@opengeni/network 0.1.1 → 0.2.0

package/README.md

@@ -26,12 +26,13 @@ calling `pinnedFetch`; the policy resolution and pinned Agent are the final
 network boundary. Callers must not preflight with one fetch and then call a
 second global fetch.
 
-The package uses Undici's fetch implementation from its explicit
-`undici/index.js` entrypoint for production callers. Bun's bare `undici`
-specifier resolves to a compatibility shim whose `Agent` does not expose the
-dispatcher methods needed by `fetch`, and Bun's native `fetch` does not provide a
-portable guarantee that an Undici `dispatcher` is honored. Bun callers should use
-the exported transport (or the explicit Undici entrypoint) rather than
-substituting Bun's native fetch after the guard. This package does not follow
-redirects; each caller must make a manual redirect decision and call the transport
-again so every hop is independently resolved and pinned.
+The pinned transport uses Undici's `request()` implementation from its explicit
+`undici/index.js` entrypoint and adapts the result to a web `Response`. This
+avoids Bun/Undici `fetch()` body-stream interoperability stalls while preserving
+the vetted per-request `Agent`. The separately exported `undiciFetch` remains a
+fetch-compatible adapter for callers that do not use `pinnedFetch`. Bun's bare
+`undici` specifier resolves to a compatibility shim whose `Agent` does not expose
+the required dispatcher methods, and Bun's native `fetch` does not provide a
+portable guarantee that an Undici `dispatcher` is honored. This package does not
+follow redirects; each caller must make a manual redirect decision and call the
+transport again so every hop is independently resolved and pinned.

package/dist/index.d.ts

@@ -1,50 +1,58 @@
-type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-type DnsAddress = {
+export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+export type DnsAddress = {
     address: string;
     family: 4 | 6;
 };
-type DnsLookup = (hostname: string) => Promise<readonly DnsAddress[]>;
-type OutboundNetworkSettings = {
+export type DnsLookup = (hostname: string) => Promise<readonly DnsAddress[]>;
+export type OutboundNetworkSettings = {
     environment: string;
     integrationsAllowPrivateNetworkTargets: boolean;
 };
-type PinnedDestination = {
+export type PinnedDestination = {
     url: URL;
     hostname: string;
     addresses: readonly DnsAddress[];
 };
-type DispatcherLifecycle = {
+export type DispatcherLifecycle = {
     /** The raw dispatcher handed to fetch; omitted for test-only lifecycle fakes. */
     dispatcher?: unknown;
     close: () => Promise<void> | void;
     destroy: (error?: unknown) => Promise<void> | void;
 };
-type PinnedFetchOptions = {
+export type PinnedFetchOptions = {
     fetchImpl?: FetchLike;
     dnsLookup?: DnsLookup;
     agentFactory?: (addresses: readonly DnsAddress[]) => DispatcherLifecycle;
     label?: string;
     requireHttpsOutsideLocalTest?: boolean;
 };
-declare const OAUTH_MAX_RESPONSE_BYTES: number;
-type HttpUrlValidationOptions = {
+export declare const OAUTH_MAX_RESPONSE_BYTES: number;
+export type HttpUrlValidationOptions = {
     allowLoopbackHttp?: boolean;
     label?: string;
 };
 /** Validate a protocol endpoint before it is persisted, returned, or opened. */
-declare function validateHttpUrl(rawUrl: string, options?: HttpUrlValidationOptions): string;
+export declare function validateHttpUrl(rawUrl: string, options?: HttpUrlValidationOptions): string;
 /**
  * Raised when a response cannot be safely consumed within its caller's byte
  * budget. The error intentionally contains no response bytes or provider
  * message: these readers are used on credential-bearing paths.
  */
-declare class ResponseBodyLimitError extends Error {
+export declare class ResponseBodyLimitError extends Error {
     readonly label: string;
     readonly actualBytes: number;
     readonly maxBytes: number;
     readonly reason: "declared_length" | "stream_overflow" | "invalid_content_length";
     constructor(label: string, actualBytes: number, maxBytes: number, reason: "declared_length" | "stream_overflow" | "invalid_content_length");
 }
+/** Raised when a caller-supplied absolute request deadline expires. */
+export declare class RequestDeadlineError extends Error {
+    readonly label: string;
+    constructor(label: string);
+}
+export type BoundedResponseReadOptions = {
+    signal?: AbortSignal;
+};
 /**
  * Read a response through its stream with a hard byte ceiling.
  *
@@ -53,42 +61,40 @@ declare class ResponseBodyLimitError extends Error {
  * the stream and rejects. Cancellation is important because pinnedFetch owns a
  * per-response dispatcher which must be closed on every exit path.
  */
-declare function readResponseBodyBounded(response: Response, maxBytes: number, label: string): Promise<Uint8Array>;
-declare function readResponseTextBounded(response: Response, maxBytes: number, label: string): Promise<string>;
-declare function readResponseJsonBounded<T = unknown>(response: Response, maxBytes: number, label: string): Promise<T>;
-type ResolvePinnedDestinationOptions = {
+export declare function readResponseBodyBounded(response: Response, maxBytes: number, label: string, options?: BoundedResponseReadOptions): Promise<Uint8Array>;
+export declare function readResponseTextBounded(response: Response, maxBytes: number, label: string, options?: BoundedResponseReadOptions): Promise<string>;
+export declare function readResponseJsonBounded<T = unknown>(response: Response, maxBytes: number, label: string, options?: BoundedResponseReadOptions): Promise<T>;
+export type ResolvePinnedDestinationOptions = {
     dnsLookup?: DnsLookup;
     label?: string;
     requireHttpsOutsideLocalTest?: boolean;
 };
-type DestinationPolicyReason = "invalid_url" | "unsupported_protocol" | "https_required" | "dns_failed" | "dns_empty" | "invalid_dns_answer" | "private_or_special_use";
-declare class DestinationPolicyError extends Error {
+export type DestinationPolicyReason = "invalid_url" | "unsupported_protocol" | "https_required" | "dns_failed" | "dns_empty" | "invalid_dns_answer" | "private_or_special_use";
+export declare class DestinationPolicyError extends Error {
     readonly reason: DestinationPolicyReason;
     constructor(reason: DestinationPolicyReason, message: string);
 }
 /** Undici fetch used by the pinned transport; Bun callers should prefer this over native fetch. */
-declare const undiciFetch: FetchLike;
+export declare const undiciFetch: FetchLike;
 /**
  * Resolve and policy-check one destination. The returned address set is the
  * complete DNS answer that the caller is allowed to use; the transport never
  * performs a second resolver call.
  */
-declare function resolvePinnedDestination(rawUrl: string | URL, settings: OutboundNetworkSettings, options?: ResolvePinnedDestinationOptions): Promise<PinnedDestination>;
+export declare function resolvePinnedDestination(rawUrl: string | URL, settings: OutboundNetworkSettings, options?: ResolvePinnedDestinationOptions): Promise<PinnedDestination>;
 /**
  * Fetch through a dispatcher whose lookup is pinned to the result of exactly
- * one policy resolution. The response body owns the agent until completion,
- * cancellation, or stream failure.
+ * one policy resolution. The response body owns the one-shot agent until
+ * completion, cancellation, or stream failure.
  */
-declare function pinnedFetch(input: string | URL | Request, init: RequestInit | undefined, settings: OutboundNetworkSettings, options?: PinnedFetchOptions): Promise<Response>;
-declare function isLocalTestEnvironment(environment: string): boolean;
+export declare function pinnedFetch(input: string | URL | Request, init: RequestInit | undefined, settings: OutboundNetworkSettings, options?: PinnedFetchOptions): Promise<Response>;
+export declare function isLocalTestEnvironment(environment: string): boolean;
 /** Return true for malformed, non-IPv4, and non-IPv6 address strings. */
-declare function isInvalidAddress(address: string): boolean;
+export declare function isInvalidAddress(address: string): boolean;
 /**
  * Classify private, reserved, documentation, benchmark, multicast, and other
  * special-use answers. IPv4-mapped IPv6 addresses are classified through their
  * embedded IPv4 value.
  */
-declare function isNonPublicAddress(address: string): boolean;
-declare const isPrivateAddress: typeof isNonPublicAddress;
-
-export { DestinationPolicyError, type DestinationPolicyReason, type DispatcherLifecycle, type DnsAddress, type DnsLookup, type FetchLike, type HttpUrlValidationOptions, OAUTH_MAX_RESPONSE_BYTES, type OutboundNetworkSettings, type PinnedDestination, type PinnedFetchOptions, type ResolvePinnedDestinationOptions, ResponseBodyLimitError, isInvalidAddress, isLocalTestEnvironment, isNonPublicAddress, isPrivateAddress, pinnedFetch, readResponseBodyBounded, readResponseJsonBounded, readResponseTextBounded, resolvePinnedDestination, undiciFetch, validateHttpUrl };
+export declare function isNonPublicAddress(address: string): boolean;
+export declare const isPrivateAddress: typeof isNonPublicAddress;

package/dist/index.js

@@ -1,7 +1,8 @@
 // src/index.ts
-import { Agent, fetch as undiciFetchImpl } from "undici/index.js";
+import { Agent, fetch as undiciFetchImpl, request as undiciRequestImpl } from "undici/index.js";
 import { lookup as nodeLookup } from "dns/promises";
 import { isIP } from "net";
+var DISPATCHER_CLOSE_TIMEOUT_MS = 100;
 var OAUTH_MAX_RESPONSE_BYTES = 1024 * 1024;
 function validateHttpUrl(rawUrl, options = {}) {
   const label = options.label ?? "HTTP endpoint";
@@ -38,7 +39,14 @@ var ResponseBodyLimitError = class extends Error {
     this.name = "ResponseBodyLimitError";
   }
 };
-async function readResponseBodyBounded(response, maxBytes, label) {
+var RequestDeadlineError = class extends Error {
+  constructor(label) {
+    super(`${label} timed out`);
+    this.label = label;
+    this.name = "RequestDeadlineError";
+  }
+};
+async function readResponseBodyBounded(response, maxBytes, label, options = {}) {
   if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) {
     throw new RangeError("response body limit must be a non-negative safe integer");
   }
@@ -63,7 +71,7 @@ async function readResponseBodyBounded(response, maxBytes, label) {
   let receivedBytes = 0;
   try {
     for (; ; ) {
-      const result = await reader.read();
+      const result = await readStreamChunk(reader, options.signal, label);
       if (result.done) {
         break;
       }
@@ -75,10 +83,13 @@ async function readResponseBodyBounded(response, maxBytes, label) {
       chunks.push(result.value);
     }
   } catch (error) {
-    await reader.cancel().catch(() => void 0);
+    void reader.cancel(error).catch(() => void 0);
     throw error;
   } finally {
-    reader.releaseLock();
+    try {
+      reader.releaseLock();
+    } catch {
+    }
   }
   const body = new Uint8Array(receivedBytes);
   let offset = 0;
@@ -88,11 +99,36 @@ async function readResponseBodyBounded(response, maxBytes, label) {
   }
   return body;
 }
-async function readResponseTextBounded(response, maxBytes, label) {
-  return new TextDecoder().decode(await readResponseBodyBounded(response, maxBytes, label));
+async function readResponseTextBounded(response, maxBytes, label, options = {}) {
+  return new TextDecoder().decode(
+    await readResponseBodyBounded(response, maxBytes, label, options)
+  );
 }
-async function readResponseJsonBounded(response, maxBytes, label) {
-  return JSON.parse(await readResponseTextBounded(response, maxBytes, label));
+async function readResponseJsonBounded(response, maxBytes, label, options = {}) {
+  return JSON.parse(await readResponseTextBounded(response, maxBytes, label, options));
+}
+async function readStreamChunk(reader, signal, label) {
+  if (!signal) return await reader.read();
+  if (signal.aborted) throw new RequestDeadlineError(label);
+  return await new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (callback) => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener("abort", onAbort);
+      callback();
+    };
+    const onAbort = () => {
+      const error = new RequestDeadlineError(label);
+      void reader.cancel(error).catch(() => void 0);
+      finish(() => reject(error));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    void reader.read().then(
+      (result) => finish(() => resolve(result)),
+      (error) => finish(() => reject(error))
+    );
+  });
 }
 var DestinationPolicyError = class extends Error {
   constructor(reason, message) {
@@ -106,6 +142,79 @@ var defaultDnsLookup = async (hostname) => {
   return answers.map((entry) => normalizeDnsAnswer(entry));
 };
 var defaultFetch = (input, init) => undiciFetchImpl(input, init);
+var pinnedRequestFetch = async (input, init) => {
+  const source = input instanceof Request ? input : null;
+  const url = source?.url ?? input.toString();
+  const method = init?.method ?? source?.method ?? "GET";
+  const headers = new Headers(source?.headers);
+  if (init?.headers) {
+    new Headers(init.headers).forEach((value, name) => headers.set(name, value));
+  }
+  if (!headers.has("accept-encoding")) headers.set("accept-encoding", "identity");
+  const rawBody = init?.body ?? (method !== "GET" && method !== "HEAD" ? source?.body : void 0);
+  const body = await normalizeUndiciRequestBody(rawBody, headers);
+  const dispatcher = init?.dispatcher;
+  const result = await undiciRequestImpl(url, {
+    method,
+    headers,
+    ...body !== void 0 && body !== null ? { body } : {},
+    ...init?.signal ? { signal: init.signal } : source?.signal ? { signal: source.signal } : {},
+    ...dispatcher ? { dispatcher } : {},
+    maxRedirections: 0
+  });
+  const iterator = result.body[Symbol.asyncIterator]();
+  const responseBody = new ReadableStream({
+    async pull(controller) {
+      try {
+        const chunk = await iterator.next();
+        if (chunk.done) {
+          controller.close();
+          return;
+        }
+        controller.enqueue(
+          chunk.value instanceof Uint8Array ? chunk.value : new Uint8Array(chunk.value)
+        );
+      } catch (error) {
+        controller.error(error);
+      }
+    },
+    async cancel(reason) {
+      result.body.destroy(reason instanceof Error ? reason : void 0);
+      await iterator.return?.();
+    }
+  });
+  const responseHeaders = new Headers();
+  for (const [name, value] of Object.entries(result.headers)) {
+    if (Array.isArray(value)) {
+      for (const entry of value) responseHeaders.append(name, entry);
+    } else if (value !== void 0) {
+      responseHeaders.set(name, value);
+    }
+  }
+  const response = new Response(responseBody, {
+    status: result.statusCode,
+    headers: responseHeaders
+  });
+  Object.defineProperty(response, "url", { value: url });
+  return response;
+};
+async function normalizeUndiciRequestBody(body, headers) {
+  if (body instanceof URLSearchParams) {
+    if (!headers.has("content-type")) {
+      headers.set("content-type", "application/x-www-form-urlencoded;charset=UTF-8");
+    }
+    return body.toString();
+  }
+  if (body instanceof Blob) {
+    if (body.type && !headers.has("content-type")) headers.set("content-type", body.type);
+    return new Uint8Array(await body.arrayBuffer());
+  }
+  if (body instanceof ArrayBuffer) return new Uint8Array(body);
+  if (ArrayBuffer.isView(body)) {
+    return new Uint8Array(body.buffer, body.byteOffset, body.byteLength);
+  }
+  return body;
+}
 var undiciFetch = defaultFetch;
 async function resolvePinnedDestination(rawUrl, settings, options = {}) {
   const label = options.label ?? "Outbound request";
@@ -165,7 +274,7 @@ async function pinnedFetch(input, init, settings, options = {}) {
   const rawUrl = input instanceof Request ? input.url : input;
   const destination = await resolvePinnedDestination(rawUrl, settings, options);
   const dispatcher = options.agentFactory?.(destination.addresses) ?? createPinnedAgent(destination.addresses);
-  const fetchImpl = options.fetchImpl ?? defaultFetch;
+  const fetchImpl = options.fetchImpl ?? pinnedRequestFetch;
   const fetchInit = {
     ...init,
     redirect: "manual",
@@ -179,10 +288,10 @@ async function pinnedFetch(input, init, settings, options = {}) {
     throw error;
   }
   if (!response.body) {
-    await closeDispatcher(dispatcher);
+    await closeDispatcher(dispatcher, DISPATCHER_CLOSE_TIMEOUT_MS);
     return response;
   }
-  return responseWithDispatcherLifecycle(response, dispatcher);
+  return responseWithDispatcherLifecycle(response, dispatcher, DISPATCHER_CLOSE_TIMEOUT_MS);
 }
 function isLocalTestEnvironment(environment) {
   return environment === "local" || environment === "test";
@@ -229,7 +338,10 @@ function createPinnedAgent(addresses) {
         if (options.all) {
           callback(
             null,
-            candidates.map((entry) => ({ address: entry.address, family: entry.family }))
+            candidates.map((entry) => ({
+              address: entry.address,
+              family: entry.family
+            }))
           );
           return;
         }
@@ -248,13 +360,19 @@ function createPinnedAgent(addresses) {
     }
   };
 }
-function responseWithDispatcherLifecycle(response, dispatcher) {
+function responseWithDispatcherLifecycle(response, dispatcher, closeTimeoutMs) {
   const reader = response.body.getReader();
+  let readerReleased = false;
+  const releaseReader = () => {
+    if (readerReleased) return;
+    readerReleased = true;
+    reader.releaseLock();
+  };
   let disposed = null;
   let cancelled = false;
   const finish = (destroy, error) => {
     if (!disposed) {
-      disposed = destroy ? destroyDispatcher(dispatcher, error) : closeDispatcher(dispatcher);
+      disposed = destroy ? destroyDispatcher(dispatcher, error) : closeDispatcher(dispatcher, closeTimeoutMs);
     }
     return disposed;
   };
@@ -263,12 +381,14 @@ function responseWithDispatcherLifecycle(response, dispatcher) {
       try {
         const chunk = await reader.read();
         if (chunk.done) {
+          releaseReader();
           await finish(cancelled);
           controller.close();
           return;
         }
         controller.enqueue(chunk.value);
       } catch (error) {
+        releaseReader();
         await finish(true, error);
         controller.error(error);
       }
@@ -278,6 +398,7 @@ function responseWithDispatcherLifecycle(response, dispatcher) {
       try {
         await reader.cancel(reason);
       } finally {
+        releaseReader();
         await finish(true, reason);
       }
     }
@@ -294,11 +415,20 @@ function responseWithDispatcherLifecycle(response, dispatcher) {
   });
   return wrapped;
 }
-async function closeDispatcher(dispatcher) {
-  try {
-    await dispatcher.close();
-  } catch {
-    await destroyDispatcher(dispatcher);
+async function closeDispatcher(dispatcher, timeoutMs) {
+  let timeout;
+  const outcome = await Promise.race([
+    Promise.resolve().then(() => dispatcher.close()).then(
+      () => "closed",
+      () => "failed"
+    ),
+    new Promise((resolve) => {
+      timeout = setTimeout(() => resolve("timed_out"), timeoutMs);
+    })
+  ]);
+  if (timeout) clearTimeout(timeout);
+  if (outcome !== "closed") {
+    void destroyDispatcher(dispatcher);
   }
 }
 async function destroyDispatcher(dispatcher, error) {
@@ -474,6 +604,7 @@ function ipv6Constant(address) {
 export {
   DestinationPolicyError,
   OAUTH_MAX_RESPONSE_BYTES,
+  RequestDeadlineError,
   ResponseBodyLimitError,
   isInvalidAddress,
   isLocalTestEnvironment,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// The explicit entrypoint avoids Bun's native `undici` compatibility shim,\n// which exposes an Agent-shaped object without Dispatcher methods.\nimport { Agent, fetch as undiciFetchImpl } from \"undici/index.js\";\nimport { lookup as nodeLookup } from \"node:dns/promises\";\nimport { isIP } from \"node:net\";\n\nexport type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;\n\nexport type DnsAddress = {\n  address: string;\n  family: 4 | 6;\n};\n\nexport type DnsLookup = (hostname: string) => Promise<readonly DnsAddress[]>;\n\nexport type OutboundNetworkSettings = {\n  environment: string;\n  integrationsAllowPrivateNetworkTargets: boolean;\n};\n\nexport type PinnedDestination = {\n  url: URL;\n  hostname: string;\n  addresses: readonly DnsAddress[];\n};\n\nexport type DispatcherLifecycle = {\n  /** The raw dispatcher handed to fetch; omitted for test-only lifecycle fakes. */\n  dispatcher?: unknown;\n  close: () => Promise<void> | void;\n  destroy: (error?: unknown) => Promise<void> | void;\n};\n\nexport type PinnedFetchOptions = {\n  fetchImpl?: FetchLike;\n  dnsLookup?: DnsLookup;\n  agentFactory?: (addresses: readonly DnsAddress[]) => DispatcherLifecycle;\n  label?: string;\n  requireHttpsOutsideLocalTest?: boolean;\n};\n\nexport const OAUTH_MAX_RESPONSE_BYTES = 1024 * 1024;\n\nexport type HttpUrlValidationOptions = {\n  allowLoopbackHttp?: boolean;\n  label?: string;\n};\n\n/** Validate a protocol endpoint before it is persisted, returned, or opened. */\nexport function validateHttpUrl(rawUrl: string, options: HttpUrlValidationOptions = {}): string {\n  const label = options.label ?? \"HTTP endpoint\";\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    throw new DestinationPolicyError(\"invalid_url\", `${label} URL is invalid`);\n  }\n  if (url.protocol !== \"http:\" && url.protocol !== \"https:\") {\n    throw new DestinationPolicyError(\n      \"unsupported_protocol\",\n      `${label} only supports http and https URLs`,\n    );\n  }\n  if (url.username || url.password) {\n    throw new DestinationPolicyError(\"invalid_url\", `${label} URL may not contain credentials`);\n  }\n  if (url.hash) {\n    throw new DestinationPolicyError(\"invalid_url\", `${label} URL may not contain a fragment`);\n  }\n  if (\n    url.protocol === \"http:\" &&\n    !(options.allowLoopbackHttp && isLoopbackHostname(url.hostname))\n  ) {\n    throw new DestinationPolicyError(\"https_required\", `${label} must use https`);\n  }\n  return url.toString();\n}\n\n/**\n * Raised when a response cannot be safely consumed within its caller's byte\n * budget. The error intentionally contains no response bytes or provider\n * message: these readers are used on credential-bearing paths.\n */\nexport class ResponseBodyLimitError extends Error {\n  constructor(\n    readonly label: string,\n    readonly actualBytes: number,\n    readonly maxBytes: number,\n    readonly reason: \"declared_length\" | \"stream_overflow\" | \"invalid_content_length\",\n  ) {\n    super(`${label} exceeded its ${maxBytes}-byte response limit`);\n    this.name = \"ResponseBodyLimitError\";\n  }\n}\n\n/**\n * Read a response through its stream with a hard byte ceiling.\n *\n * A declared Content-Length above the ceiling is rejected before reading. A\n * body exactly at the ceiling is accepted; the first byte beyond it cancels\n * the stream and rejects. Cancellation is important because pinnedFetch owns a\n * per-response dispatcher which must be closed on every exit path.\n */\nexport async function readResponseBodyBounded(\n  response: Response,\n  maxBytes: number,\n  label: string,\n): Promise<Uint8Array> {\n  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) {\n    throw new RangeError(\"response body limit must be a non-negative safe integer\");\n  }\n  const declared = response.headers.get(\"content-length\");\n  if (declared !== null) {\n    const normalized = declared.trim();\n    if (!/^\\d+$/.test(normalized)) {\n      await cancelResponse(response);\n      throw new ResponseBodyLimitError(label, 0, maxBytes, \"invalid_content_length\");\n    }\n    const declaredBytes = Number(normalized);\n    if (!Number.isSafeInteger(declaredBytes) || declaredBytes > maxBytes) {\n      await cancelResponse(response);\n      throw new ResponseBodyLimitError(label, declaredBytes, maxBytes, \"declared_length\");\n    }\n  }\n  if (!response.body) {\n    return new Uint8Array();\n  }\n\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let receivedBytes = 0;\n  try {\n    for (;;) {\n      const result = await reader.read();\n      if (result.done) {\n        break;\n      }\n      receivedBytes += result.value.byteLength;\n      if (receivedBytes > maxBytes) {\n        await reader.cancel().catch(() => undefined);\n        throw new ResponseBodyLimitError(label, receivedBytes, maxBytes, \"stream_overflow\");\n      }\n      chunks.push(result.value);\n    }\n  } catch (error) {\n    await reader.cancel().catch(() => undefined);\n    throw error;\n  } finally {\n    reader.releaseLock();\n  }\n\n  const body = new Uint8Array(receivedBytes);\n  let offset = 0;\n  for (const chunk of chunks) {\n    body.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return body;\n}\n\nexport async function readResponseTextBounded(\n  response: Response,\n  maxBytes: number,\n  label: string,\n): Promise<string> {\n  return new TextDecoder().decode(await readResponseBodyBounded(response, maxBytes, label));\n}\n\nexport async function readResponseJsonBounded<T = unknown>(\n  response: Response,\n  maxBytes: number,\n  label: string,\n): Promise<T> {\n  return JSON.parse(await readResponseTextBounded(response, maxBytes, label)) as T;\n}\n\nexport type ResolvePinnedDestinationOptions = {\n  dnsLookup?: DnsLookup;\n  label?: string;\n  requireHttpsOutsideLocalTest?: boolean;\n};\n\nexport type DestinationPolicyReason =\n  | \"invalid_url\"\n  | \"unsupported_protocol\"\n  | \"https_required\"\n  | \"dns_failed\"\n  | \"dns_empty\"\n  | \"invalid_dns_answer\"\n  | \"private_or_special_use\";\n\nexport class DestinationPolicyError extends Error {\n  constructor(\n    readonly reason: DestinationPolicyReason,\n    message: string,\n  ) {\n    super(message);\n    this.name = \"DestinationPolicyError\";\n  }\n}\n\nconst defaultDnsLookup: DnsLookup = async (hostname) => {\n  const answers = await nodeLookup(hostname, { all: true });\n  return answers.map((entry) => normalizeDnsAnswer(entry));\n};\n\nconst defaultFetch: FetchLike = (input, init) =>\n  (undiciFetchImpl as unknown as FetchLike)(input, init);\n\n/** Undici fetch used by the pinned transport; Bun callers should prefer this over native fetch. */\nexport const undiciFetch: FetchLike = defaultFetch;\n\n/**\n * Resolve and policy-check one destination. The returned address set is the\n * complete DNS answer that the caller is allowed to use; the transport never\n * performs a second resolver call.\n */\nexport async function resolvePinnedDestination(\n  rawUrl: string | URL,\n  settings: OutboundNetworkSettings,\n  options: ResolvePinnedDestinationOptions = {},\n): Promise<PinnedDestination> {\n  const label = options.label ?? \"Outbound request\";\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    throw new DestinationPolicyError(\"invalid_url\", `${label} URL is invalid`);\n  }\n  if (url.protocol !== \"http:\" && url.protocol !== \"https:\") {\n    throw new DestinationPolicyError(\n      \"unsupported_protocol\",\n      `${label} only supports http and https URLs`,\n    );\n  }\n  const localTestEscape = isLocalTestEnvironment(settings.environment);\n  if (options.requireHttpsOutsideLocalTest && !localTestEscape && url.protocol !== \"https:\") {\n    throw new DestinationPolicyError(\n      \"https_required\",\n      `${label} must use https outside local/test`,\n    );\n  }\n\n  const hostname = normalizeHostname(url.hostname);\n  if (!hostname) {\n    throw new DestinationPolicyError(\"invalid_url\", `${label} URL has no hostname`);\n  }\n\n  const literalFamily = isIP(hostname);\n  let addresses: readonly DnsAddress[];\n  try {\n    addresses = literalFamily\n      ? [{ address: hostname, family: literalFamily === 6 ? 6 : 4 }]\n      : await (options.dnsLookup ?? defaultDnsLookup)(hostname);\n  } catch (error) {\n    if (error instanceof DestinationPolicyError && error.reason === \"invalid_dns_answer\") {\n      throw error;\n    }\n    throw new DestinationPolicyError(\"dns_failed\", `${label} hostname could not be resolved`);\n  }\n\n  const normalizedAddresses = dedupeAddresses(addresses);\n  if (normalizedAddresses.length === 0) {\n    throw new DestinationPolicyError(\"dns_empty\", `${label} hostname has no addresses`);\n  }\n  if (normalizedAddresses.some((entry) => isInvalidAddress(entry.address))) {\n    throw new DestinationPolicyError(\n      \"invalid_dns_answer\",\n      `${label} hostname returned an invalid address`,\n    );\n  }\n\n  const privateEscape = localTestEscape || settings.integrationsAllowPrivateNetworkTargets === true;\n  if (\n    !privateEscape &&\n    (isLocalHostname(hostname) ||\n      normalizedAddresses.some((entry) => isNonPublicAddress(entry.address)))\n  ) {\n    throw new DestinationPolicyError(\n      \"private_or_special_use\",\n      `${label} may not target a private or special-use network address`,\n    );\n  }\n  return { url, hostname, addresses: normalizedAddresses };\n}\n\n/**\n * Fetch through a dispatcher whose lookup is pinned to the result of exactly\n * one policy resolution. The response body owns the agent until completion,\n * cancellation, or stream failure.\n */\nexport async function pinnedFetch(\n  input: string | URL | Request,\n  init: RequestInit | undefined,\n  settings: OutboundNetworkSettings,\n  options: PinnedFetchOptions = {},\n): Promise<Response> {\n  const rawUrl = input instanceof Request ? input.url : input;\n  const destination = await resolvePinnedDestination(rawUrl, settings, options);\n  const dispatcher =\n    options.agentFactory?.(destination.addresses) ?? createPinnedAgent(destination.addresses);\n  const fetchImpl = options.fetchImpl ?? defaultFetch;\n  const fetchInit = {\n    ...init,\n    redirect: \"manual\" as const,\n    dispatcher: dispatcher.dispatcher ?? dispatcher,\n  } as RequestInit & { dispatcher: DispatcherLifecycle };\n  let response: Response;\n  try {\n    response = await fetchImpl(input, fetchInit);\n  } catch (error) {\n    await destroyDispatcher(dispatcher, error);\n    throw error;\n  }\n  if (!response.body) {\n    await closeDispatcher(dispatcher);\n    return response;\n  }\n  return responseWithDispatcherLifecycle(response, dispatcher);\n}\n\nexport function isLocalTestEnvironment(environment: string): boolean {\n  return environment === \"local\" || environment === \"test\";\n}\n\n/** Return true for malformed, non-IPv4, and non-IPv6 address strings. */\nexport function isInvalidAddress(address: string): boolean {\n  return isIP(stripAddressBrackets(address.trim())) === 0;\n}\n\n/**\n * Classify private, reserved, documentation, benchmark, multicast, and other\n * special-use answers. IPv4-mapped IPv6 addresses are classified through their\n * embedded IPv4 value.\n */\nexport function isNonPublicAddress(address: string): boolean {\n  const normalized = stripAddressBrackets(address.trim().toLowerCase());\n  const family = isIP(normalized);\n  if (family === 0) {\n    return true;\n  }\n  if (family === 4) {\n    return isNonPublicIpv4(normalized);\n  }\n  const mappedText = ipv4FromMappedText(normalized);\n  if (mappedText !== null) {\n    return isNonPublicIpv4(mappedText);\n  }\n  const value = parseIpv6(normalized);\n  if (value === null) {\n    return true;\n  }\n  const mapped = ipv4FromMappedIpv6(value);\n  if (mapped !== null) {\n    return isNonPublicIpv4(mapped);\n  }\n  // Fail closed on unallocated/non-global IPv6 space. Current globally routed\n  // unicast addresses live in 2000::/3; local, transition, multicast, and\n  // future-use ranges must not become credential-bearing egress merely because\n  // they were absent from a denylist.\n  if (!hasIpv6Prefix(value, IPV6_GLOBAL_UNICAST_PREFIX, 3)) {\n    return true;\n  }\n  return IPV6_SPECIAL_PREFIXES.some(([prefix, bits]) => hasIpv6Prefix(value, prefix, bits));\n}\n\n// Backwards-compatible name used by the database token-broker API.\nexport const isPrivateAddress = isNonPublicAddress;\n\nfunction createPinnedAgent(addresses: readonly DnsAddress[]): DispatcherLifecycle {\n  const agent = new Agent({\n    connect: {\n      lookup: ((\n        _hostname: string,\n        options: { all?: boolean; family?: number },\n        callback: (\n          error: Error | null,\n          address?: string | Array<{ address: string; family: number }>,\n          family?: number,\n        ) => void,\n      ) => {\n        const candidates =\n          options.family === 4 || options.family === 6\n            ? addresses.filter((entry) => entry.family === options.family)\n            : addresses;\n        if (candidates.length === 0) {\n          callback(new Error(\"pinned DNS answer has no address for requested family\"));\n          return;\n        }\n        if (options.all) {\n          callback(\n            null,\n            candidates.map((entry) => ({ address: entry.address, family: entry.family })),\n          );\n          return;\n        }\n        const first = candidates[0]!;\n        callback(null, first.address, first.family);\n      }) as never,\n    },\n  });\n  return {\n    dispatcher: agent,\n    close: async () => {\n      await agent.close();\n    },\n    destroy: async (error) => {\n      await agent.destroy(error instanceof Error ? error : null);\n    },\n  };\n}\n\nfunction responseWithDispatcherLifecycle(\n  response: Response,\n  dispatcher: DispatcherLifecycle,\n): Response {\n  const reader = response.body!.getReader();\n  let disposed: Promise<void> | null = null;\n  let cancelled = false;\n  const finish = (destroy: boolean, error?: unknown): Promise<void> => {\n    if (!disposed) {\n      disposed = destroy ? destroyDispatcher(dispatcher, error) : closeDispatcher(dispatcher);\n    }\n    return disposed;\n  };\n  const body = new ReadableStream<Uint8Array>({\n    async pull(controller) {\n      try {\n        const chunk = await reader.read();\n        if (chunk.done) {\n          await finish(cancelled);\n          controller.close();\n          return;\n        }\n        controller.enqueue(chunk.value);\n      } catch (error) {\n        await finish(true, error);\n        controller.error(error);\n      }\n    },\n    async cancel(reason) {\n      cancelled = true;\n      try {\n        await reader.cancel(reason);\n      } finally {\n        await finish(true, reason);\n      }\n    },\n  });\n  const wrapped = new Response(body, {\n    status: response.status,\n    statusText: response.statusText,\n    headers: response.headers,\n  });\n  Object.defineProperties(wrapped, {\n    redirected: { value: response.redirected },\n    type: { value: response.type },\n    url: { value: response.url },\n  });\n  return wrapped;\n}\n\nasync function closeDispatcher(dispatcher: DispatcherLifecycle): Promise<void> {\n  try {\n    await dispatcher.close();\n  } catch {\n    await destroyDispatcher(dispatcher);\n  }\n}\n\nasync function destroyDispatcher(dispatcher: DispatcherLifecycle, error?: unknown): Promise<void> {\n  try {\n    await dispatcher.destroy(error);\n  } catch {\n    // Cleanup is best effort after the dispatcher has already failed.\n  }\n}\n\nasync function cancelResponse(response: Response): Promise<void> {\n  await response.body?.cancel().catch(() => undefined);\n}\n\nfunction normalizeHostname(hostname: string): string {\n  return stripAddressBrackets(hostname.trim().toLowerCase()).replace(/\\.$/, \"\");\n}\n\nfunction stripAddressBrackets(address: string): string {\n  return address.startsWith(\"[\") && address.endsWith(\"]\") ? address.slice(1, -1) : address;\n}\n\nfunction isLocalHostname(hostname: string): boolean {\n  return hostname === \"localhost\" || hostname.endsWith(\".localhost\");\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  const normalized = normalizeHostname(hostname);\n  return (\n    normalized === \"localhost\" ||\n    normalized.endsWith(\".localhost\") ||\n    normalized === \"::1\" ||\n    isLoopbackIpv4(normalized)\n  );\n}\n\nfunction isLoopbackIpv4(hostname: string): boolean {\n  if (isIP(hostname) !== 4) return false;\n  return hostname.split(\".\")[0] === \"127\";\n}\n\nfunction dedupeAddresses(addresses: readonly DnsAddress[]): DnsAddress[] {\n  const out: DnsAddress[] = [];\n  const seen = new Set<string>();\n  if (!Array.isArray(addresses)) {\n    throw invalidDnsAnswer();\n  }\n  for (const entry of addresses) {\n    const normalized = normalizeDnsAnswer(entry);\n    const key = `${normalized.family}:${normalized.address}`;\n    if (!seen.has(key)) {\n      seen.add(key);\n      out.push(normalized);\n    }\n  }\n  return out;\n}\n\n/**\n * Validate resolver metadata before it can influence either policy checks or\n * the pinned dispatcher. Never infer a family from the address while retaining\n * a conflicting resolver claim: an invalid answer is an invalid answer.\n */\nfunction normalizeDnsAnswer(entry: unknown): DnsAddress {\n  if (!entry || typeof entry !== \"object\") {\n    throw invalidDnsAnswer();\n  }\n  const candidate = entry as { address?: unknown; family?: unknown };\n  if (typeof candidate.address !== \"string\") {\n    throw invalidDnsAnswer();\n  }\n  const family = candidate.family;\n  if (family !== 4 && family !== 6) {\n    throw invalidDnsAnswer();\n  }\n  const address = stripAddressBrackets(candidate.address.trim().toLowerCase());\n  const actualFamily = isIP(address);\n  if (actualFamily !== family) {\n    throw invalidDnsAnswer();\n  }\n  return { address, family };\n}\n\nfunction invalidDnsAnswer(): DestinationPolicyError {\n  return new DestinationPolicyError(\n    \"invalid_dns_answer\",\n    \"hostname returned an invalid DNS answer\",\n  );\n}\n\nfunction isNonPublicIpv4(address: string): boolean {\n  const parts = address.split(\".\").map(Number);\n  if (\n    parts.length !== 4 ||\n    parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)\n  ) {\n    return true;\n  }\n  const value = (parts[0]! << 24) | (parts[1]! << 16) | (parts[2]! << 8) | parts[3]!;\n  const unsigned = value >>> 0;\n  return (\n    inIpv4Range(unsigned, 0x00000000, 0x00ffffff) ||\n    inIpv4Range(unsigned, 0x0a000000, 0x0affffff) ||\n    inIpv4Range(unsigned, 0x64400000, 0x647fffff) ||\n    inIpv4Range(unsigned, 0x7f000000, 0x7fffffff) ||\n    inIpv4Range(unsigned, 0xa9fe0000, 0xa9feffff) ||\n    inIpv4Range(unsigned, 0xac100000, 0xac1fffff) ||\n    inIpv4Range(unsigned, 0xc0000000, 0xc00000ff) ||\n    inIpv4Range(unsigned, 0xc0000200, 0xc00002ff) ||\n    inIpv4Range(unsigned, 0xc01fc400, 0xc01fc4ff) ||\n    inIpv4Range(unsigned, 0xc034c100, 0xc034c1ff) ||\n    inIpv4Range(unsigned, 0xc0586300, 0xc05863ff) ||\n    inIpv4Range(unsigned, 0xc0a80000, 0xc0a8ffff) ||\n    inIpv4Range(unsigned, 0xc0af3000, 0xc0af30ff) ||\n    inIpv4Range(unsigned, 0xc6120000, 0xc613ffff) ||\n    inIpv4Range(unsigned, 0xc6336400, 0xc63364ff) ||\n    inIpv4Range(unsigned, 0xcb007100, 0xcb0071ff) ||\n    inIpv4Range(unsigned, 0xe0000000, 0xffffffff)\n  );\n}\n\nfunction inIpv4Range(value: number, start: number, end: number): boolean {\n  return value >= start && value <= end;\n}\n\nconst IPV6_GLOBAL_UNICAST_PREFIX = ipv6Constant(\"2000::\");\n\nconst IPV6_SPECIAL_PREFIXES: readonly [bigint, number][] = [\n  [ipv6Constant(\"::\"), 96],\n  [ipv6Constant(\"64:ff9b::\"), 96],\n  [ipv6Constant(\"64:ff9b:1::\"), 48],\n  [ipv6Constant(\"100::\"), 64],\n  // IETF protocol assignments contain globally reachable carve-outs, but they\n  // are control-plane anycast/protocol addresses rather than integration\n  // endpoints. Credential-bearing MCP/OAuth egress fails closed on the full\n  // special-purpose block.\n  [ipv6Constant(\"2001::\"), 23],\n  [ipv6Constant(\"2001:db8::\"), 32],\n  [ipv6Constant(\"2002::\"), 16],\n  [ipv6Constant(\"2620:4f:8000::\"), 48],\n  [ipv6Constant(\"3ffe::\"), 16],\n  [ipv6Constant(\"3fff::\"), 20],\n  [ipv6Constant(\"5f00::\"), 16],\n  [ipv6Constant(\"fc00::\"), 7],\n  [ipv6Constant(\"fe80::\"), 10],\n  [ipv6Constant(\"fec0::\"), 10],\n  [ipv6Constant(\"ff00::\"), 8],\n];\n\nfunction hasIpv6Prefix(value: bigint, prefix: bigint, bits: number): boolean {\n  const shift = 128n - BigInt(bits);\n  return value >> shift === prefix >> shift;\n}\n\nfunction ipv4FromMappedIpv6(value: bigint): string | null {\n  if (value >> 32n !== 0xffffn) {\n    return null;\n  }\n  const embedded = Number(value & 0xffffffffn);\n  return `${embedded >>> 24}.${(embedded >>> 16) & 0xff}.${(embedded >>> 8) & 0xff}.${embedded & 0xff}`;\n}\n\nfunction ipv4FromMappedText(address: string): string | null {\n  if (!address.startsWith(\"::ffff:\")) {\n    return null;\n  }\n  const embedded = address.slice(\"::ffff:\".length);\n  if (isIP(embedded) === 4) {\n    return embedded;\n  }\n  const parts = embedded.split(\":\");\n  if (parts.length !== 2 || parts.some((part) => !/^[0-9a-f]{1,4}$/.test(part))) {\n    return null;\n  }\n  const high = Number.parseInt(parts[0]!, 16);\n  const low = Number.parseInt(parts[1]!, 16);\n  return `${(high >> 8) & 0xff}.${high & 0xff}.${(low >> 8) & 0xff}.${low & 0xff}`;\n}\n\nfunction parseIpv6(address: string): bigint | null {\n  const percent = address.indexOf(\"%\");\n  if (percent >= 0) {\n    return null;\n  }\n  let value = address;\n  if (value.includes(\".\")) {\n    const lastColon = value.lastIndexOf(\":\");\n    const dotted = value.slice(lastColon + 1);\n    const parts = dotted.split(\".\").map(Number);\n    if (\n      parts.length !== 4 ||\n      parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)\n    ) {\n      return null;\n    }\n    const hex =\n      ((parts[0]! << 8) | parts[1]!).toString(16).padStart(4, \"0\") +\n      ((parts[2]! << 8) | parts[3]!).toString(16).padStart(4, \"0\");\n    value = `${value.slice(0, lastColon + 1)}${hex}`;\n  }\n  const halves = value.split(\"::\");\n  if (halves.length > 2) {\n    return null;\n  }\n  const left = halves[0] ? halves[0].split(\":\") : [];\n  const right = halves.length === 2 && halves[1] ? halves[1].split(\":\") : [];\n  if (left.concat(right).some((part) => !/^[0-9a-f]{1,4}$/i.test(part))) {\n    return null;\n  }\n  const missing = halves.length === 2 ? 8 - left.length - right.length : 0;\n  if (missing < 0 || (halves.length === 1 && missing !== 0)) {\n    return null;\n  }\n  const groups = [...left, ...Array.from({ length: missing }, () => \"0\"), ...right];\n  if (groups.length !== 8) {\n    return null;\n  }\n  return groups.reduce((acc, group) => (acc << 16n) | BigInt(`0x${group}`), 0n);\n}\n\nfunction ipv6Constant(address: string): bigint {\n  const value = parseIpv6(address);\n  if (value === null) {\n    throw new Error(`invalid IPv6 constant: ${address}`);\n  }\n  return value;\n}\n"],"mappings":";AAEA,SAAS,OAAO,SAAS,uBAAuB;AAChD,SAAS,UAAU,kBAAkB;AACrC,SAAS,YAAY;AAqCd,IAAM,2BAA2B,OAAO;AAQxC,SAAS,gBAAgB,QAAgB,UAAoC,CAAC,GAAW;AAC9F,QAAM,QAAQ,QAAQ,SAAS;AAC/B,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,MAAM;AAAA,EACtB,QAAQ;AACN,UAAM,IAAI,uBAAuB,eAAe,GAAG,KAAK,iBAAiB;AAAA,EAC3E;AACA,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU;AACzD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AACA,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,UAAM,IAAI,uBAAuB,eAAe,GAAG,KAAK,kCAAkC;AAAA,EAC5F;AACA,MAAI,IAAI,MAAM;AACZ,UAAM,IAAI,uBAAuB,eAAe,GAAG,KAAK,iCAAiC;AAAA,EAC3F;AACA,MACE,IAAI,aAAa,WACjB,EAAE,QAAQ,qBAAqB,mBAAmB,IAAI,QAAQ,IAC9D;AACA,UAAM,IAAI,uBAAuB,kBAAkB,GAAG,KAAK,iBAAiB;AAAA,EAC9E;AACA,SAAO,IAAI,SAAS;AACtB;AAOO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YACW,OACA,aACA,UACA,QACT;AACA,UAAM,GAAG,KAAK,iBAAiB,QAAQ,sBAAsB;AALpD;AACA;AACA;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AACF;AAUA,eAAsB,wBACpB,UACA,UACA,OACqB;AACrB,MAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAW,GAAG;AACnD,UAAM,IAAI,WAAW,yDAAyD;AAAA,EAChF;AACA,QAAM,WAAW,SAAS,QAAQ,IAAI,gBAAgB;AACtD,MAAI,aAAa,MAAM;AACrB,UAAM,aAAa,SAAS,KAAK;AACjC,QAAI,CAAC,QAAQ,KAAK,UAAU,GAAG;AAC7B,YAAM,eAAe,QAAQ;AAC7B,YAAM,IAAI,uBAAuB,OAAO,GAAG,UAAU,wBAAwB;AAAA,IAC/E;AACA,UAAM,gBAAgB,OAAO,UAAU;AACvC,QAAI,CAAC,OAAO,cAAc,aAAa,KAAK,gBAAgB,UAAU;AACpE,YAAM,eAAe,QAAQ;AAC7B,YAAM,IAAI,uBAAuB,OAAO,eAAe,UAAU,iBAAiB;AAAA,IACpF;AAAA,EACF;AACA,MAAI,CAAC,SAAS,MAAM;AAClB,WAAO,IAAI,WAAW;AAAA,EACxB;AAEA,QAAM,SAAS,SAAS,KAAK,UAAU;AACvC,QAAM,SAAuB,CAAC;AAC9B,MAAI,gBAAgB;AACpB,MAAI;AACF,eAAS;AACP,YAAM,SAAS,MAAM,OAAO,KAAK;AACjC,UAAI,OAAO,MAAM;AACf;AAAA,MACF;AACA,uBAAiB,OAAO,MAAM;AAC9B,UAAI,gBAAgB,UAAU;AAC5B,cAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,cAAM,IAAI,uBAAuB,OAAO,eAAe,UAAU,iBAAiB;AAAA,MACpF;AACA,aAAO,KAAK,OAAO,KAAK;AAAA,IAC1B;AAAA,EACF,SAAS,OAAO;AACd,UAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,UAAM;AAAA,EACR,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AAEA,QAAM,OAAO,IAAI,WAAW,aAAa;AACzC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,SAAK,IAAI,OAAO,MAAM;AACtB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAEA,eAAsB,wBACpB,UACA,UACA,OACiB;AACjB,SAAO,IAAI,YAAY,EAAE,OAAO,MAAM,wBAAwB,UAAU,UAAU,KAAK,CAAC;AAC1F;AAEA,eAAsB,wBACpB,UACA,UACA,OACY;AACZ,SAAO,KAAK,MAAM,MAAM,wBAAwB,UAAU,UAAU,KAAK,CAAC;AAC5E;AAiBO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YACW,QACT,SACA;AACA,UAAM,OAAO;AAHJ;AAIT,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,mBAA8B,OAAO,aAAa;AACtD,QAAM,UAAU,MAAM,WAAW,UAAU,EAAE,KAAK,KAAK,CAAC;AACxD,SAAO,QAAQ,IAAI,CAAC,UAAU,mBAAmB,KAAK,CAAC;AACzD;AAEA,IAAM,eAA0B,CAAC,OAAO,SACrC,gBAAyC,OAAO,IAAI;AAGhD,IAAM,cAAyB;AAOtC,eAAsB,yBACpB,QACA,UACA,UAA2C,CAAC,GAChB;AAC5B,QAAM,QAAQ,QAAQ,SAAS;AAC/B,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,MAAM;AAAA,EACtB,QAAQ;AACN,UAAM,IAAI,uBAAuB,eAAe,GAAG,KAAK,iBAAiB;AAAA,EAC3E;AACA,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU;AACzD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AACA,QAAM,kBAAkB,uBAAuB,SAAS,WAAW;AACnE,MAAI,QAAQ,gCAAgC,CAAC,mBAAmB,IAAI,aAAa,UAAU;AACzF,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AAEA,QAAM,WAAW,kBAAkB,IAAI,QAAQ;AAC/C,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,uBAAuB,eAAe,GAAG,KAAK,sBAAsB;AAAA,EAChF;AAEA,QAAM,gBAAgB,KAAK,QAAQ;AACnC,MAAI;AACJ,MAAI;AACF,gBAAY,gBACR,CAAC,EAAE,SAAS,UAAU,QAAQ,kBAAkB,IAAI,IAAI,EAAE,CAAC,IAC3D,OAAO,QAAQ,aAAa,kBAAkB,QAAQ;AAAA,EAC5D,SAAS,OAAO;AACd,QAAI,iBAAiB,0BAA0B,MAAM,WAAW,sBAAsB;AACpF,YAAM;AAAA,IACR;AACA,UAAM,IAAI,uBAAuB,cAAc,GAAG,KAAK,iCAAiC;AAAA,EAC1F;AAEA,QAAM,sBAAsB,gBAAgB,SAAS;AACrD,MAAI,oBAAoB,WAAW,GAAG;AACpC,UAAM,IAAI,uBAAuB,aAAa,GAAG,KAAK,4BAA4B;AAAA,EACpF;AACA,MAAI,oBAAoB,KAAK,CAAC,UAAU,iBAAiB,MAAM,OAAO,CAAC,GAAG;AACxE,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AAEA,QAAM,gBAAgB,mBAAmB,SAAS,2CAA2C;AAC7F,MACE,CAAC,kBACA,gBAAgB,QAAQ,KACvB,oBAAoB,KAAK,CAAC,UAAU,mBAAmB,MAAM,OAAO,CAAC,IACvE;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AACA,SAAO,EAAE,KAAK,UAAU,WAAW,oBAAoB;AACzD;AAOA,eAAsB,YACpB,OACA,MACA,UACA,UAA8B,CAAC,GACZ;AACnB,QAAM,SAAS,iBAAiB,UAAU,MAAM,MAAM;AACtD,QAAM,cAAc,MAAM,yBAAyB,QAAQ,UAAU,OAAO;AAC5E,QAAM,aACJ,QAAQ,eAAe,YAAY,SAAS,KAAK,kBAAkB,YAAY,SAAS;AAC1F,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,YAAY;AAAA,IAChB,GAAG;AAAA,IACH,UAAU;AAAA,IACV,YAAY,WAAW,cAAc;AAAA,EACvC;AACA,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,UAAU,OAAO,SAAS;AAAA,EAC7C,SAAS,OAAO;AACd,UAAM,kBAAkB,YAAY,KAAK;AACzC,UAAM;AAAA,EACR;AACA,MAAI,CAAC,SAAS,MAAM;AAClB,UAAM,gBAAgB,UAAU;AAChC,WAAO;AAAA,EACT;AACA,SAAO,gCAAgC,UAAU,UAAU;AAC7D;AAEO,SAAS,uBAAuB,aAA8B;AACnE,SAAO,gBAAgB,WAAW,gBAAgB;AACpD;AAGO,SAAS,iBAAiB,SAA0B;AACzD,SAAO,KAAK,qBAAqB,QAAQ,KAAK,CAAC,CAAC,MAAM;AACxD;AAOO,SAAS,mBAAmB,SAA0B;AAC3D,QAAM,aAAa,qBAAqB,QAAQ,KAAK,EAAE,YAAY,CAAC;AACpE,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI,WAAW,GAAG;AAChB,WAAO;AAAA,EACT;AACA,MAAI,WAAW,GAAG;AAChB,WAAO,gBAAgB,UAAU;AAAA,EACnC;AACA,QAAM,aAAa,mBAAmB,UAAU;AAChD,MAAI,eAAe,MAAM;AACvB,WAAO,gBAAgB,UAAU;AAAA,EACnC;AACA,QAAM,QAAQ,UAAU,UAAU;AAClC,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AACA,QAAM,SAAS,mBAAmB,KAAK;AACvC,MAAI,WAAW,MAAM;AACnB,WAAO,gBAAgB,MAAM;AAAA,EAC/B;AAKA,MAAI,CAAC,cAAc,OAAO,4BAA4B,CAAC,GAAG;AACxD,WAAO;AAAA,EACT;AACA,SAAO,sBAAsB,KAAK,CAAC,CAAC,QAAQ,IAAI,MAAM,cAAc,OAAO,QAAQ,IAAI,CAAC;AAC1F;AAGO,IAAM,mBAAmB;AAEhC,SAAS,kBAAkB,WAAuD;AAChF,QAAM,QAAQ,IAAI,MAAM;AAAA,IACtB,SAAS;AAAA,MACP,QAAS,CACP,WACA,SACA,aAKG;AACH,cAAM,aACJ,QAAQ,WAAW,KAAK,QAAQ,WAAW,IACvC,UAAU,OAAO,CAAC,UAAU,MAAM,WAAW,QAAQ,MAAM,IAC3D;AACN,YAAI,WAAW,WAAW,GAAG;AAC3B,mBAAS,IAAI,MAAM,uDAAuD,CAAC;AAC3E;AAAA,QACF;AACA,YAAI,QAAQ,KAAK;AACf;AAAA,YACE;AAAA,YACA,WAAW,IAAI,CAAC,WAAW,EAAE,SAAS,MAAM,SAAS,QAAQ,MAAM,OAAO,EAAE;AAAA,UAC9E;AACA;AAAA,QACF;AACA,cAAM,QAAQ,WAAW,CAAC;AAC1B,iBAAS,MAAM,MAAM,SAAS,MAAM,MAAM;AAAA,MAC5C;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,OAAO,YAAY;AACjB,YAAM,MAAM,MAAM;AAAA,IACpB;AAAA,IACA,SAAS,OAAO,UAAU;AACxB,YAAM,MAAM,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI;AAAA,IAC3D;AAAA,EACF;AACF;AAEA,SAAS,gCACP,UACA,YACU;AACV,QAAM,SAAS,SAAS,KAAM,UAAU;AACxC,MAAI,WAAiC;AACrC,MAAI,YAAY;AAChB,QAAM,SAAS,CAAC,SAAkB,UAAmC;AACnE,QAAI,CAAC,UAAU;AACb,iBAAW,UAAU,kBAAkB,YAAY,KAAK,IAAI,gBAAgB,UAAU;AAAA,IACxF;AACA,WAAO;AAAA,EACT;AACA,QAAM,OAAO,IAAI,eAA2B;AAAA,IAC1C,MAAM,KAAK,YAAY;AACrB,UAAI;AACF,cAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,YAAI,MAAM,MAAM;AACd,gBAAM,OAAO,SAAS;AACtB,qBAAW,MAAM;AACjB;AAAA,QACF;AACA,mBAAW,QAAQ,MAAM,KAAK;AAAA,MAChC,SAAS,OAAO;AACd,cAAM,OAAO,MAAM,KAAK;AACxB,mBAAW,MAAM,KAAK;AAAA,MACxB;AAAA,IACF;AAAA,IACA,MAAM,OAAO,QAAQ;AACnB,kBAAY;AACZ,UAAI;AACF,cAAM,OAAO,OAAO,MAAM;AAAA,MAC5B,UAAE;AACA,cAAM,OAAO,MAAM,MAAM;AAAA,MAC3B;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,UAAU,IAAI,SAAS,MAAM;AAAA,IACjC,QAAQ,SAAS;AAAA,IACjB,YAAY,SAAS;AAAA,IACrB,SAAS,SAAS;AAAA,EACpB,CAAC;AACD,SAAO,iBAAiB,SAAS;AAAA,IAC/B,YAAY,EAAE,OAAO,SAAS,WAAW;AAAA,IACzC,MAAM,EAAE,OAAO,SAAS,KAAK;AAAA,IAC7B,KAAK,EAAE,OAAO,SAAS,IAAI;AAAA,EAC7B,CAAC;AACD,SAAO;AACT;AAEA,eAAe,gBAAgB,YAAgD;AAC7E,MAAI;AACF,UAAM,WAAW,MAAM;AAAA,EACzB,QAAQ;AACN,UAAM,kBAAkB,UAAU;AAAA,EACpC;AACF;AAEA,eAAe,kBAAkB,YAAiC,OAAgC;AAChG,MAAI;AACF,UAAM,WAAW,QAAQ,KAAK;AAAA,EAChC,QAAQ;AAAA,EAER;AACF;AAEA,eAAe,eAAe,UAAmC;AAC/D,QAAM,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AACrD;AAEA,SAAS,kBAAkB,UAA0B;AACnD,SAAO,qBAAqB,SAAS,KAAK,EAAE,YAAY,CAAC,EAAE,QAAQ,OAAO,EAAE;AAC9E;AAEA,SAAS,qBAAqB,SAAyB;AACrD,SAAO,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,IAAI,QAAQ,MAAM,GAAG,EAAE,IAAI;AACnF;AAEA,SAAS,gBAAgB,UAA2B;AAClD,SAAO,aAAa,eAAe,SAAS,SAAS,YAAY;AACnE;AAEA,SAAS,mBAAmB,UAA2B;AACrD,QAAM,aAAa,kBAAkB,QAAQ;AAC7C,SACE,eAAe,eACf,WAAW,SAAS,YAAY,KAChC,eAAe,SACf,eAAe,UAAU;AAE7B;AAEA,SAAS,eAAe,UAA2B;AACjD,MAAI,KAAK,QAAQ,MAAM,EAAG,QAAO;AACjC,SAAO,SAAS,MAAM,GAAG,EAAE,CAAC,MAAM;AACpC;AAEA,SAAS,gBAAgB,WAAgD;AACvE,QAAM,MAAoB,CAAC;AAC3B,QAAM,OAAO,oBAAI,IAAY;AAC7B,MAAI,CAAC,MAAM,QAAQ,SAAS,GAAG;AAC7B,UAAM,iBAAiB;AAAA,EACzB;AACA,aAAW,SAAS,WAAW;AAC7B,UAAM,aAAa,mBAAmB,KAAK;AAC3C,UAAM,MAAM,GAAG,WAAW,MAAM,IAAI,WAAW,OAAO;AACtD,QAAI,CAAC,KAAK,IAAI,GAAG,GAAG;AAClB,WAAK,IAAI,GAAG;AACZ,UAAI,KAAK,UAAU;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAOA,SAAS,mBAAmB,OAA4B;AACtD,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,UAAM,iBAAiB;AAAA,EACzB;AACA,QAAM,YAAY;AAClB,MAAI,OAAO,UAAU,YAAY,UAAU;AACzC,UAAM,iBAAiB;AAAA,EACzB;AACA,QAAM,SAAS,UAAU;AACzB,MAAI,WAAW,KAAK,WAAW,GAAG;AAChC,UAAM,iBAAiB;AAAA,EACzB;AACA,QAAM,UAAU,qBAAqB,UAAU,QAAQ,KAAK,EAAE,YAAY,CAAC;AAC3E,QAAM,eAAe,KAAK,OAAO;AACjC,MAAI,iBAAiB,QAAQ;AAC3B,UAAM,iBAAiB;AAAA,EACzB;AACA,SAAO,EAAE,SAAS,OAAO;AAC3B;AAEA,SAAS,mBAA2C;AAClD,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,SAA0B;AACjD,QAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,IAAI,MAAM;AAC3C,MACE,MAAM,WAAW,KACjB,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,GAAG,GACtE;AACA,WAAO;AAAA,EACT;AACA,QAAM,QAAS,MAAM,CAAC,KAAM,KAAO,MAAM,CAAC,KAAM,KAAO,MAAM,CAAC,KAAM,IAAK,MAAM,CAAC;AAChF,QAAM,WAAW,UAAU;AAC3B,SACE,YAAY,UAAU,GAAY,QAAU,KAC5C,YAAY,UAAU,WAAY,SAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU;AAEhD;AAEA,SAAS,YAAY,OAAe,OAAe,KAAsB;AACvE,SAAO,SAAS,SAAS,SAAS;AACpC;AAEA,IAAM,6BAA6B,aAAa,QAAQ;AAExD,IAAM,wBAAqD;AAAA,EACzD,CAAC,aAAa,IAAI,GAAG,EAAE;AAAA,EACvB,CAAC,aAAa,WAAW,GAAG,EAAE;AAAA,EAC9B,CAAC,aAAa,aAAa,GAAG,EAAE;AAAA,EAChC,CAAC,aAAa,OAAO,GAAG,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1B,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,YAAY,GAAG,EAAE;AAAA,EAC/B,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,gBAAgB,GAAG,EAAE;AAAA,EACnC,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,QAAQ,GAAG,CAAC;AAAA,EAC1B,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,QAAQ,GAAG,CAAC;AAC5B;AAEA,SAAS,cAAc,OAAe,QAAgB,MAAuB;AAC3E,QAAM,QAAQ,OAAO,OAAO,IAAI;AAChC,SAAO,SAAS,UAAU,UAAU;AACtC;AAEA,SAAS,mBAAmB,OAA8B;AACxD,MAAI,SAAS,QAAQ,SAAS;AAC5B,WAAO;AAAA,EACT;AACA,QAAM,WAAW,OAAO,QAAQ,WAAW;AAC3C,SAAO,GAAG,aAAa,EAAE,IAAK,aAAa,KAAM,GAAI,IAAK,aAAa,IAAK,GAAI,IAAI,WAAW,GAAI;AACrG;AAEA,SAAS,mBAAmB,SAAgC;AAC1D,MAAI,CAAC,QAAQ,WAAW,SAAS,GAAG;AAClC,WAAO;AAAA,EACT;AACA,QAAM,WAAW,QAAQ,MAAM,UAAU,MAAM;AAC/C,MAAI,KAAK,QAAQ,MAAM,GAAG;AACxB,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,SAAS,MAAM,GAAG;AAChC,MAAI,MAAM,WAAW,KAAK,MAAM,KAAK,CAAC,SAAS,CAAC,kBAAkB,KAAK,IAAI,CAAC,GAAG;AAC7E,WAAO;AAAA,EACT;AACA,QAAM,OAAO,OAAO,SAAS,MAAM,CAAC,GAAI,EAAE;AAC1C,QAAM,MAAM,OAAO,SAAS,MAAM,CAAC,GAAI,EAAE;AACzC,SAAO,GAAI,QAAQ,IAAK,GAAI,IAAI,OAAO,GAAI,IAAK,OAAO,IAAK,GAAI,IAAI,MAAM,GAAI;AAChF;AAEA,SAAS,UAAU,SAAgC;AACjD,QAAM,UAAU,QAAQ,QAAQ,GAAG;AACnC,MAAI,WAAW,GAAG;AAChB,WAAO;AAAA,EACT;AACA,MAAI,QAAQ;AACZ,MAAI,MAAM,SAAS,GAAG,GAAG;AACvB,UAAM,YAAY,MAAM,YAAY,GAAG;AACvC,UAAM,SAAS,MAAM,MAAM,YAAY,CAAC;AACxC,UAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,IAAI,MAAM;AAC1C,QACE,MAAM,WAAW,KACjB,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,GAAG,GACtE;AACA,aAAO;AAAA,IACT;AACA,UAAM,OACF,MAAM,CAAC,KAAM,IAAK,MAAM,CAAC,GAAI,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,KACzD,MAAM,CAAC,KAAM,IAAK,MAAM,CAAC,GAAI,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC7D,YAAQ,GAAG,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,GAAG;AAAA,EAChD;AACA,QAAM,SAAS,MAAM,MAAM,IAAI;AAC/B,MAAI,OAAO,SAAS,GAAG;AACrB,WAAO;AAAA,EACT;AACA,QAAM,OAAO,OAAO,CAAC,IAAI,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;AACjD,QAAM,QAAQ,OAAO,WAAW,KAAK,OAAO,CAAC,IAAI,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;AACzE,MAAI,KAAK,OAAO,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,mBAAmB,KAAK,IAAI,CAAC,GAAG;AACrE,WAAO;AAAA,EACT;AACA,QAAM,UAAU,OAAO,WAAW,IAAI,IAAI,KAAK,SAAS,MAAM,SAAS;AACvE,MAAI,UAAU,KAAM,OAAO,WAAW,KAAK,YAAY,GAAI;AACzD,WAAO;AAAA,EACT;AACA,QAAM,SAAS,CAAC,GAAG,MAAM,GAAG,MAAM,KAAK,EAAE,QAAQ,QAAQ,GAAG,MAAM,GAAG,GAAG,GAAG,KAAK;AAChF,MAAI,OAAO,WAAW,GAAG;AACvB,WAAO;AAAA,EACT;AACA,SAAO,OAAO,OAAO,CAAC,KAAK,UAAW,OAAO,MAAO,OAAO,KAAK,KAAK,EAAE,GAAG,EAAE;AAC9E;AAEA,SAAS,aAAa,SAAyB;AAC7C,QAAM,QAAQ,UAAU,OAAO;AAC/B,MAAI,UAAU,MAAM;AAClB,UAAM,IAAI,MAAM,0BAA0B,OAAO,EAAE;AAAA,EACrD;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// The explicit entrypoint avoids Bun's native `undici` compatibility shim,\n// which exposes an Agent-shaped object without Dispatcher methods.\nimport { Agent, fetch as undiciFetchImpl, request as undiciRequestImpl } from \"undici/index.js\";\nimport { lookup as nodeLookup } from \"node:dns/promises\";\nimport { isIP } from \"node:net\";\n\nexport type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;\n\nexport type DnsAddress = {\n  address: string;\n  family: 4 | 6;\n};\n\nexport type DnsLookup = (hostname: string) => Promise<readonly DnsAddress[]>;\n\nexport type OutboundNetworkSettings = {\n  environment: string;\n  integrationsAllowPrivateNetworkTargets: boolean;\n};\n\nexport type PinnedDestination = {\n  url: URL;\n  hostname: string;\n  addresses: readonly DnsAddress[];\n};\n\nexport type DispatcherLifecycle = {\n  /** The raw dispatcher handed to fetch; omitted for test-only lifecycle fakes. */\n  dispatcher?: unknown;\n  close: () => Promise<void> | void;\n  destroy: (error?: unknown) => Promise<void> | void;\n};\n\nexport type PinnedFetchOptions = {\n  fetchImpl?: FetchLike;\n  dnsLookup?: DnsLookup;\n  agentFactory?: (addresses: readonly DnsAddress[]) => DispatcherLifecycle;\n  label?: string;\n  requireHttpsOutsideLocalTest?: boolean;\n};\n\nconst DISPATCHER_CLOSE_TIMEOUT_MS = 100;\n\nexport const OAUTH_MAX_RESPONSE_BYTES = 1024 * 1024;\n\nexport type HttpUrlValidationOptions = {\n  allowLoopbackHttp?: boolean;\n  label?: string;\n};\n\n/** Validate a protocol endpoint before it is persisted, returned, or opened. */\nexport function validateHttpUrl(rawUrl: string, options: HttpUrlValidationOptions = {}): string {\n  const label = options.label ?? \"HTTP endpoint\";\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    throw new DestinationPolicyError(\"invalid_url\", `${label} URL is invalid`);\n  }\n  if (url.protocol !== \"http:\" && url.protocol !== \"https:\") {\n    throw new DestinationPolicyError(\n      \"unsupported_protocol\",\n      `${label} only supports http and https URLs`,\n    );\n  }\n  if (url.username || url.password) {\n    throw new DestinationPolicyError(\"invalid_url\", `${label} URL may not contain credentials`);\n  }\n  if (url.hash) {\n    throw new DestinationPolicyError(\"invalid_url\", `${label} URL may not contain a fragment`);\n  }\n  if (\n    url.protocol === \"http:\" &&\n    !(options.allowLoopbackHttp && isLoopbackHostname(url.hostname))\n  ) {\n    throw new DestinationPolicyError(\"https_required\", `${label} must use https`);\n  }\n  return url.toString();\n}\n\n/**\n * Raised when a response cannot be safely consumed within its caller's byte\n * budget. The error intentionally contains no response bytes or provider\n * message: these readers are used on credential-bearing paths.\n */\nexport class ResponseBodyLimitError extends Error {\n  constructor(\n    readonly label: string,\n    readonly actualBytes: number,\n    readonly maxBytes: number,\n    readonly reason: \"declared_length\" | \"stream_overflow\" | \"invalid_content_length\",\n  ) {\n    super(`${label} exceeded its ${maxBytes}-byte response limit`);\n    this.name = \"ResponseBodyLimitError\";\n  }\n}\n\n/** Raised when a caller-supplied absolute request deadline expires. */\nexport class RequestDeadlineError extends Error {\n  constructor(readonly label: string) {\n    super(`${label} timed out`);\n    this.name = \"RequestDeadlineError\";\n  }\n}\n\nexport type BoundedResponseReadOptions = {\n  signal?: AbortSignal;\n};\n\n/**\n * Read a response through its stream with a hard byte ceiling.\n *\n * A declared Content-Length above the ceiling is rejected before reading. A\n * body exactly at the ceiling is accepted; the first byte beyond it cancels\n * the stream and rejects. Cancellation is important because pinnedFetch owns a\n * per-response dispatcher which must be closed on every exit path.\n */\nexport async function readResponseBodyBounded(\n  response: Response,\n  maxBytes: number,\n  label: string,\n  options: BoundedResponseReadOptions = {},\n): Promise<Uint8Array> {\n  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) {\n    throw new RangeError(\"response body limit must be a non-negative safe integer\");\n  }\n  const declared = response.headers.get(\"content-length\");\n  if (declared !== null) {\n    const normalized = declared.trim();\n    if (!/^\\d+$/.test(normalized)) {\n      await cancelResponse(response);\n      throw new ResponseBodyLimitError(label, 0, maxBytes, \"invalid_content_length\");\n    }\n    const declaredBytes = Number(normalized);\n    if (!Number.isSafeInteger(declaredBytes) || declaredBytes > maxBytes) {\n      await cancelResponse(response);\n      throw new ResponseBodyLimitError(label, declaredBytes, maxBytes, \"declared_length\");\n    }\n  }\n  if (!response.body) {\n    return new Uint8Array();\n  }\n\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let receivedBytes = 0;\n  try {\n    for (;;) {\n      const result = await readStreamChunk(reader, options.signal, label);\n      if (result.done) {\n        break;\n      }\n      receivedBytes += result.value.byteLength;\n      if (receivedBytes > maxBytes) {\n        await reader.cancel().catch(() => undefined);\n        throw new ResponseBodyLimitError(label, receivedBytes, maxBytes, \"stream_overflow\");\n      }\n      chunks.push(result.value);\n    }\n  } catch (error) {\n    void reader.cancel(error).catch(() => undefined);\n    throw error;\n  } finally {\n    try {\n      reader.releaseLock();\n    } catch {\n      // An aborted read may still own the lock until the underlying transport\n      // observes cancellation. The response is already being cancelled above.\n    }\n  }\n\n  const body = new Uint8Array(receivedBytes);\n  let offset = 0;\n  for (const chunk of chunks) {\n    body.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return body;\n}\n\nexport async function readResponseTextBounded(\n  response: Response,\n  maxBytes: number,\n  label: string,\n  options: BoundedResponseReadOptions = {},\n): Promise<string> {\n  return new TextDecoder().decode(\n    await readResponseBodyBounded(response, maxBytes, label, options),\n  );\n}\n\nexport async function readResponseJsonBounded<T = unknown>(\n  response: Response,\n  maxBytes: number,\n  label: string,\n  options: BoundedResponseReadOptions = {},\n): Promise<T> {\n  return JSON.parse(await readResponseTextBounded(response, maxBytes, label, options)) as T;\n}\n\ntype ResponseStreamReadResult = Awaited<\n  ReturnType<ReadableStreamDefaultReader<Uint8Array>[\"read\"]>\n>;\n\nasync function readStreamChunk(\n  reader: ReadableStreamDefaultReader<Uint8Array>,\n  signal: AbortSignal | undefined,\n  label: string,\n): Promise<ResponseStreamReadResult> {\n  if (!signal) return await reader.read();\n  if (signal.aborted) throw new RequestDeadlineError(label);\n  return await new Promise<ResponseStreamReadResult>((resolve, reject) => {\n    let settled = false;\n    const finish = (callback: () => void) => {\n      if (settled) return;\n      settled = true;\n      signal.removeEventListener(\"abort\", onAbort);\n      callback();\n    };\n    const onAbort = () => {\n      const error = new RequestDeadlineError(label);\n      void reader.cancel(error).catch(() => undefined);\n      finish(() => reject(error));\n    };\n    signal.addEventListener(\"abort\", onAbort, { once: true });\n    void reader.read().then(\n      (result) => finish(() => resolve(result)),\n      (error) => finish(() => reject(error)),\n    );\n  });\n}\n\nexport type ResolvePinnedDestinationOptions = {\n  dnsLookup?: DnsLookup;\n  label?: string;\n  requireHttpsOutsideLocalTest?: boolean;\n};\n\nexport type DestinationPolicyReason =\n  | \"invalid_url\"\n  | \"unsupported_protocol\"\n  | \"https_required\"\n  | \"dns_failed\"\n  | \"dns_empty\"\n  | \"invalid_dns_answer\"\n  | \"private_or_special_use\";\n\nexport class DestinationPolicyError extends Error {\n  constructor(\n    readonly reason: DestinationPolicyReason,\n    message: string,\n  ) {\n    super(message);\n    this.name = \"DestinationPolicyError\";\n  }\n}\n\nconst defaultDnsLookup: DnsLookup = async (hostname) => {\n  const answers = await nodeLookup(hostname, { all: true });\n  return answers.map((entry) => normalizeDnsAnswer(entry));\n};\n\nconst defaultFetch: FetchLike = (input, init) =>\n  (undiciFetchImpl as unknown as FetchLike)(input, init);\n\nconst pinnedRequestFetch: FetchLike = async (input, init) => {\n  const source = input instanceof Request ? input : null;\n  const url = source?.url ?? input.toString();\n  const method = init?.method ?? source?.method ?? \"GET\";\n  const headers = new Headers(source?.headers);\n  if (init?.headers) {\n    new Headers(init.headers).forEach((value, name) => headers.set(name, value));\n  }\n  // Undici request() deliberately does not auto-decompress. Asking providers\n  // for identity encoding keeps the returned web Response body truthful.\n  if (!headers.has(\"accept-encoding\")) headers.set(\"accept-encoding\", \"identity\");\n  const rawBody = init?.body ?? (method !== \"GET\" && method !== \"HEAD\" ? source?.body : undefined);\n  const body = await normalizeUndiciRequestBody(rawBody, headers);\n  const dispatcher = (init as (RequestInit & { dispatcher?: unknown }) | undefined)?.dispatcher;\n  const result = await undiciRequestImpl(url, {\n    method: method as never,\n    headers,\n    ...(body !== undefined && body !== null ? { body: body as never } : {}),\n    ...(init?.signal ? { signal: init.signal } : source?.signal ? { signal: source.signal } : {}),\n    ...(dispatcher ? { dispatcher: dispatcher as never } : {}),\n    maxRedirections: 0,\n  });\n  const iterator = result.body[Symbol.asyncIterator]();\n  const responseBody = new ReadableStream<Uint8Array>({\n    async pull(controller) {\n      try {\n        const chunk = await iterator.next();\n        if (chunk.done) {\n          controller.close();\n          return;\n        }\n        controller.enqueue(\n          chunk.value instanceof Uint8Array ? chunk.value : new Uint8Array(chunk.value),\n        );\n      } catch (error) {\n        controller.error(error);\n      }\n    },\n    async cancel(reason) {\n      result.body.destroy(reason instanceof Error ? reason : undefined);\n      await iterator.return?.();\n    },\n  });\n  const responseHeaders = new Headers();\n  for (const [name, value] of Object.entries(result.headers)) {\n    if (Array.isArray(value)) {\n      for (const entry of value) responseHeaders.append(name, entry);\n    } else if (value !== undefined) {\n      responseHeaders.set(name, value);\n    }\n  }\n  const response = new Response(responseBody, {\n    status: result.statusCode,\n    headers: responseHeaders,\n  });\n  Object.defineProperty(response, \"url\", { value: url });\n  return response;\n};\n\n/**\n * Preserve Fetch BodyInit semantics for values that Undici request() does not\n * normalize itself. URLSearchParams is otherwise mistaken for an iterable of\n * body chunks and each [name, value] tuple reaches the socket as an Array.\n */\nasync function normalizeUndiciRequestBody(\n  body: BodyInit | null | undefined,\n  headers: Headers,\n): Promise<BodyInit | Uint8Array | null | undefined> {\n  if (body instanceof URLSearchParams) {\n    if (!headers.has(\"content-type\")) {\n      headers.set(\"content-type\", \"application/x-www-form-urlencoded;charset=UTF-8\");\n    }\n    return body.toString();\n  }\n  if (body instanceof Blob) {\n    if (body.type && !headers.has(\"content-type\")) headers.set(\"content-type\", body.type);\n    return new Uint8Array(await body.arrayBuffer());\n  }\n  if (body instanceof ArrayBuffer) return new Uint8Array(body);\n  if (ArrayBuffer.isView(body)) {\n    return new Uint8Array(body.buffer, body.byteOffset, body.byteLength);\n  }\n  return body;\n}\n\n/** Undici fetch used by the pinned transport; Bun callers should prefer this over native fetch. */\nexport const undiciFetch: FetchLike = defaultFetch;\n\n/**\n * Resolve and policy-check one destination. The returned address set is the\n * complete DNS answer that the caller is allowed to use; the transport never\n * performs a second resolver call.\n */\nexport async function resolvePinnedDestination(\n  rawUrl: string | URL,\n  settings: OutboundNetworkSettings,\n  options: ResolvePinnedDestinationOptions = {},\n): Promise<PinnedDestination> {\n  const label = options.label ?? \"Outbound request\";\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    throw new DestinationPolicyError(\"invalid_url\", `${label} URL is invalid`);\n  }\n  if (url.protocol !== \"http:\" && url.protocol !== \"https:\") {\n    throw new DestinationPolicyError(\n      \"unsupported_protocol\",\n      `${label} only supports http and https URLs`,\n    );\n  }\n  const localTestEscape = isLocalTestEnvironment(settings.environment);\n  if (options.requireHttpsOutsideLocalTest && !localTestEscape && url.protocol !== \"https:\") {\n    throw new DestinationPolicyError(\n      \"https_required\",\n      `${label} must use https outside local/test`,\n    );\n  }\n\n  const hostname = normalizeHostname(url.hostname);\n  if (!hostname) {\n    throw new DestinationPolicyError(\"invalid_url\", `${label} URL has no hostname`);\n  }\n\n  const literalFamily = isIP(hostname);\n  let addresses: readonly DnsAddress[];\n  try {\n    addresses = literalFamily\n      ? [{ address: hostname, family: literalFamily === 6 ? 6 : 4 }]\n      : await (options.dnsLookup ?? defaultDnsLookup)(hostname);\n  } catch (error) {\n    if (error instanceof DestinationPolicyError && error.reason === \"invalid_dns_answer\") {\n      throw error;\n    }\n    throw new DestinationPolicyError(\"dns_failed\", `${label} hostname could not be resolved`);\n  }\n\n  const normalizedAddresses = dedupeAddresses(addresses);\n  if (normalizedAddresses.length === 0) {\n    throw new DestinationPolicyError(\"dns_empty\", `${label} hostname has no addresses`);\n  }\n  if (normalizedAddresses.some((entry) => isInvalidAddress(entry.address))) {\n    throw new DestinationPolicyError(\n      \"invalid_dns_answer\",\n      `${label} hostname returned an invalid address`,\n    );\n  }\n\n  const privateEscape = localTestEscape || settings.integrationsAllowPrivateNetworkTargets === true;\n  if (\n    !privateEscape &&\n    (isLocalHostname(hostname) ||\n      normalizedAddresses.some((entry) => isNonPublicAddress(entry.address)))\n  ) {\n    throw new DestinationPolicyError(\n      \"private_or_special_use\",\n      `${label} may not target a private or special-use network address`,\n    );\n  }\n  return { url, hostname, addresses: normalizedAddresses };\n}\n\n/**\n * Fetch through a dispatcher whose lookup is pinned to the result of exactly\n * one policy resolution. The response body owns the one-shot agent until\n * completion, cancellation, or stream failure.\n */\nexport async function pinnedFetch(\n  input: string | URL | Request,\n  init: RequestInit | undefined,\n  settings: OutboundNetworkSettings,\n  options: PinnedFetchOptions = {},\n): Promise<Response> {\n  const rawUrl = input instanceof Request ? input.url : input;\n  const destination = await resolvePinnedDestination(rawUrl, settings, options);\n  const dispatcher =\n    options.agentFactory?.(destination.addresses) ?? createPinnedAgent(destination.addresses);\n  const fetchImpl = options.fetchImpl ?? pinnedRequestFetch;\n  const fetchInit = {\n    ...init,\n    redirect: \"manual\" as const,\n    dispatcher: dispatcher.dispatcher ?? dispatcher,\n  } as RequestInit & { dispatcher: DispatcherLifecycle };\n  let response: Response;\n  try {\n    response = await fetchImpl(input, fetchInit);\n  } catch (error) {\n    await destroyDispatcher(dispatcher, error);\n    throw error;\n  }\n  if (!response.body) {\n    await closeDispatcher(dispatcher, DISPATCHER_CLOSE_TIMEOUT_MS);\n    return response;\n  }\n  return responseWithDispatcherLifecycle(response, dispatcher, DISPATCHER_CLOSE_TIMEOUT_MS);\n}\n\nexport function isLocalTestEnvironment(environment: string): boolean {\n  return environment === \"local\" || environment === \"test\";\n}\n\n/** Return true for malformed, non-IPv4, and non-IPv6 address strings. */\nexport function isInvalidAddress(address: string): boolean {\n  return isIP(stripAddressBrackets(address.trim())) === 0;\n}\n\n/**\n * Classify private, reserved, documentation, benchmark, multicast, and other\n * special-use answers. IPv4-mapped IPv6 addresses are classified through their\n * embedded IPv4 value.\n */\nexport function isNonPublicAddress(address: string): boolean {\n  const normalized = stripAddressBrackets(address.trim().toLowerCase());\n  const family = isIP(normalized);\n  if (family === 0) {\n    return true;\n  }\n  if (family === 4) {\n    return isNonPublicIpv4(normalized);\n  }\n  const mappedText = ipv4FromMappedText(normalized);\n  if (mappedText !== null) {\n    return isNonPublicIpv4(mappedText);\n  }\n  const value = parseIpv6(normalized);\n  if (value === null) {\n    return true;\n  }\n  const mapped = ipv4FromMappedIpv6(value);\n  if (mapped !== null) {\n    return isNonPublicIpv4(mapped);\n  }\n  // Fail closed on unallocated/non-global IPv6 space. Current globally routed\n  // unicast addresses live in 2000::/3; local, transition, multicast, and\n  // future-use ranges must not become credential-bearing egress merely because\n  // they were absent from a denylist.\n  if (!hasIpv6Prefix(value, IPV6_GLOBAL_UNICAST_PREFIX, 3)) {\n    return true;\n  }\n  return IPV6_SPECIAL_PREFIXES.some(([prefix, bits]) => hasIpv6Prefix(value, prefix, bits));\n}\n\n// Backwards-compatible name used by the database token-broker API.\nexport const isPrivateAddress = isNonPublicAddress;\n\nfunction createPinnedAgent(addresses: readonly DnsAddress[]): DispatcherLifecycle {\n  const agent = new Agent({\n    connect: {\n      lookup: ((\n        _hostname: string,\n        options: { all?: boolean; family?: number },\n        callback: (\n          error: Error | null,\n          address?: string | Array<{ address: string; family: number }>,\n          family?: number,\n        ) => void,\n      ) => {\n        const candidates =\n          options.family === 4 || options.family === 6\n            ? addresses.filter((entry) => entry.family === options.family)\n            : addresses;\n        if (candidates.length === 0) {\n          callback(new Error(\"pinned DNS answer has no address for requested family\"));\n          return;\n        }\n        if (options.all) {\n          callback(\n            null,\n            candidates.map((entry) => ({\n              address: entry.address,\n              family: entry.family,\n            })),\n          );\n          return;\n        }\n        const first = candidates[0]!;\n        callback(null, first.address, first.family);\n      }) as never,\n    },\n  });\n  return {\n    dispatcher: agent,\n    close: async () => {\n      await agent.close();\n    },\n    destroy: async (error) => {\n      await agent.destroy(error instanceof Error ? error : null);\n    },\n  };\n}\n\nfunction responseWithDispatcherLifecycle(\n  response: Response,\n  dispatcher: DispatcherLifecycle,\n  closeTimeoutMs: number,\n): Response {\n  const reader = response.body!.getReader();\n  let readerReleased = false;\n  const releaseReader = () => {\n    if (readerReleased) return;\n    readerReleased = true;\n    reader.releaseLock();\n  };\n  let disposed: Promise<void> | null = null;\n  let cancelled = false;\n  const finish = (destroy: boolean, error?: unknown): Promise<void> => {\n    if (!disposed) {\n      disposed = destroy\n        ? destroyDispatcher(dispatcher, error)\n        : closeDispatcher(dispatcher, closeTimeoutMs);\n    }\n    return disposed;\n  };\n  const body = new ReadableStream<Uint8Array>({\n    async pull(controller) {\n      try {\n        const chunk = await reader.read();\n        if (chunk.done) {\n          // The dispatcher cannot finish gracefully while OpenGeni still owns\n          // the provider response's reader lock. Release it before teardown;\n          // otherwise Undici can wait forever after the complete body arrived.\n          releaseReader();\n          await finish(cancelled);\n          controller.close();\n          return;\n        }\n        controller.enqueue(chunk.value);\n      } catch (error) {\n        releaseReader();\n        await finish(true, error);\n        controller.error(error);\n      }\n    },\n    async cancel(reason) {\n      cancelled = true;\n      try {\n        await reader.cancel(reason);\n      } finally {\n        releaseReader();\n        await finish(true, reason);\n      }\n    },\n  });\n  const wrapped = new Response(body, {\n    status: response.status,\n    statusText: response.statusText,\n    headers: response.headers,\n  });\n  Object.defineProperties(wrapped, {\n    redirected: { value: response.redirected },\n    type: { value: response.type },\n    url: { value: response.url },\n  });\n  return wrapped;\n}\n\nasync function closeDispatcher(dispatcher: DispatcherLifecycle, timeoutMs: number): Promise<void> {\n  let timeout: ReturnType<typeof setTimeout> | undefined;\n  const outcome = await Promise.race([\n    Promise.resolve()\n      .then(() => dispatcher.close())\n      .then(\n        () => \"closed\" as const,\n        () => \"failed\" as const,\n      ),\n    new Promise<\"timed_out\">((resolve) => {\n      timeout = setTimeout(() => resolve(\"timed_out\"), timeoutMs);\n    }),\n  ]);\n  if (timeout) clearTimeout(timeout);\n  if (outcome !== \"closed\") {\n    // Destruction starts immediately. Do not await a provider/dispatcher\n    // shutdown promise after the bounded graceful-close deadline has elapsed.\n    void destroyDispatcher(dispatcher);\n  }\n}\n\nasync function destroyDispatcher(dispatcher: DispatcherLifecycle, error?: unknown): Promise<void> {\n  try {\n    await dispatcher.destroy(error);\n  } catch {\n    // Cleanup is best effort after the dispatcher has already failed.\n  }\n}\n\nasync function cancelResponse(response: Response): Promise<void> {\n  await response.body?.cancel().catch(() => undefined);\n}\n\nfunction normalizeHostname(hostname: string): string {\n  return stripAddressBrackets(hostname.trim().toLowerCase()).replace(/\\.$/, \"\");\n}\n\nfunction stripAddressBrackets(address: string): string {\n  return address.startsWith(\"[\") && address.endsWith(\"]\") ? address.slice(1, -1) : address;\n}\n\nfunction isLocalHostname(hostname: string): boolean {\n  return hostname === \"localhost\" || hostname.endsWith(\".localhost\");\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  const normalized = normalizeHostname(hostname);\n  return (\n    normalized === \"localhost\" ||\n    normalized.endsWith(\".localhost\") ||\n    normalized === \"::1\" ||\n    isLoopbackIpv4(normalized)\n  );\n}\n\nfunction isLoopbackIpv4(hostname: string): boolean {\n  if (isIP(hostname) !== 4) return false;\n  return hostname.split(\".\")[0] === \"127\";\n}\n\nfunction dedupeAddresses(addresses: readonly DnsAddress[]): DnsAddress[] {\n  const out: DnsAddress[] = [];\n  const seen = new Set<string>();\n  if (!Array.isArray(addresses)) {\n    throw invalidDnsAnswer();\n  }\n  for (const entry of addresses) {\n    const normalized = normalizeDnsAnswer(entry);\n    const key = `${normalized.family}:${normalized.address}`;\n    if (!seen.has(key)) {\n      seen.add(key);\n      out.push(normalized);\n    }\n  }\n  return out;\n}\n\n/**\n * Validate resolver metadata before it can influence either policy checks or\n * the pinned dispatcher. Never infer a family from the address while retaining\n * a conflicting resolver claim: an invalid answer is an invalid answer.\n */\nfunction normalizeDnsAnswer(entry: unknown): DnsAddress {\n  if (!entry || typeof entry !== \"object\") {\n    throw invalidDnsAnswer();\n  }\n  const candidate = entry as { address?: unknown; family?: unknown };\n  if (typeof candidate.address !== \"string\") {\n    throw invalidDnsAnswer();\n  }\n  const family = candidate.family;\n  if (family !== 4 && family !== 6) {\n    throw invalidDnsAnswer();\n  }\n  const address = stripAddressBrackets(candidate.address.trim().toLowerCase());\n  const actualFamily = isIP(address);\n  if (actualFamily !== family) {\n    throw invalidDnsAnswer();\n  }\n  return { address, family };\n}\n\nfunction invalidDnsAnswer(): DestinationPolicyError {\n  return new DestinationPolicyError(\n    \"invalid_dns_answer\",\n    \"hostname returned an invalid DNS answer\",\n  );\n}\n\nfunction isNonPublicIpv4(address: string): boolean {\n  const parts = address.split(\".\").map(Number);\n  if (\n    parts.length !== 4 ||\n    parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)\n  ) {\n    return true;\n  }\n  const value = (parts[0]! << 24) | (parts[1]! << 16) | (parts[2]! << 8) | parts[3]!;\n  const unsigned = value >>> 0;\n  return (\n    inIpv4Range(unsigned, 0x00000000, 0x00ffffff) ||\n    inIpv4Range(unsigned, 0x0a000000, 0x0affffff) ||\n    inIpv4Range(unsigned, 0x64400000, 0x647fffff) ||\n    inIpv4Range(unsigned, 0x7f000000, 0x7fffffff) ||\n    inIpv4Range(unsigned, 0xa9fe0000, 0xa9feffff) ||\n    inIpv4Range(unsigned, 0xac100000, 0xac1fffff) ||\n    inIpv4Range(unsigned, 0xc0000000, 0xc00000ff) ||\n    inIpv4Range(unsigned, 0xc0000200, 0xc00002ff) ||\n    inIpv4Range(unsigned, 0xc01fc400, 0xc01fc4ff) ||\n    inIpv4Range(unsigned, 0xc034c100, 0xc034c1ff) ||\n    inIpv4Range(unsigned, 0xc0586300, 0xc05863ff) ||\n    inIpv4Range(unsigned, 0xc0a80000, 0xc0a8ffff) ||\n    inIpv4Range(unsigned, 0xc0af3000, 0xc0af30ff) ||\n    inIpv4Range(unsigned, 0xc6120000, 0xc613ffff) ||\n    inIpv4Range(unsigned, 0xc6336400, 0xc63364ff) ||\n    inIpv4Range(unsigned, 0xcb007100, 0xcb0071ff) ||\n    inIpv4Range(unsigned, 0xe0000000, 0xffffffff)\n  );\n}\n\nfunction inIpv4Range(value: number, start: number, end: number): boolean {\n  return value >= start && value <= end;\n}\n\nconst IPV6_GLOBAL_UNICAST_PREFIX = ipv6Constant(\"2000::\");\n\nconst IPV6_SPECIAL_PREFIXES: readonly [bigint, number][] = [\n  [ipv6Constant(\"::\"), 96],\n  [ipv6Constant(\"64:ff9b::\"), 96],\n  [ipv6Constant(\"64:ff9b:1::\"), 48],\n  [ipv6Constant(\"100::\"), 64],\n  // IETF protocol assignments contain globally reachable carve-outs, but they\n  // are control-plane anycast/protocol addresses rather than integration\n  // endpoints. Credential-bearing MCP/OAuth egress fails closed on the full\n  // special-purpose block.\n  [ipv6Constant(\"2001::\"), 23],\n  [ipv6Constant(\"2001:db8::\"), 32],\n  [ipv6Constant(\"2002::\"), 16],\n  [ipv6Constant(\"2620:4f:8000::\"), 48],\n  [ipv6Constant(\"3ffe::\"), 16],\n  [ipv6Constant(\"3fff::\"), 20],\n  [ipv6Constant(\"5f00::\"), 16],\n  [ipv6Constant(\"fc00::\"), 7],\n  [ipv6Constant(\"fe80::\"), 10],\n  [ipv6Constant(\"fec0::\"), 10],\n  [ipv6Constant(\"ff00::\"), 8],\n];\n\nfunction hasIpv6Prefix(value: bigint, prefix: bigint, bits: number): boolean {\n  const shift = 128n - BigInt(bits);\n  return value >> shift === prefix >> shift;\n}\n\nfunction ipv4FromMappedIpv6(value: bigint): string | null {\n  if (value >> 32n !== 0xffffn) {\n    return null;\n  }\n  const embedded = Number(value & 0xffffffffn);\n  return `${embedded >>> 24}.${(embedded >>> 16) & 0xff}.${(embedded >>> 8) & 0xff}.${embedded & 0xff}`;\n}\n\nfunction ipv4FromMappedText(address: string): string | null {\n  if (!address.startsWith(\"::ffff:\")) {\n    return null;\n  }\n  const embedded = address.slice(\"::ffff:\".length);\n  if (isIP(embedded) === 4) {\n    return embedded;\n  }\n  const parts = embedded.split(\":\");\n  if (parts.length !== 2 || parts.some((part) => !/^[0-9a-f]{1,4}$/.test(part))) {\n    return null;\n  }\n  const high = Number.parseInt(parts[0]!, 16);\n  const low = Number.parseInt(parts[1]!, 16);\n  return `${(high >> 8) & 0xff}.${high & 0xff}.${(low >> 8) & 0xff}.${low & 0xff}`;\n}\n\nfunction parseIpv6(address: string): bigint | null {\n  const percent = address.indexOf(\"%\");\n  if (percent >= 0) {\n    return null;\n  }\n  let value = address;\n  if (value.includes(\".\")) {\n    const lastColon = value.lastIndexOf(\":\");\n    const dotted = value.slice(lastColon + 1);\n    const parts = dotted.split(\".\").map(Number);\n    if (\n      parts.length !== 4 ||\n      parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)\n    ) {\n      return null;\n    }\n    const hex =\n      ((parts[0]! << 8) | parts[1]!).toString(16).padStart(4, \"0\") +\n      ((parts[2]! << 8) | parts[3]!).toString(16).padStart(4, \"0\");\n    value = `${value.slice(0, lastColon + 1)}${hex}`;\n  }\n  const halves = value.split(\"::\");\n  if (halves.length > 2) {\n    return null;\n  }\n  const left = halves[0] ? halves[0].split(\":\") : [];\n  const right = halves.length === 2 && halves[1] ? halves[1].split(\":\") : [];\n  if (left.concat(right).some((part) => !/^[0-9a-f]{1,4}$/i.test(part))) {\n    return null;\n  }\n  const missing = halves.length === 2 ? 8 - left.length - right.length : 0;\n  if (missing < 0 || (halves.length === 1 && missing !== 0)) {\n    return null;\n  }\n  const groups = [...left, ...Array.from({ length: missing }, () => \"0\"), ...right];\n  if (groups.length !== 8) {\n    return null;\n  }\n  return groups.reduce((acc, group) => (acc << 16n) | BigInt(`0x${group}`), 0n);\n}\n\nfunction ipv6Constant(address: string): bigint {\n  const value = parseIpv6(address);\n  if (value === null) {\n    throw new Error(`invalid IPv6 constant: ${address}`);\n  }\n  return value;\n}\n"],"mappings":";AAEA,SAAS,OAAO,SAAS,iBAAiB,WAAW,yBAAyB;AAC9E,SAAS,UAAU,kBAAkB;AACrC,SAAS,YAAY;AAqCrB,IAAM,8BAA8B;AAE7B,IAAM,2BAA2B,OAAO;AAQxC,SAAS,gBAAgB,QAAgB,UAAoC,CAAC,GAAW;AAC9F,QAAM,QAAQ,QAAQ,SAAS;AAC/B,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,MAAM;AAAA,EACtB,QAAQ;AACN,UAAM,IAAI,uBAAuB,eAAe,GAAG,KAAK,iBAAiB;AAAA,EAC3E;AACA,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU;AACzD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AACA,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,UAAM,IAAI,uBAAuB,eAAe,GAAG,KAAK,kCAAkC;AAAA,EAC5F;AACA,MAAI,IAAI,MAAM;AACZ,UAAM,IAAI,uBAAuB,eAAe,GAAG,KAAK,iCAAiC;AAAA,EAC3F;AACA,MACE,IAAI,aAAa,WACjB,EAAE,QAAQ,qBAAqB,mBAAmB,IAAI,QAAQ,IAC9D;AACA,UAAM,IAAI,uBAAuB,kBAAkB,GAAG,KAAK,iBAAiB;AAAA,EAC9E;AACA,SAAO,IAAI,SAAS;AACtB;AAOO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YACW,OACA,aACA,UACA,QACT;AACA,UAAM,GAAG,KAAK,iBAAiB,QAAQ,sBAAsB;AALpD;AACA;AACA;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AACF;AAGO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAC9C,YAAqB,OAAe;AAClC,UAAM,GAAG,KAAK,YAAY;AADP;AAEnB,SAAK,OAAO;AAAA,EACd;AACF;AAcA,eAAsB,wBACpB,UACA,UACA,OACA,UAAsC,CAAC,GAClB;AACrB,MAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAW,GAAG;AACnD,UAAM,IAAI,WAAW,yDAAyD;AAAA,EAChF;AACA,QAAM,WAAW,SAAS,QAAQ,IAAI,gBAAgB;AACtD,MAAI,aAAa,MAAM;AACrB,UAAM,aAAa,SAAS,KAAK;AACjC,QAAI,CAAC,QAAQ,KAAK,UAAU,GAAG;AAC7B,YAAM,eAAe,QAAQ;AAC7B,YAAM,IAAI,uBAAuB,OAAO,GAAG,UAAU,wBAAwB;AAAA,IAC/E;AACA,UAAM,gBAAgB,OAAO,UAAU;AACvC,QAAI,CAAC,OAAO,cAAc,aAAa,KAAK,gBAAgB,UAAU;AACpE,YAAM,eAAe,QAAQ;AAC7B,YAAM,IAAI,uBAAuB,OAAO,eAAe,UAAU,iBAAiB;AAAA,IACpF;AAAA,EACF;AACA,MAAI,CAAC,SAAS,MAAM;AAClB,WAAO,IAAI,WAAW;AAAA,EACxB;AAEA,QAAM,SAAS,SAAS,KAAK,UAAU;AACvC,QAAM,SAAuB,CAAC;AAC9B,MAAI,gBAAgB;AACpB,MAAI;AACF,eAAS;AACP,YAAM,SAAS,MAAM,gBAAgB,QAAQ,QAAQ,QAAQ,KAAK;AAClE,UAAI,OAAO,MAAM;AACf;AAAA,MACF;AACA,uBAAiB,OAAO,MAAM;AAC9B,UAAI,gBAAgB,UAAU;AAC5B,cAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,cAAM,IAAI,uBAAuB,OAAO,eAAe,UAAU,iBAAiB;AAAA,MACpF;AACA,aAAO,KAAK,OAAO,KAAK;AAAA,IAC1B;AAAA,EACF,SAAS,OAAO;AACd,SAAK,OAAO,OAAO,KAAK,EAAE,MAAM,MAAM,MAAS;AAC/C,UAAM;AAAA,EACR,UAAE;AACA,QAAI;AACF,aAAO,YAAY;AAAA,IACrB,QAAQ;AAAA,IAGR;AAAA,EACF;AAEA,QAAM,OAAO,IAAI,WAAW,aAAa;AACzC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,SAAK,IAAI,OAAO,MAAM;AACtB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAEA,eAAsB,wBACpB,UACA,UACA,OACA,UAAsC,CAAC,GACtB;AACjB,SAAO,IAAI,YAAY,EAAE;AAAA,IACvB,MAAM,wBAAwB,UAAU,UAAU,OAAO,OAAO;AAAA,EAClE;AACF;AAEA,eAAsB,wBACpB,UACA,UACA,OACA,UAAsC,CAAC,GAC3B;AACZ,SAAO,KAAK,MAAM,MAAM,wBAAwB,UAAU,UAAU,OAAO,OAAO,CAAC;AACrF;AAMA,eAAe,gBACb,QACA,QACA,OACmC;AACnC,MAAI,CAAC,OAAQ,QAAO,MAAM,OAAO,KAAK;AACtC,MAAI,OAAO,QAAS,OAAM,IAAI,qBAAqB,KAAK;AACxD,SAAO,MAAM,IAAI,QAAkC,CAAC,SAAS,WAAW;AACtE,QAAI,UAAU;AACd,UAAM,SAAS,CAAC,aAAyB;AACvC,UAAI,QAAS;AACb,gBAAU;AACV,aAAO,oBAAoB,SAAS,OAAO;AAC3C,eAAS;AAAA,IACX;AACA,UAAM,UAAU,MAAM;AACpB,YAAM,QAAQ,IAAI,qBAAqB,KAAK;AAC5C,WAAK,OAAO,OAAO,KAAK,EAAE,MAAM,MAAM,MAAS;AAC/C,aAAO,MAAM,OAAO,KAAK,CAAC;AAAA,IAC5B;AACA,WAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,SAAK,OAAO,KAAK,EAAE;AAAA,MACjB,CAAC,WAAW,OAAO,MAAM,QAAQ,MAAM,CAAC;AAAA,MACxC,CAAC,UAAU,OAAO,MAAM,OAAO,KAAK,CAAC;AAAA,IACvC;AAAA,EACF,CAAC;AACH;AAiBO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YACW,QACT,SACA;AACA,UAAM,OAAO;AAHJ;AAIT,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,mBAA8B,OAAO,aAAa;AACtD,QAAM,UAAU,MAAM,WAAW,UAAU,EAAE,KAAK,KAAK,CAAC;AACxD,SAAO,QAAQ,IAAI,CAAC,UAAU,mBAAmB,KAAK,CAAC;AACzD;AAEA,IAAM,eAA0B,CAAC,OAAO,SACrC,gBAAyC,OAAO,IAAI;AAEvD,IAAM,qBAAgC,OAAO,OAAO,SAAS;AAC3D,QAAM,SAAS,iBAAiB,UAAU,QAAQ;AAClD,QAAM,MAAM,QAAQ,OAAO,MAAM,SAAS;AAC1C,QAAM,SAAS,MAAM,UAAU,QAAQ,UAAU;AACjD,QAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;AAC3C,MAAI,MAAM,SAAS;AACjB,QAAI,QAAQ,KAAK,OAAO,EAAE,QAAQ,CAAC,OAAO,SAAS,QAAQ,IAAI,MAAM,KAAK,CAAC;AAAA,EAC7E;AAGA,MAAI,CAAC,QAAQ,IAAI,iBAAiB,EAAG,SAAQ,IAAI,mBAAmB,UAAU;AAC9E,QAAM,UAAU,MAAM,SAAS,WAAW,SAAS,WAAW,SAAS,QAAQ,OAAO;AACtF,QAAM,OAAO,MAAM,2BAA2B,SAAS,OAAO;AAC9D,QAAM,aAAc,MAA+D;AACnF,QAAM,SAAS,MAAM,kBAAkB,KAAK;AAAA,IAC1C;AAAA,IACA;AAAA,IACA,GAAI,SAAS,UAAa,SAAS,OAAO,EAAE,KAAoB,IAAI,CAAC;AAAA,IACrE,GAAI,MAAM,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IAC3F,GAAI,aAAa,EAAE,WAAgC,IAAI,CAAC;AAAA,IACxD,iBAAiB;AAAA,EACnB,CAAC;AACD,QAAM,WAAW,OAAO,KAAK,OAAO,aAAa,EAAE;AACnD,QAAM,eAAe,IAAI,eAA2B;AAAA,IAClD,MAAM,KAAK,YAAY;AACrB,UAAI;AACF,cAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,YAAI,MAAM,MAAM;AACd,qBAAW,MAAM;AACjB;AAAA,QACF;AACA,mBAAW;AAAA,UACT,MAAM,iBAAiB,aAAa,MAAM,QAAQ,IAAI,WAAW,MAAM,KAAK;AAAA,QAC9E;AAAA,MACF,SAAS,OAAO;AACd,mBAAW,MAAM,KAAK;AAAA,MACxB;AAAA,IACF;AAAA,IACA,MAAM,OAAO,QAAQ;AACnB,aAAO,KAAK,QAAQ,kBAAkB,QAAQ,SAAS,MAAS;AAChE,YAAM,SAAS,SAAS;AAAA,IAC1B;AAAA,EACF,CAAC;AACD,QAAM,kBAAkB,IAAI,QAAQ;AACpC,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AAC1D,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,iBAAW,SAAS,MAAO,iBAAgB,OAAO,MAAM,KAAK;AAAA,IAC/D,WAAW,UAAU,QAAW;AAC9B,sBAAgB,IAAI,MAAM,KAAK;AAAA,IACjC;AAAA,EACF;AACA,QAAM,WAAW,IAAI,SAAS,cAAc;AAAA,IAC1C,QAAQ,OAAO;AAAA,IACf,SAAS;AAAA,EACX,CAAC;AACD,SAAO,eAAe,UAAU,OAAO,EAAE,OAAO,IAAI,CAAC;AACrD,SAAO;AACT;AAOA,eAAe,2BACb,MACA,SACmD;AACnD,MAAI,gBAAgB,iBAAiB;AACnC,QAAI,CAAC,QAAQ,IAAI,cAAc,GAAG;AAChC,cAAQ,IAAI,gBAAgB,iDAAiD;AAAA,IAC/E;AACA,WAAO,KAAK,SAAS;AAAA,EACvB;AACA,MAAI,gBAAgB,MAAM;AACxB,QAAI,KAAK,QAAQ,CAAC,QAAQ,IAAI,cAAc,EAAG,SAAQ,IAAI,gBAAgB,KAAK,IAAI;AACpF,WAAO,IAAI,WAAW,MAAM,KAAK,YAAY,CAAC;AAAA,EAChD;AACA,MAAI,gBAAgB,YAAa,QAAO,IAAI,WAAW,IAAI;AAC3D,MAAI,YAAY,OAAO,IAAI,GAAG;AAC5B,WAAO,IAAI,WAAW,KAAK,QAAQ,KAAK,YAAY,KAAK,UAAU;AAAA,EACrE;AACA,SAAO;AACT;AAGO,IAAM,cAAyB;AAOtC,eAAsB,yBACpB,QACA,UACA,UAA2C,CAAC,GAChB;AAC5B,QAAM,QAAQ,QAAQ,SAAS;AAC/B,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,MAAM;AAAA,EACtB,QAAQ;AACN,UAAM,IAAI,uBAAuB,eAAe,GAAG,KAAK,iBAAiB;AAAA,EAC3E;AACA,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU;AACzD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AACA,QAAM,kBAAkB,uBAAuB,SAAS,WAAW;AACnE,MAAI,QAAQ,gCAAgC,CAAC,mBAAmB,IAAI,aAAa,UAAU;AACzF,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AAEA,QAAM,WAAW,kBAAkB,IAAI,QAAQ;AAC/C,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,uBAAuB,eAAe,GAAG,KAAK,sBAAsB;AAAA,EAChF;AAEA,QAAM,gBAAgB,KAAK,QAAQ;AACnC,MAAI;AACJ,MAAI;AACF,gBAAY,gBACR,CAAC,EAAE,SAAS,UAAU,QAAQ,kBAAkB,IAAI,IAAI,EAAE,CAAC,IAC3D,OAAO,QAAQ,aAAa,kBAAkB,QAAQ;AAAA,EAC5D,SAAS,OAAO;AACd,QAAI,iBAAiB,0BAA0B,MAAM,WAAW,sBAAsB;AACpF,YAAM;AAAA,IACR;AACA,UAAM,IAAI,uBAAuB,cAAc,GAAG,KAAK,iCAAiC;AAAA,EAC1F;AAEA,QAAM,sBAAsB,gBAAgB,SAAS;AACrD,MAAI,oBAAoB,WAAW,GAAG;AACpC,UAAM,IAAI,uBAAuB,aAAa,GAAG,KAAK,4BAA4B;AAAA,EACpF;AACA,MAAI,oBAAoB,KAAK,CAAC,UAAU,iBAAiB,MAAM,OAAO,CAAC,GAAG;AACxE,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AAEA,QAAM,gBAAgB,mBAAmB,SAAS,2CAA2C;AAC7F,MACE,CAAC,kBACA,gBAAgB,QAAQ,KACvB,oBAAoB,KAAK,CAAC,UAAU,mBAAmB,MAAM,OAAO,CAAC,IACvE;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AACA,SAAO,EAAE,KAAK,UAAU,WAAW,oBAAoB;AACzD;AAOA,eAAsB,YACpB,OACA,MACA,UACA,UAA8B,CAAC,GACZ;AACnB,QAAM,SAAS,iBAAiB,UAAU,MAAM,MAAM;AACtD,QAAM,cAAc,MAAM,yBAAyB,QAAQ,UAAU,OAAO;AAC5E,QAAM,aACJ,QAAQ,eAAe,YAAY,SAAS,KAAK,kBAAkB,YAAY,SAAS;AAC1F,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,YAAY;AAAA,IAChB,GAAG;AAAA,IACH,UAAU;AAAA,IACV,YAAY,WAAW,cAAc;AAAA,EACvC;AACA,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,UAAU,OAAO,SAAS;AAAA,EAC7C,SAAS,OAAO;AACd,UAAM,kBAAkB,YAAY,KAAK;AACzC,UAAM;AAAA,EACR;AACA,MAAI,CAAC,SAAS,MAAM;AAClB,UAAM,gBAAgB,YAAY,2BAA2B;AAC7D,WAAO;AAAA,EACT;AACA,SAAO,gCAAgC,UAAU,YAAY,2BAA2B;AAC1F;AAEO,SAAS,uBAAuB,aAA8B;AACnE,SAAO,gBAAgB,WAAW,gBAAgB;AACpD;AAGO,SAAS,iBAAiB,SAA0B;AACzD,SAAO,KAAK,qBAAqB,QAAQ,KAAK,CAAC,CAAC,MAAM;AACxD;AAOO,SAAS,mBAAmB,SAA0B;AAC3D,QAAM,aAAa,qBAAqB,QAAQ,KAAK,EAAE,YAAY,CAAC;AACpE,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI,WAAW,GAAG;AAChB,WAAO;AAAA,EACT;AACA,MAAI,WAAW,GAAG;AAChB,WAAO,gBAAgB,UAAU;AAAA,EACnC;AACA,QAAM,aAAa,mBAAmB,UAAU;AAChD,MAAI,eAAe,MAAM;AACvB,WAAO,gBAAgB,UAAU;AAAA,EACnC;AACA,QAAM,QAAQ,UAAU,UAAU;AAClC,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AACA,QAAM,SAAS,mBAAmB,KAAK;AACvC,MAAI,WAAW,MAAM;AACnB,WAAO,gBAAgB,MAAM;AAAA,EAC/B;AAKA,MAAI,CAAC,cAAc,OAAO,4BAA4B,CAAC,GAAG;AACxD,WAAO;AAAA,EACT;AACA,SAAO,sBAAsB,KAAK,CAAC,CAAC,QAAQ,IAAI,MAAM,cAAc,OAAO,QAAQ,IAAI,CAAC;AAC1F;AAGO,IAAM,mBAAmB;AAEhC,SAAS,kBAAkB,WAAuD;AAChF,QAAM,QAAQ,IAAI,MAAM;AAAA,IACtB,SAAS;AAAA,MACP,QAAS,CACP,WACA,SACA,aAKG;AACH,cAAM,aACJ,QAAQ,WAAW,KAAK,QAAQ,WAAW,IACvC,UAAU,OAAO,CAAC,UAAU,MAAM,WAAW,QAAQ,MAAM,IAC3D;AACN,YAAI,WAAW,WAAW,GAAG;AAC3B,mBAAS,IAAI,MAAM,uDAAuD,CAAC;AAC3E;AAAA,QACF;AACA,YAAI,QAAQ,KAAK;AACf;AAAA,YACE;AAAA,YACA,WAAW,IAAI,CAAC,WAAW;AAAA,cACzB,SAAS,MAAM;AAAA,cACf,QAAQ,MAAM;AAAA,YAChB,EAAE;AAAA,UACJ;AACA;AAAA,QACF;AACA,cAAM,QAAQ,WAAW,CAAC;AAC1B,iBAAS,MAAM,MAAM,SAAS,MAAM,MAAM;AAAA,MAC5C;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,OAAO,YAAY;AACjB,YAAM,MAAM,MAAM;AAAA,IACpB;AAAA,IACA,SAAS,OAAO,UAAU;AACxB,YAAM,MAAM,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI;AAAA,IAC3D;AAAA,EACF;AACF;AAEA,SAAS,gCACP,UACA,YACA,gBACU;AACV,QAAM,SAAS,SAAS,KAAM,UAAU;AACxC,MAAI,iBAAiB;AACrB,QAAM,gBAAgB,MAAM;AAC1B,QAAI,eAAgB;AACpB,qBAAiB;AACjB,WAAO,YAAY;AAAA,EACrB;AACA,MAAI,WAAiC;AACrC,MAAI,YAAY;AAChB,QAAM,SAAS,CAAC,SAAkB,UAAmC;AACnE,QAAI,CAAC,UAAU;AACb,iBAAW,UACP,kBAAkB,YAAY,KAAK,IACnC,gBAAgB,YAAY,cAAc;AAAA,IAChD;AACA,WAAO;AAAA,EACT;AACA,QAAM,OAAO,IAAI,eAA2B;AAAA,IAC1C,MAAM,KAAK,YAAY;AACrB,UAAI;AACF,cAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,YAAI,MAAM,MAAM;AAId,wBAAc;AACd,gBAAM,OAAO,SAAS;AACtB,qBAAW,MAAM;AACjB;AAAA,QACF;AACA,mBAAW,QAAQ,MAAM,KAAK;AAAA,MAChC,SAAS,OAAO;AACd,sBAAc;AACd,cAAM,OAAO,MAAM,KAAK;AACxB,mBAAW,MAAM,KAAK;AAAA,MACxB;AAAA,IACF;AAAA,IACA,MAAM,OAAO,QAAQ;AACnB,kBAAY;AACZ,UAAI;AACF,cAAM,OAAO,OAAO,MAAM;AAAA,MAC5B,UAAE;AACA,sBAAc;AACd,cAAM,OAAO,MAAM,MAAM;AAAA,MAC3B;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,UAAU,IAAI,SAAS,MAAM;AAAA,IACjC,QAAQ,SAAS;AAAA,IACjB,YAAY,SAAS;AAAA,IACrB,SAAS,SAAS;AAAA,EACpB,CAAC;AACD,SAAO,iBAAiB,SAAS;AAAA,IAC/B,YAAY,EAAE,OAAO,SAAS,WAAW;AAAA,IACzC,MAAM,EAAE,OAAO,SAAS,KAAK;AAAA,IAC7B,KAAK,EAAE,OAAO,SAAS,IAAI;AAAA,EAC7B,CAAC;AACD,SAAO;AACT;AAEA,eAAe,gBAAgB,YAAiC,WAAkC;AAChG,MAAI;AACJ,QAAM,UAAU,MAAM,QAAQ,KAAK;AAAA,IACjC,QAAQ,QAAQ,EACb,KAAK,MAAM,WAAW,MAAM,CAAC,EAC7B;AAAA,MACC,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAAA,IACF,IAAI,QAAqB,CAAC,YAAY;AACpC,gBAAU,WAAW,MAAM,QAAQ,WAAW,GAAG,SAAS;AAAA,IAC5D,CAAC;AAAA,EACH,CAAC;AACD,MAAI,QAAS,cAAa,OAAO;AACjC,MAAI,YAAY,UAAU;AAGxB,SAAK,kBAAkB,UAAU;AAAA,EACnC;AACF;AAEA,eAAe,kBAAkB,YAAiC,OAAgC;AAChG,MAAI;AACF,UAAM,WAAW,QAAQ,KAAK;AAAA,EAChC,QAAQ;AAAA,EAER;AACF;AAEA,eAAe,eAAe,UAAmC;AAC/D,QAAM,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AACrD;AAEA,SAAS,kBAAkB,UAA0B;AACnD,SAAO,qBAAqB,SAAS,KAAK,EAAE,YAAY,CAAC,EAAE,QAAQ,OAAO,EAAE;AAC9E;AAEA,SAAS,qBAAqB,SAAyB;AACrD,SAAO,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,IAAI,QAAQ,MAAM,GAAG,EAAE,IAAI;AACnF;AAEA,SAAS,gBAAgB,UAA2B;AAClD,SAAO,aAAa,eAAe,SAAS,SAAS,YAAY;AACnE;AAEA,SAAS,mBAAmB,UAA2B;AACrD,QAAM,aAAa,kBAAkB,QAAQ;AAC7C,SACE,eAAe,eACf,WAAW,SAAS,YAAY,KAChC,eAAe,SACf,eAAe,UAAU;AAE7B;AAEA,SAAS,eAAe,UAA2B;AACjD,MAAI,KAAK,QAAQ,MAAM,EAAG,QAAO;AACjC,SAAO,SAAS,MAAM,GAAG,EAAE,CAAC,MAAM;AACpC;AAEA,SAAS,gBAAgB,WAAgD;AACvE,QAAM,MAAoB,CAAC;AAC3B,QAAM,OAAO,oBAAI,IAAY;AAC7B,MAAI,CAAC,MAAM,QAAQ,SAAS,GAAG;AAC7B,UAAM,iBAAiB;AAAA,EACzB;AACA,aAAW,SAAS,WAAW;AAC7B,UAAM,aAAa,mBAAmB,KAAK;AAC3C,UAAM,MAAM,GAAG,WAAW,MAAM,IAAI,WAAW,OAAO;AACtD,QAAI,CAAC,KAAK,IAAI,GAAG,GAAG;AAClB,WAAK,IAAI,GAAG;AACZ,UAAI,KAAK,UAAU;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAOA,SAAS,mBAAmB,OAA4B;AACtD,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,UAAM,iBAAiB;AAAA,EACzB;AACA,QAAM,YAAY;AAClB,MAAI,OAAO,UAAU,YAAY,UAAU;AACzC,UAAM,iBAAiB;AAAA,EACzB;AACA,QAAM,SAAS,UAAU;AACzB,MAAI,WAAW,KAAK,WAAW,GAAG;AAChC,UAAM,iBAAiB;AAAA,EACzB;AACA,QAAM,UAAU,qBAAqB,UAAU,QAAQ,KAAK,EAAE,YAAY,CAAC;AAC3E,QAAM,eAAe,KAAK,OAAO;AACjC,MAAI,iBAAiB,QAAQ;AAC3B,UAAM,iBAAiB;AAAA,EACzB;AACA,SAAO,EAAE,SAAS,OAAO;AAC3B;AAEA,SAAS,mBAA2C;AAClD,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,SAA0B;AACjD,QAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,IAAI,MAAM;AAC3C,MACE,MAAM,WAAW,KACjB,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,GAAG,GACtE;AACA,WAAO;AAAA,EACT;AACA,QAAM,QAAS,MAAM,CAAC,KAAM,KAAO,MAAM,CAAC,KAAM,KAAO,MAAM,CAAC,KAAM,IAAK,MAAM,CAAC;AAChF,QAAM,WAAW,UAAU;AAC3B,SACE,YAAY,UAAU,GAAY,QAAU,KAC5C,YAAY,UAAU,WAAY,SAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU;AAEhD;AAEA,SAAS,YAAY,OAAe,OAAe,KAAsB;AACvE,SAAO,SAAS,SAAS,SAAS;AACpC;AAEA,IAAM,6BAA6B,aAAa,QAAQ;AAExD,IAAM,wBAAqD;AAAA,EACzD,CAAC,aAAa,IAAI,GAAG,EAAE;AAAA,EACvB,CAAC,aAAa,WAAW,GAAG,EAAE;AAAA,EAC9B,CAAC,aAAa,aAAa,GAAG,EAAE;AAAA,EAChC,CAAC,aAAa,OAAO,GAAG,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1B,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,YAAY,GAAG,EAAE;AAAA,EAC/B,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,gBAAgB,GAAG,EAAE;AAAA,EACnC,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,QAAQ,GAAG,CAAC;AAAA,EAC1B,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,QAAQ,GAAG,CAAC;AAC5B;AAEA,SAAS,cAAc,OAAe,QAAgB,MAAuB;AAC3E,QAAM,QAAQ,OAAO,OAAO,IAAI;AAChC,SAAO,SAAS,UAAU,UAAU;AACtC;AAEA,SAAS,mBAAmB,OAA8B;AACxD,MAAI,SAAS,QAAQ,SAAS;AAC5B,WAAO;AAAA,EACT;AACA,QAAM,WAAW,OAAO,QAAQ,WAAW;AAC3C,SAAO,GAAG,aAAa,EAAE,IAAK,aAAa,KAAM,GAAI,IAAK,aAAa,IAAK,GAAI,IAAI,WAAW,GAAI;AACrG;AAEA,SAAS,mBAAmB,SAAgC;AAC1D,MAAI,CAAC,QAAQ,WAAW,SAAS,GAAG;AAClC,WAAO;AAAA,EACT;AACA,QAAM,WAAW,QAAQ,MAAM,UAAU,MAAM;AAC/C,MAAI,KAAK,QAAQ,MAAM,GAAG;AACxB,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,SAAS,MAAM,GAAG;AAChC,MAAI,MAAM,WAAW,KAAK,MAAM,KAAK,CAAC,SAAS,CAAC,kBAAkB,KAAK,IAAI,CAAC,GAAG;AAC7E,WAAO;AAAA,EACT;AACA,QAAM,OAAO,OAAO,SAAS,MAAM,CAAC,GAAI,EAAE;AAC1C,QAAM,MAAM,OAAO,SAAS,MAAM,CAAC,GAAI,EAAE;AACzC,SAAO,GAAI,QAAQ,IAAK,GAAI,IAAI,OAAO,GAAI,IAAK,OAAO,IAAK,GAAI,IAAI,MAAM,GAAI;AAChF;AAEA,SAAS,UAAU,SAAgC;AACjD,QAAM,UAAU,QAAQ,QAAQ,GAAG;AACnC,MAAI,WAAW,GAAG;AAChB,WAAO;AAAA,EACT;AACA,MAAI,QAAQ;AACZ,MAAI,MAAM,SAAS,GAAG,GAAG;AACvB,UAAM,YAAY,MAAM,YAAY,GAAG;AACvC,UAAM,SAAS,MAAM,MAAM,YAAY,CAAC;AACxC,UAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,IAAI,MAAM;AAC1C,QACE,MAAM,WAAW,KACjB,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,GAAG,GACtE;AACA,aAAO;AAAA,IACT;AACA,UAAM,OACF,MAAM,CAAC,KAAM,IAAK,MAAM,CAAC,GAAI,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,KACzD,MAAM,CAAC,KAAM,IAAK,MAAM,CAAC,GAAI,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC7D,YAAQ,GAAG,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,GAAG;AAAA,EAChD;AACA,QAAM,SAAS,MAAM,MAAM,IAAI;AAC/B,MAAI,OAAO,SAAS,GAAG;AACrB,WAAO;AAAA,EACT;AACA,QAAM,OAAO,OAAO,CAAC,IAAI,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;AACjD,QAAM,QAAQ,OAAO,WAAW,KAAK,OAAO,CAAC,IAAI,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;AACzE,MAAI,KAAK,OAAO,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,mBAAmB,KAAK,IAAI,CAAC,GAAG;AACrE,WAAO;AAAA,EACT;AACA,QAAM,UAAU,OAAO,WAAW,IAAI,IAAI,KAAK,SAAS,MAAM,SAAS;AACvE,MAAI,UAAU,KAAM,OAAO,WAAW,KAAK,YAAY,GAAI;AACzD,WAAO;AAAA,EACT;AACA,QAAM,SAAS,CAAC,GAAG,MAAM,GAAG,MAAM,KAAK,EAAE,QAAQ,QAAQ,GAAG,MAAM,GAAG,GAAG,GAAG,KAAK;AAChF,MAAI,OAAO,WAAW,GAAG;AACvB,WAAO;AAAA,EACT;AACA,SAAO,OAAO,OAAO,CAAC,KAAK,UAAW,OAAO,MAAO,OAAO,KAAK,KAAK,EAAE,GAAG,EAAE;AAC9E;AAEA,SAAS,aAAa,SAAyB;AAC7C,QAAM,QAAQ,UAAU,OAAO;AAC/B,MAAI,UAAU,MAAM;AAClB,UAAM,IAAI,MAAM,0BAA0B,OAAO,EAAE;AAAA,EACrD;AACA,SAAO;AACT;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/network",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "DNS-pinned outbound HTTP transport for OpenGeni credential-bearing requests.",
   "license": "Apache-2.0",
   "repository": {
@@ -29,8 +29,8 @@
     "provenance": true
   },
   "scripts": {
-    "build": "tsup",
-    "typecheck": "tsgo --noEmit",
+    "build": "bun ../../scripts/build-typescript-package.ts",
+    "typecheck": "tsc --noEmit",
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {

package/src/index.ts

@@ -1,6 +1,6 @@
 // The explicit entrypoint avoids Bun's native `undici` compatibility shim,
 // which exposes an Agent-shaped object without Dispatcher methods.
-import { Agent, fetch as undiciFetchImpl } from "undici/index.js";
+import { Agent, fetch as undiciFetchImpl, request as undiciRequestImpl } from "undici/index.js";
 import { lookup as nodeLookup } from "node:dns/promises";
 import { isIP } from "node:net";
 
@@ -39,6 +39,8 @@ export type PinnedFetchOptions = {
   requireHttpsOutsideLocalTest?: boolean;
 };
 
+const DISPATCHER_CLOSE_TIMEOUT_MS = 100;
+
 export const OAUTH_MAX_RESPONSE_BYTES = 1024 * 1024;
 
 export type HttpUrlValidationOptions = {
@@ -93,6 +95,18 @@ export class ResponseBodyLimitError extends Error {
   }
 }
 
+/** Raised when a caller-supplied absolute request deadline expires. */
+export class RequestDeadlineError extends Error {
+  constructor(readonly label: string) {
+    super(`${label} timed out`);
+    this.name = "RequestDeadlineError";
+  }
+}
+
+export type BoundedResponseReadOptions = {
+  signal?: AbortSignal;
+};
+
 /**
  * Read a response through its stream with a hard byte ceiling.
  *
@@ -105,6 +119,7 @@ export async function readResponseBodyBounded(
   response: Response,
   maxBytes: number,
   label: string,
+  options: BoundedResponseReadOptions = {},
 ): Promise<Uint8Array> {
   if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) {
     throw new RangeError("response body limit must be a non-negative safe integer");
@@ -131,7 +146,7 @@ export async function readResponseBodyBounded(
   let receivedBytes = 0;
   try {
     for (;;) {
-      const result = await reader.read();
+      const result = await readStreamChunk(reader, options.signal, label);
       if (result.done) {
         break;
       }
@@ -143,10 +158,15 @@ export async function readResponseBodyBounded(
       chunks.push(result.value);
     }
   } catch (error) {
-    await reader.cancel().catch(() => undefined);
+    void reader.cancel(error).catch(() => undefined);
     throw error;
   } finally {
-    reader.releaseLock();
+    try {
+      reader.releaseLock();
+    } catch {
+      // An aborted read may still own the lock until the underlying transport
+      // observes cancellation. The response is already being cancelled above.
+    }
   }
 
   const body = new Uint8Array(receivedBytes);
@@ -162,16 +182,52 @@ export async function readResponseTextBounded(
   response: Response,
   maxBytes: number,
   label: string,
+  options: BoundedResponseReadOptions = {},
 ): Promise<string> {
-  return new TextDecoder().decode(await readResponseBodyBounded(response, maxBytes, label));
+  return new TextDecoder().decode(
+    await readResponseBodyBounded(response, maxBytes, label, options),
+  );
 }
 
 export async function readResponseJsonBounded<T = unknown>(
   response: Response,
   maxBytes: number,
   label: string,
+  options: BoundedResponseReadOptions = {},
 ): Promise<T> {
-  return JSON.parse(await readResponseTextBounded(response, maxBytes, label)) as T;
+  return JSON.parse(await readResponseTextBounded(response, maxBytes, label, options)) as T;
+}
+
+type ResponseStreamReadResult = Awaited<
+  ReturnType<ReadableStreamDefaultReader<Uint8Array>["read"]>
+>;
+
+async function readStreamChunk(
+  reader: ReadableStreamDefaultReader<Uint8Array>,
+  signal: AbortSignal | undefined,
+  label: string,
+): Promise<ResponseStreamReadResult> {
+  if (!signal) return await reader.read();
+  if (signal.aborted) throw new RequestDeadlineError(label);
+  return await new Promise<ResponseStreamReadResult>((resolve, reject) => {
+    let settled = false;
+    const finish = (callback: () => void) => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener("abort", onAbort);
+      callback();
+    };
+    const onAbort = () => {
+      const error = new RequestDeadlineError(label);
+      void reader.cancel(error).catch(() => undefined);
+      finish(() => reject(error));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    void reader.read().then(
+      (result) => finish(() => resolve(result)),
+      (error) => finish(() => reject(error)),
+    );
+  });
 }
 
 export type ResolvePinnedDestinationOptions = {
@@ -207,6 +263,91 @@ const defaultDnsLookup: DnsLookup = async (hostname) => {
 const defaultFetch: FetchLike = (input, init) =>
   (undiciFetchImpl as unknown as FetchLike)(input, init);
 
+const pinnedRequestFetch: FetchLike = async (input, init) => {
+  const source = input instanceof Request ? input : null;
+  const url = source?.url ?? input.toString();
+  const method = init?.method ?? source?.method ?? "GET";
+  const headers = new Headers(source?.headers);
+  if (init?.headers) {
+    new Headers(init.headers).forEach((value, name) => headers.set(name, value));
+  }
+  // Undici request() deliberately does not auto-decompress. Asking providers
+  // for identity encoding keeps the returned web Response body truthful.
+  if (!headers.has("accept-encoding")) headers.set("accept-encoding", "identity");
+  const rawBody = init?.body ?? (method !== "GET" && method !== "HEAD" ? source?.body : undefined);
+  const body = await normalizeUndiciRequestBody(rawBody, headers);
+  const dispatcher = (init as (RequestInit & { dispatcher?: unknown }) | undefined)?.dispatcher;
+  const result = await undiciRequestImpl(url, {
+    method: method as never,
+    headers,
+    ...(body !== undefined && body !== null ? { body: body as never } : {}),
+    ...(init?.signal ? { signal: init.signal } : source?.signal ? { signal: source.signal } : {}),
+    ...(dispatcher ? { dispatcher: dispatcher as never } : {}),
+    maxRedirections: 0,
+  });
+  const iterator = result.body[Symbol.asyncIterator]();
+  const responseBody = new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        const chunk = await iterator.next();
+        if (chunk.done) {
+          controller.close();
+          return;
+        }
+        controller.enqueue(
+          chunk.value instanceof Uint8Array ? chunk.value : new Uint8Array(chunk.value),
+        );
+      } catch (error) {
+        controller.error(error);
+      }
+    },
+    async cancel(reason) {
+      result.body.destroy(reason instanceof Error ? reason : undefined);
+      await iterator.return?.();
+    },
+  });
+  const responseHeaders = new Headers();
+  for (const [name, value] of Object.entries(result.headers)) {
+    if (Array.isArray(value)) {
+      for (const entry of value) responseHeaders.append(name, entry);
+    } else if (value !== undefined) {
+      responseHeaders.set(name, value);
+    }
+  }
+  const response = new Response(responseBody, {
+    status: result.statusCode,
+    headers: responseHeaders,
+  });
+  Object.defineProperty(response, "url", { value: url });
+  return response;
+};
+
+/**
+ * Preserve Fetch BodyInit semantics for values that Undici request() does not
+ * normalize itself. URLSearchParams is otherwise mistaken for an iterable of
+ * body chunks and each [name, value] tuple reaches the socket as an Array.
+ */
+async function normalizeUndiciRequestBody(
+  body: BodyInit | null | undefined,
+  headers: Headers,
+): Promise<BodyInit | Uint8Array | null | undefined> {
+  if (body instanceof URLSearchParams) {
+    if (!headers.has("content-type")) {
+      headers.set("content-type", "application/x-www-form-urlencoded;charset=UTF-8");
+    }
+    return body.toString();
+  }
+  if (body instanceof Blob) {
+    if (body.type && !headers.has("content-type")) headers.set("content-type", body.type);
+    return new Uint8Array(await body.arrayBuffer());
+  }
+  if (body instanceof ArrayBuffer) return new Uint8Array(body);
+  if (ArrayBuffer.isView(body)) {
+    return new Uint8Array(body.buffer, body.byteOffset, body.byteLength);
+  }
+  return body;
+}
+
 /** Undici fetch used by the pinned transport; Bun callers should prefer this over native fetch. */
 export const undiciFetch: FetchLike = defaultFetch;
 
@@ -286,8 +427,8 @@ export async function resolvePinnedDestination(
 
 /**
  * Fetch through a dispatcher whose lookup is pinned to the result of exactly
- * one policy resolution. The response body owns the agent until completion,
- * cancellation, or stream failure.
+ * one policy resolution. The response body owns the one-shot agent until
+ * completion, cancellation, or stream failure.
  */
 export async function pinnedFetch(
   input: string | URL | Request,
@@ -299,7 +440,7 @@ export async function pinnedFetch(
   const destination = await resolvePinnedDestination(rawUrl, settings, options);
   const dispatcher =
     options.agentFactory?.(destination.addresses) ?? createPinnedAgent(destination.addresses);
-  const fetchImpl = options.fetchImpl ?? defaultFetch;
+  const fetchImpl = options.fetchImpl ?? pinnedRequestFetch;
   const fetchInit = {
     ...init,
     redirect: "manual" as const,
@@ -313,10 +454,10 @@ export async function pinnedFetch(
     throw error;
   }
   if (!response.body) {
-    await closeDispatcher(dispatcher);
+    await closeDispatcher(dispatcher, DISPATCHER_CLOSE_TIMEOUT_MS);
     return response;
   }
-  return responseWithDispatcherLifecycle(response, dispatcher);
+  return responseWithDispatcherLifecycle(response, dispatcher, DISPATCHER_CLOSE_TIMEOUT_MS);
 }
 
 export function isLocalTestEnvironment(environment: string): boolean {
@@ -390,7 +531,10 @@ function createPinnedAgent(addresses: readonly DnsAddress[]): DispatcherLifecycl
         if (options.all) {
           callback(
             null,
-            candidates.map((entry) => ({ address: entry.address, family: entry.family })),
+            candidates.map((entry) => ({
+              address: entry.address,
+              family: entry.family,
+            })),
           );
           return;
         }
@@ -413,13 +557,22 @@ function createPinnedAgent(addresses: readonly DnsAddress[]): DispatcherLifecycl
 function responseWithDispatcherLifecycle(
   response: Response,
   dispatcher: DispatcherLifecycle,
+  closeTimeoutMs: number,
 ): Response {
   const reader = response.body!.getReader();
+  let readerReleased = false;
+  const releaseReader = () => {
+    if (readerReleased) return;
+    readerReleased = true;
+    reader.releaseLock();
+  };
   let disposed: Promise<void> | null = null;
   let cancelled = false;
   const finish = (destroy: boolean, error?: unknown): Promise<void> => {
     if (!disposed) {
-      disposed = destroy ? destroyDispatcher(dispatcher, error) : closeDispatcher(dispatcher);
+      disposed = destroy
+        ? destroyDispatcher(dispatcher, error)
+        : closeDispatcher(dispatcher, closeTimeoutMs);
     }
     return disposed;
   };
@@ -428,12 +581,17 @@ function responseWithDispatcherLifecycle(
       try {
         const chunk = await reader.read();
         if (chunk.done) {
+          // The dispatcher cannot finish gracefully while OpenGeni still owns
+          // the provider response's reader lock. Release it before teardown;
+          // otherwise Undici can wait forever after the complete body arrived.
+          releaseReader();
           await finish(cancelled);
           controller.close();
           return;
         }
         controller.enqueue(chunk.value);
       } catch (error) {
+        releaseReader();
         await finish(true, error);
         controller.error(error);
       }
@@ -443,6 +601,7 @@ function responseWithDispatcherLifecycle(
       try {
         await reader.cancel(reason);
       } finally {
+        releaseReader();
         await finish(true, reason);
       }
     },
@@ -460,11 +619,24 @@ function responseWithDispatcherLifecycle(
   return wrapped;
 }
 
-async function closeDispatcher(dispatcher: DispatcherLifecycle): Promise<void> {
-  try {
-    await dispatcher.close();
-  } catch {
-    await destroyDispatcher(dispatcher);
+async function closeDispatcher(dispatcher: DispatcherLifecycle, timeoutMs: number): Promise<void> {
+  let timeout: ReturnType<typeof setTimeout> | undefined;
+  const outcome = await Promise.race([
+    Promise.resolve()
+      .then(() => dispatcher.close())
+      .then(
+        () => "closed" as const,
+        () => "failed" as const,
+      ),
+    new Promise<"timed_out">((resolve) => {
+      timeout = setTimeout(() => resolve("timed_out"), timeoutMs);
+    }),
+  ]);
+  if (timeout) clearTimeout(timeout);
+  if (outcome !== "closed") {
+    // Destruction starts immediately. Do not await a provider/dispatcher
+    // shutdown promise after the bounded graceful-close deadline has elapsed.
+    void destroyDispatcher(dispatcher);
   }
 }