@promigence/sdk 0.1.0-beta.12

package/NOTICE

@@ -0,0 +1,14 @@
+Promigence — SDK and CLI (npm package `promigence`)
+Copyright 2026 Promigence AI
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README.md

@@ -0,0 +1,54 @@
+# @promigence/sdk
+
+The fastest sandboxes for AI agents and code. The TypeScript SDK for Promigence: snapshot an environment once,
+fork it as often as you need, run commands in every copy. Zero runtime dependencies; `import` or
+`require()` on Node.js 20 or newer.
+
+Docs: https://www.promigence.ai/docs
+
+## Install
+
+```sh
+npm i @promigence/sdk
+```
+
+You need a Promigence account (private beta, by invite). The quickest way to create one is the CLI:
+`npm i -g promigence`, then `promigence signup`. The SDK uses the key you pass (`apiKey`) or
+`PROMIGENCE_API_KEY`; with neither, the key the CLI stored: the system keychain, or
+`~/.config/promigence/credentials`. A key you pass or set is used as is; the stored one is not read.
+
+## Use it
+
+```ts
+import { Sandbox } from "@promigence/sdk";
+
+const sbx = await Sandbox.create();
+const r = await sbx.commands.run("python3 -c 'print(6*7)'");
+console.log(r.stdout);       // 42
+await sbx.kill();
+```
+
+Creating a client ahead of time? Call `client.preconnect()` right after: it starts opening the connection so
+your first request does not wait for it. It never throws and sends nothing.
+
+When `PROMIGENCE_API_KEY` is set in the environment, the SDK starts connecting as soon as it loads, so your
+first request does not wait for the connection; nothing is sent until you make a request. Set
+`PROMIGENCE_PRECONNECT=0` to turn this off.
+
+Two surfaces:
+
+- `Sandbox`: a simple class for one sandbox (`create`, `connect`, `commands.run`, `files`, `pty`,
+  `fork`, `kill`).
+- `PromigenceClient`: the native client (`runs.*`, `sandboxes.*`, `snapshots.*`, `me()`), with a quote
+  before a run and a hard spend cap.
+
+Errors are typed (`PromigenceError` and its subclasses), and each carries a `code`, a `fix` and a
+link to its documentation.
+
+## Support
+
+support@promigence.ai
+
+## Licence
+
+Apache-2.0. See `NOTICE`.

package/dist/blake3.d.ts

@@ -0,0 +1,10 @@
+/**
+ * BLAKE3, hand-rolled.
+ *
+ * Scope: unkeyed hashing, 32-byte output. No keyed mode, no derive-key, no XOF — nothing in the
+ * bundle format needs them.
+ */
+/** 32-byte digest, lowercase hex. */
+export declare function blake3Hex(input: Uint8Array): string;
+/** `blake3:<hex>` of a UTF-8 string — the digest form the manifest uses everywhere. */
+export declare const blake3Ref: (text: string) => string;

package/dist/blake3.js

@@ -0,0 +1,111 @@
+const IV = new Uint32Array([
+    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+]);
+const PERM = [2, 6, 3, 10, 7, 0, 4, 13, 1, 11, 12, 5, 9, 14, 15, 8];
+const CHUNK_START = 1, CHUNK_END = 2, PARENT = 4, ROOT = 8;
+const BLOCK_LEN = 64, CHUNK_LEN = 1024;
+const rotr = (x, n) => ((x >>> n) | (x << (32 - n))) >>> 0;
+function g(s, a, b, c, d, mx, my) {
+    s[a] = (s[a] + s[b] + mx) >>> 0;
+    s[d] = rotr(s[d] ^ s[a], 16);
+    s[c] = (s[c] + s[d]) >>> 0;
+    s[b] = rotr(s[b] ^ s[c], 12);
+    s[a] = (s[a] + s[b] + my) >>> 0;
+    s[d] = rotr(s[d] ^ s[a], 8);
+    s[c] = (s[c] + s[d]) >>> 0;
+    s[b] = rotr(s[b] ^ s[c], 7);
+}
+function compress(cv, m, counter, blockLen, flags) {
+    const s = new Uint32Array(16);
+    for (let i = 0; i < 8; i++)
+        s[i] = cv[i];
+    for (let i = 0; i < 4; i++)
+        s[8 + i] = IV[i];
+    s[12] = counter >>> 0;
+    s[13] = Math.floor(counter / 0x100000000) >>> 0;
+    s[14] = blockLen >>> 0;
+    s[15] = flags >>> 0;
+    let x = m;
+    for (let r = 0; r < 7; r++) {
+        g(s, 0, 4, 8, 12, x[0], x[1]);
+        g(s, 1, 5, 9, 13, x[2], x[3]);
+        g(s, 2, 6, 10, 14, x[4], x[5]);
+        g(s, 3, 7, 11, 15, x[6], x[7]);
+        g(s, 0, 5, 10, 15, x[8], x[9]);
+        g(s, 1, 6, 11, 12, x[10], x[11]);
+        g(s, 2, 7, 8, 13, x[12], x[13]);
+        g(s, 3, 4, 9, 14, x[14], x[15]);
+        if (r < 6) {
+            const y = new Uint32Array(16);
+            for (let i = 0; i < 16; i++)
+                y[i] = x[PERM[i]];
+            x = y;
+        }
+    }
+    for (let i = 0; i < 8; i++) {
+        s[i] = (s[i] ^ s[i + 8]) >>> 0;
+        s[i + 8] = (s[i + 8] ^ cv[i]) >>> 0;
+    }
+    return s;
+}
+function words(b, off, len) {
+    const m = new Uint32Array(16);
+    for (let i = 0; i < len; i++)
+        m[i >> 2] |= b[off + i] << ((i & 3) * 8);
+    for (let i = 0; i < 16; i++)
+        m[i] = m[i] >>> 0;
+    return m;
+}
+const chainingValue = (o) => compress(o.cv, o.m, o.counter, o.blockLen, o.flags).slice(0, 8);
+function chunkOutput(b, off, len, counter) {
+    let cv = IV;
+    const blocks = Math.max(1, Math.ceil(len / BLOCK_LEN));
+    for (let i = 0; i < blocks - 1; i++) {
+        const flags = i === 0 ? CHUNK_START : 0;
+        cv = compress(cv, words(b, off + i * BLOCK_LEN, BLOCK_LEN), counter, BLOCK_LEN, flags).slice(0, 8);
+    }
+    const last = (blocks - 1) * BLOCK_LEN;
+    return {
+        cv,
+        m: words(b, off + last, len - last),
+        counter,
+        blockLen: len - last,
+        flags: (blocks === 1 ? CHUNK_START : 0) | CHUNK_END,
+    };
+}
+function parentOutput(l, r) {
+    const m = new Uint32Array(16);
+    m.set(l, 0);
+    m.set(r, 8);
+    return { cv: IV, m, counter: 0, blockLen: BLOCK_LEN, flags: PARENT };
+}
+function leftLen(n) {
+    let l = CHUNK_LEN;
+    while (l * 2 < n)
+        l *= 2;
+    return l;
+}
+function subtree(b, off, len, counter) {
+    if (len <= CHUNK_LEN)
+        return chainingValue(chunkOutput(b, off, len, counter));
+    const ll = leftLen(len);
+    return chainingValue(parentOutput(subtree(b, off, ll, counter), subtree(b, off + ll, len - ll, counter + ll / CHUNK_LEN)));
+}
+export function blake3Hex(input) {
+    const n = input.length;
+    const root = n <= CHUNK_LEN
+        ? chunkOutput(input, 0, n, 0)
+        : (() => {
+            const ll = leftLen(n);
+            return parentOutput(subtree(input, 0, ll, 0), subtree(input, ll, n - ll, ll / CHUNK_LEN));
+        })();
+    const s = compress(root.cv, root.m, 0, root.blockLen, root.flags | ROOT);
+    let out = "";
+    for (let i = 0; i < 8; i++) {
+        const w = s[i];
+        for (let k = 0; k < 4; k++)
+            out += (((w >>> (k * 8)) & 0xff) | 0x100).toString(16).slice(1);
+    }
+    return out;
+}
+export const blake3Ref = (text) => `blake3:${blake3Hex(new TextEncoder().encode(text))}`;

package/dist/bundle.d.ts

@@ -0,0 +1,96 @@
+export declare const BUNDLE_SCHEMA: "promigence.bundle/v1";
+export declare const MANIFEST_SCHEMA: "promigence.snapshot/v1";
+export declare const BUNDLE_EXT = ".promigence";
+export type Json = null | boolean | number | string | Json[] | {
+    [k: string]: Json;
+};
+/** Section digests: `provenance` and `verification` always; a full or citation bundle records one per section it has. */
+export interface Digests {
+    provenance: string;
+    verification: string;
+    [section: string]: string;
+}
+/** The sealed sections of a bundle: the digests of the sections the API did not disclose. */
+export interface Sealed {
+    platform: string;
+    machine: string;
+    layers: string;
+}
+/** On a citation bundle: the digest of the one section it leaves out. */
+export interface LayersRef {
+    digest: string;
+    [extra: string]: unknown;
+}
+export interface Bundle {
+    schema: string;
+    snap_id: string;
+    manifest_hash: string;
+    alias?: string;
+    digests: Digests;
+    /** Empty on a sealed bundle. */
+    layers: Json[];
+    /** Present only on a citation bundle. */
+    layers_ref?: LayersRef;
+    /** Present only on a sealed bundle. */
+    sealed?: Sealed;
+    provenance: Record<string, Json>;
+    verification: Record<string, Json>;
+    /** A full or citation bundle's other sections, each covered by a digest. */
+    [section: string]: unknown;
+}
+export type Form = "full" | "citation" | "sealed";
+/**
+ * Canonical JSON (RFC 8785): what every digest in a bundle is computed over.
+ *
+ * Two rules come free in JavaScript and are used deliberately rather than re-implemented:
+ * `<` on strings compares UTF-16 code units, which is exactly RFC 8785's key ordering; and
+ * `String(n)` *is* ECMAScript's `Number.prototype.toString`, which is exactly its number form. `JSON.stringify`
+ * of a string is its escaping (only `"` `\` and controls, short forms, lowercase `\u00xx`).
+ */
+export declare function canonicalize(v: unknown): string;
+/** `blake3:<hex>` of a value's canonical JSON. */
+export declare const digestOf: (v: unknown) => string;
+/**
+ * Insert insignificant whitespace into canonical JSON. A whitespace transform rather than a
+ * second serializer, so key order, number form and escaping are canonical by construction and
+ * `strip` recovers the exact bytes that were hashed.
+ */
+export declare function pretty(canonical: string): string;
+/** The exact inverse of `pretty`: drop every whitespace byte outside a string. */
+export declare function strip(text: string): string;
+export interface BuildOpts {
+    alias?: string | undefined;
+}
+/**
+ * Build a bundle from a snapshot's manifest as the API serves it (`snapshots.manifest`): the
+ * sealed form, which names exactly one environment. The id is the head of `manifest_hash`, which
+ * `verifyBundle` checks.
+ */
+export declare function buildBundle(manifest: Record<string, unknown>, opts?: BuildOpts): Bundle;
+/** RFC 8785 canonical bytes: what every digest is computed over. */
+export declare const canonicalBundle: (b: Bundle) => string;
+/** The file: the canonical bytes with whitespace put back, plus a final newline. */
+export declare const renderBundle: (b: Bundle) => string;
+/** `sealed` (what an export writes), `citation` (one section left out, pinned by its digest) or `full`. */
+export declare function bundleForm(b: Bundle): Form;
+/** The digest that names the platform a sealed bundle's environment runs on; `undefined` on any other form. */
+export declare const platformOf: (b: Bundle) => string | undefined;
+export type BundleErrorKind = "schema" | "snap_id_format" | "hash_format" | "id_mismatch" | "section_digest" | "manifest_hash" | "canonical";
+export declare class BundleVerifyError extends Error {
+    readonly kind: BundleErrorKind;
+    readonly detail: Record<string, unknown>;
+    constructor(kind: BundleErrorKind, message: string, detail?: Record<string, unknown>);
+}
+/**
+ * Everything checkable without the network, in the order that makes each failure specific: a
+ * changed section is a `section_digest` failure naming that section, a changed `manifest_hash` is
+ * a `manifest_hash` failure (a full bundle) or an `id_mismatch`, and a rewritten `snap_id` with
+ * intact content is `id_mismatch`.
+ *
+ * A sealed bundle's provenance and verification digests and its identity are verified here; the
+ * sealed sections are the API's to answer. A full or citation bundle has every section it carries
+ * checked against its recorded digest, and a full one its `manifest_hash` against its content.
+ */
+export declare function verifyBundle(b: Bundle): Form;
+/** Parse a `.promigence` file. Refuses anything that is not JSON or not a bundle; `verifyBundle` does the rest. */
+export declare function parseBundle(text: string): Bundle;

package/dist/bundle.js

@@ -0,0 +1,227 @@
+import { blake3Ref } from "./blake3.js";
+export const BUNDLE_SCHEMA = "promigence.bundle/v1";
+export const MANIFEST_SCHEMA = "promigence.snapshot/v1";
+export const BUNDLE_EXT = ".promigence";
+export function canonicalize(v) {
+    if (v === null)
+        return "null";
+    switch (typeof v) {
+        case "boolean": return v ? "true" : "false";
+        case "number":
+            if (!Number.isFinite(v))
+                throw new TypeError(`non-finite number cannot be canonicalised: ${v}`);
+            return Object.is(v, -0) ? "0" : String(v);
+        case "string": return JSON.stringify(v);
+        case "object": break;
+        default: throw new TypeError(`cannot canonicalise ${typeof v}`);
+    }
+    if (Array.isArray(v))
+        return `[${v.map(canonicalize).join(",")}]`;
+    const o = v;
+    const keys = Object.keys(o).filter((k) => o[k] !== undefined).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalize(o[k])}`).join(",")}}`;
+}
+export const digestOf = (v) => blake3Ref(canonicalize(v));
+export function pretty(canonical) {
+    let out = "";
+    let depth = 0, inStr = false, esc = false;
+    for (let i = 0; i < canonical.length; i++) {
+        const c = canonical[i];
+        if (inStr) {
+            out += c;
+            if (esc)
+                esc = false;
+            else if (c === "\\")
+                esc = true;
+            else if (c === '"')
+                inStr = false;
+            continue;
+        }
+        if (c === '"') {
+            inStr = true;
+            out += c;
+            continue;
+        }
+        if (c === "{" || c === "[") {
+            const close = c === "{" ? "}" : "]";
+            if (canonical[i + 1] === close) {
+                out += c + close;
+                i++;
+                continue;
+            }
+            depth++;
+            out += c + "\n" + "  ".repeat(depth);
+            continue;
+        }
+        if (c === "}" || c === "]") {
+            depth = Math.max(0, depth - 1);
+            out += "\n" + "  ".repeat(depth) + c;
+            continue;
+        }
+        if (c === ",") {
+            out += ",\n" + "  ".repeat(depth);
+            continue;
+        }
+        if (c === ":") {
+            out += ": ";
+            continue;
+        }
+        out += c;
+    }
+    return out;
+}
+export function strip(text) {
+    let out = "";
+    let inStr = false, esc = false;
+    for (const c of text) {
+        if (inStr) {
+            out += c;
+            if (esc)
+                esc = false;
+            else if (c === "\\")
+                esc = true;
+            else if (c === '"')
+                inStr = false;
+            continue;
+        }
+        if (c === '"') {
+            inStr = true;
+            out += c;
+            continue;
+        }
+        if (c === " " || c === "\t" || c === "\n" || c === "\r")
+            continue;
+        out += c;
+    }
+    return out;
+}
+const idOf = (hash) => `snap_${hash.slice(7, 7 + 24)}`;
+export function buildBundle(manifest, opts = {}) {
+    const sealedIn = manifest?.["sealed"];
+    if (!sealedIn || typeof sealedIn !== "object" || Array.isArray(sealedIn)) {
+        throw new BundleVerifyError("schema", "a bundle is built from a sealed manifest, and this one is not sealed");
+    }
+    const alias = opts.alias ?? manifest["alias"] ?? undefined;
+    const s = sealedIn;
+    const hash = String(manifest["manifest_hash"] ?? "");
+    return {
+        schema: BUNDLE_SCHEMA,
+        snap_id: idOf(hash),
+        manifest_hash: hash,
+        ...(alias ? { alias } : {}),
+        digests: {
+            provenance: digestOf(manifest["provenance"]),
+            verification: digestOf(manifest["verification"]),
+        },
+        layers: [],
+        sealed: { platform: String(s["platform"] ?? ""), machine: String(s["machine"] ?? ""), layers: String(s["layers"] ?? "") },
+        provenance: manifest["provenance"],
+        verification: manifest["verification"],
+    };
+}
+export const canonicalBundle = (b) => canonicalize(b);
+export const renderBundle = (b) => pretty(canonicalize(b)) + "\n";
+export function bundleForm(b) {
+    if (b.sealed !== undefined)
+        return "sealed";
+    return b.layers_ref !== undefined ? "citation" : "full";
+}
+export const platformOf = (b) => b.sealed?.platform;
+export class BundleVerifyError extends Error {
+    kind;
+    detail;
+    constructor(kind, message, detail = {}) {
+        super(message);
+        this.name = "BundleVerifyError";
+        this.kind = kind;
+        this.detail = detail;
+    }
+}
+const HEX = (s, n) => new RegExp(`^[0-9a-f]{${n}}$`).test(s);
+function checkHash(field, h) {
+    const s = String(h ?? "");
+    if (!s.startsWith("blake3:") || !HEX(s.slice(7), 64)) {
+        throw new BundleVerifyError("hash_format", `${field} ${JSON.stringify(s)} is not blake3:<64 lowercase hex>`, { field, found: s });
+    }
+}
+function section(name, recorded, v) {
+    const computed = digestOf(v);
+    if (computed !== recorded) {
+        throw new BundleVerifyError("section_digest", `section \`${name}\` does not match its recorded digest: recorded ${recorded}, computed ${computed}`, { section: name, recorded, computed });
+    }
+}
+function checkId(b) {
+    const derived = idOf(b.manifest_hash);
+    if (derived !== b.snap_id) {
+        throw new BundleVerifyError("id_mismatch", `snap_id ${b.snap_id} does not match manifest_hash (which names ${derived}): the identity and the content of this bundle disagree`, { snap_id: b.snap_id, derived });
+    }
+}
+export function verifyBundle(b) {
+    if (b?.schema !== BUNDLE_SCHEMA) {
+        throw new BundleVerifyError("schema", `not a ${BUNDLE_SCHEMA} document: schema is ${JSON.stringify(b?.schema ?? null)}`, { found: b?.schema });
+    }
+    if (!/^snap_[0-9a-f]{24}$/.test(b.snap_id ?? "")) {
+        throw new BundleVerifyError("snap_id_format", `snap_id ${JSON.stringify(b.snap_id ?? null)} is not snap_<24 lowercase hex>`, { found: b.snap_id });
+    }
+    checkHash("manifest_hash", b.manifest_hash);
+    const form = bundleForm(b);
+    if (form === "sealed") {
+        for (const k of ["platform", "machine", "layers"])
+            checkHash(`sealed.${k}`, b.sealed?.[k]);
+        for (const k of ["provenance", "verification"])
+            checkHash(`digests.${k}`, b.digests?.[k]);
+        section("provenance", b.digests.provenance, b.provenance);
+        section("verification", b.digests.verification, b.verification);
+        checkId(b);
+        return form;
+    }
+    const digests = b.digests && typeof b.digests === "object" ? { ...b.digests } : {};
+    const names = Object.keys(digests).sort();
+    for (const k of ["provenance", "verification"]) {
+        if (!names.includes(k))
+            throw new BundleVerifyError("schema", `digests.${k} is missing`, { form });
+    }
+    for (const k of names)
+        checkHash(`digests.${k}`, digests[k]);
+    let omitted;
+    if (form === "citation") {
+        const pinned = String(b.layers_ref?.digest ?? "");
+        checkHash("layers_ref.digest", pinned);
+        omitted = names.find((k) => digests[k] === pinned);
+        if (omitted === undefined) {
+            throw new BundleVerifyError("section_digest", `layers_ref.digest ${pinned} pins no section this bundle records`, { recorded: pinned });
+        }
+    }
+    for (const k of names) {
+        if (k === omitted)
+            continue;
+        if (b[k] === undefined)
+            throw new BundleVerifyError("schema", `section \`${k}\` is missing`, { section: k });
+        section(k, digests[k], b[k]);
+    }
+    if (form === "full") {
+        const content = { schema: MANIFEST_SCHEMA };
+        for (const k of names)
+            content[k] = b[k];
+        const computed = blake3Ref(canonicalize(content));
+        if (computed !== b.manifest_hash) {
+            throw new BundleVerifyError("manifest_hash", `manifest_hash mismatch: the bundle records ${b.manifest_hash}, its own contents hash to ${computed}`, { recorded: b.manifest_hash, computed });
+        }
+    }
+    checkId(b);
+    return form;
+}
+export function parseBundle(text) {
+    let v;
+    try {
+        v = JSON.parse(text);
+    }
+    catch (e) {
+        throw new BundleVerifyError("canonical", `not JSON: ${e.message}`);
+    }
+    const b = v;
+    if (b?.schema !== BUNDLE_SCHEMA) {
+        throw new BundleVerifyError("schema", `not a ${BUNDLE_SCHEMA} document: schema is ${JSON.stringify(b?.schema ?? null)}`, { found: b?.schema });
+    }
+    return b;
+}

package/dist/ca-guard.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/ca-guard.js

@@ -0,0 +1,166 @@
+import * as crypto from "node:crypto";
+import * as tls from "node:tls";
+const DISTRUSTED_SPKI_SHA256 = new Set([
+    "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105",
+    "49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f",
+    "e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41",
+    "5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0",
+    "43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b",
+    "63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8",
+    "ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6",
+    "92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30",
+]);
+const MAX_CHAIN_DEPTH = 10;
+const COMPROMISED_KEY_MESSAGE = "The server's certificate chain uses a key that is publicly known to be compromised, so the connection was refused.";
+export class CompromisedKeyError extends Error {
+    constructor() {
+        super(COMPROMISED_KEY_MESSAGE);
+        this.name = "CompromisedKeyError";
+    }
+}
+export function compromisedKeyCause(err) {
+    try {
+        let e = err;
+        for (let i = 0; i < 4; i++) {
+            if (typeof e !== "object" || e === null)
+                return undefined;
+            if (e instanceof CompromisedKeyError)
+                return e;
+            e = e.cause;
+        }
+    }
+    catch {
+    }
+    return undefined;
+}
+const TEST_HASHES = new Set();
+let parseCount = 0;
+function spkiSha256(raw) {
+    parseCount++;
+    try {
+        const der = new crypto.X509Certificate(raw).publicKey.export({ type: "spki", format: "der" });
+        return crypto.createHash("sha256").update(der).digest("hex");
+    }
+    catch {
+        return undefined;
+    }
+}
+const SPKI_BY_FINGERPRINT = new Map();
+const SPKI_CACHE_MAX = 512;
+function certSpkiSha256(node, raw) {
+    const fp = node.fingerprint256;
+    if (typeof fp !== "string" || fp === "")
+        return spkiSha256(raw);
+    const hit = SPKI_BY_FINGERPRINT.get(fp);
+    if (hit !== undefined)
+        return hit;
+    const hash = spkiSha256(raw);
+    if (hash === undefined)
+        return undefined;
+    if (SPKI_BY_FINGERPRINT.size >= SPKI_CACHE_MAX) {
+        for (const oldest of SPKI_BY_FINGERPRINT.keys()) {
+            SPKI_BY_FINGERPRINT.delete(oldest);
+            break;
+        }
+    }
+    SPKI_BY_FINGERPRINT.set(fp, hash);
+    return hash;
+}
+export function chainHasCompromisedKey(cert) {
+    try {
+        let node = cert;
+        const seen = new Set();
+        for (let depth = 0; node && depth < MAX_CHAIN_DEPTH; depth++) {
+            if (seen.has(node))
+                break;
+            seen.add(node);
+            const raw = node.raw;
+            if (raw !== undefined && raw.length > 0) {
+                const hash = certSpkiSha256(node, raw);
+                if (hash !== undefined && DISTRUSTED_SPKI_SHA256.has(hash))
+                    return true;
+            }
+            const issuer = node.issuerCertificate;
+            if (issuer === undefined || issuer === node)
+                break;
+            node = issuer;
+        }
+    }
+    catch {
+        return false;
+    }
+    return false;
+}
+export function makeCertChainGuard(prev = tls.checkServerIdentity) {
+    return (host, cert) => {
+        const prevResult = prev(host, cert);
+        if (prevResult)
+            return prevResult;
+        return chainHasCompromisedKey(cert) ? new CompromisedKeyError() : undefined;
+    };
+}
+export const guardCertChain = makeCertChainGuard();
+const DISPATCHER_KEYS = [Symbol.for("undici.globalDispatcher.1"), Symbol.for("undici.globalDispatcher.2")];
+let guardedAgent;
+function isNode() {
+    try {
+        const v = typeof process === "object" ? process.versions : undefined;
+        return Boolean(v?.["node"]) && !v?.["bun"] && !v?.["deno"];
+    }
+    catch {
+        return false;
+    }
+}
+function undiciAgentCtor() {
+    for (const key of DISPATCHER_KEYS) {
+        const d = globalThis[key];
+        const ctor = d?.constructor;
+        if (typeof ctor === "function" && ctor.name === "Agent")
+            return ctor;
+    }
+    return undefined;
+}
+export function guardedFetchDispatcher() {
+    if (guardedAgent !== undefined)
+        return guardedAgent === null ? undefined : guardedAgent;
+    guardedAgent = null;
+    try {
+        if (!isNode())
+            return undefined;
+        const Agent = undiciAgentCtor();
+        if (Agent === undefined)
+            return undefined;
+        const agent = new Agent({ connect: { checkServerIdentity: guardCertChain } });
+        if (agent !== null && typeof agent.dispatch === "function") {
+            guardedAgent = agent;
+            return agent;
+        }
+    }
+    catch {
+    }
+    return undefined;
+}
+export const __caGuardInternals = {
+    distrustedCount() {
+        return DISTRUSTED_SPKI_SHA256.size;
+    },
+    has(hashHex) {
+        return DISTRUSTED_SPKI_SHA256.has(hashHex);
+    },
+    addForTest(hashHex) {
+        DISTRUSTED_SPKI_SHA256.add(hashHex);
+        TEST_HASHES.add(hashHex);
+    },
+    testHashes() {
+        return [...TEST_HASHES];
+    },
+    parses() {
+        return parseCount;
+    },
+    cacheSize() {
+        return SPKI_BY_FINGERPRINT.size;
+    },
+    resetAgent() {
+        guardedAgent = undefined;
+    },
+};