@quantsafe/mcp 0.0.0-stage → 0.1.0

package/dist/lib/qsafe/keyfile.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.wrapKeyfile = wrapKeyfile;
+exports.unwrapKeyfile = unwrapKeyfile;
+const argon2_1 = require("@noble/hashes/argon2");
+const utils_1 = require("@noble/hashes/utils");
+const aead_1 = require("./aead");
+const constants_1 = require("./constants");
+const hkdf_1 = require("./hkdf");
+const types_1 = require("./types");
+const utf8Encoder = new TextEncoder();
+const utf8Decoder = new TextDecoder();
+function base64urlEncode(bytes) {
+    let bin = '';
+    for (let i = 0; i < bytes.length; i++) {
+        bin += String.fromCharCode(bytes[i]);
+    }
+    return btoa(bin).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
+}
+function base64urlDecode(s) {
+    const pad = s.length % 4 === 0 ? '' : '='.repeat(4 - (s.length % 4));
+    const std = s.replaceAll('-', '+').replaceAll('_', '/') + pad;
+    const bin = atob(std);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++) {
+        out[i] = bin.charCodeAt(i);
+    }
+    return out;
+}
+function serializeKeypair(kp) {
+    const json = JSON.stringify({
+        pk: {
+            mlkem: base64urlEncode(kp.publicKey.mlkem),
+            x25519: base64urlEncode(kp.publicKey.x25519),
+            mldsa: base64urlEncode(kp.publicKey.mldsa),
+        },
+        sk: {
+            mlkem: base64urlEncode(kp.secretKey.mlkem),
+            x25519: base64urlEncode(kp.secretKey.x25519),
+            mldsa: base64urlEncode(kp.secretKey.mldsa),
+        },
+    });
+    return utf8Encoder.encode(json);
+}
+function deserializeKeypair(bytes) {
+    const obj = JSON.parse(utf8Decoder.decode(bytes));
+    return {
+        publicKey: {
+            mlkem: base64urlDecode(obj.pk.mlkem),
+            x25519: base64urlDecode(obj.pk.x25519),
+            mldsa: base64urlDecode(obj.pk.mldsa),
+        },
+        secretKey: {
+            mlkem: base64urlDecode(obj.sk.mlkem),
+            x25519: base64urlDecode(obj.sk.x25519),
+            mldsa: base64urlDecode(obj.sk.mldsa),
+        },
+    };
+}
+async function deriveWrapKey(passphrase, salt, params) {
+    const passBytes = utf8Encoder.encode(passphrase);
+    const argonOut = await (0, argon2_1.argon2idAsync)(passBytes, salt, {
+        t: params.t,
+        m: params.m,
+        p: params.p,
+        dkLen: 32,
+    });
+    return (0, hkdf_1.hkdfDerive)(argonOut, constants_1.HKDF_SALT, constants_1.HKDF_INFO_KEYFILE_WRAP, constants_1.AES_KEY_LEN);
+}
+async function wrapKeyfile(kp, passphrase, params = constants_1.ARGON2ID_PARAMS_PROD) {
+    if (!passphrase || passphrase.length === 0) {
+        throw new Error('Passphrase must be non-empty');
+    }
+    const salt = (0, utils_1.randomBytes)(constants_1.ARGON2ID_SALT_LEN);
+    const nonce = (0, utils_1.randomBytes)(constants_1.NONCE_LEN);
+    const wrapKey = await deriveWrapKey(passphrase, salt, params);
+    const plaintext = serializeKeypair(kp);
+    const wrapped = await (0, aead_1.aeadEncrypt)(wrapKey, nonce, plaintext, utf8Encoder.encode(constants_1.KEYFILE_AAD));
+    return {
+        v: 1,
+        kdf: 'argon2id',
+        kdfParams: { t: params.t, m: params.m, p: params.p },
+        salt: base64urlEncode(salt),
+        nonce: base64urlEncode(nonce),
+        wrapped: base64urlEncode(wrapped),
+    };
+}
+async function unwrapKeyfile(kf, passphrase) {
+    if (kf.v !== 1) {
+        throw new Error(`Unsupported keyfile version ${kf.v}`);
+    }
+    if (kf.kdf !== 'argon2id') {
+        throw new Error(`Unsupported keyfile KDF ${kf.kdf}`);
+    }
+    const salt = base64urlDecode(kf.salt);
+    const nonce = base64urlDecode(kf.nonce);
+    const wrapped = base64urlDecode(kf.wrapped);
+    const wrapKey = await deriveWrapKey(passphrase, salt, kf.kdfParams);
+    let plaintext;
+    try {
+        plaintext = await (0, aead_1.aeadDecrypt)(wrapKey, nonce, wrapped, utf8Encoder.encode(constants_1.KEYFILE_AAD));
+    }
+    catch {
+        throw new types_1.InvalidPassphraseError();
+    }
+    return deserializeKeypair(plaintext);
+}

package/dist/lib/qsafe/keys.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keysFromSeeds = keysFromSeeds;
+const ml_dsa_1 = require("@noble/post-quantum/ml-dsa");
+const ml_kem_1 = require("@noble/post-quantum/ml-kem");
+const ed25519_1 = require("@noble/curves/ed25519");
+function keysFromSeeds(seeds) {
+    const mlkem = ml_kem_1.ml_kem768.keygen(seeds.mlkem);
+    const mldsa = ml_dsa_1.ml_dsa65.keygen(seeds.mldsa);
+    const x25519Pub = ed25519_1.x25519.getPublicKey(seeds.x25519);
+    return {
+        publicKey: {
+            mlkem: mlkem.publicKey,
+            x25519: x25519Pub,
+            mldsa: mldsa.publicKey,
+        },
+        secretKey: {
+            mlkem: mlkem.secretKey,
+            x25519: seeds.x25519,
+            mldsa: mldsa.secretKey,
+        },
+    };
+}

package/dist/lib/qsafe/types.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignatureError = exports.CorruptFileError = exports.InvalidPassphraseError = exports.QsafeError = void 0;
+class QsafeError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'QsafeError';
+    }
+}
+exports.QsafeError = QsafeError;
+class InvalidPassphraseError extends QsafeError {
+    constructor() {
+        super('Wrong passphrase or corrupted key file', 'INVALID_PASSPHRASE');
+        this.name = 'InvalidPassphraseError';
+    }
+}
+exports.InvalidPassphraseError = InvalidPassphraseError;
+class CorruptFileError extends QsafeError {
+    constructor(detail) {
+        super(`Corrupt or invalid .qsafe file: ${detail}`, 'CORRUPT_FILE');
+        this.name = 'CorruptFileError';
+    }
+}
+exports.CorruptFileError = CorruptFileError;
+class SignatureError extends QsafeError {
+    constructor() {
+        super('Signature verification failed', 'SIGNATURE_FAILED');
+        this.name = 'SignatureError';
+    }
+}
+exports.SignatureError = SignatureError;

package/dist/lib/seal/constants.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SEAL_ALGO = exports.SEAL_VERSION = void 0;
+// Kept free of DOM code so the MCP build (Node, no canvas) stamps the same values as the web Seal.
+exports.SEAL_VERSION = '1';
+exports.SEAL_ALGO = 'ML-KEM-768+X25519/AES-256-GCM/ML-DSA-65';

package/dist/lib/seal/png-text.js

@@ -0,0 +1,312 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePngTextChunks = parsePngTextChunks;
+exports.parseSealTextChunks = parseSealTextChunks;
+exports.injectSealTextChunks = injectSealTextChunks;
+exports.buildMinimalSealPng = buildMinimalSealPng;
+const PNG_SIGNATURE = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+function readU32BE(b, o) {
+    return ((((b[o] ?? 0) << 24) | ((b[o + 1] ?? 0) << 16) | ((b[o + 2] ?? 0) << 8) | (b[o + 3] ?? 0)) >>> 0);
+}
+function bytesToAscii(b) {
+    let s = '';
+    for (let i = 0; i < b.length; i++) {
+        s += String.fromCharCode(b[i]);
+    }
+    return s;
+}
+const CRC_TABLE = (() => {
+    const t = new Array(256);
+    for (let n = 0; n < 256; n++) {
+        let c = n;
+        for (let k = 0; k < 8; k++) {
+            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+        }
+        t[n] = c >>> 0;
+    }
+    return t;
+})();
+function crc32(bytes) {
+    let c = 0xffffffff;
+    for (let i = 0; i < bytes.length; i++) {
+        c = (CRC_TABLE[(c ^ bytes[i]) & 0xff] ^ (c >>> 8)) >>> 0;
+    }
+    return (c ^ 0xffffffff) >>> 0;
+}
+function isPng(b) {
+    if (b.length < 8)
+        return false;
+    for (let i = 0; i < 8; i++) {
+        if (b[i] !== PNG_SIGNATURE[i])
+            return false;
+    }
+    return true;
+}
+function parsePngTextChunks(png) {
+    if (!isPng(png))
+        throw new Error('Not a PNG: bad signature');
+    const out = [];
+    let o = 8;
+    const utf8 = new TextDecoder('utf-8', { fatal: false });
+    while (o + 8 <= png.length) {
+        const len = readU32BE(png, o);
+        o += 4;
+        if (o + 4 > png.length)
+            throw new Error('Truncated PNG chunk type');
+        const type = bytesToAscii(png.slice(o, o + 4));
+        o += 4;
+        if (o + len + 4 > png.length)
+            throw new Error('Truncated PNG chunk data');
+        const data = png.slice(o, o + len);
+        o += len;
+        const declaredCrc = readU32BE(png, o);
+        o += 4;
+        const computedCrc = crc32(png.slice(o - len - 8, o - 4));
+        if (declaredCrc !== computedCrc) {
+            // Skip chunks with a bad CRC. Do not push their text payload.
+            if (type === 'IEND')
+                break;
+            continue;
+        }
+        if (type === 'tEXt') {
+            const nul = data.indexOf(0);
+            if (nul > 0) {
+                const keyword = bytesToAscii(data.slice(0, nul));
+                const text = bytesToAscii(data.slice(nul + 1));
+                out.push({ keyword, text });
+            }
+        }
+        else if (type === 'iTXt') {
+            const nul = data.indexOf(0);
+            if (nul > 0) {
+                const keyword = bytesToAscii(data.slice(0, nul));
+                if (data.length >= nul + 5) {
+                    let p = nul + 3;
+                    while (p < data.length && data[p] !== 0)
+                        p++;
+                    p++; // skip language tag NUL
+                    while (p < data.length && data[p] !== 0)
+                        p++;
+                    p++; // skip translated keyword NUL
+                    if (p <= data.length) {
+                        const text = utf8.decode(data.slice(p));
+                        out.push({ keyword, text });
+                    }
+                }
+            }
+        }
+        if (type === 'IEND')
+            break;
+    }
+    return out;
+}
+const SEAL_TEXT_KEYS = [
+    'qsafe_version',
+    'qsafe_timestamp',
+    'qsafe_algo',
+    'qsafe_file_hash',
+    'qsafe_wallet',
+];
+const SEAL_X402_KEYS = {
+    qsafe_x402_endpoint: 'endpoint',
+    qsafe_x402_amount: 'amount',
+    qsafe_x402_token: 'token',
+    qsafe_x402_tx_hash: 'tx_hash',
+};
+const SEAL_ANCHOR_KEYS = {
+    qsafe_anchor_chain: 'chain_id',
+    qsafe_anchor_registry: 'registry',
+    qsafe_anchor_tx: 'tx_hash',
+    qsafe_anchor_account: 'account',
+    qsafe_anchor_time: 'time',
+};
+function parseSealTextChunks(png) {
+    let entries;
+    try {
+        entries = parsePngTextChunks(png);
+    }
+    catch {
+        return { valid: false, fields: {} };
+    }
+    const map = new Map();
+    for (const e of entries)
+        map.set(e.keyword, e.text);
+    const fields = {};
+    if (map.has('qsafe_version'))
+        fields.version = map.get('qsafe_version');
+    if (map.has('qsafe_timestamp'))
+        fields.timestamp = map.get('qsafe_timestamp');
+    if (map.has('qsafe_algo'))
+        fields.algo = map.get('qsafe_algo');
+    if (map.has('qsafe_file_hash'))
+        fields.file_hash = map.get('qsafe_file_hash');
+    if (map.has('qsafe_wallet'))
+        fields.wallet = map.get('qsafe_wallet');
+    const x402 = {};
+    let hasX402 = false;
+    for (const [k, field] of Object.entries(SEAL_X402_KEYS)) {
+        if (map.has(k)) {
+            x402[field] = map.get(k);
+            hasX402 = true;
+        }
+    }
+    if (hasX402)
+        fields.x402 = x402;
+    const anchor = {};
+    let hasAnchor = false;
+    for (const [k, field] of Object.entries(SEAL_ANCHOR_KEYS)) {
+        if (map.has(k)) {
+            anchor[field] = map.get(k);
+            hasAnchor = true;
+        }
+    }
+    if (hasAnchor)
+        fields.anchor = anchor;
+    const valid = SEAL_TEXT_KEYS.some((k) => map.has(k)) || hasX402;
+    return { valid, fields };
+}
+function buildChunk(type, data) {
+    const out = new Uint8Array(12 + data.length);
+    const dv = new DataView(out.buffer);
+    dv.setUint32(0, data.length, false);
+    out[4] = type.charCodeAt(0);
+    out[5] = type.charCodeAt(1);
+    out[6] = type.charCodeAt(2);
+    out[7] = type.charCodeAt(3);
+    out.set(data, 8);
+    const crc = crc32(out.subarray(4, 8 + data.length));
+    dv.setUint32(8 + data.length, crc, false);
+    return out;
+}
+function buildTextChunk(keyword, text) {
+    const kw = new TextEncoder().encode(keyword);
+    const tx = new TextEncoder().encode(text);
+    const data = new Uint8Array(kw.length + 1 + tx.length);
+    data.set(kw, 0);
+    data[kw.length] = 0;
+    data.set(tx, kw.length + 1);
+    return buildChunk('tEXt', data);
+}
+const QSAFE_KEYS_SET = new Set([
+    'qsafe_version',
+    'qsafe_timestamp',
+    'qsafe_algo',
+    'qsafe_file_hash',
+    'qsafe_wallet',
+    'qsafe_x402_endpoint',
+    'qsafe_x402_amount',
+    'qsafe_x402_token',
+    'qsafe_x402_tx_hash',
+    ...Object.keys(SEAL_ANCHOR_KEYS),
+]);
+function injectSealTextChunks(png, fields) {
+    if (!isPng(png))
+        throw new Error('Not a PNG: bad signature');
+    // Pass 1: walk chunks, drop any existing qsafe_* tEXt chunks (idempotency),
+    // remember IEND offset.
+    const segments = [];
+    segments.push(png.slice(0, 8));
+    let o = 8;
+    let iendChunk = null;
+    while (o + 8 <= png.length) {
+        const len = readU32BE(png, o);
+        if (o + 8 + len + 4 > png.length)
+            throw new Error('Truncated PNG chunk');
+        const type = bytesToAscii(png.slice(o + 4, o + 8));
+        const chunkEnd = o + 8 + len + 4;
+        const chunk = png.slice(o, chunkEnd);
+        if (type === 'IEND') {
+            iendChunk = chunk;
+            break;
+        }
+        if (type === 'tEXt') {
+            const data = chunk.slice(8, 8 + len);
+            const nul = data.indexOf(0);
+            if (nul > 0) {
+                const keyword = bytesToAscii(data.slice(0, nul));
+                if (QSAFE_KEYS_SET.has(keyword)) {
+                    o = chunkEnd;
+                    continue;
+                }
+            }
+        }
+        segments.push(chunk);
+        o = chunkEnd;
+    }
+    if (!iendChunk)
+        throw new Error('PNG missing IEND chunk');
+    // Pass 2: append new qsafe_* tEXt chunks, then IEND.
+    const newChunks = [];
+    if (fields.version !== undefined)
+        newChunks.push(buildTextChunk('qsafe_version', fields.version));
+    if (fields.timestamp !== undefined)
+        newChunks.push(buildTextChunk('qsafe_timestamp', fields.timestamp));
+    if (fields.algo !== undefined)
+        newChunks.push(buildTextChunk('qsafe_algo', fields.algo));
+    if (fields.file_hash !== undefined)
+        newChunks.push(buildTextChunk('qsafe_file_hash', fields.file_hash));
+    if (fields.wallet !== undefined)
+        newChunks.push(buildTextChunk('qsafe_wallet', fields.wallet));
+    if (fields.x402) {
+        if (fields.x402.endpoint !== undefined)
+            newChunks.push(buildTextChunk('qsafe_x402_endpoint', fields.x402.endpoint));
+        if (fields.x402.amount !== undefined)
+            newChunks.push(buildTextChunk('qsafe_x402_amount', fields.x402.amount));
+        if (fields.x402.token !== undefined)
+            newChunks.push(buildTextChunk('qsafe_x402_token', fields.x402.token));
+        if (fields.x402.tx_hash !== undefined)
+            newChunks.push(buildTextChunk('qsafe_x402_tx_hash', fields.x402.tx_hash));
+    }
+    if (fields.anchor) {
+        for (const [keyword, field] of Object.entries(SEAL_ANCHOR_KEYS)) {
+            const value = fields.anchor[field];
+            if (value !== undefined)
+                newChunks.push(buildTextChunk(keyword, value));
+        }
+    }
+    segments.push(...newChunks);
+    segments.push(iendChunk);
+    let total = 0;
+    for (const s of segments)
+        total += s.length;
+    const out = new Uint8Array(total);
+    let p = 0;
+    for (const s of segments) {
+        out.set(s, p);
+        p += s.length;
+    }
+    return out;
+}
+function buildMinimalSealPng(fields) {
+    // Minimal 1x1 transparent PNG carrying QuantSafe tEXt chunks.
+    // Used by the MCP server (no canvas) and for tests that need a seal without a renderer.
+    const sig = PNG_SIGNATURE;
+    const ihdr = new Uint8Array(13);
+    const ihdrView = new DataView(ihdr.buffer);
+    ihdrView.setUint32(0, 1, false); // width
+    ihdrView.setUint32(4, 1, false); // height
+    ihdr[8] = 8; // bit depth
+    ihdr[9] = 6; // color type RGBA
+    ihdr[10] = 0;
+    ihdr[11] = 0;
+    ihdr[12] = 0;
+    const ihdrChunk = buildChunk('IHDR', ihdr);
+    // zlib deflate of filter byte + 4 zero bytes (1x1 RGBA transparent), Adler-32 included.
+    // Image viewers inflate this stream, so it must be valid zlib, not only well-framed PNG.
+    const idatData = new Uint8Array([
+        0x78, 0x9c, 0x63, 0x60, 0x00, 0x02, 0x00, 0x00, 0x05, 0x00, 0x01,
+    ]);
+    const idatChunk = buildChunk('IDAT', idatData);
+    const iendChunk = buildChunk('IEND', new Uint8Array(0));
+    const segs = [sig, ihdrChunk, idatChunk, iendChunk];
+    let total = 0;
+    for (const s of segs)
+        total += s.length;
+    const skeleton = new Uint8Array(total);
+    let p = 0;
+    for (const s of segs) {
+        skeleton.set(s, p);
+        p += s.length;
+    }
+    return injectSealTextChunks(skeleton, fields);
+}

package/dist/lib/wallet/signer-determinism.js

@@ -0,0 +1,90 @@
+"use strict";
+// Wallet-derived keys are only as stable as the wallet's signature. A local-key EOA signs with
+// RFC 6979 nonces, so the same message always yields the same signature. MPC and threshold
+// signers draw fresh nonces, so each signature is valid, recovers to the address, and is still
+// different: keys derived from it would change on the next session and lock the user out of
+// every envelope sealed to them. Asking for the signature twice catches this before any file is
+// encrypted. Only the outcome is remembered, never a signature.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NonDeterministicSignerError = exports.SIGNER_CHECK_STORAGE_PREFIX = void 0;
+exports.localDeterminismStore = localDeterminismStore;
+exports.signaturesMatch = signaturesMatch;
+exports.signForDerivation = signForDerivation;
+exports.SIGNER_CHECK_STORAGE_PREFIX = 'qsafe:signer-deterministic:v1:';
+class NonDeterministicSignerError extends Error {
+    constructor(message = 'Your wallet returned two different signatures for the same message. ' +
+        'Keys derived from it would change between sessions, so files sealed to them could not be ' +
+        'opened later. MPC and threshold signers often sign this way. Use an EOA wallet with a ' +
+        'local private key (MetaMask, Rabby, Phantom) or a key file.') {
+        super(message);
+        this.name = 'NonDeterministicSignerError';
+    }
+}
+exports.NonDeterministicSignerError = NonDeterministicSignerError;
+function storageKey(address) {
+    return `${exports.SIGNER_CHECK_STORAGE_PREFIX}${address.toLowerCase()}`;
+}
+// Storage can be missing or throw (private windows, blocked site data). Failing closed means the
+// check simply runs again next time, which costs one extra signature and nothing else.
+function localDeterminismStore(storage) {
+    const resolve = () => {
+        if (storage)
+            return storage;
+        try {
+            return typeof window === 'undefined' ? null : window.localStorage;
+        }
+        catch {
+            return null;
+        }
+    };
+    return {
+        isVerified(address) {
+            try {
+                return resolve()?.getItem(storageKey(address)) === '1';
+            }
+            catch {
+                return false;
+            }
+        },
+        markVerified(address) {
+            try {
+                resolve()?.setItem(storageKey(address), '1');
+            }
+            catch {
+                // Not remembered: the next derivation on this device asks for two signatures again.
+            }
+        },
+    };
+}
+// Compared as the bytes that feed the KDF, so hex letter case does not matter while any other
+// difference, the recovery byte included, does.
+function signaturesMatch(a, b) {
+    const left = a.toLowerCase();
+    const right = b.toLowerCase();
+    if (left.length !== right.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < left.length; i++)
+        diff |= left.charCodeAt(i) ^ right.charCodeAt(i);
+    return diff === 0;
+}
+/**
+ * Returns the derivation signature once it is known to be reproducible. The first time an
+ * address derives keys on this device it is asked to sign twice and both answers must match.
+ */
+async function signForDerivation(options) {
+    const { address, sign, verify, store, onStep } = options;
+    const needsCheck = !store.isVerified(address);
+    const total = needsCheck ? 2 : 1;
+    onStep?.({ current: 1, total });
+    const first = await sign();
+    await verify(first);
+    if (!needsCheck)
+        return first;
+    onStep?.({ current: 2, total });
+    const second = await sign();
+    if (!signaturesMatch(first, second))
+        throw new NonDeterministicSignerError();
+    store.markVerified(address);
+    return first;
+}

package/dist/mcp/base64.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.base64Encode = base64Encode;
+exports.base64Decode = base64Decode;
+exports.base64urlEncode = base64urlEncode;
+exports.base64urlDecode = base64urlDecode;
+const BASE64_RE = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+const BASE64URL_RE = /^[A-Za-z0-9_-]*$/;
+function base64Encode(bytes) {
+    return Buffer.from(bytes).toString('base64');
+}
+// Buffer.from(s, 'base64') skips every character outside the alphabet and never throws, so raw
+// text or a string with stray characters decodes to other bytes and still encrypts into a valid
+// envelope that can never give the original back. Only the one canonical spelling of a byte
+// string is accepted; field names the input in the error.
+function base64Decode(s, field) {
+    if (typeof s !== 'string' || !BASE64_RE.test(s)) {
+        throw new Error(`${field} is not base64: use the standard alphabet (A-Z, a-z, 0-9, +, /) with = padding, no whitespace or line breaks.`);
+    }
+    const bytes = new Uint8Array(Buffer.from(s, 'base64'));
+    if (base64Encode(bytes) !== s) {
+        throw new Error(`${field} is not canonical base64: its last character carries stray bits.`);
+    }
+    return bytes;
+}
+function base64urlEncode(bytes) {
+    return base64Encode(bytes).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}
+function base64urlDecode(s, field) {
+    if (typeof s !== 'string' || !BASE64URL_RE.test(s) || s.length % 4 === 1) {
+        throw new Error(`${field} is not unpadded base64url.`);
+    }
+    const bytes = new Uint8Array(Buffer.from(s.replace(/-/g, '+').replace(/_/g, '/'), 'base64'));
+    if (base64urlEncode(bytes) !== s) {
+        throw new Error(`${field} is not canonical base64url: its last character carries stray bits.`);
+    }
+    return bytes;
+}

package/dist/mcp/canonical-json.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isJsonObject = isJsonObject;
+exports.canonicalize = canonicalize;
+function isJsonObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function canonicalize(value) {
+    if (value === null || typeof value === 'boolean' || typeof value === 'number') {
+        if (typeof value === 'number' && !Number.isFinite(value)) {
+            throw new Error('Non-finite numbers are not canonicalizable');
+        }
+        return JSON.stringify(value);
+    }
+    if (typeof value === 'string') {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return '[' + value.map((v) => canonicalize(v)).join(',') + ']';
+    }
+    if (isJsonObject(value)) {
+        const keys = Object.keys(value).sort();
+        return ('{' +
+            keys.map((k) => JSON.stringify(k) + ':' + canonicalize(value[k])).join(',') +
+            '}');
+    }
+    throw new Error(`Unsupported JSON value: ${typeof value}`);
+}