@db3.ai/app 0.1.0-beta.1 → 0.1.0-beta.4

package/src/media/MediaManager.ts

@@ -1,6 +1,6 @@
 import type { Readable } from 'node:stream';
 
-import { mimeTypeFromPath } from '../storage/mime';
+import { mimeTypeFromPath } from '../storage/mimeTypeFromPath';
 import { normalizeStoragePath } from '../storage/path';
 import type { Storage, StorageContents, StorageDisk, StorageVisibility } from '../storage';
 import { MEDIA_FILE_VISIBILITY, MEDIA_ITEM_TYPE, MEDIA_LIBRARY_DEFAULT_KEY } from './constants';
@@ -56,6 +56,7 @@ export class MediaManager {
 
 	/**
 	 * Finds or creates the media library for an application-owned scope.
+	 * Concurrent creators reuse the winning row without overwriting its defaults.
 	 *
 	 * @param input - Scope identity and defaults for a new library.
 	 * @returns Existing or newly-created media library.
@@ -92,9 +93,15 @@ export class MediaManager {
 			meta: input.meta ?? null,
 		});
 
-		await library.save();
-
-		return library;
+		try {
+			await library.save();
+			return library;
+		} catch (error) {
+			if (!isUniqueConstraintError(error) && !isRetriableTransactionConflict(error)) throw error;
+			const raced = await MediaLibrary.where({ scopeType, scopeId, key }).first();
+			if (!raced) throw error;
+			return raced;
+		}
 	}
 
 	/**
@@ -223,7 +230,7 @@ export class MediaManager {
 	}
 
 	/**
-	 * Finds or creates the root browser item for a library.
+	 * Finds or creates the root browser item for a library, including concurrent writers.
 	 *
 	 * @param libraryOrId - Media library row or id.
 	 * @returns Root browser item for the library.
@@ -248,13 +255,20 @@ export class MediaManager {
 			meta: null,
 		});
 
-		await root.save();
-
-		return root;
+		try {
+			await root.save();
+			return root;
+		} catch (error) {
+			if (!isUniqueConstraintError(error) && !isRetriableTransactionConflict(error)) throw error;
+			const raced = await MediaItem.where({ library, path: '/', type: MEDIA_ITEM_TYPE.root }).first();
+			if (!raced) throw error;
+			return raced;
+		}
 	}
 
 	/**
-	 * Finds or creates a slash-prefixed browser folder path.
+	 * Finds or creates a slash-prefixed browser folder path. Concurrent creators
+	 * reuse the winning directory without replacing its metadata.
 	 *
 	 * @param input - Library and folder path to ensure.
 	 * @returns Folder item for the requested path, or the root for `/`.
@@ -300,7 +314,14 @@ export class MediaManager {
 					path: currentPath,
 					meta: currentPath === path ? input.meta ?? null : null,
 				});
-				await folder.save();
+				try {
+					await folder.save();
+				} catch (error) {
+					if (!isUniqueConstraintError(error) && !isRetriableTransactionConflict(error)) throw error;
+					const raced = await MediaItem.where({ library, path: currentPath, type: MEDIA_ITEM_TYPE.directory }).first();
+					if (!raced) throw error;
+					folder = raced;
+				}
 			}
 
 			parent = folder;

package/src/media/README.md

@@ -51,6 +51,10 @@ This lets one app start with one default library per scope, while still allowing
 future libraries such as `generated-images`, `reference-material`, or
 `brand-assets` when they need separate configuration or workflows.
 
+Concurrent first uploads reuse the same scoped library, root and directory
+rows when another writer wins creation. Existing defaults and folder metadata
+are preserved. Other database errors still propagate to the caller.
+
 ## Managed Files Without Browser Items
 
 Use `storeFile()` when a file should be managed, loaded by ULID, and scoped to a

package/src/media/examples/runPrivateFiles.ts

@@ -2,7 +2,7 @@ import { mkdtemp, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { AuthProvider, AuthToken, PasswordResetToken, UserIdentity } from '@db3.ai/app/auth';
+import { AuthProvider, PasswordLoginAttempt, AuthToken, PasswordResetToken, UserIdentity } from '@db3.ai/app/auth';
 import { createGeneratedTestDatabase } from '@db3.ai/app/db/test/db';
 import { MediaFile, MediaItem, MediaLibrary } from '@db3.ai/app/media';
 import { App } from '@db3.ai/app/server';
@@ -16,7 +16,7 @@ export async function runPrivateFiles() {
 		const application = new App({ db: database.db, config: { auth: { providers: { password: true } } }, storage: { disks: { local: { driver: 'local', root } } } });
 		const server = createPrivateFileServer(application);
 		try {
-			await application.db.install(UserIdentity, AuthProvider, AuthToken, PasswordResetToken, MediaLibrary, MediaFile, MediaItem);
+			await application.db.install(UserIdentity, AuthProvider, PasswordLoginAttempt, AuthToken, PasswordResetToken, MediaLibrary, MediaFile, MediaItem);
 			const ada = await application.auth.registerWithPassword({ name: 'Ada', email: 'ada@example.test', password: 'example-password-123' });
 			const grace = await application.auth.registerWithPassword({ name: 'Grace', email: 'grace@example.test', password: 'example-password-456' });
 			const headers = { authorization: `Bearer ${ada.token}`, 'content-type': 'text/plain' };

package/src/network/BlockedUrlError.ts

@@ -0,0 +1,19 @@
+/**
+ * Raised when an outbound request targets a URL the network guard refuses.
+ *
+ * The message is safe to show to the user who supplied the URL: it names the
+ * rule that failed without revealing resolved internal addresses. Callers
+ * typically catch it to turn a blocked crawl, webhook or preview into a
+ * validation error instead of a server failure.
+ */
+export class BlockedUrlError extends Error {
+	/**
+	 * Creates a blocked-URL error with a public explanation.
+	 *
+	 * @param message - Caller-safe reason the URL was refused.
+	 */
+	constructor(message = 'This URL is not allowed.') {
+		super(message);
+		this.name = 'BlockedUrlError';
+	}
+}

package/src/network/README.md

@@ -0,0 +1,133 @@
+# Network
+
+The network service protects outbound requests whose destination comes from a
+user, a crawled page or a redirect. It stops those requests from reaching the
+server's own network: loopback, private ranges, link-local cloud metadata
+endpoints, and other reserved addresses.
+
+Use it whenever an application fetches a URL it did not choose itself, such as
+webhook deliveries, link previews, crawlers, feed imports or screenshot tools.
+Requests to fixed, trusted provider APIs do not need it.
+
+## Fetch a user-supplied URL
+
+```ts
+import { BlockedUrlError, guardedFetch } from '@db3.ai/app/network';
+
+try {
+	const { response, finalUrl } = await guardedFetch(input.url, {
+		init: { headers: { accept: 'text/html' }, signal: AbortSignal.timeout(10_000) },
+	});
+	// Use response and finalUrl as with fetch.
+} catch (error) {
+	if (error instanceof BlockedUrlError) {
+		// error.message is safe to show to the user who supplied the URL.
+	}
+	throw error;
+}
+```
+
+`guardedFetch` returns a normal `Response`. It:
+
+- validates the URL and every redirect target before requesting it;
+- checks the address DNS returns **when the socket connects**, so a hostname
+  cannot pass validation and then resolve to a private address (DNS rebinding);
+- follows redirects like `fetch`: `303`, and `301`/`302` after `POST`, switch
+  to `GET` without a body, and `Authorization`/`Cookie` headers are removed
+  when a redirect leaves the original origin;
+- stops after `maxRedirects` (default 4), or returns the first redirect
+  unfollowed with `redirect: 'manual'`.
+
+It sends requests with the runtime's global `fetch`, so tests that replace
+`globalThis.fetch` keep working.
+
+## Local development
+
+Pass `allowPrivate: true` to reach private hosts, for example a webhook
+receiver on `http://localhost:8100`. TLS certificate verification remains enabled
+for every HTTPS destination. Configure a trusted local CA for development HTTPS;
+allowing a private address does not authorize an unverified server certificate.
+Decide address policy in application configuration (for example only when
+`NODE_ENV=development`) and never from request input.
+
+## Other HTTP clients
+
+- `assertPublicUrl(url, options)` performs the pre-flight check and throws
+  `BlockedUrlError`. Call it for the first URL and for every redirect target.
+- `publicAddressLookup` has the signature of `dns.lookup`. Pass it as the
+  `lookup` socket option (Node `http`/`https`, undici `connect.lookup`, got
+  `dnsLookup`) so the connected address is checked. Node does not call `lookup`
+  for IP-literal hosts, which is why redirect targets also need
+  `assertPublicUrl`.
+- `isPrivateIpAddress`, `isPrivateHostname` and `normalizedUrlHostname` expose
+  the address policy for custom checks.
+
+## Headless browsers
+
+Browsers make their own requests for redirects, frames, scripts and images.
+The optional `@db3.ai/app/network/playwright` entry point requires Playwright
+and Chromium. It gives each context an authenticated loopback proxy that checks
+every HTTP destination and HTTPS CONNECT tunnel, including connect-time DNS.
+Chromium's implicit loopback bypass is disabled. Callers cannot override the proxy.
+
+```ts
+import { chromium } from 'playwright';
+import { newGuardedBrowserContext } from '@db3.ai/app/network/playwright';
+
+const browser = await chromium.launch({
+	args: ['--force-webrtc-ip-handling-policy', '--webrtc-ip-handling-policy=disable_non_proxied_udp'],
+});
+try {
+	const context = await newGuardedBrowserContext(browser, {}, {
+		blockedResourceTypes: ['font', 'media'],
+		onBlocked: ({ url }) => console.warn('Blocked', url),
+	});
+	try {
+		const page = await context.newPage();
+		await page.goto(input.url);
+		const screenshot = await page.screenshot();
+	} finally {
+		await context.close();
+	}
+} finally {
+	await browser.close();
+}
+```
+
+Redirects, cookie storage, origins and TLS certificate verification stay native to
+Chromium. The proxy streams HTTP bodies without collecting them in memory and
+handles interrupted streams as ordinary network failures. `requestTimeoutMs`
+sets socket inactivity timeout (30 seconds by default). Closing a context closes
+its listener and all in-flight proxy sockets. Setup failures also clean up.
+
+Service workers and WebSockets are disabled. WebRTC is not HTTP traffic, which is
+why the Chromium launch flags above remain necessary for untrusted pages.
+`allowPrivate` permits local destinations but does not disable Chromium TLS
+verification; explicit `ignoreHTTPSErrors` is a separate browser option. Run these
+workers behind a network egress policy as an additional infrastructure boundary.
+
+## Address policy
+
+Blocked destinations include `localhost` names, `0.0.0.0/8`, `10.0.0.0/8`,
+`100.64.0.0/10`, `127.0.0.0/8`, `169.254.0.0/16`, `172.16.0.0/12`,
+`192.0.0.0/24`, `192.0.2.0/24`, `192.88.99.0/24`, `192.168.0.0/16`,
+`198.18.0.0/15`, `198.51.100.0/24`, `203.0.113.0/24`, `224.0.0.0` and above,
+IPv6 loopback, unique-local, link-local, site-local, multicast, documentation,
+Teredo and discard ranges, and IPv4-compatible addresses. IPv4-mapped, NAT64
+(`64:ff9b::/96`) and 6to4 (`2002::/16`) addresses are judged by the IPv4 address
+they embed.
+
+## Run the example
+
+```sh
+npx tsx node_modules/@db3.ai/app/src/network/examples/runGuardedFetch.ts
+```
+
+Expect `privateBlockedByDefault` and `privateAllowedWhenRequested` to be true.
+
+## Dependencies
+
+Uses `undici` 7 for the connection dispatcher, which is compatible with the
+global `fetch` bundled with supported Node versions. The Playwright entry point
+depends on the optional `playwright` peer dependency. The service has no
+framework service dependencies.

package/src/network/assertPublicUrl.ts

@@ -0,0 +1,77 @@
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+import { BlockedUrlError } from './BlockedUrlError';
+import { isPrivateHostname, isPrivateIpAddress, normalizedUrlHostname } from './privateNetworkAddresses';
+import type * as network from './contracts';
+
+/**
+ * Validates that a URL is an HTTP(S) address on the public internet.
+ *
+ * This is a pre-flight check that gives users a clear error before any
+ * connection is attempted. It is not sufficient on its own: DNS can return a
+ * different address when the request connects (DNS rebinding). Send requests
+ * through {@link guardedFetch}, or pass {@link publicAddressLookup} to the HTTP
+ * client, so the connected address is checked as well.
+ *
+ * @param rawUrl - Absolute URL supplied by a user, crawler or redirect.
+ * @param options - Destination policy; private hosts are refused by default.
+ * @throws {BlockedUrlError} When the URL is malformed, not HTTP(S), or reaches
+ * a private, local or reserved address.
+ *
+ * @example
+ * await assertPublicUrl('https://example.com/feed.xml');
+ * await assertPublicUrl('http://169.254.169.254/'); // throws BlockedUrlError
+ */
+export async function assertPublicUrl(rawUrl: string, options: network.PublicUrlOptions = {}): Promise<void> {
+	const hostname = publicUrlHostname(rawUrl, options);
+
+	if (hostname === null || isIP(hostname)) return;
+
+	let addresses: Array<{ address: string }>;
+
+	try {
+		addresses = await lookup(hostname, { all: true, verbatim: true });
+	} catch {
+		throw new BlockedUrlError('Unable to resolve the URL hostname.');
+	}
+
+	if (addresses.length === 0 || addresses.some(entry => isPrivateIpAddress(entry.address))) {
+		throw new BlockedUrlError(PRIVATE_DESTINATION_MESSAGE);
+	}
+}
+
+/** Public explanation used for every private, local or reserved destination. */
+export const PRIVATE_DESTINATION_MESSAGE = 'Private, local, or reserved URLs are not allowed.';
+
+/**
+ * Performs the synchronous part of URL validation.
+ *
+ * @param rawUrl - Absolute URL to validate.
+ * @param options - Destination policy.
+ * @returns Normalized hostname still requiring DNS validation, or null when no
+ * further checks are needed because private destinations are allowed.
+ * @throws {BlockedUrlError} When the URL fails a synchronous rule.
+ */
+function publicUrlHostname(rawUrl: string, options: network.PublicUrlOptions): string | null {
+	let parsed: URL;
+
+	try {
+		parsed = new URL(rawUrl);
+	} catch {
+		throw new BlockedUrlError('The URL is not valid.');
+	}
+
+	if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+		throw new BlockedUrlError('Only http and https URLs are allowed.');
+	}
+
+	if (options.allowPrivate) return null;
+
+	const hostname = normalizedUrlHostname(parsed.hostname);
+
+	if (isPrivateHostname(hostname) || (isIP(hostname) && isPrivateIpAddress(hostname))) {
+		throw new BlockedUrlError(PRIVATE_DESTINATION_MESSAGE);
+	}
+
+	return hostname;
+}

package/src/network/contracts/GuardedFetch.ts

@@ -0,0 +1,40 @@
+import type { PublicUrlOptions } from './PublicUrlOptions';
+
+/**
+ * Options for one guarded outbound HTTP request.
+ *
+ * `init` is passed to `fetch` unchanged except that redirects are always
+ * handled by the guard and the connection dispatcher is always replaced with
+ * one that re-validates the addresses DNS returns at connect time.
+ */
+export interface GuardedFetchOptions extends PublicUrlOptions {
+	/** Standard fetch options such as method, headers, body and abort signal. */
+	init?: RequestInit;
+
+	/**
+	 * Maximum redirects followed before the request fails with `BlockedUrlError`.
+	 *
+	 * Every redirect target is validated as a new destination. Defaults to 4.
+	 */
+	maxRedirects?: number;
+
+	/**
+	 * How redirects are handled.
+	 *
+	 * `follow` (default) validates and follows each hop. `manual` returns the
+	 * first 3xx response unchanged so a caller such as a browser can follow it
+	 * through its own guarded request path.
+	 */
+	redirect?: 'follow' | 'manual';
+}
+
+/**
+ * Response returned by a guarded outbound request.
+ */
+export interface GuardedFetchResult {
+	/** Final response after any followed redirects. */
+	response: Response;
+
+	/** Absolute URL that produced `response`, after followed redirects. */
+	finalUrl: string;
+}

package/src/network/contracts/PublicUrlOptions.ts

@@ -0,0 +1,17 @@
+/**
+ * Destination policy shared by every outbound network guard.
+ *
+ * Applications decide the policy (for example from their environment) and pass
+ * it to each guarded operation. The guard itself never reads environment
+ * variables, so a request handler cannot widen the policy through input.
+ */
+export interface PublicUrlOptions {
+	/**
+	 * Allows private, loopback and reserved destinations.
+	 *
+	 * Intended for interactive local development, where integrations are often
+	 * tested against `localhost` receivers. Production code should leave this
+	 * unset so user-supplied URLs can only reach public internet hosts.
+	 */
+	allowPrivate?: boolean;
+}

package/src/network/contracts/index.ts

@@ -0,0 +1,2 @@
+export * from './GuardedFetch';
+export * from './PublicUrlOptions';

package/src/network/examples/runGuardedFetch.ts

@@ -0,0 +1,35 @@
+import { createServer } from 'node:http';
+import { pathToFileURL } from 'node:url';
+import { BlockedUrlError, guardedFetch } from '@db3.ai/app/network';
+
+/**
+ * Requests a local receiver with and without private-network access.
+ *
+ * A user-supplied URL pointing at the machine itself is refused by default,
+ * and reachable only when the caller explicitly allows private destinations,
+ * as a local development workflow would.
+ *
+ * @returns Whether the default policy blocked the request and the opted-in request succeeded.
+ */
+export async function runGuardedFetch() {
+	const server = createServer((_request, response) => response.end('local receiver'));
+
+	await new Promise<void>(resolve => server.listen(0, '127.0.0.1', resolve));
+
+	const address = server.address();
+	const url = `http://127.0.0.1:${typeof address === 'object' && address ? address.port : 0}/`;
+
+	try {
+		const blocked = await guardedFetch(url).then(() => false, error => error instanceof BlockedUrlError);
+		const { response } = await guardedFetch(url, { allowPrivate: true });
+
+		return {
+			privateBlockedByDefault: blocked,
+			privateAllowedWhenRequested: await response.text() === 'local receiver',
+		};
+	} finally {
+		await new Promise<void>(resolve => server.close(() => resolve()));
+	}
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) console.log(JSON.stringify(await runGuardedFetch(), null, 2));

package/src/network/guardedFetch.ts

@@ -0,0 +1,150 @@
+import { Agent, type Dispatcher } from 'undici';
+import { BlockedUrlError } from './BlockedUrlError';
+import { assertPublicUrl } from './assertPublicUrl';
+import { publicAddressLookup } from './publicAddressLookup';
+import type * as network from './contracts';
+
+const DEFAULT_MAX_REDIRECTS = 4;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+const CROSS_ORIGIN_SENSITIVE_HEADERS = ['authorization', 'cookie', 'proxy-authorization'];
+
+let publicDispatcher: Dispatcher | undefined;
+let privateDispatcher: Dispatcher | undefined;
+
+/**
+ * Fetches a user-supplied URL without allowing it to reach private networks.
+ *
+ * Each hop is validated before it is requested, and the connection itself uses
+ * {@link publicAddressLookup}, so the address DNS returns at connect time is
+ * the address that was checked. Redirects are followed manually: every target
+ * is validated, `303` (and `301`/`302` after `POST`) switch to `GET` without a
+ * body as `fetch` does, and credentials (`Authorization`, `Cookie`) are removed
+ * when a redirect leaves the original origin.
+ *
+ * `allowPrivate` permits private destinations without weakening TLS certificate
+ * verification. Local HTTPS receivers must present a certificate trusted by Node.
+ *
+ * The request is sent with the runtime's global `fetch`, so test doubles that
+ * replace `globalThis.fetch` continue to work.
+ *
+ * @param rawUrl - Absolute HTTP(S) URL to request.
+ * @param options - Fetch init, redirect handling and destination policy.
+ * @returns Final response and the URL that produced it.
+ * @throws {BlockedUrlError} When any hop targets a refused destination or the
+ * redirect limit is exceeded.
+ *
+ * @example
+ * const { response, finalUrl } = await guardedFetch('https://example.com/', {
+ * 	init: { headers: { accept: 'text/html' }, signal: AbortSignal.timeout(10_000) },
+ * });
+ */
+export async function guardedFetch(rawUrl: string, options: network.GuardedFetchOptions = {}): Promise<network.GuardedFetchResult> {
+	const maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
+	let current = rawUrl;
+	let init: RequestInit = { ...options.init };
+
+	for (let hop = 0; ; hop++) {
+		await assertPublicUrl(current, options);
+
+		const response = await fetchHop(current, init, options.allowPrivate === true);
+		const location = response.headers.get('location');
+
+		if (!REDIRECT_STATUSES.has(response.status) || !location || options.redirect === 'manual') {
+			return { response, finalUrl: current };
+		}
+
+		await response.body?.cancel();
+
+		if (hop >= maxRedirects) throw new BlockedUrlError('Too many redirects.');
+
+		const next = new URL(location, current).toString();
+
+		init = redirectInit(init, response.status, new URL(current).origin !== new URL(next).origin);
+		current = next;
+	}
+}
+
+/**
+ * Sends one request hop through the dispatcher matching the destination policy.
+ *
+ * @param url - Already validated hop URL.
+ * @param init - Fetch options for this hop.
+ * @param allowPrivate - Whether private destinations are allowed.
+ * @returns Unfollowed hop response.
+ * @throws {BlockedUrlError} When the connect-time lookup refuses the address.
+ */
+async function fetchHop(url: string, init: RequestInit, allowPrivate: boolean): Promise<Response> {
+	try {
+		// The caller checks each URL/redirect; this dispatcher validates the actual
+		// socket address, including DNS changes between validation and connection.
+		return await fetch(url, {
+			...init,
+			redirect: 'manual',
+			dispatcher: hopDispatcher(allowPrivate),
+		} as RequestInit);
+	} catch (error) {
+		throw blockedCause(error) ?? error;
+	}
+}
+
+/**
+ * Chooses the connection dispatcher for one hop.
+ *
+ * @param allowPrivate - Whether private destinations are allowed.
+ * @returns Shared dispatcher for the hop's policy.
+ */
+function hopDispatcher(allowPrivate: boolean): Dispatcher {
+	if (!allowPrivate) {
+		return publicDispatcher ??= new Agent({ connect: { lookup: publicAddressLookup, rejectUnauthorized: true } });
+	}
+
+	return privateDispatcher ??= new Agent({ connect: { rejectUnauthorized: true } });
+}
+
+/**
+ * Builds the fetch options for the next redirect hop.
+ *
+ * @param init - Options used for the previous hop.
+ * @param status - Redirect status code.
+ * @param crossOrigin - Whether the redirect leaves the previous origin.
+ * @returns Options for the next hop.
+ */
+function redirectInit(init: RequestInit, status: number, crossOrigin: boolean): RequestInit {
+	const method = (init.method ?? 'GET').toUpperCase();
+	const switchesToGet = status === 303
+		? method !== 'GET' && method !== 'HEAD'
+		: (status === 301 || status === 302) && method === 'POST';
+	const headers = new Headers(init.headers);
+
+	if (switchesToGet) {
+		headers.delete('content-type');
+		headers.delete('content-length');
+	}
+
+	if (crossOrigin) {
+		for (const name of CROSS_ORIGIN_SENSITIVE_HEADERS) headers.delete(name);
+	}
+
+	return {
+		...init,
+		headers,
+		...(switchesToGet ? { method: 'GET', body: undefined } : {}),
+	};
+}
+
+/**
+ * Finds a guard rejection wrapped inside a fetch network error.
+ *
+ * @param error - Error thrown by `fetch`.
+ * @returns The wrapped `BlockedUrlError`, or null.
+ */
+function blockedCause(error: unknown): BlockedUrlError | null {
+	let current: unknown = error;
+
+	for (let depth = 0; depth < 5 && current; depth++) {
+		if (current instanceof BlockedUrlError) return current;
+		current = (current as { cause?: unknown }).cause;
+	}
+
+	return null;
+}

package/src/network/index.ts

@@ -0,0 +1,6 @@
+export * from './contracts';
+export * from './BlockedUrlError';
+export { assertPublicUrl } from './assertPublicUrl';
+export * from './guardedFetch';
+export * from './privateNetworkAddresses';
+export * from './publicAddressLookup';