@dvmkit/sdk 0.1.0-rc.2 → 0.1.0-rc.3

package/dist/{chunk-KQAJVVZT.js → chunk-AZBXSXQT.js}

@@ -11,11 +11,6 @@ var DEFAULT_CREDIT_MIN = "$0.10";
 var DEFAULT_CREDIT_MAX = "$5.00";
 var DEFAULT_CREDIT_TTL_SECONDS = 30 * 24 * 60 * 60;
 
-// src/sdk/env.ts
-function envFlag(value) {
-  return value === "1" || value === "true";
-}
-
 // src/lib/cast-auth/canonical-json.ts
 function canonicalize(value) {
   return JSON.stringify(sortDeep(value));
@@ -47,6 +42,26 @@ function sortDeep(value) {
 
 // src/lib/cast-auth/verify.ts
 import { schnorr } from "@noble/curves/secp256k1.js";
+function verifyCanonicalSignedRequest(payload, signatureHex, pubkeyHex) {
+  if (!/^[0-9a-f]{64}$/i.test(pubkeyHex) || !/^[0-9a-f]{128}$/i.test(signatureHex)) {
+    return false;
+  }
+  const data = canonicaliseForSigning(payload);
+  const signature = hexToBytes(signatureHex);
+  const pubkey = hexToBytes(pubkeyHex);
+  try {
+    return schnorr.verify(signature, data, pubkey);
+  } catch {
+    return false;
+  }
+}
+function hexToBytes(hex) {
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
 
 // src/lib/signed-request-statement.ts
 var SIGNED_REQUEST_AUTH_ID = "secp256k1-schnorr-v2";
@@ -106,9 +121,6 @@ function canonicalRequestPath(pathOrUrl) {
   return parsed.pathname.startsWith("/") ? parsed.pathname : `/${parsed.pathname}`;
 }
 
-// src/sdk/server/signed-request.ts
-import { schnorr as schnorr2 } from "@noble/curves/secp256k1.js";
-
 // src/sdk/server/zod-error.ts
 function humanizeZodError(err, opts) {
   return humanizeZodIssues(err.issues, opts);
@@ -195,6 +207,7 @@ function pickHint(issues, schemaUrl) {
 }
 
 // src/sdk/server/signed-request.ts
+import { schnorr as schnorr2 } from "@noble/curves/secp256k1.js";
 var SIGNED_ENVELOPE_TYPES = {
   pubkey: "string",
   signature: "string",
@@ -357,12 +370,12 @@ function statementHeader(input) {
 }
 function verifyBytes(bytes, signatureHex, pubkeyHex) {
   try {
-    return schnorr2.verify(hexToBytes(signatureHex), bytes, hexToBytes(pubkeyHex));
+    return schnorr2.verify(hexToBytes2(signatureHex), bytes, hexToBytes2(pubkeyHex));
   } catch {
     return false;
   }
 }
-function hexToBytes(hex) {
+function hexToBytes2(hex) {
   const out = new Uint8Array(hex.length / 2);
   for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
   return out;
@@ -413,300 +426,27 @@ function createDefaultReplayStore() {
 }
 var SATURATION_WARN_INTERVAL_SECONDS = 60;
 
-// src/sdk/server/ssrf.ts
-import { lookup } from "dns/promises";
-import { isIPv4, isIPv6 } from "net";
-import { Agent } from "undici";
-var SSRFError = class extends Error {
-  code = "ssrf_blocked";
-  reason;
-  constructor(reason, message) {
-    super(message);
-    this.reason = reason;
-  }
-};
-async function assertSafeUrl(url, opts) {
-  await resolveAndValidate(url, opts);
-}
-async function createPinnedFetch(url, opts) {
-  const validated = await resolveAndValidate(url, opts);
-  const baseFetch = opts?.baseFetch ?? fetch;
-  const initialUrl = new URL(url);
-  const agents = [];
-  const targets = /* @__PURE__ */ new Map();
-  const createTarget = (next) => {
-    if (next.kind === "literal") return {};
-    const agent = new Agent({
-      connect: { lookup: buildPinnedLookup(next.addresses) }
-    });
-    agents.push(agent);
-    return { agent };
-  };
-  targets.set(initialUrl.origin, createTarget(validated));
-  const targetFor = async (requestUrl) => {
-    const parsed = new URL(requestUrl);
-    const existing = targets.get(parsed.origin);
-    if (existing) return existing;
-    const target = createTarget(await resolveAndValidate(parsed.href, opts));
-    targets.set(parsed.origin, target);
-    return target;
-  };
-  const pinnedFetch = async (input, init) => {
-    let request = new Request(input, init);
-    let redirects = 0;
-    for (; ; ) {
-      const target = await targetFor(request.url);
-      const response = await baseFetch(
-        request,
-        target.agent ? { redirect: "manual", dispatcher: target.agent } : { redirect: "manual" }
-      );
-      if (!isRedirect(response.status) || request.redirect === "manual") return response;
-      const location = response.headers.get("location");
-      if (location === null) return response;
-      await discardResponse(response);
-      if (request.redirect === "error") {
-        throw new TypeError("fetch failed: redirect mode is set to error");
-      }
-      if (redirects >= MAX_PINNED_REDIRECTS) {
-        throw new TypeError("fetch failed: maximum redirect count exceeded");
-      }
-      request = requestForRedirect(request, new URL(location, request.url), response.status);
-      redirects += 1;
-      opts?.onRedirectFollowed?.();
-    }
-  };
-  return {
-    fetch: pinnedFetch,
-    address: validated.address,
-    family: validated.family,
-    close: async () => {
-      await Promise.all(agents.map((agent) => agent.close()));
-    }
-  };
-}
-var MAX_PINNED_REDIRECTS = 20;
-function isRedirect(status) {
-  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
-}
-async function discardResponse(response) {
-  await response.body?.cancel().catch(() => void 0);
-}
-function requestForRedirect(request, target, status) {
-  const headers = new Headers(request.headers);
-  if (new URL(request.url).origin !== target.origin) {
-    headers.delete("authorization");
-    headers.delete("cookie");
-    headers.delete("proxy-authorization");
-    headers.delete("host");
-  }
-  const method = request.method.toUpperCase();
-  const switchToGet = status === 303 && method !== "HEAD" || (status === 301 || status === 302) && method === "POST";
-  if (switchToGet) {
-    headers.delete("content-length");
-    headers.delete("content-type");
-    return redirectRequest(target, request, headers, "GET");
-  }
-  if (method !== "GET" && method !== "HEAD") {
-    throw new TypeError("fetch failed: cannot safely replay a request body across this redirect");
-  }
-  return redirectRequest(target, request, headers, method);
-}
-function redirectRequest(target, request, headers, method) {
-  return new Request(target, {
-    method,
-    headers,
-    signal: request.signal,
-    redirect: request.redirect,
-    cache: request.cache,
-    credentials: request.credentials,
-    integrity: request.integrity,
-    keepalive: request.keepalive,
-    mode: request.mode,
-    referrer: request.referrer,
-    referrerPolicy: request.referrerPolicy
-  });
-}
-function buildPinnedLookup(addresses) {
-  return ((_hostname, options, cb) => {
-    if (options.all === false) {
-      const first = addresses[0];
-      cb(
-        null,
-        first.address,
-        first.family
-      );
-    } else {
-      cb(
-        null,
-        addresses
-      );
-    }
-  });
-}
-async function resolveAndValidate(url, opts) {
-  const resolver = opts?.resolver ?? defaultResolver;
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new SSRFError("invalid_url", `url is not a valid URL: ${url}`);
-  }
-  if (parsed.protocol !== "https:") {
-    throw new SSRFError("insecure_scheme", `url must be https; got ${parsed.protocol}`);
-  }
-  const host = parsed.hostname.toLowerCase();
-  if (host === "") {
-    throw new SSRFError("invalid_url", "url has no host");
-  }
-  if (HOSTNAME_DENYLIST_EXACT.has(host) || matchesExtraExact(host, opts?.extraHostnamesExact)) {
-    throw new SSRFError("private_address", `url host "${host}" is on the SSRF denylist`);
-  }
-  for (const suffix of HOSTNAME_DENYLIST_SUFFIX) {
-    if (host === suffix.slice(1) || host.endsWith(suffix)) {
-      throw new SSRFError(
-        "private_address",
-        `url host "${host}" matches denied suffix "${suffix}"`
-      );
-    }
-  }
-  if (opts?.extraHostnameSuffixes) {
-    for (const suffix of opts.extraHostnameSuffixes) {
-      const s = suffix.toLowerCase();
-      if (host === s.slice(1) || host.endsWith(s)) {
-        throw new SSRFError("private_address", `url host "${host}" matches denied suffix "${s}"`);
-      }
-    }
-  }
-  const stripped = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
-  if (isIPv4(stripped) || isIPv6(stripped)) {
-    if (isUnsafeAddress(stripped, opts)) {
-      throw new SSRFError(
-        "private_address",
-        `url host "${stripped}" is in a blocked address range`
-      );
-    }
-    return { kind: "literal", address: stripped, family: isIPv4(stripped) ? 4 : 6 };
-  }
-  let addresses;
-  try {
-    addresses = await resolver(host);
-  } catch (err) {
-    throw new SSRFError(
-      "dns_failed",
-      `url host "${host}" failed DNS resolution: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-  if (addresses.length === 0) {
-    throw new SSRFError("dns_failed", `url host "${host}" resolved to no addresses`);
-  }
-  for (const { address } of addresses) {
-    if (isUnsafeAddress(address, opts)) {
-      throw new SSRFError(
-        "private_address",
-        `url host "${host}" resolves to blocked address "${address}"`
-      );
-    }
-  }
-  const validated = addresses.map((a) => ({ address: a.address, family: a.family }));
-  const first = validated[0];
-  return { kind: "resolved", address: first.address, family: first.family, addresses: validated };
-}
-var HOSTNAME_DENYLIST_EXACT = /* @__PURE__ */ new Set([
-  "localhost",
-  "ip6-localhost",
-  "ip6-loopback",
-  "metadata.google.internal",
-  "metadata"
-]);
-var HOSTNAME_DENYLIST_SUFFIX = [".internal", ".local", ".localhost", ".lan"];
-async function defaultResolver(host) {
-  return lookup(host, { all: true });
-}
-function matchesExtraExact(host, extras) {
-  if (!extras) return false;
-  for (const entry of extras) {
-    if (entry.toLowerCase() === host) return true;
-  }
-  return false;
-}
-function isUnsafeAddress(address, opts) {
-  if (isIPv4(address)) {
-    if (isUnsafeIPv4(address)) return true;
-    return opts?.extraUnsafeIPv4?.(address) === true;
-  }
-  if (isIPv6(address)) {
-    if (isUnsafeIPv6(address)) return true;
-    return opts?.extraUnsafeIPv6?.(address) === true;
-  }
-  return true;
-}
-function isUnsafeIPv4(address) {
-  const parts = address.split(".").map(Number);
-  if (parts.length !== 4 || parts.some((p) => !Number.isFinite(p) || p < 0 || p > 255)) {
-    return true;
-  }
-  const [a, b, c] = parts;
-  if (a === 0) return true;
-  if (a === 10) return true;
-  if (a === 100 && b >= 64 && b <= 127) return true;
-  if (a === 127) return true;
-  if (a === 169 && b === 254) return true;
-  if (a === 172 && b >= 16 && b <= 31) return true;
-  if (a === 192 && b === 0 && (c === 0 || c === 2)) return true;
-  if (a === 192 && b === 168) return true;
-  if (a === 198 && (b === 18 || b === 19)) return true;
-  if (a >= 224 && a <= 239) return true;
-  if (a >= 240) return true;
-  return false;
-}
-function isUnsafeIPv6(address) {
-  const lower = address.toLowerCase();
-  if (lower === "::1") return true;
-  if (lower === "::") return true;
-  if (lower.startsWith("fe8") || lower.startsWith("fe9") || lower.startsWith("fea") || lower.startsWith("feb")) {
-    return true;
-  }
-  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
-  if (lower.startsWith("::ffff:")) {
-    const tail = lower.slice("::ffff:".length);
-    if (isIPv4(tail)) return isUnsafeIPv4(tail);
-    const m = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(tail);
-    if (m) {
-      const high = parseInt(m[1], 16);
-      const low = parseInt(m[2], 16);
-      const a = high >> 8 & 255;
-      const b = high & 255;
-      const c = low >> 8 & 255;
-      const d = low & 255;
-      return isUnsafeIPv4(`${a.toString()}.${b.toString()}.${c.toString()}.${d.toString()}`);
-    }
-  }
-  if (lower.startsWith("ff")) return true;
-  return false;
-}
-
 export {
   isZodSchema,
   RAIL_REFUNDABLE,
   DEFAULT_CREDIT_MIN,
   DEFAULT_CREDIT_MAX,
   DEFAULT_CREDIT_TTL_SECONDS,
-  envFlag,
   canonicalize,
   canonicaliseForSigning,
+  verifyCanonicalSignedRequest,
   SIGNED_REQUEST_AUTH_ID,
   SIGNED_REQUEST_STATEMENT_VERSION,
   signedRequestStatementHeader,
+  canonicalSignedRequestStatement,
   canonicalRequestPath,
   humanizeZodError,
   humanizeZodIssues,
   zodIssuesOf,
+  SIGNED_ENVELOPE_TYPES,
   SIGNED_ENVELOPE_FIELDS,
   SignedRequestError,
   createSignedRequestVerifier,
   signedRequestInput,
-  createDefaultReplayStore,
-  SSRFError,
-  assertSafeUrl,
-  createPinnedFetch
+  createDefaultReplayStore
 };