@affectively/aeon 1.2.0 → 1.3.1

package/dist/core/index.d.ts

@@ -1,211 +1,216 @@
-/**
- * Aeon Core Types
- *
- * Shared type definitions for the Aeon synchronization and versioning system.
- */
-/**
- * Operation type - what action is being performed
- */
-type OperationType = 'create' | 'update' | 'delete' | 'sync' | 'batch';
-/**
- * Operation priority for sync ordering
- */
-type OperationPriority = 'high' | 'normal' | 'low';
-/**
- * Operation sync status
- */
-type OperationStatus = 'pending' | 'syncing' | 'synced' | 'failed';
-/**
- * Queued operation for offline-first synchronization
- */
-interface Operation {
-    id: string;
-    type: OperationType;
-    sessionId: string;
-    status: OperationStatus;
-    data: Record<string, unknown>;
-    priority?: OperationPriority;
-    createdAt?: number;
-    syncedAt?: number;
-    retryCount?: number;
-    maxRetries?: number;
-}
-/**
- * Conflict detection result
- */
-interface ConflictDetectionResult {
-    hasConflict: boolean;
-    type?: 'update_update' | 'delete_update' | 'update_delete' | 'concurrent';
-    severity?: 'low' | 'medium' | 'high';
-    similarity?: number;
-}
-/**
- * Conflict resolution strategy
- */
-type ResolutionStrategy = 'local_wins' | 'remote_wins' | 'last_modified' | 'merge' | 'manual';
-/**
- * Sync batch for uploading multiple operations
- */
-interface SyncBatch {
-    batchId: string;
-    operations: Operation[];
-    totalSize: number;
-    createdAt: number;
-    priority: OperationPriority;
-}
-/**
- * Sync result from server
- */
-interface SyncResult {
-    success: boolean;
-    synced: string[];
-    failed: Array<{
-        operationId: string;
-        error: string;
-    }>;
-    conflicts: Array<{
-        operationId: string;
-        remoteVersion: Record<string, unknown>;
-        strategy: ResolutionStrategy;
-    }>;
-}
-/**
- * Network state for adaptive sync
- */
-type NetworkState = 'online' | 'offline' | 'poor' | 'unknown';
-/**
- * Bandwidth profile for sync adaptation
- */
-interface BandwidthProfile {
-    bandwidth: number;
-    latency: number;
-    timestamp: number;
-    reliability: number;
-}
-/**
- * Sync coordinator configuration
- */
-interface SyncCoordinatorConfig {
-    maxBatchSize: number;
-    maxBatchBytes: number;
-    maxRetries: number;
-    retryDelayMs: number;
-    enableCompression: boolean;
-    enableDeltaSync: boolean;
-    adaptateBatchSize: boolean;
-}
-/**
- * Vector clock for causality tracking
- */
-interface VectorClock {
-    [nodeId: string]: number;
-}
-/**
- * CRDT operation for conflict-free updates
- */
-interface CRDTOperation {
-    id: string;
-    type: 'insert' | 'delete' | 'update';
-    path: string[];
-    value?: unknown;
-    timestamp: number;
-    nodeId: string;
-    vectorClock: VectorClock;
-}
-/**
- * Presence selection range
- */
-interface PresenceSelection {
-    start: number;
-    end: number;
-    direction?: 'forward' | 'backward' | 'none';
-    path?: string;
-}
-/**
- * Presence typing signal
- */
-interface PresenceTyping {
-    isTyping: boolean;
-    field?: string;
-    isComposing?: boolean;
-    startedAt?: number;
-    stoppedAt?: number;
-}
-/**
- * Presence scroll signal
- */
-interface PresenceScroll {
-    depth: number;
-    y?: number;
-    viewportHeight?: number;
-    documentHeight?: number;
-    path?: string;
-}
-/**
- * Presence viewport signal
- */
-interface PresenceViewport {
-    width: number;
-    height: number;
-}
-/**
- * Presence input signal
- */
-interface PresenceInputState {
-    field: string;
-    hasFocus: boolean;
-    valueLength?: number;
-    selectionStart?: number;
-    selectionEnd?: number;
-    isComposing?: boolean;
-    inputMode?: string;
-}
-/**
- * Presence emotional state signal
- */
-interface PresenceEmotion {
-    primary?: string;
-    secondary?: string;
-    confidence?: number;
-    intensity?: number;
-    valence?: number;
-    arousal?: number;
-    dominance?: number;
-    source?: 'self-report' | 'inferred' | 'sensor' | 'hybrid';
-    updatedAt?: number;
-}
-/**
- * Presence information for real-time collaboration
- */
-interface PresenceInfo {
-    userId: string;
-    nodeId: string;
-    cursor?: {
-        x: number;
-        y: number;
-    };
-    focusNode?: string;
-    selection?: PresenceSelection;
-    typing?: PresenceTyping;
-    scroll?: PresenceScroll;
-    viewport?: PresenceViewport;
-    inputState?: PresenceInputState;
-    emotion?: PresenceEmotion;
-    metadata?: Record<string, unknown>;
-    lastActivity: number;
-}
-/**
- * Event emitter types
- */
-type EventCallback<T = unknown> = (data: T) => void;
-type EventUnsubscribe = () => void;
-/**
- * Generic event emitter interface
- */
-interface IEventEmitter {
-    on<T = unknown>(event: string, callback: EventCallback<T>): EventUnsubscribe;
-    off(event: string, callback: EventCallback): void;
-    emit<T = unknown>(event: string, data?: T): void;
+/**
+ * Aeon Core Types
+ *
+ * Shared type definitions for the Aeon synchronization and versioning system.
+ */
+/**
+ * Operation type - what action is being performed
+ */
+type OperationType = 'create' | 'update' | 'delete' | 'sync' | 'batch';
+/**
+ * Operation priority for sync ordering
+ */
+type OperationPriority = 'high' | 'normal' | 'low';
+/**
+ * Operation sync status
+ */
+type OperationStatus = 'pending' | 'syncing' | 'synced' | 'failed';
+/**
+ * Queued operation for offline-first synchronization
+ */
+interface Operation {
+  id: string;
+  type: OperationType;
+  sessionId: string;
+  status: OperationStatus;
+  data: Record<string, unknown>;
+  priority?: OperationPriority;
+  createdAt?: number;
+  syncedAt?: number;
+  retryCount?: number;
+  maxRetries?: number;
+}
+/**
+ * Conflict detection result
+ */
+interface ConflictDetectionResult {
+  hasConflict: boolean;
+  type?: 'update_update' | 'delete_update' | 'update_delete' | 'concurrent';
+  severity?: 'low' | 'medium' | 'high';
+  similarity?: number;
+}
+/**
+ * Conflict resolution strategy
+ */
+type ResolutionStrategy =
+  | 'local_wins'
+  | 'remote_wins'
+  | 'last_modified'
+  | 'merge'
+  | 'manual';
+/**
+ * Sync batch for uploading multiple operations
+ */
+interface SyncBatch {
+  batchId: string;
+  operations: Operation[];
+  totalSize: number;
+  createdAt: number;
+  priority: OperationPriority;
+}
+/**
+ * Sync result from server
+ */
+interface SyncResult {
+  success: boolean;
+  synced: string[];
+  failed: Array<{
+    operationId: string;
+    error: string;
+  }>;
+  conflicts: Array<{
+    operationId: string;
+    remoteVersion: Record<string, unknown>;
+    strategy: ResolutionStrategy;
+  }>;
+}
+/**
+ * Network state for adaptive sync
+ */
+type NetworkState = 'online' | 'offline' | 'poor' | 'unknown';
+/**
+ * Bandwidth profile for sync adaptation
+ */
+interface BandwidthProfile {
+  bandwidth: number;
+  latency: number;
+  timestamp: number;
+  reliability: number;
+}
+/**
+ * Sync coordinator configuration
+ */
+interface SyncCoordinatorConfig {
+  maxBatchSize: number;
+  maxBatchBytes: number;
+  maxRetries: number;
+  retryDelayMs: number;
+  enableCompression: boolean;
+  enableDeltaSync: boolean;
+  adaptateBatchSize: boolean;
+}
+/**
+ * Vector clock for causality tracking
+ */
+interface VectorClock {
+  [nodeId: string]: number;
+}
+/**
+ * CRDT operation for conflict-free updates
+ */
+interface CRDTOperation {
+  id: string;
+  type: 'insert' | 'delete' | 'update';
+  path: string[];
+  value?: unknown;
+  timestamp: number;
+  nodeId: string;
+  vectorClock: VectorClock;
+}
+/**
+ * Presence selection range
+ */
+interface PresenceSelection {
+  start: number;
+  end: number;
+  direction?: 'forward' | 'backward' | 'none';
+  path?: string;
+}
+/**
+ * Presence typing signal
+ */
+interface PresenceTyping {
+  isTyping: boolean;
+  field?: string;
+  isComposing?: boolean;
+  startedAt?: number;
+  stoppedAt?: number;
+}
+/**
+ * Presence scroll signal
+ */
+interface PresenceScroll {
+  depth: number;
+  y?: number;
+  viewportHeight?: number;
+  documentHeight?: number;
+  path?: string;
+}
+/**
+ * Presence viewport signal
+ */
+interface PresenceViewport {
+  width: number;
+  height: number;
+}
+/**
+ * Presence input signal
+ */
+interface PresenceInputState {
+  field: string;
+  hasFocus: boolean;
+  valueLength?: number;
+  selectionStart?: number;
+  selectionEnd?: number;
+  isComposing?: boolean;
+  inputMode?: string;
+}
+/**
+ * Presence emotional state signal
+ */
+interface PresenceEmotion {
+  primary?: string;
+  secondary?: string;
+  confidence?: number;
+  intensity?: number;
+  valence?: number;
+  arousal?: number;
+  dominance?: number;
+  source?: 'self-report' | 'inferred' | 'sensor' | 'hybrid';
+  updatedAt?: number;
+}
+/**
+ * Presence information for real-time collaboration
+ */
+interface PresenceInfo {
+  userId: string;
+  nodeId: string;
+  cursor?: {
+    x: number;
+    y: number;
+  };
+  focusNode?: string;
+  selection?: PresenceSelection;
+  typing?: PresenceTyping;
+  scroll?: PresenceScroll;
+  viewport?: PresenceViewport;
+  inputState?: PresenceInputState;
+  emotion?: PresenceEmotion;
+  metadata?: Record<string, unknown>;
+  lastActivity: number;
+}
+/**
+ * Event emitter types
+ */
+type EventCallback<T = unknown> = (data: T) => void;
+type EventUnsubscribe = () => void;
+/**
+ * Generic event emitter interface
+ */
+interface IEventEmitter {
+  on<T = unknown>(event: string, callback: EventCallback<T>): EventUnsubscribe;
+  off(event: string, callback: EventCallback): void;
+  emit<T = unknown>(event: string, data?: T): void;
 }
 
 export type { BandwidthProfile, CRDTOperation, ConflictDetectionResult, EventCallback, EventUnsubscribe, IEventEmitter, NetworkState, Operation, OperationPriority, OperationStatus, OperationType, PresenceEmotion, PresenceInfo, PresenceInputState, PresenceScroll, PresenceSelection, PresenceTyping, PresenceViewport, ResolutionStrategy, SyncBatch, SyncCoordinatorConfig, SyncResult, VectorClock };

package/dist/crypto/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/crypto/types.ts","../../src/crypto/CryptoProvider.ts"],"names":[],"mappings":";;;AA+JO,IAAM,iBAAA,GAAoB;AAAA;AAAA,EAE/B,SAAA,EAAW,gBAAA;AAAA,EACX,UAAA,EAAY,iBAAA;AAAA,EACZ,UAAA,EAAY,iBAAA;AAAA;AAAA,EAGZ,aAAA,EAAe,oBAAA;AAAA,EACf,cAAA,EAAgB,qBAAA;AAAA;AAAA,EAGhB,cAAA,EAAgB,qBAAA;AAAA,EAChB,eAAA,EAAiB,sBAAA;AAAA;AAAA,EAGjB,UAAA,EAAY,iBAAA;AAAA,EACZ,WAAA,EAAa,kBAAA;AAAA,EACb,eAAA,EAAiB;AACnB;AA4BO,IAAM,qBAAA,GAA0C;AAAA,EACrD,qBAAA,EAAuB,MAAA;AAAA,EACvB,iBAAA,EAAmB,KAAA;AAAA,EACnB,mBAAA,EAAqB,KAAA;AAAA,EACrB,0BAAA,EAA4B,CAAC,OAAA,EAAS,SAAS,CAAA;AAAA,EAC/C,2BAAA,EAA6B,CAAC,YAAA,EAAc,aAAa,CAAA;AAAA,EACzD,oBAAA,EAAsB,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK;AAAA;AACvC;;;ACHO,IAAM,qBAAN,MAAoD;AAAA,EACjD,kBAAA,GAA4B;AAClC,IAAA,OAAO,IAAI,MAAM,gCAAgC,CAAA;AAAA,EACnD;AAAA,EAEA,MAAM,gBAAA,GAIH;AACD,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,WAAA,GAA6B;AAC3B,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,oBAAA,GAAuD;AAC3D,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,kBAAA,GAAoC;AAAA,EAE1C;AAAA,EAEA,MAAM,kBAAA,GAAiD;AACrD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,IAAA,GAA4B;AAChC,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,MAAM,SAAY,KAAA,EAAsC;AACtD,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,MAAM,MAAA,GAA2B;AAE/B,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,gBAAA,GAAqC;AAEzC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,OAAA,GAOH;AACD,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,MAAM,OAAA,GAA+B;AACnC,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,MAAM,aAAA,GAAqC;AACzC,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,MAAM,qBAAA,GAMH;AACD,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,MAAM,qBAAA,GAA6C;AACjD,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,MAAM,UAAA,GAA8B;AAClC,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,MAAM,UAAA,GAA4C;AAEhD,IAAA,OAAO,EAAE,YAAY,IAAA,EAAK;AAAA,EAC5B;AAAA,EAEA,MAAM,oBAAA,GAAwC;AAC5C,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,MAAM,IAAA,GAA4B;AAChC,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,YAAY,MAAA,EAA4B;AAEtC,IAAA,OAAO,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,EACtD;AAAA,EAEA,aAAA,GAAyB;AACvB,IAAA,OAAO,KAAA;AAAA,EACT;AACF","file":"index.cjs","sourcesContent":["/**\n * Aeon Crypto Types\n *\n * Type definitions for cryptographic operations in Aeon.\n * These are compatible with @affectively/ucan and @affectively/zk-encryption.\n */\n\n// =============================================================================\n// IDENTITY TYPES (compatible with @affectively/ucan)\n// =============================================================================\n\n/**\n * Decentralized Identifier (DID)\n * Format: did:method:identifier\n */\nexport type DID = `did:${string}:${string}`;\n\n/**\n * Supported signing algorithms\n */\nexport type SigningAlgorithm = 'ES256' | 'Ed25519' | 'ES384' | 'ES512';\n\n/**\n * Key pair for signing and verification\n */\nexport interface KeyPair {\n  algorithm: SigningAlgorithm;\n  publicKey: JsonWebKey;\n  privateKey?: JsonWebKey;\n  fingerprint: string;\n}\n\n/**\n * Identity representing a user or node\n */\nexport interface Identity {\n  did: DID;\n  signingKey: KeyPair;\n  encryptionKey?: KeyPair;\n  createdAt: number;\n  displayName?: string;\n}\n\n/**\n * UCAN Capability structure\n */\nexport interface Capability {\n  can: string;\n  with: string;\n  constraints?: Record<string, unknown>;\n}\n\n/**\n * UCAN Token payload\n */\nexport interface UCANPayload {\n  iss: DID;\n  aud: DID;\n  exp: number;\n  nbf?: number;\n  iat?: number;\n  nonce?: string;\n  jti?: string;\n  att: Capability[];\n  prf?: string[];\n  fct?: Record<string, unknown>;\n}\n\n/**\n * Parsed UCAN Token\n */\nexport interface UCANToken {\n  payload: UCANPayload;\n  raw: string;\n  signature: Uint8Array;\n  algorithm: string;\n}\n\n/**\n * UCAN verification result\n */\nexport interface VerificationResult {\n  valid: boolean;\n  payload?: UCANPayload;\n  error?: string;\n  expired?: boolean;\n  shouldRotate?: boolean;\n  expiresIn?: number;\n}\n\n// =============================================================================\n// ENCRYPTION TYPES (compatible with @affectively/zk-encryption)\n// =============================================================================\n\n/**\n * Encryption algorithms supported\n */\nexport type EncryptionAlgorithm = 'ECIES-P256' | 'AES-256-GCM';\n\n/**\n * HKDF domain separator categories\n */\nexport type DomainCategory =\n  | 'default'\n  | 'sync'\n  | 'message'\n  | 'api-key'\n  | 'personal-data'\n  | string;\n\n/**\n * EC Key pair for ECDH operations\n */\nexport interface ECKeyPair {\n  publicKey: JsonWebKey;\n  privateKey: JsonWebKey;\n  keyId: string;\n  createdAt: string;\n}\n\n/**\n * Encrypted data envelope\n */\nexport interface EncryptedPayload {\n  alg: EncryptionAlgorithm;\n  ct: string;\n  iv: string;\n  tag: string;\n  epk?: JsonWebKey;\n  category?: DomainCategory;\n  nonce?: string;\n  encryptedAt: number;\n}\n\n/**\n * Decryption result\n */\nexport interface DecryptionResult {\n  plaintext: Uint8Array;\n  category?: DomainCategory;\n  encryptedAt: number;\n}\n\n// =============================================================================\n// AEON-SPECIFIC TYPES\n// =============================================================================\n\n/**\n * Aeon encryption mode\n */\nexport type AeonEncryptionMode =\n  | 'none' // No encryption (development/testing)\n  | 'transport' // Encrypt in transit only (session keys)\n  | 'at-rest' // Encrypt for storage\n  | 'end-to-end'; // Full E2E encryption between nodes\n\n/**\n * Aeon sync capability namespace\n */\nexport const AEON_CAPABILITIES = {\n  // Basic sync operations\n  SYNC_READ: 'aeon:sync:read',\n  SYNC_WRITE: 'aeon:sync:write',\n  SYNC_ADMIN: 'aeon:sync:admin',\n\n  // Node operations\n  NODE_REGISTER: 'aeon:node:register',\n  NODE_HEARTBEAT: 'aeon:node:heartbeat',\n\n  // Replication operations\n  REPLICATE_READ: 'aeon:replicate:read',\n  REPLICATE_WRITE: 'aeon:replicate:write',\n\n  // State operations\n  STATE_READ: 'aeon:state:read',\n  STATE_WRITE: 'aeon:state:write',\n  STATE_RECONCILE: 'aeon:state:reconcile',\n} as const;\n\nexport type AeonCapability =\n  (typeof AEON_CAPABILITIES)[keyof typeof AEON_CAPABILITIES];\n\n/**\n * Crypto configuration for Aeon\n */\nexport interface AeonCryptoConfig {\n  /** Default encryption mode for sync messages */\n  defaultEncryptionMode: AeonEncryptionMode;\n  /** Require all messages to be signed */\n  requireSignatures: boolean;\n  /** Require UCAN capability verification */\n  requireCapabilities: boolean;\n  /** Allowed signature algorithms */\n  allowedSignatureAlgorithms: string[];\n  /** Allowed encryption algorithms */\n  allowedEncryptionAlgorithms: string[];\n  /** UCAN audience DID for verification */\n  ucanAudience?: string;\n  /** Session key expiration (ms) */\n  sessionKeyExpiration?: number;\n}\n\n/**\n * Default crypto configuration\n */\nexport const DEFAULT_CRYPTO_CONFIG: AeonCryptoConfig = {\n  defaultEncryptionMode: 'none',\n  requireSignatures: false,\n  requireCapabilities: false,\n  allowedSignatureAlgorithms: ['ES256', 'Ed25519'],\n  allowedEncryptionAlgorithms: ['ECIES-P256', 'AES-256-GCM'],\n  sessionKeyExpiration: 24 * 60 * 60 * 1000, // 24 hours\n};\n\n/**\n * Authenticated sync message fields\n */\nexport interface AuthenticatedMessageFields {\n  /** Sender DID */\n  senderDID?: string;\n  /** Receiver DID */\n  receiverDID?: string;\n  /** UCAN token for capability verification */\n  ucan?: string;\n  /** Message signature (base64url) */\n  signature?: string;\n  /** Whether payload is encrypted */\n  encrypted?: boolean;\n}\n\n/**\n * Secure sync session\n */\nexport interface SecureSyncSession {\n  id: string;\n  initiator: string;\n  participants: string[];\n  sessionKey?: Uint8Array;\n  encryptionMode: AeonEncryptionMode;\n  requiredCapabilities: string[];\n  status: 'pending' | 'active' | 'completed' | 'failed';\n  startTime: string;\n  endTime?: string;\n}\n\n/**\n * Node with identity information\n */\nexport interface SecureNodeInfo {\n  id: string;\n  did?: string;\n  publicSigningKey?: JsonWebKey;\n  publicEncryptionKey?: JsonWebKey;\n  capabilities?: string[];\n  lastSeen?: number;\n}\n\n/**\n * Capability verification result\n */\nexport interface AeonCapabilityResult {\n  authorized: boolean;\n  error?: string;\n  issuer?: string;\n  grantedCapabilities?: Array<{ can: string; with: string }>;\n}\n\n/**\n * Signed data envelope for sync operations\n */\nexport interface SignedSyncData<T = unknown> {\n  payload: T;\n  signature: string;\n  signer: string;\n  algorithm: string;\n  signedAt: number;\n}\n","/**\n * Aeon Crypto Provider Interface\n *\n * Abstract interface for cryptographic operations.\n * Aeon core remains zero-dependency - crypto is injected through this interface.\n */\n\nimport type {\n  AeonCapabilityResult,\n  SignedSyncData,\n  SecureNodeInfo,\n} from './types';\n\n/**\n * Abstract crypto provider interface\n *\n * Implementations use @affectively/ucan and @affectively/zk-encryption\n * or other compatible libraries.\n */\nexport interface ICryptoProvider {\n  // ===========================================================================\n  // IDENTITY OPERATIONS\n  // ===========================================================================\n\n  /**\n   * Generate a new identity with DID and key pairs\n   */\n  generateIdentity(displayName?: string): Promise<{\n    did: string;\n    publicSigningKey: JsonWebKey;\n    publicEncryptionKey?: JsonWebKey;\n  }>;\n\n  /**\n   * Get the local identity's DID\n   */\n  getLocalDID(): string | null;\n\n  /**\n   * Export local identity's public info for sharing\n   */\n  exportPublicIdentity(): Promise<SecureNodeInfo | null>;\n\n  /**\n   * Register a known remote node's public keys\n   */\n  registerRemoteNode(node: SecureNodeInfo): Promise<void>;\n\n  /**\n   * Get a remote node's public key\n   */\n  getRemotePublicKey(did: string): Promise<JsonWebKey | null>;\n\n  // ===========================================================================\n  // SIGNING OPERATIONS\n  // ===========================================================================\n\n  /**\n   * Sign data with local identity's private key\n   */\n  sign(data: Uint8Array): Promise<Uint8Array>;\n\n  /**\n   * Sign structured data and wrap in SignedSyncData envelope\n   */\n  signData<T>(data: T): Promise<SignedSyncData<T>>;\n\n  /**\n   * Verify a signature from a remote node\n   */\n  verify(\n    did: string,\n    signature: Uint8Array,\n    data: Uint8Array,\n  ): Promise<boolean>;\n\n  /**\n   * Verify a SignedSyncData envelope\n   */\n  verifySignedData<T>(signedData: SignedSyncData<T>): Promise<boolean>;\n\n  // ===========================================================================\n  // ENCRYPTION OPERATIONS\n  // ===========================================================================\n\n  /**\n   * Encrypt data for a recipient\n   */\n  encrypt(\n    plaintext: Uint8Array,\n    recipientDID: string,\n  ): Promise<{\n    alg: string;\n    ct: string;\n    iv: string;\n    tag: string;\n    epk?: JsonWebKey;\n    encryptedAt: number;\n  }>;\n\n  /**\n   * Decrypt data\n   */\n  decrypt(\n    encrypted: {\n      alg: string;\n      ct: string;\n      iv: string;\n      tag: string;\n      epk?: JsonWebKey;\n    },\n    senderDID?: string,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Derive or get a session key for communication with a peer\n   */\n  getSessionKey(peerDID: string): Promise<Uint8Array>;\n\n  /**\n   * Encrypt with a session key\n   */\n  encryptWithSessionKey(\n    plaintext: Uint8Array,\n    sessionKey: Uint8Array,\n  ): Promise<{\n    alg: string;\n    ct: string;\n    iv: string;\n    tag: string;\n    encryptedAt: number;\n  }>;\n\n  /**\n   * Decrypt with a session key\n   */\n  decryptWithSessionKey(\n    encrypted: {\n      ct: string;\n      iv: string;\n      tag: string;\n    },\n    sessionKey: Uint8Array,\n  ): Promise<Uint8Array>;\n\n  // ===========================================================================\n  // UCAN OPERATIONS\n  // ===========================================================================\n\n  /**\n   * Create a UCAN token\n   */\n  createUCAN(\n    audience: string,\n    capabilities: Array<{ can: string; with: string }>,\n    options?: {\n      expirationSeconds?: number;\n      proofs?: string[];\n    },\n  ): Promise<string>;\n\n  /**\n   * Verify a UCAN token\n   */\n  verifyUCAN(\n    token: string,\n    options?: {\n      expectedAudience?: string;\n      requiredCapabilities?: Array<{ can: string; with: string }>;\n    },\n  ): Promise<AeonCapabilityResult>;\n\n  /**\n   * Delegate capabilities\n   */\n  delegateCapabilities(\n    parentToken: string,\n    audience: string,\n    capabilities: Array<{ can: string; with: string }>,\n    options?: {\n      expirationSeconds?: number;\n    },\n  ): Promise<string>;\n\n  // ===========================================================================\n  // UTILITY OPERATIONS\n  // ===========================================================================\n\n  /**\n   * Compute hash of data\n   */\n  hash(data: Uint8Array): Promise<Uint8Array>;\n\n  /**\n   * Generate random bytes\n   */\n  randomBytes(length: number): Uint8Array;\n\n  /**\n   * Check if crypto is properly initialized\n   */\n  isInitialized(): boolean;\n}\n\n/**\n * Null crypto provider for when crypto is disabled\n *\n * All operations either throw or return permissive defaults.\n */\nexport class NullCryptoProvider implements ICryptoProvider {\n  private notConfiguredError(): Error {\n    return new Error('Crypto provider not configured');\n  }\n\n  async generateIdentity(): Promise<{\n    did: string;\n    publicSigningKey: JsonWebKey;\n    publicEncryptionKey?: JsonWebKey;\n  }> {\n    throw this.notConfiguredError();\n  }\n\n  getLocalDID(): string | null {\n    return null;\n  }\n\n  async exportPublicIdentity(): Promise<SecureNodeInfo | null> {\n    return null;\n  }\n\n  async registerRemoteNode(): Promise<void> {\n    // No-op when crypto disabled\n  }\n\n  async getRemotePublicKey(): Promise<JsonWebKey | null> {\n    return null;\n  }\n\n  async sign(): Promise<Uint8Array> {\n    throw this.notConfiguredError();\n  }\n\n  async signData<T>(_data: T): Promise<SignedSyncData<T>> {\n    throw this.notConfiguredError();\n  }\n\n  async verify(): Promise<boolean> {\n    // Permissive when crypto disabled\n    return true;\n  }\n\n  async verifySignedData(): Promise<boolean> {\n    // Permissive when crypto disabled\n    return true;\n  }\n\n  async encrypt(): Promise<{\n    alg: string;\n    ct: string;\n    iv: string;\n    tag: string;\n    epk?: JsonWebKey;\n    encryptedAt: number;\n  }> {\n    throw this.notConfiguredError();\n  }\n\n  async decrypt(): Promise<Uint8Array> {\n    throw this.notConfiguredError();\n  }\n\n  async getSessionKey(): Promise<Uint8Array> {\n    throw this.notConfiguredError();\n  }\n\n  async encryptWithSessionKey(): Promise<{\n    alg: string;\n    ct: string;\n    iv: string;\n    tag: string;\n    encryptedAt: number;\n  }> {\n    throw this.notConfiguredError();\n  }\n\n  async decryptWithSessionKey(): Promise<Uint8Array> {\n    throw this.notConfiguredError();\n  }\n\n  async createUCAN(): Promise<string> {\n    throw this.notConfiguredError();\n  }\n\n  async verifyUCAN(): Promise<AeonCapabilityResult> {\n    // Permissive when crypto disabled\n    return { authorized: true };\n  }\n\n  async delegateCapabilities(): Promise<string> {\n    throw this.notConfiguredError();\n  }\n\n  async hash(): Promise<Uint8Array> {\n    throw this.notConfiguredError();\n  }\n\n  randomBytes(length: number): Uint8Array {\n    // Use crypto.getRandomValues even without full crypto setup\n    return crypto.getRandomValues(new Uint8Array(length));\n  }\n\n  isInitialized(): boolean {\n    return false;\n  }\n}\n"]}
+{"version":3,"sources":["../../src/crypto/types.ts","../../src/crypto/CryptoProvider.ts"],"names":[],"mappings":";;;AA+JO,IAAM,iBAAA,GAAoB;AAAA;AAAA,EAE/B,SAAA,EAAW,gBAAA;AAAA,EACX,UAAA,EAAY,iBAAA;AAAA,EACZ,UAAA,EAAY,iBAAA;AAAA;AAAA,EAGZ,aAAA,EAAe,oBAAA;AAAA,EACf,cAAA,EAAgB,qBAAA;AAAA;AAAA,EAGhB,cAAA,EAAgB,qBAAA;AAAA,EAChB,eAAA,EAAiB,sBAAA;AAAA;AAAA,EAGjB,UAAA,EAAY,iBAAA;AAAA,EACZ,WAAA,EAAa,kBAAA;AAAA,EACb,eAAA,EAAiB;AACnB;AA4BO,IAAM,qBAAA,GAA0C;AAAA,EACrD,qBAAA,EAAuB,MAAA;AAAA,EACvB,iBAAA,EAAmB,KAAA;AAAA,EACnB,mBAAA,EAAqB,KAAA;AAAA,EACrB,0BAAA,EAA4B,CAAC,OAAA,EAAS,SAAS,CAAA;AAAA,EAC/C,2BAAA,EAA6B,CAAC,YAAA,EAAc,aAAa,CAAA;AAAA,EACzD,oBAAA,EAAsB,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK;AAAA;AACvC;;;ACHO,IAAM,qBAAN,MAAoD;AAAA,EACjD,kBAAA,GAA4B;AAClC,IAAA,OAAO,IAAI,MAAM,gCAAgC,CAAA;AAAA,EACnD;AAAA,EAEA,MAAM,gBAAA,GAIH;AACD,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,WAAA,GAA6B;AAC3B,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,oBAAA,GAAuD;AAC3D,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,kBAAA,GAAoC;AAAA,EAE1C;AAAA,EAEA,MAAM,kBAAA,GAAiD;AACrD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,IAAA,GAA4B;AAChC,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,MAAM,SAAY,KAAA,EAAsC;AACtD,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,MAAM,MAAA,GAA2B;AAE/B,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,gBAAA,GAAqC;AAEzC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,OAAA,GAOH;AACD,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,MAAM,OAAA,GAA+B;AACnC,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,MAAM,aAAA,GAAqC;AACzC,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,MAAM,qBAAA,GAMH;AACD,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,MAAM,qBAAA,GAA6C;AACjD,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,MAAM,UAAA,GAA8B;AAClC,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,MAAM,UAAA,GAA4C;AAEhD,IAAA,OAAO,EAAE,YAAY,IAAA,EAAK;AAAA,EAC5B;AAAA,EAEA,MAAM,oBAAA,GAAwC;AAC5C,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,MAAM,IAAA,GAA4B;AAChC,IAAA,MAAM,KAAK,kBAAA,EAAmB;AAAA,EAChC;AAAA,EAEA,YAAY,MAAA,EAA4B;AAEtC,IAAA,OAAO,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,EACtD;AAAA,EAEA,aAAA,GAAyB;AACvB,IAAA,OAAO,KAAA;AAAA,EACT;AACF","file":"index.cjs","sourcesContent":["/**\r\n * Aeon Crypto Types\r\n *\r\n * Type definitions for cryptographic operations in Aeon.\r\n * These are compatible with @affectively/ucan and @affectively/zk-encryption.\r\n */\r\n\r\n// =============================================================================\r\n// IDENTITY TYPES (compatible with @affectively/ucan)\r\n// =============================================================================\r\n\r\n/**\r\n * Decentralized Identifier (DID)\r\n * Format: did:method:identifier\r\n */\r\nexport type DID = `did:${string}:${string}`;\r\n\r\n/**\r\n * Supported signing algorithms\r\n */\r\nexport type SigningAlgorithm = 'ES256' | 'Ed25519' | 'ES384' | 'ES512';\r\n\r\n/**\r\n * Key pair for signing and verification\r\n */\r\nexport interface KeyPair {\r\n  algorithm: SigningAlgorithm;\r\n  publicKey: JsonWebKey;\r\n  privateKey?: JsonWebKey;\r\n  fingerprint: string;\r\n}\r\n\r\n/**\r\n * Identity representing a user or node\r\n */\r\nexport interface Identity {\r\n  did: DID;\r\n  signingKey: KeyPair;\r\n  encryptionKey?: KeyPair;\r\n  createdAt: number;\r\n  displayName?: string;\r\n}\r\n\r\n/**\r\n * UCAN Capability structure\r\n */\r\nexport interface Capability {\r\n  can: string;\r\n  with: string;\r\n  constraints?: Record<string, unknown>;\r\n}\r\n\r\n/**\r\n * UCAN Token payload\r\n */\r\nexport interface UCANPayload {\r\n  iss: DID;\r\n  aud: DID;\r\n  exp: number;\r\n  nbf?: number;\r\n  iat?: number;\r\n  nonce?: string;\r\n  jti?: string;\r\n  att: Capability[];\r\n  prf?: string[];\r\n  fct?: Record<string, unknown>;\r\n}\r\n\r\n/**\r\n * Parsed UCAN Token\r\n */\r\nexport interface UCANToken {\r\n  payload: UCANPayload;\r\n  raw: string;\r\n  signature: Uint8Array;\r\n  algorithm: string;\r\n}\r\n\r\n/**\r\n * UCAN verification result\r\n */\r\nexport interface VerificationResult {\r\n  valid: boolean;\r\n  payload?: UCANPayload;\r\n  error?: string;\r\n  expired?: boolean;\r\n  shouldRotate?: boolean;\r\n  expiresIn?: number;\r\n}\r\n\r\n// =============================================================================\r\n// ENCRYPTION TYPES (compatible with @affectively/zk-encryption)\r\n// =============================================================================\r\n\r\n/**\r\n * Encryption algorithms supported\r\n */\r\nexport type EncryptionAlgorithm = 'ECIES-P256' | 'AES-256-GCM';\r\n\r\n/**\r\n * HKDF domain separator categories\r\n */\r\nexport type DomainCategory =\r\n  | 'default'\r\n  | 'sync'\r\n  | 'message'\r\n  | 'api-key'\r\n  | 'personal-data'\r\n  | string;\r\n\r\n/**\r\n * EC Key pair for ECDH operations\r\n */\r\nexport interface ECKeyPair {\r\n  publicKey: JsonWebKey;\r\n  privateKey: JsonWebKey;\r\n  keyId: string;\r\n  createdAt: string;\r\n}\r\n\r\n/**\r\n * Encrypted data envelope\r\n */\r\nexport interface EncryptedPayload {\r\n  alg: EncryptionAlgorithm;\r\n  ct: string;\r\n  iv: string;\r\n  tag: string;\r\n  epk?: JsonWebKey;\r\n  category?: DomainCategory;\r\n  nonce?: string;\r\n  encryptedAt: number;\r\n}\r\n\r\n/**\r\n * Decryption result\r\n */\r\nexport interface DecryptionResult {\r\n  plaintext: Uint8Array;\r\n  category?: DomainCategory;\r\n  encryptedAt: number;\r\n}\r\n\r\n// =============================================================================\r\n// AEON-SPECIFIC TYPES\r\n// =============================================================================\r\n\r\n/**\r\n * Aeon encryption mode\r\n */\r\nexport type AeonEncryptionMode =\r\n  | 'none' // No encryption (development/testing)\r\n  | 'transport' // Encrypt in transit only (session keys)\r\n  | 'at-rest' // Encrypt for storage\r\n  | 'end-to-end'; // Full E2E encryption between nodes\r\n\r\n/**\r\n * Aeon sync capability namespace\r\n */\r\nexport const AEON_CAPABILITIES = {\r\n  // Basic sync operations\r\n  SYNC_READ: 'aeon:sync:read',\r\n  SYNC_WRITE: 'aeon:sync:write',\r\n  SYNC_ADMIN: 'aeon:sync:admin',\r\n\r\n  // Node operations\r\n  NODE_REGISTER: 'aeon:node:register',\r\n  NODE_HEARTBEAT: 'aeon:node:heartbeat',\r\n\r\n  // Replication operations\r\n  REPLICATE_READ: 'aeon:replicate:read',\r\n  REPLICATE_WRITE: 'aeon:replicate:write',\r\n\r\n  // State operations\r\n  STATE_READ: 'aeon:state:read',\r\n  STATE_WRITE: 'aeon:state:write',\r\n  STATE_RECONCILE: 'aeon:state:reconcile',\r\n} as const;\r\n\r\nexport type AeonCapability =\r\n  (typeof AEON_CAPABILITIES)[keyof typeof AEON_CAPABILITIES];\r\n\r\n/**\r\n * Crypto configuration for Aeon\r\n */\r\nexport interface AeonCryptoConfig {\r\n  /** Default encryption mode for sync messages */\r\n  defaultEncryptionMode: AeonEncryptionMode;\r\n  /** Require all messages to be signed */\r\n  requireSignatures: boolean;\r\n  /** Require UCAN capability verification */\r\n  requireCapabilities: boolean;\r\n  /** Allowed signature algorithms */\r\n  allowedSignatureAlgorithms: string[];\r\n  /** Allowed encryption algorithms */\r\n  allowedEncryptionAlgorithms: string[];\r\n  /** UCAN audience DID for verification */\r\n  ucanAudience?: string;\r\n  /** Session key expiration (ms) */\r\n  sessionKeyExpiration?: number;\r\n}\r\n\r\n/**\r\n * Default crypto configuration\r\n */\r\nexport const DEFAULT_CRYPTO_CONFIG: AeonCryptoConfig = {\r\n  defaultEncryptionMode: 'none',\r\n  requireSignatures: false,\r\n  requireCapabilities: false,\r\n  allowedSignatureAlgorithms: ['ES256', 'Ed25519'],\r\n  allowedEncryptionAlgorithms: ['ECIES-P256', 'AES-256-GCM'],\r\n  sessionKeyExpiration: 24 * 60 * 60 * 1000, // 24 hours\r\n};\r\n\r\n/**\r\n * Authenticated sync message fields\r\n */\r\nexport interface AuthenticatedMessageFields {\r\n  /** Sender DID */\r\n  senderDID?: string;\r\n  /** Receiver DID */\r\n  receiverDID?: string;\r\n  /** UCAN token for capability verification */\r\n  ucan?: string;\r\n  /** Message signature (base64url) */\r\n  signature?: string;\r\n  /** Whether payload is encrypted */\r\n  encrypted?: boolean;\r\n}\r\n\r\n/**\r\n * Secure sync session\r\n */\r\nexport interface SecureSyncSession {\r\n  id: string;\r\n  initiator: string;\r\n  participants: string[];\r\n  sessionKey?: Uint8Array;\r\n  encryptionMode: AeonEncryptionMode;\r\n  requiredCapabilities: string[];\r\n  status: 'pending' | 'active' | 'completed' | 'failed';\r\n  startTime: string;\r\n  endTime?: string;\r\n}\r\n\r\n/**\r\n * Node with identity information\r\n */\r\nexport interface SecureNodeInfo {\r\n  id: string;\r\n  did?: string;\r\n  publicSigningKey?: JsonWebKey;\r\n  publicEncryptionKey?: JsonWebKey;\r\n  capabilities?: string[];\r\n  lastSeen?: number;\r\n}\r\n\r\n/**\r\n * Capability verification result\r\n */\r\nexport interface AeonCapabilityResult {\r\n  authorized: boolean;\r\n  error?: string;\r\n  issuer?: string;\r\n  grantedCapabilities?: Array<{ can: string; with: string }>;\r\n}\r\n\r\n/**\r\n * Signed data envelope for sync operations\r\n */\r\nexport interface SignedSyncData<T = unknown> {\r\n  payload: T;\r\n  signature: string;\r\n  signer: string;\r\n  algorithm: string;\r\n  signedAt: number;\r\n}\r\n","/**\r\n * Aeon Crypto Provider Interface\r\n *\r\n * Abstract interface for cryptographic operations.\r\n * Aeon core remains zero-dependency - crypto is injected through this interface.\r\n */\r\n\r\nimport type {\r\n  AeonCapabilityResult,\r\n  SignedSyncData,\r\n  SecureNodeInfo,\r\n} from './types';\r\n\r\n/**\r\n * Abstract crypto provider interface\r\n *\r\n * Implementations use @affectively/ucan and @affectively/zk-encryption\r\n * or other compatible libraries.\r\n */\r\nexport interface ICryptoProvider {\r\n  // ===========================================================================\r\n  // IDENTITY OPERATIONS\r\n  // ===========================================================================\r\n\r\n  /**\r\n   * Generate a new identity with DID and key pairs\r\n   */\r\n  generateIdentity(displayName?: string): Promise<{\r\n    did: string;\r\n    publicSigningKey: JsonWebKey;\r\n    publicEncryptionKey?: JsonWebKey;\r\n  }>;\r\n\r\n  /**\r\n   * Get the local identity's DID\r\n   */\r\n  getLocalDID(): string | null;\r\n\r\n  /**\r\n   * Export local identity's public info for sharing\r\n   */\r\n  exportPublicIdentity(): Promise<SecureNodeInfo | null>;\r\n\r\n  /**\r\n   * Register a known remote node's public keys\r\n   */\r\n  registerRemoteNode(node: SecureNodeInfo): Promise<void>;\r\n\r\n  /**\r\n   * Get a remote node's public key\r\n   */\r\n  getRemotePublicKey(did: string): Promise<JsonWebKey | null>;\r\n\r\n  // ===========================================================================\r\n  // SIGNING OPERATIONS\r\n  // ===========================================================================\r\n\r\n  /**\r\n   * Sign data with local identity's private key\r\n   */\r\n  sign(data: Uint8Array): Promise<Uint8Array>;\r\n\r\n  /**\r\n   * Sign structured data and wrap in SignedSyncData envelope\r\n   */\r\n  signData<T>(data: T): Promise<SignedSyncData<T>>;\r\n\r\n  /**\r\n   * Verify a signature from a remote node\r\n   */\r\n  verify(\r\n    did: string,\r\n    signature: Uint8Array,\r\n    data: Uint8Array\r\n  ): Promise<boolean>;\r\n\r\n  /**\r\n   * Verify a SignedSyncData envelope\r\n   */\r\n  verifySignedData<T>(signedData: SignedSyncData<T>): Promise<boolean>;\r\n\r\n  // ===========================================================================\r\n  // ENCRYPTION OPERATIONS\r\n  // ===========================================================================\r\n\r\n  /**\r\n   * Encrypt data for a recipient\r\n   */\r\n  encrypt(\r\n    plaintext: Uint8Array,\r\n    recipientDID: string\r\n  ): Promise<{\r\n    alg: string;\r\n    ct: string;\r\n    iv: string;\r\n    tag: string;\r\n    epk?: JsonWebKey;\r\n    encryptedAt: number;\r\n  }>;\r\n\r\n  /**\r\n   * Decrypt data\r\n   */\r\n  decrypt(\r\n    encrypted: {\r\n      alg: string;\r\n      ct: string;\r\n      iv: string;\r\n      tag: string;\r\n      epk?: JsonWebKey;\r\n    },\r\n    senderDID?: string\r\n  ): Promise<Uint8Array>;\r\n\r\n  /**\r\n   * Derive or get a session key for communication with a peer\r\n   */\r\n  getSessionKey(peerDID: string): Promise<Uint8Array>;\r\n\r\n  /**\r\n   * Encrypt with a session key\r\n   */\r\n  encryptWithSessionKey(\r\n    plaintext: Uint8Array,\r\n    sessionKey: Uint8Array\r\n  ): Promise<{\r\n    alg: string;\r\n    ct: string;\r\n    iv: string;\r\n    tag: string;\r\n    encryptedAt: number;\r\n  }>;\r\n\r\n  /**\r\n   * Decrypt with a session key\r\n   */\r\n  decryptWithSessionKey(\r\n    encrypted: {\r\n      ct: string;\r\n      iv: string;\r\n      tag: string;\r\n    },\r\n    sessionKey: Uint8Array\r\n  ): Promise<Uint8Array>;\r\n\r\n  // ===========================================================================\r\n  // UCAN OPERATIONS\r\n  // ===========================================================================\r\n\r\n  /**\r\n   * Create a UCAN token\r\n   */\r\n  createUCAN(\r\n    audience: string,\r\n    capabilities: Array<{ can: string; with: string }>,\r\n    options?: {\r\n      expirationSeconds?: number;\r\n      proofs?: string[];\r\n    }\r\n  ): Promise<string>;\r\n\r\n  /**\r\n   * Verify a UCAN token\r\n   */\r\n  verifyUCAN(\r\n    token: string,\r\n    options?: {\r\n      expectedAudience?: string;\r\n      requiredCapabilities?: Array<{ can: string; with: string }>;\r\n    }\r\n  ): Promise<AeonCapabilityResult>;\r\n\r\n  /**\r\n   * Delegate capabilities\r\n   */\r\n  delegateCapabilities(\r\n    parentToken: string,\r\n    audience: string,\r\n    capabilities: Array<{ can: string; with: string }>,\r\n    options?: {\r\n      expirationSeconds?: number;\r\n    }\r\n  ): Promise<string>;\r\n\r\n  // ===========================================================================\r\n  // UTILITY OPERATIONS\r\n  // ===========================================================================\r\n\r\n  /**\r\n   * Compute hash of data\r\n   */\r\n  hash(data: Uint8Array): Promise<Uint8Array>;\r\n\r\n  /**\r\n   * Generate random bytes\r\n   */\r\n  randomBytes(length: number): Uint8Array;\r\n\r\n  /**\r\n   * Check if crypto is properly initialized\r\n   */\r\n  isInitialized(): boolean;\r\n}\r\n\r\n/**\r\n * Null crypto provider for when crypto is disabled\r\n *\r\n * All operations either throw or return permissive defaults.\r\n */\r\nexport class NullCryptoProvider implements ICryptoProvider {\r\n  private notConfiguredError(): Error {\r\n    return new Error('Crypto provider not configured');\r\n  }\r\n\r\n  async generateIdentity(): Promise<{\r\n    did: string;\r\n    publicSigningKey: JsonWebKey;\r\n    publicEncryptionKey?: JsonWebKey;\r\n  }> {\r\n    throw this.notConfiguredError();\r\n  }\r\n\r\n  getLocalDID(): string | null {\r\n    return null;\r\n  }\r\n\r\n  async exportPublicIdentity(): Promise<SecureNodeInfo | null> {\r\n    return null;\r\n  }\r\n\r\n  async registerRemoteNode(): Promise<void> {\r\n    // No-op when crypto disabled\r\n  }\r\n\r\n  async getRemotePublicKey(): Promise<JsonWebKey | null> {\r\n    return null;\r\n  }\r\n\r\n  async sign(): Promise<Uint8Array> {\r\n    throw this.notConfiguredError();\r\n  }\r\n\r\n  async signData<T>(_data: T): Promise<SignedSyncData<T>> {\r\n    throw this.notConfiguredError();\r\n  }\r\n\r\n  async verify(): Promise<boolean> {\r\n    // Permissive when crypto disabled\r\n    return true;\r\n  }\r\n\r\n  async verifySignedData(): Promise<boolean> {\r\n    // Permissive when crypto disabled\r\n    return true;\r\n  }\r\n\r\n  async encrypt(): Promise<{\r\n    alg: string;\r\n    ct: string;\r\n    iv: string;\r\n    tag: string;\r\n    epk?: JsonWebKey;\r\n    encryptedAt: number;\r\n  }> {\r\n    throw this.notConfiguredError();\r\n  }\r\n\r\n  async decrypt(): Promise<Uint8Array> {\r\n    throw this.notConfiguredError();\r\n  }\r\n\r\n  async getSessionKey(): Promise<Uint8Array> {\r\n    throw this.notConfiguredError();\r\n  }\r\n\r\n  async encryptWithSessionKey(): Promise<{\r\n    alg: string;\r\n    ct: string;\r\n    iv: string;\r\n    tag: string;\r\n    encryptedAt: number;\r\n  }> {\r\n    throw this.notConfiguredError();\r\n  }\r\n\r\n  async decryptWithSessionKey(): Promise<Uint8Array> {\r\n    throw this.notConfiguredError();\r\n  }\r\n\r\n  async createUCAN(): Promise<string> {\r\n    throw this.notConfiguredError();\r\n  }\r\n\r\n  async verifyUCAN(): Promise<AeonCapabilityResult> {\r\n    // Permissive when crypto disabled\r\n    return { authorized: true };\r\n  }\r\n\r\n  async delegateCapabilities(): Promise<string> {\r\n    throw this.notConfiguredError();\r\n  }\r\n\r\n  async hash(): Promise<Uint8Array> {\r\n    throw this.notConfiguredError();\r\n  }\r\n\r\n  randomBytes(length: number): Uint8Array {\r\n    // Use crypto.getRandomValues even without full crypto setup\r\n    return crypto.getRandomValues(new Uint8Array(length));\r\n  }\r\n\r\n  isInitialized(): boolean {\r\n    return false;\r\n  }\r\n}\r\n"]}