@kya-os/checkpoint-wasm-runtime 1.0.0

package/dist/orchestrator-edge.js

@@ -0,0 +1,1076 @@
+'use strict';
+
+var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// wasm/kya-os-engine-web/kya_os_engine.js
+var kya_os_engine_exports = {};
+__export(kya_os_engine_exports, {
+  default: () => kya_os_engine_default,
+  initSync: () => initSync,
+  verify: () => verify
+});
+function getUint8ArrayMemory0() {
+  if (cachedUint8ArrayMemory0 === null || cachedUint8ArrayMemory0.byteLength === 0) {
+    cachedUint8ArrayMemory0 = new Uint8Array(wasm.memory.buffer);
+  }
+  return cachedUint8ArrayMemory0;
+}
+function decodeText(ptr, len) {
+  numBytesDecoded += len;
+  if (numBytesDecoded >= MAX_SAFARI_DECODE_BYTES) {
+    cachedTextDecoder = new TextDecoder("utf-8", { ignoreBOM: true, fatal: true });
+    cachedTextDecoder.decode();
+    numBytesDecoded = len;
+  }
+  return cachedTextDecoder.decode(getUint8ArrayMemory0().subarray(ptr, ptr + len));
+}
+function getStringFromWasm0(ptr, len) {
+  ptr = ptr >>> 0;
+  return decodeText(ptr, len);
+}
+function addHeapObject(obj) {
+  if (heap_next === heap.length) heap.push(heap.length + 1);
+  const idx = heap_next;
+  heap_next = heap[idx];
+  heap[idx] = obj;
+  return idx;
+}
+function getObject(idx) {
+  return heap[idx];
+}
+function passStringToWasm0(arg, malloc, realloc) {
+  if (realloc === void 0) {
+    const buf = cachedTextEncoder.encode(arg);
+    const ptr2 = malloc(buf.length, 1) >>> 0;
+    getUint8ArrayMemory0().subarray(ptr2, ptr2 + buf.length).set(buf);
+    WASM_VECTOR_LEN = buf.length;
+    return ptr2;
+  }
+  let len = arg.length;
+  let ptr = malloc(len, 1) >>> 0;
+  const mem = getUint8ArrayMemory0();
+  let offset = 0;
+  for (; offset < len; offset++) {
+    const code = arg.charCodeAt(offset);
+    if (code > 127) break;
+    mem[ptr + offset] = code;
+  }
+  if (offset !== len) {
+    if (offset !== 0) {
+      arg = arg.slice(offset);
+    }
+    ptr = realloc(ptr, len, len = offset + arg.length * 3, 1) >>> 0;
+    const view = getUint8ArrayMemory0().subarray(ptr + offset, ptr + len);
+    const ret = cachedTextEncoder.encodeInto(arg, view);
+    offset += ret.written;
+    ptr = realloc(ptr, len, offset, 1) >>> 0;
+  }
+  WASM_VECTOR_LEN = offset;
+  return ptr;
+}
+function getDataViewMemory0() {
+  if (cachedDataViewMemory0 === null || cachedDataViewMemory0.buffer.detached === true || cachedDataViewMemory0.buffer.detached === void 0 && cachedDataViewMemory0.buffer !== wasm.memory.buffer) {
+    cachedDataViewMemory0 = new DataView(wasm.memory.buffer);
+  }
+  return cachedDataViewMemory0;
+}
+function isLikeNone(x) {
+  return x === void 0 || x === null;
+}
+function debugString(val) {
+  const type = typeof val;
+  if (type == "number" || type == "boolean" || val == null) {
+    return `${val}`;
+  }
+  if (type == "string") {
+    return `"${val}"`;
+  }
+  if (type == "symbol") {
+    const description = val.description;
+    if (description == null) {
+      return "Symbol";
+    } else {
+      return `Symbol(${description})`;
+    }
+  }
+  if (type == "function") {
+    const name = val.name;
+    if (typeof name == "string" && name.length > 0) {
+      return `Function(${name})`;
+    } else {
+      return "Function";
+    }
+  }
+  if (Array.isArray(val)) {
+    const length = val.length;
+    let debug = "[";
+    if (length > 0) {
+      debug += debugString(val[0]);
+    }
+    for (let i = 1; i < length; i++) {
+      debug += ", " + debugString(val[i]);
+    }
+    debug += "]";
+    return debug;
+  }
+  const builtInMatches = /\[object ([^\]]+)\]/.exec(toString.call(val));
+  let className;
+  if (builtInMatches && builtInMatches.length > 1) {
+    className = builtInMatches[1];
+  } else {
+    return toString.call(val);
+  }
+  if (className == "Object") {
+    try {
+      return "Object(" + JSON.stringify(val) + ")";
+    } catch (_) {
+      return "Object";
+    }
+  }
+  if (val instanceof Error) {
+    return `${val.name}: ${val.message}
+${val.stack}`;
+  }
+  return className;
+}
+function handleError(f, args) {
+  try {
+    return f.apply(this, args);
+  } catch (e) {
+    wasm.__wbindgen_export3(addHeapObject(e));
+  }
+}
+function getArrayU8FromWasm0(ptr, len) {
+  ptr = ptr >>> 0;
+  return getUint8ArrayMemory0().subarray(ptr / 1, ptr / 1 + len);
+}
+function dropObject(idx) {
+  if (idx < 132) return;
+  heap[idx] = heap_next;
+  heap_next = idx;
+}
+function takeObject(idx) {
+  const ret = getObject(idx);
+  dropObject(idx);
+  return ret;
+}
+function verify(input_js, ctx_js) {
+  try {
+    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+    wasm.verify(retptr, addHeapObject(input_js), addHeapObject(ctx_js));
+    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+    var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+    if (r2) {
+      throw takeObject(r1);
+    }
+    return takeObject(r0);
+  } finally {
+    wasm.__wbindgen_add_to_stack_pointer(16);
+  }
+}
+async function __wbg_load(module, imports) {
+  if (typeof Response === "function" && module instanceof Response) {
+    if (typeof WebAssembly.instantiateStreaming === "function") {
+      try {
+        return await WebAssembly.instantiateStreaming(module, imports);
+      } catch (e) {
+        const validResponse = module.ok && EXPECTED_RESPONSE_TYPES.has(module.type);
+        if (validResponse && module.headers.get("Content-Type") !== "application/wasm") {
+          console.warn("`WebAssembly.instantiateStreaming` failed because your server does not serve Wasm with `application/wasm` MIME type. Falling back to `WebAssembly.instantiate` which is slower. Original error:\n", e);
+        } else {
+          throw e;
+        }
+      }
+    }
+    const bytes = await module.arrayBuffer();
+    return await WebAssembly.instantiate(bytes, imports);
+  } else {
+    const instance = await WebAssembly.instantiate(module, imports);
+    if (instance instanceof WebAssembly.Instance) {
+      return { instance, module };
+    } else {
+      return instance;
+    }
+  }
+}
+function __wbg_get_imports() {
+  const imports = {};
+  imports.wbg = {};
+  imports.wbg.__wbg_Error_e83987f665cf5504 = function(arg0, arg1) {
+    const ret = Error(getStringFromWasm0(arg0, arg1));
+    return addHeapObject(ret);
+  };
+  imports.wbg.__wbg_Number_bb48ca12f395cd08 = function(arg0) {
+    const ret = Number(getObject(arg0));
+    return ret;
+  };
+  imports.wbg.__wbg_String_8f0eb39a4a4c2f66 = function(arg0, arg1) {
+    const ret = String(getObject(arg1));
+    const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    const len1 = WASM_VECTOR_LEN;
+    getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
+    getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
+  };
+  imports.wbg.__wbg___wbindgen_bigint_get_as_i64_f3ebc5a755000afd = function(arg0, arg1) {
+    const v = getObject(arg1);
+    const ret = typeof v === "bigint" ? v : void 0;
+    getDataViewMemory0().setBigInt64(arg0 + 8 * 1, isLikeNone(ret) ? BigInt(0) : ret, true);
+    getDataViewMemory0().setInt32(arg0 + 4 * 0, !isLikeNone(ret), true);
+  };
+  imports.wbg.__wbg___wbindgen_boolean_get_6d5a1ee65bab5f68 = function(arg0) {
+    const v = getObject(arg0);
+    const ret = typeof v === "boolean" ? v : void 0;
+    return isLikeNone(ret) ? 16777215 : ret ? 1 : 0;
+  };
+  imports.wbg.__wbg___wbindgen_debug_string_df47ffb5e35e6763 = function(arg0, arg1) {
+    const ret = debugString(getObject(arg1));
+    const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    const len1 = WASM_VECTOR_LEN;
+    getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
+    getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
+  };
+  imports.wbg.__wbg___wbindgen_in_bb933bd9e1b3bc0f = function(arg0, arg1) {
+    const ret = getObject(arg0) in getObject(arg1);
+    return ret;
+  };
+  imports.wbg.__wbg___wbindgen_is_bigint_cb320707dcd35f0b = function(arg0) {
+    const ret = typeof getObject(arg0) === "bigint";
+    return ret;
+  };
+  imports.wbg.__wbg___wbindgen_is_function_ee8a6c5833c90377 = function(arg0) {
+    const ret = typeof getObject(arg0) === "function";
+    return ret;
+  };
+  imports.wbg.__wbg___wbindgen_is_object_c818261d21f283a4 = function(arg0) {
+    const val = getObject(arg0);
+    const ret = typeof val === "object" && val !== null;
+    return ret;
+  };
+  imports.wbg.__wbg___wbindgen_is_string_fbb76cb2940daafd = function(arg0) {
+    const ret = typeof getObject(arg0) === "string";
+    return ret;
+  };
+  imports.wbg.__wbg___wbindgen_is_undefined_2d472862bd29a478 = function(arg0) {
+    const ret = getObject(arg0) === void 0;
+    return ret;
+  };
+  imports.wbg.__wbg___wbindgen_jsval_eq_6b13ab83478b1c50 = function(arg0, arg1) {
+    const ret = getObject(arg0) === getObject(arg1);
+    return ret;
+  };
+  imports.wbg.__wbg___wbindgen_jsval_loose_eq_b664b38a2f582147 = function(arg0, arg1) {
+    const ret = getObject(arg0) == getObject(arg1);
+    return ret;
+  };
+  imports.wbg.__wbg___wbindgen_number_get_a20bf9b85341449d = function(arg0, arg1) {
+    const obj = getObject(arg1);
+    const ret = typeof obj === "number" ? obj : void 0;
+    getDataViewMemory0().setFloat64(arg0 + 8 * 1, isLikeNone(ret) ? 0 : ret, true);
+    getDataViewMemory0().setInt32(arg0 + 4 * 0, !isLikeNone(ret), true);
+  };
+  imports.wbg.__wbg___wbindgen_string_get_e4f06c90489ad01b = function(arg0, arg1) {
+    const obj = getObject(arg1);
+    const ret = typeof obj === "string" ? obj : void 0;
+    var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+    var len1 = WASM_VECTOR_LEN;
+    getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
+    getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
+  };
+  imports.wbg.__wbg___wbindgen_throw_b855445ff6a94295 = function(arg0, arg1) {
+    throw new Error(getStringFromWasm0(arg0, arg1));
+  };
+  imports.wbg.__wbg_call_e762c39fa8ea36bf = function() {
+    return handleError(function(arg0, arg1) {
+      const ret = getObject(arg0).call(getObject(arg1));
+      return addHeapObject(ret);
+    }, arguments);
+  };
+  imports.wbg.__wbg_done_2042aa2670fb1db1 = function(arg0) {
+    const ret = getObject(arg0).done;
+    return ret;
+  };
+  imports.wbg.__wbg_entries_e171b586f8f6bdbf = function(arg0) {
+    const ret = Object.entries(getObject(arg0));
+    return addHeapObject(ret);
+  };
+  imports.wbg.__wbg_get_7bed016f185add81 = function(arg0, arg1) {
+    const ret = getObject(arg0)[arg1 >>> 0];
+    return addHeapObject(ret);
+  };
+  imports.wbg.__wbg_get_efcb449f58ec27c2 = function() {
+    return handleError(function(arg0, arg1) {
+      const ret = Reflect.get(getObject(arg0), getObject(arg1));
+      return addHeapObject(ret);
+    }, arguments);
+  };
+  imports.wbg.__wbg_get_with_ref_key_1dc361bd10053bfe = function(arg0, arg1) {
+    const ret = getObject(arg0)[getObject(arg1)];
+    return addHeapObject(ret);
+  };
+  imports.wbg.__wbg_instanceof_ArrayBuffer_70beb1189ca63b38 = function(arg0) {
+    let result;
+    try {
+      result = getObject(arg0) instanceof ArrayBuffer;
+    } catch (_) {
+      result = false;
+    }
+    const ret = result;
+    return ret;
+  };
+  imports.wbg.__wbg_instanceof_Map_8579b5e2ab5437c7 = function(arg0) {
+    let result;
+    try {
+      result = getObject(arg0) instanceof Map;
+    } catch (_) {
+      result = false;
+    }
+    const ret = result;
+    return ret;
+  };
+  imports.wbg.__wbg_instanceof_Uint8Array_20c8e73002f7af98 = function(arg0) {
+    let result;
+    try {
+      result = getObject(arg0) instanceof Uint8Array;
+    } catch (_) {
+      result = false;
+    }
+    const ret = result;
+    return ret;
+  };
+  imports.wbg.__wbg_isArray_96e0af9891d0945d = function(arg0) {
+    const ret = Array.isArray(getObject(arg0));
+    return ret;
+  };
+  imports.wbg.__wbg_isSafeInteger_d216eda7911dde36 = function(arg0) {
+    const ret = Number.isSafeInteger(getObject(arg0));
+    return ret;
+  };
+  imports.wbg.__wbg_iterator_e5822695327a3c39 = function() {
+    const ret = Symbol.iterator;
+    return addHeapObject(ret);
+  };
+  imports.wbg.__wbg_length_69bca3cb64fc8748 = function(arg0) {
+    const ret = getObject(arg0).length;
+    return ret;
+  };
+  imports.wbg.__wbg_length_cdd215e10d9dd507 = function(arg0) {
+    const ret = getObject(arg0).length;
+    return ret;
+  };
+  imports.wbg.__wbg_new_1acc0b6eea89d040 = function() {
+    const ret = new Object();
+    return addHeapObject(ret);
+  };
+  imports.wbg.__wbg_new_5a79be3ab53b8aa5 = function(arg0) {
+    const ret = new Uint8Array(getObject(arg0));
+    return addHeapObject(ret);
+  };
+  imports.wbg.__wbg_new_68651c719dcda04e = function() {
+    const ret = /* @__PURE__ */ new Map();
+    return addHeapObject(ret);
+  };
+  imports.wbg.__wbg_new_e17d9f43105b08be = function() {
+    const ret = new Array();
+    return addHeapObject(ret);
+  };
+  imports.wbg.__wbg_next_020810e0ae8ebcb0 = function() {
+    return handleError(function(arg0) {
+      const ret = getObject(arg0).next();
+      return addHeapObject(ret);
+    }, arguments);
+  };
+  imports.wbg.__wbg_next_2c826fe5dfec6b6a = function(arg0) {
+    const ret = getObject(arg0).next;
+    return addHeapObject(ret);
+  };
+  imports.wbg.__wbg_prototypesetcall_2a6620b6922694b2 = function(arg0, arg1, arg2) {
+    Uint8Array.prototype.set.call(getArrayU8FromWasm0(arg0, arg1), getObject(arg2));
+  };
+  imports.wbg.__wbg_set_3f1d0b984ed272ed = function(arg0, arg1, arg2) {
+    getObject(arg0)[takeObject(arg1)] = takeObject(arg2);
+  };
+  imports.wbg.__wbg_set_907fb406c34a251d = function(arg0, arg1, arg2) {
+    const ret = getObject(arg0).set(getObject(arg1), getObject(arg2));
+    return addHeapObject(ret);
+  };
+  imports.wbg.__wbg_set_c213c871859d6500 = function(arg0, arg1, arg2) {
+    getObject(arg0)[arg1 >>> 0] = takeObject(arg2);
+  };
+  imports.wbg.__wbg_value_692627309814bb8c = function(arg0) {
+    const ret = getObject(arg0).value;
+    return addHeapObject(ret);
+  };
+  imports.wbg.__wbindgen_cast_2241b6af4c4b2941 = function(arg0, arg1) {
+    const ret = getStringFromWasm0(arg0, arg1);
+    return addHeapObject(ret);
+  };
+  imports.wbg.__wbindgen_cast_4625c577ab2ec9ee = function(arg0) {
+    const ret = BigInt.asUintN(64, arg0);
+    return addHeapObject(ret);
+  };
+  imports.wbg.__wbindgen_cast_9ae0607507abb057 = function(arg0) {
+    const ret = arg0;
+    return addHeapObject(ret);
+  };
+  imports.wbg.__wbindgen_cast_d6cd19b81560fd6e = function(arg0) {
+    const ret = arg0;
+    return addHeapObject(ret);
+  };
+  imports.wbg.__wbindgen_object_clone_ref = function(arg0) {
+    const ret = getObject(arg0);
+    return addHeapObject(ret);
+  };
+  imports.wbg.__wbindgen_object_drop_ref = function(arg0) {
+    takeObject(arg0);
+  };
+  return imports;
+}
+function __wbg_finalize_init(instance, module) {
+  wasm = instance.exports;
+  __wbg_init.__wbindgen_wasm_module = module;
+  cachedDataViewMemory0 = null;
+  cachedUint8ArrayMemory0 = null;
+  return wasm;
+}
+function initSync(module) {
+  if (wasm !== void 0) return wasm;
+  if (typeof module !== "undefined") {
+    if (Object.getPrototypeOf(module) === Object.prototype) {
+      ({ module } = module);
+    } else {
+      console.warn("using deprecated parameters for `initSync()`; pass a single object instead");
+    }
+  }
+  const imports = __wbg_get_imports();
+  if (!(module instanceof WebAssembly.Module)) {
+    module = new WebAssembly.Module(module);
+  }
+  const instance = new WebAssembly.Instance(module, imports);
+  return __wbg_finalize_init(instance, module);
+}
+async function __wbg_init(module_or_path) {
+  if (wasm !== void 0) return wasm;
+  if (typeof module_or_path !== "undefined") {
+    if (Object.getPrototypeOf(module_or_path) === Object.prototype) {
+      ({ module_or_path } = module_or_path);
+    } else {
+      console.warn("using deprecated parameters for the initialization function; pass a single object instead");
+    }
+  }
+  if (typeof module_or_path === "undefined") {
+    module_or_path = new URL("kya_os_engine_bg.wasm", (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('orchestrator-edge.js', document.baseURI).href)));
+  }
+  const imports = __wbg_get_imports();
+  if (typeof module_or_path === "string" || typeof Request === "function" && module_or_path instanceof Request || typeof URL === "function" && module_or_path instanceof URL) {
+    module_or_path = fetch(module_or_path);
+  }
+  const { instance, module } = await __wbg_load(await module_or_path, imports);
+  return __wbg_finalize_init(instance, module);
+}
+var wasm, cachedUint8ArrayMemory0, cachedTextDecoder, MAX_SAFARI_DECODE_BYTES, numBytesDecoded, heap, heap_next, WASM_VECTOR_LEN, cachedTextEncoder, cachedDataViewMemory0, EXPECTED_RESPONSE_TYPES, kya_os_engine_default;
+var init_kya_os_engine = __esm({
+  "wasm/kya-os-engine-web/kya_os_engine.js"() {
+    cachedUint8ArrayMemory0 = null;
+    cachedTextDecoder = new TextDecoder("utf-8", { ignoreBOM: true, fatal: true });
+    cachedTextDecoder.decode();
+    MAX_SAFARI_DECODE_BYTES = 2146435072;
+    numBytesDecoded = 0;
+    heap = new Array(128).fill(void 0);
+    heap.push(void 0, null, true, false);
+    heap_next = heap.length;
+    WASM_VECTOR_LEN = 0;
+    cachedTextEncoder = new TextEncoder();
+    if (!("encodeInto" in cachedTextEncoder)) {
+      cachedTextEncoder.encodeInto = function(arg, view) {
+        const buf = cachedTextEncoder.encode(arg);
+        view.set(buf);
+        return {
+          read: arg.length,
+          written: buf.length
+        };
+      };
+    }
+    cachedDataViewMemory0 = null;
+    EXPECTED_RESPONSE_TYPES = /* @__PURE__ */ new Set(["basic", "cors", "default"]);
+    kya_os_engine_default = __wbg_init;
+  }
+});
+
+// src/engine/adapters/outbound-url-policy.ts
+var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "metadata", "metadata.google.internal"]);
+var UnsafeOutboundUrl = class extends Error {
+  kind = "UnsafeOutboundUrl";
+};
+function assertSafeHttpsUrl(rawUrl, label = "outbound URL") {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new UnsafeOutboundUrl(`${label} must be a valid URL: ${rawUrl}`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new UnsafeOutboundUrl(`${label} must use https: ${rawUrl}`);
+  }
+  if (parsed.username || parsed.password) {
+    throw new UnsafeOutboundUrl(`${label} must not contain credentials: ${rawUrl}`);
+  }
+  const hostname = normalizeHostname(parsed.hostname);
+  if (!hostname || isBlockedHostname(hostname)) {
+    throw new UnsafeOutboundUrl(`${label} targets a local or private host: ${rawUrl}`);
+  }
+  return rawUrl;
+}
+function normalizeHostname(hostname) {
+  let normalized = hostname.trim().toLowerCase();
+  if (normalized.startsWith("[") && normalized.endsWith("]")) {
+    normalized = normalized.slice(1, -1);
+  }
+  while (normalized.endsWith(".")) {
+    normalized = normalized.slice(0, -1);
+  }
+  return normalized;
+}
+function isBlockedHostname(hostname) {
+  if (BLOCKED_HOSTNAMES.has(hostname) || hostname.endsWith(".localhost")) {
+    return true;
+  }
+  const ipv4 = parseIpv4(hostname);
+  if (ipv4) {
+    return isBlockedIpv4(ipv4);
+  }
+  return isBlockedIpv6(hostname);
+}
+function parseIpv4(hostname) {
+  const parts = hostname.split(".");
+  if (parts.length !== 4) return null;
+  const octets = parts.map((part) => {
+    if (!/^\d{1,3}$/.test(part)) return Number.NaN;
+    const value = Number(part);
+    return value >= 0 && value <= 255 ? value : Number.NaN;
+  });
+  if (octets.some(Number.isNaN)) return null;
+  return octets;
+}
+function isBlockedIpv4([a, b]) {
+  return a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 198 && (b === 18 || b === 19) || a >= 224;
+}
+function isBlockedIpv6(hostname) {
+  if (!hostname.includes(":")) return false;
+  const ipv4Mapped = hostname.match(/(?:^|:)ffff:(\d{1,3}(?:\.\d{1,3}){3})$/);
+  if (ipv4Mapped) {
+    const ipv4 = parseIpv4(ipv4Mapped[1]);
+    return ipv4 ? isBlockedIpv4(ipv4) : true;
+  }
+  if (hostname === "::" || hostname === "::1" || hostname === "0:0:0:0:0:0:0:1") {
+    return true;
+  }
+  const firstSegment = Number.parseInt(hostname.split(":")[0] || "0", 16);
+  if (Number.isNaN(firstSegment)) return true;
+  return (firstSegment & 65024) === 64512 || // unique local fc00::/7
+  (firstSegment & 65472) === 65152 || // link-local fe80::/10
+  (firstSegment & 65280) === 65280;
+}
+
+// src/engine/edge.ts
+var initialised = null;
+function initEngineEdge(moduleOrPath) {
+  return ensureReady(moduleOrPath).then(() => void 0);
+}
+function ensureReady(moduleOrPath) {
+  if (initialised) return initialised;
+  const pending = (async () => {
+    const mod = await Promise.resolve().then(() => (init_kya_os_engine(), kya_os_engine_exports));
+    await mod.default(moduleOrPath !== void 0 ? { module_or_path: moduleOrPath } : void 0);
+    return mod.verify;
+  })();
+  initialised = pending;
+  pending.catch(() => {
+    if (initialised === pending) {
+      initialised = null;
+    }
+  });
+  return initialised;
+}
+async function engineVerifyEdge(input, ctx) {
+  const verify2 = await ensureReady();
+  return verify2(input, ctx);
+}
+
+// src/engine/adapters/util.ts
+function base64UrlDecode(input) {
+  const padded = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
+  return new Uint8Array(Buffer.from(padded + padding, "base64"));
+}
+
+// src/engine/orchestrator/build-agent-request.ts
+function buildAgentRequest(req, opts = {}) {
+  const mcpI = tryBuildMcpIFromBody(req);
+  if (mcpI) {
+    return { protocol: "McpI", request: mcpI };
+  }
+  if (opts.legacyEnvelopeFallback) {
+    const legacyMcpI = tryBuildMcpIFromLegacyHeader(req);
+    if (legacyMcpI) {
+      return { protocol: "McpI", request: legacyMcpI };
+    }
+  }
+  if (getHeader(req, "signature-input")) {
+    return { protocol: "HttpSigned", request: buildHttpSigned(req) };
+  }
+  return { protocol: "PlainHttp", request: buildPlainHttp(req) };
+}
+function hasMalformedJwsBody(req) {
+  const parsed = parseBodyAsObject(req.body);
+  if (!parsed || typeof parsed !== "object") return false;
+  const meta = parsed._meta;
+  if (!meta || typeof meta !== "object") return false;
+  const proof = meta.proof;
+  if (!proof || typeof proof !== "object") return false;
+  const jws = proof.jws;
+  if (typeof jws !== "string" || jws.length === 0) return false;
+  const raw = Array.from(Buffer.from(jws, "utf8"));
+  return parseJwsPayloadStruct(raw) === null;
+}
+function extractIssuer(request) {
+  if (request.protocol === "McpI") return request.request.payload.iss || null;
+  return null;
+}
+function extractAgentDid(request) {
+  if (request.protocol === "McpI") return request.request.payload.sub || null;
+  return null;
+}
+function extractCredentialStatusUrl(request) {
+  if (request.protocol !== "McpI") return null;
+  const raw = decodeJwsPayloadJson(request.request.raw);
+  if (!raw) return null;
+  const vc = raw.vc;
+  if (!vc || typeof vc !== "object") return null;
+  const credentialStatus = vc.credentialStatus;
+  if (!credentialStatus || typeof credentialStatus !== "object") return null;
+  const id = credentialStatus.id;
+  return typeof id === "string" ? id : null;
+}
+function tryBuildMcpIFromBody(req) {
+  const parsed = parseBodyAsObject(req.body);
+  if (!parsed) return null;
+  const meta = parsed._meta;
+  if (!meta || typeof meta !== "object") return null;
+  const proof = meta.proof;
+  if (!proof || typeof proof !== "object") return null;
+  const jws = proof.jws;
+  if (typeof jws !== "string" || jws.length === 0) return null;
+  const raw = Array.from(Buffer.from(jws, "utf8"));
+  const payload = parseJwsPayloadStruct(raw);
+  if (!payload) return null;
+  return { raw, payload };
+}
+function parseBodyAsObject(body) {
+  if (!body) return null;
+  if (Buffer.isBuffer(body)) {
+    try {
+      return JSON.parse(body.toString("utf8"));
+    } catch {
+      return null;
+    }
+  }
+  if (typeof body === "string") {
+    try {
+      return JSON.parse(body);
+    } catch {
+      return null;
+    }
+  }
+  if (typeof body === "object") return body;
+  return null;
+}
+function tryBuildMcpIFromLegacyHeader(req) {
+  const header = getHeader(req, "kya-delegation");
+  if (!header) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(header);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const obj = parsed;
+  const protectedSeg = obj.protected;
+  const payloadSeg = obj.payload;
+  const signatureSeg = obj.signature;
+  if (typeof protectedSeg !== "string" || typeof payloadSeg !== "string" || typeof signatureSeg !== "string") {
+    return null;
+  }
+  const compact = `${protectedSeg}.${payloadSeg}.${signatureSeg}`;
+  const raw = Array.from(Buffer.from(compact, "utf8"));
+  const payload = parseJwsPayloadStruct(raw);
+  if (!payload) return null;
+  return { raw, payload };
+}
+function parseJwsPayloadStruct(rawBytes) {
+  const json = decodeJwsPayloadJson(rawBytes);
+  if (!json || typeof json !== "object") return null;
+  return projectMcpIPayload(json);
+}
+function decodeJwsPayloadJson(rawBytes) {
+  const text = Buffer.from(rawBytes).toString("utf8");
+  const segments = text.split(".");
+  if (segments.length !== 3) return null;
+  let decoded;
+  try {
+    decoded = base64UrlDecode(segments[1]);
+  } catch {
+    return null;
+  }
+  try {
+    return JSON.parse(Buffer.from(decoded).toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+function projectMcpIPayload(raw) {
+  const aud = raw.aud;
+  const iss = raw.iss;
+  const sub = raw.sub;
+  const nonce = raw.nonce;
+  const sessionId = raw.sessionId;
+  const ts = raw.ts;
+  const requestHash = raw.requestHash;
+  const responseHash = raw.responseHash;
+  if (typeof aud !== "string" || typeof iss !== "string" || typeof sub !== "string" || typeof nonce !== "string" || typeof sessionId !== "string" || typeof ts !== "number" || typeof requestHash !== "string" || typeof responseHash !== "string") {
+    return null;
+  }
+  return { aud, iss, sub, nonce, sessionId, ts, requestHash, responseHash };
+}
+function buildHttpSigned(req) {
+  return {
+    raw: bodyAsBytes(req.body),
+    method: req.method,
+    path: req.url,
+    headers: flattenHeaders(req.headers)
+  };
+}
+function buildPlainHttp(req) {
+  return {
+    raw: bodyAsBytes(req.body),
+    method: req.method,
+    path: req.url,
+    headers: flattenHeaders(req.headers),
+    userAgent: getHeader(req, "user-agent") ?? null,
+    remoteIp: req.remoteAddress ?? null
+  };
+}
+function getHeader(req, name) {
+  const lowered = name.toLowerCase();
+  for (const [key, value] of Object.entries(req.headers)) {
+    if (key.toLowerCase() !== lowered) continue;
+    if (Array.isArray(value)) return value[0] ?? null;
+    if (typeof value === "string") return value;
+  }
+  return null;
+}
+function flattenHeaders(headers) {
+  const out = [];
+  for (const [key, value] of Object.entries(headers)) {
+    if (value === void 0) continue;
+    if (Array.isArray(value)) {
+      for (const v of value) out.push([key, v]);
+    } else {
+      out.push([key, value]);
+    }
+  }
+  return out;
+}
+function bodyAsBytes(body) {
+  if (!body) return [];
+  if (Buffer.isBuffer(body)) return Array.from(body);
+  if (typeof body === "string") return Array.from(Buffer.from(body, "utf8"));
+  if (typeof body === "object") return Array.from(Buffer.from(JSON.stringify(body), "utf8"));
+  return [];
+}
+
+// src/engine/orchestrator/render-decision.ts
+function renderDecisionAsResponse(result) {
+  const baseHeaders = buildBaseHeaders(result);
+  if (result.enforcementMode === "observe") {
+    return {
+      status: null,
+      headers: {
+        ...baseHeaders,
+        "X-Checkpoint-Mode": "observe",
+        "X-Checkpoint-Would-Have-Been": result.decision.kind,
+        ...wouldHaveBeenReasonHeader(result)
+      }
+    };
+  }
+  switch (result.decision.kind) {
+    case "Permit":
+      return {
+        status: null,
+        headers: { ...baseHeaders, "X-Checkpoint-Decision": "permit" }
+      };
+    case "Block": {
+      const reason = result.decision.reason;
+      return {
+        status: httpStatusForBlockReason(reason),
+        headers: {
+          ...baseHeaders,
+          ...blockHeaders(reason),
+          "X-Checkpoint-Decision": "block",
+          "X-Checkpoint-Reason": reason.kind
+        },
+        body: blockResponseBody(reason)
+      };
+    }
+    case "Challenge": {
+      const params = result.decision.params;
+      return {
+        status: 401,
+        headers: {
+          ...baseHeaders,
+          "X-Checkpoint-Decision": "challenge",
+          "X-Checkpoint-Challenge": params.nonce
+        },
+        body: {
+          challenge: params
+        }
+      };
+    }
+    case "Redirect": {
+      const target = result.decision.target;
+      return {
+        status: 302,
+        headers: {
+          ...baseHeaders,
+          "X-Checkpoint-Decision": "redirect",
+          Location: target.url,
+          "X-Checkpoint-Redirect-Reason": target.reason
+        }
+      };
+    }
+    case "Instruct": {
+      const payload = result.decision.payload;
+      return {
+        status: 422,
+        headers: {
+          ...baseHeaders,
+          "X-Checkpoint-Decision": "instruct",
+          "Content-Type": "application/problem+json"
+        },
+        body: {
+          type: payload.problem,
+          title: payload.title,
+          suggestedActions: payload.suggestedActions
+        }
+      };
+    }
+  }
+}
+function buildBaseHeaders(result) {
+  const headers = {
+    "X-Checkpoint-Engine": result.engineInfo.name,
+    "X-Checkpoint-Engine-Version": result.engineInfo.version
+  };
+  if (result.engineInfo.rulesetHash) {
+    headers["X-Checkpoint-Ruleset-Hash"] = result.engineInfo.rulesetHash;
+  }
+  return headers;
+}
+function httpStatusForBlockReason(reason) {
+  switch (reason.kind) {
+    case "Unauthenticated":
+    case "Expired":
+      return 401;
+    case "ParseError":
+      return 400;
+    case "InvalidSignature":
+    case "Revoked":
+    case "OutOfScope":
+    case "LowReputation":
+    case "PolicyDenied":
+      return 403;
+  }
+}
+function blockHeaders(reason) {
+  if (reason.kind === "Unauthenticated") {
+    return { "WWW-Authenticate": 'KyaProof realm="checkpoint"' };
+  }
+  return {};
+}
+function blockResponseBody(reason) {
+  switch (reason.kind) {
+    case "Revoked":
+    case "InvalidSignature":
+    case "Unauthenticated":
+    case "Expired":
+      return { error: humanError(reason.kind), reason: reason.kind };
+    case "OutOfScope":
+      return {
+        error: "requested scope is not granted",
+        reason: "OutOfScope",
+        requested: reason.requested,
+        granted: reason.granted
+      };
+    case "LowReputation":
+      return {
+        error: "agent reputation below tenant threshold",
+        reason: "LowReputation",
+        score: reason.score,
+        threshold: reason.threshold
+      };
+    case "PolicyDenied":
+      return {
+        error: "tenant policy denied the request",
+        reason: "PolicyDenied",
+        detail: reason.detail
+      };
+    case "ParseError":
+      return {
+        error: "request envelope could not be parsed",
+        reason: "ParseError",
+        detail: reason.detail
+      };
+  }
+}
+function humanError(kind) {
+  switch (kind) {
+    case "Revoked":
+      return "credential has been revoked";
+    case "InvalidSignature":
+      return "request signature failed verification";
+    case "Unauthenticated":
+      return "authentication required";
+    case "Expired":
+      return "credential is expired";
+  }
+}
+function wouldHaveBeenReasonHeader(result) {
+  if (result.decision.kind === "Block") {
+    return { "X-Checkpoint-Would-Have-Been-Reason": result.decision.reason.kind };
+  }
+  return {};
+}
+
+// src/engine/orchestrator/verify-request-edge.ts
+var DEFAULT_REPUTATION_BASELINE = 1;
+function makeVerifyRequestEdge(opts) {
+  let argusWarningLogged = false;
+  const log = opts.logger ?? defaultLogger;
+  return async function verifyRequestEdge2(req) {
+    if (!argusWarningLogged && !opts.argusUrl) {
+      log(
+        '[Checkpoint] WARNING: Argus URL not configured; reputation will degrade to baseline 1.0 ("trust by default"). Set ARGUS_API_URL to enable.'
+      );
+      argusWarningLogged = true;
+    }
+    return verifyRequestEdge_internal(req, opts);
+  };
+}
+async function verifyRequestEdge(req, opts) {
+  return verifyRequestEdge_internal(req, opts);
+}
+async function verifyRequestEdge_internal(req, opts) {
+  if (hasMalformedJwsBody(req)) {
+    return blockWithParseError("malformed JWS body", opts.enforcementMode);
+  }
+  const agentRequest = buildAgentRequest(req, {
+    legacyEnvelopeFallback: opts.legacyEnvelopeFallback
+  });
+  const issuer = extractIssuer(agentRequest);
+  const agentDid = extractAgentDid(agentRequest);
+  const credentialStatusUrl = extractCredentialStatusUrl(agentRequest);
+  const baseline = opts.reputationBaseline ?? DEFAULT_REPUTATION_BASELINE;
+  const [didResult, statusResult, repResult] = await Promise.allSettled([
+    issuer ? opts.didResolver.resolve(issuer) : Promise.resolve(null),
+    credentialStatusUrl ? fetchCredentialStatus(credentialStatusUrl, opts.statusListCache) : Promise.resolve(null),
+    agentDid ? opts.reputationOracle.score(agentDid) : Promise.resolve(baseline)
+  ]);
+  if (didResult.status === "rejected") {
+    if (isDidResolverError(didResult.reason)) {
+      return blockWithParseError(
+        didResult.reason instanceof Error ? didResult.reason.message : String(didResult.reason),
+        opts.enforcementMode
+      );
+    }
+    throw didResult.reason;
+  }
+  if (statusResult.status === "rejected") {
+    if (statusResult.reason instanceof UnsafeOutboundUrl) {
+      return blockWithParseError(statusResult.reason.message, opts.enforcementMode);
+    }
+    throw statusResult.reason;
+  }
+  if (repResult.status === "rejected") {
+    throw repResult.reason;
+  }
+  const didDoc = didResult.value;
+  const revokedIndices = statusResult.value;
+  const repScore = repResult.value;
+  const tenantDecision = await opts.policyEvaluator.evaluate({
+    tenantHost: opts.tenantHost,
+    reputation: repScore
+  });
+  await initEngineEdge();
+  const ctx = {
+    didDocs: didDoc && issuer ? { [issuer]: didDoc } : {},
+    revoked: revokedIndices !== null && credentialStatusUrl ? { [credentialStatusUrl]: revokedIndices } : {},
+    reputation: agentDid ? { [agentDid]: repScore } : {},
+    tenantDecision,
+    nowUnix: opts.clock.nowUnix(),
+    enforcementMode: opts.enforcementMode
+  };
+  return engineVerifyEdge(agentRequest, ctx);
+}
+async function fetchCredentialStatus(credentialStatusUrl, statusListCache) {
+  assertSafeHttpsUrl(credentialStatusUrl, "credential status URL");
+  return statusListCache.fetch(credentialStatusUrl);
+}
+function isDidResolverError(err) {
+  if (!(err instanceof Error)) return false;
+  const kind = err.kind;
+  return kind === "DidNotFound" || kind === "DidResolverTimeout" || kind === "DidResolverError" || kind === "MalformedDid" || kind === "UnsupportedKeyType" || kind === "UnsupportedDidMethod";
+}
+function blockWithParseError(detail, enforcementMode) {
+  return {
+    decision: {
+      kind: "Block",
+      reason: {
+        kind: "ParseError",
+        detail
+      }
+    },
+    enforcementMode,
+    engineInfo: {
+      name: "checkpoint-engine-wasm",
+      version: "0.0.0-host-synth",
+      rulesetHash: "sha256:host-synthesized",
+      rulesetVersion: "0.0.0-host-synth",
+      extras: { synthesized: true }
+    }
+  };
+}
+function defaultLogger(msg) {
+  console.warn(msg);
+}
+
+exports.buildAgentRequest = buildAgentRequest;
+exports.extractAgentDid = extractAgentDid;
+exports.extractCredentialStatusUrl = extractCredentialStatusUrl;
+exports.extractIssuer = extractIssuer;
+exports.hasMalformedJwsBody = hasMalformedJwsBody;
+exports.initEngineEdge = initEngineEdge;
+exports.makeVerifyRequestEdge = makeVerifyRequestEdge;
+exports.renderDecisionAsResponse = renderDecisionAsResponse;
+exports.verifyRequestEdge = verifyRequestEdge;
+//# sourceMappingURL=orchestrator-edge.js.map
+//# sourceMappingURL=orchestrator-edge.js.map