@agirails/sdk 2.0.0 → 2.0.1-beta

package/dist/utils/UsedAttestationTracker.js

@@ -1,309 +0,0 @@
-"use strict";
-/**
- * UsedAttestationTracker - Prevents EAS Attestation Replay Attacks (C-1)
- *
- * Tracks which attestation UIDs have been used for which transaction IDs.
- * This prevents a malicious provider from reusing an attestation from
- * Transaction A to settle Transaction B.
- *
- * SECURITY: ACTPKernel V1 contract accepts any attestationUID without validation.
- * This tracker provides SDK-side protection until contract is upgraded.
- *
- * @module utils/UsedAttestationTracker
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createUsedAttestationTracker = exports.FileBasedUsedAttestationTracker = exports.InMemoryUsedAttestationTracker = void 0;
-const fsSafe_1 = require("./fsSafe");
-/**
- * In-Memory Used Attestation Tracker
- *
- * SECURITY FIX (C-1): Prevents attestation replay attacks by tracking
- * which attestation UIDs have been used for which transactions.
- *
- * SECURITY FIX (NEW-H-2): LRU-style cache with max size to prevent DoS
- *
- * WARNING: In-memory only. For production:
- * - Use persistent storage (Redis, PostgreSQL, etc.)
- * - Implement recovery from blockchain events
- */
-class InMemoryUsedAttestationTracker {
-    /**
-     * Create in-memory tracker with optional max size
-     * @param maxSize - Maximum entries to store (default: 100,000)
-     */
-    constructor(maxSize = 100000) {
-        // Map: attestationUID -> txId
-        this.usedAttestations = new Map();
-        if (maxSize <= 0) {
-            throw new Error('maxSize must be positive');
-        }
-        this.maxSize = maxSize;
-    }
-    /**
-     * Record that an attestation was used for a transaction
-     * @param attestationUID - EAS attestation UID (bytes32)
-     * @param txId - Transaction ID (bytes32)
-     * @returns true if recorded, false if already used for different transaction
-     *
-     * SECURITY FIX (NEW-H-2): LRU eviction when max size reached
-     * SECURITY FIX (HIGH-1): Now async for interface consistency
-     */
-    async recordUsage(attestationUID, txId) {
-        return this.recordUsageSync(attestationUID, txId);
-    }
-    /**
-     * Synchronous version of recordUsage (for backward compatibility)
-     * @param attestationUID - EAS attestation UID (bytes32)
-     * @param txId - Transaction ID (bytes32)
-     * @returns true if recorded, false if already used for different transaction
-     */
-    recordUsageSync(attestationUID, txId) {
-        const normalizedUID = attestationUID.toLowerCase();
-        const normalizedTxId = txId.toLowerCase();
-        const existingTxId = this.usedAttestations.get(normalizedUID);
-        // If attestation was already used for a different transaction, reject
-        if (existingTxId && existingTxId !== normalizedTxId) {
-            return false;
-        }
-        // SECURITY FIX (NEW-H-2): Enforce max size limit with true LRU behavior
-        if (this.usedAttestations.size >= this.maxSize && !existingTxId) {
-            // Remove oldest entry (first entry in Map)
-            const firstKey = this.usedAttestations.keys().next().value;
-            if (firstKey) {
-                this.usedAttestations.delete(firstKey);
-            }
-        }
-        else if (existingTxId) {
-            // SECURITY FIX (M-3): True LRU - delete and re-add to move to end
-            this.usedAttestations.delete(normalizedUID);
-        }
-        // Record the usage (at end for LRU)
-        this.usedAttestations.set(normalizedUID, normalizedTxId);
-        return true;
-    }
-    /**
-     * Check if attestation has been used
-     * @param attestationUID - EAS attestation UID (bytes32)
-     * @returns Transaction ID if used, null if not used
-     *
-     * SECURITY FIX (MEDIUM-4): Updates access order for true LRU behavior
-     * Accessed items are moved to end of Map (most recently used)
-     */
-    getUsageForAttestation(attestationUID) {
-        const normalizedUID = attestationUID.toLowerCase();
-        const txId = this.usedAttestations.get(normalizedUID);
-        // SECURITY FIX (MEDIUM-4): True LRU - move accessed item to end
-        // Without this, eviction uses insertion order, not access order
-        if (txId !== undefined) {
-            this.usedAttestations.delete(normalizedUID);
-            this.usedAttestations.set(normalizedUID, txId);
-        }
-        return txId || null;
-    }
-    /**
-     * Check if attestation is valid for transaction
-     * @param attestationUID - EAS attestation UID
-     * @param txId - Transaction ID
-     * @returns true if attestation is unused or already used for this txId
-     *
-     * SECURITY FIX (MEDIUM-4): Updates access order for true LRU behavior
-     */
-    isValidForTransaction(attestationUID, txId) {
-        const normalizedUID = attestationUID.toLowerCase();
-        const normalizedTxId = txId.toLowerCase();
-        const existingTxId = this.usedAttestations.get(normalizedUID);
-        // SECURITY FIX (MEDIUM-4): True LRU - move accessed item to end
-        if (existingTxId !== undefined) {
-            this.usedAttestations.delete(normalizedUID);
-            this.usedAttestations.set(normalizedUID, existingTxId);
-        }
-        // Valid if: not used OR used for same transaction
-        return !existingTxId || existingTxId === normalizedTxId;
-    }
-    /**
-     * Clear all tracked attestations
-     */
-    clear() {
-        this.usedAttestations.clear();
-    }
-    /**
-     * Get all tracked attestations (for debugging/persistence)
-     */
-    getAllUsages() {
-        return Object.fromEntries(this.usedAttestations.entries());
-    }
-    /**
-     * Get count of tracked attestations
-     */
-    getCount() {
-        return this.usedAttestations.size;
-    }
-    /**
-     * Cleanup old entries based on timestamp (optional)
-     *
-     * SECURITY FIX (NEW-H-2): Manual cleanup for old entries
-     * Note: This requires external timestamp tracking. For automatic cleanup,
-     * use FileBasedUsedAttestationTracker with periodic cleanup.
-     *
-     * @param maxAgeHours - Remove entries older than this many hours
-     */
-    cleanupOldEntries(maxAgeHours) {
-        // In-memory tracker doesn't track timestamps
-        // This is a placeholder for future enhancement
-        console.warn('cleanupOldEntries not implemented for InMemoryUsedAttestationTracker. ' +
-            'Consider using FileBasedUsedAttestationTracker for time-based cleanup.');
-        return 0;
-    }
-}
-exports.InMemoryUsedAttestationTracker = InMemoryUsedAttestationTracker;
-/**
- * File-based Used Attestation Tracker for persistence
- *
- * SECURITY FIX (C-1): Persistent storage for attestation tracking
- * SECURITY FIX (NEW-H-4): File locking to prevent concurrent write corruption
- *
- * Survives process restarts.
- */
-class FileBasedUsedAttestationTracker {
-    constructor(stateDirectory) {
-        this.inMemory = new InMemoryUsedAttestationTracker();
-        this.fs = require('fs');
-        this.path = require('path');
-        // SECURITY FIX (NEW-H-4): File locking to prevent race conditions
-        this.lockfile = require('proper-lockfile');
-        // Ensure directory exists
-        const actpDir = this.path.join(stateDirectory, '.actp');
-        (0, fsSafe_1.ensureSafeDir)(actpDir, 0o755);
-        this.filePath = this.path.join(actpDir, 'used-attestations.json');
-        // Load existing data
-        this.loadFromFile();
-    }
-    loadFromFile() {
-        if (!this.fs.existsSync(this.filePath))
-            return;
-        // SECURITY: Refuse to read from symlinked tracker files
-        (0, fsSafe_1.assertSafeFileForRead)(this.filePath);
-        // Basic size limit to avoid memory DoS on parse
-        const MAX_TRACKER_FILE_SIZE = 10 * 1024 * 1024; // 10MB
-        const st = this.fs.statSync(this.filePath);
-        if (st.size > MAX_TRACKER_FILE_SIZE) {
-            throw new Error(`used-attestations.json exceeds ${MAX_TRACKER_FILE_SIZE / 1024 / 1024}MB limit: ${this.filePath}`);
-        }
-        try {
-            const data = JSON.parse(this.fs.readFileSync(this.filePath, 'utf-8'));
-            for (const [uid, txId] of Object.entries(data)) {
-                this.inMemory.recordUsageSync(uid, txId);
-            }
-        }
-        catch (e) {
-            // Fail closed: losing replay-protection state is a security issue.
-            throw new Error(`Failed to parse used-attestations.json (replay protection would be disabled). ` +
-                `Fix/delete the file: ${this.filePath}. Error: ${e?.message || String(e)}`);
-        }
-    }
-    /**
-     * Save data to file with file locking
-     *
-     * SECURITY FIX (NEW-H-4): File locking prevents concurrent write corruption
-     * SECURITY FIX (NEW-HIGH-1): Create file before locking if it doesn't exist
-     */
-    async saveToFile() {
-        const data = this.inMemory.getAllUsages();
-        const tempPath = `${this.filePath}.tmp`;
-        // SECURITY FIX (NEW-HIGH-1): Ensure file exists before locking
-        // proper-lockfile.lock() fails on non-existent files
-        (0, fsSafe_1.ensureSafeFile)(this.filePath, '{}', 0o644);
-        // SECURITY FIX (NEW-H-4): Acquire file lock before writing
-        let release = null;
-        try {
-            release = await this.lockfile.lock(this.filePath, {
-                stale: 10000, // Lock expires after 10 seconds if process crashes
-                retries: {
-                    retries: 5,
-                    minTimeout: 100,
-                    maxTimeout: 500
-                }
-            });
-            // Atomic write: temp file + rename
-            if (this.fs.existsSync(tempPath)) {
-                this.fs.unlinkSync(tempPath);
-            }
-            this.fs.writeFileSync(tempPath, JSON.stringify(data, null, 2), {
-                encoding: 'utf-8',
-                mode: 0o644,
-                flag: 'wx'
-            });
-            this.fs.renameSync(tempPath, this.filePath);
-        }
-        catch (error) {
-            // Clean up temp file on error
-            if (this.fs.existsSync(tempPath)) {
-                try {
-                    this.fs.unlinkSync(tempPath);
-                }
-                catch {
-                    // Ignore cleanup errors
-                }
-            }
-            throw error;
-        }
-        finally {
-            // Always release lock if acquired
-            if (release) {
-                await release();
-            }
-        }
-    }
-    /**
-     * Record attestation usage with guaranteed persistence
-     *
-     * SECURITY FIX (HIGH-1): Now properly awaits persistence to prevent data loss
-     */
-    async recordUsage(attestationUID, txId) {
-        const result = this.inMemory.recordUsageSync(attestationUID, txId);
-        if (result) {
-            // SECURITY FIX (HIGH-1): Await persistence to ensure data is saved
-            await this.saveToFile();
-        }
-        return result;
-    }
-    /**
-     * Fire-and-forget version for backward compatibility
-     * WARNING: May lose data if process crashes before save completes
-     */
-    recordUsageSync(attestationUID, txId) {
-        const result = this.inMemory.recordUsageSync(attestationUID, txId);
-        if (result) {
-            this.saveToFile().catch((err) => {
-                console.error('Failed to save attestation tracker state:', err);
-            });
-        }
-        return result;
-    }
-    getUsageForAttestation(attestationUID) {
-        return this.inMemory.getUsageForAttestation(attestationUID);
-    }
-    isValidForTransaction(attestationUID, txId) {
-        return this.inMemory.isValidForTransaction(attestationUID, txId);
-    }
-    clear() {
-        this.inMemory.clear();
-        if (this.fs.existsSync(this.filePath)) {
-            this.fs.unlinkSync(this.filePath);
-        }
-    }
-}
-exports.FileBasedUsedAttestationTracker = FileBasedUsedAttestationTracker;
-/**
- * Factory to create attestation tracker
- * @param stateDirectory - Optional directory for persistent storage
- * @returns IUsedAttestationTracker instance
- */
-function createUsedAttestationTracker(stateDirectory) {
-    if (stateDirectory) {
-        return new FileBasedUsedAttestationTracker(stateDirectory);
-    }
-    return new InMemoryUsedAttestationTracker();
-}
-exports.createUsedAttestationTracker = createUsedAttestationTracker;
-//# sourceMappingURL=UsedAttestationTracker.js.map

package/dist/utils/UsedAttestationTracker.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"UsedAttestationTracker.js","sourceRoot":"","sources":["../../src/utils/UsedAttestationTracker.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAEH,qCAAgF;AAsChF;;;;;;;;;;;GAWG;AACH,MAAa,8BAA8B;IAOzC;;;OAGG;IACH,YAAY,UAAkB,MAAM;QAVpC,8BAA8B;QACtB,qBAAgB,GAAwB,IAAI,GAAG,EAAE,CAAC;QAUxD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,IAAY;QACpD,OAAO,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,cAAsB,EAAE,IAAY;QAClD,MAAM,aAAa,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAE1C,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAE9D,sEAAsE;QACtE,IAAI,YAAY,IAAI,YAAY,KAAK,cAAc,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,wEAAwE;QACxE,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;YAChE,2CAA2C;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC3D,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,kEAAkE;YAClE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9C,CAAC;QAED,oCAAoC;QACpC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,sBAAsB,CAAC,cAAsB;QAC3C,MAAM,aAAa,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAEtD,gEAAgE;QAChE,gEAAgE;QAChE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QAED,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;IAED;;;;;;;OAOG;IACH,qBAAqB,CAAC,cAAsB,EAAE,IAAY;QACxD,MAAM,aAAa,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAE1C,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAE9D,gEAAgE;QAChE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QACzD,CAAC;QAED,kDAAkD;QAClD,OAAO,CAAC,YAAY,IAAI,YAAY,KAAK,cAAc,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,iBAAiB,CAAC,WAAmB;QACnC,6CAA6C;QAC7C,+CAA+C;QAC/C,OAAO,CAAC,IAAI,CACV,wEAAwE;YACxE,wEAAwE,CACzE,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;CACF;AAtJD,wEAsJC;AAED;;;;;;;GAOG;AACH,MAAa,+BAA+B;IAO1C,YAAY,cAAsB;QAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,8BAA8B,EAAE,CAAC;QACrD,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,kEAAkE;QAClE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAE3C,0BAA0B;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACxD,IAAA,sBAAa,EAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAE9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;QAElE,qBAAqB;QACrB,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO;QAE/C,wDAAwD;QACxD,IAAA,8BAAqB,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAErC,gDAAgD;QAChD,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;QACvD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,EAAE,CAAC,IAAI,GAAG,qBAAqB,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,kCAAkC,qBAAqB,GAAG,IAAI,GAAG,IAAI,aAAa,IAAI,CAAC,QAAQ,EAAE,CAClG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YACtE,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,EAAE,IAAc,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,mEAAmE;YACnE,MAAM,IAAI,KAAK,CACb,gFAAgF;gBAC9E,wBAAwB,IAAI,CAAC,QAAQ,YAAY,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,UAAU;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAC;QAExC,+DAA+D;QAC/D,qDAAqD;QACrD,IAAA,uBAAc,EAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAE3C,2DAA2D;QAC3D,IAAI,OAAO,GAAiC,IAAI,CAAC;QACjD,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;gBAChD,KAAK,EAAE,KAAK,EAAE,mDAAmD;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,CAAC;oBACV,UAAU,EAAE,GAAG;oBACf,UAAU,EAAE,GAAG;iBAChB;aACF,CAAC,CAAC;YAEH,mCAAmC;YACnC,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;gBAC7D,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,IAAI;aACX,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8BAA8B;YAC9B,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC/B,CAAC;gBAAC,MAAM,CAAC;oBACP,wBAAwB;gBAC1B,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,kCAAkC;YAClC,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,IAAY;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,MAAM,EAAE,CAAC;YACX,mEAAmE;YACnE,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,cAAsB,EAAE,IAAY;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC9B,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sBAAsB,CAAC,cAAsB;QAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC9D,CAAC;IAED,qBAAqB,CAAC,cAAsB,EAAE,IAAY;QACxD,OAAO,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;CACF;AArJD,0EAqJC;AAED;;;;GAIG;AACH,SAAgB,4BAA4B,CAC1C,cAAuB;IAEvB,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,IAAI,+BAA+B,CAAC,cAAc,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,8BAA8B,EAAE,CAAC;AAC9C,CAAC;AAPD,oEAOC"}

package/dist/utils/fsSafe.d.ts

@@ -1,14 +0,0 @@
-/**
- * fsSafe - minimal filesystem hardening helpers
- *
- * Focus:
- * - Prevent symlink-based path escapes when persisting local state
- * - Avoid clobbering arbitrary files via pre-created symlink temp files
- *
- * NOTE: This is not a complete TOCTOU-proof sandbox, but it eliminates the
- * most common local symlink/hardlink footguns for SDK-managed state files.
- */
-export declare function ensureSafeDir(dirPath: string, mode?: number): void;
-export declare function assertSafeFileForRead(filePath: string): void;
-export declare function ensureSafeFile(filePath: string, contents: string, mode?: number): void;
-//# sourceMappingURL=fsSafe.d.ts.map

package/dist/utils/fsSafe.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fsSafe.d.ts","sourceRoot":"","sources":["../../src/utils/fsSafe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAAc,GAAG,IAAI,CAmBzE;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAS5D;AAED,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,MAAc,GACnB,IAAI,CAmBN"}

package/dist/utils/fsSafe.js

@@ -1,89 +0,0 @@
-"use strict";
-/**
- * fsSafe - minimal filesystem hardening helpers
- *
- * Focus:
- * - Prevent symlink-based path escapes when persisting local state
- * - Avoid clobbering arbitrary files via pre-created symlink temp files
- *
- * NOTE: This is not a complete TOCTOU-proof sandbox, but it eliminates the
- * most common local symlink/hardlink footguns for SDK-managed state files.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ensureSafeFile = exports.assertSafeFileForRead = exports.ensureSafeDir = void 0;
-const fs = __importStar(require("fs"));
-function ensureSafeDir(dirPath, mode = 0o755) {
-    if (fs.existsSync(dirPath)) {
-        const st = fs.lstatSync(dirPath);
-        if (st.isSymbolicLink()) {
-            throw new Error(`Refusing to use symlink directory: ${dirPath}`);
-        }
-        if (!st.isDirectory()) {
-            throw new Error(`Expected directory but found non-directory: ${dirPath}`);
-        }
-        return;
-    }
-    fs.mkdirSync(dirPath, { recursive: true, mode });
-    // Post-create sanity: ensure it didn't become a symlink (defense-in-depth)
-    const st = fs.lstatSync(dirPath);
-    if (st.isSymbolicLink() || !st.isDirectory()) {
-        throw new Error(`Created unsafe directory (symlink or non-dir): ${dirPath}`);
-    }
-}
-exports.ensureSafeDir = ensureSafeDir;
-function assertSafeFileForRead(filePath) {
-    if (!fs.existsSync(filePath))
-        return;
-    const st = fs.lstatSync(filePath);
-    if (st.isSymbolicLink()) {
-        throw new Error(`Refusing to read from symlink file: ${filePath}`);
-    }
-    if (!st.isFile()) {
-        throw new Error(`Expected file but found non-file: ${filePath}`);
-    }
-}
-exports.assertSafeFileForRead = assertSafeFileForRead;
-function ensureSafeFile(filePath, contents, mode = 0o644) {
-    if (fs.existsSync(filePath)) {
-        const st = fs.lstatSync(filePath);
-        if (st.isSymbolicLink()) {
-            throw new Error(`Refusing to use symlink file: ${filePath}`);
-        }
-        if (!st.isFile()) {
-            throw new Error(`Expected file but found non-file: ${filePath}`);
-        }
-        return;
-    }
-    // Use exclusive create to avoid clobbering a file that appears between
-    // existsSync() and writeFileSync().
-    fs.writeFileSync(filePath, contents, {
-        encoding: 'utf-8',
-        mode,
-        flag: 'wx',
-    });
-}
-exports.ensureSafeFile = ensureSafeFile;
-//# sourceMappingURL=fsSafe.js.map

package/dist/utils/fsSafe.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"fsSafe.js","sourceRoot":"","sources":["../../src/utils/fsSafe.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AAEzB,SAAgB,aAAa,CAAC,OAAe,EAAE,OAAe,KAAK;IACjE,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+CAA+C,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO;IACT,CAAC;IAED,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAEjD,2EAA2E;IAC3E,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,kDAAkD,OAAO,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAnBD,sCAmBC;AAED,SAAgB,qBAAqB,CAAC,QAAgB;IACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO;IACrC,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AATD,sDASC;AAED,SAAgB,cAAc,CAC5B,QAAgB,EAChB,QAAgB,EAChB,OAAe,KAAK;IAEpB,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,OAAO;IACT,CAAC;IAED,uEAAuE;IACvE,oCAAoC;IACpC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE;QACnC,QAAQ,EAAE,OAAO;QACjB,IAAI;QACJ,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;AACL,CAAC;AAvBD,wCAuBC"}

package/dist/utils/index.d.ts

@@ -1,15 +0,0 @@
-/**
- * ACTP SDK Utilities
- *
- * This module exports all utility classes for the ACTP SDK.
- *
- * @module utils
- */
-export { ErrorRecoveryGuide, withRecoveryGuidance, type ErrorRecoveryInfo, type ErrorSeverity, type ErrorCategory, } from './ErrorRecoveryGuide';
-export { RateLimiter, CircuitBreaker, APIProtector, type RateLimiterConfig, type RateLimitResult, type CircuitBreakerConfig, type CircuitBreakerResult, type CircuitState, } from './RateLimiter';
-export { Logger, MetricsCollector, sdkLogger, sdkMetrics, type LogLevel, type LogEntry, type LoggerConfig, type MetricsHook, } from './Logger';
-export { SDKLifecycle, sdkLifecycle, onShutdown, registerDisposable, shutdownSDK, type Disposable, type ShutdownHandler, type LifecycleEvent, type LifecycleListener, } from './SDKLifecycle';
-export { InMemoryReceivedNonceTracker, SetBasedReceivedNonceTracker, createReceivedNonceTracker, type IReceivedNonceTracker, type NonceValidationResult, } from './ReceivedNonceTracker';
-export { InMemoryUsedAttestationTracker, FileBasedUsedAttestationTracker, createUsedAttestationTracker, type IUsedAttestationTracker, } from './UsedAttestationTracker';
-export { USDC, Deadline, Address, Bytes32, State, DisputeWindow, } from './Helpers';
-//# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,WAAW,EACX,cAAc,EACd,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,YAAY,GAClB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,UAAU,CAAC;AAGlB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,WAAW,EACX,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,iBAAiB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,EAC5B,0BAA0B,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,EAC/B,4BAA4B,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,OAAO,EACP,KAAK,EACL,aAAa,GACd,MAAM,WAAW,CAAC"}

package/dist/utils/index.js

@@ -1,51 +0,0 @@
-"use strict";
-/**
- * ACTP SDK Utilities
- *
- * This module exports all utility classes for the ACTP SDK.
- *
- * @module utils
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DisputeWindow = exports.State = exports.Bytes32 = exports.Address = exports.Deadline = exports.USDC = exports.createUsedAttestationTracker = exports.FileBasedUsedAttestationTracker = exports.InMemoryUsedAttestationTracker = exports.createReceivedNonceTracker = exports.SetBasedReceivedNonceTracker = exports.InMemoryReceivedNonceTracker = exports.shutdownSDK = exports.registerDisposable = exports.onShutdown = exports.sdkLifecycle = exports.SDKLifecycle = exports.sdkMetrics = exports.sdkLogger = exports.MetricsCollector = exports.Logger = exports.APIProtector = exports.CircuitBreaker = exports.RateLimiter = exports.withRecoveryGuidance = exports.ErrorRecoveryGuide = void 0;
-// Error Recovery (HIGH-6)
-var ErrorRecoveryGuide_1 = require("./ErrorRecoveryGuide");
-Object.defineProperty(exports, "ErrorRecoveryGuide", { enumerable: true, get: function () { return ErrorRecoveryGuide_1.ErrorRecoveryGuide; } });
-Object.defineProperty(exports, "withRecoveryGuidance", { enumerable: true, get: function () { return ErrorRecoveryGuide_1.withRecoveryGuidance; } });
-// Rate Limiting & Circuit Breaker (M-4, M-5)
-var RateLimiter_1 = require("./RateLimiter");
-Object.defineProperty(exports, "RateLimiter", { enumerable: true, get: function () { return RateLimiter_1.RateLimiter; } });
-Object.defineProperty(exports, "CircuitBreaker", { enumerable: true, get: function () { return RateLimiter_1.CircuitBreaker; } });
-Object.defineProperty(exports, "APIProtector", { enumerable: true, get: function () { return RateLimiter_1.APIProtector; } });
-// Logging & Metrics (M-6, M-7)
-var Logger_1 = require("./Logger");
-Object.defineProperty(exports, "Logger", { enumerable: true, get: function () { return Logger_1.Logger; } });
-Object.defineProperty(exports, "MetricsCollector", { enumerable: true, get: function () { return Logger_1.MetricsCollector; } });
-Object.defineProperty(exports, "sdkLogger", { enumerable: true, get: function () { return Logger_1.sdkLogger; } });
-Object.defineProperty(exports, "sdkMetrics", { enumerable: true, get: function () { return Logger_1.sdkMetrics; } });
-// SDK Lifecycle (M-8)
-var SDKLifecycle_1 = require("./SDKLifecycle");
-Object.defineProperty(exports, "SDKLifecycle", { enumerable: true, get: function () { return SDKLifecycle_1.SDKLifecycle; } });
-Object.defineProperty(exports, "sdkLifecycle", { enumerable: true, get: function () { return SDKLifecycle_1.sdkLifecycle; } });
-Object.defineProperty(exports, "onShutdown", { enumerable: true, get: function () { return SDKLifecycle_1.onShutdown; } });
-Object.defineProperty(exports, "registerDisposable", { enumerable: true, get: function () { return SDKLifecycle_1.registerDisposable; } });
-Object.defineProperty(exports, "shutdownSDK", { enumerable: true, get: function () { return SDKLifecycle_1.shutdownSDK; } });
-// Nonce Tracking (Security)
-var ReceivedNonceTracker_1 = require("./ReceivedNonceTracker");
-Object.defineProperty(exports, "InMemoryReceivedNonceTracker", { enumerable: true, get: function () { return ReceivedNonceTracker_1.InMemoryReceivedNonceTracker; } });
-Object.defineProperty(exports, "SetBasedReceivedNonceTracker", { enumerable: true, get: function () { return ReceivedNonceTracker_1.SetBasedReceivedNonceTracker; } });
-Object.defineProperty(exports, "createReceivedNonceTracker", { enumerable: true, get: function () { return ReceivedNonceTracker_1.createReceivedNonceTracker; } });
-// Attestation Tracking (Security)
-var UsedAttestationTracker_1 = require("./UsedAttestationTracker");
-Object.defineProperty(exports, "InMemoryUsedAttestationTracker", { enumerable: true, get: function () { return UsedAttestationTracker_1.InMemoryUsedAttestationTracker; } });
-Object.defineProperty(exports, "FileBasedUsedAttestationTracker", { enumerable: true, get: function () { return UsedAttestationTracker_1.FileBasedUsedAttestationTracker; } });
-Object.defineProperty(exports, "createUsedAttestationTracker", { enumerable: true, get: function () { return UsedAttestationTracker_1.createUsedAttestationTracker; } });
-// Helper Utilities (L-7)
-var Helpers_1 = require("./Helpers");
-Object.defineProperty(exports, "USDC", { enumerable: true, get: function () { return Helpers_1.USDC; } });
-Object.defineProperty(exports, "Deadline", { enumerable: true, get: function () { return Helpers_1.Deadline; } });
-Object.defineProperty(exports, "Address", { enumerable: true, get: function () { return Helpers_1.Address; } });
-Object.defineProperty(exports, "Bytes32", { enumerable: true, get: function () { return Helpers_1.Bytes32; } });
-Object.defineProperty(exports, "State", { enumerable: true, get: function () { return Helpers_1.State; } });
-Object.defineProperty(exports, "DisputeWindow", { enumerable: true, get: function () { return Helpers_1.DisputeWindow; } });
-//# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,0BAA0B;AAC1B,2DAM8B;AAL5B,wHAAA,kBAAkB,OAAA;AAClB,0HAAA,oBAAoB,OAAA;AAMtB,6CAA6C;AAC7C,6CASuB;AARrB,0GAAA,WAAW,OAAA;AACX,6GAAA,cAAc,OAAA;AACd,2GAAA,YAAY,OAAA;AAQd,+BAA+B;AAC/B,mCASkB;AARhB,gGAAA,MAAM,OAAA;AACN,0GAAA,gBAAgB,OAAA;AAChB,mGAAA,SAAS,OAAA;AACT,oGAAA,UAAU,OAAA;AAOZ,sBAAsB;AACtB,+CAUwB;AATtB,4GAAA,YAAY,OAAA;AACZ,4GAAA,YAAY,OAAA;AACZ,0GAAA,UAAU,OAAA;AACV,kHAAA,kBAAkB,OAAA;AAClB,2GAAA,WAAW,OAAA;AAOb,4BAA4B;AAC5B,+DAMgC;AAL9B,oIAAA,4BAA4B,OAAA;AAC5B,oIAAA,4BAA4B,OAAA;AAC5B,kIAAA,0BAA0B,OAAA;AAK5B,kCAAkC;AAClC,mEAKkC;AAJhC,wIAAA,8BAA8B,OAAA;AAC9B,yIAAA,+BAA+B,OAAA;AAC/B,sIAAA,4BAA4B,OAAA;AAI9B,yBAAyB;AACzB,qCAOmB;AANjB,+FAAA,IAAI,OAAA;AACJ,mGAAA,QAAQ,OAAA;AACR,kGAAA,OAAO,OAAA;AACP,kGAAA,OAAO,OAAA;AACP,gGAAA,KAAK,OAAA;AACL,wGAAA,aAAa,OAAA"}

package/dist/utils/security.d.ts

@@ -1,147 +0,0 @@
-/**
- * Security Utilities for ACTP SDK
- *
- * SECURITY FIXES:
- * - H-7: Constant-time string comparison (timing attack prevention)
- * - H-6: Path traversal prevention
- * - H-2: Input validation and sanitization
- * - C-3: Safe JSON parsing with schema validation
- *
- * @module utils/security
- */
-/**
- * H-7: Constant-time string comparison to prevent timing attacks
- *
- * Never use === for comparing signatures, hashes, or other security-sensitive strings
- * as it can leak timing information that attackers can exploit.
- *
- * @param a - First string to compare
- * @param b - Second string to compare
- * @returns true if strings are equal, false otherwise
- */
-export declare function timingSafeEqual(a: string, b: string): boolean;
-/**
- * H-6: Validate and sanitize directory path to prevent path traversal
- *
- * Ensures that the provided path:
- * 1. Does not contain '..' sequences
- * 2. Resolves to a location within the allowed base directory
- * 3. Does not follow symlinks (optional)
- *
- * @param requestedPath - The path to validate
- * @param baseDirectory - The base directory to restrict paths to
- * @returns Sanitized absolute path
- * @throws Error if path is invalid or contains traversal attempts
- */
-export declare function validatePath(requestedPath: string, baseDirectory: string): string;
-/**
- * H-2: Validate and sanitize service name
- *
- * Ensures service name:
- * 1. Contains only safe characters (alphanumeric, dash, dot, underscore)
- * 2. Does not exceed maximum length
- * 3. Does not contain special characters that could cause injection
- *
- * @param serviceName - The service name to validate
- * @returns Sanitized service name
- * @throws Error if service name is invalid
- */
-export declare function validateServiceName(serviceName: string): string;
-/**
- * H-5: Validate Ethereum address format
- *
- * Ensures address:
- * 1. Is a valid hex string
- * 2. Has correct length (42 chars including '0x' prefix)
- * 3. Uses valid checksum if provided (EIP-55)
- *
- * @param address - The Ethereum address to validate
- * @returns true if address is valid, false otherwise
- */
-export declare function isValidAddress(address: string): boolean;
-/**
- * C-3: Safe JSON parsing with schema validation
- *
- * Prevents code injection and prototype pollution attacks by:
- * 1. Safely parsing JSON with error handling
- * 2. Validating the parsed object against an expected schema
- * 3. Removing __proto__, constructor, and prototype properties
- * 4. Returning only whitelisted fields
- *
- * @param jsonString - The JSON string to parse
- * @param schema - Expected schema (object with field names and types)
- * @returns Parsed and validated object, or null if invalid
- */
-export declare function safeJSONParse<T = any>(jsonString: string, schema?: Record<string, string>): T | null;
-/**
- * LRU (Least Recently Used) cache with maximum size
- * Used for preventing unbounded memory growth
- *
- * @template K - Key type
- * @template V - Value type
- */
-export declare class LRUCache<K, V> {
-    private cache;
-    private readonly maxSize;
-    constructor(maxSize?: number);
-    /**
-     * Get value from cache
-     *
-     * @param key - Cache key
-     * @returns Cached value or undefined
-     */
-    get(key: K): V | undefined;
-    /**
-     * Set value in cache
-     *
-     * @param key - Cache key
-     * @param value - Value to cache
-     */
-    set(key: K, value: V): void;
-    /**
-     * Check if key exists in cache
-     *
-     * SECURITY FIX (N-1): Use Map's native has() instead of get()
-     * to avoid modifying LRU order on read-only operations.
-     *
-     * @param key - Cache key
-     * @returns true if key exists
-     */
-    has(key: K): boolean;
-    /**
-     * Delete key from cache
-     *
-     * @param key - Cache key
-     */
-    delete(key: K): void;
-    /**
-     * Clear all entries
-     */
-    clear(): void;
-    /**
-     * Get current cache size
-     */
-    get size(): number;
-    /**
-     * Get all values from cache
-     *
-     * SECURITY FIX (N-2): Add iterator support for LRUCache.
-     * Returns values in LRU order (oldest to newest).
-     *
-     * @returns Array of all cached values
-     */
-    values(): V[];
-    /**
-     * Get all keys from cache
-     *
-     * @returns Array of all cached keys
-     */
-    keys(): K[];
-    /**
-     * Get all entries from cache
-     *
-     * @returns Array of all cached [key, value] pairs
-     */
-    entries(): [K, V][];
-}
-//# sourceMappingURL=security.d.ts.map

package/dist/utils/security.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/utils/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAkB7D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CA4BjF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAgC/D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAyBvD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,CAAC,GAAG,GAAG,EACnC,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,CAAC,GAAG,IAAI,CAoEV;AAqCD;;;;;;GAMG;AACH,qBAAa,QAAQ,CAAC,CAAC,EAAE,CAAC;IACxB,OAAO,CAAC,KAAK,CAAmB;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,OAAO,GAAE,MAAa;IAOlC;;;;;OAKG;IACH,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,SAAS;IAU1B;;;;;OAKG;IACH,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAmB3B;;;;;;;;OAQG;IACH,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO;IAIpB;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI;IAIpB;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;;;;;;OAOG;IACH,MAAM,IAAI,CAAC,EAAE;IAIb;;;;OAIG;IACH,IAAI,IAAI,CAAC,EAAE;IAIX;;;;OAIG;IACH,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;CAGpB"}