| import dns from "node:dns"; | |
| // Bypass Railway's in-container resolver, which returns stale/mis-routed | |
| // answers for api.anthropic.com that land on CF anycast IPs not | |
| // authorized for Anthropic's zone — Cloudflare then rejects the TLS | |
| // handshake with Error 1000 ("DNS points to prohibited IP"). Pinning the | |
| // resolver to Cloudflare + Google fixes the A record, and the lookup | |
| // patch below forces IPv4 so undici can't prefer an AAAA with the same | |
| // problem. | |
| dns.setServers(["1.1.1.1", "8.8.8.8"]); | |
| // Prefer IPv4 via c-ares `resolve4` over getaddrinfo. Also matters on local | |
| // networks where getaddrinfo returns AAAA-only for hosts with no global v6 route. | |
| // biome-ignore lint/suspicious/noExplicitAny: matches Node's overloaded lookup signature | |
| const origLookup = dns.lookup as any; | |
| // biome-ignore lint/suspicious/noExplicitAny: matches Node's overloaded lookup signature | |
| (dns as any).lookup = function patchedLookup( | |
| hostname: string, | |
| optsOrCb: unknown, | |
| maybeCb?: unknown, | |
| ) { | |
| const cb = (typeof optsOrCb === "function" ? optsOrCb : maybeCb) as ( | |
| err: NodeJS.ErrnoException | null, | |
| address?: string | { address: string; family: number }[], | |
| family?: number, | |
| ) => void; | |
| const opts = (typeof optsOrCb === "function" ? {} : optsOrCb) as { | |
| all?: boolean; | |
| family?: number; | |
| }; | |
| if (opts.family === 6) { | |
| return origLookup(hostname, opts, cb); | |
| } | |
| dns.resolve4(hostname, (err, addrs) => { | |
| if (!err && addrs?.length) { | |
| if (opts.all) { | |
| return cb( | |
| null, | |
| addrs.map((a) => ({ address: a, family: 4 })), | |
| ); | |
| } | |
| return cb(null, addrs[0], 4); | |
| } | |
| origLookup(hostname, opts, cb); | |
| }); | |
| }; | |