@agentxv2/sdk 0.3.0 → 0.4.0

package/dist/core.mjs

@@ -0,0 +1,240 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/core/types.ts
+var AgentXErrorCode = /* @__PURE__ */ ((AgentXErrorCode2) => {
+  AgentXErrorCode2["NOT_SUBSCRIBED"] = "NOT_SUBSCRIBED";
+  AgentXErrorCode2["SUBSCRIPTION_EXPIRED"] = "SUBSCRIPTION_EXPIRED";
+  AgentXErrorCode2["DECRYPTION_FAILED"] = "DECRYPTION_FAILED";
+  AgentXErrorCode2["IPFS_FETCH_FAILED"] = "IPFS_FETCH_FAILED";
+  AgentXErrorCode2["AGENT_NOT_FOUND"] = "AGENT_NOT_FOUND";
+  AgentXErrorCode2["INVALID_SCHEMA"] = "INVALID_SCHEMA";
+  AgentXErrorCode2["TX_FAILED"] = "TX_FAILED";
+  AgentXErrorCode2["WALLET_NOT_CONNECTED"] = "WALLET_NOT_CONNECTED";
+  return AgentXErrorCode2;
+})(AgentXErrorCode || {});
+var AgentXError = class extends Error {
+  code;
+  /** If NOT_SUBSCRIBED, carry enough info for wallet/X402 auto-payment */
+  paymentInfo;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "AgentXError";
+  }
+};
+
+// src/core/crypto.ts
+import { gcm } from "@noble/ciphers/aes.js";
+import { secp256k1 } from "@noble/curves/secp256k1.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { hkdf } from "@noble/hashes/hkdf.js";
+import { hmac } from "@noble/hashes/hmac.js";
+import { bytesToHex, hexToBytes } from "@noble/ciphers/utils.js";
+function randomBytes(length) {
+  if (typeof crypto !== "undefined" && crypto.getRandomValues) {
+    const buf = new Uint8Array(length);
+    crypto.getRandomValues(buf);
+    return buf;
+  }
+  const nodeCrypto = __require("crypto");
+  return new Uint8Array(nodeCrypto.randomBytes(length));
+}
+var AES_KEY_SIZE = 32;
+var IV_SIZE = 12;
+var TAG_SIZE = 16;
+function toBase64(bytes) {
+  if (typeof Buffer !== "undefined") return Buffer.from(bytes).toString("base64");
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+  return btoa(binary);
+}
+function fromBase64(b64) {
+  if (typeof Buffer !== "undefined") return new Uint8Array(Buffer.from(b64, "base64"));
+  const binary = atob(b64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+function aesEncrypt(plaintext, keyHex) {
+  const key = hexToBytes(keyHex);
+  const iv = randomBytes(IV_SIZE);
+  const plainBytes = new TextEncoder().encode(plaintext);
+  const cipher = gcm(key, iv);
+  const encrypted = cipher.encrypt(plainBytes);
+  const ciphertext = encrypted.subarray(0, -TAG_SIZE);
+  const authTag = encrypted.subarray(-TAG_SIZE);
+  const combined = new Uint8Array(IV_SIZE + ciphertext.length + TAG_SIZE);
+  combined.set(iv, 0);
+  combined.set(ciphertext, IV_SIZE);
+  combined.set(authTag, IV_SIZE + ciphertext.length);
+  return toBase64(combined);
+}
+function aesDecrypt(encryptedBase64, keyHex) {
+  const key = hexToBytes(keyHex);
+  const combined = fromBase64(encryptedBase64);
+  const iv = combined.subarray(0, IV_SIZE);
+  const ciphertext = combined.subarray(IV_SIZE, -TAG_SIZE);
+  const authTag = combined.subarray(-TAG_SIZE);
+  const cipher = gcm(key, iv);
+  const ciphertextWithTag = new Uint8Array(ciphertext.length + TAG_SIZE);
+  ciphertextWithTag.set(ciphertext, 0);
+  ciphertextWithTag.set(authTag, ciphertext.length);
+  const decrypted = cipher.decrypt(ciphertextWithTag);
+  return new TextDecoder().decode(decrypted);
+}
+function generateAesKey() {
+  return bytesToHex(randomBytes(AES_KEY_SIZE));
+}
+function eciesEncode(ephemeralPub, iv, ciphertext, mac) {
+  const out = new Uint8Array(33 + 16 + ciphertext.length + 32);
+  out.set(ephemeralPub, 0);
+  out.set(iv, 33);
+  out.set(ciphertext, 33 + 16);
+  out.set(mac, 33 + 16 + ciphertext.length);
+  return bytesToHex(out);
+}
+function eciesDecode(dataHex) {
+  const d = hexToBytes(dataHex);
+  return {
+    ephemeralPub: d.subarray(0, 33),
+    iv: d.subarray(33, 49),
+    ciphertext: d.subarray(49, -32),
+    mac: d.subarray(-32)
+  };
+}
+function aesCtrEncrypt(key, ctrBytes, data) {
+  const blockSize = 16;
+  const cipher = gcm(key, ctrBytes);
+  const result = new Uint8Array(data.length);
+  const counter = new Uint8Array(blockSize);
+  counter.set(ctrBytes);
+  for (let i = 0; i < data.length; i += blockSize) {
+    const keystream = gcm(key, counter).encrypt(new Uint8Array(blockSize));
+    for (let j = 0; j < blockSize && i + j < data.length; j++) {
+      result[i + j] = keystream[j] ^ data[i + j];
+    }
+    for (let j = blockSize - 1; j >= 0; j--) {
+      const val = counter[j];
+      if (val !== void 0) {
+        counter[j] = val + 1 & 255;
+        if (counter[j] !== 0) break;
+      }
+    }
+  }
+  return result;
+}
+function eciesEncrypt(dataHex, publicKey) {
+  const ephPriv = randomBytes(32);
+  const ephPub = secp256k1.getPublicKey(ephPriv, true);
+  let recipientPub;
+  if (publicKey.startsWith("04") && publicKey.length === 130) {
+    recipientPub = hexToBytes(publicKey);
+  } else if (publicKey.startsWith("02") || publicKey.startsWith("03")) {
+    recipientPub = hexToBytes(publicKey);
+  } else {
+    throw new Error("Invalid public key format: expected hex with 02/03/04 prefix");
+  }
+  const shared = secp256k1.getSharedSecret(ephPriv, recipientPub);
+  const sharedX = shared.subarray(1, 33);
+  const sharedKey = sha256(sharedX);
+  const hkdfOut = hkdf(sha256, sharedKey, void 0, void 0, 64);
+  const encKey = hkdfOut.subarray(0, 32);
+  const macKey = hkdfOut.subarray(32, 64);
+  const iv = randomBytes(16);
+  const plaintext = hexToBytes(dataHex);
+  const ciphertext = aesCtrEncrypt(encKey, iv, plaintext);
+  const macInput = new Uint8Array(33 + 16 + ciphertext.length);
+  macInput.set(ephPub, 0);
+  macInput.set(iv, 33);
+  macInput.set(ciphertext, 33 + 16);
+  const mac = hmac(sha256, macKey, macInput);
+  return eciesEncode(ephPub, iv, ciphertext, mac);
+}
+function eciesDecrypt(dataHex, privateKey) {
+  const { ephemeralPub, iv, ciphertext, mac } = eciesDecode(dataHex);
+  const privBytes = hexToBytes(privateKey);
+  const shared = secp256k1.getSharedSecret(privBytes, ephemeralPub);
+  const sharedX = shared.subarray(1, 33);
+  const sharedKey = sha256(sharedX);
+  const hkdfOut = hkdf(sha256, sharedKey, void 0, void 0, 64);
+  const encKey = hkdfOut.subarray(0, 32);
+  const macKey = hkdfOut.subarray(32, 64);
+  const macInput = new Uint8Array(33 + 16 + ciphertext.length);
+  macInput.set(ephemeralPub, 0);
+  macInput.set(iv, 33);
+  macInput.set(ciphertext, 33 + 16);
+  const expectedMac = hmac(sha256, macKey, macInput);
+  if (!constantTimeEqual(mac, expectedMac)) {
+    throw new Error("ECIES decryption failed: MAC mismatch");
+  }
+  const plaintext = aesCtrEncrypt(encKey, iv, ciphertext);
+  return bytesToHex(plaintext);
+}
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+function encryptPayload(payload, keyHex) {
+  const key = keyHex ?? generateAesKey();
+  return {
+    encrypted: true,
+    algorithm: "AES-256-GCM",
+    data: aesEncrypt(JSON.stringify(payload), key)
+  };
+}
+function decryptPayload(encrypted, keyHex) {
+  if (encrypted.algorithm !== "AES-256-GCM") {
+    throw new Error(`Unsupported algorithm: ${encrypted.algorithm}`);
+  }
+  return JSON.parse(aesDecrypt(encrypted.data, keyHex));
+}
+function packAgentForPublish(agent, publicKey, aesKeyHex) {
+  const key = aesKeyHex ?? generateAesKey();
+  const eciesEncryptedKeyHex = eciesEncrypt(key, publicKey);
+  return {
+    encryptedCid: "",
+    // filled after IPFS upload
+    publicCid: "",
+    // filled after IPFS upload
+    aesKeyHex: key,
+    eciesEncryptedKeyHex
+  };
+}
+function unpackAgent(encryptedPayload, eciesEncryptedKey, privateKey) {
+  const aesKeyHex = eciesDecrypt(eciesEncryptedKey, privateKey);
+  return decryptPayload(encryptedPayload, aesKeyHex);
+}
+function generateKeyPair() {
+  const priv = randomBytes(32);
+  const pub = secp256k1.getPublicKey(priv, false);
+  return { privateKey: bytesToHex(priv), publicKey: bytesToHex(pub) };
+}
+function getPublicKey(privateKey) {
+  return bytesToHex(secp256k1.getPublicKey(hexToBytes(privateKey), false));
+}
+export {
+  AgentXError,
+  AgentXErrorCode,
+  aesDecrypt,
+  aesEncrypt,
+  bytesToHex,
+  decryptPayload,
+  eciesDecrypt,
+  eciesEncrypt,
+  encryptPayload,
+  generateAesKey,
+  generateKeyPair,
+  getPublicKey,
+  hexToBytes,
+  packAgentForPublish,
+  randomBytes,
+  unpackAgent
+};
+//# sourceMappingURL=index.mjs.map

package/dist/core.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/types.ts","../../src/core/crypto.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// @agentx/sdk — Core Type Definitions\n// ---------------------------------------------------------------------------\n// Agent = Prompt + Skills[] + MCP\n// All crypto-related \"wire\" fields (encryptedPayloadCid, eciesEncryptedKey)\n// live in IPFS metadata attributes → existing ERC8004 contracts are unchanged.\n// ---------------------------------------------------------------------------\n\n// ── JSON Schema (MCP standard subset) ──────────────────────────────────────\n\nexport interface JSONSchema {\n  type: 'object' | 'array' | 'string' | 'number' | 'boolean' | 'integer' | 'null'\n  properties?: Record<string, JSONSchemaProperty>\n  required?: string[]\n  description?: string\n  items?: JSONSchema\n  enum?: (string | number | boolean | null)[]\n}\n\nexport interface JSONSchemaProperty {\n  type?: JSONSchema['type'] | JSONSchema['type'][]\n  description?: string\n  properties?: Record<string, JSONSchemaProperty>\n  required?: string[]\n  items?: JSONSchema\n  enum?: (string | number | boolean | null)[]\n  format?: string\n  default?: unknown\n}\n\n// ── Skill Definition ───────────────────────────────────────────────────────\n\n/**\n * A single skill module that an Agent exposes.\n * `inputSchema` and `outputSchema` follow MCP Tool JSON Schema conventions.\n */\nexport interface SkillDef {\n  /** Unique skill name (e.g. \"solidity_audit\") */\n  name: string\n  /** Human-readable description shown in the marketplace */\n  description: string\n  /** Semantic version of this skill */\n  version: string\n  /** JSON Schema for the tool's input parameters */\n  inputSchema: JSONSchema\n  /** JSON Schema for the tool's output return value */\n  outputSchema?: JSONSchema\n  /**\n   * Execution mode.\n   * - undefined / \"open\": Source is in the encrypted payload, runs locally.\n   * - { type: \"mcp\", toolName: \"...\" }: Source lives on the publisher's\n   *     MCP server.  Subscriber only gets Schema + remote execution endpoint.\n   *     MCP server verifies on-chain subscription on every call.\n   * - { type: \"a2a\", targetAgentId: 42 }: Delegates to another AgentX Agent.\n   *     The caller's AgentRunner loads + decrypts the target Agent, injects\n   *     its prompt into the LLM context, and exposes its skills as callable\n   *     tools.  This is the core Agent Composition primitive.\n   */\n  execution?: SkillExecutionRemote | A2ASkillExecution\n}\n\n/** Where the skill code actually runs. */\nexport type SkillExecutionMode = 'open' | 'mcp' | 'a2a'\n\nexport interface SkillExecutionRemote {\n  type: 'mcp'\n  /** MCP tool name on the publisher's server (e.g. \"run_strategy_abc123\") */\n  toolName: string\n  /** Optional: explicit MCP endpoint override */\n  endpoint?: string\n}\n\n/**\n * A2A Skill Execution — delegate to another AgentX Agent.\n *\n * Example: A \"trading\" Agent has a skill:\n *   execution: { type: \"a2a\", targetAgentId: 42 }\n * → When LLM calls this skill, AgentRunner loads Agent #42,\n *   decrypts its prompt+skills, and the sub-Agent runs in the\n *   same LLM conversation with its own system prompt.\n */\nexport interface A2ASkillExecution {\n  type: 'a2a'\n  /** On-chain Agent ID to delegate to */\n  targetAgentId: number\n  /** Optional: restrict which of the target Agent's skills are exposed */\n  skillFilter?: string[]\n  /** Optional: custom system prompt override for the sub-Agent */\n  promptOverride?: string\n}\n\n// ── MCP Connection ─────────────────────────────────────────────────────────\n\nexport type McpTransport = 'http' | 'sse' | 'stdio'\n\nexport interface McpConnection {\n  /** Transport type */\n  type: McpTransport\n  /** MCP server URL (required for http/sse) */\n  url?: string\n  /** Optional: limit which tools the Agent exposes to users */\n  toolFilter?: string[]\n  /** Optional: MCP server authentication header / key */\n  authHeader?: string\n}\n\n// ── Pricing ────────────────────────────────────────────────────────────────\n\nexport type PricingType = 'subscription' | 'pay_per_use' | 'free'\n\nexport interface AgentPricing {\n  type: PricingType\n  /** Amount in native unit (e.g. \"0.01\" for 0.01 ETH) */\n  amount: string\n  /** ERC20 token address, or empty for native currency */\n  currency: string\n  /** Billing period for subscriptions (e.g. \"month\", \"year\", \"day\") */\n  period?: string\n}\n\n// ── Agent Payload (the core data model) ────────────────────────────────────\n\n/**\n * The complete Agent definition.\n *\n * - Fields above \"--- private payload ---\" are public (IPFS publicPayloadCid).\n * - Fields below are encrypted with AES-256-GCM and stored at encryptedPayloadCid.\n */\nexport interface AgentPayload {\n  // ── Public (visible in marketplace, stored at publicPayloadCid) ─────────\n  name: string\n  description: string\n  image?: string\n  version: string\n  tags: string[]\n  capabilities: string[]\n  supportedTasks: string[]\n  communicationProtocol: 'mcp' | 'a2a'\n  authenticationMethod: 'ecdsa'\n  pricing: AgentPricing\n\n  // ── Private (AES-256-GCM encrypted, stored at encryptedPayloadCid) ──────\n  prompt: string\n  skills: SkillDef[]\n  mcp: McpConnection\n}\n\n/** Subset of AgentPayload that is publicly visible */\nexport type AgentPublicPayload = Omit<\n  AgentPayload,\n  'prompt' | 'skills' | 'mcp'\n>\n\n/** Fields that must be encrypted before IPFS upload */\nexport type AgentPrivatePayload = Pick<\n  AgentPayload,\n  'prompt' | 'skills' | 'mcp'\n>\n\n// ── Encrypted Payload (IPFS wire format) ───────────────────────────────────\n\nexport interface EncryptedPayload {\n  encrypted: true\n  algorithm: 'AES-256-GCM'\n  /** base64(iv + ciphertext + authTag) */\n  data: string\n}\n\n// ── On-Chain Metadata (stored in ERC-721 tokenURI attributes) ─────────────\n\nexport interface OnChainAgentMetadata {\n  tokenURI: string\n  attributes: {\n    name: string\n    description: string\n    /** CID of the AES-256-GCM encrypted payload on IPFS */\n    encryptedPayloadCid: string\n    /** ECIES-encrypted AES key (secp256k1, hex string) */\n    eciesEncryptedKey: string\n    /** CID of the public metadata on IPFS */\n    publicPayloadCid: string\n    capabilities: string[]\n    skills: string[]\n    mcpEndpoint: string\n    version: string\n    tags: string[]\n    pricingType: PricingType\n    pricingAmount: string\n  }\n}\n\n// ── Agent Registry ─────────────────────────────────────────────────────────\n\nexport interface RegisteredAgent {\n  /** ERC-721 token ID (= agentId) */\n  agentId: number\n  /** Owner wallet address */\n  owner: string\n  /** Creator wallet address */\n  creator: string\n  /** Full on-chain metadata */\n  metadata: OnChainAgentMetadata\n  /** Block number where agent was registered */\n  registeredAt: number\n  /** IPFS CID of the full public payload (resolved from tokenURI) */\n  publicPayloadCid: string\n}\n\n// ── Agent Search ───────────────────────────────────────────────────────────\n\nexport interface AgentSearchQuery {\n  keyword?: string\n  capabilities?: string[]\n  tags?: string[]\n  pricingType?: PricingType\n  maxPrice?: string\n  owner?: string\n  sortBy?: 'latest' | 'reputation' | 'price_asc' | 'price_desc'\n  page?: number\n  pageSize?: number\n}\n\nexport interface AgentSearchResult {\n  agents: RegisteredAgent[]\n  total: number\n  page: number\n  pageSize: number\n}\n\n// ── Subscription ───────────────────────────────────────────────────────────\n\nexport type SubscriptionStatus = 'active' | 'expired' | 'cancelled' | 'pending'\n\nexport interface AgentSubscription {\n  subscriptionId: number\n  subscriber: string\n  agentId: number\n  status: SubscriptionStatus\n  startedAt: number\n  expiresAt: number\n  period: string\n}\n\n// ── A2A Protocol ───────────────────────────────────────────────────────────\n\nexport type A2ATaskStatus = 'created' | 'accepted' | 'in_progress' | 'completed' | 'failed'\n\nexport interface A2AAgentCard {\n  agentId: number\n  name: string\n  capabilities: string[]\n  supportedTasks: string[]\n  /** MCP endpoint URL for direct agent-to-agent communication */\n  endpoint: string\n  /** Public key for ECDSA authentication */\n  publicKey: string\n}\n\nexport interface A2ATask {\n  taskId: number\n  /** Agent that created the task */\n  creator: string\n  /** Target agent to execute the task */\n  targetAgentId: number\n  /** Task type (must be in target's supportedTasks) */\n  taskType: string\n  /** JSON input payload */\n  input: string\n  status: A2ATaskStatus\n  result?: string\n  createdAt: number\n  completedAt?: number\n}\n\n// ── Reputation ─────────────────────────────────────────────────────────────\n\nexport interface AgentReputation {\n  agentId: number\n  averageRating: number\n  totalRatings: number\n  reviews: AgentReview[]\n}\n\nexport interface AgentReview {\n  reviewer: string\n  rating: number // 1-5\n  comment: string\n  timestamp: number\n}\n\n// ── AgentX Client Configuration ────────────────────────────────────────────\n\nexport interface AgentXConfig {\n  /** Chain ID (e.g. 11155111 for Sepolia) */\n  chainId: number\n  /** RPC endpoint override (uses viem's default if omitted) */\n  rpcUrl?: string\n  /** Contract addresses for the current chain */\n  contracts: AgentXContracts\n  /** IPFS gateway URLs (ordered by priority) */\n  ipfsGateways: string[]\n  /** Default IPFS pinning service */\n  pinningService?: 'pinata'\n  pinataJwt?: string\n}\n\nexport interface AgentXContracts {\n  identityRegistry: `0x${string}`\n  subscriptionManager: `0x${string}`\n  paymentGateway: `0x${string}`\n  a2aProtocolRegistry: `0x${string}`\n  reputationRegistry: `0x${string}`\n  configurationRegistry: `0x${string}`\n}\n\n// ── Agent Packing / Unpacking Result ───────────────────────────────────────\n\nexport interface PackResult {\n  /** CID of AES-256-GCM encrypted payload on IPFS */\n  encryptedCid: string\n  /** CID of public metadata on IPFS */\n  publicCid: string\n  /** Raw AES key (hex) — DO NOT share or upload this */\n  aesKeyHex: string\n  /** ECIES-encrypted AES key (hex), safe to store on-chain */\n  eciesEncryptedKeyHex: string\n}\n\nexport interface UnpackResult {\n  /** Decrypted AgentPayload */\n  agent: AgentPayload\n  /** CID where the encrypted payload was fetched from */\n  encryptedCid: string\n  /** CID of the public metadata */\n  publicCid: string\n}\n\n// ── Error Types ────────────────────────────────────────────────────────────\n\nexport enum AgentXErrorCode {\n  NOT_SUBSCRIBED = 'NOT_SUBSCRIBED',\n  SUBSCRIPTION_EXPIRED = 'SUBSCRIPTION_EXPIRED',\n  DECRYPTION_FAILED = 'DECRYPTION_FAILED',\n  IPFS_FETCH_FAILED = 'IPFS_FETCH_FAILED',\n  AGENT_NOT_FOUND = 'AGENT_NOT_FOUND',\n  INVALID_SCHEMA = 'INVALID_SCHEMA',\n  TX_FAILED = 'TX_FAILED',\n  WALLET_NOT_CONNECTED = 'WALLET_NOT_CONNECTED',\n}\n\nexport class AgentXError extends Error {\n  code: AgentXErrorCode\n  /** If NOT_SUBSCRIBED, carry enough info for wallet/X402 auto-payment */\n  paymentInfo?: SubscriptionRequired\n  constructor(code: AgentXErrorCode, message: string) {\n    super(message)\n    this.code = code\n    this.name = 'AgentXError'\n  }\n}\n\n/**\n * Structured info for wallet/X402 auto-subscription.\n * Thrown by AgentRunner.useAgent() when the user/Agent has no\n * active subscription.\n */\nexport interface SubscriptionRequired {\n  agentId: number\n  /** Plan IDs available for this Agent (on-chain query) */\n  plans?: { planId: number; price: bigint; period: string; payToken: string; trialDays: number }[]\n}\n","// ---------------------------------------------------------------------------\n// @agentx/sdk — Crypto Engine\n// ---------------------------------------------------------------------------\n// AES-256-GCM for content encryption (NIST standard, same wire format as\n// aihunter-saas for interop).  ECIES (secp256k1) for key wrapping.\n//\n// Wire format (AES-256-GCM):\n//   base64( IV[12] || ciphertext || authTag[16] )\n//\n// ECIES wire format (compatible with eciesjs):\n//   hex( ephemeralPub[33] || IV[16] || ciphertext || MAC[32] )\n//\n// Pure JS — works in browser, Node, edge. No native deps except @noble/*.\n// ---------------------------------------------------------------------------\n\nimport { gcm } from '@noble/ciphers/aes.js'\nimport { secp256k1 } from '@noble/curves/secp256k1.js'\nimport { sha256 } from '@noble/hashes/sha2.js'\nimport { hkdf } from '@noble/hashes/hkdf.js'\nimport { hmac } from '@noble/hashes/hmac.js'\nimport { bytesToHex, hexToBytes } from '@noble/ciphers/utils.js'\n\n// ── randomBytes implementation (cross-runtime: browser / Node) ────────────\n\nexport function randomBytes(length: number): Uint8Array {\n  // browser: crypto.getRandomValues\n  if (typeof crypto !== 'undefined' && crypto.getRandomValues) {\n    const buf = new Uint8Array(length)\n    crypto.getRandomValues(buf)\n    return buf\n  }\n  // Node: crypto.randomBytes\n  // eslint-disable-next-line @typescript-eslint/no-require-imports\n  const nodeCrypto = require('crypto')\n  return new Uint8Array(nodeCrypto.randomBytes(length))\n}\n\nimport type { EncryptedPayload, AgentPrivatePayload } from './types'\nimport type { PackResult } from './types'\n\n// ── Re-exports for convenience ─────────────────────────────────────────────\n\nexport { bytesToHex, hexToBytes }\n\n// ── Constants ──────────────────────────────────────────────────────────────\n\nconst AES_KEY_SIZE = 32\nconst IV_SIZE = 12 // GCM recommended\nconst TAG_SIZE = 16 // GCM auth tag\n\n// ── Base64 helpers (cross-runtime) ─────────────────────────────────────────\n\nfunction toBase64(bytes: Uint8Array): string {\n  // Works in browser (btoa + binary) and Node (Buffer)\n  if (typeof Buffer !== 'undefined') return Buffer.from(bytes).toString('base64')\n  let binary = ''\n  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]!)\n  return btoa(binary)\n}\n\nfunction fromBase64(b64: string): Uint8Array {\n  if (typeof Buffer !== 'undefined') return new Uint8Array(Buffer.from(b64, 'base64'))\n  const binary = atob(b64)\n  const bytes = new Uint8Array(binary.length)\n  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i)\n  return bytes\n}\n\n// ── AES-256-GCM ────────────────────────────────────────────────────────────\n\n/**\n * Encrypt with AES-256-GCM.\n * Wire format (same as aihunter-saas): base64( IV[12] || ciphertext || authTag[16] )\n */\nexport function aesEncrypt(plaintext: string, keyHex: string): string {\n  const key = hexToBytes(keyHex)\n  const iv = randomBytes(IV_SIZE)\n  const plainBytes = new TextEncoder().encode(plaintext)\n\n  const cipher = gcm(key, iv)\n  const encrypted = cipher.encrypt(plainBytes)\n  // noble gcm.encrypt returns: ciphertext || authTag(16)\n  const ciphertext = encrypted.subarray(0, -TAG_SIZE)\n  const authTag = encrypted.subarray(-TAG_SIZE)\n\n  // Pack: IV || ciphertext || authTag\n  const combined = new Uint8Array(IV_SIZE + ciphertext.length + TAG_SIZE)\n  combined.set(iv, 0)\n  combined.set(ciphertext, IV_SIZE)\n  combined.set(authTag, IV_SIZE + ciphertext.length)\n\n  return toBase64(combined)\n}\n\n/**\n * Decrypt AES-256-GCM (same wire format as aihunter-saas).\n */\nexport function aesDecrypt(encryptedBase64: string, keyHex: string): string {\n  const key = hexToBytes(keyHex)\n  const combined = fromBase64(encryptedBase64)\n\n  const iv = combined.subarray(0, IV_SIZE)\n  const ciphertext = combined.subarray(IV_SIZE, -TAG_SIZE)\n  const authTag = combined.subarray(-TAG_SIZE)\n\n  const cipher = gcm(key, iv)\n  // noble decrypt expects: ciphertext || authTag\n  const ciphertextWithTag = new Uint8Array(ciphertext.length + TAG_SIZE)\n  ciphertextWithTag.set(ciphertext, 0)\n  ciphertextWithTag.set(authTag, ciphertext.length)\n\n  const decrypted = cipher.decrypt(ciphertextWithTag)\n  return new TextDecoder().decode(decrypted)\n}\n\n/**\n * Generate a cryptographically random AES-256 key (hex, 64 chars).\n */\nexport function generateAesKey(): string {\n  return bytesToHex(randomBytes(AES_KEY_SIZE))\n}\n\n// ── ECIES (secp256k1) ──────────────────────────────────────────────────────\n//\n// eciesjs-compatible wire format:\n//   ephemeralPub(33B compressed) || IV(16B) || ciphertext || MAC(32B)\n//   Encoding: hex\n//\n// HKDF(SHA-256) derives AES key + HMAC key from ECDH shared secret.\n// ---------------------------------------------------------------------------\n\nfunction eciesEncode(\n  ephemeralPub: Uint8Array,\n  iv: Uint8Array,\n  ciphertext: Uint8Array,\n  mac: Uint8Array\n): string {\n  const out = new Uint8Array(33 + 16 + ciphertext.length + 32)\n  out.set(ephemeralPub, 0)\n  out.set(iv, 33)\n  out.set(ciphertext, 33 + 16)\n  out.set(mac, 33 + 16 + ciphertext.length)\n  return bytesToHex(out)\n}\n\nfunction eciesDecode(dataHex: string): {\n  ephemeralPub: Uint8Array\n  iv: Uint8Array\n  ciphertext: Uint8Array\n  mac: Uint8Array\n} {\n  const d = hexToBytes(dataHex)\n  return {\n    ephemeralPub: d.subarray(0, 33),\n    iv: d.subarray(33, 49),\n    ciphertext: d.subarray(49, -32),\n    mac: d.subarray(-32),\n  }\n}\n\n// Simple AES-256-CTR implementation on top of @noble/ciphers AES core\nfunction aesCtrEncrypt(key: Uint8Array, ctrBytes: Uint8Array, data: Uint8Array): Uint8Array {\n  const blockSize = 16\n  const cipher = gcm(key, ctrBytes) // GCM internally handles CTR\n  // Use noble's CTR approach: encrypt the plaintext directly with the derived stream\n  // noble uses AES-CTR internally for GCM; simpler: implement CTR with AES-ECB\n  const result = new Uint8Array(data.length)\n  const counter = new Uint8Array(blockSize)\n  counter.set(ctrBytes)\n  for (let i = 0; i < data.length; i += blockSize) {\n    const keystream = gcm(key, counter).encrypt(new Uint8Array(blockSize))\n    for (let j = 0; j < blockSize && i + j < data.length; j++) {\n      result[i + j] = keystream[j]! ^ data[i + j]!\n    }\n    // Increment counter (big-endian)\n    for (let j = blockSize - 1; j >= 0; j--) {\n      const val = counter[j]\n      if (val !== undefined) {\n        counter[j] = (val + 1) & 0xff\n        if (counter[j] !== 0) break\n      }\n    }\n  }\n  return result\n}\n\n/**\n * Encrypt data with recipient's secp256k1 public key (ECIES).\n *\n * @param dataHex    The data to encrypt (hex, e.g. AES key)\n * @param publicKey  Recipient's public key (hex, 04-prefixed uncompressed or 02/03 compressed)\n */\nexport function eciesEncrypt(dataHex: string, publicKey: string): string {\n  // 1. Ephemeral keypair\n  const ephPriv = randomBytes(32)\n  const ephPub = secp256k1.getPublicKey(ephPriv, true) // 33B compressed\n\n  // 2. Parse recipient public key\n  let recipientPub: Uint8Array\n  if (publicKey.startsWith('04') && publicKey.length === 130) {\n    recipientPub = hexToBytes(publicKey)\n  } else if (publicKey.startsWith('02') || publicKey.startsWith('03')) {\n    recipientPub = hexToBytes(publicKey)\n  } else {\n    throw new Error('Invalid public key format: expected hex with 02/03/04 prefix')\n  }\n\n  // 3. ECDH\n  const shared = secp256k1.getSharedSecret(ephPriv, recipientPub)\n  const sharedX = shared.subarray(1, 33) // x-coordinate only\n  const sharedKey = sha256(sharedX)\n\n  // 4. HKDF: encKey(32) || macKey(32)\n  const hkdfOut = hkdf(sha256, sharedKey, undefined, undefined, 64)\n  const encKey = hkdfOut.subarray(0, 32)\n  const macKey = hkdfOut.subarray(32, 64)\n\n  // 5. AES-256-CTR encrypt\n  const iv = randomBytes(16)\n  const plaintext = hexToBytes(dataHex)\n  const ciphertext = aesCtrEncrypt(encKey, iv, plaintext)\n\n  // 6. HMAC: MAC(ephemeralPub || IV || ciphertext)\n  const macInput = new Uint8Array(33 + 16 + ciphertext.length)\n  macInput.set(ephPub, 0)\n  macInput.set(iv, 33)\n  macInput.set(ciphertext, 33 + 16)\n  const mac = hmac(sha256, macKey, macInput)\n\n  return eciesEncode(ephPub, iv, ciphertext, mac)\n}\n\n/**\n * Decrypt ECIES ciphertext with recipient's secp256k1 private key.\n */\nexport function eciesDecrypt(dataHex: string, privateKey: string): string {\n  const { ephemeralPub, iv, ciphertext, mac } = eciesDecode(dataHex)\n\n  // 1. ECDH\n  const privBytes = hexToBytes(privateKey)\n  const shared = secp256k1.getSharedSecret(privBytes, ephemeralPub)\n  const sharedX = shared.subarray(1, 33)\n  const sharedKey = sha256(sharedX)\n\n  // 2. HKDF\n  const hkdfOut = hkdf(sha256, sharedKey, undefined, undefined, 64)\n  const encKey = hkdfOut.subarray(0, 32)\n  const macKey = hkdfOut.subarray(32, 64)\n\n  // 3. Verify MAC\n  const macInput = new Uint8Array(33 + 16 + ciphertext.length)\n  macInput.set(ephemeralPub, 0)\n  macInput.set(iv, 33)\n  macInput.set(ciphertext, 33 + 16)\n  const expectedMac = hmac(sha256, macKey, macInput)\n  if (!constantTimeEqual(mac, expectedMac)) {\n    throw new Error('ECIES decryption failed: MAC mismatch')\n  }\n\n  // 4. Decrypt\n  const plaintext = aesCtrEncrypt(encKey, iv, ciphertext) // CTR encrypt = decrypt\n  return bytesToHex(plaintext)\n}\n\nfunction constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== b.length) return false\n  let diff = 0\n  for (let i = 0; i < a.length; i++) diff |= a[i]! ^ b[i]!\n  return diff === 0\n}\n\n// ── High-Level: Agent Pack / Unpack ────────────────────────────────────────\n\n/**\n * Encrypt an Agent's private payload with AES-256-GCM.\n */\nexport function encryptPayload(\n  payload: AgentPrivatePayload,\n  keyHex?: string\n): EncryptedPayload {\n  const key = keyHex ?? generateAesKey()\n  return {\n    encrypted: true,\n    algorithm: 'AES-256-GCM',\n    data: aesEncrypt(JSON.stringify(payload), key),\n  }\n}\n\n/**\n * Decrypt an EncryptedPayload.\n */\nexport function decryptPayload(\n  encrypted: EncryptedPayload,\n  keyHex: string\n): AgentPrivatePayload {\n  if (encrypted.algorithm !== 'AES-256-GCM') {\n    throw new Error(`Unsupported algorithm: ${encrypted.algorithm}`)\n  }\n  return JSON.parse(aesDecrypt(encrypted.data, keyHex)) as AgentPrivatePayload\n}\n\n/**\n * Pack an AgentPayload for publishing.\n *   1. Split public/private\n *   2. AES-256-GCM encrypt private part\n *   3. ECIES wrap AES key with creator's public key\n */\nexport function packAgentForPublish(\n  agent: import('./types').AgentPayload,\n  publicKey: string,\n  aesKeyHex?: string\n): PackResult {\n  const key = aesKeyHex ?? generateAesKey()\n\n  const eciesEncryptedKeyHex = eciesEncrypt(key, publicKey)\n\n  return {\n    encryptedCid: '', // filled after IPFS upload\n    publicCid: '',    // filled after IPFS upload\n    aesKeyHex: key,\n    eciesEncryptedKeyHex,\n  }\n}\n\n/**\n * Unpack an Agent:\n *   1. ECIES decrypt the AES key (private key)\n *   2. AES-256-GCM decrypt the payload\n */\nexport function unpackAgent(\n  encryptedPayload: EncryptedPayload,\n  eciesEncryptedKey: string,\n  privateKey: string\n): AgentPrivatePayload {\n  const aesKeyHex = eciesDecrypt(eciesEncryptedKey, privateKey)\n  return decryptPayload(encryptedPayload, aesKeyHex)\n}\n\n// ── Key Pair Utilities ─────────────────────────────────────────────────────\n\n/**\n * Generate a secp256k1 keypair compatible with Ethereum wallets.\n */\nexport function generateKeyPair(): { privateKey: string; publicKey: string } {\n  const priv = randomBytes(32)\n  const pub = secp256k1.getPublicKey(priv, false) // uncompressed 04-prefixed\n  return { privateKey: bytesToHex(priv), publicKey: bytesToHex(pub) }\n}\n\n/**\n * Derive public key from private key (hex).\n */\nexport function getPublicKey(privateKey: string): string {\n  return bytesToHex(secp256k1.getPublicKey(hexToBytes(privateKey), false))\n}\n"],"mappings":";;;;;;;;AAmVO,IAAK,kBAAL,kBAAKA,qBAAL;AACL,EAAAA,iBAAA,oBAAiB;AACjB,EAAAA,iBAAA,0BAAuB;AACvB,EAAAA,iBAAA,uBAAoB;AACpB,EAAAA,iBAAA,uBAAoB;AACpB,EAAAA,iBAAA,qBAAkB;AAClB,EAAAA,iBAAA,oBAAiB;AACjB,EAAAA,iBAAA,eAAY;AACZ,EAAAA,iBAAA,0BAAuB;AARb,SAAAA;AAAA,GAAA;AAWL,IAAM,cAAN,cAA0B,MAAM;AAAA,EACrC;AAAA;AAAA,EAEA;AAAA,EACA,YAAY,MAAuB,SAAiB;AAClD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;;;ACxVA,SAAS,WAAW;AACpB,SAAS,iBAAiB;AAC1B,SAAS,cAAc;AACvB,SAAS,YAAY;AACrB,SAAS,YAAY;AACrB,SAAS,YAAY,kBAAkB;AAIhC,SAAS,YAAY,QAA4B;AAEtD,MAAI,OAAO,WAAW,eAAe,OAAO,iBAAiB;AAC3D,UAAM,MAAM,IAAI,WAAW,MAAM;AACjC,WAAO,gBAAgB,GAAG;AAC1B,WAAO;AAAA,EACT;AAGA,QAAM,aAAa,UAAQ,QAAQ;AACnC,SAAO,IAAI,WAAW,WAAW,YAAY,MAAM,CAAC;AACtD;AAWA,IAAM,eAAe;AACrB,IAAM,UAAU;AAChB,IAAM,WAAW;AAIjB,SAAS,SAAS,OAA2B;AAE3C,MAAI,OAAO,WAAW,YAAa,QAAO,OAAO,KAAK,KAAK,EAAE,SAAS,QAAQ;AAC9E,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,WAAU,OAAO,aAAa,MAAM,CAAC,CAAE;AAC9E,SAAO,KAAK,MAAM;AACpB;AAEA,SAAS,WAAW,KAAyB;AAC3C,MAAI,OAAO,WAAW,YAAa,QAAO,IAAI,WAAW,OAAO,KAAK,KAAK,QAAQ,CAAC;AACnF,QAAM,SAAS,KAAK,GAAG;AACvB,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,IAAK,OAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AACtE,SAAO;AACT;AAQO,SAAS,WAAW,WAAmB,QAAwB;AACpE,QAAM,MAAM,WAAW,MAAM;AAC7B,QAAM,KAAK,YAAY,OAAO;AAC9B,QAAM,aAAa,IAAI,YAAY,EAAE,OAAO,SAAS;AAErD,QAAM,SAAS,IAAI,KAAK,EAAE;AAC1B,QAAM,YAAY,OAAO,QAAQ,UAAU;AAE3C,QAAM,aAAa,UAAU,SAAS,GAAG,CAAC,QAAQ;AAClD,QAAM,UAAU,UAAU,SAAS,CAAC,QAAQ;AAG5C,QAAM,WAAW,IAAI,WAAW,UAAU,WAAW,SAAS,QAAQ;AACtE,WAAS,IAAI,IAAI,CAAC;AAClB,WAAS,IAAI,YAAY,OAAO;AAChC,WAAS,IAAI,SAAS,UAAU,WAAW,MAAM;AAEjD,SAAO,SAAS,QAAQ;AAC1B;AAKO,SAAS,WAAW,iBAAyB,QAAwB;AAC1E,QAAM,MAAM,WAAW,MAAM;AAC7B,QAAM,WAAW,WAAW,eAAe;AAE3C,QAAM,KAAK,SAAS,SAAS,GAAG,OAAO;AACvC,QAAM,aAAa,SAAS,SAAS,SAAS,CAAC,QAAQ;AACvD,QAAM,UAAU,SAAS,SAAS,CAAC,QAAQ;AAE3C,QAAM,SAAS,IAAI,KAAK,EAAE;AAE1B,QAAM,oBAAoB,IAAI,WAAW,WAAW,SAAS,QAAQ;AACrE,oBAAkB,IAAI,YAAY,CAAC;AACnC,oBAAkB,IAAI,SAAS,WAAW,MAAM;AAEhD,QAAM,YAAY,OAAO,QAAQ,iBAAiB;AAClD,SAAO,IAAI,YAAY,EAAE,OAAO,SAAS;AAC3C;AAKO,SAAS,iBAAyB;AACvC,SAAO,WAAW,YAAY,YAAY,CAAC;AAC7C;AAWA,SAAS,YACP,cACA,IACA,YACA,KACQ;AACR,QAAM,MAAM,IAAI,WAAW,KAAK,KAAK,WAAW,SAAS,EAAE;AAC3D,MAAI,IAAI,cAAc,CAAC;AACvB,MAAI,IAAI,IAAI,EAAE;AACd,MAAI,IAAI,YAAY,KAAK,EAAE;AAC3B,MAAI,IAAI,KAAK,KAAK,KAAK,WAAW,MAAM;AACxC,SAAO,WAAW,GAAG;AACvB;AAEA,SAAS,YAAY,SAKnB;AACA,QAAM,IAAI,WAAW,OAAO;AAC5B,SAAO;AAAA,IACL,cAAc,EAAE,SAAS,GAAG,EAAE;AAAA,IAC9B,IAAI,EAAE,SAAS,IAAI,EAAE;AAAA,IACrB,YAAY,EAAE,SAAS,IAAI,GAAG;AAAA,IAC9B,KAAK,EAAE,SAAS,GAAG;AAAA,EACrB;AACF;AAGA,SAAS,cAAc,KAAiB,UAAsB,MAA8B;AAC1F,QAAM,YAAY;AAClB,QAAM,SAAS,IAAI,KAAK,QAAQ;AAGhC,QAAM,SAAS,IAAI,WAAW,KAAK,MAAM;AACzC,QAAM,UAAU,IAAI,WAAW,SAAS;AACxC,UAAQ,IAAI,QAAQ;AACpB,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,WAAW;AAC/C,UAAM,YAAY,IAAI,KAAK,OAAO,EAAE,QAAQ,IAAI,WAAW,SAAS,CAAC;AACrE,aAAS,IAAI,GAAG,IAAI,aAAa,IAAI,IAAI,KAAK,QAAQ,KAAK;AACzD,aAAO,IAAI,CAAC,IAAI,UAAU,CAAC,IAAK,KAAK,IAAI,CAAC;AAAA,IAC5C;AAEA,aAAS,IAAI,YAAY,GAAG,KAAK,GAAG,KAAK;AACvC,YAAM,MAAM,QAAQ,CAAC;AACrB,UAAI,QAAQ,QAAW;AACrB,gBAAQ,CAAC,IAAK,MAAM,IAAK;AACzB,YAAI,QAAQ,CAAC,MAAM,EAAG;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAQO,SAAS,aAAa,SAAiB,WAA2B;AAEvE,QAAM,UAAU,YAAY,EAAE;AAC9B,QAAM,SAAS,UAAU,aAAa,SAAS,IAAI;AAGnD,MAAI;AACJ,MAAI,UAAU,WAAW,IAAI,KAAK,UAAU,WAAW,KAAK;AAC1D,mBAAe,WAAW,SAAS;AAAA,EACrC,WAAW,UAAU,WAAW,IAAI,KAAK,UAAU,WAAW,IAAI,GAAG;AACnE,mBAAe,WAAW,SAAS;AAAA,EACrC,OAAO;AACL,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AAGA,QAAM,SAAS,UAAU,gBAAgB,SAAS,YAAY;AAC9D,QAAM,UAAU,OAAO,SAAS,GAAG,EAAE;AACrC,QAAM,YAAY,OAAO,OAAO;AAGhC,QAAM,UAAU,KAAK,QAAQ,WAAW,QAAW,QAAW,EAAE;AAChE,QAAM,SAAS,QAAQ,SAAS,GAAG,EAAE;AACrC,QAAM,SAAS,QAAQ,SAAS,IAAI,EAAE;AAGtC,QAAM,KAAK,YAAY,EAAE;AACzB,QAAM,YAAY,WAAW,OAAO;AACpC,QAAM,aAAa,cAAc,QAAQ,IAAI,SAAS;AAGtD,QAAM,WAAW,IAAI,WAAW,KAAK,KAAK,WAAW,MAAM;AAC3D,WAAS,IAAI,QAAQ,CAAC;AACtB,WAAS,IAAI,IAAI,EAAE;AACnB,WAAS,IAAI,YAAY,KAAK,EAAE;AAChC,QAAM,MAAM,KAAK,QAAQ,QAAQ,QAAQ;AAEzC,SAAO,YAAY,QAAQ,IAAI,YAAY,GAAG;AAChD;AAKO,SAAS,aAAa,SAAiB,YAA4B;AACxE,QAAM,EAAE,cAAc,IAAI,YAAY,IAAI,IAAI,YAAY,OAAO;AAGjE,QAAM,YAAY,WAAW,UAAU;AACvC,QAAM,SAAS,UAAU,gBAAgB,WAAW,YAAY;AAChE,QAAM,UAAU,OAAO,SAAS,GAAG,EAAE;AACrC,QAAM,YAAY,OAAO,OAAO;AAGhC,QAAM,UAAU,KAAK,QAAQ,WAAW,QAAW,QAAW,EAAE;AAChE,QAAM,SAAS,QAAQ,SAAS,GAAG,EAAE;AACrC,QAAM,SAAS,QAAQ,SAAS,IAAI,EAAE;AAGtC,QAAM,WAAW,IAAI,WAAW,KAAK,KAAK,WAAW,MAAM;AAC3D,WAAS,IAAI,cAAc,CAAC;AAC5B,WAAS,IAAI,IAAI,EAAE;AACnB,WAAS,IAAI,YAAY,KAAK,EAAE;AAChC,QAAM,cAAc,KAAK,QAAQ,QAAQ,QAAQ;AACjD,MAAI,CAAC,kBAAkB,KAAK,WAAW,GAAG;AACxC,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAGA,QAAM,YAAY,cAAc,QAAQ,IAAI,UAAU;AACtD,SAAO,WAAW,SAAS;AAC7B;AAEA,SAAS,kBAAkB,GAAe,GAAwB;AAChE,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,CAAC,IAAK,EAAE,CAAC;AACtD,SAAO,SAAS;AAClB;AAOO,SAAS,eACd,SACA,QACkB;AAClB,QAAM,MAAM,UAAU,eAAe;AACrC,SAAO;AAAA,IACL,WAAW;AAAA,IACX,WAAW;AAAA,IACX,MAAM,WAAW,KAAK,UAAU,OAAO,GAAG,GAAG;AAAA,EAC/C;AACF;AAKO,SAAS,eACd,WACA,QACqB;AACrB,MAAI,UAAU,cAAc,eAAe;AACzC,UAAM,IAAI,MAAM,0BAA0B,UAAU,SAAS,EAAE;AAAA,EACjE;AACA,SAAO,KAAK,MAAM,WAAW,UAAU,MAAM,MAAM,CAAC;AACtD;AAQO,SAAS,oBACd,OACA,WACA,WACY;AACZ,QAAM,MAAM,aAAa,eAAe;AAExC,QAAM,uBAAuB,aAAa,KAAK,SAAS;AAExD,SAAO;AAAA,IACL,cAAc;AAAA;AAAA,IACd,WAAW;AAAA;AAAA,IACX,WAAW;AAAA,IACX;AAAA,EACF;AACF;AAOO,SAAS,YACd,kBACA,mBACA,YACqB;AACrB,QAAM,YAAY,aAAa,mBAAmB,UAAU;AAC5D,SAAO,eAAe,kBAAkB,SAAS;AACnD;AAOO,SAAS,kBAA6D;AAC3E,QAAM,OAAO,YAAY,EAAE;AAC3B,QAAM,MAAM,UAAU,aAAa,MAAM,KAAK;AAC9C,SAAO,EAAE,YAAY,WAAW,IAAI,GAAG,WAAW,WAAW,GAAG,EAAE;AACpE;AAKO,SAAS,aAAa,YAA4B;AACvD,SAAO,WAAW,UAAU,aAAa,WAAW,UAAU,GAAG,KAAK,CAAC;AACzE;","names":["AgentXErrorCode"]}

package/dist/{agent/agent-runner.d.ts → index-DhXVi_ub.d.ts}

@@ -1,7 +1,46 @@
-import { IPFSFetcher } from '../registry/ipfs-fetcher';
-import type { AgentPayload, PackResult } from '../core/types';
+import { E as EncryptedPayload, g as AgentPayload, P as PackResult } from './types-2aHUvS4M.js';
+import { Address, PublicClient, WalletClient, Hash } from 'viem';
+
+interface IPFSFetcherConfig {
+    /** Primary IPFS gateway (default: ipfs.io) */
+    gateway?: string;
+    /** Fallback gateways in order of preference */
+    fallbackGateways?: string[];
+    /** Request timeout in ms (default: 10_000) */
+    timeoutMs?: number;
+    /** Max cached entries (LRU-like eviction, default: 200) */
+    maxCache?: number;
+}
+declare class IPFSFetcher {
+    private gateway;
+    private fallbackGateways;
+    private timeoutMs;
+    private cache;
+    private maxCache;
+    private pending;
+    private failed;
+    constructor(config?: IPFSFetcherConfig);
+    /** Fetch JSON from a single IPFS CID. */
+    fetchJSON<T = unknown>(cid: string): Promise<T>;
+    /** Fetch encrypted agent payload (validates algorithm). */
+    fetchEncryptedPayload(cid: string): Promise<EncryptedPayload>;
+    /** Batch fetch multiple CIDs with concurrency control. */
+    fetchBatch<T = unknown>(cids: string[], concurrency?: number): Promise<Map<string, T>>;
+    /** Check if a string looks like a valid IPFS CID. */
+    isValidCID(cid: string): boolean;
+    /** Clear cache (optionally for a specific CID). */
+    clearCache(cid?: string): void;
+    /** Number of cached entries. */
+    get cacheSize(): number;
+    private _doFetch;
+    private _fetchFrom;
+    private _cacheSet;
+}
+/** Singleton-friendly default instance. */
+declare const defaultIPFSFetcher: IPFSFetcher;
+
 /** Minimal on-chain reader interface — implement with viem. */
-export interface OnChainReader {
+interface OnChainReader {
     /** Read tokenURI from IdentityRegistry by tokenId. */
     getTokenURI(agentId: number): Promise<string>;
     /** Get agent metadata attributes (returned as key-value pairs). */
@@ -10,7 +49,7 @@ export interface OnChainReader {
     hasActiveSubscription(address: string, agentId: number): Promise<boolean>;
 }
 /** Minimal wallet signer interface — implement with wagmi/viem. */
-export interface WalletSigner {
+interface WalletSigner {
     /** Sign a message (for authentication to MCP servers). */
     signMessage(message: string): Promise<string>;
     /** Get the current wallet address. */
@@ -18,7 +57,7 @@ export interface WalletSigner {
     /** Get the wallet's ECDSA private key (required for ECIES decryption). */
     getPrivateKey?(): Promise<string>;
 }
-export interface AgentRunnerConfig {
+interface AgentRunnerConfig {
     /** On-chain data reader (injected from viem/wagmi). */
     reader: OnChainReader;
     /** Wallet signer (injected from wagmi). */
@@ -28,7 +67,7 @@ export interface AgentRunnerConfig {
     /** IPFS gateway list (overrides IPFSFetcher defaults). */
     ipfsGateways?: string[];
 }
-export interface AgentRunContext {
+interface AgentRunContext {
     /** Agent NFT token ID */
     agentId: number;
     /** System prompt — inject into LLM conversation */
@@ -44,7 +83,7 @@ export interface AgentRunContext {
     /** Subscription expiry timestamp (0 = unknown) */
     subscriptionExpiry: number;
 }
-export interface RunnableSkill {
+interface RunnableSkill {
     name: string;
     description: string;
     inputSchema: Record<string, unknown>;
@@ -66,7 +105,7 @@ export interface RunnableSkill {
  * The calling LLM receives the sub-Agent's prompt and skills
  * and can inject them into the conversation.
  */
-export interface A2ASkillResult {
+interface A2ASkillResult {
     /** On-chain Agent ID that was delegated to */
     agentId: number;
     /** Sub-Agent's decrypted system prompt */
@@ -80,7 +119,7 @@ export interface A2ASkillResult {
     /** The original input passed by the caller */
     callerInput: Record<string, unknown>;
 }
-export declare class AgentRunner {
+declare class AgentRunner {
     private reader;
     private wallet;
     private ipfs;
@@ -121,4 +160,49 @@ export declare class AgentRunner {
     private _executeA2ASkill;
     private _getPrivateKey;
 }
-//# sourceMappingURL=agent-runner.d.ts.map
+
+interface ChainConfig {
+    chainId: number;
+    contracts: {
+        identityRegistry: Address;
+        subscriptionManager: Address;
+        paymentGateway: Address;
+        a2aProtocolRegistry: Address;
+        reputationRegistry: Address;
+        configurationRegistry: Address;
+    };
+    ipfsGateways: string[];
+    rpcUrl?: string;
+}
+declare const KNOWN_CHAINS: Record<number, ChainConfig>;
+interface ConfigRegistryOpts {
+    contractAddress: Address;
+    publicClient: PublicClient;
+    walletClient: WalletClient;
+}
+declare class ConfigurationRegistry {
+    private address;
+    private publicClient;
+    private walletClient;
+    constructor(opts: ConfigRegistryOpts);
+    private get account();
+    set(key: string, value: string): Promise<Hash>;
+    get(key: string): Promise<string>;
+    getAll(): Promise<Record<string, string>>;
+}
+
+interface UseAgentRunnerConfig {
+    agentId: number;
+    chainConfig?: ChainConfig;
+    ipfsGateways?: string[];
+}
+interface UseAgentRunnerResult {
+    ctx: AgentRunContext | null;
+    isLoading: boolean;
+    error: Error | null;
+    /** Re-trigger the load (e.g. after connecting wallet or subscribing) */
+    refetch: () => void;
+}
+declare function useAgentRunner(config: UseAgentRunnerConfig): UseAgentRunnerResult;
+
+export { type A2ASkillResult as A, type ChainConfig as C, IPFSFetcher as I, KNOWN_CHAINS as K, type OnChainReader as O, type RunnableSkill as R, type UseAgentRunnerConfig as U, type WalletSigner as W, type AgentRunContext as a, AgentRunner as b, type AgentRunnerConfig as c, type ConfigRegistryOpts as d, ConfigurationRegistry as e, type IPFSFetcherConfig as f, type UseAgentRunnerResult as g, defaultIPFSFetcher as h, useAgentRunner as u };

package/dist/index-eQO4iaOr.d.mts

@@ -0,0 +1,208 @@
+import { E as EncryptedPayload, g as AgentPayload, P as PackResult } from './types-2aHUvS4M.mjs';
+import { Address, PublicClient, WalletClient, Hash } from 'viem';
+
+interface IPFSFetcherConfig {
+    /** Primary IPFS gateway (default: ipfs.io) */
+    gateway?: string;
+    /** Fallback gateways in order of preference */
+    fallbackGateways?: string[];
+    /** Request timeout in ms (default: 10_000) */
+    timeoutMs?: number;
+    /** Max cached entries (LRU-like eviction, default: 200) */
+    maxCache?: number;
+}
+declare class IPFSFetcher {
+    private gateway;
+    private fallbackGateways;
+    private timeoutMs;
+    private cache;
+    private maxCache;
+    private pending;
+    private failed;
+    constructor(config?: IPFSFetcherConfig);
+    /** Fetch JSON from a single IPFS CID. */
+    fetchJSON<T = unknown>(cid: string): Promise<T>;
+    /** Fetch encrypted agent payload (validates algorithm). */
+    fetchEncryptedPayload(cid: string): Promise<EncryptedPayload>;
+    /** Batch fetch multiple CIDs with concurrency control. */
+    fetchBatch<T = unknown>(cids: string[], concurrency?: number): Promise<Map<string, T>>;
+    /** Check if a string looks like a valid IPFS CID. */
+    isValidCID(cid: string): boolean;
+    /** Clear cache (optionally for a specific CID). */
+    clearCache(cid?: string): void;
+    /** Number of cached entries. */
+    get cacheSize(): number;
+    private _doFetch;
+    private _fetchFrom;
+    private _cacheSet;
+}
+/** Singleton-friendly default instance. */
+declare const defaultIPFSFetcher: IPFSFetcher;
+
+/** Minimal on-chain reader interface — implement with viem. */
+interface OnChainReader {
+    /** Read tokenURI from IdentityRegistry by tokenId. */
+    getTokenURI(agentId: number): Promise<string>;
+    /** Get agent metadata attributes (returned as key-value pairs). */
+    getAttributes(agentId: number): Promise<Record<string, string>>;
+    /** Check if `address` has an active subscription for `agentId`. */
+    hasActiveSubscription(address: string, agentId: number): Promise<boolean>;
+}
+/** Minimal wallet signer interface — implement with wagmi/viem. */
+interface WalletSigner {
+    /** Sign a message (for authentication to MCP servers). */
+    signMessage(message: string): Promise<string>;
+    /** Get the current wallet address. */
+    getAddress(): Promise<string>;
+    /** Get the wallet's ECDSA private key (required for ECIES decryption). */
+    getPrivateKey?(): Promise<string>;
+}
+interface AgentRunnerConfig {
+    /** On-chain data reader (injected from viem/wagmi). */
+    reader: OnChainReader;
+    /** Wallet signer (injected from wagmi). */
+    wallet: WalletSigner;
+    /** IPFS fetcher instance (creates default if omitted). */
+    ipfsFetcher?: IPFSFetcher;
+    /** IPFS gateway list (overrides IPFSFetcher defaults). */
+    ipfsGateways?: string[];
+}
+interface AgentRunContext {
+    /** Agent NFT token ID */
+    agentId: number;
+    /** System prompt — inject into LLM conversation */
+    prompt: string;
+    /** All skills with execution metadata */
+    skills: RunnableSkill[];
+    /** MCP connection info */
+    mcp: {
+        type: string;
+        url?: string;
+        toolFilter?: string[];
+    };
+    /** Subscription expiry timestamp (0 = unknown) */
+    subscriptionExpiry: number;
+}
+interface RunnableSkill {
+    name: string;
+    description: string;
+    inputSchema: Record<string, unknown>;
+    outputSchema?: Record<string, unknown>;
+    /** Execution mode */
+    mode: 'open' | 'mcp' | 'a2a';
+    /** If mode='a2a', the on-chain Agent ID being delegated to */
+    a2aTargetAgentId?: number;
+    /**
+     * Execute this skill with the given input.
+     * - Open: runs locally (caller provides implementation)
+     * - MCP: POSTs to the publisher's MCP server
+     * - A2A: loads target Agent context (prompt+skills) via AgentRunner
+     */
+    execute(input: Record<string, unknown>): Promise<unknown>;
+}
+/**
+ * Standard return type for A2A skill execution.
+ * The calling LLM receives the sub-Agent's prompt and skills
+ * and can inject them into the conversation.
+ */
+interface A2ASkillResult {
+    /** On-chain Agent ID that was delegated to */
+    agentId: number;
+    /** Sub-Agent's decrypted system prompt */
+    prompt: string;
+    /** Sub-Agent's skills (name + description + schema only, no execute) */
+    skills: {
+        name: string;
+        description: string;
+        inputSchema: Record<string, unknown>;
+    }[];
+    /** The original input passed by the caller */
+    callerInput: Record<string, unknown>;
+}
+declare class AgentRunner {
+    private reader;
+    private wallet;
+    private ipfs;
+    constructor(config: AgentRunnerConfig);
+    /**
+     * Load and decrypt an Agent, returning a run context ready to inject
+     * into any LLM conversation.
+     *
+     * Steps:
+     *   1. Verify on-chain subscription (frontend check)
+     *   2. Fetch metadata → get encryptedPayloadCid + eciesEncryptedKey
+     *   3. IPFS fetch encrypted payload
+     *   4. ECIES decrypt AES key (using wallet private key)
+     *   5. AES-256-GCM decrypt payload → { prompt, skills, mcp }
+     *   6. Build RunnableSkill wrappers (Open: local stub, Closed: MCP remote)
+     */
+    useAgent(agentId: number): Promise<AgentRunContext>;
+    /**
+     * Pack an AgentPayload for publishing (encryption only, no IPFS upload).
+     * Caller is responsible for IPFS upload and on-chain registration.
+     */
+    packForPublish(payload: AgentPayload, publicKey: string): PackResult;
+    /** Wrap a SkillDef into a RunnableSkill with execute(). */
+    private _wrapSkill;
+    /** Call a tool on the publisher's MCP server (Closed skill). */
+    private _executeMCPTool;
+    /**
+     * Execute an A2A skill — delegate to another AgentX Agent.
+     *
+     * Standard Interface:
+     *   Input:  { task, ...taskSpecificParams }
+     *   Output: { agentId, prompt, skills[] }
+     *
+     * The caller (LLM) receives the sub-Agent's prompt + skill list.
+     * The LLM then decides how to use the sub-Agent — typically by
+     * injecting the sub-Agent's system prompt and calling its skills.
+     */
+    private _executeA2ASkill;
+    private _getPrivateKey;
+}
+
+interface ChainConfig {
+    chainId: number;
+    contracts: {
+        identityRegistry: Address;
+        subscriptionManager: Address;
+        paymentGateway: Address;
+        a2aProtocolRegistry: Address;
+        reputationRegistry: Address;
+        configurationRegistry: Address;
+    };
+    ipfsGateways: string[];
+    rpcUrl?: string;
+}
+declare const KNOWN_CHAINS: Record<number, ChainConfig>;
+interface ConfigRegistryOpts {
+    contractAddress: Address;
+    publicClient: PublicClient;
+    walletClient: WalletClient;
+}
+declare class ConfigurationRegistry {
+    private address;
+    private publicClient;
+    private walletClient;
+    constructor(opts: ConfigRegistryOpts);
+    private get account();
+    set(key: string, value: string): Promise<Hash>;
+    get(key: string): Promise<string>;
+    getAll(): Promise<Record<string, string>>;
+}
+
+interface UseAgentRunnerConfig {
+    agentId: number;
+    chainConfig?: ChainConfig;
+    ipfsGateways?: string[];
+}
+interface UseAgentRunnerResult {
+    ctx: AgentRunContext | null;
+    isLoading: boolean;
+    error: Error | null;
+    /** Re-trigger the load (e.g. after connecting wallet or subscribing) */
+    refetch: () => void;
+}
+declare function useAgentRunner(config: UseAgentRunnerConfig): UseAgentRunnerResult;
+
+export { type A2ASkillResult as A, type ChainConfig as C, IPFSFetcher as I, KNOWN_CHAINS as K, type OnChainReader as O, type RunnableSkill as R, type UseAgentRunnerConfig as U, type WalletSigner as W, type AgentRunContext as a, AgentRunner as b, type AgentRunnerConfig as c, type ConfigRegistryOpts as d, ConfigurationRegistry as e, type IPFSFetcherConfig as f, type UseAgentRunnerResult as g, defaultIPFSFetcher as h, useAgentRunner as u };