@kya-os/mcp 1.7.0 → 1.10.0

package/dist/middleware/with-kya-os.types.d.ts

@@ -0,0 +1,178 @@
+/**
+ * KYA-OS Middleware — public API-surface types.
+ *
+ * The tool, call-context, and role interfaces for `createKyaOsMiddleware` /
+ * `withKyaOs`, separated from the implementation (`./with-kya-os.ts`). The
+ * configuration INPUT types live in `./with-kya-os.config-types.ts` and are
+ * re-exported below, so every existing `import { KyaOsConfig } from './with-kya-os'`
+ * is unchanged.
+ */
+import type { SessionManager } from "../session/manager.js";
+import type { ProofGenerator } from "../proof/generator.js";
+import type { NeedsAuthorizationError } from "../types/protocol.js";
+import type { PolicyEngine } from "../policy/engine.js";
+import type { RiskClassifier } from "../policy/classifier.js";
+import type { ApprovalGrant } from "../policy/approval.js";
+import type { KyaOsIdentityConfig } from "./with-kya-os.config-types.js";
+export * from "./with-kya-os.config-types.js";
+export interface KyaOsToolDefinition {
+    name: string;
+    description?: string;
+    inputSchema: {
+        type: "object";
+        properties?: Record<string, unknown>;
+        required?: string[];
+        [key: string]: unknown;
+    };
+}
+/**
+ * Per-call context threaded through the middleware wrappers (not part of the
+ * tool's public arguments). `wrapWithDelegation` populates `scopeId` so the
+ * proof and audit record reflect the scope the call was authorized under.
+ */
+export interface KyaOsCallContext {
+    scopeId?: string;
+}
+export interface KyaOsToolHandler<T extends Record<string, unknown> = Record<string, unknown>> {
+    (args: T, sessionId?: string, context?: KyaOsCallContext): Promise<{
+        content: Array<{
+            type: string;
+            text: string;
+            [key: string]: unknown;
+        }>;
+        isError?: boolean;
+        [key: string]: unknown;
+    }>;
+}
+/**
+ * Server interface — minimal subset of @modelcontextprotocol/sdk Server.
+ * This avoids a hard dependency on the SDK at the type level.
+ */
+export interface KyaOsServer {
+    setRequestHandler(schema: unknown, handler: (...args: unknown[]) => unknown): void;
+}
+/** Route the unified `_kyaos` protocol action (and the deprecated handshake). */
+export interface KyaOsProtocolHandler {
+    /**
+     * Handle a unified `_kyaos` action. Use this in your CallToolRequest handler
+     * when `request.params.name === '_kyaos'`.
+     */
+    handleKyaOs(args: Record<string, unknown>): Promise<{
+        content: Array<{
+            type: string;
+            text: string;
+        }>;
+        isError?: boolean;
+    }>;
+    /**
+     * @deprecated Use `handleKyaOs` with `action: "handshake"`.
+     * Handle a handshake call. Use this in your CallToolRequest handler
+     * when `request.params.name === '_kyaos_handshake'`.
+     */
+    handleHandshake(args: Record<string, unknown>): Promise<{
+        content: Array<{
+            type: string;
+            text: string;
+        }>;
+        isError?: boolean;
+    }>;
+}
+/** Wrap a tool handler to automatically attach holder-of-key proofs. */
+export interface KyaOsProofAttacher {
+    /**
+     * Wrap a tool handler to automatically generate proofs.
+     * Returns a new handler that appends proof metadata to the response.
+     */
+    wrapWithProof<T extends Record<string, unknown> = Record<string, unknown>>(toolName: string, handler: KyaOsToolHandler<T>): KyaOsToolHandler;
+}
+/** Wrap a tool handler to require a valid W3C Delegation Credential. */
+export interface KyaOsDelegationGate {
+    /**
+     * Wrap a tool handler to require a valid W3C Delegation Credential.
+     *
+     * Caller must pass the VC as `_kyaos_delegation` in the tool args.
+     * - If absent: returns a `needs_authorization` response with the consentUrl.
+     * - If present but invalid: returns a structured error with reason.
+     * - If valid with correct scope: strips `_kyaos_delegation` and calls the handler.
+     */
+    wrapWithDelegation(toolName: string, config: {
+        scopeId: string;
+        consentUrl: string;
+        /**
+         * Optional presentation hook for the `needs_authorization` challenge.
+         * Given the structured challenge, return the tool-response content to emit
+         * (e.g. a markdown "Authorize" link for LLM / chat-style MCP clients that
+         * won't parse raw JSON). The signed challenge proof binds a `responseHash`
+         * over WHATEVER this returns, so the `authorizationUrl` stays tamper-evident
+         * regardless of presentation. Defaults to the structured challenge as JSON.
+         */
+        formatChallenge?: (challenge: NeedsAuthorizationError) => Array<{
+            type: "text";
+            text: string;
+        }>;
+    }, handler: KyaOsToolHandler): KyaOsToolHandler;
+}
+/** Wrap a tool handler with a per-action policy / step-up gate. */
+export interface KyaOsPolicyGate {
+    /**
+     * Wrap a tool handler with a per-action policy / step-up gate.
+     *
+     * Compose after `wrapWithDelegation`. Classifies the action's risk and asks a
+     * pluggable PolicyEngine: allow → run handler; deny → signed denial proof;
+     * step_up → `needs_approval` until N-of-M signed approval grants (bound to the
+     * request hash) are supplied.
+     */
+    withPolicyGate(toolName: string, handler: KyaOsToolHandler, opts?: PolicyGateOptions): KyaOsToolHandler;
+}
+/**
+ * The full middleware surface = the exposed components PLUS the four wrapping
+ * ROLES ({@link KyaOsProtocolHandler}, {@link KyaOsProofAttacher},
+ * {@link KyaOsDelegationGate}, {@link KyaOsPolicyGate}). Prefer depending on a
+ * single role where a caller only needs one; this composition keeps the flat API
+ * for back-compat while satisfying the Interface Segregation Principle.
+ */
+export interface KyaOsMiddleware extends KyaOsProtocolHandler, KyaOsProofAttacher, KyaOsDelegationGate {
+    /** The identity config used by this middleware instance */
+    identity: KyaOsIdentityConfig;
+    /** The SessionManager instance for manual session operations */
+    sessionManager: SessionManager;
+    /** The ProofGenerator instance for manual proof operations */
+    proofGenerator: ProofGenerator;
+    /**
+     * Unified tool definition for `_kyaos`.
+     * Include this in your ListToolsRequest handler's tool list.
+     */
+    kyaOsTool: KyaOsToolDefinition;
+    /**
+     * @deprecated Use `kyaOsTool` (`_kyaos` with `action: "handshake"`).
+     * Tool definition for `_kyaos_handshake`.
+     * Include this in your ListToolsRequest handler's tool list.
+     */
+    handshakeTool: KyaOsToolDefinition;
+    withPolicyGate?: KyaOsPolicyGate["withPolicyGate"];
+}
+export interface PolicyGateOptions {
+    /** Policy decision engine. Defaults to a fail-closed DefaultPolicyEngine. */
+    engine?: PolicyEngine;
+    /** Risk classifier. Defaults to the built-in RiskClassifier. */
+    classifier?: RiskClassifier;
+    /** Derive the resource namespace from the tool args (defaults to the tool name). */
+    resolveNamespace?: (args: Record<string, unknown>) => string;
+    /** Tool-arg key carrying approval grants on resume. Default "_kyaos_approvals". */
+    approvalsArgKey?: string;
+    /** Verifier for approval-grant signatures (identity-layer). Default: reject all. */
+    isValidApprovalSignature?: (grant: ApprovalGrant) => Promise<boolean>;
+    /**
+     * Whether a prior step already authorized this action's scope/identity.
+     *
+     * Defaults to FALSE (fail-closed): used standalone, withPolicyGate enforces no
+     * scope or identity, so it must NOT be trusted to allow on its own. When you
+     * compose it AFTER wrapWithDelegation (the expected usage), pass
+     * `scopeMatched: true` to signal that the delegated scope was already verified.
+     * Note: principal facts are projected from the (unverified) `_kyaos_delegation`
+     * arg on a best-effort basis and must not be treated as authenticated unless
+     * wrapWithDelegation ran first.
+     */
+    scopeMatched?: boolean;
+}
+//# sourceMappingURL=with-kya-os.types.d.ts.map

package/dist/middleware/with-kya-os.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-kya-os.types.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAIzE,cAAc,+BAA+B,CAAC;AAE9C,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB,CAC/B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE3D,CACE,IAAI,EAAE,CAAC,EACP,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC;QACT,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC,CAAC;QACvE,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC,CAAC;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,iBAAiB,CACf,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,GACvC,IAAI,CAAC;CACT;AAQD,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QAClD,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IAEH;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;CACJ;AAED,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvE,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAC3B,gBAAgB,CAAC;CACrB;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,kBAAkB,CAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB;;;;;;;WAOG;QACH,eAAe,CAAC,EAAE,CAChB,SAAS,EAAE,uBAAuB,KAC/B,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC5C,EACD,OAAO,EAAE,gBAAgB,GACxB,gBAAgB,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B;;;;;;;OAOG;IACH,cAAc,CACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,EACzB,IAAI,CAAC,EAAE,iBAAiB,GACvB,gBAAgB,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eACf,SAAQ,oBAAoB,EAC1B,kBAAkB,EAClB,mBAAmB;IACrB,2DAA2D;IAC3D,QAAQ,EAAE,mBAAmB,CAAC;IAE9B,gEAAgE;IAChE,cAAc,EAAE,cAAc,CAAC;IAE/B,8DAA8D;IAC9D,cAAc,EAAE,cAAc,CAAC;IAE/B;;;OAGG;IACH,SAAS,EAAE,mBAAmB,CAAC;IAE/B;;;;OAIG;IACH,aAAa,EAAE,mBAAmB,CAAC;IAInC,cAAc,CAAC,EAAE,eAAe,CAAC,gBAAgB,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,gEAAgE;IAChE,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC;IAC7D,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,wBAAwB,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB"}

package/dist/middleware/with-kya-os.types.js

@@ -0,0 +1,13 @@
+/**
+ * KYA-OS Middleware — public API-surface types.
+ *
+ * The tool, call-context, and role interfaces for `createKyaOsMiddleware` /
+ * `withKyaOs`, separated from the implementation (`./with-kya-os.ts`). The
+ * configuration INPUT types live in `./with-kya-os.config-types.ts` and are
+ * re-exported below, so every existing `import { KyaOsConfig } from './with-kya-os'`
+ * is unchanged.
+ */
+// The configuration input types (KyaOsConfig, KyaOsDelegationConfig, …) live in
+// ./with-kya-os.config-types.ts; re-export them so importers are unchanged.
+export * from "./with-kya-os.config-types.js";
+//# sourceMappingURL=with-kya-os.types.js.map

package/dist/middleware/with-kya-os.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-kya-os.types.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAUH,gFAAgF;AAChF,4EAA4E;AAC5E,cAAc,+BAA+B,CAAC"}

package/dist/proof/generator.d.ts

@@ -33,7 +33,16 @@ export declare const LEGACY_PROOF_META_KEY = "proof";
 export interface ProofAgentIdentity {
     did: string;
     kid: string;
-    privateKey: string;
+    /**
+     * The Ed25519 signing key. Either the base64-encoded raw private key (the
+     * historical form), or a `CryptoKey` handle — including a **non-extractable**
+     * WebCrypto key (e.g. a passkey-PRF-derived or HSM/KMS-fronted key). Passing a
+     * handle keeps secret key material inside the caller's trust boundary and
+     * hands the library only a signer, per SPEC §4.5 ("implementations that …
+     * hold agent secret keys … are non-conformant") and the KMS/HSM signer-hook
+     * guidance. Either form produces an equally valid, verifier-accepted proof.
+     */
+    privateKey: string | CryptoKey;
     publicKey: string;
 }
 export interface ToolRequest {
@@ -97,6 +106,14 @@ export declare class ProofGenerator {
      */
     hashRequest(request: ToolRequest): Promise<string>;
     private generateCanonicalHashes;
+    /**
+     * Resolve the identity's signing key into the form jose signs with. A base64
+     * string is imported as a PKCS#8 key (the historical path); a `CryptoKey`
+     * handle — including a non-extractable one (passkey-PRF- or HSM/KMS-fronted)
+     * — is used as-is. Either way the caller never has to materialize secret key
+     * bytes for the library, per SPEC §4.5.
+     */
+    private resolveSigningKey;
     private generateJWS;
     private formatPrivateKeyAsPEM;
     verifyProof(proof: DetachedProof, request: ToolRequest, response?: ToolResponse): Promise<boolean>;

package/dist/proof/generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/proof/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EACV,aAAa,EAEb,cAAc,EACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,UAAU,CAAC;AAE7C,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,aAAa,CAAC;QACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,GAC3C,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBzD;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,cAAc,CAAiB;gBAE3B,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc;IAKxE;;;;;;;;;;;;OAYG;IACG,aAAa,CACjB,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,aAAa,CAAC;IAsBzB;;;OAGG;IACG,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;YAI1C,uBAAuB;YASvB,WAAW;IAyCzB,OAAO,CAAC,qBAAqB;IAqBvB,WAAW,CACf,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,YAAY,GACtB,OAAO,CAAC,OAAO,CAAC;IA4BnB,OAAO,CAAC,oBAAoB;CAc7B;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,cAAc,EACvB,cAAc,EAAE,cAAc,EAC9B,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,YAAY,CAAC,CAMvB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GACrB;IACD,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAQA"}
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/proof/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EACV,aAAa,EAEb,cAAc,EACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,UAAU,CAAC;AAE7C,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,aAAa,CAAC;QACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,GAC3C,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBzD;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,cAAc,CAAiB;gBAE3B,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc;IAKxE;;;;;;;;;;;;OAYG;IACG,aAAa,CACjB,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,aAAa,CAAC;IAsBzB;;;OAGG;IACG,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;YAI1C,uBAAuB;IASrC;;;;;;OAMG;YACW,iBAAiB;YAOjB,WAAW;IA2CzB,OAAO,CAAC,qBAAqB;IAqBvB,WAAW,CACf,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,YAAY,GACtB,OAAO,CAAC,OAAO,CAAC;IA4BnB,OAAO,CAAC,oBAAoB;CAc7B;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,cAAc,EACvB,cAAc,EAAE,cAAc,EAC9B,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,YAAY,CAAC,CAMvB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GACrB;IACD,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAQA"}

package/dist/proof/generator.js

@@ -108,10 +108,25 @@ export class ProofGenerator {
     async generateCanonicalHashes(request, response) {
         return computeCanonicalHashes(request, response, (bytes) => this.cryptoProvider.hash(bytes));
     }
+    /**
+     * Resolve the identity's signing key into the form jose signs with. A base64
+     * string is imported as a PKCS#8 key (the historical path); a `CryptoKey`
+     * handle — including a non-extractable one (passkey-PRF- or HSM/KMS-fronted)
+     * — is used as-is. Either way the caller never has to materialize secret key
+     * bytes for the library, per SPEC §4.5.
+     */
+    async resolveSigningKey() {
+        const key = this.identity.privateKey;
+        return typeof key === 'string'
+            ? importPKCS8(this.formatPrivateKeyAsPEM(key), 'EdDSA')
+            : key;
+    }
     async generateJWS(meta) {
         try {
-            const privateKeyPem = this.formatPrivateKeyAsPEM(this.identity.privateKey);
-            const privateKey = await importPKCS8(privateKeyPem, 'EdDSA');
+            // jose's CompactSign owns the JWS signing-input construction, so
+            // canonicalization stays inside the library and the signing input is the
+            // same regardless of how the signing key was supplied.
+            const privateKey = await this.resolveSigningKey();
             const payload = {
                 aud: meta.audience,
                 sub: meta.did,

package/dist/proof/generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../src/proof/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAOjD,OAAO,EAAE,aAAa,EAAmB,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAE3F;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AA8B7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAoB,EACpB,QAAkC,EAClC,IAA4C;IAE5C,MAAM,gBAAgB,GAAG;QACvB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAC5B,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,YAAY,CAAC,gBAAsD,CAAC,CACrE,CACF,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAC7B,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,YAAY,CAAC,QAAQ,CAAC,IAA0C,CAAC,CAClE,CACF,CAAC;IACF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,QAAQ,CAAqB;IAC7B,cAAc,CAAiB;IAEvC,YAAY,QAA4B,EAAE,cAA8B;QACtE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,aAAa,CACjB,OAAoB,EACpB,QAAkC,EAClC,OAAuB,EACvB,UAAwB,EAAE;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAErE,MAAM,IAAI,GAAc;YACtB,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;YACtB,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;YACtB,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACjC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;gBACvC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,OAAO;SACX,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAEzC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,OAAoB;QACpC,OAAO,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;IACnE,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,OAAoB,EACpB,QAAuB;QAEvB,OAAO,sBAAsB,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CACzD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAChC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAe;QACvC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3E,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YAE7D,MAAM,OAAO,GAAG;gBACd,GAAG,EAAE,IAAI,CAAC,QAAQ;gBAClB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC3E,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9C,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;gBAChE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;aAC5C,CAAC;YAEF,6EAA6E;YAC7E,gFAAgF;YAChF,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAA6C,CAAC,CAAC;YACrF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAEhE,MAAM,GAAG,GAAG,MAAM,IAAI,WAAW,CAAC,YAAY,CAAC;iBAC5C,kBAAkB,CAAC;gBAClB,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;aACvB,CAAC;iBACD,IAAI,CAAC,UAAU,CAAC,CAAC;YAEpB,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,qBAAqB,CAAC,gBAAwB;QACpD,MAAM,OAAO,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAEhD,2BAA2B;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAErD,0CAA0C;QAC1C,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,wBAAwB,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAErD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;QAE1E,OAAO,CACL,+BAA+B;YAC/B,YAAY;YACZ,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CACf,KAAoB,EACpB,OAAoB,EACpB,QAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAE7E,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC1C,IACE,cAAc,CAAC,YAAY,KAAK,SAAS;oBACzC,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,cAAc,CAAC,YAAY,EACvD,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAE7D,OAAO,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE;gBACtD,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;gBAC9B,GAAG,EAAE,OAAO;aACb,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,eAAuB;QAClD,MAAM,cAAc,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;QAEtD,IAAI,cAAc,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,OAAO;YACL,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,SAAS;YACd,CAAC,EAAE,wBAAwB,CAAC,cAAc,CAAC;YAC3C,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;SACvB,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAoB,EACpB,IAAa,EACb,QAA4B,EAC5B,OAAuB,EACvB,cAA8B,EAC9B,UAAwB,EAAE;IAE1B,MAAM,QAAQ,GAAiB,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACtF,QAAQ,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC;IAC1B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAoB,EACpB,QAAsB;IAKtB,OAAO;QACL,OAAO,EAAE;YACP,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,QAAQ,EAAE,QAAQ,CAAC,IAAI;KACxB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../src/proof/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAOjD,OAAO,EAAE,aAAa,EAAmB,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAE3F;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAuC7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAoB,EACpB,QAAkC,EAClC,IAA4C;IAE5C,MAAM,gBAAgB,GAAG;QACvB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAC5B,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,YAAY,CAAC,gBAAsD,CAAC,CACrE,CACF,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAC7B,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,YAAY,CAAC,QAAQ,CAAC,IAA0C,CAAC,CAClE,CACF,CAAC;IACF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,QAAQ,CAAqB;IAC7B,cAAc,CAAiB;IAEvC,YAAY,QAA4B,EAAE,cAA8B;QACtE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,aAAa,CACjB,OAAoB,EACpB,QAAkC,EAClC,OAAuB,EACvB,UAAwB,EAAE;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAErE,MAAM,IAAI,GAAc;YACtB,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;YACtB,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;YACtB,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACjC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;gBACvC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,OAAO;SACX,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAEzC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,OAAoB;QACpC,OAAO,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;IACnE,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,OAAoB,EACpB,QAAuB;QAEvB,OAAO,sBAAsB,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CACzD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAChC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,iBAAiB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACrC,OAAO,OAAO,GAAG,KAAK,QAAQ;YAC5B,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;YACvD,CAAC,CAAC,GAAG,CAAC;IACV,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAe;QACvC,IAAI,CAAC;YACH,iEAAiE;YACjE,yEAAyE;YACzE,uDAAuD;YACvD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAElD,MAAM,OAAO,GAAG;gBACd,GAAG,EAAE,IAAI,CAAC,QAAQ;gBAClB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC3E,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9C,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;gBAChE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;aAC5C,CAAC;YAEF,6EAA6E;YAC7E,gFAAgF;YAChF,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAA6C,CAAC,CAAC;YACrF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAEhE,MAAM,GAAG,GAAG,MAAM,IAAI,WAAW,CAAC,YAAY,CAAC;iBAC5C,kBAAkB,CAAC;gBAClB,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;aACvB,CAAC;iBACD,IAAI,CAAC,UAAU,CAAC,CAAC;YAEpB,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,qBAAqB,CAAC,gBAAwB;QACpD,MAAM,OAAO,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAEhD,2BAA2B;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAErD,0CAA0C;QAC1C,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,wBAAwB,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAErD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;QAE1E,OAAO,CACL,+BAA+B;YAC/B,YAAY;YACZ,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CACf,KAAoB,EACpB,OAAoB,EACpB,QAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAE7E,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC1C,IACE,cAAc,CAAC,YAAY,KAAK,SAAS;oBACzC,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,cAAc,CAAC,YAAY,EACvD,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAE7D,OAAO,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE;gBACtD,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;gBAC9B,GAAG,EAAE,OAAO;aACb,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,eAAuB;QAClD,MAAM,cAAc,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;QAEtD,IAAI,cAAc,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,OAAO;YACL,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,SAAS;YACd,CAAC,EAAE,wBAAwB,CAAC,cAAc,CAAC;YAC3C,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;SACvB,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAoB,EACpB,IAAa,EACb,QAA4B,EAC5B,OAAuB,EACvB,cAA8B,EAC9B,UAAwB,EAAE;IAE1B,MAAM,QAAQ,GAAiB,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACtF,QAAQ,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC;IAC1B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAoB,EACpB,QAAsB;IAKtB,OAAO;QACL,OAAO,EAAE;YACP,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,QAAQ,EAAE,QAAQ,CAAC,IAAI;KACxB,CAAC;AACJ,CAAC"}

package/dist/providers/runtime-fetch.d.ts

@@ -30,6 +30,7 @@
  * ```
  */
 import { FetchProvider } from "./base.js";
+import { type DIDResolverRegistry } from "../delegation/did-resolver-registry.js";
 import type { DIDDocument } from "../delegation/vc-verifier.js";
 import type { StatusList2021Credential, DelegationRecord } from "../types/protocol.js";
 export interface RuntimeFetchProviderOptions {
@@ -39,10 +40,17 @@ export interface RuntimeFetchProviderOptions {
      * trusted internal deployments.
      */
     allowPrivateNetworkHosts?: boolean;
+    /**
+     * Optional DID method resolver registry. Entries dispatch by DID method before
+     * built-in did:key and did:web fallback. A factory receives this fetch provider
+     * so network-backed resolvers can share the same fetch implementation.
+     */
+    didResolvers?: DIDResolverRegistry;
 }
 export declare class RuntimeFetchProvider extends FetchProvider {
     private readonly didKeyResolver;
     private didWebResolver;
+    private readonly didResolvers;
     private readonly allowPrivateNetworkHosts;
     constructor(options?: RuntimeFetchProviderOptions);
     /**

package/dist/providers/runtime-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-fetch.d.ts","sourceRoot":"","sources":["../../src/providers/runtime-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAO1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EACV,wBAAwB,EACxB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,qBAAa,oBAAqB,SAAQ,aAAa;IACrD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA0B;IACzD,OAAO,CAAC,cAAc,CAAsD;IAC5E,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAU;gBAEvC,OAAO,CAAC,EAAE,2BAA2B;IAMjD;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAkB1D;;;;;OAKG;IACG,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAgB5E;;;;OAIG;IACG,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAIpE,yEAAyE;IACnE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAO9D,iFAAiF;IACjF,OAAO,CAAC,eAAe;CAYxB;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAkB,SAAQ,aAAa;IAC5C,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAGrD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAGvE,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAG9D,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CAGjE"}
+{"version":3,"file":"runtime-fetch.d.ts","sourceRoot":"","sources":["../../src/providers/runtime-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAO1C,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EACV,wBAAwB,EACxB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;OAIG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACpC;AAED,qBAAa,oBAAqB,SAAQ,aAAa;IACrD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA0B;IACzD,OAAO,CAAC,cAAc,CAAsD;IAC5E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwE;IACrG,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAU;gBAEvC,OAAO,CAAC,EAAE,2BAA2B;IAOjD;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA+B1D;;;;;OAKG;IACG,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAgB5E;;;;OAIG;IACG,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAIpE,yEAAyE;IACnE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAO9D,iFAAiF;IACjF,OAAO,CAAC,eAAe;CAYxB;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAkB,SAAQ,aAAa;IAC5C,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAGrD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAGvE,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAG9D,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CAGjE"}

package/dist/providers/runtime-fetch.js

@@ -32,14 +32,18 @@
 import { FetchProvider } from "./base.js";
 import { createDidKeyResolver } from "../delegation/did-key-resolver.js";
 import { createDidWebResolver, isDidWeb, didWebToUrl, } from "../delegation/did-web-resolver.js";
+import { buildDidResolverRegistry, } from "../delegation/did-resolver-registry.js";
+import { getDidMethod } from "../utils/did-helpers.js";
 export class RuntimeFetchProvider extends FetchProvider {
     didKeyResolver = createDidKeyResolver();
     didWebResolver;
+    didResolvers;
     allowPrivateNetworkHosts;
     constructor(options) {
         super();
         this.allowPrivateNetworkHosts =
             options?.allowPrivateNetworkHosts ?? false;
+        this.didResolvers = buildDidResolverRegistry(options?.didResolvers, this);
     }
     /**
      * Resolve a DID to its DID Document. did:key is decoded locally (no network);
@@ -48,6 +52,19 @@ export class RuntimeFetchProvider extends FetchProvider {
      * resolution failure (never throws).
      */
     async resolveDID(did) {
+        const method = getDidMethod(did);
+        const configuredResolver = method ? this.didResolvers[method] : undefined;
+        if (configuredResolver) {
+            try {
+                const resolved = await configuredResolver.resolve(did);
+                if (resolved) {
+                    return resolved;
+                }
+            }
+            catch {
+                return null;
+            }
+        }
         if (did.startsWith("did:key:")) {
             return this.didKeyResolver.resolve(did);
         }

package/dist/providers/runtime-fetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-fetch.js","sourceRoot":"","sources":["../../src/providers/runtime-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,WAAW,GACZ,MAAM,mCAAmC,CAAC;AAgB3C,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IACpC,cAAc,GAAG,oBAAoB,EAAE,CAAC;IACjD,cAAc,CAAsD;IAC3D,wBAAwB,CAAU;IAEnD,YAAY,OAAqC;QAC/C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,wBAAwB;YAC3B,OAAO,EAAE,wBAAwB,IAAI,KAAK,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,GAAW;QAC1B,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,IAAI,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,0EAA0E;YAC1E,uEAAuE;YACvE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzB,IAAI,CAAC,cAAc,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,GAAW;QAC/B,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACvC,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,GAAW;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAiB;QACxC,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,OAAsB,CAAC,CAAC;IACvD,CAAC;IAED,iFAAiF;IACzE,eAAe,CAAC,GAAkB;QACxC,IAAI,IAAI,CAAC,wBAAwB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAkB,SAAQ,aAAa;IAClD,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,IAAY;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,oBAAoB,CAAC,GAAW;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,QAAkB;QAC1C,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;CACF;AAED,uEAAuE;AACvE,SAAS,0BAA0B,CACjC,KAAc;IAEd,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,KAAgC,CAAC;IAC9C,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAClD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,gBAAgB,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,sCAAsC;IAC5D,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,eAAe;QACf,OAAO,CACL,CAAC,KAAK,KAAK,IAAI,WAAW;YAC1B,CAAC,KAAK,IAAI,IAAI,cAAc;YAC5B,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,aAAa;YACtC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,wBAAwB;YAC9C,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CACnB,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,iCAAiC;IACjD,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,CACL,CAAC,KAAK,GAAG,IAAI,uBAAuB;QACpC,CAAC,KAAK,EAAE,IAAI,qBAAqB;QACjC,CAAC,KAAK,CAAC,IAAI,sCAAsC;QACjD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,6CAA6C;QACzE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,yBAAyB;QACrD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,wBAAwB;KAC3D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"runtime-fetch.js","sourceRoot":"","sources":["../../src/providers/runtime-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,WAAW,GACZ,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,wBAAwB,GAEzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAsBvD,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IACpC,cAAc,GAAG,oBAAoB,EAAE,CAAC;IACjD,cAAc,CAAsD;IAC3D,YAAY,CAAwE;IACpF,wBAAwB,CAAU;IAEnD,YAAY,OAAqC;QAC/C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,wBAAwB;YAC3B,OAAO,EAAE,wBAAwB,IAAI,KAAK,CAAC;QAC7C,IAAI,CAAC,YAAY,GAAG,wBAAwB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,GAAW;QAC1B,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,kBAAkB,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,kBAAkB,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACvD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,QAAQ,CAAC;gBAClB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,IAAI,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,0EAA0E;YAC1E,uEAAuE;YACvE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzB,IAAI,CAAC,cAAc,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,GAAW;QAC/B,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACvC,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,GAAW;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAiB;QACxC,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,OAAsB,CAAC,CAAC;IACvD,CAAC;IAED,iFAAiF;IACzE,eAAe,CAAC,GAAkB;QACxC,IAAI,IAAI,CAAC,wBAAwB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAkB,SAAQ,aAAa;IAClD,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,IAAY;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,oBAAoB,CAAC,GAAW;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,QAAkB;QAC1C,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;CACF;AAED,uEAAuE;AACvE,SAAS,0BAA0B,CACjC,KAAc;IAEd,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,KAAgC,CAAC;IAC9C,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAClD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,gBAAgB,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,sCAAsC;IAC5D,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,eAAe;QACf,OAAO,CACL,CAAC,KAAK,KAAK,IAAI,WAAW;YAC1B,CAAC,KAAK,IAAI,IAAI,cAAc;YAC5B,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,aAAa;YACtC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,wBAAwB;YAC9C,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CACnB,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,iCAAiC;IACjD,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,CACL,CAAC,KAAK,GAAG,IAAI,uBAAuB;QACpC,CAAC,KAAK,EAAE,IAAI,qBAAqB;QACjC,CAAC,KAAK,CAAC,IAAI,sCAAsC;QACjD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,6CAA6C;QACzE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,yBAAyB;QACrD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,wBAAwB;KAC3D,CAAC;AACJ,CAAC"}

package/dist/providers/web-crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-crypto.d.ts","sourceRoot":"","sources":["../../src/providers/web-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA4B3C,qBAAa,iBAAkB,SAAQ,cAAc;IAC7C,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAYrE,MAAM,CACV,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,UAAU,EACrB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC;IAWb,eAAe,IAAI,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAerE,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAKvC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAGvD"}
+{"version":3,"file":"web-crypto.d.ts","sourceRoot":"","sources":["../../src/providers/web-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA8C3C,qBAAa,iBAAkB,SAAQ,cAAc;IAC7C,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAYrE,MAAM,CACV,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,UAAU,EACrB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC;IAsBb,eAAe,IAAI,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAarE,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAKvC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAGvD"}

package/dist/providers/web-crypto.js

@@ -43,6 +43,16 @@ function toHex(bytes) {
         out += b.toString(16).padStart(2, "0");
     return out;
 }
+// WebCrypto's BufferSource requires a Uint8Array backed by a concrete
+// ArrayBuffer (not the wider ArrayBufferLike a bare `Uint8Array` type
+// admits). `.slice()` always allocates a fresh ArrayBuffer, so it doubles
+// as the narrowing conversion.
+function toBufferSource(bytes) {
+    return bytes.slice();
+}
+function isKeyPair(key) {
+    return "privateKey" in key && "publicKey" in key;
+}
 export class WebCryptoProvider extends CryptoProvider {
     async sign(data, privateKeyBase64) {
         const raw = base64ToBytes(privateKeyBase64);
@@ -52,14 +62,14 @@ export class WebCryptoProvider extends CryptoProvider {
         pkcs8.set(ED25519_PKCS8_PREFIX, 0);
         pkcs8.set(seed, ED25519_PKCS8_PREFIX.length);
         const key = await getCrypto().subtle.importKey("pkcs8", pkcs8, { name: ALG }, false, ["sign"]);
-        const sig = await getCrypto().subtle.sign({ name: ALG }, key, data);
+        const sig = await getCrypto().subtle.sign({ name: ALG }, key, toBufferSource(data));
         return new Uint8Array(sig);
     }
     async verify(data, signature, publicKeyBase64) {
         try {
             const raw = base64ToBytes(publicKeyBase64);
-            const key = await getCrypto().subtle.importKey("raw", raw, { name: ALG }, false, ["verify"]);
-            return await getCrypto().subtle.verify({ name: ALG }, key, signature, data);
+            const key = await getCrypto().subtle.importKey("raw", toBufferSource(raw), { name: ALG }, false, ["verify"]);
+            return await getCrypto().subtle.verify({ name: ALG }, key, toBufferSource(signature), toBufferSource(data));
         }
         catch {
             // Never throw on a bad key/signature — verification simply fails.
@@ -68,9 +78,7 @@ export class WebCryptoProvider extends CryptoProvider {
     }
     async generateKeyPair() {
         const kp = await getCrypto().subtle.generateKey({ name: ALG }, true, ["sign", "verify"]);
-        // generateKey returns CryptoKey | CryptoKeyPair; narrow to the pair without
-        // naming the DOM type (this file compiles without a DOM lib — see getCrypto).
-        if (!("publicKey" in kp)) {
+        if (!isKeyPair(kp)) {
             throw new Error("WebCryptoProvider: expected an Ed25519 key pair from generateKey");
         }
         const rawPub = new Uint8Array(await getCrypto().subtle.exportKey("raw", kp.publicKey));
@@ -81,7 +89,7 @@ export class WebCryptoProvider extends CryptoProvider {
         return { privateKey: bytesToBase64(seed), publicKey: bytesToBase64(rawPub) };
     }
     async hash(data) {
-        const digest = new Uint8Array(await getCrypto().subtle.digest("SHA-256", data));
+        const digest = new Uint8Array(await getCrypto().subtle.digest("SHA-256", toBufferSource(data)));
         return `sha256:${toHex(digest)}`;
     }
     async randomBytes(length) {

package/dist/providers/web-crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"web-crypto.js","sourceRoot":"","sources":["../../src/providers/web-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElE,MAAM,GAAG,GAAG,SAAkB,CAAC;AAE/B,yFAAyF;AACzF,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAAC;IAC3C,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CAC/F,CAAC,CAAC;AAEH,SAAS,SAAS;IAChB,wEAAwE;IACxE,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,cAAc;IACnD,KAAK,CAAC,IAAI,CAAC,IAAgB,EAAE,gBAAwB;QACnD,MAAM,GAAG,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC5C,wEAAwE;QACxE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;QACnC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACpE,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAgB,EAChB,SAAqB,EACrB,eAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7F,OAAO,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,4EAA4E;QAC5E,8EAA8E;QAC9E,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACzF,0EAA0E;QAC1E,wDAAwD;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC3F,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAChF,OAAO,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,SAAS,EAAE,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;CACF"}
+{"version":3,"file":"web-crypto.js","sourceRoot":"","sources":["../../src/providers/web-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElE,MAAM,GAAG,GAAG,SAAkB,CAAC;AAE/B,yFAAyF;AACzF,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAAC;IAC3C,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CAC/F,CAAC,CAAC;AAEH,SAAS,SAAS;IAChB,wEAAwE;IACxE,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sEAAsE;AACtE,sEAAsE;AACtE,0EAA0E;AAC1E,+BAA+B;AAC/B,SAAS,cAAc,CAAC,KAAiB;IACvC,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAQD,SAAS,SAAS,CAAC,GAAiB;IAClC,OAAO,YAAY,IAAI,GAAG,IAAI,WAAW,IAAI,GAAG,CAAC;AACnD,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,cAAc;IACnD,KAAK,CAAC,IAAI,CAAC,IAAgB,EAAE,gBAAwB;QACnD,MAAM,GAAG,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC5C,wEAAwE;QACxE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;QACnC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QACpF,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAgB,EAChB,SAAqB,EACrB,eAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAC5C,KAAK,EACL,cAAc,CAAC,GAAG,CAAC,EACnB,EAAE,IAAI,EAAE,GAAG,EAAE,EACb,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,OAAO,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CACpC,EAAE,IAAI,EAAE,GAAG,EAAE,EACb,GAAG,EACH,cAAc,CAAC,SAAS,CAAC,EACzB,cAAc,CAAC,IAAI,CAAC,CACrB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACzF,0EAA0E;QAC1E,wDAAwD;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC3F,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChG,OAAO,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,SAAS,EAAE,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/utils/guards.d.ts

@@ -0,0 +1,2 @@
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+//# sourceMappingURL=guards.d.ts.map

package/dist/utils/guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/utils/guards.ts"],"names":[],"mappings":"AAAA,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE"}

package/dist/utils/guards.js

@@ -0,0 +1,4 @@
+export function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=guards.js.map

package/dist/utils/guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/utils/guards.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/utils/index.d.ts

@@ -2,4 +2,7 @@
  * Utility exports
  */
 export { ED25519_PKCS8_DER_HEADER, ED25519_SPKI_DER_HEADER_LENGTH, ED25519_KEY_SIZE, } from './ed25519-constants.js';
+export { isRecord } from './guards.js';
+export { stripTrailingSlashes } from './url.js';
+export { createSafeFetch, fetchTransport, isBlockedAddress, type SafeFetch, type SafeFetchResponse, type SafeFetchOptions, type SafeFetchTransport, type TransportInit, type RawResponse, type DnsLookup, type DnsAddress, } from './safe-fetch.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,iBAAiB,CAAC"}

package/dist/utils/index.js

@@ -2,4 +2,7 @@
  * Utility exports
  */
 export { ED25519_PKCS8_DER_HEADER, ED25519_SPKI_DER_HEADER_LENGTH, ED25519_KEY_SIZE, } from './ed25519-constants.js';
+export { isRecord } from './guards.js';
+export { stripTrailingSlashes } from './url.js';
+export { createSafeFetch, fetchTransport, isBlockedAddress, } from './safe-fetch.js';
 //# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,GASjB,MAAM,iBAAiB,CAAC"}

package/dist/utils/ip-classifier.d.ts

@@ -0,0 +1,12 @@
+/**
+ * SSRF address policy — classify a resolved IP as public unicast or not.
+ *
+ * Pure, I/O-free RFC classification extracted from `./safe-fetch` so the "which addresses may we
+ * connect to" decision is one cohesive, independently-testable unit. Every predicate FAILS CLOSED:
+ * an unparseable literal classifies as blocked. IPv6 is classified by its 16 canonical bytes (not
+ * its textual form), and every IPv4-bearing transition range (v4-mapped, NAT64, 6to4, v4-compatible)
+ * folds down to its embedded v4 so a private tail cannot slip through a v6 wrapper.
+ */
+/** True if an address must NOT be connected to (classified by shape, not by trusting `family`). */
+export declare function isBlockedAddress(address: string): boolean;
+//# sourceMappingURL=ip-classifier.d.ts.map

package/dist/utils/ip-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-classifier.d.ts","sourceRoot":"","sources":["../../src/utils/ip-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6GH,mGAAmG;AACnG,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzD"}