@kya-os/mcp 1.7.0 → 1.9.0

package/dist/utils/safe-fetch-transports.d.ts

@@ -0,0 +1,40 @@
+/**
+ * SSRF-hardened fetch — the Node I/O adapters (the `SafeFetchTransport` + `DnsLookup` defaults).
+ *
+ * Two transports ship. The DEFAULT `nodeHttpsTransport` PINS the connection to the pre-validated
+ * IP (closing the DNS-rebinding TOCTOU window) via a custom `node:https` `lookup`. That pinned path
+ * misbehaves in some serverless runtimes — it failed 100% of fetches in the Vercel Node serverless
+ * runtime on 2026-07-02, a failure the mocked-transport unit suite cannot catch. For those runtimes,
+ * select `fetchTransport`: it connects by HOSTNAME through global `fetch` (the SSRF screen has
+ * already run in the policy layer via `resolveAndPin`). All addressing policy lives in
+ * `./ip-classifier`; the seam vocabulary lives in `./safe-fetch-types`. No crypto here.
+ */
+import type { DnsLookup, SafeFetchTransport } from './safe-fetch-types.js';
+/** Default DNS seam — resolve every address (`all: true`) for full SSRF screening. */
+export declare const defaultLookup: DnsLookup;
+/**
+ * Fetch-based transport — for runtimes where the `node:https` pinned-connect path misbehaves
+ * (the Vercel Node serverless runtime failed 100% of fetches on 2026-07-02). Select it explicitly
+ * with `transport: fetchTransport`, or rely on the auto-select when `node:https` is unavailable.
+ *
+ * The SSRF screen is UNCHANGED: for non-first-party origins `resolveAndPin` has already run EVERY
+ * resolved address through the `lookup` seam + `isBlockedAddress` policy before this transport is
+ * called. This variant then connects by HOSTNAME via global `fetch` (`redirect: 'manual'`, so a
+ * 3xx flows back to the caller's redirect loop) — it does NOT pin `init.pinnedAddress`.
+ *
+ * TOCTOU: `nodeHttpsTransport` PINS the validated IP, closing the DNS-rebinding window. This
+ * variant validates-then-reconnects-by-name, so a hostile resolver could hand `lookup` a public
+ * IP and `fetch`'s own resolution a private one — a narrow validated-then-reconnected-by-name
+ * window it knowingly accepts for serverless compatibility. Prefer the pinned transport where
+ * `node:https` works; the first-party escape hatch avoids the window for a caller's own origin.
+ */
+export declare const fetchTransport: SafeFetchTransport;
+/** Default transport — node:https pinned to the validated IP, TLS SNI preserved, body-capped. */
+export declare const nodeHttpsTransport: SafeFetchTransport;
+/**
+ * Pick the default transport: the `node:https` pinned transport when it is available, else the
+ * fetch-based transport. This only covers ABSENCE of `node:https`; a runtime where the pinned
+ * path is present-but-broken (e.g. Vercel Node serverless) must pass `transport: fetchTransport`.
+ */
+export declare function selectDefaultTransport(): SafeFetchTransport;
+//# sourceMappingURL=safe-fetch-transports.d.ts.map

package/dist/utils/safe-fetch-transports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-fetch-transports.d.ts","sourceRoot":"","sources":["../../src/utils/safe-fetch-transports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,KAAK,EAAE,SAAS,EAAe,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAExF,sFAAsF;AACtF,eAAO,MAAM,aAAa,EAAE,SAG3B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc,EAAE,kBAG5B,CAAC;AA2BF,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,EAAE,kBAsC7B,CAAC;AAgBL;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,kBAAkB,CAE3D"}

package/dist/utils/safe-fetch-transports.js

@@ -0,0 +1,121 @@
+/**
+ * SSRF-hardened fetch — the Node I/O adapters (the `SafeFetchTransport` + `DnsLookup` defaults).
+ *
+ * Two transports ship. The DEFAULT `nodeHttpsTransport` PINS the connection to the pre-validated
+ * IP (closing the DNS-rebinding TOCTOU window) via a custom `node:https` `lookup`. That pinned path
+ * misbehaves in some serverless runtimes — it failed 100% of fetches in the Vercel Node serverless
+ * runtime on 2026-07-02, a failure the mocked-transport unit suite cannot catch. For those runtimes,
+ * select `fetchTransport`: it connects by HOSTNAME through global `fetch` (the SSRF screen has
+ * already run in the policy layer via `resolveAndPin`). All addressing policy lives in
+ * `./ip-classifier`; the seam vocabulary lives in `./safe-fetch-types`. No crypto here.
+ */
+import { lookup as nodeDnsLookup } from 'node:dns/promises';
+import { request as httpsRequest } from 'node:https';
+/** Default DNS seam — resolve every address (`all: true`) for full SSRF screening. */
+export const defaultLookup = async (hostname) => {
+    const resolved = await nodeDnsLookup(hostname, { all: true, verbatim: true });
+    return resolved.map((entry) => ({ address: entry.address, family: entry.family }));
+};
+/**
+ * Fetch-based transport — for runtimes where the `node:https` pinned-connect path misbehaves
+ * (the Vercel Node serverless runtime failed 100% of fetches on 2026-07-02). Select it explicitly
+ * with `transport: fetchTransport`, or rely on the auto-select when `node:https` is unavailable.
+ *
+ * The SSRF screen is UNCHANGED: for non-first-party origins `resolveAndPin` has already run EVERY
+ * resolved address through the `lookup` seam + `isBlockedAddress` policy before this transport is
+ * called. This variant then connects by HOSTNAME via global `fetch` (`redirect: 'manual'`, so a
+ * 3xx flows back to the caller's redirect loop) — it does NOT pin `init.pinnedAddress`.
+ *
+ * TOCTOU: `nodeHttpsTransport` PINS the validated IP, closing the DNS-rebinding window. This
+ * variant validates-then-reconnects-by-name, so a hostile resolver could hand `lookup` a public
+ * IP and `fetch`'s own resolution a private one — a narrow validated-then-reconnected-by-name
+ * window it knowingly accepts for serverless compatibility. Prefer the pinned transport where
+ * `node:https` works; the first-party escape hatch avoids the window for a caller's own origin.
+ */
+export const fetchTransport = async (url, init) => {
+    const response = await fetch(url, { method: 'GET', redirect: 'manual', signal: init.signal });
+    return readCapped(response, init.maxBytes);
+};
+/** Stream a fetch Response body into a RawResponse, enforcing the byte cap mid-stream. */
+async function readCapped(response, maxBytes) {
+    const reader = response.body?.getReader();
+    const chunks = [];
+    let size = 0;
+    if (reader) {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.length;
+            if (size > maxBytes) {
+                await reader.cancel();
+                throw new Error(`safe-fetch: response body exceeds size cap ${maxBytes}`);
+            }
+            chunks.push(value);
+        }
+    }
+    const body = Buffer.concat(chunks).toString('utf8');
+    return {
+        status: response.status,
+        headers: { get: (name) => response.headers.get(name) },
+        text: () => Promise.resolve(body),
+    };
+}
+/** Default transport — node:https pinned to the validated IP, TLS SNI preserved, body-capped. */
+export const nodeHttpsTransport = (url, init) => new Promise((resolve, reject) => {
+    // Return the pinned IP for BOTH lookup call-shapes. Node ≥20 defaults to
+    // `autoSelectFamily=true`, which invokes a custom lookup with `{ all: true }` and expects an
+    // ARRAY of `{ address, family }`; a scalar 3-arg callback yields "Invalid IP address:
+    // undefined" and breaks every real request. Honour the array form when `all` is asked,
+    // the scalar form otherwise.
+    const family = init.family === 6 ? 6 : 4;
+    const pinnedLookup = (_hostname, options, cb) => {
+        if (typeof options === 'object' && options?.all) {
+            cb(null, [
+                { address: init.pinnedAddress, family },
+            ]);
+        }
+        else {
+            cb(null, init.pinnedAddress, family);
+        }
+    };
+    const req = httpsRequest(url, { method: 'GET', servername: init.hostname, signal: init.signal, lookup: pinnedLookup }, (res) => {
+        const chunks = [];
+        let size = 0;
+        res.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > init.maxBytes) {
+                req.destroy();
+                reject(new Error(`safe-fetch: response body exceeds size cap ${init.maxBytes}`));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        res.on('end', () => resolve(toRawResponse(res, chunks)));
+        res.on('error', reject);
+    });
+    req.on('error', reject);
+    req.end();
+});
+/** Project a node:http IncomingMessage + buffered chunks into the RawResponse shape. */
+function toRawResponse(res, chunks) {
+    return {
+        status: res.statusCode ?? 0,
+        headers: {
+            get: (name) => {
+                const value = res.headers[name.toLowerCase()];
+                return Array.isArray(value) ? (value[0] ?? null) : (value ?? null);
+            },
+        },
+        text: () => Promise.resolve(Buffer.concat(chunks).toString('utf8')),
+    };
+}
+/**
+ * Pick the default transport: the `node:https` pinned transport when it is available, else the
+ * fetch-based transport. This only covers ABSENCE of `node:https`; a runtime where the pinned
+ * path is present-but-broken (e.g. Vercel Node serverless) must pass `transport: fetchTransport`.
+ */
+export function selectDefaultTransport() {
+    return typeof httpsRequest === 'function' ? nodeHttpsTransport : fetchTransport;
+}
+//# sourceMappingURL=safe-fetch-transports.js.map

package/dist/utils/safe-fetch-transports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-fetch-transports.js","sourceRoot":"","sources":["../../src/utils/safe-fetch-transports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAKrD,sFAAsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAc,KAAK,EAAE,QAAQ,EAAE,EAAE;IACzD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACrF,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,cAAc,GAAuB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACpE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9F,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,0FAA0F;AAC1F,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAE,QAAgB;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,MAAM,EAAE,CAAC;QACX,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,8CAA8C,QAAQ,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACtD,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,kBAAkB,GAAuB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAClE,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC3C,yEAAyE;IACzE,6FAA6F;IAC7F,sFAAsF;IACtF,uFAAuF;IACvF,6BAA6B;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,YAAY,GAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE;QAC9D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,GAAG,EAAE,CAAC;YAC/C,EAAkF,CAAC,IAAI,EAAE;gBACxF,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,YAAY,CACtB,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,EACvF,CAAC,GAAoB,EAAE,EAAE;QACvB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACzB,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACjF,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACzD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC,CAAC,CAAC;AAEL,wFAAwF;AACxF,SAAS,aAAa,CAAC,GAAoB,EAAE,MAAgB;IAC3D,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;QAC3B,OAAO,EAAE;YACP,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;gBACZ,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;YACrE,CAAC;SACF;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc,CAAC;AAClF,CAAC"}

package/dist/utils/safe-fetch-types.d.ts

@@ -0,0 +1,66 @@
+/**
+ * SSRF-hardened fetch — the shared seam types.
+ *
+ * Kept in their own module so the pure address classifier (`./ip-classifier`), the Node I/O
+ * adapters (`./safe-fetch-transports`), and the policy orchestrator (`./safe-fetch`) can all
+ * depend on the vocabulary without any import cycle. `./safe-fetch` re-exports every name here,
+ * so the public surface (`@kya-os/mcp` barrels) is unchanged.
+ */
+/** A resolved address + its IP family (4 or 6). */
+export interface DnsAddress {
+    address: string;
+    family: number;
+}
+/** DNS resolution seam — returns every address the host resolves to. */
+export type DnsLookup = (hostname: string) => Promise<DnsAddress[]>;
+/** The minimal response a transport yields; safe-fetch interprets status/headers/body. */
+export interface RawResponse {
+    status: number;
+    headers: {
+        get(name: string): string | null;
+    };
+    text: () => Promise<string>;
+}
+/** Per-request context handed to the transport (connection already validated + pinned). */
+export interface TransportInit {
+    signal: AbortSignal;
+    hostname: string;
+    pinnedAddress: string;
+    family: number;
+    maxBytes: number;
+}
+/** Transport seam — performs ONE request (no redirect following) to the pinned address. */
+export type SafeFetchTransport = (url: string, init: TransportInit) => Promise<RawResponse>;
+/** The fetcher safe-fetch returns — structurally compatible with the card's `FetchLike`. */
+export interface SafeFetchResponse {
+    ok: boolean;
+    status: number;
+    json: () => Promise<unknown>;
+}
+export type SafeFetch = (url: string) => Promise<SafeFetchResponse>;
+export interface SafeFetchOptions {
+    /** DNS seam (default: `node:dns` resolving every address). */
+    lookup?: DnsLookup;
+    /**
+     * Transport seam. Default auto-selects `nodeHttpsTransport` when `node:https` is available,
+     * else `fetchTransport`. Serverless runtimes where the pinned path is broken (not absent)
+     * should pass `fetchTransport` explicitly.
+     */
+    transport?: SafeFetchTransport;
+    /**
+     * First-party origins the caller OWNS (e.g. `["https://api.example.com"]`). A request whose
+     * origin equals one of these skips the SSRF resolve-and-pin screen and is fetched plain by
+     * name — origin-equality is not attacker-routable. Each entry MUST be a valid https origin
+     * (fail-closed otherwise); every non-listed origin still takes the guarded path.
+     */
+    allowOrigins?: string[];
+    /** Convenience singular form of {@link SafeFetchOptions.allowOrigins}. */
+    firstPartyOrigin?: string;
+    /** Request timeout per hop, in ms (default 5000). */
+    timeoutMs?: number;
+    /** Maximum response body size, in bytes (default 1 MiB). */
+    maxBytes?: number;
+    /** Maximum same-origin redirects to follow (default 3). */
+    maxRedirects?: number;
+}
+//# sourceMappingURL=safe-fetch-types.d.ts.map

package/dist/utils/safe-fetch-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-fetch-types.d.ts","sourceRoot":"","sources":["../../src/utils/safe-fetch-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,MAAM,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;AAEpE,0FAA0F;AAC1F,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC9C,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,2FAA2F;AAC3F,MAAM,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;AAE5F,4FAA4F;AAC5F,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9B;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEpE,MAAM,WAAW,gBAAgB;IAC/B,8DAA8D;IAC9D,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}

package/dist/utils/safe-fetch-types.js

@@ -0,0 +1,10 @@
+/**
+ * SSRF-hardened fetch — the shared seam types.
+ *
+ * Kept in their own module so the pure address classifier (`./ip-classifier`), the Node I/O
+ * adapters (`./safe-fetch-transports`), and the policy orchestrator (`./safe-fetch`) can all
+ * depend on the vocabulary without any import cycle. `./safe-fetch` re-exports every name here,
+ * so the public surface (`@kya-os/mcp` barrels) is unchanged.
+ */
+export {};
+//# sourceMappingURL=safe-fetch-types.js.map

package/dist/utils/safe-fetch-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-fetch-types.js","sourceRoot":"","sources":["../../src/utils/safe-fetch-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/utils/safe-fetch.d.ts

@@ -0,0 +1,40 @@
+/**
+ * SSRF-hardened outbound fetch (safe-fetch) — the policy orchestrator.
+ *
+ * `resolveCard` — and, later, JWKS + status-list resolution — follows URLs an attacker can
+ * influence across four discovery surfaces, so every outbound request goes through this
+ * guard. `createSafeFetch` returns a fetcher structurally compatible with the card's
+ * `FetchLike` ({ ok, status, json }) that enforces, fail-closed:
+ *
+ *   - https-only (no http:, file:, data:, …);
+ *   - the connection IP is a PUBLIC UNICAST address (RFC1918, loopback, link-local incl. the
+ *     169.254.169.254 cloud-metadata endpoint, IPv6 ULA/link-local, NAT64/6to4/Teredo transition
+ *     ranges are denied — see `./ip-classifier`). Each HOP is resolved ONCE and its connection is
+ *     PINNED to that validated address, closing the DNS-rebinding (TOCTOU) window within the hop; a
+ *     same-origin redirect to a different host triggers a fresh resolve-and-pin cycle for that hop;
+ *   - cross-origin redirects are blocked (manual handling; a 3xx to a different origin is
+ *     rejected, same-origin redirects are followed up to a small cap);
+ *   - a response size cap and an AbortSignal-backed timeout bound resource use.
+ *
+ * The two Node transports live in `./safe-fetch-transports`; the seam vocabulary in
+ * `./safe-fetch-types`; the address policy in `./ip-classifier`. This module owns only the
+ * hop-by-hop POLICY (scheme, resolve-and-pin, redirect, size cap, timeout, first-party escape
+ * hatch) and re-exports the transports + classifier + types so the public surface is one import.
+ *
+ * First-party escape hatch: `allowOrigins` / `firstPartyOrigin` list origins a caller owns. A
+ * request whose origin equals a configured one is fetched plain (origin-equality is not
+ * attacker-routable); every other origin still takes the guarded path, fail-closed.
+ *
+ * All I/O is injected via pluggable seams (`lookup`, `transport`) so the policy is unit tested
+ * with mocked DNS + transport. No crypto here — no mcp-i-core dependency leaks in.
+ */
+import type { SafeFetch, SafeFetchOptions } from './safe-fetch-types.js';
+export * from './safe-fetch-types.js';
+export { isBlockedAddress } from './ip-classifier.js';
+export { defaultLookup, fetchTransport, nodeHttpsTransport, selectDefaultTransport, } from './safe-fetch-transports.js';
+/**
+ * Build an SSRF-hardened fetcher. The returned function is structurally compatible with the
+ * card's `FetchLike`: `(url) => Promise<{ ok, status, json }>`.
+ */
+export declare function createSafeFetch(options?: SafeFetchOptions): SafeFetch;
+//# sourceMappingURL=safe-fetch.d.ts.map

package/dist/utils/safe-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-fetch.d.ts","sourceRoot":"","sources":["../../src/utils/safe-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAQH,OAAO,KAAK,EAIV,SAAS,EACT,gBAAgB,EAGjB,MAAM,uBAAuB,CAAC;AAG/B,cAAc,uBAAuB,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EACL,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AA6EpC;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,SAAS,CAuBzE"}

package/dist/utils/safe-fetch.js

@@ -0,0 +1,188 @@
+/**
+ * SSRF-hardened outbound fetch (safe-fetch) — the policy orchestrator.
+ *
+ * `resolveCard` — and, later, JWKS + status-list resolution — follows URLs an attacker can
+ * influence across four discovery surfaces, so every outbound request goes through this
+ * guard. `createSafeFetch` returns a fetcher structurally compatible with the card's
+ * `FetchLike` ({ ok, status, json }) that enforces, fail-closed:
+ *
+ *   - https-only (no http:, file:, data:, …);
+ *   - the connection IP is a PUBLIC UNICAST address (RFC1918, loopback, link-local incl. the
+ *     169.254.169.254 cloud-metadata endpoint, IPv6 ULA/link-local, NAT64/6to4/Teredo transition
+ *     ranges are denied — see `./ip-classifier`). Each HOP is resolved ONCE and its connection is
+ *     PINNED to that validated address, closing the DNS-rebinding (TOCTOU) window within the hop; a
+ *     same-origin redirect to a different host triggers a fresh resolve-and-pin cycle for that hop;
+ *   - cross-origin redirects are blocked (manual handling; a 3xx to a different origin is
+ *     rejected, same-origin redirects are followed up to a small cap);
+ *   - a response size cap and an AbortSignal-backed timeout bound resource use.
+ *
+ * The two Node transports live in `./safe-fetch-transports`; the seam vocabulary in
+ * `./safe-fetch-types`; the address policy in `./ip-classifier`. This module owns only the
+ * hop-by-hop POLICY (scheme, resolve-and-pin, redirect, size cap, timeout, first-party escape
+ * hatch) and re-exports the transports + classifier + types so the public surface is one import.
+ *
+ * First-party escape hatch: `allowOrigins` / `firstPartyOrigin` list origins a caller owns. A
+ * request whose origin equals a configured one is fetched plain (origin-equality is not
+ * attacker-routable); every other origin still takes the guarded path, fail-closed.
+ *
+ * All I/O is injected via pluggable seams (`lookup`, `transport`) so the policy is unit tested
+ * with mocked DNS + transport. No crypto here — no mcp-i-core dependency leaks in.
+ */
+import { isBlockedAddress } from './ip-classifier.js';
+import { defaultLookup, fetchTransport, selectDefaultTransport, } from './safe-fetch-transports.js';
+// Re-export the full public surface so a consumer needs only `./safe-fetch` (barrels unchanged).
+export * from './safe-fetch-types.js';
+export { isBlockedAddress } from './ip-classifier.js';
+export { defaultLookup, fetchTransport, nodeHttpsTransport, selectDefaultTransport, } from './safe-fetch-transports.js';
+const DEFAULT_TIMEOUT_MS = 5_000;
+const DEFAULT_MAX_BYTES = 1_048_576;
+const DEFAULT_MAX_REDIRECTS = 3;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/** Parse + require https; returns the normalized href. */
+function assertHttpsUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error(`safe-fetch: invalid URL "${raw}"`);
+    }
+    if (url.protocol !== 'https:') {
+        throw new Error(`safe-fetch: only https is allowed (got "${url.protocol}")`);
+    }
+    return url.href;
+}
+/** Resolve the host ONCE, reject if ANY resolved address is non-public, and pin the first. */
+async function resolveAndPin(hostname, lookup) {
+    const addresses = await lookup(hostname);
+    const [first] = addresses;
+    if (!first) {
+        throw new Error(`safe-fetch: DNS lookup for "${hostname}" returned no addresses`);
+    }
+    for (const candidate of addresses) {
+        if (isBlockedAddress(candidate.address)) {
+            throw new Error(`safe-fetch: refusing non-public address ${candidate.address} for host "${hostname}"`);
+        }
+    }
+    return first;
+}
+/** Resolve a 3xx into the next URL, rejecting cross-origin / non-https / missing-Location. */
+function nextRedirectUrl(currentUrl, raw) {
+    const location = raw.headers.get('location');
+    if (!location) {
+        throw new Error(`safe-fetch: ${raw.status} redirect without a Location header`);
+    }
+    let target;
+    try {
+        target = new URL(location, currentUrl);
+    }
+    catch {
+        // Keep the module's fail-closed convention: a malformed Location surfaces a `safe-fetch:`-
+        // prefixed error rather than a raw TypeError leaking out of the URL constructor.
+        throw new Error(`safe-fetch: redirect location is not a valid URL "${location}"`);
+    }
+    if (target.protocol !== 'https:') {
+        throw new Error(`safe-fetch: redirect to non-https target "${target.protocol}" blocked`);
+    }
+    const origin = new URL(currentUrl).origin;
+    if (target.origin !== origin) {
+        throw new Error(`safe-fetch: cross-origin redirect blocked (${origin} → ${target.origin})`);
+    }
+    return target.href;
+}
+/** Enforce the size cap and project a RawResponse into the FetchLike-compatible shape. */
+async function finalize(raw, maxBytes) {
+    const declared = Number(raw.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > maxBytes) {
+        throw new Error(`safe-fetch: declared content-length ${declared} exceeds cap ${maxBytes}`);
+    }
+    const body = await raw.text();
+    if (Buffer.byteLength(body, 'utf8') > maxBytes) {
+        throw new Error(`safe-fetch: response body exceeds size cap ${maxBytes}`);
+    }
+    return {
+        ok: raw.status >= 200 && raw.status < 300,
+        status: raw.status,
+        json: () => Promise.resolve(JSON.parse(body)),
+    };
+}
+/**
+ * Build an SSRF-hardened fetcher. The returned function is structurally compatible with the
+ * card's `FetchLike`: `(url) => Promise<{ ok, status, json }>`.
+ */
+export function createSafeFetch(options = {}) {
+    const cfg = {
+        lookup: options.lookup ?? defaultLookup,
+        transport: options.transport ?? selectDefaultTransport(),
+        timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+        maxBytes: options.maxBytes ?? DEFAULT_MAX_BYTES,
+        trustedOrigins: normalizeTrustedOrigins(options),
+    };
+    const maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
+    return async function safeFetch(initialUrl) {
+        let url = assertHttpsUrl(initialUrl);
+        for (let hop = 0;; hop++) {
+            const raw = await requestOnce(url, cfg);
+            if (!REDIRECT_STATUSES.has(raw.status)) {
+                return finalize(raw, cfg.maxBytes);
+            }
+            if (hop >= maxRedirects) {
+                throw new Error(`safe-fetch: too many redirects (> ${maxRedirects})`);
+            }
+            url = nextRedirectUrl(url, raw);
+        }
+    };
+}
+/**
+ * Perform ONE hop. First-party origins skip the resolve-and-pin SSRF screen (origin-equality is
+ * not attacker-routable) and are fetched plain by name; every other origin is resolved, screened,
+ * and pinned before the configured transport runs. Both branches are timeout-bounded.
+ */
+async function requestOnce(url, cfg) {
+    const { hostname, origin } = new URL(url);
+    if (cfg.trustedOrigins.has(origin)) {
+        return withTimeout(hostname, cfg.timeoutMs, (signal) => fetchTransport(url, { signal, hostname, pinnedAddress: '', family: 4, maxBytes: cfg.maxBytes }));
+    }
+    const pinned = await resolveAndPin(hostname, cfg.lookup);
+    return withTimeout(hostname, cfg.timeoutMs, (signal) => cfg.transport(url, {
+        signal,
+        hostname,
+        pinnedAddress: pinned.address,
+        family: pinned.family,
+        maxBytes: cfg.maxBytes,
+    }));
+}
+/** Run a transport call under an AbortSignal that fires after `timeoutMs`. */
+async function withTimeout(hostname, timeoutMs, run) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(new Error(`safe-fetch: request to ${hostname} timed out after ${timeoutMs}ms`)), timeoutMs);
+    try {
+        return await run(controller.signal);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Build the set of first-party origins that bypass the SSRF screen. Each `allowOrigins` /
+ * `firstPartyOrigin` entry MUST parse as an https origin — fail-closed (throw) otherwise.
+ */
+function normalizeTrustedOrigins(options) {
+    const raw = [...(options.allowOrigins ?? []), ...(options.firstPartyOrigin ? [options.firstPartyOrigin] : [])];
+    const origins = new Set();
+    for (const entry of raw) {
+        let url;
+        try {
+            url = new URL(entry);
+        }
+        catch {
+            throw new Error(`safe-fetch: invalid first-party origin "${entry}"`);
+        }
+        if (url.protocol !== 'https:') {
+            throw new Error(`safe-fetch: first-party origin must be https (got "${entry}")`);
+        }
+        origins.add(url.origin);
+    }
+    return origins;
+}
+//# sourceMappingURL=safe-fetch.js.map

package/dist/utils/safe-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-fetch.js","sourceRoot":"","sources":["../../src/utils/safe-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EACL,aAAa,EACb,cAAc,EACd,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AAWpC,iGAAiG;AACjG,cAAc,uBAAuB,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EACL,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AACpC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE7D,0DAA0D;AAC1D,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,8FAA8F;AAC9F,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,MAAiB;IAC9D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,yBAAyB,CAAC,CAAC;IACpF,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;QAClC,IAAI,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,2CAA2C,SAAS,CAAC,OAAO,cAAc,QAAQ,GAAG,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8FAA8F;AAC9F,SAAS,eAAe,CAAC,UAAkB,EAAE,GAAgB;IAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,MAAM,qCAAqC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;QAC3F,iFAAiF;QACjF,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,GAAG,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,6CAA6C,MAAM,CAAC,QAAQ,WAAW,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,MAAM,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,QAAQ,CAAC,GAAgB,EAAE,QAAgB;IACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,gBAAgB,QAAQ,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,8CAA8C,QAAQ,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QACzC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;KACzD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,UAA4B,EAAE;IAC5D,MAAM,GAAG,GAAc;QACrB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa;QACvC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,sBAAsB,EAAE;QACxD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,kBAAkB;QAClD,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,iBAAiB;QAC/C,cAAc,EAAE,uBAAuB,CAAC,OAAO,CAAC;KACjD,CAAC;IACF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;IAEnE,OAAO,KAAK,UAAU,SAAS,CAAC,UAAkB;QAChD,IAAI,GAAG,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;QACrC,KAAK,IAAI,GAAG,GAAG,CAAC,GAAI,GAAG,EAAE,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,GAAG,IAAI,YAAY,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,qCAAqC,YAAY,GAAG,CAAC,CAAC;YACxE,CAAC;YACD,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAWD;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,GAAc;IACpD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CACrD,cAAc,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzD,OAAO,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CACrD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,MAAM;QACN,QAAQ;QACR,aAAa,EAAE,MAAM,CAAC,OAAO;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC,CACH,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,WAAW,CACxB,QAAgB,EAChB,SAAiB,EACjB,GAAkD;IAElD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,0BAA0B,QAAQ,oBAAoB,SAAS,IAAI,CAAC,CAAC,EACtG,SAAS,CACV,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,OAAyB;IACxD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/G,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,KAAK,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,sDAAsD,KAAK,IAAI,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/utils/statuslist-purpose.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Shared fail-closed status-list `statusPurpose` check — the SINGLE source of truth for the
+ * invariant both the card revocation reader (`src/card/revocation.ts`) and the delegation status
+ * manager (`src/delegation/statuslist-manager.ts`) enforce, so the two readers cannot drift.
+ */
+/**
+ * Fail CLOSED unless the resolved status list's `statusPurpose` is present AND equals `wanted`. A
+ * list of a DIFFERENT kind (e.g. a `suspension` list read as `revocation`) must not be accepted —
+ * its clear bit would otherwise report "not revoked" from the wrong list, a fail-open bypass.
+ */
+export declare function assertStatusPurpose(listPurpose: unknown, wanted: string): void;
+//# sourceMappingURL=statuslist-purpose.d.ts.map

package/dist/utils/statuslist-purpose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"statuslist-purpose.d.ts","sourceRoot":"","sources":["../../src/utils/statuslist-purpose.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAO9E"}

package/dist/utils/statuslist-purpose.js

@@ -0,0 +1,19 @@
+/**
+ * Shared fail-closed status-list `statusPurpose` check — the SINGLE source of truth for the
+ * invariant both the card revocation reader (`src/card/revocation.ts`) and the delegation status
+ * manager (`src/delegation/statuslist-manager.ts`) enforce, so the two readers cannot drift.
+ */
+/**
+ * Fail CLOSED unless the resolved status list's `statusPurpose` is present AND equals `wanted`. A
+ * list of a DIFFERENT kind (e.g. a `suspension` list read as `revocation`) must not be accepted —
+ * its clear bit would otherwise report "not revoked" from the wrong list, a fail-open bypass.
+ */
+export function assertStatusPurpose(listPurpose, wanted) {
+    if (typeof listPurpose !== 'string') {
+        throw new Error(`status list has no statusPurpose (expected "${wanted}") — fail-closed`);
+    }
+    if (listPurpose !== wanted) {
+        throw new Error(`status list statusPurpose mismatch: "${listPurpose}" ≠ "${wanted}"`);
+    }
+}
+//# sourceMappingURL=statuslist-purpose.js.map

package/dist/utils/statuslist-purpose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"statuslist-purpose.js","sourceRoot":"","sources":["../../src/utils/statuslist-purpose.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAoB,EAAE,MAAc;IACtE,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,+CAA+C,MAAM,kBAAkB,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,wCAAwC,WAAW,QAAQ,MAAM,GAAG,CAAC,CAAC;IACxF,CAAC;AACH,CAAC"}

package/dist/utils/url.d.ts

@@ -0,0 +1,2 @@
+export declare function stripTrailingSlashes(value: string): string;
+//# sourceMappingURL=url.d.ts.map

package/dist/utils/url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/utils/url.ts"],"names":[],"mappings":"AAAA,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM1D"}

package/dist/utils/url.js

@@ -0,0 +1,8 @@
+export function stripTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value.charCodeAt(end - 1) === 47) {
+        end--;
+    }
+    return value.slice(0, end);
+}
+//# sourceMappingURL=url.js.map

package/dist/utils/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../src/utils/url.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACnD,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC"}