feat: guardedFetch + sameSitePolicy — runtime-agnostic guarded fetch

[jlc488]

What

The Workers pattern the README told consumers to hand-roll (#9) now ships as API — AskLinq's URL ingestion was the first consumer to write that loop by hand, which was the signal it belongs in the package.

guardedFetch(input, policy, init?)

URL-time validation + the same redirect semantics as safeFetch — every hop re-passes the policy before it is followed, credentials stripped on cross-origin redirects, 303/301/302-POST downgrade to GET without body replay — minus DNS resolution and pinning. Works on Cloudflare Workers, browsers, and edge runtimes. fetchImpl is injectable for tests/instrumentation.

The policy allowlist is the primary control: the fail-closed default (empty allowlist allows nothing) does real work here. Opening a specific host = putting it in the allowlist — the bypass mechanism stays in the policy, auditable in one place.

sameSitePolicy(url, overrides?)

Derives the allowlist from a submitted URL: the whole fetch, redirects included, locks to that domain (www. stripped so apex ↔ www redirects survive; subdomains reachable). Overrides merge additively, so extra hosts can be allowlisted alongside.

Refactor

• The redirect-revalidation loop moved verbatim from safeFetch into redirect.ts (zero Node imports); both fetchers share it. safeFetch layers its DNS hooks on top (unpinned per-hop check / pinned undici connector / guard-error unwrap).
• node:dns is now lazily imported — loading the package no longer requires a functional dns module; calling safeFetch without one throws a typed SsrfGuardError pointing to guardedFetch.

Docs

README (en + ko): Workers section now shows guardedFetch/sameSitePolicy instead of the DIY loop; support matrix gains the new row. CHANGELOG gets an Unreleased section.

Verification

• tsc --noEmit clean, build clean
• 136/136 tests — 12 new (fail-closed empty allowlist, redirect escape blocked without fetching the target, credential stripping, 303 downgrade, maxRedirects, sameSitePolicy derivation/merging/typed errors); the untouched safe-fetch suites (18 unpinned + 5 pinned) pass unchanged against the shared loop

After release

AskLinq's ingest/url.ts swaps its hand-rolled guardedFetchPage loop for guardedFetch + sameSitePolicy.