@opengeni/network 0.1.1

package/dist/index.js

@@ -0,0 +1,490 @@
+// src/index.ts
+import { Agent, fetch as undiciFetchImpl } from "undici/index.js";
+import { lookup as nodeLookup } from "dns/promises";
+import { isIP } from "net";
+var OAUTH_MAX_RESPONSE_BYTES = 1024 * 1024;
+function validateHttpUrl(rawUrl, options = {}) {
+  const label = options.label ?? "HTTP endpoint";
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw new DestinationPolicyError("invalid_url", `${label} URL is invalid`);
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new DestinationPolicyError(
+      "unsupported_protocol",
+      `${label} only supports http and https URLs`
+    );
+  }
+  if (url.username || url.password) {
+    throw new DestinationPolicyError("invalid_url", `${label} URL may not contain credentials`);
+  }
+  if (url.hash) {
+    throw new DestinationPolicyError("invalid_url", `${label} URL may not contain a fragment`);
+  }
+  if (url.protocol === "http:" && !(options.allowLoopbackHttp && isLoopbackHostname(url.hostname))) {
+    throw new DestinationPolicyError("https_required", `${label} must use https`);
+  }
+  return url.toString();
+}
+var ResponseBodyLimitError = class extends Error {
+  constructor(label, actualBytes, maxBytes, reason) {
+    super(`${label} exceeded its ${maxBytes}-byte response limit`);
+    this.label = label;
+    this.actualBytes = actualBytes;
+    this.maxBytes = maxBytes;
+    this.reason = reason;
+    this.name = "ResponseBodyLimitError";
+  }
+};
+async function readResponseBodyBounded(response, maxBytes, label) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) {
+    throw new RangeError("response body limit must be a non-negative safe integer");
+  }
+  const declared = response.headers.get("content-length");
+  if (declared !== null) {
+    const normalized = declared.trim();
+    if (!/^\d+$/.test(normalized)) {
+      await cancelResponse(response);
+      throw new ResponseBodyLimitError(label, 0, maxBytes, "invalid_content_length");
+    }
+    const declaredBytes = Number(normalized);
+    if (!Number.isSafeInteger(declaredBytes) || declaredBytes > maxBytes) {
+      await cancelResponse(response);
+      throw new ResponseBodyLimitError(label, declaredBytes, maxBytes, "declared_length");
+    }
+  }
+  if (!response.body) {
+    return new Uint8Array();
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let receivedBytes = 0;
+  try {
+    for (; ; ) {
+      const result = await reader.read();
+      if (result.done) {
+        break;
+      }
+      receivedBytes += result.value.byteLength;
+      if (receivedBytes > maxBytes) {
+        await reader.cancel().catch(() => void 0);
+        throw new ResponseBodyLimitError(label, receivedBytes, maxBytes, "stream_overflow");
+      }
+      chunks.push(result.value);
+    }
+  } catch (error) {
+    await reader.cancel().catch(() => void 0);
+    throw error;
+  } finally {
+    reader.releaseLock();
+  }
+  const body = new Uint8Array(receivedBytes);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return body;
+}
+async function readResponseTextBounded(response, maxBytes, label) {
+  return new TextDecoder().decode(await readResponseBodyBounded(response, maxBytes, label));
+}
+async function readResponseJsonBounded(response, maxBytes, label) {
+  return JSON.parse(await readResponseTextBounded(response, maxBytes, label));
+}
+var DestinationPolicyError = class extends Error {
+  constructor(reason, message) {
+    super(message);
+    this.reason = reason;
+    this.name = "DestinationPolicyError";
+  }
+};
+var defaultDnsLookup = async (hostname) => {
+  const answers = await nodeLookup(hostname, { all: true });
+  return answers.map((entry) => normalizeDnsAnswer(entry));
+};
+var defaultFetch = (input, init) => undiciFetchImpl(input, init);
+var undiciFetch = defaultFetch;
+async function resolvePinnedDestination(rawUrl, settings, options = {}) {
+  const label = options.label ?? "Outbound request";
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw new DestinationPolicyError("invalid_url", `${label} URL is invalid`);
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new DestinationPolicyError(
+      "unsupported_protocol",
+      `${label} only supports http and https URLs`
+    );
+  }
+  const localTestEscape = isLocalTestEnvironment(settings.environment);
+  if (options.requireHttpsOutsideLocalTest && !localTestEscape && url.protocol !== "https:") {
+    throw new DestinationPolicyError(
+      "https_required",
+      `${label} must use https outside local/test`
+    );
+  }
+  const hostname = normalizeHostname(url.hostname);
+  if (!hostname) {
+    throw new DestinationPolicyError("invalid_url", `${label} URL has no hostname`);
+  }
+  const literalFamily = isIP(hostname);
+  let addresses;
+  try {
+    addresses = literalFamily ? [{ address: hostname, family: literalFamily === 6 ? 6 : 4 }] : await (options.dnsLookup ?? defaultDnsLookup)(hostname);
+  } catch (error) {
+    if (error instanceof DestinationPolicyError && error.reason === "invalid_dns_answer") {
+      throw error;
+    }
+    throw new DestinationPolicyError("dns_failed", `${label} hostname could not be resolved`);
+  }
+  const normalizedAddresses = dedupeAddresses(addresses);
+  if (normalizedAddresses.length === 0) {
+    throw new DestinationPolicyError("dns_empty", `${label} hostname has no addresses`);
+  }
+  if (normalizedAddresses.some((entry) => isInvalidAddress(entry.address))) {
+    throw new DestinationPolicyError(
+      "invalid_dns_answer",
+      `${label} hostname returned an invalid address`
+    );
+  }
+  const privateEscape = localTestEscape || settings.integrationsAllowPrivateNetworkTargets === true;
+  if (!privateEscape && (isLocalHostname(hostname) || normalizedAddresses.some((entry) => isNonPublicAddress(entry.address)))) {
+    throw new DestinationPolicyError(
+      "private_or_special_use",
+      `${label} may not target a private or special-use network address`
+    );
+  }
+  return { url, hostname, addresses: normalizedAddresses };
+}
+async function pinnedFetch(input, init, settings, options = {}) {
+  const rawUrl = input instanceof Request ? input.url : input;
+  const destination = await resolvePinnedDestination(rawUrl, settings, options);
+  const dispatcher = options.agentFactory?.(destination.addresses) ?? createPinnedAgent(destination.addresses);
+  const fetchImpl = options.fetchImpl ?? defaultFetch;
+  const fetchInit = {
+    ...init,
+    redirect: "manual",
+    dispatcher: dispatcher.dispatcher ?? dispatcher
+  };
+  let response;
+  try {
+    response = await fetchImpl(input, fetchInit);
+  } catch (error) {
+    await destroyDispatcher(dispatcher, error);
+    throw error;
+  }
+  if (!response.body) {
+    await closeDispatcher(dispatcher);
+    return response;
+  }
+  return responseWithDispatcherLifecycle(response, dispatcher);
+}
+function isLocalTestEnvironment(environment) {
+  return environment === "local" || environment === "test";
+}
+function isInvalidAddress(address) {
+  return isIP(stripAddressBrackets(address.trim())) === 0;
+}
+function isNonPublicAddress(address) {
+  const normalized = stripAddressBrackets(address.trim().toLowerCase());
+  const family = isIP(normalized);
+  if (family === 0) {
+    return true;
+  }
+  if (family === 4) {
+    return isNonPublicIpv4(normalized);
+  }
+  const mappedText = ipv4FromMappedText(normalized);
+  if (mappedText !== null) {
+    return isNonPublicIpv4(mappedText);
+  }
+  const value = parseIpv6(normalized);
+  if (value === null) {
+    return true;
+  }
+  const mapped = ipv4FromMappedIpv6(value);
+  if (mapped !== null) {
+    return isNonPublicIpv4(mapped);
+  }
+  if (!hasIpv6Prefix(value, IPV6_GLOBAL_UNICAST_PREFIX, 3)) {
+    return true;
+  }
+  return IPV6_SPECIAL_PREFIXES.some(([prefix, bits]) => hasIpv6Prefix(value, prefix, bits));
+}
+var isPrivateAddress = isNonPublicAddress;
+function createPinnedAgent(addresses) {
+  const agent = new Agent({
+    connect: {
+      lookup: (_hostname, options, callback) => {
+        const candidates = options.family === 4 || options.family === 6 ? addresses.filter((entry) => entry.family === options.family) : addresses;
+        if (candidates.length === 0) {
+          callback(new Error("pinned DNS answer has no address for requested family"));
+          return;
+        }
+        if (options.all) {
+          callback(
+            null,
+            candidates.map((entry) => ({ address: entry.address, family: entry.family }))
+          );
+          return;
+        }
+        const first = candidates[0];
+        callback(null, first.address, first.family);
+      }
+    }
+  });
+  return {
+    dispatcher: agent,
+    close: async () => {
+      await agent.close();
+    },
+    destroy: async (error) => {
+      await agent.destroy(error instanceof Error ? error : null);
+    }
+  };
+}
+function responseWithDispatcherLifecycle(response, dispatcher) {
+  const reader = response.body.getReader();
+  let disposed = null;
+  let cancelled = false;
+  const finish = (destroy, error) => {
+    if (!disposed) {
+      disposed = destroy ? destroyDispatcher(dispatcher, error) : closeDispatcher(dispatcher);
+    }
+    return disposed;
+  };
+  const body = new ReadableStream({
+    async pull(controller) {
+      try {
+        const chunk = await reader.read();
+        if (chunk.done) {
+          await finish(cancelled);
+          controller.close();
+          return;
+        }
+        controller.enqueue(chunk.value);
+      } catch (error) {
+        await finish(true, error);
+        controller.error(error);
+      }
+    },
+    async cancel(reason) {
+      cancelled = true;
+      try {
+        await reader.cancel(reason);
+      } finally {
+        await finish(true, reason);
+      }
+    }
+  });
+  const wrapped = new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  });
+  Object.defineProperties(wrapped, {
+    redirected: { value: response.redirected },
+    type: { value: response.type },
+    url: { value: response.url }
+  });
+  return wrapped;
+}
+async function closeDispatcher(dispatcher) {
+  try {
+    await dispatcher.close();
+  } catch {
+    await destroyDispatcher(dispatcher);
+  }
+}
+async function destroyDispatcher(dispatcher, error) {
+  try {
+    await dispatcher.destroy(error);
+  } catch {
+  }
+}
+async function cancelResponse(response) {
+  await response.body?.cancel().catch(() => void 0);
+}
+function normalizeHostname(hostname) {
+  return stripAddressBrackets(hostname.trim().toLowerCase()).replace(/\.$/, "");
+}
+function stripAddressBrackets(address) {
+  return address.startsWith("[") && address.endsWith("]") ? address.slice(1, -1) : address;
+}
+function isLocalHostname(hostname) {
+  return hostname === "localhost" || hostname.endsWith(".localhost");
+}
+function isLoopbackHostname(hostname) {
+  const normalized = normalizeHostname(hostname);
+  return normalized === "localhost" || normalized.endsWith(".localhost") || normalized === "::1" || isLoopbackIpv4(normalized);
+}
+function isLoopbackIpv4(hostname) {
+  if (isIP(hostname) !== 4) return false;
+  return hostname.split(".")[0] === "127";
+}
+function dedupeAddresses(addresses) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  if (!Array.isArray(addresses)) {
+    throw invalidDnsAnswer();
+  }
+  for (const entry of addresses) {
+    const normalized = normalizeDnsAnswer(entry);
+    const key = `${normalized.family}:${normalized.address}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      out.push(normalized);
+    }
+  }
+  return out;
+}
+function normalizeDnsAnswer(entry) {
+  if (!entry || typeof entry !== "object") {
+    throw invalidDnsAnswer();
+  }
+  const candidate = entry;
+  if (typeof candidate.address !== "string") {
+    throw invalidDnsAnswer();
+  }
+  const family = candidate.family;
+  if (family !== 4 && family !== 6) {
+    throw invalidDnsAnswer();
+  }
+  const address = stripAddressBrackets(candidate.address.trim().toLowerCase());
+  const actualFamily = isIP(address);
+  if (actualFamily !== family) {
+    throw invalidDnsAnswer();
+  }
+  return { address, family };
+}
+function invalidDnsAnswer() {
+  return new DestinationPolicyError(
+    "invalid_dns_answer",
+    "hostname returned an invalid DNS answer"
+  );
+}
+function isNonPublicIpv4(address) {
+  const parts = address.split(".").map(Number);
+  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
+    return true;
+  }
+  const value = parts[0] << 24 | parts[1] << 16 | parts[2] << 8 | parts[3];
+  const unsigned = value >>> 0;
+  return inIpv4Range(unsigned, 0, 16777215) || inIpv4Range(unsigned, 167772160, 184549375) || inIpv4Range(unsigned, 1681915904, 1686110207) || inIpv4Range(unsigned, 2130706432, 2147483647) || inIpv4Range(unsigned, 2851995648, 2852061183) || inIpv4Range(unsigned, 2886729728, 2887778303) || inIpv4Range(unsigned, 3221225472, 3221225727) || inIpv4Range(unsigned, 3221225984, 3221226239) || inIpv4Range(unsigned, 3223307264, 3223307519) || inIpv4Range(unsigned, 3224682752, 3224683007) || inIpv4Range(unsigned, 3227017984, 3227018239) || inIpv4Range(unsigned, 3232235520, 3232301055) || inIpv4Range(unsigned, 3232706560, 3232706815) || inIpv4Range(unsigned, 3323068416, 3323199487) || inIpv4Range(unsigned, 3325256704, 3325256959) || inIpv4Range(unsigned, 3405803776, 3405804031) || inIpv4Range(unsigned, 3758096384, 4294967295);
+}
+function inIpv4Range(value, start, end) {
+  return value >= start && value <= end;
+}
+var IPV6_GLOBAL_UNICAST_PREFIX = ipv6Constant("2000::");
+var IPV6_SPECIAL_PREFIXES = [
+  [ipv6Constant("::"), 96],
+  [ipv6Constant("64:ff9b::"), 96],
+  [ipv6Constant("64:ff9b:1::"), 48],
+  [ipv6Constant("100::"), 64],
+  // IETF protocol assignments contain globally reachable carve-outs, but they
+  // are control-plane anycast/protocol addresses rather than integration
+  // endpoints. Credential-bearing MCP/OAuth egress fails closed on the full
+  // special-purpose block.
+  [ipv6Constant("2001::"), 23],
+  [ipv6Constant("2001:db8::"), 32],
+  [ipv6Constant("2002::"), 16],
+  [ipv6Constant("2620:4f:8000::"), 48],
+  [ipv6Constant("3ffe::"), 16],
+  [ipv6Constant("3fff::"), 20],
+  [ipv6Constant("5f00::"), 16],
+  [ipv6Constant("fc00::"), 7],
+  [ipv6Constant("fe80::"), 10],
+  [ipv6Constant("fec0::"), 10],
+  [ipv6Constant("ff00::"), 8]
+];
+function hasIpv6Prefix(value, prefix, bits) {
+  const shift = 128n - BigInt(bits);
+  return value >> shift === prefix >> shift;
+}
+function ipv4FromMappedIpv6(value) {
+  if (value >> 32n !== 0xffffn) {
+    return null;
+  }
+  const embedded = Number(value & 0xffffffffn);
+  return `${embedded >>> 24}.${embedded >>> 16 & 255}.${embedded >>> 8 & 255}.${embedded & 255}`;
+}
+function ipv4FromMappedText(address) {
+  if (!address.startsWith("::ffff:")) {
+    return null;
+  }
+  const embedded = address.slice("::ffff:".length);
+  if (isIP(embedded) === 4) {
+    return embedded;
+  }
+  const parts = embedded.split(":");
+  if (parts.length !== 2 || parts.some((part) => !/^[0-9a-f]{1,4}$/.test(part))) {
+    return null;
+  }
+  const high = Number.parseInt(parts[0], 16);
+  const low = Number.parseInt(parts[1], 16);
+  return `${high >> 8 & 255}.${high & 255}.${low >> 8 & 255}.${low & 255}`;
+}
+function parseIpv6(address) {
+  const percent = address.indexOf("%");
+  if (percent >= 0) {
+    return null;
+  }
+  let value = address;
+  if (value.includes(".")) {
+    const lastColon = value.lastIndexOf(":");
+    const dotted = value.slice(lastColon + 1);
+    const parts = dotted.split(".").map(Number);
+    if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
+      return null;
+    }
+    const hex = (parts[0] << 8 | parts[1]).toString(16).padStart(4, "0") + (parts[2] << 8 | parts[3]).toString(16).padStart(4, "0");
+    value = `${value.slice(0, lastColon + 1)}${hex}`;
+  }
+  const halves = value.split("::");
+  if (halves.length > 2) {
+    return null;
+  }
+  const left = halves[0] ? halves[0].split(":") : [];
+  const right = halves.length === 2 && halves[1] ? halves[1].split(":") : [];
+  if (left.concat(right).some((part) => !/^[0-9a-f]{1,4}$/i.test(part))) {
+    return null;
+  }
+  const missing = halves.length === 2 ? 8 - left.length - right.length : 0;
+  if (missing < 0 || halves.length === 1 && missing !== 0) {
+    return null;
+  }
+  const groups = [...left, ...Array.from({ length: missing }, () => "0"), ...right];
+  if (groups.length !== 8) {
+    return null;
+  }
+  return groups.reduce((acc, group) => acc << 16n | BigInt(`0x${group}`), 0n);
+}
+function ipv6Constant(address) {
+  const value = parseIpv6(address);
+  if (value === null) {
+    throw new Error(`invalid IPv6 constant: ${address}`);
+  }
+  return value;
+}
+export {
+  DestinationPolicyError,
+  OAUTH_MAX_RESPONSE_BYTES,
+  ResponseBodyLimitError,
+  isInvalidAddress,
+  isLocalTestEnvironment,
+  isNonPublicAddress,
+  isPrivateAddress,
+  pinnedFetch,
+  readResponseBodyBounded,
+  readResponseJsonBounded,
+  readResponseTextBounded,
+  resolvePinnedDestination,
+  undiciFetch,
+  validateHttpUrl
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// The explicit entrypoint avoids Bun's native `undici` compatibility shim,\n// which exposes an Agent-shaped object without Dispatcher methods.\nimport { Agent, fetch as undiciFetchImpl } from \"undici/index.js\";\nimport { lookup as nodeLookup } from \"node:dns/promises\";\nimport { isIP } from \"node:net\";\n\nexport type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;\n\nexport type DnsAddress = {\n  address: string;\n  family: 4 | 6;\n};\n\nexport type DnsLookup = (hostname: string) => Promise<readonly DnsAddress[]>;\n\nexport type OutboundNetworkSettings = {\n  environment: string;\n  integrationsAllowPrivateNetworkTargets: boolean;\n};\n\nexport type PinnedDestination = {\n  url: URL;\n  hostname: string;\n  addresses: readonly DnsAddress[];\n};\n\nexport type DispatcherLifecycle = {\n  /** The raw dispatcher handed to fetch; omitted for test-only lifecycle fakes. */\n  dispatcher?: unknown;\n  close: () => Promise<void> | void;\n  destroy: (error?: unknown) => Promise<void> | void;\n};\n\nexport type PinnedFetchOptions = {\n  fetchImpl?: FetchLike;\n  dnsLookup?: DnsLookup;\n  agentFactory?: (addresses: readonly DnsAddress[]) => DispatcherLifecycle;\n  label?: string;\n  requireHttpsOutsideLocalTest?: boolean;\n};\n\nexport const OAUTH_MAX_RESPONSE_BYTES = 1024 * 1024;\n\nexport type HttpUrlValidationOptions = {\n  allowLoopbackHttp?: boolean;\n  label?: string;\n};\n\n/** Validate a protocol endpoint before it is persisted, returned, or opened. */\nexport function validateHttpUrl(rawUrl: string, options: HttpUrlValidationOptions = {}): string {\n  const label = options.label ?? \"HTTP endpoint\";\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    throw new DestinationPolicyError(\"invalid_url\", `${label} URL is invalid`);\n  }\n  if (url.protocol !== \"http:\" && url.protocol !== \"https:\") {\n    throw new DestinationPolicyError(\n      \"unsupported_protocol\",\n      `${label} only supports http and https URLs`,\n    );\n  }\n  if (url.username || url.password) {\n    throw new DestinationPolicyError(\"invalid_url\", `${label} URL may not contain credentials`);\n  }\n  if (url.hash) {\n    throw new DestinationPolicyError(\"invalid_url\", `${label} URL may not contain a fragment`);\n  }\n  if (\n    url.protocol === \"http:\" &&\n    !(options.allowLoopbackHttp && isLoopbackHostname(url.hostname))\n  ) {\n    throw new DestinationPolicyError(\"https_required\", `${label} must use https`);\n  }\n  return url.toString();\n}\n\n/**\n * Raised when a response cannot be safely consumed within its caller's byte\n * budget. The error intentionally contains no response bytes or provider\n * message: these readers are used on credential-bearing paths.\n */\nexport class ResponseBodyLimitError extends Error {\n  constructor(\n    readonly label: string,\n    readonly actualBytes: number,\n    readonly maxBytes: number,\n    readonly reason: \"declared_length\" | \"stream_overflow\" | \"invalid_content_length\",\n  ) {\n    super(`${label} exceeded its ${maxBytes}-byte response limit`);\n    this.name = \"ResponseBodyLimitError\";\n  }\n}\n\n/**\n * Read a response through its stream with a hard byte ceiling.\n *\n * A declared Content-Length above the ceiling is rejected before reading. A\n * body exactly at the ceiling is accepted; the first byte beyond it cancels\n * the stream and rejects. Cancellation is important because pinnedFetch owns a\n * per-response dispatcher which must be closed on every exit path.\n */\nexport async function readResponseBodyBounded(\n  response: Response,\n  maxBytes: number,\n  label: string,\n): Promise<Uint8Array> {\n  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) {\n    throw new RangeError(\"response body limit must be a non-negative safe integer\");\n  }\n  const declared = response.headers.get(\"content-length\");\n  if (declared !== null) {\n    const normalized = declared.trim();\n    if (!/^\\d+$/.test(normalized)) {\n      await cancelResponse(response);\n      throw new ResponseBodyLimitError(label, 0, maxBytes, \"invalid_content_length\");\n    }\n    const declaredBytes = Number(normalized);\n    if (!Number.isSafeInteger(declaredBytes) || declaredBytes > maxBytes) {\n      await cancelResponse(response);\n      throw new ResponseBodyLimitError(label, declaredBytes, maxBytes, \"declared_length\");\n    }\n  }\n  if (!response.body) {\n    return new Uint8Array();\n  }\n\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let receivedBytes = 0;\n  try {\n    for (;;) {\n      const result = await reader.read();\n      if (result.done) {\n        break;\n      }\n      receivedBytes += result.value.byteLength;\n      if (receivedBytes > maxBytes) {\n        await reader.cancel().catch(() => undefined);\n        throw new ResponseBodyLimitError(label, receivedBytes, maxBytes, \"stream_overflow\");\n      }\n      chunks.push(result.value);\n    }\n  } catch (error) {\n    await reader.cancel().catch(() => undefined);\n    throw error;\n  } finally {\n    reader.releaseLock();\n  }\n\n  const body = new Uint8Array(receivedBytes);\n  let offset = 0;\n  for (const chunk of chunks) {\n    body.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return body;\n}\n\nexport async function readResponseTextBounded(\n  response: Response,\n  maxBytes: number,\n  label: string,\n): Promise<string> {\n  return new TextDecoder().decode(await readResponseBodyBounded(response, maxBytes, label));\n}\n\nexport async function readResponseJsonBounded<T = unknown>(\n  response: Response,\n  maxBytes: number,\n  label: string,\n): Promise<T> {\n  return JSON.parse(await readResponseTextBounded(response, maxBytes, label)) as T;\n}\n\nexport type ResolvePinnedDestinationOptions = {\n  dnsLookup?: DnsLookup;\n  label?: string;\n  requireHttpsOutsideLocalTest?: boolean;\n};\n\nexport type DestinationPolicyReason =\n  | \"invalid_url\"\n  | \"unsupported_protocol\"\n  | \"https_required\"\n  | \"dns_failed\"\n  | \"dns_empty\"\n  | \"invalid_dns_answer\"\n  | \"private_or_special_use\";\n\nexport class DestinationPolicyError extends Error {\n  constructor(\n    readonly reason: DestinationPolicyReason,\n    message: string,\n  ) {\n    super(message);\n    this.name = \"DestinationPolicyError\";\n  }\n}\n\nconst defaultDnsLookup: DnsLookup = async (hostname) => {\n  const answers = await nodeLookup(hostname, { all: true });\n  return answers.map((entry) => normalizeDnsAnswer(entry));\n};\n\nconst defaultFetch: FetchLike = (input, init) =>\n  (undiciFetchImpl as unknown as FetchLike)(input, init);\n\n/** Undici fetch used by the pinned transport; Bun callers should prefer this over native fetch. */\nexport const undiciFetch: FetchLike = defaultFetch;\n\n/**\n * Resolve and policy-check one destination. The returned address set is the\n * complete DNS answer that the caller is allowed to use; the transport never\n * performs a second resolver call.\n */\nexport async function resolvePinnedDestination(\n  rawUrl: string | URL,\n  settings: OutboundNetworkSettings,\n  options: ResolvePinnedDestinationOptions = {},\n): Promise<PinnedDestination> {\n  const label = options.label ?? \"Outbound request\";\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    throw new DestinationPolicyError(\"invalid_url\", `${label} URL is invalid`);\n  }\n  if (url.protocol !== \"http:\" && url.protocol !== \"https:\") {\n    throw new DestinationPolicyError(\n      \"unsupported_protocol\",\n      `${label} only supports http and https URLs`,\n    );\n  }\n  const localTestEscape = isLocalTestEnvironment(settings.environment);\n  if (options.requireHttpsOutsideLocalTest && !localTestEscape && url.protocol !== \"https:\") {\n    throw new DestinationPolicyError(\n      \"https_required\",\n      `${label} must use https outside local/test`,\n    );\n  }\n\n  const hostname = normalizeHostname(url.hostname);\n  if (!hostname) {\n    throw new DestinationPolicyError(\"invalid_url\", `${label} URL has no hostname`);\n  }\n\n  const literalFamily = isIP(hostname);\n  let addresses: readonly DnsAddress[];\n  try {\n    addresses = literalFamily\n      ? [{ address: hostname, family: literalFamily === 6 ? 6 : 4 }]\n      : await (options.dnsLookup ?? defaultDnsLookup)(hostname);\n  } catch (error) {\n    if (error instanceof DestinationPolicyError && error.reason === \"invalid_dns_answer\") {\n      throw error;\n    }\n    throw new DestinationPolicyError(\"dns_failed\", `${label} hostname could not be resolved`);\n  }\n\n  const normalizedAddresses = dedupeAddresses(addresses);\n  if (normalizedAddresses.length === 0) {\n    throw new DestinationPolicyError(\"dns_empty\", `${label} hostname has no addresses`);\n  }\n  if (normalizedAddresses.some((entry) => isInvalidAddress(entry.address))) {\n    throw new DestinationPolicyError(\n      \"invalid_dns_answer\",\n      `${label} hostname returned an invalid address`,\n    );\n  }\n\n  const privateEscape = localTestEscape || settings.integrationsAllowPrivateNetworkTargets === true;\n  if (\n    !privateEscape &&\n    (isLocalHostname(hostname) ||\n      normalizedAddresses.some((entry) => isNonPublicAddress(entry.address)))\n  ) {\n    throw new DestinationPolicyError(\n      \"private_or_special_use\",\n      `${label} may not target a private or special-use network address`,\n    );\n  }\n  return { url, hostname, addresses: normalizedAddresses };\n}\n\n/**\n * Fetch through a dispatcher whose lookup is pinned to the result of exactly\n * one policy resolution. The response body owns the agent until completion,\n * cancellation, or stream failure.\n */\nexport async function pinnedFetch(\n  input: string | URL | Request,\n  init: RequestInit | undefined,\n  settings: OutboundNetworkSettings,\n  options: PinnedFetchOptions = {},\n): Promise<Response> {\n  const rawUrl = input instanceof Request ? input.url : input;\n  const destination = await resolvePinnedDestination(rawUrl, settings, options);\n  const dispatcher =\n    options.agentFactory?.(destination.addresses) ?? createPinnedAgent(destination.addresses);\n  const fetchImpl = options.fetchImpl ?? defaultFetch;\n  const fetchInit = {\n    ...init,\n    redirect: \"manual\" as const,\n    dispatcher: dispatcher.dispatcher ?? dispatcher,\n  } as RequestInit & { dispatcher: DispatcherLifecycle };\n  let response: Response;\n  try {\n    response = await fetchImpl(input, fetchInit);\n  } catch (error) {\n    await destroyDispatcher(dispatcher, error);\n    throw error;\n  }\n  if (!response.body) {\n    await closeDispatcher(dispatcher);\n    return response;\n  }\n  return responseWithDispatcherLifecycle(response, dispatcher);\n}\n\nexport function isLocalTestEnvironment(environment: string): boolean {\n  return environment === \"local\" || environment === \"test\";\n}\n\n/** Return true for malformed, non-IPv4, and non-IPv6 address strings. */\nexport function isInvalidAddress(address: string): boolean {\n  return isIP(stripAddressBrackets(address.trim())) === 0;\n}\n\n/**\n * Classify private, reserved, documentation, benchmark, multicast, and other\n * special-use answers. IPv4-mapped IPv6 addresses are classified through their\n * embedded IPv4 value.\n */\nexport function isNonPublicAddress(address: string): boolean {\n  const normalized = stripAddressBrackets(address.trim().toLowerCase());\n  const family = isIP(normalized);\n  if (family === 0) {\n    return true;\n  }\n  if (family === 4) {\n    return isNonPublicIpv4(normalized);\n  }\n  const mappedText = ipv4FromMappedText(normalized);\n  if (mappedText !== null) {\n    return isNonPublicIpv4(mappedText);\n  }\n  const value = parseIpv6(normalized);\n  if (value === null) {\n    return true;\n  }\n  const mapped = ipv4FromMappedIpv6(value);\n  if (mapped !== null) {\n    return isNonPublicIpv4(mapped);\n  }\n  // Fail closed on unallocated/non-global IPv6 space. Current globally routed\n  // unicast addresses live in 2000::/3; local, transition, multicast, and\n  // future-use ranges must not become credential-bearing egress merely because\n  // they were absent from a denylist.\n  if (!hasIpv6Prefix(value, IPV6_GLOBAL_UNICAST_PREFIX, 3)) {\n    return true;\n  }\n  return IPV6_SPECIAL_PREFIXES.some(([prefix, bits]) => hasIpv6Prefix(value, prefix, bits));\n}\n\n// Backwards-compatible name used by the database token-broker API.\nexport const isPrivateAddress = isNonPublicAddress;\n\nfunction createPinnedAgent(addresses: readonly DnsAddress[]): DispatcherLifecycle {\n  const agent = new Agent({\n    connect: {\n      lookup: ((\n        _hostname: string,\n        options: { all?: boolean; family?: number },\n        callback: (\n          error: Error | null,\n          address?: string | Array<{ address: string; family: number }>,\n          family?: number,\n        ) => void,\n      ) => {\n        const candidates =\n          options.family === 4 || options.family === 6\n            ? addresses.filter((entry) => entry.family === options.family)\n            : addresses;\n        if (candidates.length === 0) {\n          callback(new Error(\"pinned DNS answer has no address for requested family\"));\n          return;\n        }\n        if (options.all) {\n          callback(\n            null,\n            candidates.map((entry) => ({ address: entry.address, family: entry.family })),\n          );\n          return;\n        }\n        const first = candidates[0]!;\n        callback(null, first.address, first.family);\n      }) as never,\n    },\n  });\n  return {\n    dispatcher: agent,\n    close: async () => {\n      await agent.close();\n    },\n    destroy: async (error) => {\n      await agent.destroy(error instanceof Error ? error : null);\n    },\n  };\n}\n\nfunction responseWithDispatcherLifecycle(\n  response: Response,\n  dispatcher: DispatcherLifecycle,\n): Response {\n  const reader = response.body!.getReader();\n  let disposed: Promise<void> | null = null;\n  let cancelled = false;\n  const finish = (destroy: boolean, error?: unknown): Promise<void> => {\n    if (!disposed) {\n      disposed = destroy ? destroyDispatcher(dispatcher, error) : closeDispatcher(dispatcher);\n    }\n    return disposed;\n  };\n  const body = new ReadableStream<Uint8Array>({\n    async pull(controller) {\n      try {\n        const chunk = await reader.read();\n        if (chunk.done) {\n          await finish(cancelled);\n          controller.close();\n          return;\n        }\n        controller.enqueue(chunk.value);\n      } catch (error) {\n        await finish(true, error);\n        controller.error(error);\n      }\n    },\n    async cancel(reason) {\n      cancelled = true;\n      try {\n        await reader.cancel(reason);\n      } finally {\n        await finish(true, reason);\n      }\n    },\n  });\n  const wrapped = new Response(body, {\n    status: response.status,\n    statusText: response.statusText,\n    headers: response.headers,\n  });\n  Object.defineProperties(wrapped, {\n    redirected: { value: response.redirected },\n    type: { value: response.type },\n    url: { value: response.url },\n  });\n  return wrapped;\n}\n\nasync function closeDispatcher(dispatcher: DispatcherLifecycle): Promise<void> {\n  try {\n    await dispatcher.close();\n  } catch {\n    await destroyDispatcher(dispatcher);\n  }\n}\n\nasync function destroyDispatcher(dispatcher: DispatcherLifecycle, error?: unknown): Promise<void> {\n  try {\n    await dispatcher.destroy(error);\n  } catch {\n    // Cleanup is best effort after the dispatcher has already failed.\n  }\n}\n\nasync function cancelResponse(response: Response): Promise<void> {\n  await response.body?.cancel().catch(() => undefined);\n}\n\nfunction normalizeHostname(hostname: string): string {\n  return stripAddressBrackets(hostname.trim().toLowerCase()).replace(/\\.$/, \"\");\n}\n\nfunction stripAddressBrackets(address: string): string {\n  return address.startsWith(\"[\") && address.endsWith(\"]\") ? address.slice(1, -1) : address;\n}\n\nfunction isLocalHostname(hostname: string): boolean {\n  return hostname === \"localhost\" || hostname.endsWith(\".localhost\");\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  const normalized = normalizeHostname(hostname);\n  return (\n    normalized === \"localhost\" ||\n    normalized.endsWith(\".localhost\") ||\n    normalized === \"::1\" ||\n    isLoopbackIpv4(normalized)\n  );\n}\n\nfunction isLoopbackIpv4(hostname: string): boolean {\n  if (isIP(hostname) !== 4) return false;\n  return hostname.split(\".\")[0] === \"127\";\n}\n\nfunction dedupeAddresses(addresses: readonly DnsAddress[]): DnsAddress[] {\n  const out: DnsAddress[] = [];\n  const seen = new Set<string>();\n  if (!Array.isArray(addresses)) {\n    throw invalidDnsAnswer();\n  }\n  for (const entry of addresses) {\n    const normalized = normalizeDnsAnswer(entry);\n    const key = `${normalized.family}:${normalized.address}`;\n    if (!seen.has(key)) {\n      seen.add(key);\n      out.push(normalized);\n    }\n  }\n  return out;\n}\n\n/**\n * Validate resolver metadata before it can influence either policy checks or\n * the pinned dispatcher. Never infer a family from the address while retaining\n * a conflicting resolver claim: an invalid answer is an invalid answer.\n */\nfunction normalizeDnsAnswer(entry: unknown): DnsAddress {\n  if (!entry || typeof entry !== \"object\") {\n    throw invalidDnsAnswer();\n  }\n  const candidate = entry as { address?: unknown; family?: unknown };\n  if (typeof candidate.address !== \"string\") {\n    throw invalidDnsAnswer();\n  }\n  const family = candidate.family;\n  if (family !== 4 && family !== 6) {\n    throw invalidDnsAnswer();\n  }\n  const address = stripAddressBrackets(candidate.address.trim().toLowerCase());\n  const actualFamily = isIP(address);\n  if (actualFamily !== family) {\n    throw invalidDnsAnswer();\n  }\n  return { address, family };\n}\n\nfunction invalidDnsAnswer(): DestinationPolicyError {\n  return new DestinationPolicyError(\n    \"invalid_dns_answer\",\n    \"hostname returned an invalid DNS answer\",\n  );\n}\n\nfunction isNonPublicIpv4(address: string): boolean {\n  const parts = address.split(\".\").map(Number);\n  if (\n    parts.length !== 4 ||\n    parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)\n  ) {\n    return true;\n  }\n  const value = (parts[0]! << 24) | (parts[1]! << 16) | (parts[2]! << 8) | parts[3]!;\n  const unsigned = value >>> 0;\n  return (\n    inIpv4Range(unsigned, 0x00000000, 0x00ffffff) ||\n    inIpv4Range(unsigned, 0x0a000000, 0x0affffff) ||\n    inIpv4Range(unsigned, 0x64400000, 0x647fffff) ||\n    inIpv4Range(unsigned, 0x7f000000, 0x7fffffff) ||\n    inIpv4Range(unsigned, 0xa9fe0000, 0xa9feffff) ||\n    inIpv4Range(unsigned, 0xac100000, 0xac1fffff) ||\n    inIpv4Range(unsigned, 0xc0000000, 0xc00000ff) ||\n    inIpv4Range(unsigned, 0xc0000200, 0xc00002ff) ||\n    inIpv4Range(unsigned, 0xc01fc400, 0xc01fc4ff) ||\n    inIpv4Range(unsigned, 0xc034c100, 0xc034c1ff) ||\n    inIpv4Range(unsigned, 0xc0586300, 0xc05863ff) ||\n    inIpv4Range(unsigned, 0xc0a80000, 0xc0a8ffff) ||\n    inIpv4Range(unsigned, 0xc0af3000, 0xc0af30ff) ||\n    inIpv4Range(unsigned, 0xc6120000, 0xc613ffff) ||\n    inIpv4Range(unsigned, 0xc6336400, 0xc63364ff) ||\n    inIpv4Range(unsigned, 0xcb007100, 0xcb0071ff) ||\n    inIpv4Range(unsigned, 0xe0000000, 0xffffffff)\n  );\n}\n\nfunction inIpv4Range(value: number, start: number, end: number): boolean {\n  return value >= start && value <= end;\n}\n\nconst IPV6_GLOBAL_UNICAST_PREFIX = ipv6Constant(\"2000::\");\n\nconst IPV6_SPECIAL_PREFIXES: readonly [bigint, number][] = [\n  [ipv6Constant(\"::\"), 96],\n  [ipv6Constant(\"64:ff9b::\"), 96],\n  [ipv6Constant(\"64:ff9b:1::\"), 48],\n  [ipv6Constant(\"100::\"), 64],\n  // IETF protocol assignments contain globally reachable carve-outs, but they\n  // are control-plane anycast/protocol addresses rather than integration\n  // endpoints. Credential-bearing MCP/OAuth egress fails closed on the full\n  // special-purpose block.\n  [ipv6Constant(\"2001::\"), 23],\n  [ipv6Constant(\"2001:db8::\"), 32],\n  [ipv6Constant(\"2002::\"), 16],\n  [ipv6Constant(\"2620:4f:8000::\"), 48],\n  [ipv6Constant(\"3ffe::\"), 16],\n  [ipv6Constant(\"3fff::\"), 20],\n  [ipv6Constant(\"5f00::\"), 16],\n  [ipv6Constant(\"fc00::\"), 7],\n  [ipv6Constant(\"fe80::\"), 10],\n  [ipv6Constant(\"fec0::\"), 10],\n  [ipv6Constant(\"ff00::\"), 8],\n];\n\nfunction hasIpv6Prefix(value: bigint, prefix: bigint, bits: number): boolean {\n  const shift = 128n - BigInt(bits);\n  return value >> shift === prefix >> shift;\n}\n\nfunction ipv4FromMappedIpv6(value: bigint): string | null {\n  if (value >> 32n !== 0xffffn) {\n    return null;\n  }\n  const embedded = Number(value & 0xffffffffn);\n  return `${embedded >>> 24}.${(embedded >>> 16) & 0xff}.${(embedded >>> 8) & 0xff}.${embedded & 0xff}`;\n}\n\nfunction ipv4FromMappedText(address: string): string | null {\n  if (!address.startsWith(\"::ffff:\")) {\n    return null;\n  }\n  const embedded = address.slice(\"::ffff:\".length);\n  if (isIP(embedded) === 4) {\n    return embedded;\n  }\n  const parts = embedded.split(\":\");\n  if (parts.length !== 2 || parts.some((part) => !/^[0-9a-f]{1,4}$/.test(part))) {\n    return null;\n  }\n  const high = Number.parseInt(parts[0]!, 16);\n  const low = Number.parseInt(parts[1]!, 16);\n  return `${(high >> 8) & 0xff}.${high & 0xff}.${(low >> 8) & 0xff}.${low & 0xff}`;\n}\n\nfunction parseIpv6(address: string): bigint | null {\n  const percent = address.indexOf(\"%\");\n  if (percent >= 0) {\n    return null;\n  }\n  let value = address;\n  if (value.includes(\".\")) {\n    const lastColon = value.lastIndexOf(\":\");\n    const dotted = value.slice(lastColon + 1);\n    const parts = dotted.split(\".\").map(Number);\n    if (\n      parts.length !== 4 ||\n      parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)\n    ) {\n      return null;\n    }\n    const hex =\n      ((parts[0]! << 8) | parts[1]!).toString(16).padStart(4, \"0\") +\n      ((parts[2]! << 8) | parts[3]!).toString(16).padStart(4, \"0\");\n    value = `${value.slice(0, lastColon + 1)}${hex}`;\n  }\n  const halves = value.split(\"::\");\n  if (halves.length > 2) {\n    return null;\n  }\n  const left = halves[0] ? halves[0].split(\":\") : [];\n  const right = halves.length === 2 && halves[1] ? halves[1].split(\":\") : [];\n  if (left.concat(right).some((part) => !/^[0-9a-f]{1,4}$/i.test(part))) {\n    return null;\n  }\n  const missing = halves.length === 2 ? 8 - left.length - right.length : 0;\n  if (missing < 0 || (halves.length === 1 && missing !== 0)) {\n    return null;\n  }\n  const groups = [...left, ...Array.from({ length: missing }, () => \"0\"), ...right];\n  if (groups.length !== 8) {\n    return null;\n  }\n  return groups.reduce((acc, group) => (acc << 16n) | BigInt(`0x${group}`), 0n);\n}\n\nfunction ipv6Constant(address: string): bigint {\n  const value = parseIpv6(address);\n  if (value === null) {\n    throw new Error(`invalid IPv6 constant: ${address}`);\n  }\n  return value;\n}\n"],"mappings":";AAEA,SAAS,OAAO,SAAS,uBAAuB;AAChD,SAAS,UAAU,kBAAkB;AACrC,SAAS,YAAY;AAqCd,IAAM,2BAA2B,OAAO;AAQxC,SAAS,gBAAgB,QAAgB,UAAoC,CAAC,GAAW;AAC9F,QAAM,QAAQ,QAAQ,SAAS;AAC/B,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,MAAM;AAAA,EACtB,QAAQ;AACN,UAAM,IAAI,uBAAuB,eAAe,GAAG,KAAK,iBAAiB;AAAA,EAC3E;AACA,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU;AACzD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AACA,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,UAAM,IAAI,uBAAuB,eAAe,GAAG,KAAK,kCAAkC;AAAA,EAC5F;AACA,MAAI,IAAI,MAAM;AACZ,UAAM,IAAI,uBAAuB,eAAe,GAAG,KAAK,iCAAiC;AAAA,EAC3F;AACA,MACE,IAAI,aAAa,WACjB,EAAE,QAAQ,qBAAqB,mBAAmB,IAAI,QAAQ,IAC9D;AACA,UAAM,IAAI,uBAAuB,kBAAkB,GAAG,KAAK,iBAAiB;AAAA,EAC9E;AACA,SAAO,IAAI,SAAS;AACtB;AAOO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YACW,OACA,aACA,UACA,QACT;AACA,UAAM,GAAG,KAAK,iBAAiB,QAAQ,sBAAsB;AALpD;AACA;AACA;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AACF;AAUA,eAAsB,wBACpB,UACA,UACA,OACqB;AACrB,MAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAW,GAAG;AACnD,UAAM,IAAI,WAAW,yDAAyD;AAAA,EAChF;AACA,QAAM,WAAW,SAAS,QAAQ,IAAI,gBAAgB;AACtD,MAAI,aAAa,MAAM;AACrB,UAAM,aAAa,SAAS,KAAK;AACjC,QAAI,CAAC,QAAQ,KAAK,UAAU,GAAG;AAC7B,YAAM,eAAe,QAAQ;AAC7B,YAAM,IAAI,uBAAuB,OAAO,GAAG,UAAU,wBAAwB;AAAA,IAC/E;AACA,UAAM,gBAAgB,OAAO,UAAU;AACvC,QAAI,CAAC,OAAO,cAAc,aAAa,KAAK,gBAAgB,UAAU;AACpE,YAAM,eAAe,QAAQ;AAC7B,YAAM,IAAI,uBAAuB,OAAO,eAAe,UAAU,iBAAiB;AAAA,IACpF;AAAA,EACF;AACA,MAAI,CAAC,SAAS,MAAM;AAClB,WAAO,IAAI,WAAW;AAAA,EACxB;AAEA,QAAM,SAAS,SAAS,KAAK,UAAU;AACvC,QAAM,SAAuB,CAAC;AAC9B,MAAI,gBAAgB;AACpB,MAAI;AACF,eAAS;AACP,YAAM,SAAS,MAAM,OAAO,KAAK;AACjC,UAAI,OAAO,MAAM;AACf;AAAA,MACF;AACA,uBAAiB,OAAO,MAAM;AAC9B,UAAI,gBAAgB,UAAU;AAC5B,cAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,cAAM,IAAI,uBAAuB,OAAO,eAAe,UAAU,iBAAiB;AAAA,MACpF;AACA,aAAO,KAAK,OAAO,KAAK;AAAA,IAC1B;AAAA,EACF,SAAS,OAAO;AACd,UAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,UAAM;AAAA,EACR,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AAEA,QAAM,OAAO,IAAI,WAAW,aAAa;AACzC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,SAAK,IAAI,OAAO,MAAM;AACtB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAEA,eAAsB,wBACpB,UACA,UACA,OACiB;AACjB,SAAO,IAAI,YAAY,EAAE,OAAO,MAAM,wBAAwB,UAAU,UAAU,KAAK,CAAC;AAC1F;AAEA,eAAsB,wBACpB,UACA,UACA,OACY;AACZ,SAAO,KAAK,MAAM,MAAM,wBAAwB,UAAU,UAAU,KAAK,CAAC;AAC5E;AAiBO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YACW,QACT,SACA;AACA,UAAM,OAAO;AAHJ;AAIT,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,mBAA8B,OAAO,aAAa;AACtD,QAAM,UAAU,MAAM,WAAW,UAAU,EAAE,KAAK,KAAK,CAAC;AACxD,SAAO,QAAQ,IAAI,CAAC,UAAU,mBAAmB,KAAK,CAAC;AACzD;AAEA,IAAM,eAA0B,CAAC,OAAO,SACrC,gBAAyC,OAAO,IAAI;AAGhD,IAAM,cAAyB;AAOtC,eAAsB,yBACpB,QACA,UACA,UAA2C,CAAC,GAChB;AAC5B,QAAM,QAAQ,QAAQ,SAAS;AAC/B,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,MAAM;AAAA,EACtB,QAAQ;AACN,UAAM,IAAI,uBAAuB,eAAe,GAAG,KAAK,iBAAiB;AAAA,EAC3E;AACA,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU;AACzD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AACA,QAAM,kBAAkB,uBAAuB,SAAS,WAAW;AACnE,MAAI,QAAQ,gCAAgC,CAAC,mBAAmB,IAAI,aAAa,UAAU;AACzF,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AAEA,QAAM,WAAW,kBAAkB,IAAI,QAAQ;AAC/C,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,uBAAuB,eAAe,GAAG,KAAK,sBAAsB;AAAA,EAChF;AAEA,QAAM,gBAAgB,KAAK,QAAQ;AACnC,MAAI;AACJ,MAAI;AACF,gBAAY,gBACR,CAAC,EAAE,SAAS,UAAU,QAAQ,kBAAkB,IAAI,IAAI,EAAE,CAAC,IAC3D,OAAO,QAAQ,aAAa,kBAAkB,QAAQ;AAAA,EAC5D,SAAS,OAAO;AACd,QAAI,iBAAiB,0BAA0B,MAAM,WAAW,sBAAsB;AACpF,YAAM;AAAA,IACR;AACA,UAAM,IAAI,uBAAuB,cAAc,GAAG,KAAK,iCAAiC;AAAA,EAC1F;AAEA,QAAM,sBAAsB,gBAAgB,SAAS;AACrD,MAAI,oBAAoB,WAAW,GAAG;AACpC,UAAM,IAAI,uBAAuB,aAAa,GAAG,KAAK,4BAA4B;AAAA,EACpF;AACA,MAAI,oBAAoB,KAAK,CAAC,UAAU,iBAAiB,MAAM,OAAO,CAAC,GAAG;AACxE,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AAEA,QAAM,gBAAgB,mBAAmB,SAAS,2CAA2C;AAC7F,MACE,CAAC,kBACA,gBAAgB,QAAQ,KACvB,oBAAoB,KAAK,CAAC,UAAU,mBAAmB,MAAM,OAAO,CAAC,IACvE;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AACA,SAAO,EAAE,KAAK,UAAU,WAAW,oBAAoB;AACzD;AAOA,eAAsB,YACpB,OACA,MACA,UACA,UAA8B,CAAC,GACZ;AACnB,QAAM,SAAS,iBAAiB,UAAU,MAAM,MAAM;AACtD,QAAM,cAAc,MAAM,yBAAyB,QAAQ,UAAU,OAAO;AAC5E,QAAM,aACJ,QAAQ,eAAe,YAAY,SAAS,KAAK,kBAAkB,YAAY,SAAS;AAC1F,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,YAAY;AAAA,IAChB,GAAG;AAAA,IACH,UAAU;AAAA,IACV,YAAY,WAAW,cAAc;AAAA,EACvC;AACA,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,UAAU,OAAO,SAAS;AAAA,EAC7C,SAAS,OAAO;AACd,UAAM,kBAAkB,YAAY,KAAK;AACzC,UAAM;AAAA,EACR;AACA,MAAI,CAAC,SAAS,MAAM;AAClB,UAAM,gBAAgB,UAAU;AAChC,WAAO;AAAA,EACT;AACA,SAAO,gCAAgC,UAAU,UAAU;AAC7D;AAEO,SAAS,uBAAuB,aAA8B;AACnE,SAAO,gBAAgB,WAAW,gBAAgB;AACpD;AAGO,SAAS,iBAAiB,SAA0B;AACzD,SAAO,KAAK,qBAAqB,QAAQ,KAAK,CAAC,CAAC,MAAM;AACxD;AAOO,SAAS,mBAAmB,SAA0B;AAC3D,QAAM,aAAa,qBAAqB,QAAQ,KAAK,EAAE,YAAY,CAAC;AACpE,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI,WAAW,GAAG;AAChB,WAAO;AAAA,EACT;AACA,MAAI,WAAW,GAAG;AAChB,WAAO,gBAAgB,UAAU;AAAA,EACnC;AACA,QAAM,aAAa,mBAAmB,UAAU;AAChD,MAAI,eAAe,MAAM;AACvB,WAAO,gBAAgB,UAAU;AAAA,EACnC;AACA,QAAM,QAAQ,UAAU,UAAU;AAClC,MAAI,UAAU,MAAM;AAClB,WAAO;AAAA,EACT;AACA,QAAM,SAAS,mBAAmB,KAAK;AACvC,MAAI,WAAW,MAAM;AACnB,WAAO,gBAAgB,MAAM;AAAA,EAC/B;AAKA,MAAI,CAAC,cAAc,OAAO,4BAA4B,CAAC,GAAG;AACxD,WAAO;AAAA,EACT;AACA,SAAO,sBAAsB,KAAK,CAAC,CAAC,QAAQ,IAAI,MAAM,cAAc,OAAO,QAAQ,IAAI,CAAC;AAC1F;AAGO,IAAM,mBAAmB;AAEhC,SAAS,kBAAkB,WAAuD;AAChF,QAAM,QAAQ,IAAI,MAAM;AAAA,IACtB,SAAS;AAAA,MACP,QAAS,CACP,WACA,SACA,aAKG;AACH,cAAM,aACJ,QAAQ,WAAW,KAAK,QAAQ,WAAW,IACvC,UAAU,OAAO,CAAC,UAAU,MAAM,WAAW,QAAQ,MAAM,IAC3D;AACN,YAAI,WAAW,WAAW,GAAG;AAC3B,mBAAS,IAAI,MAAM,uDAAuD,CAAC;AAC3E;AAAA,QACF;AACA,YAAI,QAAQ,KAAK;AACf;AAAA,YACE;AAAA,YACA,WAAW,IAAI,CAAC,WAAW,EAAE,SAAS,MAAM,SAAS,QAAQ,MAAM,OAAO,EAAE;AAAA,UAC9E;AACA;AAAA,QACF;AACA,cAAM,QAAQ,WAAW,CAAC;AAC1B,iBAAS,MAAM,MAAM,SAAS,MAAM,MAAM;AAAA,MAC5C;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,OAAO,YAAY;AACjB,YAAM,MAAM,MAAM;AAAA,IACpB;AAAA,IACA,SAAS,OAAO,UAAU;AACxB,YAAM,MAAM,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI;AAAA,IAC3D;AAAA,EACF;AACF;AAEA,SAAS,gCACP,UACA,YACU;AACV,QAAM,SAAS,SAAS,KAAM,UAAU;AACxC,MAAI,WAAiC;AACrC,MAAI,YAAY;AAChB,QAAM,SAAS,CAAC,SAAkB,UAAmC;AACnE,QAAI,CAAC,UAAU;AACb,iBAAW,UAAU,kBAAkB,YAAY,KAAK,IAAI,gBAAgB,UAAU;AAAA,IACxF;AACA,WAAO;AAAA,EACT;AACA,QAAM,OAAO,IAAI,eAA2B;AAAA,IAC1C,MAAM,KAAK,YAAY;AACrB,UAAI;AACF,cAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,YAAI,MAAM,MAAM;AACd,gBAAM,OAAO,SAAS;AACtB,qBAAW,MAAM;AACjB;AAAA,QACF;AACA,mBAAW,QAAQ,MAAM,KAAK;AAAA,MAChC,SAAS,OAAO;AACd,cAAM,OAAO,MAAM,KAAK;AACxB,mBAAW,MAAM,KAAK;AAAA,MACxB;AAAA,IACF;AAAA,IACA,MAAM,OAAO,QAAQ;AACnB,kBAAY;AACZ,UAAI;AACF,cAAM,OAAO,OAAO,MAAM;AAAA,MAC5B,UAAE;AACA,cAAM,OAAO,MAAM,MAAM;AAAA,MAC3B;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,UAAU,IAAI,SAAS,MAAM;AAAA,IACjC,QAAQ,SAAS;AAAA,IACjB,YAAY,SAAS;AAAA,IACrB,SAAS,SAAS;AAAA,EACpB,CAAC;AACD,SAAO,iBAAiB,SAAS;AAAA,IAC/B,YAAY,EAAE,OAAO,SAAS,WAAW;AAAA,IACzC,MAAM,EAAE,OAAO,SAAS,KAAK;AAAA,IAC7B,KAAK,EAAE,OAAO,SAAS,IAAI;AAAA,EAC7B,CAAC;AACD,SAAO;AACT;AAEA,eAAe,gBAAgB,YAAgD;AAC7E,MAAI;AACF,UAAM,WAAW,MAAM;AAAA,EACzB,QAAQ;AACN,UAAM,kBAAkB,UAAU;AAAA,EACpC;AACF;AAEA,eAAe,kBAAkB,YAAiC,OAAgC;AAChG,MAAI;AACF,UAAM,WAAW,QAAQ,KAAK;AAAA,EAChC,QAAQ;AAAA,EAER;AACF;AAEA,eAAe,eAAe,UAAmC;AAC/D,QAAM,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AACrD;AAEA,SAAS,kBAAkB,UAA0B;AACnD,SAAO,qBAAqB,SAAS,KAAK,EAAE,YAAY,CAAC,EAAE,QAAQ,OAAO,EAAE;AAC9E;AAEA,SAAS,qBAAqB,SAAyB;AACrD,SAAO,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,IAAI,QAAQ,MAAM,GAAG,EAAE,IAAI;AACnF;AAEA,SAAS,gBAAgB,UAA2B;AAClD,SAAO,aAAa,eAAe,SAAS,SAAS,YAAY;AACnE;AAEA,SAAS,mBAAmB,UAA2B;AACrD,QAAM,aAAa,kBAAkB,QAAQ;AAC7C,SACE,eAAe,eACf,WAAW,SAAS,YAAY,KAChC,eAAe,SACf,eAAe,UAAU;AAE7B;AAEA,SAAS,eAAe,UAA2B;AACjD,MAAI,KAAK,QAAQ,MAAM,EAAG,QAAO;AACjC,SAAO,SAAS,MAAM,GAAG,EAAE,CAAC,MAAM;AACpC;AAEA,SAAS,gBAAgB,WAAgD;AACvE,QAAM,MAAoB,CAAC;AAC3B,QAAM,OAAO,oBAAI,IAAY;AAC7B,MAAI,CAAC,MAAM,QAAQ,SAAS,GAAG;AAC7B,UAAM,iBAAiB;AAAA,EACzB;AACA,aAAW,SAAS,WAAW;AAC7B,UAAM,aAAa,mBAAmB,KAAK;AAC3C,UAAM,MAAM,GAAG,WAAW,MAAM,IAAI,WAAW,OAAO;AACtD,QAAI,CAAC,KAAK,IAAI,GAAG,GAAG;AAClB,WAAK,IAAI,GAAG;AACZ,UAAI,KAAK,UAAU;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAOA,SAAS,mBAAmB,OAA4B;AACtD,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,UAAM,iBAAiB;AAAA,EACzB;AACA,QAAM,YAAY;AAClB,MAAI,OAAO,UAAU,YAAY,UAAU;AACzC,UAAM,iBAAiB;AAAA,EACzB;AACA,QAAM,SAAS,UAAU;AACzB,MAAI,WAAW,KAAK,WAAW,GAAG;AAChC,UAAM,iBAAiB;AAAA,EACzB;AACA,QAAM,UAAU,qBAAqB,UAAU,QAAQ,KAAK,EAAE,YAAY,CAAC;AAC3E,QAAM,eAAe,KAAK,OAAO;AACjC,MAAI,iBAAiB,QAAQ;AAC3B,UAAM,iBAAiB;AAAA,EACzB;AACA,SAAO,EAAE,SAAS,OAAO;AAC3B;AAEA,SAAS,mBAA2C;AAClD,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,SAA0B;AACjD,QAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,IAAI,MAAM;AAC3C,MACE,MAAM,WAAW,KACjB,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,GAAG,GACtE;AACA,WAAO;AAAA,EACT;AACA,QAAM,QAAS,MAAM,CAAC,KAAM,KAAO,MAAM,CAAC,KAAM,KAAO,MAAM,CAAC,KAAM,IAAK,MAAM,CAAC;AAChF,QAAM,WAAW,UAAU;AAC3B,SACE,YAAY,UAAU,GAAY,QAAU,KAC5C,YAAY,UAAU,WAAY,SAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU,KAC5C,YAAY,UAAU,YAAY,UAAU;AAEhD;AAEA,SAAS,YAAY,OAAe,OAAe,KAAsB;AACvE,SAAO,SAAS,SAAS,SAAS;AACpC;AAEA,IAAM,6BAA6B,aAAa,QAAQ;AAExD,IAAM,wBAAqD;AAAA,EACzD,CAAC,aAAa,IAAI,GAAG,EAAE;AAAA,EACvB,CAAC,aAAa,WAAW,GAAG,EAAE;AAAA,EAC9B,CAAC,aAAa,aAAa,GAAG,EAAE;AAAA,EAChC,CAAC,aAAa,OAAO,GAAG,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1B,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,YAAY,GAAG,EAAE;AAAA,EAC/B,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,gBAAgB,GAAG,EAAE;AAAA,EACnC,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,QAAQ,GAAG,CAAC;AAAA,EAC1B,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,QAAQ,GAAG,EAAE;AAAA,EAC3B,CAAC,aAAa,QAAQ,GAAG,CAAC;AAC5B;AAEA,SAAS,cAAc,OAAe,QAAgB,MAAuB;AAC3E,QAAM,QAAQ,OAAO,OAAO,IAAI;AAChC,SAAO,SAAS,UAAU,UAAU;AACtC;AAEA,SAAS,mBAAmB,OAA8B;AACxD,MAAI,SAAS,QAAQ,SAAS;AAC5B,WAAO;AAAA,EACT;AACA,QAAM,WAAW,OAAO,QAAQ,WAAW;AAC3C,SAAO,GAAG,aAAa,EAAE,IAAK,aAAa,KAAM,GAAI,IAAK,aAAa,IAAK,GAAI,IAAI,WAAW,GAAI;AACrG;AAEA,SAAS,mBAAmB,SAAgC;AAC1D,MAAI,CAAC,QAAQ,WAAW,SAAS,GAAG;AAClC,WAAO;AAAA,EACT;AACA,QAAM,WAAW,QAAQ,MAAM,UAAU,MAAM;AAC/C,MAAI,KAAK,QAAQ,MAAM,GAAG;AACxB,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,SAAS,MAAM,GAAG;AAChC,MAAI,MAAM,WAAW,KAAK,MAAM,KAAK,CAAC,SAAS,CAAC,kBAAkB,KAAK,IAAI,CAAC,GAAG;AAC7E,WAAO;AAAA,EACT;AACA,QAAM,OAAO,OAAO,SAAS,MAAM,CAAC,GAAI,EAAE;AAC1C,QAAM,MAAM,OAAO,SAAS,MAAM,CAAC,GAAI,EAAE;AACzC,SAAO,GAAI,QAAQ,IAAK,GAAI,IAAI,OAAO,GAAI,IAAK,OAAO,IAAK,GAAI,IAAI,MAAM,GAAI;AAChF;AAEA,SAAS,UAAU,SAAgC;AACjD,QAAM,UAAU,QAAQ,QAAQ,GAAG;AACnC,MAAI,WAAW,GAAG;AAChB,WAAO;AAAA,EACT;AACA,MAAI,QAAQ;AACZ,MAAI,MAAM,SAAS,GAAG,GAAG;AACvB,UAAM,YAAY,MAAM,YAAY,GAAG;AACvC,UAAM,SAAS,MAAM,MAAM,YAAY,CAAC;AACxC,UAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,IAAI,MAAM;AAC1C,QACE,MAAM,WAAW,KACjB,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,GAAG,GACtE;AACA,aAAO;AAAA,IACT;AACA,UAAM,OACF,MAAM,CAAC,KAAM,IAAK,MAAM,CAAC,GAAI,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,KACzD,MAAM,CAAC,KAAM,IAAK,MAAM,CAAC,GAAI,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC7D,YAAQ,GAAG,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,GAAG;AAAA,EAChD;AACA,QAAM,SAAS,MAAM,MAAM,IAAI;AAC/B,MAAI,OAAO,SAAS,GAAG;AACrB,WAAO;AAAA,EACT;AACA,QAAM,OAAO,OAAO,CAAC,IAAI,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;AACjD,QAAM,QAAQ,OAAO,WAAW,KAAK,OAAO,CAAC,IAAI,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;AACzE,MAAI,KAAK,OAAO,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,mBAAmB,KAAK,IAAI,CAAC,GAAG;AACrE,WAAO;AAAA,EACT;AACA,QAAM,UAAU,OAAO,WAAW,IAAI,IAAI,KAAK,SAAS,MAAM,SAAS;AACvE,MAAI,UAAU,KAAM,OAAO,WAAW,KAAK,YAAY,GAAI;AACzD,WAAO;AAAA,EACT;AACA,QAAM,SAAS,CAAC,GAAG,MAAM,GAAG,MAAM,KAAK,EAAE,QAAQ,QAAQ,GAAG,MAAM,GAAG,GAAG,GAAG,KAAK;AAChF,MAAI,OAAO,WAAW,GAAG;AACvB,WAAO;AAAA,EACT;AACA,SAAO,OAAO,OAAO,CAAC,KAAK,UAAW,OAAO,MAAO,OAAO,KAAK,KAAK,EAAE,GAAG,EAAE;AAC9E;AAEA,SAAS,aAAa,SAAyB;AAC7C,QAAM,QAAQ,UAAU,OAAO;AAC/B,MAAI,UAAU,MAAM;AAClB,UAAM,IAAI,MAAM,0BAA0B,OAAO,EAAE;AAAA,EACrD;AACA,SAAO;AACT;","names":[]}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@opengeni/network",
+  "version": "0.1.1",
+  "description": "DNS-pinned outbound HTTP transport for OpenGeni credential-bearing requests.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Cloudgeni-ai/opengeni.git",
+    "directory": "packages/network"
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsgo --noEmit",
+    "prepublishOnly": "bash ../../scripts/prepublish-guard"
+  },
+  "dependencies": {
+    "undici": "^6.21.3"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}