@indorania/contracts 0.1.0

package/dist/versions.js

@@ -0,0 +1,54 @@
+/**
+ * Dated API versions — the Stripe pattern (ECOSYSTEM d47(h): "platform API versioning").
+ *
+ * - The URL carries the major (`/v1`, architecture §10); the header `Indorania-Version: YYYY-MM-DD`
+ *   carries the dated version. Resolution: the header, else the caller's pinned version (an
+ *   organisation's or an integration's), else `400 version_required`.
+ * - Every organisation and every integration is pinned to one version. Webhooks reach a receiver
+ *   rendered in its pin.
+ * - A version is a **preview** until it is released — the founder publishes `@indorania/contracts`,
+ *   or a member first vendors its OpenAPI file (founder decision, PL-4, 2026-09-25). Until then it
+ *   may be corrected in place. Once released, it changes by addition only; anything else is a new
+ *   dated version whose `changes` translate between the two.
+ * - The handlers speak the latest version. Requests travel **up** through every change after the
+ *   caller's version, oldest first; responses and webhook payloads travel **down**, newest first.
+ */
+export const VERSION_HEADER = "indorania-version";
+export const VERSION_PATTERN = "^\\d{4}-\\d{2}-\\d{2}$";
+/** Oldest first. The last entry is the version the handlers speak. */
+export const VERSIONS = [
+    { id: "2026-09-25", status: "preview", changes: [] },
+];
+export function latestVersion(versions = VERSIONS) {
+    const last = versions.at(-1);
+    if (!last)
+        throw new Error("the version registry is empty");
+    return last;
+}
+export function findVersion(id, versions = VERSIONS) {
+    return versions.find((v) => v.id === id);
+}
+/** The changes between `from` (exclusive) and the latest version, oldest first. */
+function changesAfter(from, versions) {
+    const index = versions.findIndex((v) => v.id === from);
+    if (index < 0)
+        throw new Error(`unknown API version ${from}`);
+    return versions.slice(index + 1).flatMap((v) => v.changes);
+}
+/** A request body written for version `from`, translated up to the latest version. */
+export function translateRequest(from, operationId, body, versions = VERSIONS) {
+    return changesAfter(from, versions).reduce((b, change) => (change.up ? change.up(operationId, b) : b), body);
+}
+/** A response body from the latest version, translated down to version `to`. */
+export function translateResponse(to, operationId, status, body, versions = VERSIONS) {
+    return [...changesAfter(to, versions)]
+        .reverse()
+        .reduce((b, change) => (change.down ? change.down(operationId, status, b) : b), body);
+}
+/** A webhook payload's `data` from the latest version, translated down to the receiver's pin. */
+export function translateEvent(to, type, data, versions = VERSIONS) {
+    return [...changesAfter(to, versions)]
+        .reverse()
+        .reduce((d, change) => (change.downEvent ? change.downEvent(type, d) : d), data);
+}
+//# sourceMappingURL=versions.js.map

package/dist/versions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"versions.js","sourceRoot":"","sources":["../src/versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAuBH,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAExD,sEAAsE;AACtE,MAAM,CAAC,MAAM,QAAQ,GAA0B;IAC7C,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;CACrD,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,WAAkC,QAAQ;IACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU,EAAE,WAAkC,QAAQ;IAChF,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,mFAAmF;AACnF,SAAS,YAAY,CAAC,IAAY,EAAE,QAA+B;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IACvD,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,WAAmB,EACnB,IAAa,EACb,WAAkC,QAAQ;IAE1C,OAAO,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/G,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAC/B,EAAU,EACV,WAAmB,EACnB,MAAc,EACd,IAAa,EACb,WAAkC,QAAQ;IAE1C,OAAO,CAAC,GAAG,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;SACnC,OAAO,EAAE;SACT,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC1F,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAC5B,EAAU,EACV,IAAY,EACZ,IAAa,EACb,WAAkC,QAAQ;IAE1C,OAAO,CAAC,GAAG,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;SACnC,OAAO,EAAE;SACT,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AACrF,CAAC"}

package/dist/webhooks.d.ts

@@ -0,0 +1,55 @@
+/**
+ * `@indorania/contracts/webhooks` — the reference signer and verifier for webhooks in both
+ * directions: the platform's to an integration, and an integration's to the platform.
+ *
+ * Standard Webhooks 1.0.0, asymmetric scheme `v1a` (Ed25519):
+ * - headers `webhook-id`, `webhook-timestamp` (unix seconds), `webhook-signature`;
+ * - signed content `${id}.${timestamp}.${body}`, over the body's exact bytes;
+ * - `webhook-signature` is a space-separated list of `v1a,<base64 signature>` — two during a key
+ *   rotation — and a message verifies if any one verifies under any current key;
+ * - a timestamp more than 300 seconds from the receiver's clock is refused;
+ * - `webhook-id` is the idempotency key: a receiver processes each id once.
+ * Uses WebCrypto only, so it runs in Node 22, Deno, Bun, Workers and browsers.
+ */
+export declare const WEBHOOK_TOLERANCE_SEC = 300;
+/** The payload structure Standard Webhooks recommends. `data` is rendered in the receiver's pinned version. */
+export interface WebhookEvent<T = unknown> {
+    readonly type: string;
+    /** ISO 8601. */
+    readonly timestamp: string;
+    readonly data: T;
+}
+export interface WebhookHeaders {
+    readonly "webhook-id": string;
+    readonly "webhook-timestamp": string;
+    readonly "webhook-signature": string;
+}
+export type WebhookFailure = "missing-header" | "malformed-timestamp" | "timestamp-out-of-tolerance" | "no-valid-signature";
+export declare function signedContent(id: string, timestamp: string | number, body: string): string;
+/** An Ed25519 public key for verifying: a JWK (`{kty: "OKP", crv: "Ed25519", x}`), or the raw 32 bytes. */
+export declare function importVerifyKey(key: {
+    kty: "OKP";
+    crv: "Ed25519";
+    x: string;
+} | Uint8Array<ArrayBuffer>): Promise<CryptoKey>;
+/** Sign one message. Returns the `webhook-signature` header value. */
+export declare function signWebhook(input: {
+    id: string;
+    timestamp: number;
+    body: string;
+    privateKey: CryptoKey;
+}): Promise<string>;
+/** Verify one message against the sender's current public keys. */
+export declare function verifyWebhook(input: {
+    headers: Partial<WebhookHeaders>;
+    body: string;
+    keys: readonly CryptoKey[];
+    nowSec?: number;
+    toleranceSec?: number;
+}): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    reason: WebhookFailure;
+}>;
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAGzC,+GAA+G;AAC/G,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gBAAgB;IAChB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,qBAAqB,GAAG,4BAA4B,GAAG,oBAAoB,CAAC;AAoB5H,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED,2GAA2G;AAC3G,wBAAsB,eAAe,CAAC,GAAG,EAAE;IAAE,GAAG,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,SAAS,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAGlI;AAED,sEAAsE;AACtE,wBAAsB,WAAW,CAAC,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAIhI;AAED,mEAAmE;AACnE,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,SAAS,EAAE,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC,CAuBhE"}

package/dist/webhooks.js

@@ -0,0 +1,76 @@
+/**
+ * `@indorania/contracts/webhooks` — the reference signer and verifier for webhooks in both
+ * directions: the platform's to an integration, and an integration's to the platform.
+ *
+ * Standard Webhooks 1.0.0, asymmetric scheme `v1a` (Ed25519):
+ * - headers `webhook-id`, `webhook-timestamp` (unix seconds), `webhook-signature`;
+ * - signed content `${id}.${timestamp}.${body}`, over the body's exact bytes;
+ * - `webhook-signature` is a space-separated list of `v1a,<base64 signature>` — two during a key
+ *   rotation — and a message verifies if any one verifies under any current key;
+ * - a timestamp more than 300 seconds from the receiver's clock is refused;
+ * - `webhook-id` is the idempotency key: a receiver processes each id once.
+ * Uses WebCrypto only, so it runs in Node 22, Deno, Bun, Workers and browsers.
+ */
+export const WEBHOOK_TOLERANCE_SEC = 300;
+const SCHEME = "v1a";
+const encoder = new TextEncoder();
+const VERIFY = ["verify"];
+function toBase64(bytes) {
+    let binary = "";
+    for (const b of bytes)
+        binary += String.fromCharCode(b);
+    return btoa(binary);
+}
+function fromBase64(text) {
+    try {
+        const binary = atob(text.replace(/-/g, "+").replace(/_/g, "/"));
+        return Uint8Array.from(binary, (c) => c.charCodeAt(0));
+    }
+    catch {
+        return null;
+    }
+}
+export function signedContent(id, timestamp, body) {
+    return `${id}.${timestamp}.${body}`;
+}
+/** An Ed25519 public key for verifying: a JWK (`{kty: "OKP", crv: "Ed25519", x}`), or the raw 32 bytes. */
+export async function importVerifyKey(key) {
+    if (key instanceof Uint8Array)
+        return crypto.subtle.importKey("raw", key, { name: "Ed25519" }, false, VERIFY);
+    return crypto.subtle.importKey("jwk", { kty: key.kty, crv: key.crv, x: key.x }, { name: "Ed25519" }, false, VERIFY);
+}
+/** Sign one message. Returns the `webhook-signature` header value. */
+export async function signWebhook(input) {
+    const content = encoder.encode(signedContent(input.id, input.timestamp, input.body));
+    const signature = new Uint8Array(await crypto.subtle.sign({ name: "Ed25519" }, input.privateKey, content));
+    return `${SCHEME},${toBase64(signature)}`;
+}
+/** Verify one message against the sender's current public keys. */
+export async function verifyWebhook(input) {
+    const id = input.headers["webhook-id"];
+    const timestamp = input.headers["webhook-timestamp"];
+    const header = input.headers["webhook-signature"];
+    if (!id || !timestamp || !header)
+        return { ok: false, reason: "missing-header" };
+    if (!/^\d{1,12}$/.test(timestamp))
+        return { ok: false, reason: "malformed-timestamp" };
+    const now = input.nowSec ?? Math.floor(Date.now() / 1000);
+    if (Math.abs(now - Number(timestamp)) > (input.toleranceSec ?? WEBHOOK_TOLERANCE_SEC)) {
+        return { ok: false, reason: "timestamp-out-of-tolerance" };
+    }
+    const content = encoder.encode(signedContent(id, timestamp, input.body));
+    for (const entry of header.split(" ")) {
+        const [scheme, value] = entry.split(",", 2);
+        if (scheme !== SCHEME || !value)
+            continue;
+        const signature = fromBase64(value);
+        if (!signature || signature.length !== 64)
+            continue;
+        for (const key of input.keys) {
+            if (await crypto.subtle.verify({ name: "Ed25519" }, key, signature, content))
+                return { ok: true };
+        }
+    }
+    return { ok: false, reason: "no-valid-signature" };
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AACzC,MAAM,MAAM,GAAG,KAAK,CAAC;AAkBrB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,MAAM,GAAe,CAAC,QAAQ,CAAC,CAAC;AAEtC,SAAS,QAAQ,CAAC,KAAiB;IACjC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAU,EAAE,SAA0B,EAAE,IAAY;IAChF,OAAO,GAAG,EAAE,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAwE;IAC5G,IAAI,GAAG,YAAY,UAAU;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9G,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AACtH,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAA6E;IAC7G,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3G,OAAO,GAAG,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAMnC;IACC,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClD,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAEvF,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,qBAAqB,CAAC,EAAE,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK;YAAE,SAAS;QAC1C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;YAAE,SAAS;QACpD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACpG,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;AACrD,CAAC"}

package/dist/zod.d.ts

@@ -0,0 +1,3 @@
+import { z } from "zod";
+export { z };
+//# sourceMappingURL=zod.d.ts.map

package/dist/zod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod.d.ts","sourceRoot":"","sources":["../src/zod.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,CAAC,EAAE,CAAC"}

package/dist/zod.js

@@ -0,0 +1,7 @@
+// One Zod instance for the whole contract, extended once so `.openapi()` is available to the
+// generator. Every module imports `z` from here, never from "zod" directly.
+import { extendZodWithOpenApi } from "@asteasolutions/zod-to-openapi";
+import { z } from "zod";
+extendZodWithOpenApi(z);
+export { z };
+//# sourceMappingURL=zod.js.map

package/dist/zod.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod.js","sourceRoot":"","sources":["../src/zod.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,4EAA4E;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oBAAoB,CAAC,CAAC,CAAC,CAAC;AAExB,OAAO,EAAE,CAAC,EAAE,CAAC"}

package/node/kernel-esm.mjs

@@ -0,0 +1,27 @@
+// A Node resolve hook for one defect in the published kernel, and nothing else.
+//
+// @kashscript/attest (0.1.8 and 0.2.0-alpha.1) and @kashscript/identity-core (0.3.1) ship
+// ES modules whose relative imports carry no extension ("./constants"). Bundlers accept that;
+// Node's own resolver refuses it with ERR_MODULE_NOT_FOUND, so no library entry of the kernel
+// loads under plain Node (the attest CLI works only because it is bundled). Verified 2026-09-25.
+//
+// This hook retries a failed relative import (a missing extension, or a bare directory such as identity-server's "./witness") made *from inside an @kashscript package* with
+// ".js", then "/index.js". Every other import resolves exactly as Node resolves it. Delete this
+// file, and the --import flags that load it, once KashScript republishes with ".js" specifiers.
+
+export async function resolve(specifier, context, nextResolve) {
+  try {
+    return await nextResolve(specifier, context);
+  } catch (error) {
+    const fromKernel = context.parentURL?.includes("/node_modules/@kashscript/") ?? false;
+    if ((error?.code !== "ERR_MODULE_NOT_FOUND" && error?.code !== "ERR_UNSUPPORTED_DIR_IMPORT") || !fromKernel || !specifier.startsWith(".")) throw error;
+    for (const suffix of [".js", "/index.js"]) {
+      try {
+        return await nextResolve(specifier + suffix, context);
+      } catch {
+        // try the next form
+      }
+    }
+    throw error;
+  }
+}

package/node/register.mjs

@@ -0,0 +1,5 @@
+// Load with `node --import @indorania/contracts/node/register` (or a relative path inside this
+// package). It registers kernel-esm.mjs — see that file for why, and for when to delete both.
+import { register } from "node:module";
+
+register("./kernel-esm.mjs", import.meta.url);