@venizia/ignis-helpers 0.2.0-2 → 0.2.0-20

package/dist/cjs/modules/network/url-safety/ingest.js

@@ -0,0 +1,167 @@
+"use strict";
+// The half `policy.ts` cannot do: resolving a hostname needs `node:dns`, so nothing here may be
+// re-exported from the `./core` subpath.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UrlIngest = void 0;
+const duration_1 = require("../../../common/constants/duration");
+const error_1 = require("../../error");
+const promises_1 = require("node:dns/promises");
+const constants_1 = require("./common/constants");
+const errors_1 = require("./common/errors");
+const policy_1 = require("./policy");
+/** Fetching an untrusted url without letting it reach inside the network. */
+class UrlIngest {
+    /**
+     * Rejects when ANY resolved address is non-public. Checking only the first walks straight into a
+     * host that publishes one public A record beside an internal one.
+     *
+     * A rebinding window remains: the address can change between this check and the connect. Closing
+     * it means connecting to the resolved address and setting `Host` by hand, which no fetch API
+     * exposes.
+     */
+    static async assertPublicHost(opts) {
+        const { hostname, policy } = opts;
+        if (policy?.allowPrivateAddress ?? constants_1.UrlSafetyDefaults.ALLOW_PRIVATE_ADDRESS) {
+            return;
+        }
+        // `URL.hostname` keeps the brackets on an IPv6 literal; `lookup` does not accept them, and the
+        // ENOTFOUND that follows reads as a transient DNS failure rather than the refusal it should be.
+        const address = policy_1.UrlPolicy.readHostAddress({ hostname });
+        const addresses = await (0, promises_1.lookup)(address, { all: true });
+        if (!addresses.length) {
+            throw (0, error_1.getError)({
+                error: errors_1.UrlSafetyErrors.URL_REFUSED,
+                message: `[assertPublicHost] Host resolves to nothing | host: ${hostname}`,
+            });
+        }
+        const offender = addresses.find(entry => policy_1.UrlPolicy.isNonPublicAddress({ address: entry.address }));
+        if (offender) {
+            throw (0, error_1.getError)({
+                error: errors_1.UrlSafetyErrors.URL_REFUSED,
+                message: `[assertPublicHost] Host resolves to a non-public address | host: ${hostname} | address: ${offender.address}`,
+            });
+        }
+    }
+    /** Both halves, in the order they must run: shape first, then the network. */
+    static async assertReachableUrl(opts) {
+        const parsed = policy_1.UrlPolicy.assertSafeUrl(opts);
+        await UrlIngest.assertPublicHost({ hostname: parsed.hostname, policy: opts.policy });
+        return parsed;
+    }
+    static readTimeoutMilliseconds(opts) {
+        const { timeout } = opts.policy ?? {};
+        const milliseconds = timeout ? duration_1.DurationMultipliers.toMilliseconds(timeout) : null;
+        return milliseconds ?? constants_1.UrlSafetyDefaults.TIMEOUT_MILLISECONDS;
+    }
+    /**
+     * A GET that an untrusted url cannot steer inside the network. Redirects are followed by hand so
+     * every hop is re-checked - `redirect: 'follow'` would land on an internal host with no second
+     * look.
+     *
+     * The body is returned unread: the caller decides whether to stream it onward or cap it with
+     * {@link UrlIngest.readCappedBody}. Nothing is buffered here.
+     */
+    static async fetchGuarded(opts) {
+        const { url, policy, headers } = opts;
+        const maxRedirects = policy?.maxRedirects ?? constants_1.UrlSafetyDefaults.MAX_REDIRECTS;
+        const timeoutMilliseconds = UrlIngest.readTimeoutMilliseconds({ policy });
+        let target = await UrlIngest.assertReachableUrl({ url, policy });
+        for (let hop = 0; hop <= maxRedirects; hop += 1) {
+            const response = await fetch(target, {
+                redirect: 'manual',
+                signal: AbortSignal.timeout(timeoutMilliseconds),
+                ...(headers ? { headers } : {}),
+            });
+            if (response.status < 300 || response.status > 399) {
+                if (!response.ok) {
+                    // Cancelled, or the socket stays open on every 4xx and 5xx.
+                    await response.body?.cancel();
+                    throw (0, error_1.getError)({
+                        message: `[fetchGuarded] Request failed | status: ${response.status} | url: ${url}`,
+                    });
+                }
+                return response;
+            }
+            const location = response.headers.get('location');
+            await response.body?.cancel();
+            if (!location) {
+                throw (0, error_1.getError)({
+                    error: errors_1.UrlSafetyErrors.URL_REFUSED,
+                    message: `[fetchGuarded] Redirect carried no location | url: ${url}`,
+                });
+            }
+            target = await UrlIngest.assertReachableUrl({
+                url: new URL(location, target).toString(),
+                policy,
+            });
+        }
+        throw (0, error_1.getError)({
+            error: errors_1.UrlSafetyErrors.URL_REFUSED,
+            message: `[fetchGuarded] Too many redirects | max: ${maxRedirects} | url: ${url}`,
+        });
+    }
+    /**
+     * Enforces `maxBytes` on a stream nothing reads into this process - the shape a caller wants when
+     * the body is piped onward rather than held. Without it a `maxBytes` policy is inert on that path.
+     */
+    static capStream(opts) {
+        const { source } = opts;
+        const maxBytes = opts.policy?.maxBytes ?? constants_1.UrlSafetyDefaults.MAX_BYTES;
+        let received = 0;
+        return source.pipeThrough(new TransformStream({
+            transform(chunk, controller) {
+                received += chunk.byteLength;
+                if (received > maxBytes) {
+                    controller.error((0, error_1.getError)({
+                        error: errors_1.UrlSafetyErrors.URL_REFUSED,
+                        message: `[capStream] Body exceeds the cap | received: ${received} | max: ${maxBytes}`,
+                    }));
+                    return;
+                }
+                controller.enqueue(chunk);
+            },
+        }));
+    }
+    /**
+     * Reads a body that must not exceed `maxBytes`, cancelling the moment it does. `content-length` is
+     * checked first because it is free, and counted anyway because it may be absent or lie.
+     */
+    static async readCappedBody(opts) {
+        const { response, policy } = opts;
+        const maxBytes = policy?.maxBytes ?? constants_1.UrlSafetyDefaults.MAX_BYTES;
+        const declaredLength = Number(response.headers.get('content-length') ?? 0);
+        if (declaredLength > maxBytes) {
+            await response.body?.cancel();
+            // The same fact as the streaming branch below, so the same verdict: a caller must not retry an
+            // oversized body when the server sends `content-length` and drop it when the server omits one.
+            throw (0, error_1.getError)({
+                error: errors_1.UrlSafetyErrors.URL_REFUSED,
+                message: `[readCappedBody] Body exceeds the cap | declared: ${declaredLength} | max: ${maxBytes}`,
+            });
+        }
+        const reader = response.body?.getReader();
+        if (!reader) {
+            throw (0, error_1.getError)({ message: '[readCappedBody] Response carried no body' });
+        }
+        const chunks = [];
+        let received = 0;
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done) {
+                break;
+            }
+            received += value.length;
+            if (received > maxBytes) {
+                await reader.cancel();
+                throw (0, error_1.getError)({
+                    error: errors_1.UrlSafetyErrors.URL_REFUSED,
+                    message: `[readCappedBody] Body exceeds the cap | received: ${received} | max: ${maxBytes}`,
+                });
+            }
+            chunks.push(value);
+        }
+        return Buffer.concat(chunks);
+    }
+}
+exports.UrlIngest = UrlIngest;
+//# sourceMappingURL=ingest.js.map

package/dist/cjs/modules/network/url-safety/ingest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest.js","sourceRoot":"","sources":["../../../../../src/modules/network/url-safety/ingest.ts"],"names":[],"mappings":";AAAA,gGAAgG;AAChG,yCAAyC;;;AAEzC,0DAAkE;AAClE,2CAA2C;AAC3C,gDAA2C;AAC3C,kDAAuD;AACvD,4CAAkD;AAElD,qCAAqC;AAErC,6EAA6E;AAC7E,MAAa,SAAS;IACpB;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAG7B;QACC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAElC,IAAI,MAAM,EAAE,mBAAmB,IAAI,6BAAiB,CAAC,qBAAqB,EAAE,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,+FAA+F;QAC/F,gGAAgG;QAChG,MAAM,OAAO,GAAG,kBAAS,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,IAAA,iBAAM,EAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAA,gBAAQ,EAAC;gBACb,KAAK,EAAE,wBAAe,CAAC,WAAW;gBAClC,OAAO,EAAE,uDAAuD,QAAQ,EAAE;aAC3E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACtC,kBAAS,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CACzD,CAAC;QAEF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAA,gBAAQ,EAAC;gBACb,KAAK,EAAE,wBAAe,CAAC,WAAW;gBAClC,OAAO,EAAE,oEAAoE,QAAQ,eAAe,QAAQ,CAAC,OAAO,EAAE;aACvH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAgD;QAC9E,MAAM,MAAM,GAAG,kBAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,SAAS,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrF,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,uBAAuB,CAAC,IAAmC;QACxE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACtC,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,8BAAmB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,OAAO,YAAY,IAAI,6BAAiB,CAAC,oBAAoB,CAAC;IAChE,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAIzB;QACC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QACtC,MAAM,YAAY,GAAG,MAAM,EAAE,YAAY,IAAI,6BAAiB,CAAC,aAAa,CAAC;QAC7E,MAAM,mBAAmB,GAAG,SAAS,CAAC,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAE1E,IAAI,MAAM,GAAG,MAAM,SAAS,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAEjE,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,YAAY,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;gBACnC,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;gBAChD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChC,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBACnD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,4DAA4D;oBAC5D,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;oBAC9B,MAAM,IAAA,gBAAQ,EAAC;wBACb,OAAO,EAAE,2CAA2C,QAAQ,CAAC,MAAM,WAAW,GAAG,EAAE;qBACpF,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAE9B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAA,gBAAQ,EAAC;oBACb,KAAK,EAAE,wBAAe,CAAC,WAAW;oBAClC,OAAO,EAAE,sDAAsD,GAAG,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,GAAG,MAAM,SAAS,CAAC,kBAAkB,CAAC;gBAC1C,GAAG,EAAE,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE;gBACzC,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAA,gBAAQ,EAAC;YACb,KAAK,EAAE,wBAAe,CAAC,WAAW;YAClC,OAAO,EAAE,4CAA4C,YAAY,WAAW,GAAG,EAAE;SAClF,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,SAAS,CAAC,IAGhB;QACC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,6BAAiB,CAAC,SAAS,CAAC;QACtE,IAAI,QAAQ,GAAG,CAAC,CAAC;QAEjB,OAAO,MAAM,CAAC,WAAW,CACvB,IAAI,eAAe,CAAyB;YAC1C,SAAS,CAAC,KAAK,EAAE,UAAU;gBACzB,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC;gBAE7B,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;oBACxB,UAAU,CAAC,KAAK,CACd,IAAA,gBAAQ,EAAC;wBACP,KAAK,EAAE,wBAAe,CAAC,WAAW;wBAClC,OAAO,EAAE,gDAAgD,QAAQ,WAAW,QAAQ,EAAE;qBACvF,CAAC,CACH,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAG3B;QACC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,6BAAiB,CAAC,SAAS,CAAC;QAEjE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3E,IAAI,cAAc,GAAG,QAAQ,EAAE,CAAC;YAC9B,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9B,+FAA+F;YAC/F,+FAA+F;YAC/F,MAAM,IAAA,gBAAQ,EAAC;gBACb,KAAK,EAAE,wBAAe,CAAC,WAAW;gBAClC,OAAO,EAAE,qDAAqD,cAAc,WAAW,QAAQ,EAAE;aAClG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAA,gBAAQ,EAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,QAAQ,GAAG,CAAC,CAAC;QAEjB,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM;YACR,CAAC;YAED,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;YACzB,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;gBACxB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAA,gBAAQ,EAAC;oBACb,KAAK,EAAE,wBAAe,CAAC,WAAW;oBAClC,OAAO,EAAE,qDAAqD,QAAQ,WAAW,QAAQ,EAAE;iBAC5F,CAAC,CAAC;YACL,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;CACF;AAvMD,8BAuMC"}

package/dist/cjs/modules/network/url-safety/policy.d.ts

@@ -0,0 +1,29 @@
+import { UrlSafetyDefaults, UrlSchemes } from './common/constants';
+import type { IUrlSafetyPolicy } from './common/types';
+/** Everything about a url that can be decided without touching the network. */
+export declare class UrlPolicy {
+    /** A dotted-quad that is not routable on the public internet. An unparseable input counts as non-public. */
+    private static isNonPublicIPv4;
+    /**
+     * An address that must never be reached with an untrusted url. Anything unrecognised answers
+     * `true`: a guard that fails open on a string it cannot parse is not a guard.
+     */
+    static isNonPublicAddress(opts: {
+        address: string;
+    }): boolean;
+    /** A bracketed IPv6 literal arrives as `[::1]`; the brackets are not part of the address. */
+    static readHostAddress(opts: {
+        hostname: string;
+    }): string;
+    /**
+     * A hostname that RESOLVES to a private address passes here on purpose - `UrlIngest` catches that,
+     * and this half runs where `node:dns` does not exist.
+     */
+    static assertSafeUrl(opts: {
+        url: string;
+        policy?: IUrlSafetyPolicy;
+    }): URL;
+}
+export { UrlSafetyDefaults, UrlSchemes };
+export type { IUrlSafetyPolicy };
+//# sourceMappingURL=policy.d.ts.map

package/dist/cjs/modules/network/url-safety/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../../../src/modules/network/url-safety/policy.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,+EAA+E;AAC/E,qBAAa,SAAS;IACpB,4GAA4G;IAC5G,OAAO,CAAC,MAAM,CAAC,eAAe;IA0B9B;;;OAGG;IACH,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO;IAoC7D,6FAA6F;IAC7F,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAK1D;;;OAGG;IACH,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;KAAE,GAAG,GAAG;CA0C5E;AAED,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC;AACzC,YAAY,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/cjs/modules/network/url-safety/policy.js

@@ -0,0 +1,114 @@
+"use strict";
+// The browser-pure half of the guard: a url and a literal address are decided with string and
+// number work alone. Resolving a hostname needs `node:dns` and lives in `ingest.ts`, which this
+// file must never import - `policy.ts` is re-exported from the `./core` subpath and is gated by
+// `make purity`.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UrlSchemes = exports.UrlSafetyDefaults = exports.UrlPolicy = void 0;
+const error_1 = require("../../error");
+const constants_1 = require("./common/constants");
+Object.defineProperty(exports, "UrlSafetyDefaults", { enumerable: true, get: function () { return constants_1.UrlSafetyDefaults; } });
+Object.defineProperty(exports, "UrlSchemes", { enumerable: true, get: function () { return constants_1.UrlSchemes; } });
+const errors_1 = require("./common/errors");
+/** Everything about a url that can be decided without touching the network. */
+class UrlPolicy {
+    /** A dotted-quad that is not routable on the public internet. An unparseable input counts as non-public. */
+    static isNonPublicIPv4(opts) {
+        const parts = opts.address.split('.').map(Number);
+        if (parts.length !== 4 ||
+            parts.some(part => !Number.isInteger(part) || part < 0 || part > 255)) {
+            return true;
+        }
+        const [first, second] = parts;
+        return (first === 0 || // this host
+            first === 10 || // private
+            first === 127 || // loopback
+            (first === 100 && second >= 64 && second <= 127) || // carrier-grade NAT
+            (first === 169 && second === 254) || // link-local, and the cloud metadata address
+            (first === 172 && second >= 16 && second <= 31) || // private
+            (first === 192 && second === 0) || // IETF protocol assignments
+            (first === 192 && second === 168) || // private
+            (first === 198 && (second === 18 || second === 19)) || // benchmarking
+            first >= 224 // multicast and reserved
+        );
+    }
+    /**
+     * An address that must never be reached with an untrusted url. Anything unrecognised answers
+     * `true`: a guard that fails open on a string it cannot parse is not a guard.
+     */
+    static isNonPublicAddress(opts) {
+        const normalized = opts.address.toLowerCase().split('%')[0];
+        if (!normalized.includes(':')) {
+            return UrlPolicy.isNonPublicIPv4({ address: normalized });
+        }
+        // An IPv4 address wearing an IPv6 coat walks past every naive v6 check. Both spellings must be
+        // unwrapped: `new URL` rewrites `::ffff:169.254.169.254` into the hex form `::ffff:a9fe:a9fe`,
+        // so a dotted-quad-only check is green on a value the parser never actually produces.
+        const dottedMapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(normalized)?.[1];
+        if (dottedMapped) {
+            return UrlPolicy.isNonPublicIPv4({ address: dottedMapped });
+        }
+        const hexMapped = /^::ffff:([\da-f]{1,4}):([\da-f]{1,4})$/.exec(normalized);
+        if (hexMapped) {
+            const high = Number.parseInt(hexMapped[1], 16);
+            const low = Number.parseInt(hexMapped[2], 16);
+            const dotted = [high >> 8, high & 0xff, low >> 8, low & 0xff].join('.');
+            return UrlPolicy.isNonPublicIPv4({ address: dotted });
+        }
+        return (normalized === '::' ||
+            normalized === '::1' ||
+            normalized.startsWith('fc') || // unique local
+            normalized.startsWith('fd') ||
+            normalized.startsWith('fe8') || // link-local
+            normalized.startsWith('fe9') ||
+            normalized.startsWith('fea') ||
+            normalized.startsWith('feb'));
+    }
+    /** A bracketed IPv6 literal arrives as `[::1]`; the brackets are not part of the address. */
+    static readHostAddress(opts) {
+        const { hostname } = opts;
+        return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+    }
+    /**
+     * A hostname that RESOLVES to a private address passes here on purpose - `UrlIngest` catches that,
+     * and this half runs where `node:dns` does not exist.
+     */
+    static assertSafeUrl(opts) {
+        const { url, policy } = opts;
+        const allowedSchemes = policy?.allowedSchemes ?? constants_1.UrlSafetyDefaults.ALLOWED_SCHEMES;
+        const allowPrivateAddress = policy?.allowPrivateAddress ?? constants_1.UrlSafetyDefaults.ALLOW_PRIVATE_ADDRESS;
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            throw (0, error_1.getError)({
+                error: errors_1.UrlSafetyErrors.URL_REFUSED,
+                message: `[assertSafeUrl] Malformed url | url: ${url}`,
+            });
+        }
+        if (!allowedSchemes.includes(parsed.protocol)) {
+            throw (0, error_1.getError)({
+                error: errors_1.UrlSafetyErrors.URL_REFUSED,
+                message: `[assertSafeUrl] Disallowed scheme | scheme: ${parsed.protocol} | allowed: ${allowedSchemes.join(', ')}`,
+            });
+        }
+        if (policy?.allowedHosts && !policy.allowedHosts.includes(parsed.hostname)) {
+            throw (0, error_1.getError)({
+                error: errors_1.UrlSafetyErrors.URL_REFUSED,
+                message: `[assertSafeUrl] Host is not in the allow-list | host: ${parsed.hostname}`,
+            });
+        }
+        const address = UrlPolicy.readHostAddress({ hostname: parsed.hostname });
+        const isLiteralAddress = /^[\d.]+$/.test(address) || address.includes(':');
+        if (!allowPrivateAddress && isLiteralAddress && UrlPolicy.isNonPublicAddress({ address })) {
+            throw (0, error_1.getError)({
+                error: errors_1.UrlSafetyErrors.URL_REFUSED,
+                message: `[assertSafeUrl] Url points at a non-public address | address: ${address}`,
+            });
+        }
+        return parsed;
+    }
+}
+exports.UrlPolicy = UrlPolicy;
+//# sourceMappingURL=policy.js.map

package/dist/cjs/modules/network/url-safety/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../../../src/modules/network/url-safety/policy.ts"],"names":[],"mappings":";AAAA,8FAA8F;AAC9F,gGAAgG;AAChG,gGAAgG;AAChG,iBAAiB;;;AAEjB,2CAA2C;AAC3C,kDAAmE;AA+H1D,kGA/HA,6BAAiB,OA+HA;AAAE,2FA/HA,sBAAU,OA+HA;AA9HtC,4CAAkD;AAGlD,+EAA+E;AAC/E,MAAa,SAAS;IACpB,4GAA4G;IACpG,MAAM,CAAC,eAAe,CAAC,IAAyB;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAElD,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,EACrE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;QAE9B,OAAO,CACL,KAAK,KAAK,CAAC,IAAI,YAAY;YAC3B,KAAK,KAAK,EAAE,IAAI,UAAU;YAC1B,KAAK,KAAK,GAAG,IAAI,WAAW;YAC5B,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,GAAG,CAAC,IAAI,oBAAoB;YACxE,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,IAAI,6CAA6C;YAClF,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,UAAU;YAC7D,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,4BAA4B;YAC/D,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,IAAI,UAAU;YAC/C,CAAC,KAAK,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,IAAI,eAAe;YACtE,KAAK,IAAI,GAAG,CAAC,yBAAyB;SACvC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,kBAAkB,CAAC,IAAyB;QACjD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,+FAA+F;QAC/F,+FAA+F;QAC/F,sFAAsF;QACtF,MAAM,YAAY,GAAG,+BAA+B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,SAAS,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,SAAS,GAAG,wCAAwC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5E,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAExE,OAAO,SAAS,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,CACL,UAAU,KAAK,IAAI;YACnB,UAAU,KAAK,KAAK;YACpB,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,eAAe;YAC9C,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;YAC3B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,aAAa;YAC7C,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAC7B,CAAC;IACJ,CAAC;IAED,6FAA6F;IAC7F,MAAM,CAAC,eAAe,CAAC,IAA0B;QAC/C,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAC1B,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/F,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,aAAa,CAAC,IAAgD;QACnE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAC7B,MAAM,cAAc,GAAG,MAAM,EAAE,cAAc,IAAI,6BAAiB,CAAC,eAAe,CAAC;QACnF,MAAM,mBAAmB,GACvB,MAAM,EAAE,mBAAmB,IAAI,6BAAiB,CAAC,qBAAqB,CAAC;QAEzE,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAA,gBAAQ,EAAC;gBACb,KAAK,EAAE,wBAAe,CAAC,WAAW;gBAClC,OAAO,EAAE,wCAAwC,GAAG,EAAE;aACvD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAA,gBAAQ,EAAC;gBACb,KAAK,EAAE,wBAAe,CAAC,WAAW;gBAClC,OAAO,EAAE,+CAA+C,MAAM,CAAC,QAAQ,eAAe,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAClH,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,EAAE,YAAY,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAA,gBAAQ,EAAC;gBACb,KAAK,EAAE,wBAAe,CAAC,WAAW;gBAClC,OAAO,EAAE,yDAAyD,MAAM,CAAC,QAAQ,EAAE;aACpF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzE,MAAM,gBAAgB,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE3E,IAAI,CAAC,mBAAmB,IAAI,gBAAgB,IAAI,SAAS,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YAC1F,MAAM,IAAA,gBAAQ,EAAC;gBACb,KAAK,EAAE,wBAAe,CAAC,WAAW;gBAClC,OAAO,EAAE,iEAAiE,OAAO,EAAE;aACpF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAxHD,8BAwHC"}

package/dist/cjs/modules/pool/abstract.d.ts

@@ -1,6 +1,6 @@
 import { ValueOrPromise } from '../../common/types';
-import { BaseHelper } from '../../modules/base';
-import { IPool, IPoolControlOptions, IPoolStats } from './types';
+import { BaseHelper } from '../base';
+import { IPool, IPoolControlOptions, IPoolStats } from './common';
 /** Single-borrower pool skeleton: subclasses override {@link create} (required) and optionally validateResource/resetResource/onDestroyResource. All resource-waiter pairing flows through ONE re-entrancy-guarded `dispatch()` loop; the waiter queue is {@link HfQueueHelper} - O(1), no shift/splice. */
 export declare abstract class AbstractPoolHelper<T> extends BaseHelper implements IPool<T> {
     protected readonly size: number;

package/dist/cjs/modules/pool/abstract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"abstract.d.ts","sourceRoot":"","sources":["../../../../src/modules/pool/abstract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAG5C,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAe,MAAM,SAAS,CAAC;AAE9E,4SAA4S;AAC5S,8BAAsB,kBAAkB,CAAC,CAAC,CAAE,SAAQ,UAAW,YAAW,KAAK,CAAC,CAAC,CAAC;IAChF,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC7C,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE9C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAW;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuC;IAEnE,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,WAAW,CAAS;gBAEhB,IAAI,EAAE,mBAAmB;IASrC,qCAAqC;IACrC,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,CAAC;IAE9C,2GAA2G;IAC3G,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,cAAc,CAAC,OAAO,CAAC;IAI3E,6GAA6G;IAC7G,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,cAAc,CAAC,IAAI,CAAC;IAIrE,wEAAwE;IACxE,SAAS,CAAC,iBAAiB,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,cAAc,CAAC,IAAI,CAAC;IAMzE,QAAQ,IAAI,UAAU;IAShB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC;IAqC3B,OAAO,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,IAAI;IAqB9B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAcvB,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE;QAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IAgB3E,OAAO,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAY7C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAgBhB,cAAc;YAed,eAAe;IAY7B,yFAAyF;IACzF,OAAO,CAAC,YAAY;IAQpB,2JAA2J;YAC7I,QAAQ;IAsCtB,8GAA8G;YAChG,gBAAgB;IA8B9B,qGAAqG;YACvF,aAAa;IAY3B,mJAAmJ;IACnJ,OAAO,CAAC,YAAY;IAwBpB,sGAAsG;IACtG,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,gBAAgB;CAOzB"}
+{"version":3,"file":"abstract.d.ts","sourceRoot":"","sources":["../../../../src/modules/pool/abstract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAG5C,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAe,MAAM,UAAU,CAAC;AAE/E,4SAA4S;AAC5S,8BAAsB,kBAAkB,CAAC,CAAC,CAAE,SAAQ,UAAW,YAAW,KAAK,CAAC,CAAC,CAAC;IAChF,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC7C,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE9C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAW;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuC;IAEnE,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,WAAW,CAAS;gBAEhB,IAAI,EAAE,mBAAmB;IASrC,qCAAqC;IACrC,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,CAAC;IAE9C,2GAA2G;IAC3G,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,cAAc,CAAC,OAAO,CAAC;IAI3E,6GAA6G;IAC7G,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,cAAc,CAAC,IAAI,CAAC;IAIrE,wEAAwE;IACxE,SAAS,CAAC,iBAAiB,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,cAAc,CAAC,IAAI,CAAC;IAMzE,QAAQ,IAAI,UAAU;IAShB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC;IAqC3B,OAAO,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,IAAI;IAqB9B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAcvB,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE;QAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IAgB3E,OAAO,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAY7C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAgBhB,cAAc;YAed,eAAe;IAY7B,yFAAyF;IACzF,OAAO,CAAC,YAAY;IAQpB,2JAA2J;YAC7I,QAAQ;IAsCtB,8GAA8G;YAChG,gBAAgB;IA8B9B,qGAAqG;YACvF,aAAa;IAY3B,mJAAmJ;IACnJ,OAAO,CAAC,YAAY;IAwBpB,sGAAsG;IACtG,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,gBAAgB;CAOzB"}

package/dist/cjs/modules/pool/abstract.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AbstractPoolHelper = void 0;
-const base_1 = require("../../modules/base");
-const error_1 = require("../../modules/error");
-const hf_1 = require("../../modules/queue/internal/hf");
+const base_1 = require("../base");
+const error_1 = require("../error");
+const hf_1 = require("../queue/internal/hf");
 /** Single-borrower pool skeleton: subclasses override {@link create} (required) and optionally validateResource/resetResource/onDestroyResource. All resource-waiter pairing flows through ONE re-entrancy-guarded `dispatch()` loop; the waiter queue is {@link HfQueueHelper} - O(1), no shift/splice. */
 class AbstractPoolHelper extends base_1.BaseHelper {
     constructor(opts) {

package/dist/cjs/modules/pool/base.d.ts

@@ -1,6 +1,6 @@
 import { ValueOrPromise } from '../../common/types';
 import { AbstractPoolHelper } from './abstract';
-import { IPoolOptions } from './types';
+import { IPoolOptions } from './common';
 /** Concrete object pool configured by callbacks ({@link IPoolOptions}); implements the AbstractPoolHelper lifecycle hooks by delegating to `create`/`validate`/`reset`/`destroy`. */
 export declare class BasePoolHelper<T> extends AbstractPoolHelper<T> {
     private readonly factory;

package/dist/cjs/modules/pool/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/modules/pool/base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,qLAAqL;AACrL,qBAAa,cAAc,CAAC,CAAC,CAAE,SAAQ,kBAAkB,CAAC,CAAC,CAAC;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkB;gBAE9B,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IAUpC,SAAS,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,CAAC;cAIlB,gBAAgB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,cAAc,CAAC,OAAO,CAAC;cAIhE,aAAa,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,cAAc,CAAC,IAAI,CAAC;cAI1D,iBAAiB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,cAAc,CAAC,IAAI,CAAC;CAGlF"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/modules/pool/base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,qLAAqL;AACrL,qBAAa,cAAc,CAAC,CAAC,CAAE,SAAQ,kBAAkB,CAAC,CAAC,CAAC;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkB;gBAE9B,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IAUpC,SAAS,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,CAAC;cAIlB,gBAAgB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,cAAc,CAAC,OAAO,CAAC;cAIhE,aAAa,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,cAAc,CAAC,IAAI,CAAC;cAI1D,iBAAiB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,cAAc,CAAC,IAAI,CAAC;CAGlF"}

package/dist/cjs/modules/pool/common/index.d.ts

@@ -0,0 +1,2 @@
+export * from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/modules/pool/common/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/modules/pool/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC"}

package/dist/cjs/modules/pool/common/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/modules/pool/common/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/modules/pool/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB"}

package/dist/{esm/modules/pool → cjs/modules/pool/common}/types.d.ts

@@ -1,4 +1,4 @@
-import { TNullable, ValueOrPromise } from '../../common/types.js';
+import { TNullable, ValueOrPromise } from '../../../common/types';
 export interface IPoolStats {
     size: number;
     available: number;

package/dist/cjs/modules/pool/common/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/modules/pool/common/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE3D,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,KAAK,CAAC,CAAC;IACtB,gGAAgG;IAChG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IAEtB,6FAA6F;IAC7F,OAAO,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IAErC,2GAA2G;IAC3G,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE;QAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE5E,+DAA+D;IAC/D,OAAO,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9C,6DAA6D;IAC7D,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAExB,kFAAkF;IAClF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,QAAQ,IAAI,UAAU,CAAC;CACxB;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2FAA2F;IAC3F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wMAAwM;AACxM,MAAM,WAAW,YAAY,CAAC,CAAC,CAAE,SAAQ,mBAAmB;IAC1D,sCAAsC;IACtC,MAAM,EAAE,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC;IAEhC,gEAAgE;IAChE,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,cAAc,CAAC,IAAI,CAAC,CAAC;IAEhD,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,cAAc,CAAC,OAAO,CAAC,CAAC;IAEpD,mGAAmG;IACnG,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,cAAc,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,wGAAwG;AACxG,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACjC,KAAK,EAAE,SAAS,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;CACjD"}

package/dist/cjs/modules/pool/common/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../src/modules/pool/common/types.ts"],"names":[],"mappings":""}

package/dist/cjs/modules/pool/index.d.ts

@@ -1,4 +1,4 @@
 export * from './abstract';
 export * from './base';
-export * from './types';
+export * from './common';
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/modules/pool/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/modules/pool/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/modules/pool/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,QAAQ,CAAC;AACvB,cAAc,UAAU,CAAC"}

package/dist/cjs/modules/pool/index.js

@@ -16,5 +16,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./abstract"), exports);
 __exportStar(require("./base"), exports);
-__exportStar(require("./types"), exports);
+__exportStar(require("./common"), exports);
 //# sourceMappingURL=index.js.map

package/dist/cjs/modules/pool/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/modules/pool/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B;AAC3B,yCAAuB;AACvB,0CAAwB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/modules/pool/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B;AAC3B,yCAAuB;AACvB,2CAAyB"}

package/dist/cjs/modules/queue/bullmq/helper.d.ts

@@ -1,14 +1,18 @@
-import { BaseHelper } from '../../../modules/base';
-import { IRedisHelper } from '../../../modules/redis';
-import { Job, Processor, Queue, Worker } from 'bullmq';
+import { BaseHelper } from '../../base';
+import { IRedisHelper } from '../../redis';
+import { Job, Processor, Queue, QueueOptions, Worker, WorkerOptions } from 'bullmq';
 import { TBullQueueRole } from '../common';
-interface IBullMQOptions<TQueueElement = any, TQueueResult = any> {
+export interface IBullMQOptions<TQueueElement = any, TQueueResult = any> {
     queueName: string;
     identifier: string;
     role: TBullQueueRole;
     redisConnection: IRedisHelper;
     numberOfWorker?: number;
     lockDuration?: number;
+    /** Merged over the framework defaults, under the fields the helper owns (`connection`) - see `queueOptionsFor`. */
+    queueOptions?: Omit<QueueOptions, 'connection'>;
+    /** Merged under the fields the helper owns (`connection`, `concurrency`, `lockDuration`) - see `workerOptionsFor`. */
+    workerOptions?: Omit<WorkerOptions, 'connection' | 'concurrency' | 'lockDuration'>;
     onWorkerData?: (job: Job<TQueueElement, TQueueResult>) => Promise<any>;
     onWorkerDataCompleted?: (job: Job<TQueueElement, TQueueResult>, result: any) => Promise<void>;
     onWorkerDataFail?: (job: Job<TQueueElement, TQueueResult> | undefined, error: Error) => Promise<void>;
@@ -21,13 +25,26 @@ export declare class BullMQHelper<TQueueElement = any, TQueueResult = any> exten
     worker: Worker<TQueueElement, TQueueResult>;
     protected numberOfWorker: number;
     protected lockDuration: number;
+    protected queueOptions?: Omit<QueueOptions, 'connection'>;
+    protected workerOptions?: Omit<WorkerOptions, 'connection' | 'concurrency' | 'lockDuration'>;
     protected onWorkerData?: (job: Job<TQueueElement, TQueueResult>) => Promise<any>;
     protected onWorkerDataCompleted?: (job: Job<TQueueElement, TQueueResult>, result: any) => Promise<void>;
     protected onWorkerDataFail?: (job: Job<TQueueElement, TQueueResult> | undefined, error: Error) => Promise<void>;
     constructor(options: IBullMQOptions<TQueueElement, TQueueResult>);
     static newInstance<T = any, R = any>(opts: IBullMQOptions<T, R>): BullMQHelper<T, R>;
-    private resolveQueueName;
+    /** Structural cluster check: catches a real `Cluster` instance, a duplicated cluster client, and one built from a second ioredis copy (fails `instanceof` across module copies). */
+    protected isClusterClient(): boolean;
+    protected resolveQueueName(): string;
     configureQueue(): void;
+    /** Full `Queue` options: framework defaults, then `this.queueOptions`, then the connection the helper owns - in that precedence order. */
+    protected queueOptionsFor(opts: {
+        queueName: string;
+    }): QueueOptions;
+    /** Full `Worker` options: `this.workerOptions`, then the connection/concurrency/lock fields the helper owns - in that precedence order. */
+    protected workerOptionsFor(opts: {
+        queueName: string;
+        processor: Processor<TQueueElement, TQueueResult>;
+    }): WorkerOptions;
     /** Client factory seam - overridden in tests to run the helper without Redis. */
     protected buildQueue(opts: {
         queueName: string;
@@ -41,5 +58,4 @@ export declare class BullMQHelper<TQueueElement = any, TQueueResult = any> exten
     configure(): void;
     close(): Promise<void>;
 }
-export {};
 //# sourceMappingURL=helper.d.ts.map

package/dist/cjs/modules/queue/bullmq/helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../../../../../src/modules/queue/bullmq/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAqB,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE1E,OAAO,EAAc,cAAc,EAAE,MAAM,WAAW,CAAC;AAEvD,UAAU,cAAc,CAAC,aAAa,GAAG,GAAG,EAAE,YAAY,GAAG,GAAG;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,cAAc,CAAC;IACrB,eAAe,EAAE,YAAY,CAAC;IAE9B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IACvE,qBAAqB,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F,gBAAgB,CAAC,EAAE,CACjB,GAAG,EAAE,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,GAAG,SAAS,EACjD,KAAK,EAAE,KAAK,KACT,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB;AAED,qBAAa,YAAY,CAAC,aAAa,GAAG,GAAG,EAAE,YAAY,GAAG,GAAG,CAAE,SAAQ,UAAU;IACnF,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC;IAC/B,SAAS,CAAC,eAAe,EAAE,YAAY,CAAC;IAExC,KAAK,EAAE,KAAK,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC1C,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAE5C,SAAS,CAAC,cAAc,SAAK;IAC7B,SAAS,CAAC,YAAY,SAAkB;IAExC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IACjF,SAAS,CAAC,qBAAqB,CAAC,EAAE,CAChC,GAAG,EAAE,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,EACrC,MAAM,EAAE,GAAG,KACR,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAC3B,GAAG,EAAE,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,GAAG,SAAS,EACjD,KAAK,EAAE,KAAK,KACT,OAAO,CAAC,IAAI,CAAC,CAAC;gBAEP,OAAO,EAAE,cAAc,CAAC,aAAa,EAAE,YAAY,CAAC;IA2BhE,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC;IAI/D,OAAO,CAAC,gBAAgB;IASxB,cAAc;IAwBd,iFAAiF;IACjF,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC,aAAa,EAAE,YAAY,CAAC;IAUrF,iFAAiF;IACjF,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,SAAS,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;KACnD,GAAG,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC;IAQvC,eAAe;IA8Df,SAAS;IAuBH,KAAK;CAgCZ"}
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../../../../../src/modules/queue/bullmq/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEpF,OAAO,EAAc,cAAc,EAAE,MAAM,WAAW,CAAC;AAEvD,MAAM,WAAW,cAAc,CAAC,aAAa,GAAG,GAAG,EAAE,YAAY,GAAG,GAAG;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,cAAc,CAAC;IACrB,eAAe,EAAE,YAAY,CAAC;IAE9B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,mHAAmH;IACnH,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAChD,sHAAsH;IACtH,aAAa,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,aAAa,GAAG,cAAc,CAAC,CAAC;IAEnF,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IACvE,qBAAqB,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F,gBAAgB,CAAC,EAAE,CACjB,GAAG,EAAE,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,GAAG,SAAS,EACjD,KAAK,EAAE,KAAK,KACT,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB;AAED,qBAAa,YAAY,CAAC,aAAa,GAAG,GAAG,EAAE,YAAY,GAAG,GAAG,CAAE,SAAQ,UAAU;IACnF,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC;IAC/B,SAAS,CAAC,eAAe,EAAE,YAAY,CAAC;IAExC,KAAK,EAAE,KAAK,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC1C,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAE5C,SAAS,CAAC,cAAc,SAAK;IAC7B,SAAS,CAAC,YAAY,SAAkB;IAExC,SAAS,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC1D,SAAS,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,aAAa,GAAG,cAAc,CAAC,CAAC;IAE7F,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IACjF,SAAS,CAAC,qBAAqB,CAAC,EAAE,CAChC,GAAG,EAAE,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,EACrC,MAAM,EAAE,GAAG,KACR,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAC3B,GAAG,EAAE,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,GAAG,SAAS,EACjD,KAAK,EAAE,KAAK,KACT,OAAO,CAAC,IAAI,CAAC,CAAC;gBAEP,OAAO,EAAE,cAAc,CAAC,aAAa,EAAE,YAAY,CAAC;IAgChE,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC;IAI/D,oLAAoL;IACpL,SAAS,CAAC,eAAe,IAAI,OAAO;IAcpC,SAAS,CAAC,gBAAgB,IAAI,MAAM;IAQpC,cAAc;IAwBd,0IAA0I;IAC1I,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,YAAY;IAepE,2IAA2I;IAC3I,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC/B,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,SAAS,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;KACnD,GAAG,aAAa;IAajB,iFAAiF;IACjF,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC,aAAa,EAAE,YAAY,CAAC;IAIrF,iFAAiF;IACjF,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,SAAS,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;KACnD,GAAG,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC;IAQvC,eAAe;IA8Df,SAAS;IAuBH,KAAK;CAgCZ"}