@agenticprimitives/agent-profile 1.0.0-alpha.45 → 1.0.0-alpha.47

package/dist/safe-fetch.js

@@ -0,0 +1,130 @@
+// ONE GUARDED GET FOR A URL THIS PACKAGE DID NOT CHOOSE — spec 445 (audit NAME-7; completes NEW-AP-2).
+//
+// The property, over the whole request: a URL taken from a record, a card or a caller is fetched only if it is
+// public (url-policy.ts), the request cannot be handed on (no redirect is followed), it cannot run long (one
+// deadline over connect + headers + body), it cannot be large (the cap is enforced WHILE reading, and a declared
+// content-length over the cap is refused before a byte is read), the answer says it is JSON, and nothing ambient
+// (cookie, Authorization) rides along. Every refusal is a `ProfileFetchError` with a stable `code`.
+//
+// NOT CLOSED HERE: DNS rebinding between the check and the connection. `fetch` takes a URL, not an address, so
+// the address that was checked cannot be pinned. A deployment with reach to internal services closes that at the
+// transport (an egress proxy / resolver that refuses private answers), not in this file.
+import { checkPublicUrl } from './url-policy.js';
+export class ProfileFetchError extends Error {
+    code;
+    constructor(code, detail) {
+        // "SSRF guard" is kept in the URL refusal: callers and tests match on it since NEW-AP-2.
+        super(`[agent-profile] fetch refused (${code}${code === 'url_refused' ? ' — SSRF guard' : ''}): ${detail}`);
+        this.code = code;
+        this.name = 'ProfileFetchError';
+    }
+}
+export const DEFAULT_FETCH_TIMEOUT_MS = 5_000;
+export const DEFAULT_FETCH_MAX_BYTES = 256 * 1024;
+const JSON_TYPE = /^application\/(?:[a-z0-9.!#$&^_-]+\+)?json$/i;
+function positive(n, fallback, what) {
+    if (n === undefined)
+        return fallback;
+    if (!Number.isFinite(n) || n <= 0)
+        throw new RangeError(`[agent-profile] ${what} must be a positive number`);
+    return n;
+}
+/**
+ * GET `url` and return its body as text, under the property stated at the top of this file. Throws
+ * `ProfileFetchError`; never returns a partial body.
+ */
+export async function fetchPublicJsonText(url, opts = {}) {
+    const timeoutMs = positive(opts.timeoutMs, DEFAULT_FETCH_TIMEOUT_MS, 'timeoutMs');
+    const maxBytes = positive(opts.maxBytes, DEFAULT_FETCH_MAX_BYTES, 'maxBytes');
+    const fetcher = opts.fetch ?? globalThis.fetch.bind(globalThis);
+    // 1. The URL, before anything touches the network.
+    const decision = await checkPublicUrl(url, { policy: opts.policy, resolveHost: opts.resolveHost });
+    if (!decision.allow)
+        throw new ProfileFetchError('url_refused', decision.reason);
+    // 2. One deadline. The signal asks the transport to stop; the race makes the deadline hold even over a
+    //    fetch (or a body) that ignores the signal.
+    const controller = new AbortController();
+    let timer;
+    const deadline = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            controller.abort();
+            reject(new ProfileFetchError('timeout', `no complete response within ${timeoutMs} ms`));
+        }, timeoutMs);
+    });
+    const within = (p) => Promise.race([p, deadline]);
+    let reader;
+    try {
+        const init = {
+            method: 'GET',
+            // A public host may not hand the request on to a private one. `manual`, not `error`: workerd rejects
+            // `redirect: 'error'` with a TypeError, which would fail every fetch on Workers (COR-5). The check below
+            // refuses any 3xx, a followed redirect and an opaque redirect, so nothing is ever followed.
+            redirect: 'manual',
+            signal: controller.signal,
+            headers: { accept: 'application/json' }, // the ONLY header: no Authorization, no cookie
+        };
+        // Only a browser has an ambient cookie jar; say `omit` there. (Server runtimes send none, and some refuse
+        // the field outright.)
+        if (typeof document !== 'undefined')
+            init.credentials = 'omit';
+        let response;
+        try {
+            response = await within(fetcher(url, init));
+        }
+        catch (e) {
+            if (e instanceof ProfileFetchError)
+                throw e;
+            // A network failure. No detail from the far side.
+            throw new ProfileFetchError('network_error', 'the request failed');
+        }
+        // 3. Under `manual` a redirect arrives as a 3xx (server runtimes) or an opaque redirect (browsers); a fetch that
+        //    followed one anyway reports `redirected`. Each is refused; nothing is ever followed.
+        if (response.redirected || (response.status >= 300 && response.status < 400) || response.type === 'opaqueredirect') {
+            throw new ProfileFetchError('redirect_refused', `the server redirected (HTTP ${response.status}); redirects are not followed`);
+        }
+        if (!response.ok)
+            throw new ProfileFetchError('http_error', `HTTP ${response.status}`);
+        const type = (response.headers.get('content-type') ?? '').split(';')[0].trim();
+        if (!JSON_TYPE.test(type))
+            throw new ProfileFetchError('not_json', `content-type "${type || '(none)'}" is not JSON`);
+        // 4. Size: the declared length first (refuse before reading), then the bytes as they arrive.
+        const declared = response.headers.get('content-length');
+        if (declared !== null && /^\d+$/.test(declared.trim()) && Number(declared) > maxBytes) {
+            throw new ProfileFetchError('too_large', `content-length ${declared.trim()} exceeds the ${maxBytes}-byte cap`);
+        }
+        if (!response.body)
+            throw new ProfileFetchError('no_body', 'the response has no readable body');
+        reader = response.body.getReader();
+        const chunks = [];
+        let total = 0;
+        for (;;) {
+            const { done, value } = await within(reader.read());
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > maxBytes)
+                throw new ProfileFetchError('too_large', `the body exceeds the ${maxBytes}-byte cap`);
+            chunks.push(value);
+        }
+        const all = new Uint8Array(total);
+        let at = 0;
+        for (const c of chunks) {
+            all.set(c, at);
+            at += c.byteLength;
+        }
+        return new TextDecoder('utf-8', { fatal: false }).decode(all);
+    }
+    catch (e) {
+        // Stop the transfer on ANY refusal — the cap and the deadline abort, they do not merely stop listening.
+        controller.abort();
+        if (reader)
+            void reader.cancel().catch(() => undefined);
+        throw e;
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+        deadline.catch(() => undefined);
+    }
+}
+//# sourceMappingURL=safe-fetch.js.map

package/dist/safe-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-fetch.js","sourceRoot":"","sources":["../src/safe-fetch.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,EAAE;AACF,+GAA+G;AAC/G,6GAA6G;AAC7G,iHAAiH;AACjH,iHAAiH;AACjH,oGAAoG;AACpG,EAAE;AACF,+GAA+G;AAC/G,iHAAiH;AACjH,yFAAyF;AACzF,OAAO,EAAE,cAAc,EAAiD,MAAM,iBAAiB,CAAC;AAYhG,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACrB;IAArB,YAAqB,IAAyB,EAAE,MAAc;QAC5D,yFAAyF;QACzF,KAAK,CAAC,kCAAkC,IAAI,GAAG,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC,CAAC;QAFzF,SAAI,GAAJ,IAAI,CAAqB;QAG5C,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAC9C,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,GAAG,IAAI,CAAC;AAelD,MAAM,SAAS,GAAG,8CAA8C,CAAC;AAEjE,SAAS,QAAQ,CAAC,CAAqB,EAAE,QAAgB,EAAE,IAAY;IACrE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,IAAI,4BAA4B,CAAC,CAAC;IAC7G,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAW,EAAE,OAA+B,EAAE;IACtF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,EAAE,WAAW,CAAC,CAAC;IAClF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,EAAE,UAAU,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAEhE,mDAAmD;IACnD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACnG,IAAI,CAAC,QAAQ,CAAC,KAAK;QAAE,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEjF,uGAAuG;IACvG,gDAAgD;IAChD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAgD,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAChD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,iBAAiB,CAAC,SAAS,EAAE,+BAA+B,SAAS,KAAK,CAAC,CAAC,CAAC;QAC1F,CAAC,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAI,CAAa,EAAc,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7E,IAAI,MAA2D,CAAC;IAEhE,IAAI,CAAC;QACH,MAAM,IAAI,GAAgB;YACxB,MAAM,EAAE,KAAK;YACb,qGAAqG;YACrG,yGAAyG;YACzG,4FAA4F;YAC5F,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,+CAA+C;SACzF,CAAC;QACF,0GAA0G;QAC1G,uBAAuB;QACvB,IAAI,OAAO,QAAQ,KAAK,WAAW;YAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC;QAE/D,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,iBAAiB;gBAAE,MAAM,CAAC,CAAC;YAC5C,kDAAkD;YAClD,MAAM,IAAI,iBAAiB,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;QACrE,CAAC;QAED,iHAAiH;QACjH,0FAA0F;QAC1F,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACnH,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,+BAA+B,QAAQ,CAAC,MAAM,+BAA+B,CAAC,CAAC;QACjI,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,iBAAiB,CAAC,YAAY,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAEvF,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;QAChF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,iBAAiB,IAAI,IAAI,QAAQ,eAAe,CAAC,CAAC;QAErH,6FAA6F;QAC7F,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACxD,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,EAAE,CAAC;YACtF,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,kBAAkB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,QAAQ,WAAW,CAAC,CAAC;QACjH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;QAChG,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACpD,IAAI,IAAI;gBAAE,MAAM;YAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,QAAQ;gBAAE,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,wBAAwB,QAAQ,WAAW,CAAC,CAAC;YAC5G,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,EAAE,GAAG,CAAC,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAAC,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC;QAAC,CAAC;QAC/D,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,wGAAwG;QACxG,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,MAAM;YAAE,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,CAAC,CAAC;IACV,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/url-policy.d.ts

@@ -0,0 +1,34 @@
+/** The policy's answer. A refusal says why, in words fit for an error message. */
+export type PublicUrlDecision = {
+    allow: true;
+} | {
+    allow: false;
+    reason: string;
+};
+/** The port: a synchronous judgement of one URL. `defaultPublicUrlPolicy` is the shipped one. */
+export type PublicUrlPolicy = (url: string) => PublicUrlDecision;
+/** Optional port: the addresses a host name resolves to (A and AAAA), as IP literals. */
+export type PublicHostResolver = (host: string) => Promise<string[]>;
+/**
+ * Why an IP literal is not a public destination — `null` when it is public, a reason when it is refused, and
+ * a reason too when the string is not an IP literal at all (a resolver that answers with something else has
+ * not answered). Brackets around an IPv6 literal are accepted.
+ */
+export declare function publicAddressRefusal(address: string): string | null;
+/**
+ * THE SHIPPED POLICY (spec 445; the same rule as a2a's push policy, spec 445 §3.5). Pure and synchronous: it judges the URL as written.
+ * Allows only an `https:` URL with no credentials whose host is a public IP literal or a name that is not
+ * local by construction.
+ */
+export declare function defaultPublicUrlPolicy(url: string): PublicUrlDecision;
+/**
+ * The whole check, run before every outbound request to a URL this package did not choose: the policy
+ * first; then, when the deployment can resolve names, EVERY address the host resolves to must be public. A
+ * host that resolves to nothing, or a resolver that fails, is a refusal — never "unknown, so allowed".
+ * An IP-literal host is already judged by the policy and is not resolved.
+ */
+export declare function checkPublicUrl(url: string, ports?: {
+    policy?: PublicUrlPolicy;
+    resolveHost?: PublicHostResolver;
+}): Promise<PublicUrlDecision>;
+//# sourceMappingURL=url-policy.d.ts.map

package/dist/url-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-policy.d.ts","sourceRoot":"","sources":["../src/url-policy.ts"],"names":[],"mappings":"AAyBA,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GAAG;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnF,iGAAiG;AACjG,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,iBAAiB,CAAC;AAEjE,yFAAyF;AACzF,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAiFrE;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOnE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CA0BrE;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE;IAAE,MAAM,CAAC,EAAE,eAAe,CAAC;IAAC,WAAW,CAAC,EAAE,kBAAkB,CAAA;CAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAcxJ"}

package/dist/url-policy.js

@@ -0,0 +1,226 @@
+// WHERE THIS PACKAGE MAY SEND A REQUEST — spec 445 (audit NAME-7; completes ledger NEW-AP-2).
+//
+// A profile's metadata URI is ON-CHAIN STATE THE AGENT WROTE ABOUT ITSELF. Whoever fetches it (an indexer, a
+// Worker) lends the agent its network position: cloud metadata at 169.254.169.254, a loopback admin port, a
+// private service. So a URL that came from a record, a card or a caller is fetched only when it is PUBLIC.
+//
+// THE RULE: `https:` only; no credentials in the URL; no IP literal in a loopback, link-local, private, CGNAT,
+// unspecified, multicast or reserved range — in any spelling, including an IPv4 address carried inside an IPv6
+// one (mapped, compatible, NAT64, 6to4) and a numeric host the URL parser did not canonicalize; no name that is
+// local by construction (`localhost`, `*.localhost`, `*.local`, `*.internal`).
+//
+// PURE: no I/O, no DNS. A name that RESOLVES to a refused range is a second question, answered by
+// `checkPublicUrl` when a deployment supplies a resolver (every address must pass; none, or a failed lookup, is
+// a refusal). What neither closes: a name re-resolved to a different address between this check and the
+// connection (DNS rebinding) — that needs the transport to pin the checked address, which a fetch-shaped port
+// cannot say. Redirects are refused at the request (`redirect: 'manual'` plus a refusal of any 3xx, see safe-fetch.ts), so a public address
+// cannot hand the request on to a private one.
+//
+// DUPLICATE — UNIFY IN A FOLLOW-UP. This is the same policy as `packages/a2a/src/standard/push-url-policy.ts`
+// (written the same day, 2026-11-10), copied because `agent-profile` must not depend on `a2a` and the a2a file
+// was not ours to move. Two copies of a security table drift. The policy is pure, dependency-free and names no
+// transport, so under the repo's boundary rules it can live in `@agenticprimitives/types` (the transport-agnostic
+// base both packages already depend on) — as its own module/subpath there — and both copies become re-exports.
+// Until then: a change to one table is a change to both, and both test tables.
+const refuse = (reason) => ({ allow: false, reason });
+const ALLOW = { allow: true };
+/** Four octets from a strict dotted quad, else null. The URL parser has already normalized the odd
+ *  spellings (`0x7f.1`, `2130706433`, `017700000001`) to this form for an https URL. */
+function parseIpv4(s) {
+    const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(s);
+    if (!m)
+        return null;
+    const o = [Number(m[1]), Number(m[2]), Number(m[3]), Number(m[4])];
+    return o.every((n) => n <= 255) ? o : null;
+}
+/** Eight 16-bit groups from an IPv6 literal (no brackets, zone id dropped), else null. Handles `::` and a
+ *  dotted IPv4 tail. */
+function parseIpv6(input) {
+    let s = input;
+    const zone = s.indexOf('%');
+    if (zone >= 0)
+        s = s.slice(0, zone);
+    if (!s.includes(':') || !/^[0-9a-f:.]+$/i.test(s))
+        return null;
+    const tail = /(^|:)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(s);
+    if (tail) {
+        const v4 = parseIpv4(tail[2]);
+        if (!v4)
+            return null;
+        s = `${s.slice(0, s.length - tail[2].length)}${((v4[0] << 8) | v4[1]).toString(16)}:${((v4[2] << 8) | v4[3]).toString(16)}`;
+    }
+    if (s.includes('.'))
+        return null;
+    const halves = s.split('::');
+    if (halves.length > 2)
+        return null;
+    const groups = (part) => {
+        if (part === '')
+            return [];
+        const out = [];
+        for (const g of part.split(':')) {
+            if (!/^[0-9a-f]{1,4}$/i.test(g))
+                return null;
+            out.push(parseInt(g, 16));
+        }
+        return out;
+    };
+    const head = groups(halves[0]);
+    const rest = halves.length === 2 ? groups(halves[1]) : [];
+    if (!head || !rest)
+        return null;
+    if (halves.length === 1)
+        return head.length === 8 ? head : null;
+    const fill = 8 - head.length - rest.length;
+    if (fill < 1)
+        return null;
+    return [...head, ...new Array(fill).fill(0), ...rest];
+}
+/** Why an IPv4 address is not a public destination, or null when it is. */
+function ipv4Refusal(o) {
+    const [a, b] = o;
+    if (a === 0)
+        return 'an unspecified ("this network") address';
+    if (a === 127)
+        return 'a loopback address';
+    if (a === 10)
+        return 'a private address (10.0.0.0/8)';
+    if (a === 172 && b >= 16 && b <= 31)
+        return 'a private address (172.16.0.0/12)';
+    if (a === 192 && b === 168)
+        return 'a private address (192.168.0.0/16)';
+    if (a === 169 && b === 254)
+        return 'a link-local address (169.254.0.0/16)';
+    if (a === 100 && b >= 64 && b <= 127)
+        return 'a carrier-grade NAT address (100.64.0.0/10)';
+    if (a >= 224)
+        return 'a multicast or reserved address';
+    return null;
+}
+/** Why an IPv6 address is not a public destination, or null when it is. An address that CARRIES an IPv4
+ *  one (mapped `::ffff:a.b.c.d`, the deprecated compatible `::a.b.c.d`, NAT64 `64:ff9b::/96`, 6to4
+ *  `2002::/16`) is judged by the IPv4 address it reaches. */
+function ipv6Refusal(g) {
+    const zeros = (n) => g.slice(0, n).every((x) => x === 0);
+    const embedded = (hi, lo, what) => {
+        const r = ipv4Refusal([hi >> 8, hi & 0xff, lo >> 8, lo & 0xff]);
+        return r ? `${what} for ${r}` : null;
+    };
+    if (zeros(8))
+        return 'the unspecified address (::)';
+    if (zeros(7) && g[7] === 1)
+        return 'a loopback address (::1)';
+    if (zeros(5) && g[5] === 0xffff)
+        return embedded(g[6], g[7], 'an IPv4-mapped IPv6 form');
+    if (zeros(6))
+        return embedded(g[6], g[7], 'an IPv4-compatible IPv6 form') ?? 'an IPv4-compatible IPv6 address';
+    if (g[0] === 0x64 && g[1] === 0xff9b && g.slice(2, 6).every((x) => x === 0))
+        return embedded(g[6], g[7], 'a NAT64 form');
+    if (g[0] === 0x2002)
+        return embedded(g[1], g[2], 'a 6to4 form');
+    if ((g[0] & 0xffc0) === 0xfe80)
+        return 'a link-local address (fe80::/10)';
+    if ((g[0] & 0xffc0) === 0xfec0)
+        return 'a site-local address (fec0::/10)';
+    if ((g[0] & 0xfe00) === 0xfc00)
+        return 'a private address (fc00::/7)';
+    if ((g[0] & 0xff00) === 0xff00)
+        return 'a multicast address (ff00::/8)';
+    return null;
+}
+/**
+ * Why an IP literal is not a public destination — `null` when it is public, a reason when it is refused, and
+ * a reason too when the string is not an IP literal at all (a resolver that answers with something else has
+ * not answered). Brackets around an IPv6 literal are accepted.
+ */
+export function publicAddressRefusal(address) {
+    const s = address.trim().toLowerCase().replace(/^\[(.*)\]$/, '$1');
+    const v4 = parseIpv4(s);
+    if (v4)
+        return ipv4Refusal(v4);
+    const v6 = parseIpv6(s);
+    if (v6)
+        return ipv6Refusal(v6);
+    return 'not an IP address';
+}
+/**
+ * THE SHIPPED POLICY (spec 445; the same rule as a2a's push policy, spec 445 §3.5). Pure and synchronous: it judges the URL as written.
+ * Allows only an `https:` URL with no credentials whose host is a public IP literal or a name that is not
+ * local by construction.
+ */
+export function defaultPublicUrlPolicy(url) {
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        return refuse('the URL is not a valid absolute URL');
+    }
+    if (u.protocol !== 'https:')
+        return refuse(`the URL must be https: (got ${u.protocol})`);
+    if (u.username || u.password)
+        return refuse('the URL must not carry credentials (user:password@)');
+    const host = u.hostname.toLowerCase().replace(/\.$/, '');
+    if (!host)
+        return refuse('the URL names no host');
+    if (host.startsWith('[') || host.includes(':')) {
+        const g = parseIpv6(host.replace(/^\[(.*)\]$/, '$1'));
+        if (!g)
+            return refuse('the URL host is not a valid IPv6 address');
+        const why = ipv6Refusal(g);
+        return why ? refuse(`the URL host is ${why}`) : ALLOW;
+    }
+    const v4 = parseIpv4(host);
+    if (v4) {
+        const why = ipv4Refusal(v4);
+        return why ? refuse(`the URL host is ${why}`) : ALLOW;
+    }
+    // A host whose last label is a number is an IPv4 address in some spelling (WHATWG "ends in a number").
+    // A parser that normalized it was handled above; one that did not must not let it through as a name.
+    const last = host.slice(host.lastIndexOf('.') + 1);
+    if (/^(\d+|0x[0-9a-f]*)$/.test(last))
+        return refuse('the URL host is a numeric address in a non-canonical form');
+    if (host === 'localhost' || host.endsWith('.localhost'))
+        return refuse('the URL host is localhost');
+    if (host.endsWith('.local') || host === 'local')
+        return refuse('the URL host is a local (.local) name');
+    if (host.endsWith('.internal') || host === 'internal')
+        return refuse('the URL host is an internal (.internal) name');
+    return ALLOW;
+}
+/**
+ * The whole check, run before every outbound request to a URL this package did not choose: the policy
+ * first; then, when the deployment can resolve names, EVERY address the host resolves to must be public. A
+ * host that resolves to nothing, or a resolver that fails, is a refusal — never "unknown, so allowed".
+ * An IP-literal host is already judged by the policy and is not resolved.
+ */
+export async function checkPublicUrl(url, ports = {}) {
+    const decision = (ports.policy ?? defaultPublicUrlPolicy)(url);
+    if (!decision.allow || !ports.resolveHost)
+        return decision;
+    let host;
+    try {
+        host = new URL(url).hostname.toLowerCase().replace(/\.$/, '');
+    }
+    catch {
+        return refuse('the URL is not a valid absolute URL');
+    }
+    if (host.startsWith('[') || parseIpv4(host))
+        return decision;
+    let addresses;
+    try {
+        addresses = await ports.resolveHost(host);
+    }
+    catch {
+        return refuse(`the URL host ${host} could not be resolved`);
+    }
+    if (!Array.isArray(addresses) || addresses.length === 0)
+        return refuse(`the URL host ${host} resolves to no address`);
+    for (const a of addresses) {
+        const why = publicAddressRefusal(String(a));
+        if (why)
+            return refuse(`the URL host ${host} resolves to ${why}`);
+    }
+    return decision;
+}
+//# sourceMappingURL=url-policy.js.map

package/dist/url-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-policy.js","sourceRoot":"","sources":["../src/url-policy.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,EAAE;AACF,6GAA6G;AAC7G,4GAA4G;AAC5G,2GAA2G;AAC3G,EAAE;AACF,+GAA+G;AAC/G,+GAA+G;AAC/G,gHAAgH;AAChH,+EAA+E;AAC/E,EAAE;AACF,kGAAkG;AAClG,gHAAgH;AAChH,wGAAwG;AACxG,8GAA8G;AAC9G,4IAA4I;AAC5I,+CAA+C;AAC/C,EAAE;AACF,8GAA8G;AAC9G,+GAA+G;AAC/G,+GAA+G;AAC/G,kHAAkH;AAClH,+GAA+G;AAC/G,+EAA+E;AAW/E,MAAM,MAAM,GAAG,CAAC,MAAc,EAAqB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AACjF,MAAM,KAAK,GAAsB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAEjD;wFACwF;AACxF,SAAS,SAAS,CAAC,CAAS;IAC1B,MAAM,CAAC,GAAG,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAqC,CAAC;IACvG,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;wBACwB;AACxB,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,IAAI,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,IAAI,GAAG,4CAA4C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACrB,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/H,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAmB,EAAE;QAC/C,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC;QAC7G,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3C,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAS,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,2EAA2E;AAC3E,SAAS,WAAW,CAAC,CAA4C;IAC/D,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACjB,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,yCAAyC,CAAC;IAC9D,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,oBAAoB,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,gCAAgC,CAAC;IACtD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,mCAAmC,CAAC;IAChF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,oCAAoC,CAAC;IACxE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,uCAAuC,CAAC;IAC3E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,6CAA6C,CAAC;IAC3F,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,iCAAiC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;6DAE6D;AAC7D,SAAS,WAAW,CAAC,CAAoB;IACvC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAU,EAAE,IAAY,EAAiB,EAAE;QACvE,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,8BAA8B,CAAC;IACpD,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,0BAA0B,CAAC;IAC9D,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,0BAA0B,CAAC,CAAE;IAC5F,IAAI,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,8BAA8B,CAAC,IAAI,iCAAiC,CAAC;IACjH,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,cAAc,CAAC,CAAC;IAC3H,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,aAAa,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,kCAAkC,CAAC;IAC3E,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,kCAAkC,CAAC;IAC3E,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,8BAA8B,CAAC;IACvE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,gCAAgC,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACnE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE;QAAE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE;QAAE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/B,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QAAC,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,MAAM,CAAC,qCAAqC,CAAC,CAAC;IAAC,CAAC;IACzF,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,+BAA+B,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;IACzF,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,qDAAqD,CAAC,CAAC;IACnG,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,0CAA0C,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACxD,CAAC;IACD,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACxD,CAAC;IACD,uGAAuG;IACvG,qGAAqG;IACrG,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,2DAA2D,CAAC,CAAC;IACjH,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACpG,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC,uCAAuC,CAAC,CAAC;IACxG,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,8CAA8C,CAAC,CAAC;IACrH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,QAAwE,EAAE;IAC1H,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO,QAAQ,CAAC;IAC3D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,MAAM,CAAC,qCAAqC,CAAC,CAAC;IAAC,CAAC;IACtI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7D,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QAAC,SAAS,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,MAAM,CAAC,gBAAgB,IAAI,wBAAwB,CAAC,CAAC;IAAC,CAAC;IACzH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,gBAAgB,IAAI,yBAAyB,CAAC,CAAC;IACtH,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,GAAG;YAAE,OAAO,MAAM,CAAC,gBAAgB,IAAI,gBAAgB,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/agent-profile",
-  "version": "1.0.0-alpha.45",
+  "version": "1.0.0-alpha.47",
   "description": "Agent identity SDK: AP-native Canonical Agent Profile (CanonicalAgentProfileV1) + signed profile bundle, CAIP-10 nativeId helpers, endpoint verification methods, and the A2A 1.0 Agent Card model (./a2a: JCS canonical bytes, ES256 JWS, EIP-712 Smart Agent binding, field provenance, pure validation, import, release lifecycle). External registry projections stay outside Ring 0.",
   "homepage": "https://agenticprimitives.dev",
   "bugs": {
@@ -52,9 +52,9 @@
   },
   "peerDependencies": {
     "viem": "^2.52.2",
-    "@agenticprimitives/agent-account": "^1.0.0-alpha.45",
-    "@agenticprimitives/connect-auth": "^1.0.0-alpha.45",
-    "@agenticprimitives/types": "^1.0.0-alpha.45"
+    "@agenticprimitives/agent-account": "^1.0.0-alpha.47",
+    "@agenticprimitives/connect-auth": "^1.0.0-alpha.47",
+    "@agenticprimitives/types": "^1.0.0-alpha.47"
   },
   "devDependencies": {
     "@types/node": "^22.7.0",
@@ -81,6 +81,7 @@
     "build": "tsc -p tsconfig.build.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run",
+    "test:unit": "vitest run",
     "test:watch": "vitest",
     "clean": "rm -rf dist"
   }