@kya-os/mcp 1.10.0 → 1.11.0

package/dist/session/manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/session/manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAuB,MAAM,cAAc,CAAC;AAOvE,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAgB,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAqC7C,MAAM,OAAO,cAAc;IACjB,MAAM,CAIZ;IACM,cAAc,CAAiB;IAC/B,YAAY,CAAe;IAEnC,YAAY,cAA8B,EAAE,SAAwB,EAAE;QACpE,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,YAAY;YACf,MAAM,CAAC,YAAY;gBACnB,IAAI,kBAAkB,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG;YACZ,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,IAAI,GAAG;YACxD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,EAAE;YACjD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,wBAAwB,EAAE;YAC/D,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,QAAQ;YACzC,GAAG,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,IAAI;gBAClD,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;aACxD,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;SACvE,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,YAAY,wBAAwB,EAAE,CAAC;YAC/D,MAAM,CAAC,IAAI,CACT,qEAAqE;gBACnE,oEAAoE;gBACpE,iBAAiB,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IACpC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAyB;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YAEnD,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBAChD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;wBACzC,OAAO,EAAE,wCAAwC,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI;wBACrF,WAAW,EAAE,6DAA6D,GAAG,eAAe,OAAO,CAAC,SAAS,WAAW,QAAQ,2CAA2C;qBAC5K;iBACF,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;wBACzC,OAAO,EAAE,+BAA+B,IAAI,CAAC,MAAM,CAAC,SAAS,SAAS,OAAO,CAAC,QAAQ,EAAE;qBACzF;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAClD,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,QAAQ,CACjB,CAAC;YACF,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;wBACzC,OAAO,EAAE,+CAA+C;wBACxD,WAAW,EAAE,8CAA8C;qBAC5D;iBACF,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;YACtC,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC;YACvE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;YACrD,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAC9B,OAAO,CAAC,KAAK,EACb,eAAe,EACf,OAAO,CAAC,QAAQ,CACjB,CAAC;YAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAEvD,MAAM,OAAO,GAAmB;gBAC9B,SAAS;gBACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,GAAG;gBACd,YAAY,EAAE,GAAG;gBACjB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;gBACzC,aAAa,EAAE,WAAW;gBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;gBAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAClE,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,CAAC;aAClC,CAAC;YAEF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAEhD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;oBACzC,OAAO,EAAE,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;iBACpG;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,eAAe,GAAG,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC;QACnD,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC;QAE/C,IAAI,eAAe,GAAG,cAAc,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,iBAAiB,GAAG,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;YAClD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,GAAG,EAAE,CAAC;YAC/D,IAAI,iBAAiB,GAAG,aAAa,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,CAAC,YAAY,GAAG,GAAG,CAAC;QAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QACrC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QACrC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QACrH,OAAO,SAAS,IAAI,EAAE,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,UAAU,GAAG,EAAE,CAAC;IACzB,CAAC;IAEO,yBAAyB,CAAC,KAAc;QAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,OAAyB;QAEzB,MAAM,WAAW,GACf,CAAC,CAAC,OAAO,CAAC,UAAU;YACpB,OAAO,OAAO,CAAC,qBAAqB,KAAK,QAAQ;YACjD,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC;QAE3C,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAEnC,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;QAElC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,SAAS;YAC/D,KAAK,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC;YACpD,OAAO,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,OAAO,CAAC;YACxD,QAAQ,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC1D,MAAM,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC;YACtD,YAAY,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,YAAY,CAAC;YAClE,QAAQ,EACN,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAChD,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACjC,eAAe,EAAE,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAC9E,YAAY,EAAE,OAAO,CAAC,kBAAkB;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,aAAa;QAClB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAClC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,SAAS,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;YACrE,MAAM,eAAe,GAAG,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC;YACnD,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC;YAC/C,IAAI,OAAO,GAAG,eAAe,GAAG,cAAc,CAAC;YAE/C,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;gBAClE,MAAM,iBAAiB,GAAG,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;gBAClD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,GAAG,EAAE,CAAC;gBAC/D,OAAO,GAAG,iBAAiB,GAAG,aAAa,CAAC;YAC9C,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IACzC,CAAC;IAED,QAAQ;QASN,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;YACxC,MAAM,EAAE;gBACN,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;gBACtD,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;gBAChD,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,uBAAuB;gBAC5D,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI;aACnD;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,OAAO;QACL,KAAK,EAAE,cAAc,CAAC,aAAa,EAAE;QACrC,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,OAAO,CACL,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,OAAQ,OAAmC,CAAC,OAAO,CAAC,KAAK,QAAQ;QAC/D,OAAmC,CAAC,OAAO,CAAY,CAAC,MAAM,GAAG,CAAC;QACpE,OAAQ,OAAmC,CAAC,UAAU,CAAC,KAAK,QAAQ;QAClE,OAAmC,CAAC,UAAU,CAAY,CAAC,MAAM,GAAG,CAAC;QACvE,OAAQ,OAAmC,CAAC,WAAW,CAAC,KAAK,QAAQ;QACnE,OAAmC,CAAC,WAAW,CAAY,GAAG,CAAC;QACjE,MAAM,CAAC,SAAS,CAAE,OAAmC,CAAC,WAAW,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/session/manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAuB,MAAM,cAAc,CAAC;AAOvE,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAgB,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAqC7C,MAAM,OAAO,cAAc;IACjB,MAAM,CAIZ;IACM,cAAc,CAAiB;IAC/B,YAAY,CAAe;IAEnC,YAAY,cAA8B,EAAE,SAAwB,EAAE;QACpE,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,YAAY;YACf,MAAM,CAAC,YAAY;gBACnB,IAAI,kBAAkB,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG;YACZ,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,IAAI,GAAG;YACxD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,EAAE;YACjD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,wBAAwB,EAAE;YAC/D,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,QAAQ;YACzC,GAAG,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,IAAI;gBAClD,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;aACxD,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;SACvE,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,YAAY,wBAAwB,EAAE,CAAC;YAC/D,MAAM,CAAC,IAAI,CACT,qEAAqE;gBACnE,oEAAoE;gBACpE,iBAAiB,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IACpC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAyB;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YAEnD,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBAChD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;wBACzC,OAAO,EAAE,wCAAwC,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI;wBACrF,WAAW,EAAE,6DAA6D,GAAG,eAAe,OAAO,CAAC,SAAS,WAAW,QAAQ,2CAA2C;qBAC5K;iBACF,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;wBACzC,OAAO,EAAE,+BAA+B,IAAI,CAAC,MAAM,CAAC,SAAS,SAAS,OAAO,CAAC,QAAQ,EAAE;qBACzF;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAClD,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,QAAQ,CACjB,CAAC;YACF,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB,CAAC,YAAY;wBACrC,OAAO,EAAE,+CAA+C;wBACxD,WAAW,EAAE,8CAA8C;qBAC5D;iBACF,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;YACtC,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC;YACvE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;YACrD,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAC9B,OAAO,CAAC,KAAK,EACb,eAAe,EACf,OAAO,CAAC,QAAQ,CACjB,CAAC;YAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAEvD,MAAM,OAAO,GAAmB;gBAC9B,SAAS;gBACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,GAAG;gBACd,YAAY,EAAE,GAAG;gBACjB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;gBACzC,aAAa,EAAE,WAAW;gBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;gBAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAClE,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,CAAC;aAClC,CAAC;YAEF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAEhD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;oBACzC,OAAO,EAAE,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;iBACpG;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,eAAe,GAAG,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC;QACnD,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC;QAE/C,IAAI,eAAe,GAAG,cAAc,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,iBAAiB,GAAG,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;YAClD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,GAAG,EAAE,CAAC;YAC/D,IAAI,iBAAiB,GAAG,aAAa,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,CAAC,YAAY,GAAG,GAAG,CAAC;QAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QACrC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QACrC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QACrH,OAAO,SAAS,IAAI,EAAE,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,UAAU,GAAG,EAAE,CAAC;IACzB,CAAC;IAEO,yBAAyB,CAAC,KAAc;QAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,OAAyB;QAEzB,MAAM,WAAW,GACf,CAAC,CAAC,OAAO,CAAC,UAAU;YACpB,OAAO,OAAO,CAAC,qBAAqB,KAAK,QAAQ;YACjD,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC;QAE3C,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAEnC,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;QAElC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,SAAS;YAC/D,KAAK,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC;YACpD,OAAO,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,OAAO,CAAC;YACxD,QAAQ,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC1D,MAAM,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC;YACtD,YAAY,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,YAAY,CAAC;YAClE,QAAQ,EACN,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAChD,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACjC,eAAe,EAAE,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAC9E,YAAY,EAAE,OAAO,CAAC,kBAAkB;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,aAAa;QAClB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAClC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,SAAS,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;YACrE,MAAM,eAAe,GAAG,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC;YACnD,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC;YAC/C,IAAI,OAAO,GAAG,eAAe,GAAG,cAAc,CAAC;YAE/C,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;gBAClE,MAAM,iBAAiB,GAAG,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;gBAClD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,GAAG,EAAE,CAAC;gBAC/D,OAAO,GAAG,iBAAiB,GAAG,aAAa,CAAC;YAC9C,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IACzC,CAAC;IAED,QAAQ;QASN,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;YACxC,MAAM,EAAE;gBACN,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;gBACtD,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;gBAChD,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,uBAAuB;gBAC5D,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI;aACnD;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,OAAO;QACL,KAAK,EAAE,cAAc,CAAC,aAAa,EAAE;QACrC,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,OAAO,CACL,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,OAAQ,OAAmC,CAAC,OAAO,CAAC,KAAK,QAAQ;QAC/D,OAAmC,CAAC,OAAO,CAAY,CAAC,MAAM,GAAG,CAAC;QACpE,OAAQ,OAAmC,CAAC,UAAU,CAAC,KAAK,QAAQ;QAClE,OAAmC,CAAC,UAAU,CAAY,CAAC,MAAM,GAAG,CAAC;QACvE,OAAQ,OAAmC,CAAC,WAAW,CAAC,KAAK,QAAQ;QACnE,OAAmC,CAAC,WAAW,CAAY,GAAG,CAAC;QACjE,MAAM,CAAC,SAAS,CAAE,OAAmC,CAAC,WAAW,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC"}

package/dist/utils/canonical-json.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Strict RFC 8785 JSON canonicalization for integrity-critical inputs.
+ *
+ * `json-canonicalize` intentionally follows JSON serialization semantics, which
+ * can silently erase or coerce unsupported JavaScript values. Protocol digests
+ * must fail closed instead: two distinguishable JavaScript inputs must never be
+ * accepted as the same canonical JSON value by accident.
+ */
+/** Validate that a value has an unambiguous JSON representation. */
+export declare function assertCanonicalJsonValue(value: unknown, path?: string, ancestors?: WeakSet<object>): void;
+/** Canonicalize a strict JSON value according to RFC 8785. */
+export declare function canonicalizeJson(value: unknown): string;
+/** Canonical UTF-8 bytes for hashing or signing. */
+export declare function canonicalizeJsonBytes(value: unknown): Uint8Array;
+//# sourceMappingURL=canonical-json.d.ts.map

package/dist/utils/canonical-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.d.ts","sourceRoot":"","sources":["../../src/utils/canonical-json.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAqBH,oEAAoE;AACpE,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,IAAI,SAAM,EACV,SAAS,GAAE,OAAO,CAAC,MAAM,CAAyB,GACjD,IAAI,CA4EN;AAED,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGvD;AAED,oDAAoD;AACpD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAEhE"}

package/dist/utils/canonical-json.js

@@ -0,0 +1,109 @@
+/**
+ * Strict RFC 8785 JSON canonicalization for integrity-critical inputs.
+ *
+ * `json-canonicalize` intentionally follows JSON serialization semantics, which
+ * can silently erase or coerce unsupported JavaScript values. Protocol digests
+ * must fail closed instead: two distinguishable JavaScript inputs must never be
+ * accepted as the same canonical JSON value by accident.
+ */
+import { canonicalize } from 'json-canonicalize';
+const encoder = new TextEncoder();
+/** RFC 8785 requires invalid Unicode data (unpaired UTF-16 surrogates) to fail. */
+function hasLoneSurrogate(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
+            const next = value.charCodeAt(index + 1);
+            if (index + 1 >= value.length || next < 0xdc00 || next > 0xdfff)
+                return true;
+            index += 1;
+        }
+        else if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
+            return true;
+        }
+    }
+    return false;
+}
+/** Validate that a value has an unambiguous JSON representation. */
+export function assertCanonicalJsonValue(value, path = '$', ancestors = new WeakSet()) {
+    if (value === null || typeof value === 'boolean') {
+        return;
+    }
+    if (typeof value === 'string') {
+        if (hasLoneSurrogate(value)) {
+            throw new TypeError(`Cannot canonicalize string with lone surrogate at ${path}`);
+        }
+        return;
+    }
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value)) {
+            throw new TypeError(`Cannot canonicalize non-finite number at ${path}: ${value}`);
+        }
+        if (Number.isInteger(value) && !Number.isSafeInteger(value)) {
+            throw new TypeError(`Cannot canonicalize unsafe integer at ${path}: ${value}`);
+        }
+        return;
+    }
+    if (typeof value === 'undefined') {
+        throw new TypeError(`Cannot canonicalize undefined at ${path}`);
+    }
+    if (typeof value === 'function') {
+        throw new TypeError(`Cannot canonicalize function at ${path}`);
+    }
+    if (typeof value === 'symbol') {
+        throw new TypeError(`Cannot canonicalize symbol at ${path}`);
+    }
+    if (typeof value === 'bigint') {
+        throw new TypeError(`Cannot canonicalize bigint at ${path}`);
+    }
+    if (typeof value !== 'object') {
+        throw new TypeError(`Cannot canonicalize unsupported value at ${path}`);
+    }
+    if (ancestors.has(value)) {
+        throw new TypeError(`Cannot canonicalize cyclic reference at ${path}`);
+    }
+    ancestors.add(value);
+    try {
+        if (Array.isArray(value)) {
+            for (let index = 0; index < value.length; index += 1) {
+                if (!(index in value)) {
+                    throw new TypeError(`Cannot canonicalize sparse array element at ${path}[${index}]`);
+                }
+                assertCanonicalJsonValue(value[index], `${path}[${index}]`, ancestors);
+            }
+            return;
+        }
+        const prototype = Object.getPrototypeOf(value);
+        if (prototype !== Object.prototype && prototype !== null) {
+            throw new TypeError(`Cannot canonicalize non-plain object at ${path}`);
+        }
+        for (const key of Reflect.ownKeys(value)) {
+            if (typeof key === 'symbol') {
+                throw new TypeError(`Cannot canonicalize symbol-keyed property at ${path}`);
+            }
+            if (hasLoneSurrogate(key)) {
+                throw new TypeError(`Cannot canonicalize object key with lone surrogate at ${path}`);
+            }
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            if (!descriptor?.enumerable)
+                continue;
+            if (!('value' in descriptor)) {
+                throw new TypeError(`Cannot canonicalize accessor property at ${path}.${key}`);
+            }
+            assertCanonicalJsonValue(descriptor.value, `${path}.${key}`, ancestors);
+        }
+    }
+    finally {
+        ancestors.delete(value);
+    }
+}
+/** Canonicalize a strict JSON value according to RFC 8785. */
+export function canonicalizeJson(value) {
+    assertCanonicalJsonValue(value);
+    return canonicalize(value);
+}
+/** Canonical UTF-8 bytes for hashing or signing. */
+export function canonicalizeJsonBytes(value) {
+    return encoder.encode(canonicalizeJson(value));
+}
+//# sourceMappingURL=canonical-json.js.map

package/dist/utils/canonical-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.js","sourceRoot":"","sources":["../../src/utils/canonical-json.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,KAAa;IACrC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,MAAM,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,GAAG,MAAM,IAAI,IAAI,GAAG,MAAM;gBAAE,OAAO,IAAI,CAAC;YAC7E,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,QAAQ,IAAI,MAAM,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,wBAAwB,CACtC,KAAc,EACd,IAAI,GAAG,GAAG,EACV,YAA6B,IAAI,OAAO,EAAU;IAElD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,SAAS,CAAC,qDAAqD,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,SAAS,CAAC,4CAA4C,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,SAAS,CAAC,yCAAyC,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,2CAA2C,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBACrD,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,EAAE,CAAC;oBACtB,MAAM,IAAI,SAAS,CAAC,+CAA+C,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC;gBACvF,CAAC;gBACD,wBAAwB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,SAAS,CAAC,CAAC;YACzE,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAkB,CAAC;QAChE,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACzD,MAAM,IAAI,SAAS,CAAC,2CAA2C,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,SAAS,CAAC,gDAAgD,IAAI,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,SAAS,CAAC,yDAAyD,IAAI,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,UAAU,EAAE,UAAU;gBAAE,SAAS;YACtC,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,SAAS,CAAC,4CAA4C,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,wBAAwB,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;AACjD,CAAC"}

package/dist/utils/crypto-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto-service.d.ts","sourceRoot":"","sources":["../../src/utils/crypto-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAStD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,SAAS,CAAC;IACf,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,cAAc,EAAE,UAAU,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,aAAa;IACZ,OAAO,CAAC,cAAc;gBAAd,cAAc,EAAE,cAAc;IAE5C,aAAa,CACjB,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;IAUnB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS;IA0C1B,SAAS,CACb,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,UAAU,EACxB,OAAO,CAAC,EAAE;QACR,eAAe,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;QACtC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,GAAG,CAAC,EAAE,OAAO,CAAC;KACf,GACA,OAAO,CAAC,OAAO,CAAC;IAuFnB,OAAO,CAAC,iBAAiB;IAczB,OAAO,CAAC,oBAAoB;CAO7B"}
+{"version":3,"file":"crypto-service.d.ts","sourceRoot":"","sources":["../../src/utils/crypto-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAStD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,SAAS,CAAC;IACf,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,cAAc,EAAE,UAAU,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,aAAa;IACZ,OAAO,CAAC,cAAc;gBAAd,cAAc,EAAE,cAAc;IAE5C,aAAa,CACjB,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;IAUnB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS;IA0C1B,SAAS,CACb,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,UAAU,EACxB,OAAO,CAAC,EAAE;QACR,eAAe,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;QACtC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,GAAG,CAAC,EAAE,OAAO,CAAC;KACf,GACA,OAAO,CAAC,OAAO,CAAC;IA8FnB,OAAO,CAAC,iBAAiB;IAczB,OAAO,CAAC,oBAAoB;CAO7B"}

package/dist/utils/crypto-service.js

@@ -98,6 +98,11 @@ export class CryptoService {
                 logger.error(`[CryptoService] Unsupported algorithm: ${parsed.header['alg']}, expected ${expectedAlg}`);
                 return false;
             }
+            if (options?.expectedKid !== undefined &&
+                parsed.header['kid'] !== options.expectedKid) {
+                logger.error('[CryptoService] Protected JWS key ID mismatch');
+                return false;
+            }
             let signingInputBytes;
             if (options?.detachedPayload !== undefined) {
                 const headerB64 = jws.split('.')[0];

package/dist/utils/crypto-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto-service.js","sourceRoot":"","sources":["../../src/utils/crypto-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,EACxB,aAAa,GACd,MAAM,aAAa,CAAC;AAoBrB,MAAM,OAAO,aAAa;IACJ;IAApB,YAAoB,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAAG,CAAC;IAEtD,KAAK,CAAC,aAAa,CACjB,IAAgB,EAChB,SAAqB,EACrB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;YAC5E,OAAO,MAAM,KAAK,IAAI,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;YACnE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;QAEpD,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,SAAU,CAAC,CAA4B,CAAC;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnF,CAAC;QACJ,CAAC;QAED,IAAI,OAA4C,CAAC;QACjD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAA4B,CAAC;YACvF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,cAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,cAAc,GAAG,sBAAsB,CAAC,YAAa,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAElD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,SAAS,CACb,GAAW,EACX,YAAwB,EACxB,OAIC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAC3D,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,OAAO,EAAE,WAAW,IAAI,YAAY,CAAC,GAAG,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;gBACrE,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBAChD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,MAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,OAAO,EAAE,eAAe,KAAK,SAAS,EAAE,CAAC;oBAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;wBAC1C,IAAI,CAAC;4BACH,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;4BAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;4BAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,uBAAuB,CAAC,SAAS,CAAC,CACR,CAAC;4BAC7B,MAAM,cAAc,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;4BAC5D,MAAM,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;wBAC5E,CAAC;wBAAC,MAAM,CAAC;4BACP,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;4BAC5D,OAAO,KAAK,CAAC;wBACf,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;wBAC3D,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;oBAC3D,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC;YAC5C,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,WAAW,EAAE,CAAC;gBACzC,MAAM,CAAC,KAAK,CACV,0CAA0C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,WAAW,EAAE,CAC1F,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,iBAA6B,CAAC;YAElC,IAAI,OAAO,EAAE,eAAe,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;gBACrC,IAAI,UAAkB,CAAC;gBAEvB,IAAI,OAAO,CAAC,eAAe,YAAY,UAAU,EAAE,CAAC;oBAClD,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBACjE,CAAC;qBAAM,CAAC;oBACN,UAAU,GAAG,wBAAwB,CACnC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAClD,CAAC;gBACJ,CAAC;gBAED,iBAAiB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBACzB,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;oBACtE,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,iBAAiB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,eAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE,KAAK,CAAC,CAAC;gBACrE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,GAAY;QACpC,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;YACvB,GAAG,KAAK,IAAI;YACZ,KAAK,IAAI,GAAG;YACX,GAA+B,CAAC,KAAK,CAAC,KAAK,KAAK;YACjD,KAAK,IAAI,GAAG;YACX,GAA+B,CAAC,KAAK,CAAC,KAAK,SAAS;YACrD,GAAG,IAAI,GAAG;YACV,OAAQ,GAA+B,CAAC,GAAG,CAAC,KAAK,QAAQ;YACvD,GAA+B,CAAC,GAAG,CAAY,CAAC,MAAM,GAAG,CAAC,CAC7D,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAAC,GAAe;QAC1C,MAAM,cAAc,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,cAAc,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,aAAa,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC;CACF"}
+{"version":3,"file":"crypto-service.js","sourceRoot":"","sources":["../../src/utils/crypto-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,EACxB,aAAa,GACd,MAAM,aAAa,CAAC;AAoBrB,MAAM,OAAO,aAAa;IACJ;IAApB,YAAoB,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAAG,CAAC;IAEtD,KAAK,CAAC,aAAa,CACjB,IAAgB,EAChB,SAAqB,EACrB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;YAC5E,OAAO,MAAM,KAAK,IAAI,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;YACnE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;QAEpD,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,SAAU,CAAC,CAA4B,CAAC;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnF,CAAC;QACJ,CAAC;QAED,IAAI,OAA4C,CAAC;QACjD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAA4B,CAAC;YACvF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,cAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,cAAc,GAAG,sBAAsB,CAAC,YAAa,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAElD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,SAAS,CACb,GAAW,EACX,YAAwB,EACxB,OAIC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAC3D,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,OAAO,EAAE,WAAW,IAAI,YAAY,CAAC,GAAG,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;gBACrE,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBAChD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,MAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,OAAO,EAAE,eAAe,KAAK,SAAS,EAAE,CAAC;oBAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;wBAC1C,IAAI,CAAC;4BACH,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;4BAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;4BAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,uBAAuB,CAAC,SAAS,CAAC,CACR,CAAC;4BAC7B,MAAM,cAAc,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;4BAC5D,MAAM,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;wBAC5E,CAAC;wBAAC,MAAM,CAAC;4BACP,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;4BAC5D,OAAO,KAAK,CAAC;wBACf,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;wBAC3D,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;oBAC3D,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC;YAC5C,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,WAAW,EAAE,CAAC;gBACzC,MAAM,CAAC,KAAK,CACV,0CAA0C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,WAAW,EAAE,CAC1F,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IACE,OAAO,EAAE,WAAW,KAAK,SAAS;gBAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,WAAW,EAC5C,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBAC9D,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,iBAA6B,CAAC;YAElC,IAAI,OAAO,EAAE,eAAe,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;gBACrC,IAAI,UAAkB,CAAC;gBAEvB,IAAI,OAAO,CAAC,eAAe,YAAY,UAAU,EAAE,CAAC;oBAClD,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBACjE,CAAC;qBAAM,CAAC;oBACN,UAAU,GAAG,wBAAwB,CACnC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAClD,CAAC;gBACJ,CAAC;gBAED,iBAAiB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBACzB,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;oBACtE,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,iBAAiB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,eAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE,KAAK,CAAC,CAAC;gBACrE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,GAAY;QACpC,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;YACvB,GAAG,KAAK,IAAI;YACZ,KAAK,IAAI,GAAG;YACX,GAA+B,CAAC,KAAK,CAAC,KAAK,KAAK;YACjD,KAAK,IAAI,GAAG;YACX,GAA+B,CAAC,KAAK,CAAC,KAAK,SAAS;YACrD,GAAG,IAAI,GAAG;YACV,OAAQ,GAA+B,CAAC,GAAG,CAAC,KAAK,QAAQ;YACvD,GAA+B,CAAC,GAAG,CAAY,CAAC,MAAM,GAAG,CAAC,CAC7D,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAAC,GAAe;QAC1C,MAAM,cAAc,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,cAAc,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,aAAa,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC;CACF"}

package/dist/utils/index.d.ts

@@ -3,6 +3,7 @@
  */
 export { ED25519_PKCS8_DER_HEADER, ED25519_SPKI_DER_HEADER_LENGTH, ED25519_KEY_SIZE, } from './ed25519-constants.js';
 export { isRecord } from './guards.js';
+export { assertCanonicalJsonValue, canonicalizeJson, canonicalizeJsonBytes, } from './canonical-json.js';
 export { stripTrailingSlashes } from './url.js';
 export { createSafeFetch, fetchTransport, isBlockedAddress, type SafeFetch, type SafeFetchResponse, type SafeFetchOptions, type SafeFetchTransport, type TransportInit, type RawResponse, type DnsLookup, type DnsAddress, } from './safe-fetch.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,iBAAiB,CAAC"}

package/dist/utils/index.js

@@ -3,6 +3,7 @@
  */
 export { ED25519_PKCS8_DER_HEADER, ED25519_SPKI_DER_HEADER_LENGTH, ED25519_KEY_SIZE, } from './ed25519-constants.js';
 export { isRecord } from './guards.js';
+export { assertCanonicalJsonValue, canonicalizeJson, canonicalizeJsonBytes, } from './canonical-json.js';
 export { stripTrailingSlashes } from './url.js';
 export { createSafeFetch, fetchTransport, isBlockedAddress, } from './safe-fetch.js';
 //# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,GASjB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,GASjB,MAAM,iBAAiB,CAAC"}

package/dist/utils/safe-fetch-transports.d.ts

@@ -9,6 +9,7 @@
  * already run in the policy layer via `resolveAndPin`). All addressing policy lives in
  * `./ip-classifier`; the seam vocabulary lives in `./safe-fetch-types`. No crypto here.
  */
+import type { LookupFunction } from 'node:net';
 import type { DnsLookup, SafeFetchTransport } from './safe-fetch-types.js';
 /** Default DNS seam — resolve every address (`all: true`) for full SSRF screening. */
 export declare const defaultLookup: DnsLookup;
@@ -29,12 +30,24 @@ export declare const defaultLookup: DnsLookup;
  * `node:https` works; the first-party escape hatch avoids the window for a caller's own origin.
  */
 export declare const fetchTransport: SafeFetchTransport;
+/**
+ * Build the custom `node:https` lookup that pins the connection to the pre-validated IP for BOTH
+ * call-shapes (closing the DNS-rebinding TOCTOU window). Node ≥20 defaults to
+ * `autoSelectFamily=true`, which invokes a custom lookup with `{ all: true }` and expects an ARRAY
+ * of `{ address, family }`; a scalar 3-arg callback yields "Invalid IP address: undefined" and
+ * breaks every real request. Honour the array form when `all` is asked, the scalar form otherwise.
+ * Exported for direct unit testing (the request wiring around it is integration-only — no TLS in
+ * the unit suite). Not re-exported from the package barrels; the public surface is unchanged.
+ */
+export declare function buildPinnedLookup(pinnedAddress: string, family: 4 | 6): LookupFunction;
 /** Default transport — node:https pinned to the validated IP, TLS SNI preserved, body-capped. */
 export declare const nodeHttpsTransport: SafeFetchTransport;
 /**
  * Pick the default transport: the `node:https` pinned transport when it is available, else the
- * fetch-based transport. This only covers ABSENCE of `node:https`; a runtime where the pinned
- * path is present-but-broken (e.g. Vercel Node serverless) must pass `transport: fetchTransport`.
+ * fetch-based transport. The `node:https` check is deferred to request time (it lazy-loads), so a
+ * runtime without `node:https` (workerd) transparently gets `fetchTransport`. This only covers
+ * ABSENCE of `node:https`; a runtime where the pinned path is present-but-broken (e.g. the Vercel
+ * Node serverless runtime) must still pass `transport: fetchTransport` explicitly.
  */
 export declare function selectDefaultTransport(): SafeFetchTransport;
 //# sourceMappingURL=safe-fetch-transports.d.ts.map

package/dist/utils/safe-fetch-transports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safe-fetch-transports.d.ts","sourceRoot":"","sources":["../../src/utils/safe-fetch-transports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,KAAK,EAAE,SAAS,EAAe,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAExF,sFAAsF;AACtF,eAAO,MAAM,aAAa,EAAE,SAG3B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc,EAAE,kBAG5B,CAAC;AA2BF,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,EAAE,kBAsC7B,CAAC;AAgBL;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,kBAAkB,CAE3D"}
+{"version":3,"file":"safe-fetch-transports.d.ts","sourceRoot":"","sources":["../../src/utils/safe-fetch-transports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAe,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AA2CxF,sFAAsF;AACtF,eAAO,MAAM,aAAa,EAAE,SAI3B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc,EAAE,kBAG5B,CAAC;AA2BF;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,cAAc,CAUtF;AAED,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,EAAE,kBA+BhC,CAAC;AAgBF;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,kBAAkB,CAK3D"}

package/dist/utils/safe-fetch-transports.js

@@ -9,10 +9,25 @@
  * already run in the policy layer via `resolveAndPin`). All addressing policy lives in
  * `./ip-classifier`; the seam vocabulary lives in `./safe-fetch-types`. No crypto here.
  */
-import { lookup as nodeDnsLookup } from 'node:dns/promises';
-import { request as httpsRequest } from 'node:https';
+let dnsLookupPromise;
+/**
+ * Lazily load (and cache) `node:dns/promises`' `lookup`. Where `node:dns` is absent (workerd),
+ * fail with a guiding error rather than a cryptic module-resolution reject: a Worker should inject
+ * its own `lookup` seam (e.g. DNS-over-HTTPS) or use trusted origins + `fetchTransport`.
+ */
+function loadNodeDnsLookup() {
+    return (dnsLookupPromise ??= import('node:dns/promises').then((m) => m.lookup, (cause) => {
+        throw new Error('safe-fetch: node:dns is unavailable in this runtime — inject a `lookup` seam (e.g. DNS-over-HTTPS) or use trusted origins with fetchTransport', { cause });
+    }));
+}
+let nodeHttpsPromise;
+/** Lazily load (and cache) `node:https`; resolves to `null` where it's absent (workerd). */
+function loadNodeHttps() {
+    return (nodeHttpsPromise ??= import('node:https').then((m) => m, () => null));
+}
 /** Default DNS seam — resolve every address (`all: true`) for full SSRF screening. */
 export const defaultLookup = async (hostname) => {
+    const nodeDnsLookup = await loadNodeDnsLookup();
     const resolved = await nodeDnsLookup(hostname, { all: true, verbatim: true });
     return resolved.map((entry) => ({ address: entry.address, family: entry.family }));
 };
@@ -61,42 +76,56 @@ async function readCapped(response, maxBytes) {
         text: () => Promise.resolve(body),
     };
 }
-/** Default transport — node:https pinned to the validated IP, TLS SNI preserved, body-capped. */
-export const nodeHttpsTransport = (url, init) => new Promise((resolve, reject) => {
-    // Return the pinned IP for BOTH lookup call-shapes. Node ≥20 defaults to
-    // `autoSelectFamily=true`, which invokes a custom lookup with `{ all: true }` and expects an
-    // ARRAY of `{ address, family }`; a scalar 3-arg callback yields "Invalid IP address:
-    // undefined" and breaks every real request. Honour the array form when `all` is asked,
-    // the scalar form otherwise.
-    const family = init.family === 6 ? 6 : 4;
-    const pinnedLookup = (_hostname, options, cb) => {
+/**
+ * Build the custom `node:https` lookup that pins the connection to the pre-validated IP for BOTH
+ * call-shapes (closing the DNS-rebinding TOCTOU window). Node ≥20 defaults to
+ * `autoSelectFamily=true`, which invokes a custom lookup with `{ all: true }` and expects an ARRAY
+ * of `{ address, family }`; a scalar 3-arg callback yields "Invalid IP address: undefined" and
+ * breaks every real request. Honour the array form when `all` is asked, the scalar form otherwise.
+ * Exported for direct unit testing (the request wiring around it is integration-only — no TLS in
+ * the unit suite). Not re-exported from the package barrels; the public surface is unchanged.
+ */
+export function buildPinnedLookup(pinnedAddress, family) {
+    return (_hostname, options, cb) => {
         if (typeof options === 'object' && options?.all) {
             cb(null, [
-                { address: init.pinnedAddress, family },
+                { address: pinnedAddress, family },
             ]);
         }
         else {
-            cb(null, init.pinnedAddress, family);
+            cb(null, pinnedAddress, family);
         }
     };
-    const req = httpsRequest(url, { method: 'GET', servername: init.hostname, signal: init.signal, lookup: pinnedLookup }, (res) => {
-        const chunks = [];
-        let size = 0;
-        res.on('data', (chunk) => {
-            size += chunk.length;
-            if (size > init.maxBytes) {
-                req.destroy();
-                reject(new Error(`safe-fetch: response body exceeds size cap ${init.maxBytes}`));
-                return;
-            }
-            chunks.push(chunk);
+}
+/** Default transport — node:https pinned to the validated IP, TLS SNI preserved, body-capped. */
+export const nodeHttpsTransport = async (url, init) => {
+    const https = await loadNodeHttps();
+    if (!https) {
+        throw new Error('safe-fetch: node:https is unavailable in this runtime; pass transport: fetchTransport');
+    }
+    const httpsRequest = https.request;
+    return new Promise((resolve, reject) => {
+        const family = init.family === 6 ? 6 : 4;
+        const pinnedLookup = buildPinnedLookup(init.pinnedAddress, family);
+        const req = httpsRequest(url, { method: 'GET', servername: init.hostname, signal: init.signal, lookup: pinnedLookup }, (res) => {
+            const chunks = [];
+            let size = 0;
+            res.on('data', (chunk) => {
+                size += chunk.length;
+                if (size > init.maxBytes) {
+                    req.destroy();
+                    reject(new Error(`safe-fetch: response body exceeds size cap ${init.maxBytes}`));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            res.on('end', () => resolve(toRawResponse(res, chunks)));
+            res.on('error', reject);
         });
-        res.on('end', () => resolve(toRawResponse(res, chunks)));
-        res.on('error', reject);
+        req.on('error', reject);
+        req.end();
     });
-    req.on('error', reject);
-    req.end();
-});
+};
 /** Project a node:http IncomingMessage + buffered chunks into the RawResponse shape. */
 function toRawResponse(res, chunks) {
     return {
@@ -112,10 +141,15 @@ function toRawResponse(res, chunks) {
 }
 /**
  * Pick the default transport: the `node:https` pinned transport when it is available, else the
- * fetch-based transport. This only covers ABSENCE of `node:https`; a runtime where the pinned
- * path is present-but-broken (e.g. Vercel Node serverless) must pass `transport: fetchTransport`.
+ * fetch-based transport. The `node:https` check is deferred to request time (it lazy-loads), so a
+ * runtime without `node:https` (workerd) transparently gets `fetchTransport`. This only covers
+ * ABSENCE of `node:https`; a runtime where the pinned path is present-but-broken (e.g. the Vercel
+ * Node serverless runtime) must still pass `transport: fetchTransport` explicitly.
  */
 export function selectDefaultTransport() {
-    return typeof httpsRequest === 'function' ? nodeHttpsTransport : fetchTransport;
+    return async (url, init) => {
+        const https = await loadNodeHttps();
+        return https ? nodeHttpsTransport(url, init) : fetchTransport(url, init);
+    };
 }
 //# sourceMappingURL=safe-fetch-transports.js.map

package/dist/utils/safe-fetch-transports.js.map

@@ -1 +1 @@
-{"version":3,"file":"safe-fetch-transports.js","sourceRoot":"","sources":["../../src/utils/safe-fetch-transports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAKrD,sFAAsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAc,KAAK,EAAE,QAAQ,EAAE,EAAE;IACzD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACrF,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,cAAc,GAAuB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACpE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9F,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,0FAA0F;AAC1F,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAE,QAAgB;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,MAAM,EAAE,CAAC;QACX,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,8CAA8C,QAAQ,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACtD,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,kBAAkB,GAAuB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAClE,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC3C,yEAAyE;IACzE,6FAA6F;IAC7F,sFAAsF;IACtF,uFAAuF;IACvF,6BAA6B;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,YAAY,GAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE;QAC9D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,GAAG,EAAE,CAAC;YAC/C,EAAkF,CAAC,IAAI,EAAE;gBACxF,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,YAAY,CACtB,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,EACvF,CAAC,GAAoB,EAAE,EAAE;QACvB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACzB,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACjF,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACzD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC,CAAC,CAAC;AAEL,wFAAwF;AACxF,SAAS,aAAa,CAAC,GAAoB,EAAE,MAAgB;IAC3D,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;QAC3B,OAAO,EAAE;YACP,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;gBACZ,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;YACrE,CAAC;SACF;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc,CAAC;AAClF,CAAC"}
+{"version":3,"file":"safe-fetch-transports.js","sourceRoot":"","sources":["../../src/utils/safe-fetch-transports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAmBH,IAAI,gBAAoD,CAAC;AACzD;;;;GAIG;AACH,SAAS,iBAAiB;IACxB,OAAO,CAAC,gBAAgB,KAAK,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAC3D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EACf,CAAC,KAAK,EAAE,EAAE;QACR,MAAM,IAAI,KAAK,CACb,+IAA+I,EAC/I,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC,CACF,CAAC,CAAC;AACL,CAAC;AAGD,IAAI,gBAAuD,CAAC;AAC5D,4FAA4F;AAC5F,SAAS,aAAa;IACpB,OAAO,CAAC,gBAAgB,KAAK,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CACpD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EACR,GAAG,EAAE,CAAC,IAAI,CACX,CAAC,CAAC;AACL,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAc,KAAK,EAAE,QAAQ,EAAE,EAAE;IACzD,MAAM,aAAa,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACrF,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,cAAc,GAAuB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACpE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9F,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,0FAA0F;AAC1F,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAE,QAAgB;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,MAAM,EAAE,CAAC;QACX,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,8CAA8C,QAAQ,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACtD,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,aAAqB,EAAE,MAAa;IACpE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE;QAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,GAAG,EAAE,CAAC;YAC/C,EAAkF,CAAC,IAAI,EAAE;gBACxF,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,kBAAkB,GAAuB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACxE,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC;IACnC,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,GAAG,GAAG,YAAY,CACtB,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,EACvF,CAAC,GAAoB,EAAE,EAAE;YACvB,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBACrB,IAAI,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACzB,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,MAAM,CAAC,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;oBACjF,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YACzD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,wFAAwF;AACxF,SAAS,aAAa,CAAC,GAAoB,EAAE,MAAgB;IAC3D,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;QAC3B,OAAO,EAAE;YACP,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;gBACZ,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;YACrE,CAAC;SACF;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3E,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,12 +1,15 @@
 {
   "name": "@kya-os/mcp",
-  "version": "1.10.0",
-  "description": "Reference implementation of the KYA-OS protocol for Model Context Protocol servers: delegation, proof, and session primitives",
+  "version": "1.11.0",
+  "description": "Reference implementation of the KYA-OS protocol for Model Context Protocol servers: identity, delegation, proofs, sessions, and verifiable audit trails",
   "license": "MIT",
   "type": "module",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "bin": {
+    "kya-audit": "./dist/audit/cli.js"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -56,6 +59,14 @@
       "types": "./dist/authz/index.d.ts",
       "default": "./dist/authz/index.js"
     },
+    "./audit": {
+      "types": "./dist/audit/index.d.ts",
+      "default": "./dist/audit/index.js"
+    },
+    "./audit/testing": {
+      "types": "./dist/audit/testing/index.d.ts",
+      "default": "./dist/audit/testing/index.js"
+    },
     "./cheqd": {
       "types": "./dist/integrations/cheqd/index.d.ts",
       "default": "./dist/integrations/cheqd/index.js"
@@ -68,7 +79,10 @@
     "schemas",
     "LICENSE",
     "README.md",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "AUDITABILITY.md",
+    "CONFORMANCE.md",
+    "SPEC.md"
   ],
   "scripts": {
     "build": "tsc",
@@ -97,10 +111,11 @@
     "example:authz-inspector:http": "npx tsx examples/authz-inspector/src/inspector-http.ts",
     "example:authz-inspector:http:server": "npx tsx examples/authz-inspector/src/http.ts",
     "example:authz-inspector:stdio:server": "npx tsx examples/authz-inspector/src/stdio.ts",
-    "example:cheqd-dlr": "npx tsx examples/cheqd-dlr/operator-flow.ts"
+    "example:cheqd-dlr": "npx tsx examples/cheqd-dlr/operator-flow.ts",
+    "example:audit-trail": "npx tsx examples/audit-trail/walkthrough.ts"
   },
   "dependencies": {
-    "jose": "^6.2.3",
+    "jose": "^6.2.4",
     "json-canonicalize": "^2.0.0",
     "zod": "^4.3.6"
   },
@@ -114,20 +129,21 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@kya-os/consent": "^0.1.37",
+    "@kya-os/consent": "^0.1.43",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "@types/express": "^5.0.6",
     "@types/node": "^26.0.1",
-    "@typescript-eslint/eslint-plugin": "^8.57.0",
-    "@typescript-eslint/parser": "^8.57.0",
-    "@vitest/coverage-v8": "^2.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.65.0",
+    "@typescript-eslint/parser": "^8.65.0",
+    "@vitest/coverage-v8": "^4.1.10",
+    "ajv": "^8.20.0",
     "commander": "^15.0.0",
     "eslint": "^10.0.3",
     "express": "^5.2.1",
     "tsx": "^4.22.4",
     "typescript": "^5.5.3",
-    "typescript-eslint": "^8.57.0",
-    "vitest": "^2.0.0"
+    "typescript-eslint": "^8.65.0",
+    "vitest": "^4.1.10"
   },
   "keywords": [
     "kya-os",
@@ -137,6 +153,8 @@
     "did",
     "protocol",
     "identity",
+    "audit",
+    "transparency-log",
     "dif"
   ],
   "repository": {

package/schemas/README.md

@@ -11,7 +11,19 @@ This directory contains JSON Schema definitions for the core KYA-OS (Model Conte
 | [delegation-credential.json](./delegation-credential.json) | W3C Verifiable Credential for delegations (legacy VC 1.0 shape) |
 | [card-delegation-credential.json](./card-delegation-credential.json) | W3C VC 2.0 + ZCAP-LD delegation profile (Entity Card) |
 | [detached-proof.json](./detached-proof.json) | Cryptographic proof for tool request/response |
-| [well-known-kyaos.json](./well-known-kyaos.json) | Service discovery document |
+| [kya-os-card.schema.json](./kya-os-card.schema.json) | Typed KYA-OS Entity Card |
+| [well-known-mcpi.json](./well-known-mcpi.json) | Service discovery document |
+| [audit-event.schema.json](./audit-event.schema.json) | Strict, privacy-minimal producer audit event core |
+| [audit-entry.schema.json](./audit-entry.schema.json) | Recorder-assigned chained entry core |
+| [audit-receipt.schema.json](./audit-receipt.schema.json) | Signed append-receipt core |
+| [audit-checkpoint.schema.json](./audit-checkpoint.schema.json) | RFC 9162 signed-checkpoint core |
+| [audit-bundle-manifest.schema.json](./audit-bundle-manifest.schema.json) | Signed replay-bundle inventory and scope core |
+| [audit-observation.schema.json](./audit-observation.schema.json) | Independently signed checkpoint observation receipt |
+| [audit-anchor-receipt.schema.json](./audit-anchor-receipt.schema.json) | Supporting WORM, RFC 3161, or SCITT receipt |
+| [audit-inclusion-proof.schema.json](./audit-inclusion-proof.schema.json) | RFC 9162 inclusion proof |
+| [audit-consistency-proof.schema.json](./audit-consistency-proof.schema.json) | RFC 9162 consistency proof |
+| [audit-verification-report.schema.json](./audit-verification-report.schema.json) | Multi-dimensional offline verification result |
+| [audit-verification-policy.schema.json](./audit-verification-policy.schema.json) | Out-of-band recorder, observer, anchor, and exporter trust policy |
 
 ## Usage
 
@@ -73,6 +85,19 @@ https://schema.kya-os.org/v1/protocol/{family}/{resource}/v1.0.0
 
 Schemas can reference each other using `$ref`. For example, the delegation credential schema references shared definitions for constraints and proof structures.
 
+### Audit semantic keywords
+
+Three audit schemas use required KYA-OS semantic keywords for invariants that
+JSON Schema draft 2020-12 cannot express with its standard vocabulary:
+
+- `kyaOrderedDecimalRange` compares two canonical decimal-string properties;
+- `kyaOrderedNumberRange` compares two optional integer properties;
+- `kyaUniqueProperty` requires unique values for one property across an array.
+
+Audit validators MUST implement these keywords rather than treating them as
+annotations. The TypeScript/Ajv parity suite in
+`src/audit/__tests__/schema-parity.test.ts` is the executable reference.
+
 ## Protocol Flow
 
 ```
@@ -107,6 +132,7 @@ These schemas implement types defined in the [KYA-OS Specification](../SPEC.md):
 - **Delegation Credentials**: SPEC.md §4.1–4.2
 - **Detached Proofs**: SPEC.md §5
 - **Discovery**: SPEC.md §14 (Transport Binding)
+- **Auditability**: [AUDITABILITY.md](../AUDITABILITY.md)
 
 ## Contributing