@dvmkit/sdk 0.0.0 → 0.1.0-rc.1

package/dist/chunk-KQAJVVZT.js

@@ -0,0 +1,712 @@
+// src/sdk/types.ts
+function isZodSchema(value) {
+  return typeof value === "object" && value !== null && "_zod" in value && "parse" in value && "safeParse" in value;
+}
+var RAIL_REFUNDABLE = {
+  cashu: false,
+  x402: false,
+  tempo: false
+};
+var DEFAULT_CREDIT_MIN = "$0.10";
+var DEFAULT_CREDIT_MAX = "$5.00";
+var DEFAULT_CREDIT_TTL_SECONDS = 30 * 24 * 60 * 60;
+
+// src/sdk/env.ts
+function envFlag(value) {
+  return value === "1" || value === "true";
+}
+
+// src/lib/cast-auth/canonical-json.ts
+function canonicalize(value) {
+  return JSON.stringify(sortDeep(value));
+}
+function canonicaliseForSigning(value) {
+  return new TextEncoder().encode(canonicalize(value));
+}
+function sortDeep(value) {
+  if (value === null) return null;
+  if (typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError(`canonicalize: non-finite number is not JSON-serialisable`);
+    }
+    return value;
+  }
+  if (Array.isArray(value)) return value.map(sortDeep);
+  if (typeof value === "object") {
+    const sorted = {};
+    for (const key of Object.keys(value).sort()) {
+      const v = value[key];
+      if (v === void 0) continue;
+      sorted[key] = sortDeep(v);
+    }
+    return sorted;
+  }
+  throw new TypeError(`canonicalize: unsupported value of type ${typeof value}`);
+}
+
+// src/lib/cast-auth/verify.ts
+import { schnorr } from "@noble/curves/secp256k1.js";
+
+// src/lib/signed-request-statement.ts
+var SIGNED_REQUEST_AUTH_ID = "secp256k1-schnorr-v2";
+var SIGNED_REQUEST_STATEMENT_VERSION = 2;
+var TEST_DOMAIN_SENTINEL = "__dvmkit_test_domain__";
+function normalizeSignedRequestDomain(domain) {
+  return {
+    audience: {
+      dvm_id: domain.audience.dvm_id,
+      builder_pubkey: domain.audience.builder_pubkey.trim().toLowerCase()
+    },
+    method: domain.method.trim().toUpperCase(),
+    path: canonicalRequestPath(domain.path),
+    capability: domain.capability
+  };
+}
+function signedRequestStatementHeader(domain) {
+  const normalized = normalizeSignedRequestDomain(domain);
+  return {
+    v: SIGNED_REQUEST_STATEMENT_VERSION,
+    protocol: "dvmkit",
+    protocol_version: 1,
+    auth: SIGNED_REQUEST_AUTH_ID,
+    audience: normalized.audience,
+    method: normalized.method,
+    path: normalized.path,
+    capability: normalized.capability
+  };
+}
+function canonicalSignedRequestStatement(header, input) {
+  return canonicaliseForSigning({
+    ...header,
+    input
+  });
+}
+function signedRequestHeaderMatchesDomain(header, domain) {
+  if (!header || typeof header !== "object" || Array.isArray(header)) return false;
+  const actual = header;
+  const expected = signedRequestStatementHeader(domain);
+  const audience = actual.audience;
+  if (process.env.NODE_ENV === "test" && actual.method === TEST_DOMAIN_SENTINEL.toUpperCase() && actual.path === `/${TEST_DOMAIN_SENTINEL}` && actual.capability === TEST_DOMAIN_SENTINEL && audience?.dvm_id === TEST_DOMAIN_SENTINEL) {
+    return true;
+  }
+  return actual.v === expected.v && actual.protocol === expected.protocol && actual.protocol_version === expected.protocol_version && actual.auth === expected.auth && actual.method === expected.method && actual.path === expected.path && actual.capability === expected.capability && !!audience && typeof audience === "object" && audience.dvm_id === expected.audience.dvm_id && audience.builder_pubkey === expected.audience.builder_pubkey;
+}
+function testOnlySignedRequestDomain() {
+  if (process.env.NODE_ENV !== "test") return void 0;
+  return {
+    audience: { dvm_id: TEST_DOMAIN_SENTINEL, builder_pubkey: "00".repeat(32) },
+    method: TEST_DOMAIN_SENTINEL,
+    path: TEST_DOMAIN_SENTINEL,
+    capability: TEST_DOMAIN_SENTINEL
+  };
+}
+function canonicalRequestPath(pathOrUrl) {
+  const parsed = new URL(pathOrUrl, "https://signed-request.invalid");
+  return parsed.pathname.startsWith("/") ? parsed.pathname : `/${parsed.pathname}`;
+}
+
+// src/sdk/server/signed-request.ts
+import { schnorr as schnorr2 } from "@noble/curves/secp256k1.js";
+
+// src/sdk/server/zod-error.ts
+function humanizeZodError(err, opts) {
+  return humanizeZodIssues(err.issues, opts);
+}
+function humanizeZodIssues(issues, opts) {
+  return { message: summariseIssues(issues), hint: pickHint(issues, opts.schemaUrl) };
+}
+function zodIssuesOf(error) {
+  if (typeof error !== "object" || error === null) return void 0;
+  const issues = error.issues;
+  return Array.isArray(issues) ? issues : void 0;
+}
+var MAX_REPORTED_CLAUSES = 3;
+function summariseIssues(issues) {
+  if (issues.length === 0) return "Input validation failed";
+  const line = issues.slice(0, MAX_REPORTED_CLAUSES).map(summariseIssue).join("; ");
+  const overflow = issues.length - MAX_REPORTED_CLAUSES;
+  return overflow > 0 ? `${line} (+${overflow.toString()} more)` : line;
+}
+function summariseIssue(issue) {
+  const path = formatPath(issue.path);
+  const reason = describeReason(issue);
+  return path ? `${path}: ${reason}` : reason;
+}
+function formatPath(path) {
+  if (path.length === 0) return "";
+  return path.map((segment) => typeof segment === "number" ? `[${segment.toString()}]` : String(segment)).join(".");
+}
+function describeReason(issue) {
+  switch (issue.code) {
+    case "too_big": {
+      const max = issue.maximum.toString();
+      if (issue.origin === "string") return `too long (max ${max} chars)`;
+      if (issue.origin === "array" || issue.origin === "set") {
+        return `too many items (max ${max})`;
+      }
+      return `value too large (max ${max})`;
+    }
+    case "too_small": {
+      const min = issue.minimum.toString();
+      if (issue.origin === "string") {
+        return min === "1" ? "required" : `too short (min ${min} chars)`;
+      }
+      if (issue.origin === "array" || issue.origin === "set") {
+        return min === "1" ? "required (must be non-empty)" : `too few items (min ${min})`;
+      }
+      return `value too small (min ${min})`;
+    }
+    case "invalid_type":
+      return `expected ${issue.expected}`;
+    case "invalid_value":
+      return `must be one of: ${issue.values.map(String).join(", ")}`;
+    case "invalid_format":
+      return `invalid ${issue.format}`;
+    case "unrecognized_keys":
+      return `unrecognized field(s): ${issue.keys.join(", ")}`;
+    case "not_multiple_of":
+      return `must be a multiple of ${issue.divisor.toString()}`;
+    case "invalid_union":
+      return "no matching variant";
+    case "custom":
+    default:
+      return issue.message || "invalid";
+  }
+}
+function pickHint(issues, schemaUrl) {
+  const tooBigString = issues.find(
+    (i) => i.code === "too_big" && i.origin === "string"
+  );
+  if (tooBigString) {
+    const path = formatPath(tooBigString.path);
+    const field = path ? `\`${path}\` ` : "";
+    return `Input field ${field}exceeds the ${tooBigString.maximum.toString()}-character limit. Split into smaller chunks and submit separately.`;
+  }
+  const tooSmallString = issues.find(
+    (i) => i.code === "too_small" && i.origin === "string" && i.minimum === 1
+  );
+  if (tooSmallString) {
+    const path = formatPath(tooSmallString.path);
+    const field = path ? `\`${path}\`` : "the required string field";
+    return `Provide non-empty text in ${field}.`;
+  }
+  return `Inspect ${schemaUrl} for the expected input schema.`;
+}
+
+// src/sdk/server/signed-request.ts
+var SIGNED_ENVELOPE_TYPES = {
+  pubkey: "string",
+  signature: "string",
+  timestamp: "number",
+  nonce: "string",
+  auth_statement: "object"
+};
+var SIGNED_ENVELOPE_FIELDS = Object.keys(
+  SIGNED_ENVELOPE_TYPES
+);
+var SignedRequestError = class extends Error {
+  constructor(message, sub_reason, issues) {
+    super(message);
+    this.sub_reason = sub_reason;
+    this.issues = issues;
+    this.name = "SignedRequestError";
+  }
+  sub_reason;
+  issues;
+  code = "auth_error";
+};
+var DEFAULT_DRIFT_SECONDS = 5 * 60;
+var DEFAULT_ENVELOPE_FIELDS = ["signature"];
+var DEFAULT_REPLAY_WINDOW_SECONDS = 10 * 60;
+var DEFAULT_REPLAY_CAP = 1e5;
+function createSignedRequestVerifier(schema, opts = {}) {
+  const driftSeconds = opts.driftSeconds ?? DEFAULT_DRIFT_SECONDS;
+  const stripFields = /* @__PURE__ */ new Set([...DEFAULT_ENVELOPE_FIELDS, ...opts.envelopeFields ?? []]);
+  const schemaIgnoreFields = /* @__PURE__ */ new Set([
+    "auth_statement",
+    ...opts.schemaIgnoreFields ?? []
+  ]);
+  const replayStore = opts.replayStore === null ? null : opts.replayStore ?? createDefaultReplayStore();
+  const now = opts.now ?? (() => Math.floor(Date.now() / 1e3));
+  function requiredDomain(domain) {
+    const resolved = domain ?? opts.domain ?? testOnlySignedRequestDomain();
+    if (!resolved) {
+      throw new SignedRequestError("signed-request domain is required", "signature_invalid");
+    }
+    return resolved;
+  }
+  function parse(input) {
+    if (!isZodSchema(schema)) {
+      throw new SignedRequestError("signed-request schema must be a Zod schema", "schema_invalid");
+    }
+    const parsed = schema.safeParse(withoutIgnoredFields(input, schemaIgnoreFields));
+    if (!parsed.success) {
+      throw new SignedRequestError(
+        "input did not satisfy schema",
+        "schema_invalid",
+        zodIssuesOf(parsed.error)
+      );
+    }
+    const envelope = {
+      ...parsed.data,
+      auth_statement: statementHeader(input)
+    };
+    const mistyped = Object.entries(SIGNED_ENVELOPE_TYPES).some(
+      ([field, expected]) => typeof envelope[field] !== expected
+    );
+    if (mistyped) {
+      throw new SignedRequestError(
+        `schema must include ${SIGNED_ENVELOPE_FIELDS.join("/")} envelope fields`,
+        "schema_invalid"
+      );
+    }
+    return envelope;
+  }
+  function canonicalBytes(input, domain) {
+    const expected = requiredDomain(domain);
+    const stripped = stripEnvelope(input, stripFields);
+    const header = statementHeader(input);
+    if (!signedRequestHeaderMatchesDomain(header, expected)) {
+      throw new SignedRequestError("signed-request domain does not match", "signature_invalid");
+    }
+    return canonicalSignedRequestStatement(header, stripped);
+  }
+  function checkAuth(input, domain) {
+    const envelope = parse(input);
+    const t = now();
+    if (Math.abs(t - envelope.timestamp) > driftSeconds) {
+      throw new SignedRequestError(
+        "timestamp drift exceeds the permitted window",
+        "timestamp_drift"
+      );
+    }
+    if (!verifyBytes(canonicalBytes(input, domain), envelope.signature, envelope.pubkey)) {
+      throw new SignedRequestError("signature verification failed", "signature_invalid");
+    }
+    return envelope;
+  }
+  function verifySignature(input, domain) {
+    const envelope = parse(input);
+    if (!verifyBytes(canonicalBytes(input, domain), envelope.signature, envelope.pubkey)) {
+      throw new SignedRequestError("signature verification failed", "signature_invalid");
+    }
+    return envelope;
+  }
+  async function recordReplay(envelope) {
+    if (!replayStore) return;
+    const t = now();
+    if (await replayStore.checkAndRecord(envelope.pubkey, envelope.timestamp, envelope.nonce, t)) {
+      throw new SignedRequestError(
+        "duplicate (pubkey, timestamp, nonce) in replay window",
+        "replay_detected"
+      );
+    }
+  }
+  function signRequest(privkey, body, signOpts, domain) {
+    const pubkey = bytesToHex(schnorr2.getPublicKey(privkey));
+    const timestamp = signOpts?.timestamp ?? now();
+    const nonce = signOpts?.nonce ?? randomNonce();
+    const unsigned = {
+      pubkey,
+      timestamp,
+      nonce,
+      ...body
+    };
+    const authStatement = signedRequestStatementHeader(requiredDomain(domain));
+    const signature = bytesToHex(
+      schnorr2.sign(canonicalBytes({ ...unsigned, auth_statement: authStatement }, domain), privkey)
+    );
+    return { ...unsigned, auth_statement: authStatement, signature };
+  }
+  return { checkAuth, verifySignature, recordReplay, canonicalBytes, signRequest };
+}
+function signedRequestInput(body) {
+  if (body.data !== void 0) return body.data;
+  if (typeof body.input === "string" && body.input.length > 0) {
+    try {
+      return JSON.parse(body.input);
+    } catch {
+      return {};
+    }
+  }
+  return {};
+}
+function withoutIgnoredFields(input, ignore) {
+  if (ignore.size === 0) return input;
+  if (input === null || typeof input !== "object" || Array.isArray(input)) return input;
+  const entries = Object.entries(input);
+  if (!entries.some(([key]) => ignore.has(key))) return input;
+  return Object.fromEntries(entries.filter(([key]) => !ignore.has(key)));
+}
+function stripEnvelope(input, stripFields) {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) {
+    return input;
+  }
+  const out = {};
+  for (const [k, v] of Object.entries(input)) {
+    if (stripFields.has(k) || k === "auth_statement") continue;
+    if (v === void 0) continue;
+    out[k] = v;
+  }
+  return out;
+}
+function statementHeader(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return void 0;
+  return input.auth_statement;
+}
+function verifyBytes(bytes, signatureHex, pubkeyHex) {
+  try {
+    return schnorr2.verify(hexToBytes(signatureHex), bytes, hexToBytes(pubkeyHex));
+  } catch {
+    return false;
+  }
+}
+function hexToBytes(hex) {
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  return out;
+}
+function bytesToHex(bytes) {
+  let s = "";
+  for (const b of bytes) s += b.toString(16).padStart(2, "0");
+  return s;
+}
+function randomNonce() {
+  const bytes = new Uint8Array(12);
+  globalThis.crypto.getRandomValues(bytes);
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function createDefaultReplayStore() {
+  const entries = /* @__PURE__ */ new Map();
+  let lastSaturationWarnAt = 0;
+  return {
+    checkAndRecord(pubkey, timestamp, nonce, t) {
+      const key = `${pubkey}|${timestamp.toString()}|${nonce}`;
+      const cutoff = t - DEFAULT_REPLAY_WINDOW_SECONDS;
+      for (const [k, recordedAt] of entries) {
+        if (recordedAt >= cutoff) break;
+        entries.delete(k);
+      }
+      if (entries.has(key)) return Promise.resolve(true);
+      if (entries.size >= DEFAULT_REPLAY_CAP) {
+        if (t - lastSaturationWarnAt >= SATURATION_WARN_INTERVAL_SECONDS) {
+          lastSaturationWarnAt = t;
+          console.warn(
+            JSON.stringify({
+              level: "warn",
+              event: "signed_request_replay_store_saturated",
+              message: "in-memory signed-request replay store at cap \u2014 rejecting fresh inserts to avoid widening the replay window; move to PostgresReplayStore",
+              cap: DEFAULT_REPLAY_CAP,
+              window_seconds: DEFAULT_REPLAY_WINDOW_SECONDS
+            })
+          );
+        }
+        return Promise.resolve(true);
+      }
+      entries.set(key, t);
+      return Promise.resolve(false);
+    }
+  };
+}
+var SATURATION_WARN_INTERVAL_SECONDS = 60;
+
+// src/sdk/server/ssrf.ts
+import { lookup } from "dns/promises";
+import { isIPv4, isIPv6 } from "net";
+import { Agent } from "undici";
+var SSRFError = class extends Error {
+  code = "ssrf_blocked";
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.reason = reason;
+  }
+};
+async function assertSafeUrl(url, opts) {
+  await resolveAndValidate(url, opts);
+}
+async function createPinnedFetch(url, opts) {
+  const validated = await resolveAndValidate(url, opts);
+  const baseFetch = opts?.baseFetch ?? fetch;
+  const initialUrl = new URL(url);
+  const agents = [];
+  const targets = /* @__PURE__ */ new Map();
+  const createTarget = (next) => {
+    if (next.kind === "literal") return {};
+    const agent = new Agent({
+      connect: { lookup: buildPinnedLookup(next.addresses) }
+    });
+    agents.push(agent);
+    return { agent };
+  };
+  targets.set(initialUrl.origin, createTarget(validated));
+  const targetFor = async (requestUrl) => {
+    const parsed = new URL(requestUrl);
+    const existing = targets.get(parsed.origin);
+    if (existing) return existing;
+    const target = createTarget(await resolveAndValidate(parsed.href, opts));
+    targets.set(parsed.origin, target);
+    return target;
+  };
+  const pinnedFetch = async (input, init) => {
+    let request = new Request(input, init);
+    let redirects = 0;
+    for (; ; ) {
+      const target = await targetFor(request.url);
+      const response = await baseFetch(
+        request,
+        target.agent ? { redirect: "manual", dispatcher: target.agent } : { redirect: "manual" }
+      );
+      if (!isRedirect(response.status) || request.redirect === "manual") return response;
+      const location = response.headers.get("location");
+      if (location === null) return response;
+      await discardResponse(response);
+      if (request.redirect === "error") {
+        throw new TypeError("fetch failed: redirect mode is set to error");
+      }
+      if (redirects >= MAX_PINNED_REDIRECTS) {
+        throw new TypeError("fetch failed: maximum redirect count exceeded");
+      }
+      request = requestForRedirect(request, new URL(location, request.url), response.status);
+      redirects += 1;
+      opts?.onRedirectFollowed?.();
+    }
+  };
+  return {
+    fetch: pinnedFetch,
+    address: validated.address,
+    family: validated.family,
+    close: async () => {
+      await Promise.all(agents.map((agent) => agent.close()));
+    }
+  };
+}
+var MAX_PINNED_REDIRECTS = 20;
+function isRedirect(status) {
+  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+async function discardResponse(response) {
+  await response.body?.cancel().catch(() => void 0);
+}
+function requestForRedirect(request, target, status) {
+  const headers = new Headers(request.headers);
+  if (new URL(request.url).origin !== target.origin) {
+    headers.delete("authorization");
+    headers.delete("cookie");
+    headers.delete("proxy-authorization");
+    headers.delete("host");
+  }
+  const method = request.method.toUpperCase();
+  const switchToGet = status === 303 && method !== "HEAD" || (status === 301 || status === 302) && method === "POST";
+  if (switchToGet) {
+    headers.delete("content-length");
+    headers.delete("content-type");
+    return redirectRequest(target, request, headers, "GET");
+  }
+  if (method !== "GET" && method !== "HEAD") {
+    throw new TypeError("fetch failed: cannot safely replay a request body across this redirect");
+  }
+  return redirectRequest(target, request, headers, method);
+}
+function redirectRequest(target, request, headers, method) {
+  return new Request(target, {
+    method,
+    headers,
+    signal: request.signal,
+    redirect: request.redirect,
+    cache: request.cache,
+    credentials: request.credentials,
+    integrity: request.integrity,
+    keepalive: request.keepalive,
+    mode: request.mode,
+    referrer: request.referrer,
+    referrerPolicy: request.referrerPolicy
+  });
+}
+function buildPinnedLookup(addresses) {
+  return ((_hostname, options, cb) => {
+    if (options.all === false) {
+      const first = addresses[0];
+      cb(
+        null,
+        first.address,
+        first.family
+      );
+    } else {
+      cb(
+        null,
+        addresses
+      );
+    }
+  });
+}
+async function resolveAndValidate(url, opts) {
+  const resolver = opts?.resolver ?? defaultResolver;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new SSRFError("invalid_url", `url is not a valid URL: ${url}`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new SSRFError("insecure_scheme", `url must be https; got ${parsed.protocol}`);
+  }
+  const host = parsed.hostname.toLowerCase();
+  if (host === "") {
+    throw new SSRFError("invalid_url", "url has no host");
+  }
+  if (HOSTNAME_DENYLIST_EXACT.has(host) || matchesExtraExact(host, opts?.extraHostnamesExact)) {
+    throw new SSRFError("private_address", `url host "${host}" is on the SSRF denylist`);
+  }
+  for (const suffix of HOSTNAME_DENYLIST_SUFFIX) {
+    if (host === suffix.slice(1) || host.endsWith(suffix)) {
+      throw new SSRFError(
+        "private_address",
+        `url host "${host}" matches denied suffix "${suffix}"`
+      );
+    }
+  }
+  if (opts?.extraHostnameSuffixes) {
+    for (const suffix of opts.extraHostnameSuffixes) {
+      const s = suffix.toLowerCase();
+      if (host === s.slice(1) || host.endsWith(s)) {
+        throw new SSRFError("private_address", `url host "${host}" matches denied suffix "${s}"`);
+      }
+    }
+  }
+  const stripped = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+  if (isIPv4(stripped) || isIPv6(stripped)) {
+    if (isUnsafeAddress(stripped, opts)) {
+      throw new SSRFError(
+        "private_address",
+        `url host "${stripped}" is in a blocked address range`
+      );
+    }
+    return { kind: "literal", address: stripped, family: isIPv4(stripped) ? 4 : 6 };
+  }
+  let addresses;
+  try {
+    addresses = await resolver(host);
+  } catch (err) {
+    throw new SSRFError(
+      "dns_failed",
+      `url host "${host}" failed DNS resolution: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (addresses.length === 0) {
+    throw new SSRFError("dns_failed", `url host "${host}" resolved to no addresses`);
+  }
+  for (const { address } of addresses) {
+    if (isUnsafeAddress(address, opts)) {
+      throw new SSRFError(
+        "private_address",
+        `url host "${host}" resolves to blocked address "${address}"`
+      );
+    }
+  }
+  const validated = addresses.map((a) => ({ address: a.address, family: a.family }));
+  const first = validated[0];
+  return { kind: "resolved", address: first.address, family: first.family, addresses: validated };
+}
+var HOSTNAME_DENYLIST_EXACT = /* @__PURE__ */ new Set([
+  "localhost",
+  "ip6-localhost",
+  "ip6-loopback",
+  "metadata.google.internal",
+  "metadata"
+]);
+var HOSTNAME_DENYLIST_SUFFIX = [".internal", ".local", ".localhost", ".lan"];
+async function defaultResolver(host) {
+  return lookup(host, { all: true });
+}
+function matchesExtraExact(host, extras) {
+  if (!extras) return false;
+  for (const entry of extras) {
+    if (entry.toLowerCase() === host) return true;
+  }
+  return false;
+}
+function isUnsafeAddress(address, opts) {
+  if (isIPv4(address)) {
+    if (isUnsafeIPv4(address)) return true;
+    return opts?.extraUnsafeIPv4?.(address) === true;
+  }
+  if (isIPv6(address)) {
+    if (isUnsafeIPv6(address)) return true;
+    return opts?.extraUnsafeIPv6?.(address) === true;
+  }
+  return true;
+}
+function isUnsafeIPv4(address) {
+  const parts = address.split(".").map(Number);
+  if (parts.length !== 4 || parts.some((p) => !Number.isFinite(p) || p < 0 || p > 255)) {
+    return true;
+  }
+  const [a, b, c] = parts;
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 0 && (c === 0 || c === 2)) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a >= 224 && a <= 239) return true;
+  if (a >= 240) return true;
+  return false;
+}
+function isUnsafeIPv6(address) {
+  const lower = address.toLowerCase();
+  if (lower === "::1") return true;
+  if (lower === "::") return true;
+  if (lower.startsWith("fe8") || lower.startsWith("fe9") || lower.startsWith("fea") || lower.startsWith("feb")) {
+    return true;
+  }
+  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
+  if (lower.startsWith("::ffff:")) {
+    const tail = lower.slice("::ffff:".length);
+    if (isIPv4(tail)) return isUnsafeIPv4(tail);
+    const m = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(tail);
+    if (m) {
+      const high = parseInt(m[1], 16);
+      const low = parseInt(m[2], 16);
+      const a = high >> 8 & 255;
+      const b = high & 255;
+      const c = low >> 8 & 255;
+      const d = low & 255;
+      return isUnsafeIPv4(`${a.toString()}.${b.toString()}.${c.toString()}.${d.toString()}`);
+    }
+  }
+  if (lower.startsWith("ff")) return true;
+  return false;
+}
+
+export {
+  isZodSchema,
+  RAIL_REFUNDABLE,
+  DEFAULT_CREDIT_MIN,
+  DEFAULT_CREDIT_MAX,
+  DEFAULT_CREDIT_TTL_SECONDS,
+  envFlag,
+  canonicalize,
+  canonicaliseForSigning,
+  SIGNED_REQUEST_AUTH_ID,
+  SIGNED_REQUEST_STATEMENT_VERSION,
+  signedRequestStatementHeader,
+  canonicalRequestPath,
+  humanizeZodError,
+  humanizeZodIssues,
+  zodIssuesOf,
+  SIGNED_ENVELOPE_FIELDS,
+  SignedRequestError,
+  createSignedRequestVerifier,
+  signedRequestInput,
+  createDefaultReplayStore,
+  SSRFError,
+  assertSafeUrl,
+  createPinnedFetch
+};