@wishknish/knishio-client-ts 0.8.2 → 0.9.0

package/src/libraries/GraphQLClient.ts

@@ -62,6 +62,22 @@ import type {
 } from '@/types'
 import type Wallet from '@/core/Wallet'
 
+const CIPHER_HASH_QUERY = 'query ( $Hash: String! ) { CipherHash ( Hash: $Hash ) { hash } }'
+
+/**
+ * Light parse of a GraphQL request body's operation type + root field name, for the CipherHash
+ * bypass decision (no full GraphQL parse needed). Operation type = the first query/mutation/
+ * subscription keyword (default 'query' for an anonymous `{ ... }`); root field = the first
+ * identifier inside the top-level selection set.
+ */
+function parseOperation(query: string): { type: string; name: string } {
+  const typeMatch = (query || '').match(/\b(query|mutation|subscription)\b/i)
+  const type = typeMatch?.[1]?.toLowerCase() ?? 'query'
+  const braceIdx = (query || '').indexOf('{')
+  const nameMatch = braceIdx >= 0 ? query.slice(braceIdx + 1).match(/[A-Za-z_][A-Za-z0-9_]*/) : null
+  return { type, name: nameMatch?.[0] ?? '' }
+}
+
 /**
  * GraphQL client wrapper for KnishIO SDK
  * Provides a unified interface for GraphQL operations
@@ -125,6 +141,10 @@ export default class GraphQLClient implements IGraphQLClient {
     return createClient({
       url: serverUri,
       exchanges,
+      // PQ-transport Phase E: when encryption is on, route fetch through the CipherHash wrapper
+      // (encrypt the request body to the validator's ML-KEM pubkey, decrypt the response).
+      // Omitted → urql uses the global fetch (plaintext).
+      ...(this.cipherLink ? { fetch: ((input: any, init: any) => this.cipherFetch(input, init)) as typeof fetch } : {}),
       fetchOptions: () => ({
         headers: {
           'X-Auth-Token': this.$__authToken
@@ -135,6 +155,69 @@ export default class GraphQLClient implements IGraphQLClient {
     })
   }
 
+  /**
+   * Whether an outgoing GraphQL request body should be wrapped in CipherHash. Bypass (plaintext):
+   * introspection `__schema`, `ContinuId`, the `AccessToken` mutation, and the U-isotope
+   * `ProposeMolecule` (auth bootstrap — the key exchange itself can't be encrypted). Mirrors the
+   * Kotlin/PHP/validator bypass set.
+   */
+  private shouldEncrypt(body: string): boolean {
+    let parsed: any
+    try {
+      parsed = JSON.parse(body)
+    } catch (e) {
+      return false
+    }
+    const { type, name } = parseOperation(parsed.query)
+    if (type === 'query' && (name === '__schema' || name === 'ContinuId')) return false
+    if (type === 'mutation' && name === 'AccessToken') return false
+    if (type === 'mutation' && name === 'ProposeMolecule') {
+      const isotope = parsed.variables?.molecule?.atoms?.[0]?.isotope
+      if (isotope === 'U') return false
+    }
+    return true
+  }
+
+  /**
+   * Custom `fetch` that wraps a GraphQL request in the ML-KEM CipherHash envelope and decrypts the
+   * response (PQ-transport Phase E). Operates on the raw POST body (mirrors the JS/Kotlin transform).
+   * Reads the CURRENT client wallet + validator pubkey from auth.
+   */
+  private async cipherFetch(input: any, init: any): Promise<Response> {
+    const wallet = this.$__wallet
+    const serverPubkey = this.$__pubkey
+    let encryptedRequest = false
+    let requestInit = init
+
+    if (wallet && serverPubkey && init && typeof init.body === 'string' && this.shouldEncrypt(init.body)) {
+      const hashVar = await wallet.encryptStringML768(init.body, serverPubkey)
+      requestInit = { ...init, body: JSON.stringify({ query: CIPHER_HASH_QUERY, variables: { Hash: hashVar } }) }
+      encryptedRequest = true
+    }
+
+    const response = await fetch(input, requestInit)
+    if (!encryptedRequest) {
+      return response
+    }
+
+    // Decrypt the CipherHash response back to the inner GraphQL response JSON.
+    const text = await response.text()
+    const init2 = { status: response.status, statusText: response.statusText, headers: response.headers }
+    let parsed: any
+    try {
+      parsed = JSON.parse(text)
+    } catch (e) {
+      return new Response(text, init2)
+    }
+    const hash = parsed?.data?.CipherHash?.hash
+    if (typeof hash !== 'string') {
+      // Plaintext (e.g. a validator-side error response) — pass through unchanged.
+      return new Response(text, init2)
+    }
+    const decrypted = await wallet!.decryptMyMessageML768(JSON.parse(hash))
+    return new Response(decrypted != null ? decrypted : text, init2)
+  }
+
   setAuthData({
     token,
     pubkey,

package/src/libraries/Hex.ts

@@ -72,7 +72,8 @@ export default class Hex {
         ? ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'A', 'B', 'C', 'D', 'E', 'F']
         : ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f']
 
-      return set[Math.floor(val / 16)] + set[val % 16]
+      // indices are provably in-range (val is a byte; /16 and %16 are 0..15 for a 16-elem set)
+      return set[Math.floor(val / 16)]! + set[val % 16]!
     }
 
     const opts: Required<HexOptions> = Object.assign(
@@ -97,7 +98,7 @@ export default class Hex {
     let column = 0
 
     for (let i = 0; i < arrayLike.length; ++i) {
-      str += numberToHex(arrayLike[i], opts.uppercase)
+      str += numberToHex(arrayLike[i]!, opts.uppercase)
 
       if (i === arrayLike.length - 1) {
         break
@@ -135,7 +136,7 @@ export default class Hex {
     let curr = -1
 
     for (let i = 0; i < target.length; ++i) {
-      const c = target[i]
+      const c = target[i]!
       const val = ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'].indexOf(c)
 
       if (val === -1) {

package/src/libraries/UrqlClientWrapper.ts

@@ -54,11 +54,10 @@ import {
   Client,
   OperationResult
 } from '@urql/core'
-import { createClient as createWSClient, Client as WSClient } from 'graphql-ws'
-import { pipe, map, SubscriptionLike } from 'wonka'
+import { createClient as createWSClient, Client as WSClient, type SubscribePayload } from 'graphql-ws'
+import { pipe, map, subscribe, type Subscription } from 'wonka'
 import type { DocumentNode } from 'graphql'
 import type Wallet from '@/core/Wallet'
-import { GraphQLRequestSchema, GraphQLResponseSchema, parseWithSchema } from '@/schemas'
 
 // Enhanced type definitions with proper constraints
 interface SocketConfig {
@@ -110,7 +109,7 @@ class UrqlClientWrapper {
   private $__authToken: string = ''
   private $__pubkey: string | null = null
   private $__wallet: Wallet | null = null
-  private readonly serverUri: string
+  private serverUri: string
   private soketi: SocketConfig | null
   private cipherLink: boolean
   private readonly $__subscriptionManager: Map<string, SubscriptionManager> = new Map()
@@ -126,8 +125,7 @@ class UrqlClientWrapper {
 
   private createUrqlClient({
     serverUri,
-    socket,
-    encrypt
+    socket
   }: {
     serverUri: string
     socket?: SocketConfig | null
@@ -147,7 +145,7 @@ class UrqlClientWrapper {
       exchanges.push(subscriptionExchange({
         forwardSubscription: operation => ({
           subscribe: sink => {
-            const disposable = wsClient.subscribe(operation, sink)
+            const disposable = wsClient.subscribe(operation as unknown as SubscribePayload, sink)
             return { unsubscribe: disposable }
           }
         })
@@ -209,12 +207,14 @@ class UrqlClientWrapper {
       throw new Error('Query is required for subscription')
     }
 
-    const subscription: SubscriptionLike = pipe(
+    // wonka v6: subscribe is a pipe operator (no `.subscribe()` method on Source) → pipe(src, ..., subscribe(h))
+    const subscription: Subscription = pipe(
       this.$__client.subscription(query, variables),
       map(result => {
         closure(this.formatResponse<TData>(result))
-      })
-    ).subscribe(() => {})
+      }),
+      subscribe(() => {})
+    )
 
     // Store subscription for later cleanup
     if (operationName) {
@@ -238,8 +238,8 @@ class UrqlClientWrapper {
     if (result.error) {
       response.errors = [{
         message: result.error.message,
-        locations: result.error.graphQLErrors?.[0]?.locations,
-        path: result.error.graphQLErrors?.[0]?.path,
+        locations: result.error.graphQLErrors?.[0]?.locations as { line: number; column: number }[] | undefined,
+        path: result.error.graphQLErrors?.[0]?.path as (string | number)[] | undefined,
         extensions: result.error.graphQLErrors?.[0]?.extensions
       }]
     }
@@ -263,7 +263,7 @@ class UrqlClientWrapper {
   }
 
   unsubscribeAll(): void {
-    this.$__subscriptionManager.forEach((subscription, operationName) => {
+    this.$__subscriptionManager.forEach((_subscription, operationName) => {
       this.unsubscribe(operationName)
     })
   }

package/src/libraries/crypto.ts

@@ -178,10 +178,10 @@ export function generateSecretEnhanced(options: SecretGenerationOptions): string
  * Uses SHAKE256 with 256-bit output (64 hex characters)
  */
 export function generateBundleHash(secret: string, _source: string | null = null): BundleHash {
-  if (!secret || secret.length === 0) {
-    throw new Error('Secret is required for bundle hash generation')
-  }
-
+  // Cross-SDK parity (c142): an empty secret hashes to shake256("") = 46b9dd2b… — matching
+  // JS/PHP/Kotlin/Rust/Python + the committed `empty_secret` vector. (Previously threw;
+  // no real caller passes an empty secret.)
+  //
   // CRITICAL: source parameter must be IGNORED to match JS SDK behavior.
   // JS SDK's generateBundleHash() accepts source but never uses it.
   // The bundle hash is an identity anchor and must be deterministic from secret alone.

package/src/mutation/MutationClaimShadowWallet.ts

@@ -71,9 +71,11 @@ export default class MutationClaimShadowWallet extends MutationProposeMolecule {
       bundle: this.$__molecule.bundle,
       token,
       batchId
-    })
+    });
 
     // Initialize shadow wallet claim on the molecule
+    // (leading-paren statements REQUIRE the preceding semicolon — without it ASI parses
+    //  `Wallet.create({...})(this.$__molecule)` and throws "Wallet.create(...) is not a function")
     (this.$__molecule as any).initShadowWalletClaim(wallet)
     this.$__molecule.sign({})
     this.$__molecule.check()

package/src/mutation/MutationTransferTokens.ts

@@ -74,6 +74,24 @@ export default class MutationTransferTokens extends MutationProposeMolecule {
     (this.$__molecule as any).check((this.$__molecule as any).sourceWallet)
   }
 
+  /**
+   * Fills the Molecule for a MULTI-recipient transfer (one source funds N recipients)
+   */
+  fillMoleculeMulti({
+    recipientWallets,
+    amounts
+  }: {
+    recipientWallets: Wallet[]
+    amounts: number[]
+  }): void {
+    (this.$__molecule as any).initValues({
+      recipientWallets,
+      amounts
+    });
+    (this.$__molecule as any).sign({});
+    (this.$__molecule as any).check((this.$__molecule as any).sourceWallet)
+  }
+
   /**
    * Builds a Response object out of a JSON object
    * Matches JavaScript SDK createResponse method signature exactly

package/src/query/QueryActiveSession.ts

@@ -51,7 +51,6 @@ import ResponseQueryActiveSession from '@/response/ResponseQueryActiveSession'
 import { gql } from '@urql/core'
 import type { GraphQLClient as IGraphQLClient } from '@/types'
 import type KnishIOClient from '@/KnishIOClient'
-import type { BundleHash, MetaType, MetaId } from '@/types'
 
 /**
  * Query for retrieving a list of active User Sessions

package/src/query/QueryPolicy.ts

@@ -51,7 +51,6 @@ import ResponsePolicy from '@/response/ResponsePolicy'
 import { gql } from '@urql/core'
 import type { GraphQLClient as IGraphQLClient } from '@/types'
 import type KnishIOClient from '@/KnishIOClient'
-import type { MetaType, MetaId } from '@/types'
 
 /**
  * Query for retrieving Policy information

package/src/response/ResponseAuthorizationGuest.ts

@@ -75,14 +75,14 @@ export default class ResponseAuthorizationGuest extends Response {
   /**
    * Returns the reason for rejection
    */
-  reason(): string {
+  override reason(): string {
     return 'Invalid response from server'
   }
 
   /**
    * Returns whether molecule was accepted or not
    */
-  success(): boolean {
+  override success(): boolean {
     return this.payload() !== null
   }
 

package/src/response/ResponseBalance.ts

@@ -48,6 +48,7 @@ License: https://github.com/WishKnish/KnishIO-Client-TS/blob/master/LICENSE
 
 import Response from './Response'
 import Wallet from '../core/Wallet'
+import TokenUnit from '../core/TokenUnit'
 import type Query from '../query/Query'
 
 /**
@@ -134,12 +135,14 @@ export default class ResponseBalance extends Response {
       wallet.tokenFungibility = data.token.fungibility
     }
 
-    // TODO: Implement TokenUnit support when TokenUnit class is available
-    // if (data.tokenUnits && data.tokenUnits.length) {
-    //   for (const tokenUnitData of data.tokenUnits) {
-    //     wallet.tokenUnits.push(TokenUnit.createFromGraphQL(tokenUnitData))
-    //   }
-    // }
+    // Stackable (NFT) token units — the validator serves Wallet.tokenUnits and QueryBalance
+    // selects them; parse them so a queried source wallet carries its units (otherwise every
+    // stackable transfer silently degrades to fungible). Mirrors ResponseWalletList.toClientWallet.
+    if (data.tokenUnits && data.tokenUnits.length) {
+      for (const tokenUnitData of data.tokenUnits) {
+        wallet.tokenUnits.push(TokenUnit.createFromGraphQL(tokenUnitData))
+      }
+    }
 
     // Set trade rates if available
     if (data.tradeRates && data.tradeRates.length) {

package/src/response/ResponseLinkIdentifier.ts

@@ -74,7 +74,7 @@ export default class ResponseLinkIdentifier extends Response {
   /**
    * Returns success status
    */
-  success(): any {
+  override success(): any {
     return Dot.get(this.data(), 'set')
   }
 

package/src/response/ResponseRequestAuthorizationGuest.ts

@@ -75,14 +75,14 @@ export default class ResponseRequestAuthorizationGuest extends Response {
   /**
    * Returns the reason for rejection
    */
-  reason(): string {
+  override reason(): string {
     return 'Invalid response from server'
   }
 
   /**
    * Returns whether authorization was successful
    */
-  success(): boolean {
+  override success(): boolean {
     return this.payload() !== null
   }
 

package/src/schemas/index.ts

@@ -191,7 +191,8 @@ export const KnishIOClientConfigSchema = z.object({
   client: z.unknown().optional(),
   socket: z.unknown().optional(),
   serverSdkVersion: z.number().int().min(1).optional(),
-  logging: z.boolean().optional()
+  logging: z.boolean().optional(),
+  defaultRequestPolicy: z.enum(['cache-first', 'cache-only', 'network-only', 'cache-and-network']).nullable().optional()
 }).strict()
 
 // =============================================================================

package/src/subscribe/Subscribe.ts

@@ -49,7 +49,6 @@ License: https://github.com/WishKnish/KnishIO-Client-TS/blob/master/LICENSE
 import type { GraphQLClient as IGraphQLClient } from '@/types'
 import { CodeException } from '@/exception'
 import type { DocumentNode } from 'graphql'
-import { GraphQLRequestSchema, parseWithSchema } from '@/schemas'
 
 // Define subscription-specific types for better type safety
 interface SubscriptionRequest {
@@ -72,7 +71,9 @@ interface SubscriptionCreateParams {
 }
 
 // Type for GraphQL client with subscription support
-interface GraphQLSubscriptionClient extends IGraphQLClient {
+// Omit the base's required subscribe/getUri, then re-add as OPTIONAL variants (a passed client may
+// not implement them) — avoids TS2430 (an optional member can't override a required base member).
+interface GraphQLSubscriptionClient extends Omit<IGraphQLClient, 'subscribe' | 'getUri'> {
   subscribe?: (request: SubscriptionRequest, closure: (result: unknown) => void) => Promise<string>
   getUri?: () => string | null
 }

package/src/types/assertions.ts

@@ -58,19 +58,14 @@ License: https://github.com/WishKnish/KnishIO-Client-TS/blob/master/LICENSE
 
 import type {
   AtomIsotope,
-  KnishIOErrorType,
-  QueryType,
-  MutationType,
-  SubscriptionType
+  KnishIOErrorType
 } from '../constants'
 
 import type {
   WalletAddress,
   BundleHash,
   TokenSlug,
-  Position,
   MolecularHash,
-  CellSlug,
   BatchId,
   AtomParams,
   WalletParams,

package/src/types/client.ts

@@ -129,6 +129,18 @@ export interface TransferTokenOptions {
   callbackUrl?: string | null
 }
 
+/**
+ * One destination of a multi-recipient transfer (see KnishIOClient.transferTokens).
+ * Provide EITHER units (stackable/NFT: amount = units.length) OR amount (fungible), not both.
+ * batchId makes the recipient a claimable shadow under that batch.
+ */
+export interface TransferRecipientInput {
+  bundleHash: BundleHash | string
+  units?: string[]
+  amount?: number | null
+  batchId?: string | null
+}
+
 export interface RequestTokensOptions {
   to: WalletAddress | string
   amount: number | string
@@ -269,16 +281,6 @@ export interface ActiveSessionOptions {
   metaId?: MetaId | string | null
 }
 
-export interface UserActivityOptions {
-  bundleHash?: BundleHash | string | null
-  metaType?: MetaType | string | null
-  metaId?: MetaId | string | null
-  dateFrom?: string | null
-  dateTo?: string | null
-  limit?: number | null
-  offset?: number | null
-}
-
 export interface PolicyQueryOptions {
   metaType?: MetaType | string | null
   metaId?: MetaId | string | null
@@ -478,15 +480,6 @@ export interface ResponseQueryActiveSession extends BaseResponse<{
   expiresAt: string
 }> {}
 
-export interface ResponseQueryUserActivity extends BaseResponse<{
-  activities: Array<{
-    type: string
-    description: string
-    data: Record<string, unknown>
-    createdAt: string
-  }>
-}> {}
-
 export interface ResponsePolicy extends BaseResponse<{
   policy: Record<string, unknown>
   metaType: MetaType | null

package/src/types/guards.ts

@@ -239,7 +239,7 @@ export function isKnishIOErrorType(value: unknown): value is KnishIOErrorType {
     'WRONG_TOKEN_TYPE_ERROR'
   ] as const
 
-  return typeof value === 'string' && errorTypes.includes(value as KnishIOErrorType)
+  return typeof value === 'string' && (errorTypes as readonly string[]).includes(value)
 }
 
 /**
@@ -282,8 +282,7 @@ export function isQueryType(value: unknown): value is QueryType {
     'Batch',
     'ActiveSession',
     'Policy',
-    'Token',
-    'UserActivity'
+    'Token'
   ] as const
 
   return typeof value === 'string' && queryTypes.includes(value as QueryType)

package/src/types/index.ts

@@ -371,6 +371,12 @@ export interface SignatureResult {
 // GRAPHQL OPERATION TYPES
 // =============================================================================
 
+/**
+ * urql request policy (mirrors @urql/core's RequestPolicy). Controls whether a
+ * read hits the client's in-memory cache. 'network-only' bypasses it entirely.
+ */
+export type RequestPolicy = 'cache-first' | 'cache-only' | 'network-only' | 'cache-and-network'
+
 export interface GraphQLRequest {
   query: string
   variables?: Record<string, unknown>

package/src/validation/UNIVERSAL_CONFIGURATION_INTERFACES.ts

@@ -61,8 +61,6 @@ License: https://github.com/WishKnish/KnishIO-Client-TS/blob/master/LICENSE
  * - Performance optimization hints
  */
 
-import { z } from 'zod'
-import type { ValidationResult } from './ValidationService'
 
 // =============================================================================
 // UNIVERSAL CONFIGURATION TYPES
@@ -227,16 +225,16 @@ export class ConfigValidator {
 
       // Enhanced validations
       if (options.includeWarnings !== false) {
-        result.warnings.push(...this.generateWarnings(result.data))
+        result.warnings.push(...this.generateWarnings(result.data!))
       }
 
       if (options.includeRecommendations !== false) {
-        result.recommendations.push(...this.generateRecommendations(result.data, options))
+        result.recommendations.push(...this.generateRecommendations(result.data!, options))
       }
 
       // Performance validation
       if (options.includePerformanceHints !== false) {
-        result.warnings.push(...this.generatePerformanceWarnings(result.data))
+        result.warnings.push(...this.generatePerformanceWarnings(result.data!))
       }
 
     } catch (error) {

package/src/validation/ValidationService.ts

@@ -57,20 +57,9 @@ License: https://github.com/WishKnish/KnishIO-Client-TS/blob/master/LICENSE
  */
 
 import { z } from 'zod'
-import type { 
-  KnishIOClientConfig,
-  TransferParams,
-  CreateTokenParams,
-  RequestTokensParams,
-  BalanceQueryParams,
-  MetaQueryParams,
-  WalletQueryParams
-} from '@/types'
 import {
   Schemas,
   safeParse,
-  validateStrict,
-  validateWithDefaults,
   createTypeGuard,
   type ValidatedClientConfig,
   type ValidatedTransferParams,
@@ -164,8 +153,8 @@ export class ValidationService {
       this.logValidation('ClientConfig', true)
       return {
         success: true,
-        data: parseResult.data,
-        warnings: this.generateConfigWarnings(parseResult.data)
+        data: parseResult.data as ValidatedClientConfig,
+        warnings: this.generateConfigWarnings(parseResult.data as ValidatedClientConfig)
       }
     } catch (error) {
       this.logValidation('ClientConfig', false, String(error))
@@ -193,7 +182,9 @@ export class ValidationService {
         KNISHIO_SERVER_SDK_VERSION: process.env.KNISHIO_SERVER_SDK_VERSION
       }
 
-      const parseResult = safeParse(Schemas.EnvironmentConfig, env)
+      // cast: EnvironmentConfig uses .default()/.optional() so its inferred input≠output type and
+      // doesn't structurally match safeParse's ZodType<T> param; ZodTypeAny sidesteps the mismatch.
+      const parseResult = safeParse(Schemas.EnvironmentConfig as z.ZodTypeAny, env)
       
       if (!parseResult.success) {
         return {
@@ -320,7 +311,7 @@ export class ValidationService {
               received: 'error',
               path: [],
               message: err.message
-            } as z.ZodIssue)),
+            } as unknown as z.ZodIssue)),
             context: 'GraphQLResponse'
           }
         }

package/src/validation/schemas.ts

@@ -206,7 +206,11 @@ export const KnishIOClientConfigSchema = z.object({
   client: z.unknown().optional(),
   socket: z.unknown().optional(),
   serverSdkVersion: z.number().int().min(1).max(10).default(4),
-  logging: z.boolean().default(false)
+  logging: z.boolean().default(false),
+  // Optional default urql request policy for reads (server/sync clients pass
+  // 'network-only'). Permitted by the strict schema so the constructor option
+  // isn't rejected.
+  defaultRequestPolicy: z.enum(['cache-first', 'cache-only', 'network-only', 'cache-and-network']).nullable().optional()
 }).strict()
 
 // Environment configuration with validation

package/src/versions/HashAtom.ts

@@ -49,17 +49,19 @@ License: https://github.com/WishKnish/KnishIO-Client-TS/blob/master/LICENSE
 import type Atom from '@/core/Atom'
 
 // Define structured value types for better type safety
-type StructuredValue = 
-  | string 
-  | number 
-  | boolean 
-  | null 
+type StructuredValue =
+  | string
+  | number
+  | boolean
+  | null
   | undefined
   | StructuredObject
   | StructuredArray
 
-type StructuredObject = Record<string, StructuredValue>
-type StructuredArray = StructuredValue[]
+// interfaces (not type aliases) so the recursion goes alias->interface->alias, which TS permits
+// (an all-type-alias cycle triggers TS2456 "circularly references itself").
+interface StructuredObject { [key: string]: StructuredValue }
+interface StructuredArray extends Array<StructuredValue> {}
 
 // Define types for hashable values
 type HashableValue = 
@@ -95,7 +97,7 @@ export default class HashAtom {
     // Extract atom properties with type safety
     for (const key of Object.keys(atom)) {
       if (Object.prototype.hasOwnProperty.call(atom, key)) {
-        parameters[key] = (atom as Record<string, unknown>)[key]
+        parameters[key] = (atom as unknown as Record<string, unknown>)[key]
       }
     }
 
@@ -113,7 +115,7 @@ export default class HashAtom {
 
     if (isArray(object)) {
       const result: StructuredArray = []
-      for (const value of object) {
+      for (const value of (object as unknown[])) {
         result.push(HashAtom.isStructure(value) ? HashAtom.structure(value) : value as StructuredValue)
       }
       return result