@kya-os/mcp 1.7.0 → 1.9.0

package/dist/middleware/with-kya-os.types.d.ts

@@ -0,0 +1,178 @@
+/**
+ * KYA-OS Middleware — public API-surface types.
+ *
+ * The tool, call-context, and role interfaces for `createKyaOsMiddleware` /
+ * `withKyaOs`, separated from the implementation (`./with-kya-os.ts`). The
+ * configuration INPUT types live in `./with-kya-os.config-types.ts` and are
+ * re-exported below, so every existing `import { KyaOsConfig } from './with-kya-os'`
+ * is unchanged.
+ */
+import type { SessionManager } from "../session/manager.js";
+import type { ProofGenerator } from "../proof/generator.js";
+import type { NeedsAuthorizationError } from "../types/protocol.js";
+import type { PolicyEngine } from "../policy/engine.js";
+import type { RiskClassifier } from "../policy/classifier.js";
+import type { ApprovalGrant } from "../policy/approval.js";
+import type { KyaOsIdentityConfig } from "./with-kya-os.config-types.js";
+export * from "./with-kya-os.config-types.js";
+export interface KyaOsToolDefinition {
+    name: string;
+    description?: string;
+    inputSchema: {
+        type: "object";
+        properties?: Record<string, unknown>;
+        required?: string[];
+        [key: string]: unknown;
+    };
+}
+/**
+ * Per-call context threaded through the middleware wrappers (not part of the
+ * tool's public arguments). `wrapWithDelegation` populates `scopeId` so the
+ * proof and audit record reflect the scope the call was authorized under.
+ */
+export interface KyaOsCallContext {
+    scopeId?: string;
+}
+export interface KyaOsToolHandler<T extends Record<string, unknown> = Record<string, unknown>> {
+    (args: T, sessionId?: string, context?: KyaOsCallContext): Promise<{
+        content: Array<{
+            type: string;
+            text: string;
+            [key: string]: unknown;
+        }>;
+        isError?: boolean;
+        [key: string]: unknown;
+    }>;
+}
+/**
+ * Server interface — minimal subset of @modelcontextprotocol/sdk Server.
+ * This avoids a hard dependency on the SDK at the type level.
+ */
+export interface KyaOsServer {
+    setRequestHandler(schema: unknown, handler: (...args: unknown[]) => unknown): void;
+}
+/** Route the unified `_kyaos` protocol action (and the deprecated handshake). */
+export interface KyaOsProtocolHandler {
+    /**
+     * Handle a unified `_kyaos` action. Use this in your CallToolRequest handler
+     * when `request.params.name === '_kyaos'`.
+     */
+    handleKyaOs(args: Record<string, unknown>): Promise<{
+        content: Array<{
+            type: string;
+            text: string;
+        }>;
+        isError?: boolean;
+    }>;
+    /**
+     * @deprecated Use `handleKyaOs` with `action: "handshake"`.
+     * Handle a handshake call. Use this in your CallToolRequest handler
+     * when `request.params.name === '_kyaos_handshake'`.
+     */
+    handleHandshake(args: Record<string, unknown>): Promise<{
+        content: Array<{
+            type: string;
+            text: string;
+        }>;
+        isError?: boolean;
+    }>;
+}
+/** Wrap a tool handler to automatically attach holder-of-key proofs. */
+export interface KyaOsProofAttacher {
+    /**
+     * Wrap a tool handler to automatically generate proofs.
+     * Returns a new handler that appends proof metadata to the response.
+     */
+    wrapWithProof<T extends Record<string, unknown> = Record<string, unknown>>(toolName: string, handler: KyaOsToolHandler<T>): KyaOsToolHandler;
+}
+/** Wrap a tool handler to require a valid W3C Delegation Credential. */
+export interface KyaOsDelegationGate {
+    /**
+     * Wrap a tool handler to require a valid W3C Delegation Credential.
+     *
+     * Caller must pass the VC as `_kyaos_delegation` in the tool args.
+     * - If absent: returns a `needs_authorization` response with the consentUrl.
+     * - If present but invalid: returns a structured error with reason.
+     * - If valid with correct scope: strips `_kyaos_delegation` and calls the handler.
+     */
+    wrapWithDelegation(toolName: string, config: {
+        scopeId: string;
+        consentUrl: string;
+        /**
+         * Optional presentation hook for the `needs_authorization` challenge.
+         * Given the structured challenge, return the tool-response content to emit
+         * (e.g. a markdown "Authorize" link for LLM / chat-style MCP clients that
+         * won't parse raw JSON). The signed challenge proof binds a `responseHash`
+         * over WHATEVER this returns, so the `authorizationUrl` stays tamper-evident
+         * regardless of presentation. Defaults to the structured challenge as JSON.
+         */
+        formatChallenge?: (challenge: NeedsAuthorizationError) => Array<{
+            type: "text";
+            text: string;
+        }>;
+    }, handler: KyaOsToolHandler): KyaOsToolHandler;
+}
+/** Wrap a tool handler with a per-action policy / step-up gate. */
+export interface KyaOsPolicyGate {
+    /**
+     * Wrap a tool handler with a per-action policy / step-up gate.
+     *
+     * Compose after `wrapWithDelegation`. Classifies the action's risk and asks a
+     * pluggable PolicyEngine: allow → run handler; deny → signed denial proof;
+     * step_up → `needs_approval` until N-of-M signed approval grants (bound to the
+     * request hash) are supplied.
+     */
+    withPolicyGate(toolName: string, handler: KyaOsToolHandler, opts?: PolicyGateOptions): KyaOsToolHandler;
+}
+/**
+ * The full middleware surface = the exposed components PLUS the four wrapping
+ * ROLES ({@link KyaOsProtocolHandler}, {@link KyaOsProofAttacher},
+ * {@link KyaOsDelegationGate}, {@link KyaOsPolicyGate}). Prefer depending on a
+ * single role where a caller only needs one; this composition keeps the flat API
+ * for back-compat while satisfying the Interface Segregation Principle.
+ */
+export interface KyaOsMiddleware extends KyaOsProtocolHandler, KyaOsProofAttacher, KyaOsDelegationGate {
+    /** The identity config used by this middleware instance */
+    identity: KyaOsIdentityConfig;
+    /** The SessionManager instance for manual session operations */
+    sessionManager: SessionManager;
+    /** The ProofGenerator instance for manual proof operations */
+    proofGenerator: ProofGenerator;
+    /**
+     * Unified tool definition for `_kyaos`.
+     * Include this in your ListToolsRequest handler's tool list.
+     */
+    kyaOsTool: KyaOsToolDefinition;
+    /**
+     * @deprecated Use `kyaOsTool` (`_kyaos` with `action: "handshake"`).
+     * Tool definition for `_kyaos_handshake`.
+     * Include this in your ListToolsRequest handler's tool list.
+     */
+    handshakeTool: KyaOsToolDefinition;
+    withPolicyGate?: KyaOsPolicyGate["withPolicyGate"];
+}
+export interface PolicyGateOptions {
+    /** Policy decision engine. Defaults to a fail-closed DefaultPolicyEngine. */
+    engine?: PolicyEngine;
+    /** Risk classifier. Defaults to the built-in RiskClassifier. */
+    classifier?: RiskClassifier;
+    /** Derive the resource namespace from the tool args (defaults to the tool name). */
+    resolveNamespace?: (args: Record<string, unknown>) => string;
+    /** Tool-arg key carrying approval grants on resume. Default "_kyaos_approvals". */
+    approvalsArgKey?: string;
+    /** Verifier for approval-grant signatures (identity-layer). Default: reject all. */
+    isValidApprovalSignature?: (grant: ApprovalGrant) => Promise<boolean>;
+    /**
+     * Whether a prior step already authorized this action's scope/identity.
+     *
+     * Defaults to FALSE (fail-closed): used standalone, withPolicyGate enforces no
+     * scope or identity, so it must NOT be trusted to allow on its own. When you
+     * compose it AFTER wrapWithDelegation (the expected usage), pass
+     * `scopeMatched: true` to signal that the delegated scope was already verified.
+     * Note: principal facts are projected from the (unverified) `_kyaos_delegation`
+     * arg on a best-effort basis and must not be treated as authenticated unless
+     * wrapWithDelegation ran first.
+     */
+    scopeMatched?: boolean;
+}
+//# sourceMappingURL=with-kya-os.types.d.ts.map

package/dist/middleware/with-kya-os.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-kya-os.types.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAIzE,cAAc,+BAA+B,CAAC;AAE9C,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB,CAC/B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE3D,CACE,IAAI,EAAE,CAAC,EACP,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC;QACT,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC,CAAC;QACvE,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC,CAAC;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,iBAAiB,CACf,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,GACvC,IAAI,CAAC;CACT;AAQD,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QAClD,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IAEH;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;CACJ;AAED,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvE,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAC3B,gBAAgB,CAAC;CACrB;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,kBAAkB,CAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB;;;;;;;WAOG;QACH,eAAe,CAAC,EAAE,CAChB,SAAS,EAAE,uBAAuB,KAC/B,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC5C,EACD,OAAO,EAAE,gBAAgB,GACxB,gBAAgB,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B;;;;;;;OAOG;IACH,cAAc,CACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,EACzB,IAAI,CAAC,EAAE,iBAAiB,GACvB,gBAAgB,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eACf,SAAQ,oBAAoB,EAC1B,kBAAkB,EAClB,mBAAmB;IACrB,2DAA2D;IAC3D,QAAQ,EAAE,mBAAmB,CAAC;IAE9B,gEAAgE;IAChE,cAAc,EAAE,cAAc,CAAC;IAE/B,8DAA8D;IAC9D,cAAc,EAAE,cAAc,CAAC;IAE/B;;;OAGG;IACH,SAAS,EAAE,mBAAmB,CAAC;IAE/B;;;;OAIG;IACH,aAAa,EAAE,mBAAmB,CAAC;IAInC,cAAc,CAAC,EAAE,eAAe,CAAC,gBAAgB,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,gEAAgE;IAChE,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC;IAC7D,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,wBAAwB,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB"}

package/dist/middleware/with-kya-os.types.js

@@ -0,0 +1,13 @@
+/**
+ * KYA-OS Middleware — public API-surface types.
+ *
+ * The tool, call-context, and role interfaces for `createKyaOsMiddleware` /
+ * `withKyaOs`, separated from the implementation (`./with-kya-os.ts`). The
+ * configuration INPUT types live in `./with-kya-os.config-types.ts` and are
+ * re-exported below, so every existing `import { KyaOsConfig } from './with-kya-os'`
+ * is unchanged.
+ */
+// The configuration input types (KyaOsConfig, KyaOsDelegationConfig, …) live in
+// ./with-kya-os.config-types.ts; re-export them so importers are unchanged.
+export * from "./with-kya-os.config-types.js";
+//# sourceMappingURL=with-kya-os.types.js.map

package/dist/middleware/with-kya-os.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-kya-os.types.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAUH,gFAAgF;AAChF,4EAA4E;AAC5E,cAAc,+BAA+B,CAAC"}

package/dist/providers/runtime-fetch.d.ts

@@ -30,6 +30,7 @@
  * ```
  */
 import { FetchProvider } from "./base.js";
+import { type DIDResolverRegistry } from "../delegation/did-resolver-registry.js";
 import type { DIDDocument } from "../delegation/vc-verifier.js";
 import type { StatusList2021Credential, DelegationRecord } from "../types/protocol.js";
 export interface RuntimeFetchProviderOptions {
@@ -39,10 +40,17 @@ export interface RuntimeFetchProviderOptions {
      * trusted internal deployments.
      */
     allowPrivateNetworkHosts?: boolean;
+    /**
+     * Optional DID method resolver registry. Entries dispatch by DID method before
+     * built-in did:key and did:web fallback. A factory receives this fetch provider
+     * so network-backed resolvers can share the same fetch implementation.
+     */
+    didResolvers?: DIDResolverRegistry;
 }
 export declare class RuntimeFetchProvider extends FetchProvider {
     private readonly didKeyResolver;
     private didWebResolver;
+    private readonly didResolvers;
     private readonly allowPrivateNetworkHosts;
     constructor(options?: RuntimeFetchProviderOptions);
     /**

package/dist/providers/runtime-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-fetch.d.ts","sourceRoot":"","sources":["../../src/providers/runtime-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAO1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EACV,wBAAwB,EACxB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,qBAAa,oBAAqB,SAAQ,aAAa;IACrD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA0B;IACzD,OAAO,CAAC,cAAc,CAAsD;IAC5E,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAU;gBAEvC,OAAO,CAAC,EAAE,2BAA2B;IAMjD;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAkB1D;;;;;OAKG;IACG,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAgB5E;;;;OAIG;IACG,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAIpE,yEAAyE;IACnE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAO9D,iFAAiF;IACjF,OAAO,CAAC,eAAe;CAYxB;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAkB,SAAQ,aAAa;IAC5C,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAGrD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAGvE,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAG9D,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CAGjE"}
+{"version":3,"file":"runtime-fetch.d.ts","sourceRoot":"","sources":["../../src/providers/runtime-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAO1C,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EACV,wBAAwB,EACxB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;OAIG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACpC;AAED,qBAAa,oBAAqB,SAAQ,aAAa;IACrD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA0B;IACzD,OAAO,CAAC,cAAc,CAAsD;IAC5E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwE;IACrG,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAU;gBAEvC,OAAO,CAAC,EAAE,2BAA2B;IAOjD;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA+B1D;;;;;OAKG;IACG,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAgB5E;;;;OAIG;IACG,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAIpE,yEAAyE;IACnE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAO9D,iFAAiF;IACjF,OAAO,CAAC,eAAe;CAYxB;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAkB,SAAQ,aAAa;IAC5C,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAGrD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAGvE,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAG9D,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CAGjE"}

package/dist/providers/runtime-fetch.js

@@ -32,14 +32,18 @@
 import { FetchProvider } from "./base.js";
 import { createDidKeyResolver } from "../delegation/did-key-resolver.js";
 import { createDidWebResolver, isDidWeb, didWebToUrl, } from "../delegation/did-web-resolver.js";
+import { buildDidResolverRegistry, } from "../delegation/did-resolver-registry.js";
+import { getDidMethod } from "../utils/did-helpers.js";
 export class RuntimeFetchProvider extends FetchProvider {
     didKeyResolver = createDidKeyResolver();
     didWebResolver;
+    didResolvers;
     allowPrivateNetworkHosts;
     constructor(options) {
         super();
         this.allowPrivateNetworkHosts =
             options?.allowPrivateNetworkHosts ?? false;
+        this.didResolvers = buildDidResolverRegistry(options?.didResolvers, this);
     }
     /**
      * Resolve a DID to its DID Document. did:key is decoded locally (no network);
@@ -48,6 +52,19 @@ export class RuntimeFetchProvider extends FetchProvider {
      * resolution failure (never throws).
      */
     async resolveDID(did) {
+        const method = getDidMethod(did);
+        const configuredResolver = method ? this.didResolvers[method] : undefined;
+        if (configuredResolver) {
+            try {
+                const resolved = await configuredResolver.resolve(did);
+                if (resolved) {
+                    return resolved;
+                }
+            }
+            catch {
+                return null;
+            }
+        }
         if (did.startsWith("did:key:")) {
             return this.didKeyResolver.resolve(did);
         }

package/dist/providers/runtime-fetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-fetch.js","sourceRoot":"","sources":["../../src/providers/runtime-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,WAAW,GACZ,MAAM,mCAAmC,CAAC;AAgB3C,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IACpC,cAAc,GAAG,oBAAoB,EAAE,CAAC;IACjD,cAAc,CAAsD;IAC3D,wBAAwB,CAAU;IAEnD,YAAY,OAAqC;QAC/C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,wBAAwB;YAC3B,OAAO,EAAE,wBAAwB,IAAI,KAAK,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,GAAW;QAC1B,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,IAAI,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,0EAA0E;YAC1E,uEAAuE;YACvE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzB,IAAI,CAAC,cAAc,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,GAAW;QAC/B,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACvC,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,GAAW;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAiB;QACxC,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,OAAsB,CAAC,CAAC;IACvD,CAAC;IAED,iFAAiF;IACzE,eAAe,CAAC,GAAkB;QACxC,IAAI,IAAI,CAAC,wBAAwB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAkB,SAAQ,aAAa;IAClD,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,IAAY;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,oBAAoB,CAAC,GAAW;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,QAAkB;QAC1C,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;CACF;AAED,uEAAuE;AACvE,SAAS,0BAA0B,CACjC,KAAc;IAEd,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,KAAgC,CAAC;IAC9C,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAClD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,gBAAgB,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,sCAAsC;IAC5D,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,eAAe;QACf,OAAO,CACL,CAAC,KAAK,KAAK,IAAI,WAAW;YAC1B,CAAC,KAAK,IAAI,IAAI,cAAc;YAC5B,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,aAAa;YACtC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,wBAAwB;YAC9C,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CACnB,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,iCAAiC;IACjD,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,CACL,CAAC,KAAK,GAAG,IAAI,uBAAuB;QACpC,CAAC,KAAK,EAAE,IAAI,qBAAqB;QACjC,CAAC,KAAK,CAAC,IAAI,sCAAsC;QACjD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,6CAA6C;QACzE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,yBAAyB;QACrD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,wBAAwB;KAC3D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"runtime-fetch.js","sourceRoot":"","sources":["../../src/providers/runtime-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,WAAW,GACZ,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,wBAAwB,GAEzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAsBvD,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IACpC,cAAc,GAAG,oBAAoB,EAAE,CAAC;IACjD,cAAc,CAAsD;IAC3D,YAAY,CAAwE;IACpF,wBAAwB,CAAU;IAEnD,YAAY,OAAqC;QAC/C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,wBAAwB;YAC3B,OAAO,EAAE,wBAAwB,IAAI,KAAK,CAAC;QAC7C,IAAI,CAAC,YAAY,GAAG,wBAAwB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,GAAW;QAC1B,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,kBAAkB,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,kBAAkB,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACvD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,QAAQ,CAAC;gBAClB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,IAAI,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,0EAA0E;YAC1E,uEAAuE;YACvE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzB,IAAI,CAAC,cAAc,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,GAAW;QAC/B,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACvC,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,GAAW;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAiB;QACxC,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,OAAsB,CAAC,CAAC;IACvD,CAAC;IAED,iFAAiF;IACzE,eAAe,CAAC,GAAkB;QACxC,IAAI,IAAI,CAAC,wBAAwB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAkB,SAAQ,aAAa;IAClD,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,IAAY;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,oBAAoB,CAAC,GAAW;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,QAAkB;QAC1C,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;CACF;AAED,uEAAuE;AACvE,SAAS,0BAA0B,CACjC,KAAc;IAEd,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,KAAgC,CAAC;IAC9C,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAClD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,gBAAgB,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,sCAAsC;IAC5D,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,eAAe;QACf,OAAO,CACL,CAAC,KAAK,KAAK,IAAI,WAAW;YAC1B,CAAC,KAAK,IAAI,IAAI,cAAc;YAC5B,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,aAAa;YACtC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,wBAAwB;YAC9C,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CACnB,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,iCAAiC;IACjD,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,CACL,CAAC,KAAK,GAAG,IAAI,uBAAuB;QACpC,CAAC,KAAK,EAAE,IAAI,qBAAqB;QACjC,CAAC,KAAK,CAAC,IAAI,sCAAsC;QACjD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,6CAA6C;QACzE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,yBAAyB;QACrD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,wBAAwB;KAC3D,CAAC;AACJ,CAAC"}

package/dist/providers/web-crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-crypto.d.ts","sourceRoot":"","sources":["../../src/providers/web-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA4B3C,qBAAa,iBAAkB,SAAQ,cAAc;IAC7C,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAYrE,MAAM,CACV,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,UAAU,EACrB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC;IAWb,eAAe,IAAI,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAerE,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAKvC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAGvD"}
+{"version":3,"file":"web-crypto.d.ts","sourceRoot":"","sources":["../../src/providers/web-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA8C3C,qBAAa,iBAAkB,SAAQ,cAAc;IAC7C,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAYrE,MAAM,CACV,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,UAAU,EACrB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC;IAsBb,eAAe,IAAI,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAarE,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAKvC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAGvD"}

package/dist/providers/web-crypto.js

@@ -43,6 +43,16 @@ function toHex(bytes) {
         out += b.toString(16).padStart(2, "0");
     return out;
 }
+// WebCrypto's BufferSource requires a Uint8Array backed by a concrete
+// ArrayBuffer (not the wider ArrayBufferLike a bare `Uint8Array` type
+// admits). `.slice()` always allocates a fresh ArrayBuffer, so it doubles
+// as the narrowing conversion.
+function toBufferSource(bytes) {
+    return bytes.slice();
+}
+function isKeyPair(key) {
+    return "privateKey" in key && "publicKey" in key;
+}
 export class WebCryptoProvider extends CryptoProvider {
     async sign(data, privateKeyBase64) {
         const raw = base64ToBytes(privateKeyBase64);
@@ -52,14 +62,14 @@ export class WebCryptoProvider extends CryptoProvider {
         pkcs8.set(ED25519_PKCS8_PREFIX, 0);
         pkcs8.set(seed, ED25519_PKCS8_PREFIX.length);
         const key = await getCrypto().subtle.importKey("pkcs8", pkcs8, { name: ALG }, false, ["sign"]);
-        const sig = await getCrypto().subtle.sign({ name: ALG }, key, data);
+        const sig = await getCrypto().subtle.sign({ name: ALG }, key, toBufferSource(data));
         return new Uint8Array(sig);
     }
     async verify(data, signature, publicKeyBase64) {
         try {
             const raw = base64ToBytes(publicKeyBase64);
-            const key = await getCrypto().subtle.importKey("raw", raw, { name: ALG }, false, ["verify"]);
-            return await getCrypto().subtle.verify({ name: ALG }, key, signature, data);
+            const key = await getCrypto().subtle.importKey("raw", toBufferSource(raw), { name: ALG }, false, ["verify"]);
+            return await getCrypto().subtle.verify({ name: ALG }, key, toBufferSource(signature), toBufferSource(data));
         }
         catch {
             // Never throw on a bad key/signature — verification simply fails.
@@ -68,9 +78,7 @@ export class WebCryptoProvider extends CryptoProvider {
     }
     async generateKeyPair() {
         const kp = await getCrypto().subtle.generateKey({ name: ALG }, true, ["sign", "verify"]);
-        // generateKey returns CryptoKey | CryptoKeyPair; narrow to the pair without
-        // naming the DOM type (this file compiles without a DOM lib — see getCrypto).
-        if (!("publicKey" in kp)) {
+        if (!isKeyPair(kp)) {
             throw new Error("WebCryptoProvider: expected an Ed25519 key pair from generateKey");
         }
         const rawPub = new Uint8Array(await getCrypto().subtle.exportKey("raw", kp.publicKey));
@@ -81,7 +89,7 @@ export class WebCryptoProvider extends CryptoProvider {
         return { privateKey: bytesToBase64(seed), publicKey: bytesToBase64(rawPub) };
     }
     async hash(data) {
-        const digest = new Uint8Array(await getCrypto().subtle.digest("SHA-256", data));
+        const digest = new Uint8Array(await getCrypto().subtle.digest("SHA-256", toBufferSource(data)));
         return `sha256:${toHex(digest)}`;
     }
     async randomBytes(length) {

package/dist/providers/web-crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"web-crypto.js","sourceRoot":"","sources":["../../src/providers/web-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElE,MAAM,GAAG,GAAG,SAAkB,CAAC;AAE/B,yFAAyF;AACzF,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAAC;IAC3C,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CAC/F,CAAC,CAAC;AAEH,SAAS,SAAS;IAChB,wEAAwE;IACxE,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,cAAc;IACnD,KAAK,CAAC,IAAI,CAAC,IAAgB,EAAE,gBAAwB;QACnD,MAAM,GAAG,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC5C,wEAAwE;QACxE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;QACnC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACpE,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAgB,EAChB,SAAqB,EACrB,eAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7F,OAAO,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,4EAA4E;QAC5E,8EAA8E;QAC9E,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACzF,0EAA0E;QAC1E,wDAAwD;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC3F,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAChF,OAAO,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,SAAS,EAAE,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;CACF"}
+{"version":3,"file":"web-crypto.js","sourceRoot":"","sources":["../../src/providers/web-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElE,MAAM,GAAG,GAAG,SAAkB,CAAC;AAE/B,yFAAyF;AACzF,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAAC;IAC3C,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CAC/F,CAAC,CAAC;AAEH,SAAS,SAAS;IAChB,wEAAwE;IACxE,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sEAAsE;AACtE,sEAAsE;AACtE,0EAA0E;AAC1E,+BAA+B;AAC/B,SAAS,cAAc,CAAC,KAAiB;IACvC,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAQD,SAAS,SAAS,CAAC,GAAiB;IAClC,OAAO,YAAY,IAAI,GAAG,IAAI,WAAW,IAAI,GAAG,CAAC;AACnD,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,cAAc;IACnD,KAAK,CAAC,IAAI,CAAC,IAAgB,EAAE,gBAAwB;QACnD,MAAM,GAAG,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC5C,wEAAwE;QACxE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;QACnC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QACpF,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAgB,EAChB,SAAqB,EACrB,eAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAC5C,KAAK,EACL,cAAc,CAAC,GAAG,CAAC,EACnB,EAAE,IAAI,EAAE,GAAG,EAAE,EACb,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,OAAO,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CACpC,EAAE,IAAI,EAAE,GAAG,EAAE,EACb,GAAG,EACH,cAAc,CAAC,SAAS,CAAC,EACzB,cAAc,CAAC,IAAI,CAAC,CACrB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACzF,0EAA0E;QAC1E,wDAAwD;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC3F,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChG,OAAO,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,SAAS,EAAE,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/utils/guards.d.ts

@@ -0,0 +1,2 @@
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+//# sourceMappingURL=guards.d.ts.map

package/dist/utils/guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/utils/guards.ts"],"names":[],"mappings":"AAAA,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE"}

package/dist/utils/guards.js

@@ -0,0 +1,4 @@
+export function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=guards.js.map

package/dist/utils/guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/utils/guards.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/utils/index.d.ts

@@ -2,4 +2,7 @@
  * Utility exports
  */
 export { ED25519_PKCS8_DER_HEADER, ED25519_SPKI_DER_HEADER_LENGTH, ED25519_KEY_SIZE, } from './ed25519-constants.js';
+export { isRecord } from './guards.js';
+export { stripTrailingSlashes } from './url.js';
+export { createSafeFetch, fetchTransport, isBlockedAddress, type SafeFetch, type SafeFetchResponse, type SafeFetchOptions, type SafeFetchTransport, type TransportInit, type RawResponse, type DnsLookup, type DnsAddress, } from './safe-fetch.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,iBAAiB,CAAC"}

package/dist/utils/index.js

@@ -2,4 +2,7 @@
  * Utility exports
  */
 export { ED25519_PKCS8_DER_HEADER, ED25519_SPKI_DER_HEADER_LENGTH, ED25519_KEY_SIZE, } from './ed25519-constants.js';
+export { isRecord } from './guards.js';
+export { stripTrailingSlashes } from './url.js';
+export { createSafeFetch, fetchTransport, isBlockedAddress, } from './safe-fetch.js';
 //# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,GASjB,MAAM,iBAAiB,CAAC"}

package/dist/utils/ip-classifier.d.ts

@@ -0,0 +1,12 @@
+/**
+ * SSRF address policy — classify a resolved IP as public unicast or not.
+ *
+ * Pure, I/O-free RFC classification extracted from `./safe-fetch` so the "which addresses may we
+ * connect to" decision is one cohesive, independently-testable unit. Every predicate FAILS CLOSED:
+ * an unparseable literal classifies as blocked. IPv6 is classified by its 16 canonical bytes (not
+ * its textual form), and every IPv4-bearing transition range (v4-mapped, NAT64, 6to4, v4-compatible)
+ * folds down to its embedded v4 so a private tail cannot slip through a v6 wrapper.
+ */
+/** True if an address must NOT be connected to (classified by shape, not by trusting `family`). */
+export declare function isBlockedAddress(address: string): boolean;
+//# sourceMappingURL=ip-classifier.d.ts.map

package/dist/utils/ip-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-classifier.d.ts","sourceRoot":"","sources":["../../src/utils/ip-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6GH,mGAAmG;AACnG,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzD"}

package/dist/utils/ip-classifier.js

@@ -0,0 +1,153 @@
+/**
+ * SSRF address policy — classify a resolved IP as public unicast or not.
+ *
+ * Pure, I/O-free RFC classification extracted from `./safe-fetch` so the "which addresses may we
+ * connect to" decision is one cohesive, independently-testable unit. Every predicate FAILS CLOSED:
+ * an unparseable literal classifies as blocked. IPv6 is classified by its 16 canonical bytes (not
+ * its textual form), and every IPv4-bearing transition range (v4-mapped, NAT64, 6to4, v4-compatible)
+ * folds down to its embedded v4 so a private tail cannot slip through a v6 wrapper.
+ */
+/** True if an IPv4 dotted-quad is NOT a public unicast address (fail-closed on parse error). */
+function isBlockedIpv4(ip) {
+    const parts = ip.split('.');
+    if (parts.length !== 4)
+        return true;
+    const octets = parts.map((part) => Number(part));
+    if (octets.some((o) => !Number.isInteger(o) || o < 0 || o > 255))
+        return true;
+    const [a, b, c] = octets;
+    if (a === undefined || b === undefined || c === undefined)
+        return true;
+    if (a === 0 || a === 10 || a === 127)
+        return true; // this-host, RFC1918 10/8, loopback 127/8
+    if (a === 169 && b === 254)
+        return true; // link-local 169.254/16 (incl. 169.254.169.254)
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // RFC1918 172.16/12
+    if (a === 192 && b === 168)
+        return true; // RFC1918 192.168/16
+    if (a === 100 && b >= 64 && b <= 127)
+        return true; // CGNAT 100.64/10
+    if (a === 192 && b === 0 && c === 0)
+        return true; // IETF protocol assignments 192.0.0/24
+    if (a === 192 && b === 0 && c === 2)
+        return true; // RFC 5737 TEST-NET-1 192.0.2/24 (documentation)
+    if (a === 198 && b === 51 && c === 100)
+        return true; // RFC 5737 TEST-NET-2 198.51.100/24 (documentation)
+    if (a === 203 && b === 0 && c === 113)
+        return true; // RFC 5737 TEST-NET-3 203.0.113/24 (documentation)
+    if (a === 198 && (b === 18 || b === 19))
+        return true; // benchmarking 198.18/15
+    if (a >= 224)
+        return true; // multicast 224/4, reserved 240/4, broadcast 255.255.255.255
+    return false;
+}
+/**
+ * Parse an IPv6 literal into its 16 bytes, or `null` when it is not well-formed. Expands `::`
+ * and folds an embedded IPv4 tail, so classification never depends on the TEXTUAL form — `::1`,
+ * `0:0:0:0:0:0:0:1`, and `0000:...:0001` all resolve to the same bytes (closing the string-match
+ * bypass where an expanded loopback slipped through).
+ */
+function ipv6ToBytes(ip) {
+    let text = ip.toLowerCase().split('%')[0] ?? ''; // drop any zone id
+    // Fold a trailing dotted-quad (::ffff:1.2.3.4, ::1.2.3.4) into two hextets.
+    const v4 = text.match(/:(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (v4) {
+        const o = [v4[1], v4[2], v4[3], v4[4]].map(Number);
+        if (o.some((n) => !Number.isInteger(n) || n < 0 || n > 255))
+            return null;
+        const hi = (((o[0] ?? 0) << 8) | (o[1] ?? 0)).toString(16);
+        const lo = (((o[2] ?? 0) << 8) | (o[3] ?? 0)).toString(16);
+        text = `${text.slice(0, v4.index)}:${hi}:${lo}`;
+    }
+    const halves = text.split('::');
+    if (halves.length > 2)
+        return null; // more than one "::" is illegal
+    const parse = (part) => {
+        if (part === '')
+            return [];
+        const out = [];
+        for (const h of part.split(':')) {
+            if (!/^[0-9a-f]{1,4}$/.test(h))
+                return null;
+            out.push(parseInt(h, 16));
+        }
+        return out;
+    };
+    const head = parse(halves[0] ?? '');
+    const tail = halves.length === 2 ? parse(halves[1] ?? '') : [];
+    if (head === null || tail === null)
+        return null;
+    let hextets;
+    if (halves.length === 2) {
+        const fill = 8 - head.length - tail.length;
+        if (fill < 1)
+            return null; // "::" must stand in for at least one zero group
+        hextets = [...head, ...Array(fill).fill(0), ...tail];
+    }
+    else {
+        hextets = head;
+    }
+    if (hextets.length !== 8)
+        return null;
+    const bytes = new Uint8Array(16);
+    hextets.forEach((h, i) => {
+        bytes[i * 2] = (h >> 8) & 0xff;
+        bytes[i * 2 + 1] = h & 0xff;
+    });
+    return bytes;
+}
+/** True if an IPv6 literal is NOT a public unicast address (fail-closed on parse error). */
+function isBlockedIpv6(ip) {
+    const b = ipv6ToBytes(ip);
+    if (b === null)
+        return true; // unparseable → fail-closed
+    const embeddedV4 = () => isBlockedIpv4(`${b[12]}.${b[13]}.${b[14]}.${b[15]}`);
+    // IPv4-mapped ::ffff:a.b.c.d — classify by the embedded v4 (loopback, RFC1918, metadata, …).
+    if (b.subarray(0, 10).every((x) => x === 0) && b[10] === 0xff && b[11] === 0xff)
+        return embeddedV4();
+    if (b.every((x) => x === 0))
+        return true; // :: unspecified
+    if (b.subarray(0, 15).every((x) => x === 0) && b[15] === 1)
+        return true; // ::1 loopback (any form)
+    if (b[0] === 0xfe && (b[1] & 0xc0) === 0x80)
+        return true; // fe80::/10 link-local
+    if ((b[0] & 0xfe) === 0xfc)
+        return true; // fc00::/7 ULA (fc00::/8 + fd00::/8)
+    if (b[0] === 0xff)
+        return true; // ff00::/8 multicast
+    if (b[0] === 0xfe && (b[1] & 0xc0) === 0xc0)
+        return true; // fec0::/10 deprecated site-local
+    // NAT64 well-known prefix 64:ff9b::/96 — the tail IS an IPv4 address the gateway routes to, so a
+    // 64:ff9b::10.0.0.1 / 64:ff9b::a9fe:a9fe would reach RFC1918 / the metadata endpoint. Classify it.
+    if (b[0] === 0x00 && b[1] === 0x64 && b[2] === 0xff && b[3] === 0x9b && b.subarray(4, 12).every((x) => x === 0)) {
+        return embeddedV4();
+    }
+    // NAT64 LOCAL-USE prefix 64:ff9b:1::/48 (RFC 8215): operators derive /96 translation prefixes from
+    // it, so the routed IPv4 sits in the low 32 bits — classify that (the /96 clause above matched only
+    // the well-known prefix). A non-/96 embedding leaves bytes 12-15 zero → 0.0.0.0 → blocked (fail-closed).
+    if (b[0] === 0x00 && b[1] === 0x64 && b[2] === 0xff && b[3] === 0x9b && b[4] === 0x00 && b[5] === 0x01) {
+        return embeddedV4();
+    }
+    // 6to4 2002::/16 — bytes 2-5 embed the IPv4 of the 6to4 relay/host; classify that v4.
+    if (b[0] === 0x20 && b[1] === 0x02)
+        return isBlockedIpv4(`${b[2]}.${b[3]}.${b[4]}.${b[5]}`);
+    // Teredo 2001:0000::/32 — the client IPv4 is obfuscated in the tail; block conservatively.
+    if (b[0] === 0x20 && b[1] === 0x01 && b[2] === 0x00 && b[3] === 0x00)
+        return true;
+    // IPv4-compatible ::a.b.c.d (deprecated, non-routable) — classify the embedded v4, fail-closed.
+    if (b.subarray(0, 12).every((x) => x === 0))
+        return embeddedV4();
+    // 2001:db8::/32 — RFC 3849 documentation range (not public unicast, per the module contract).
+    if (b[0] === 0x20 && b[1] === 0x01 && b[2] === 0x0d && b[3] === 0xb8)
+        return true;
+    // 100::/64 — RFC 6666 discard-only prefix (a routing black hole, never a real service).
+    if (b[0] === 0x01 && b[1] === 0x00 && b.subarray(2, 8).every((x) => x === 0))
+        return true;
+    return false; // global unicast
+}
+/** True if an address must NOT be connected to (classified by shape, not by trusting `family`). */
+export function isBlockedAddress(address) {
+    return address.includes(':') ? isBlockedIpv6(address) : isBlockedIpv4(address);
+}
+//# sourceMappingURL=ip-classifier.js.map

package/dist/utils/ip-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-classifier.js","sourceRoot":"","sources":["../../src/utils/ip-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,gGAAgG;AAChG,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;IACzB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,0CAA0C;IAC7F,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,gDAAgD;IACzF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,oBAAoB;IACtE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB;IAC9D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;IACrE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,uCAAuC;IACzF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,iDAAiD;IACnG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,oDAAoD;IACzG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,mDAAmD;IACvG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,yBAAyB;IAC/E,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,6DAA6D;IACxF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,EAAU;IAC7B,IAAI,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,mBAAmB;IACpE,4EAA4E;IAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACtE,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3D,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3D,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;IAClD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,gCAAgC;IACpE,MAAM,KAAK,GAAG,CAAC,IAAY,EAAmB,EAAE;QAC9C,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,OAAiB,CAAC;IACtB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3C,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,iDAAiD;QAC5E,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAS,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvB,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC/B,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4FAA4F;AAC5F,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,4BAA4B;IACzD,MAAM,UAAU,GAAG,GAAY,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACvF,6FAA6F;IAC7F,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI;QAAE,OAAO,UAAU,EAAE,CAAC;IACrG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,iBAAiB;IAC3D,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,0BAA0B;IACnG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;IAClF,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,qCAAqC;IAC/E,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB;IACrD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;IAC7F,iGAAiG;IACjG,mGAAmG;IACnG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAChH,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;IACD,mGAAmG;IACnG,oGAAoG;IACpG,yGAAyG;IACzG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvG,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;IACD,sFAAsF;IACtF,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5F,2FAA2F;IAC3F,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClF,gGAAgG;IAChG,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,UAAU,EAAE,CAAC;IACjE,8FAA8F;IAC9F,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClF,wFAAwF;IACxF,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1F,OAAO,KAAK,CAAC,CAAC,iBAAiB;AACjC,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;AACjF,CAAC"}