@dvmkit/sdk 0.1.0-rc.2 → 0.1.0-rc.4

package/dist/chunk-66HGCPBU.js

@@ -0,0 +1,25 @@
+// src/lib/caller-loggers.ts
+var callerLoggers = buildNoopLoggers();
+function initCallerLoggers(nextLoggers) {
+  callerLoggers = nextLoggers;
+}
+function buildNoopLoggers() {
+  const noopLogger = {
+    // eslint-disable-next-line @typescript-eslint/no-empty-function -- standalone caller has no exporter
+    info() {
+    },
+    async span(_name, _attrs, fn) {
+      return fn();
+    }
+  };
+  return {
+    cashu: noopLogger,
+    lightning: noopLogger,
+    x402: noopLogger
+  };
+}
+
+export {
+  callerLoggers,
+  initCallerLoggers
+};

package/dist/{chunk-DCNT4PJS.js → chunk-AAJNGQMC.js}

@@ -1,28 +1,13 @@
+import {
+  DvmError
+} from "./chunk-F2L6KIMD.js";
 import {
   callerLoggers
-} from "./chunk-KXWROQGK.js";
+} from "./chunk-66HGCPBU.js";
 
 // src/lib/x402/constants.ts
 var X402_DEFAULT_FACILITATOR = "https://x402.org/facilitator";
 
-// src/lib/errors.ts
-var DvmError = class extends Error {
-  constructor(code, message, hint, data, display, proseSources) {
-    super(message);
-    this.code = code;
-    this.hint = hint;
-    this.data = data;
-    this.display = display;
-    this.proseSources = proseSources;
-    this.name = "DvmError";
-  }
-  code;
-  hint;
-  data;
-  display;
-  proseSources;
-};
-
 // src/lib/x402/networks.ts
 var X402_NETWORKS = [
   {
@@ -459,231 +444,13 @@ function isOptionalRecord(value) {
   return value === void 0 || value === null || isRecord(value);
 }
 
-// src/lib/credit-implicit.ts
-var IMPLICIT_CREDIT_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
-
-// src/lib/currency.ts
-import { existsSync, readFileSync, writeFileSync } from "fs";
-import { dirname } from "path";
-
-// src/defaults.ts
-import { homedir } from "os";
-import { join } from "path";
-var CONFIG_DIR = process.env.DVM_CONFIG_DIR ?? join(homedir(), ".dvm");
-var CONFIG_FILE = join(CONFIG_DIR, "config.json");
-var CONFIG_BACKUP_FILE = join(CONFIG_DIR, "config.json.bak");
-var CONFIG_AUDIT_FILE = join(CONFIG_DIR, "config-audit.jsonl");
-var CONFIG_PINNED_FILE = join(CONFIG_DIR, "config.json.pinned");
-var JOBS_FILE = join(CONFIG_DIR, "jobs.json");
-var REQUEST_INTENTS_DIR = join(CONFIG_DIR, "request-intents");
-var FAVORITES_FILE = join(CONFIG_DIR, "favorites.json");
-var MESSAGES_DIR = join(CONFIG_DIR, "messages");
-var RECEIPTS_FILE = join(CONFIG_DIR, "receipts.jsonl");
-var CREDITS_FILE = join(CONFIG_DIR, "credits.json");
-var X402_CHANNELS_FILE = join(CONFIG_DIR, "x402-channels.json");
-var TEMPO_CHANNELS_FILE = join(CONFIG_DIR, "tempo-channels.json");
-var FEEDBACK_NUDGES_FILE = join(CONFIG_DIR, "feedback-nudges.json");
-var RECOVERY_MNEMONIC_FILE = join(CONFIG_DIR, "recovery.mnemonic");
-var WALLET_FILE = join(CONFIG_DIR, "wallet.json");
-var AGENT_MNEMONIC_FILE = join(CONFIG_DIR, "wallet.mnemonic");
-var IDENTITIES_FILE = join(CONFIG_DIR, "identities.json");
-var PAIRINGS_DIR = join(CONFIG_DIR, "pairings");
-var BUDGET_FILE = join(CONFIG_DIR, "budget.json");
-var BTC_RATE_FILE = join(CONFIG_DIR, "btc-rate.json");
-var ADMIN_DIR = join(CONFIG_DIR, "admin");
-var PROXY_STATE_FILE = join(ADMIN_DIR, "proxy.json");
-var BUILDER_CONFIG_DIR = process.env.DVMKIT_CONFIG_DIR ?? join(homedir(), ".dvmkit");
-var BUILDER_FILE = join(BUILDER_CONFIG_DIR, "builder.json");
-var BUILDER_MNEMONIC_FILE = join(BUILDER_CONFIG_DIR, "recovery.mnemonic");
-var BUILDER_KEY_FILE = join(BUILDER_CONFIG_DIR, "builder.key");
-var MELT_PENDING_LOG_FILE = join(BUILDER_CONFIG_DIR, "melt-pending.log");
-var DRAIN_PARK_LOG_FILE = join(BUILDER_CONFIG_DIR, "drain-park.log");
-var DRAIN_HOLD_STATE_FILE = join(BUILDER_CONFIG_DIR, "drain-hold.json");
-var MELT_SUCCESS_FILE = join(BUILDER_CONFIG_DIR, "melt-success.json");
-
-// src/lib/config-dir.ts
-import { chmodSync, mkdirSync, statSync } from "fs";
-var CONFIG_DIR_MODE = 448;
-function ensureConfigDir() {
-  ensureConfigSubdir(CONFIG_DIR);
-}
-function ensureConfigSubdir(path) {
-  mkdirSync(path, { recursive: true, mode: CONFIG_DIR_MODE });
-}
-
-// src/lib/fx-coingecko.ts
-var COINGECKO_BTC_USD_URL = "https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd";
-var DEFAULT_TIMEOUT_MS = 5e3;
-var DEFAULT_USER_AGENT = "dvmkit-platform/1.0 (+https://dvmkit.com)";
-async function fetchCoinGeckoBtcUsd(opts) {
-  const body = await fetchCoinGeckoBody(opts, COINGECKO_BTC_USD_URL);
-  const btc = body.bitcoin?.usd;
-  if (!isPositiveNumber(btc)) {
-    throw new Error("coingecko response missing bitcoin.usd");
-  }
-  return { btc_usd: btc, as_of: (/* @__PURE__ */ new Date()).toISOString() };
-}
-async function fetchCoinGeckoBody(opts, defaultUrl) {
-  const url = opts?.url ?? defaultUrl;
-  const fetchImpl = opts?.fetchImpl ?? fetch;
-  const timeoutMs = opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const userAgent = opts?.userAgent ?? DEFAULT_USER_AGENT;
-  const res = await fetchImpl(url, {
-    headers: { "User-Agent": userAgent, Accept: "application/json" },
-    signal: AbortSignal.timeout(timeoutMs)
-  });
-  if (!res.ok) {
-    throw new Error(`coingecko returned HTTP ${res.status.toString()}`);
-  }
-  return await res.json();
-}
-function isPositiveNumber(v) {
-  return typeof v === "number" && Number.isFinite(v) && v > 0;
-}
-
-// src/lib/currency.ts
-function msatsToUsd(msats, rate) {
-  return msats / 1e11 * rate;
-}
-function usdToMsats(usd, rate) {
-  return Math.round(usd / rate * 1e11);
-}
-function msatsToUsdc(msats, btcUsdRate) {
-  const usd = msatsToUsd(msats, btcUsdRate);
-  return Math.ceil(usd * 1e6);
-}
-function usdcToMsats(usdc, btcUsdRate) {
-  return usdToMsats(usdc, btcUsdRate);
-}
-var COST_ANCHOR_BANDS = {
-  usd: [0.01, 0.1, 1, 10],
-  eur: [0.01, 0.1, 1, 10],
-  gbp: [0.01, 0.1, 1, 10],
-  jpy: [1, 10, 100, 1500]
-};
-function costAnchor(amount, currency = "usd") {
-  const bands = COST_ANCHOR_BANDS[currency] ?? COST_ANCHOR_BANDS.usd;
-  if (amount < bands[0]) return "fraction of a cent";
-  if (amount <= bands[1]) return "comparable to an API call";
-  if (amount <= bands[2]) return "comparable to a ChatGPT query";
-  if (amount <= bands[3]) return "comparable to a coffee";
-  return "significant purchase \u2014 review carefully";
-}
-function formatUsd(usd) {
-  if (usd === 0) return "0.00";
-  if (usd >= 0.01) return usd.toFixed(2);
-  const digits = Math.max(2, -Math.floor(Math.log10(usd)) + 1);
-  return usd.toFixed(digits);
-}
-async function fetchBtcUsdRate() {
-  if (memRate && Date.now() - memTime < CACHE_TTL) {
-    return memRate;
-  }
-  const disk = readDiskCache();
-  if (disk) {
-    memRate = disk;
-    memTime = Date.now();
-    return disk;
-  }
-  const rate = await fetchFromApi();
-  memRate = rate;
-  memTime = Date.now();
-  writeDiskCache(rate);
-  return rate;
-}
-function getLastKnownBtcRate() {
-  if (memRate && memTime > 0) return { rate: memRate, cachedAt: memTime };
-  return readDiskCacheStale();
-}
-function formatStaleness(cachedAt, now = Date.now()) {
-  const ageMs = Math.max(0, now - cachedAt);
-  const seconds = Math.floor(ageMs / 1e3);
-  if (seconds < 60) return `${seconds}s ago`;
-  const minutes = Math.floor(seconds / 60);
-  if (minutes < 60) return `${minutes} min ago`;
-  const hours = Math.floor(minutes / 60);
-  if (hours < 24) return `${hours} hour${hours === 1 ? "" : "s"} ago`;
-  const days = Math.floor(hours / 24);
-  return `${days} day${days === 1 ? "" : "s"} ago`;
-}
-var CACHE_TTL = 5 * 60 * 1e3;
-var CACHE_FILE = BTC_RATE_FILE;
-var memRate = null;
-var memTime = 0;
-function readDiskCache() {
-  try {
-    if (!existsSync(CACHE_FILE)) return null;
-    const data = JSON.parse(readFileSync(CACHE_FILE, "utf-8"));
-    if (Date.now() - data.timestamp >= CACHE_TTL) return null;
-    if (!isPlausibleBtcUsdRate(data.rate)) return null;
-    return data.rate;
-  } catch {
-    return null;
-  }
-}
-function readDiskCacheStale() {
-  try {
-    if (!existsSync(CACHE_FILE)) return null;
-    const data = JSON.parse(readFileSync(CACHE_FILE, "utf-8"));
-    if (!isPlausibleBtcUsdRate(data.rate)) return null;
-    return { rate: data.rate, cachedAt: data.timestamp };
-  } catch {
-    return null;
-  }
-}
-function writeDiskCache(rate) {
-  try {
-    ensureConfigSubdir(dirname(CACHE_FILE));
-    writeFileSync(CACHE_FILE, JSON.stringify({ rate, timestamp: Date.now() }));
-  } catch {
-  }
-}
-var MAX_PLAUSIBLE_BTC_USD = 1e7;
-function isPlausibleBtcUsdRate(rate) {
-  return typeof rate === "number" && Number.isFinite(rate) && rate > 0 && rate < MAX_PLAUSIBLE_BTC_USD;
-}
-async function fetchFromApi() {
-  const spot = await fetchCoinGeckoBtcUsd();
-  const rate = spot.btc_usd;
-  if (!isPlausibleBtcUsdRate(rate)) {
-    throw new Error(`implausible BTC/USD rate from upstream: ${String(rate)}`);
-  }
-  return rate;
-}
-
-// src/lib/payment-rails/rpc.ts
-function resolveRpcOverride(envValue, bundled) {
-  const override = envValue?.trim() ?? "";
-  return override.length > 0 ? { url: override, source: "override" } : { url: bundled, source: "bundled" };
-}
-function resolveRpcHttpTransportOptions(source, envValue) {
-  if (source !== "override" || !envValue?.trim()) return void 0;
-  let parsed;
-  try {
-    parsed = JSON.parse(envValue);
-  } catch {
-    throw new Error("RPC headers must be a JSON object of non-empty string values.");
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-    throw new Error("RPC headers must be a JSON object of non-empty string values.");
-  const headers = {};
-  for (const [name, value] of Object.entries(parsed)) {
-    if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name) || typeof value !== "string" || value.length === 0 || /[\r\n]/.test(value))
-      throw new Error("RPC headers must be a JSON object of non-empty string values.");
-    headers[name] = value;
-  }
-  if (Object.keys(headers).length === 0)
-    throw new Error("RPC headers must be a JSON object of non-empty string values.");
-  return { fetchOptions: { headers } };
-}
-
 export {
   X402_DEFAULT_FACILITATOR,
   createX402FacilitatorAuthHeaders,
   createX402FacilitatorClient,
-  DvmError,
   X402_NETWORKS,
   x402NetworkByCaip2,
+  x402NetworkBySlug,
   x402NetworkLabel,
   x402NetworkListForCopy,
   assertSupportedX402Network,
@@ -710,24 +477,5 @@ export {
   exactEvmAuthorization,
   encodeSettleResponseHeader,
   verifyWithFacilitator,
-  settleWithFacilitator,
-  IMPLICIT_CREDIT_TTL_MS,
-  CONFIG_FILE,
-  CONFIG_BACKUP_FILE,
-  CONFIG_AUDIT_FILE,
-  CONFIG_PINNED_FILE,
-  X402_CHANNELS_FILE,
-  WALLET_FILE,
-  AGENT_MNEMONIC_FILE,
-  ensureConfigDir,
-  msatsToUsd,
-  msatsToUsdc,
-  usdcToMsats,
-  costAnchor,
-  formatUsd,
-  fetchBtcUsdRate,
-  getLastKnownBtcRate,
-  formatStaleness,
-  resolveRpcOverride,
-  resolveRpcHttpTransportOptions
+  settleWithFacilitator
 };

package/dist/{chunk-KQAJVVZT.js → chunk-AZBXSXQT.js}

@@ -11,11 +11,6 @@ var DEFAULT_CREDIT_MIN = "$0.10";
 var DEFAULT_CREDIT_MAX = "$5.00";
 var DEFAULT_CREDIT_TTL_SECONDS = 30 * 24 * 60 * 60;
 
-// src/sdk/env.ts
-function envFlag(value) {
-  return value === "1" || value === "true";
-}
-
 // src/lib/cast-auth/canonical-json.ts
 function canonicalize(value) {
   return JSON.stringify(sortDeep(value));
@@ -47,6 +42,26 @@ function sortDeep(value) {
 
 // src/lib/cast-auth/verify.ts
 import { schnorr } from "@noble/curves/secp256k1.js";
+function verifyCanonicalSignedRequest(payload, signatureHex, pubkeyHex) {
+  if (!/^[0-9a-f]{64}$/i.test(pubkeyHex) || !/^[0-9a-f]{128}$/i.test(signatureHex)) {
+    return false;
+  }
+  const data = canonicaliseForSigning(payload);
+  const signature = hexToBytes(signatureHex);
+  const pubkey = hexToBytes(pubkeyHex);
+  try {
+    return schnorr.verify(signature, data, pubkey);
+  } catch {
+    return false;
+  }
+}
+function hexToBytes(hex) {
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
 
 // src/lib/signed-request-statement.ts
 var SIGNED_REQUEST_AUTH_ID = "secp256k1-schnorr-v2";
@@ -106,9 +121,6 @@ function canonicalRequestPath(pathOrUrl) {
   return parsed.pathname.startsWith("/") ? parsed.pathname : `/${parsed.pathname}`;
 }
 
-// src/sdk/server/signed-request.ts
-import { schnorr as schnorr2 } from "@noble/curves/secp256k1.js";
-
 // src/sdk/server/zod-error.ts
 function humanizeZodError(err, opts) {
   return humanizeZodIssues(err.issues, opts);
@@ -195,6 +207,7 @@ function pickHint(issues, schemaUrl) {
 }
 
 // src/sdk/server/signed-request.ts
+import { schnorr as schnorr2 } from "@noble/curves/secp256k1.js";
 var SIGNED_ENVELOPE_TYPES = {
   pubkey: "string",
   signature: "string",
@@ -357,12 +370,12 @@ function statementHeader(input) {
 }
 function verifyBytes(bytes, signatureHex, pubkeyHex) {
   try {
-    return schnorr2.verify(hexToBytes(signatureHex), bytes, hexToBytes(pubkeyHex));
+    return schnorr2.verify(hexToBytes2(signatureHex), bytes, hexToBytes2(pubkeyHex));
   } catch {
     return false;
   }
 }
-function hexToBytes(hex) {
+function hexToBytes2(hex) {
   const out = new Uint8Array(hex.length / 2);
   for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
   return out;
@@ -413,300 +426,27 @@ function createDefaultReplayStore() {
 }
 var SATURATION_WARN_INTERVAL_SECONDS = 60;
 
-// src/sdk/server/ssrf.ts
-import { lookup } from "dns/promises";
-import { isIPv4, isIPv6 } from "net";
-import { Agent } from "undici";
-var SSRFError = class extends Error {
-  code = "ssrf_blocked";
-  reason;
-  constructor(reason, message) {
-    super(message);
-    this.reason = reason;
-  }
-};
-async function assertSafeUrl(url, opts) {
-  await resolveAndValidate(url, opts);
-}
-async function createPinnedFetch(url, opts) {
-  const validated = await resolveAndValidate(url, opts);
-  const baseFetch = opts?.baseFetch ?? fetch;
-  const initialUrl = new URL(url);
-  const agents = [];
-  const targets = /* @__PURE__ */ new Map();
-  const createTarget = (next) => {
-    if (next.kind === "literal") return {};
-    const agent = new Agent({
-      connect: { lookup: buildPinnedLookup(next.addresses) }
-    });
-    agents.push(agent);
-    return { agent };
-  };
-  targets.set(initialUrl.origin, createTarget(validated));
-  const targetFor = async (requestUrl) => {
-    const parsed = new URL(requestUrl);
-    const existing = targets.get(parsed.origin);
-    if (existing) return existing;
-    const target = createTarget(await resolveAndValidate(parsed.href, opts));
-    targets.set(parsed.origin, target);
-    return target;
-  };
-  const pinnedFetch = async (input, init) => {
-    let request = new Request(input, init);
-    let redirects = 0;
-    for (; ; ) {
-      const target = await targetFor(request.url);
-      const response = await baseFetch(
-        request,
-        target.agent ? { redirect: "manual", dispatcher: target.agent } : { redirect: "manual" }
-      );
-      if (!isRedirect(response.status) || request.redirect === "manual") return response;
-      const location = response.headers.get("location");
-      if (location === null) return response;
-      await discardResponse(response);
-      if (request.redirect === "error") {
-        throw new TypeError("fetch failed: redirect mode is set to error");
-      }
-      if (redirects >= MAX_PINNED_REDIRECTS) {
-        throw new TypeError("fetch failed: maximum redirect count exceeded");
-      }
-      request = requestForRedirect(request, new URL(location, request.url), response.status);
-      redirects += 1;
-      opts?.onRedirectFollowed?.();
-    }
-  };
-  return {
-    fetch: pinnedFetch,
-    address: validated.address,
-    family: validated.family,
-    close: async () => {
-      await Promise.all(agents.map((agent) => agent.close()));
-    }
-  };
-}
-var MAX_PINNED_REDIRECTS = 20;
-function isRedirect(status) {
-  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
-}
-async function discardResponse(response) {
-  await response.body?.cancel().catch(() => void 0);
-}
-function requestForRedirect(request, target, status) {
-  const headers = new Headers(request.headers);
-  if (new URL(request.url).origin !== target.origin) {
-    headers.delete("authorization");
-    headers.delete("cookie");
-    headers.delete("proxy-authorization");
-    headers.delete("host");
-  }
-  const method = request.method.toUpperCase();
-  const switchToGet = status === 303 && method !== "HEAD" || (status === 301 || status === 302) && method === "POST";
-  if (switchToGet) {
-    headers.delete("content-length");
-    headers.delete("content-type");
-    return redirectRequest(target, request, headers, "GET");
-  }
-  if (method !== "GET" && method !== "HEAD") {
-    throw new TypeError("fetch failed: cannot safely replay a request body across this redirect");
-  }
-  return redirectRequest(target, request, headers, method);
-}
-function redirectRequest(target, request, headers, method) {
-  return new Request(target, {
-    method,
-    headers,
-    signal: request.signal,
-    redirect: request.redirect,
-    cache: request.cache,
-    credentials: request.credentials,
-    integrity: request.integrity,
-    keepalive: request.keepalive,
-    mode: request.mode,
-    referrer: request.referrer,
-    referrerPolicy: request.referrerPolicy
-  });
-}
-function buildPinnedLookup(addresses) {
-  return ((_hostname, options, cb) => {
-    if (options.all === false) {
-      const first = addresses[0];
-      cb(
-        null,
-        first.address,
-        first.family
-      );
-    } else {
-      cb(
-        null,
-        addresses
-      );
-    }
-  });
-}
-async function resolveAndValidate(url, opts) {
-  const resolver = opts?.resolver ?? defaultResolver;
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new SSRFError("invalid_url", `url is not a valid URL: ${url}`);
-  }
-  if (parsed.protocol !== "https:") {
-    throw new SSRFError("insecure_scheme", `url must be https; got ${parsed.protocol}`);
-  }
-  const host = parsed.hostname.toLowerCase();
-  if (host === "") {
-    throw new SSRFError("invalid_url", "url has no host");
-  }
-  if (HOSTNAME_DENYLIST_EXACT.has(host) || matchesExtraExact(host, opts?.extraHostnamesExact)) {
-    throw new SSRFError("private_address", `url host "${host}" is on the SSRF denylist`);
-  }
-  for (const suffix of HOSTNAME_DENYLIST_SUFFIX) {
-    if (host === suffix.slice(1) || host.endsWith(suffix)) {
-      throw new SSRFError(
-        "private_address",
-        `url host "${host}" matches denied suffix "${suffix}"`
-      );
-    }
-  }
-  if (opts?.extraHostnameSuffixes) {
-    for (const suffix of opts.extraHostnameSuffixes) {
-      const s = suffix.toLowerCase();
-      if (host === s.slice(1) || host.endsWith(s)) {
-        throw new SSRFError("private_address", `url host "${host}" matches denied suffix "${s}"`);
-      }
-    }
-  }
-  const stripped = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
-  if (isIPv4(stripped) || isIPv6(stripped)) {
-    if (isUnsafeAddress(stripped, opts)) {
-      throw new SSRFError(
-        "private_address",
-        `url host "${stripped}" is in a blocked address range`
-      );
-    }
-    return { kind: "literal", address: stripped, family: isIPv4(stripped) ? 4 : 6 };
-  }
-  let addresses;
-  try {
-    addresses = await resolver(host);
-  } catch (err) {
-    throw new SSRFError(
-      "dns_failed",
-      `url host "${host}" failed DNS resolution: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-  if (addresses.length === 0) {
-    throw new SSRFError("dns_failed", `url host "${host}" resolved to no addresses`);
-  }
-  for (const { address } of addresses) {
-    if (isUnsafeAddress(address, opts)) {
-      throw new SSRFError(
-        "private_address",
-        `url host "${host}" resolves to blocked address "${address}"`
-      );
-    }
-  }
-  const validated = addresses.map((a) => ({ address: a.address, family: a.family }));
-  const first = validated[0];
-  return { kind: "resolved", address: first.address, family: first.family, addresses: validated };
-}
-var HOSTNAME_DENYLIST_EXACT = /* @__PURE__ */ new Set([
-  "localhost",
-  "ip6-localhost",
-  "ip6-loopback",
-  "metadata.google.internal",
-  "metadata"
-]);
-var HOSTNAME_DENYLIST_SUFFIX = [".internal", ".local", ".localhost", ".lan"];
-async function defaultResolver(host) {
-  return lookup(host, { all: true });
-}
-function matchesExtraExact(host, extras) {
-  if (!extras) return false;
-  for (const entry of extras) {
-    if (entry.toLowerCase() === host) return true;
-  }
-  return false;
-}
-function isUnsafeAddress(address, opts) {
-  if (isIPv4(address)) {
-    if (isUnsafeIPv4(address)) return true;
-    return opts?.extraUnsafeIPv4?.(address) === true;
-  }
-  if (isIPv6(address)) {
-    if (isUnsafeIPv6(address)) return true;
-    return opts?.extraUnsafeIPv6?.(address) === true;
-  }
-  return true;
-}
-function isUnsafeIPv4(address) {
-  const parts = address.split(".").map(Number);
-  if (parts.length !== 4 || parts.some((p) => !Number.isFinite(p) || p < 0 || p > 255)) {
-    return true;
-  }
-  const [a, b, c] = parts;
-  if (a === 0) return true;
-  if (a === 10) return true;
-  if (a === 100 && b >= 64 && b <= 127) return true;
-  if (a === 127) return true;
-  if (a === 169 && b === 254) return true;
-  if (a === 172 && b >= 16 && b <= 31) return true;
-  if (a === 192 && b === 0 && (c === 0 || c === 2)) return true;
-  if (a === 192 && b === 168) return true;
-  if (a === 198 && (b === 18 || b === 19)) return true;
-  if (a >= 224 && a <= 239) return true;
-  if (a >= 240) return true;
-  return false;
-}
-function isUnsafeIPv6(address) {
-  const lower = address.toLowerCase();
-  if (lower === "::1") return true;
-  if (lower === "::") return true;
-  if (lower.startsWith("fe8") || lower.startsWith("fe9") || lower.startsWith("fea") || lower.startsWith("feb")) {
-    return true;
-  }
-  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
-  if (lower.startsWith("::ffff:")) {
-    const tail = lower.slice("::ffff:".length);
-    if (isIPv4(tail)) return isUnsafeIPv4(tail);
-    const m = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(tail);
-    if (m) {
-      const high = parseInt(m[1], 16);
-      const low = parseInt(m[2], 16);
-      const a = high >> 8 & 255;
-      const b = high & 255;
-      const c = low >> 8 & 255;
-      const d = low & 255;
-      return isUnsafeIPv4(`${a.toString()}.${b.toString()}.${c.toString()}.${d.toString()}`);
-    }
-  }
-  if (lower.startsWith("ff")) return true;
-  return false;
-}
-
 export {
   isZodSchema,
   RAIL_REFUNDABLE,
   DEFAULT_CREDIT_MIN,
   DEFAULT_CREDIT_MAX,
   DEFAULT_CREDIT_TTL_SECONDS,
-  envFlag,
   canonicalize,
   canonicaliseForSigning,
+  verifyCanonicalSignedRequest,
   SIGNED_REQUEST_AUTH_ID,
   SIGNED_REQUEST_STATEMENT_VERSION,
   signedRequestStatementHeader,
+  canonicalSignedRequestStatement,
   canonicalRequestPath,
   humanizeZodError,
   humanizeZodIssues,
   zodIssuesOf,
+  SIGNED_ENVELOPE_TYPES,
   SIGNED_ENVELOPE_FIELDS,
   SignedRequestError,
   createSignedRequestVerifier,
   signedRequestInput,
-  createDefaultReplayStore,
-  SSRFError,
-  assertSafeUrl,
-  createPinnedFetch
+  createDefaultReplayStore
 };