN protocol hints (e.g. h2, h3)
+ * - IP address hints for faster connection setup
+ * - Port overrides
+ *
+ * Can use either the system DNS resolver (via `node:dns`) or a DoH
+ * resolver for encrypted queries.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc9460
+ */
+import { Resolver } from "node:dns/promises";
+import { DoHResolver } from "./doh-resolver.js";
+import { parseSVCBRecord } from "./codec.js";
+import { RTYPE } from "./types.js";
+/**
+ * Resolver for HTTPS/SVCB DNS Resource Records (RFC 9460).
+ *
+ * Supports two modes:
+ * 1. **System DNS** — Uses `node:dns` (resolveAny or raw query).
+ * 2. **DoH** — Uses a DoHResolver for encrypted HTTPS-RR queries.
+ */
+export class HTTPSRRResolver {
+    dohResolver;
+    systemResolver;
+    constructor(dohConfig) {
+        if (dohConfig) {
+            this.dohResolver = new DoHResolver(dohConfig);
+        }
+        this.systemResolver = new Resolver();
+    }
+    /**
+     * Queries HTTPS records for a hostname and parses the results.
+     *
+     * @param hostname The domain to look up HTTPS records for.
+     * @param signal   Optional AbortSignal for cancellation.
+     * @returns Parsed HTTPS-RR result with SVCB params, or null if no records found.
+     */
+    async resolve(hostname, signal) {
+        try {
+            let svcbRecords;
+            if (this.dohResolver) {
+                svcbRecords = await this.resolveViaDoH(hostname, signal);
+            }
+            else {
+                svcbRecords = await this.resolveViaSystem(hostname);
+            }
+            if (svcbRecords.length === 0)
+                return null;
+            svcbRecords.sort((a, b) => a.priority - b.priority);
+            const serviceRecords = svcbRecords.filter((r) => r.priority > 0);
+            if (serviceRecords.length === 0)
+                return null;
+            const best = serviceRecords[0];
+            const addresses = [];
+            for (const rec of serviceRecords) {
+                if (rec.ipv4Hints) {
+                    for (const addr of rec.ipv4Hints) {
+                        addresses.push({ address: addr, family: 4 });
+                    }
+                }
+                if (rec.ipv6Hints) {
+                    for (const addr of rec.ipv6Hints) {
+                        addresses.push({ address: addr, family: 6 });
+                    }
+                }
+            }
+            const echRecord = serviceRecords.find((r) => r.echConfigList);
+            return {
+                svcb: svcbRecords,
+                echConfigList: echRecord?.echConfigList,
+                alpn: best.alpn,
+                addresses,
+                port: best.port,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Resolves HTTPS records via DoH.
+     */
+    async resolveViaDoH(hostname, signal) {
+        const records = await this.dohResolver.query(hostname, "HTTPS", signal);
+        return records.filter((r) => r.type === RTYPE.HTTPS || r.type === RTYPE.SVCB).map((r) => parseSVCBRecord(r.data));
+    }
+    /**
+     * Resolves HTTPS records via the system DNS resolver.
+     * Uses raw DNS query + decode since node:dns doesn't natively support type 65.
+     */
+    async resolveViaSystem(hostname) {
+        try {
+            const results = await this.systemResolver.resolve(hostname, "HTTPS").catch(() => []);
+            if (Array.isArray(results) && results.length > 0) {
+                return results.map((r) => this.parseNativeHTTPSRecord(r));
+            }
+        }
+        catch { }
+        return [];
+    }
+    /**
+     * Parses a native Node.js HTTPS DNS record into our SVCBRecord format.
+     * Node.js 22+ may return HTTPS records with a specific structure.
+     */
+    parseNativeHTTPSRecord(record) {
+        const result = {
+            priority: record.priority ?? 0,
+            target: record.target ?? "",
+        };
+        if (record.alpn)
+            result.alpn = Array.isArray(record.alpn) ? record.alpn : [record.alpn];
+        if (record.port)
+            result.port = record.port;
+        if (record.ipv4hint)
+            result.ipv4Hints = Array.isArray(record.ipv4hint) ? record.ipv4hint : [record.ipv4hint];
+        if (record.ipv6hint)
+            result.ipv6Hints = Array.isArray(record.ipv6hint) ? record.ipv6hint : [record.ipv6hint];
+        if (record.ech)
+            result.echConfigList = Buffer.isBuffer(record.ech) ? record.ech : Buffer.from(record.ech, "base64");
+        return result;
+    }
+}
+//# sourceMappingURL=https-rr.js.map

package/dist/dns/https-rr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"https-rr.js","sourceRoot":"","sources":["../../src/dns/https-rr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAmC,eAAe,EAAiC,MAAM,YAAY,CAAC;AAC7G,OAAO,EAAE,KAAK,EAAyD,MAAM,YAAY,CAAC;AAkB1F;;;;;;GAMG;AACH,MAAM,OAAO,eAAe;IACT,WAAW,CAAe;IAC1B,cAAc,CAAW;IAE1C,YAAY,SAAqB;QAC/B,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,IAAI,QAAQ,EAAE,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,MAAoB;QAClD,IAAI,CAAC;YACH,IAAI,WAAyB,CAAC;YAE9B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YACtD,CAAC;YAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAE1C,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;YAEpD,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YACjE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAE7C,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAE,CAAC;YAEhC,MAAM,SAAS,GAAsB,EAAE,CAAC;YACxC,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;gBACjC,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;oBAClB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;wBACjC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;oBAC/C,CAAC;gBACH,CAAC;gBACD,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;oBAClB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;wBACjC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;oBAC/C,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;YAE9D,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,aAAa,EAAE,SAAS,EAAE,aAAa;gBACvC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS;gBACT,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,MAAoB;QAChE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,gBAAgB,CAAC,QAAgB;QAC7C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAO,IAAI,CAAC,cAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9F,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;OAGG;IACK,sBAAsB,CAAC,MAAW;QACxC,MAAM,MAAM,GAAe;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;YAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;SAC5B,CAAC;QAEF,IAAI,MAAM,CAAC,IAAI;YAAE,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxF,IAAI,MAAM,CAAC,IAAI;YAAE,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAC3C,IAAI,MAAM,CAAC,QAAQ;YAAE,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7G,IAAI,MAAM,CAAC,QAAQ;YAAE,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7G,IAAI,MAAM,CAAC,GAAG;YAAE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEpH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/dns/types.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Type definitions for the DNS resolution subsystem, including DNS-over-HTTPS
+ * (RFC 8484), HTTPS/SVCB resource records (RFC 9460), and resolver interfaces.
+ */
+/**
+ * A resolved IP address entry.
+ */
+export interface ResolvedAddress {
+    address: string;
+    family: 4 | 6;
+}
+/**
+ * DNS query types used by the resolver.
+ */
+export type DNSRecordType = "A" | "AAAA" | "HTTPS" | "SVCB";
+/**
+ * A parsed DNS resource record.
+ */
+export interface DNSRecord {
+    name: string;
+    type: number;
+    ttl: number;
+    data: Buffer;
+}
+/**
+ * Wire-format DNS record type numbers.
+ */
+export declare const RTYPE: {
+    readonly A: 1;
+    readonly AAAA: 28;
+    readonly HTTPS: 65;
+    readonly SVCB: 64;
+};
+/**
+ * Wire-format DNS class numbers.
+ */
+export declare const RCLASS: {
+    readonly IN: 1;
+};
+/**
+ * SvcParam keys defined in RFC 9460 §14.3.
+ */
+export declare const SvcParamKey: {
+    readonly MANDATORY: 0;
+    readonly ALPN: 1;
+    readonly NO_DEFAULT_ALPN: 2;
+    readonly PORT: 3;
+    readonly IPV4HINT: 4;
+    readonly ECH: 5;
+    readonly IPV6HINT: 6;
+    /** draft-ietf-dnsop-svcb-https §14 — DNS-over-HTTPS path template */
+    readonly DOHPATH: 7;
+};
+/**
+ * Parsed HTTPS/SVCB record service parameters (RFC 9460).
+ */
+export interface SVCBRecord {
+    /** SvcPriority — 0 = AliasMode, >0 = ServiceMode. */
+    priority: number;
+    /** TargetName — the target domain (empty = use record owner). */
+    target: string;
+    /** ALPN protocol identifiers (e.g. ["h2", "h3"]). */
+    alpn?: string[];
+    /** TCP port override. */
+    port?: number;
+    /** IPv4 address hints. */
+    ipv4Hints?: string[];
+    /** IPv6 address hints. */
+    ipv6Hints?: string[];
+    /** ECH configuration (raw bytes). */
+    echConfigList?: Buffer;
+    /** Whether no-default-alpn is set. */
+    noDefaultAlpn?: boolean;
+}
+/**
+ * Configuration options for the DoH resolver.
+ */
+export interface DoHConfig {
+    /** DoH server URL (e.g. "https://1.1.1.1/dns-query"). */
+    server: string;
+    /**
+     * HTTP method for DoH queries.
+     * - `"GET"`: DNS wire-format base64url-encoded in `?dns=` query parameter.
+     * - `"POST"`: DNS wire-format in request body.
+     * @default "POST"
+     */
+    method?: "GET" | "POST";
+    /** Timeout in ms for each DoH query. @default 5000 */
+    timeout?: number;
+    /**
+     * Whether to bootstrap the DoH server address via system DNS if the
+     * server URL uses a hostname instead of an IP.
+     * @default true
+     */
+    bootstrap?: boolean;
+}
+/**
+ * Combined DNS configuration for the library.
+ */
+export interface DNSConfig {
+    /** DoH resolver configuration. When set, DNS queries use DNS-over-HTTPS. */
+    doh?: DoHConfig;
+    /**
+     * Whether to query HTTPS/SVCB records alongside A/AAAA.
+     * Enables ECH key discovery, ALPN hints, and IP hints.
+     * @default false
+     */
+    httpsRR?: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/dns/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/dns/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;CACf;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,GAAG,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAE5D;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,eAAO,MAAM,KAAK;;;;;CAKR,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,MAAM;;CAET,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,WAAW;;;;;;;;IAQtB,qEAAqE;;CAE7D,CAAC;AAEX;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,yBAAyB;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,0BAA0B;IAC1B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,qCAAqC;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACxB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,4EAA4E;IAC5E,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB"}

package/dist/dns/types.js

@@ -0,0 +1,34 @@
+/**
+ * Type definitions for the DNS resolution subsystem, including DNS-over-HTTPS
+ * (RFC 8484), HTTPS/SVCB resource records (RFC 9460), and resolver interfaces.
+ */
+/**
+ * Wire-format DNS record type numbers.
+ */
+export const RTYPE = {
+    A: 1,
+    AAAA: 28,
+    HTTPS: 65,
+    SVCB: 64,
+};
+/**
+ * Wire-format DNS class numbers.
+ */
+export const RCLASS = {
+    IN: 1,
+};
+/**
+ * SvcParam keys defined in RFC 9460 §14.3.
+ */
+export const SvcParamKey = {
+    MANDATORY: 0,
+    ALPN: 1,
+    NO_DEFAULT_ALPN: 2,
+    PORT: 3,
+    IPV4HINT: 4,
+    ECH: 5,
+    IPV6HINT: 6,
+    /** draft-ietf-dnsop-svcb-https §14 — DNS-over-HTTPS path template */
+    DOHPATH: 7,
+};
+//# sourceMappingURL=types.js.map

package/dist/dns/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/dns/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAyBH;;GAEG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,CAAC,EAAE,CAAC;IACJ,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,EAAE;CACA,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,EAAE,EAAE,CAAC;CACG,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,SAAS,EAAE,CAAC;IACZ,IAAI,EAAE,CAAC;IACP,eAAe,EAAE,CAAC;IAClB,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;IACX,GAAG,EAAE,CAAC;IACN,QAAQ,EAAE,CAAC;IACX,qEAAqE;IACrE,OAAO,EAAE,CAAC;CACF,CAAC"}

package/dist/hsts/store.d.ts

@@ -0,0 +1,41 @@
+import type { HSTSConfig } from "./types.js";
+/**
+ * In-memory HSTS policy store implementing RFC 6797.
+ *
+ * Parses `Strict-Transport-Security` response headers, stores per-host policies,
+ * and upgrades `http://` URLs to `https://` when an active policy matches.
+ */
+export declare class HSTSStore {
+    private readonly policies;
+    constructor(config?: HSTSConfig);
+    /**
+     * Seeds a preload entry with a very long max-age (20 years).
+     */
+    private addPreload;
+    /**
+     * Parses a `Strict-Transport-Security` header value and stores the policy.
+     * Only processes headers received over a secure (HTTPS) connection, as
+     * required by RFC 6797 §8.1.
+     *
+     * @param host     - The hostname from the request URL.
+     * @param value    - The raw STS header value (e.g. `"max-age=31536000; includeSubDomains"`).
+     * @param isSecure - Whether the response was received over HTTPS.
+     */
+    parseHeader(host: string, value: string, isSecure: boolean): void;
+    /**
+     * Checks whether the given host has an active HSTS policy, either via
+     * congruent match or superdomain match with `includeSubDomains`.
+     */
+    isSecure(host: string): boolean;
+    /**
+     * If there is an active HSTS policy for the host in the given URL,
+     * upgrades the scheme from `http:` to `https:`. Returns the original
+     * URL string if no upgrade is needed.
+     */
+    upgradeURL(urlString: string): string;
+    /** Returns the number of active policies stored. */
+    get size(): number;
+    /** Clears all stored policies. */
+    clear(): void;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/hsts/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/hsts/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAA+B,MAAM,YAAY,CAAC;AAE1E;;;;;GAKG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgC;gBAE7C,MAAM,CAAC,EAAE,UAAU;IAQ/B;;OAEG;IACH,OAAO,CAAC,UAAU;IAUlB;;;;;;;;OAQG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI;IA2BjE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAwB/B;;;;OAIG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAkBrC,oDAAoD;IACpD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,kCAAkC;IAClC,KAAK,IAAI,IAAI;CAGd"}