@ajna-inc/vaults 0.1.0 → 0.1.2

package/build/VaultsApi.js

@@ -1,81 +1,26 @@
 "use strict";
-var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
-    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
-    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
-    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
-    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
-    var _, done = false;
-    for (var i = decorators.length - 1; i >= 0; i--) {
-        var context = {};
-        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
-        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
-        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
-        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
-        if (kind === "accessor") {
-            if (result === void 0) continue;
-            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
-            if (_ = accept(result.get)) descriptor.get = _;
-            if (_ = accept(result.set)) descriptor.set = _;
-            if (_ = accept(result.init)) initializers.unshift(_);
-        }
-        else if (_ = accept(result)) {
-            if (kind === "field") initializers.unshift(_);
-            else descriptor[key] = _;
-        }
-    }
-    if (target) Object.defineProperty(target, contextIn.name, descriptor);
-    done = true;
-};
-var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
-    var useValue = arguments.length > 2;
-    for (var i = 0; i < initializers.length; i++) {
-        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
-    }
-    return useValue ? value : void 0;
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-var __generator = (this && this.__generator) || function (thisArg, body) {
-    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
-    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
-    function verb(n) { return function (v) { return step([n, v]); }; }
-    function step(op) {
-        if (f) throw new TypeError("Generator is already executing.");
-        while (g && (g = 0, op[0] && (_ = 0)), _) try {
-            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
-            if (y = 0, t) op = [op[0] & 2, t.value];
-            switch (op[0]) {
-                case 0: case 1: t = op; break;
-                case 4: _.label++; return { value: op[1], done: false };
-                case 5: _.label++; y = op[1]; op = [0]; continue;
-                case 7: op = _.ops.pop(); _.trys.pop(); continue;
-                default:
-                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
-                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
-                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
-                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
-                    if (t[2]) _.ops.pop();
-                    _.trys.pop(); continue;
-            }
-            op = body.call(thisArg, _);
-        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
-        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
-    }
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __setFunctionName = (this && this.__setFunctionName) || function (f, name, prefix) {
-    if (typeof name === "symbol") name = name.description ? "[".concat(name.description, "]") : "";
-    return Object.defineProperty(f, "name", { configurable: true, value: prefix ? "".concat(prefix, " ", name) : name });
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VaultsApi = void 0;
-var core_1 = require("@credo-ts/core");
+const core_1 = require("@credo-ts/core");
+const VaultService_1 = require("./services/VaultService");
+const KemKeyExchangeService_1 = require("./services/KemKeyExchangeService");
+const VaultSigningService_1 = require("./services/VaultSigningService");
+const VaultStorageService_1 = require("./storage/VaultStorageService");
+const VaultRepository_1 = require("./repository/VaultRepository");
+const ThresholdSessionRepository_1 = require("./repository/ThresholdSessionRepository");
+const handlers_1 = require("./handlers");
 /**
  * Vaults API
  *
@@ -84,180 +29,437 @@ var core_1 = require("@credo-ts/core");
  *
  * All encryption and decryption happens client-side.
  */
-var VaultsApi = function () {
-    var _classDecorators = [(0, core_1.injectable)()];
-    var _classDescriptor;
-    var _classExtraInitializers = [];
-    var _classThis;
-    var VaultsApi = _classThis = /** @class */ (function () {
-        function VaultsApi_1(agentContext, vaultService) {
-            this.vaultService = vaultService;
-            this.agentContext = agentContext;
-        }
-        /**
-         * Create a new encrypted vault
-         *
-         * @param data - Raw data to encrypt (e.g., PDF bytes)
-         * @param options - Creation options including passphrase
-         * @returns Created vault identifiers
-         *
-         * @example
-         * ```typescript
-         * const pdfBytes = await fs.readFile('contract.pdf')
-         * const { vaultId } = await agent.modules.vaults.create(pdfBytes, {
-         *   passphrase: 'my-secure-passphrase',
-         *   metadata: { description: 'Employment Contract' }
-         * })
-         * ```
-         */
-        VaultsApi_1.prototype.create = function (data, options) {
-            return __awaiter(this, void 0, void 0, function () {
-                return __generator(this, function (_a) {
-                    return [2 /*return*/, this.vaultService.createVault(this.agentContext, data, options)];
-                });
-            });
-        };
-        /**
-         * Open (decrypt) a vault
-         *
-         * @param vaultId - Vault identifier
-         * @param options - Open options including passphrase
-         * @returns Decrypted data
-         *
-         * @example
-         * ```typescript
-         * const decrypted = await agent.modules.vaults.open(vaultId, {
-         *   passphrase: 'my-secure-passphrase'
-         * })
-         * await fs.writeFile('contract-decrypted.pdf', decrypted)
-         * ```
-         */
-        VaultsApi_1.prototype.open = function (vaultId, options) {
-            return __awaiter(this, void 0, void 0, function () {
-                return __generator(this, function (_a) {
-                    return [2 /*return*/, this.vaultService.openVault(this.agentContext, vaultId, options)];
-                });
-            });
-        };
-        /**
-         * Update vault with new data
-         *
-         * @param vaultId - Vault identifier
-         * @param data - New data to encrypt
-         * @param options - Update options including passphrase
-         *
-         * @example
-         * ```typescript
-         * const newPdfBytes = await fs.readFile('contract-v2.pdf')
-         * await agent.modules.vaults.update(vaultId, newPdfBytes, {
-         *   passphrase: 'my-secure-passphrase'
-         * })
-         * ```
-         */
-        VaultsApi_1.prototype.update = function (vaultId, data, options) {
-            return __awaiter(this, void 0, void 0, function () {
-                return __generator(this, function (_a) {
-                    return [2 /*return*/, this.vaultService.updateVault(this.agentContext, vaultId, data, options)];
-                });
-            });
-        };
-        /**
-         * Delete a vault
-         *
-         * @param vaultId - Vault identifier
-         *
-         * @example
-         * ```typescript
-         * await agent.modules.vaults.delete(vaultId)
-         * ```
-         */
-        VaultsApi_1.prototype.delete = function (vaultId) {
-            return __awaiter(this, void 0, void 0, function () {
-                return __generator(this, function (_a) {
-                    return [2 /*return*/, this.vaultService.deleteVault(this.agentContext, vaultId)];
-                });
-            });
-        };
-        /**
-         * List all vaults
-         *
-         * @returns Array of vault records
-         *
-         * @example
-         * ```typescript
-         * const vaults = await agent.modules.vaults.list()
-         * console.log(`Total vaults: ${vaults.length}`)
-         * ```
-         */
-        VaultsApi_1.prototype.list = function () {
-            return __awaiter(this, void 0, void 0, function () {
-                return __generator(this, function (_a) {
-                    return [2 /*return*/, this.vaultService.listVaults(this.agentContext)];
-                });
-            });
-        };
-        /**
-         * Get vault info (metadata without decrypting)
-         *
-         * @param vaultId - Vault identifier
-         * @returns Vault information
-         *
-         * @example
-         * ```typescript
-         * const info = await agent.modules.vaults.getInfo(vaultId)
-         * console.log(`Vault: ${info.vaultId}, Epoch: ${info.header.epoch}`)
-         * ```
-         */
-        VaultsApi_1.prototype.getInfo = function (vaultId) {
-            return __awaiter(this, void 0, void 0, function () {
-                return __generator(this, function (_a) {
-                    return [2 /*return*/, this.vaultService.getVaultInfo(this.agentContext, vaultId)];
-                });
-            });
-        };
-        /**
-         * Check if a vault exists
-         *
-         * @param vaultId - Vault identifier
-         * @returns True if vault exists
-         *
-         * @example
-         * ```typescript
-         * if (await agent.modules.vaults.exists(vaultId)) {
-         *   console.log('Vault found!')
-         * }
-         * ```
-         */
-        VaultsApi_1.prototype.exists = function (vaultId) {
-            return __awaiter(this, void 0, void 0, function () {
-                return __generator(this, function (_a) {
-                    return [2 /*return*/, this.vaultService.vaultExists(this.agentContext, vaultId)];
-                });
-            });
-        };
-        /**
-         * Get the raw vault record (for advanced operations)
-         *
-         * @param vaultId - Vault identifier
-         * @returns Vault record or null
-         */
-        VaultsApi_1.prototype.getRecord = function (vaultId) {
-            return __awaiter(this, void 0, void 0, function () {
-                return __generator(this, function (_a) {
-                    return [2 /*return*/, this.vaultService.getVaultRecord(this.agentContext, vaultId)];
-                });
-            });
-        };
-        return VaultsApi_1;
-    }());
-    __setFunctionName(_classThis, "VaultsApi");
-    (function () {
-        var _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
-        __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
-        VaultsApi = _classThis = _classDescriptor.value;
-        if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
-        __runInitializers(_classThis, _classExtraInitializers);
-    })();
-    return VaultsApi = _classThis;
-}();
+let VaultsApi = class VaultsApi {
+    constructor(agentContext, messageHandlerRegistry, eventEmitter, logger, vaultService, kemKeyExchangeService, vaultSigningService, storageService, vaultRepository, thresholdSessionRepository) {
+        this.vaultService = vaultService;
+        this.agentContext = agentContext;
+        this.logger = logger;
+        this.kemKeyExchangeService = kemKeyExchangeService;
+        this.vaultSigningService = vaultSigningService;
+        this.storageService = storageService;
+        // Register message handlers
+        this.registerMessageHandlers(messageHandlerRegistry, eventEmitter, logger, vaultRepository, thresholdSessionRepository, storageService);
+    }
+    registerMessageHandlers(messageHandlerRegistry, eventEmitter, logger, vaultRepository, sessionRepository, storageService) {
+        // Storage/retrieval handlers (inline)
+        messageHandlerRegistry.registerMessageHandler(new handlers_1.StoreVaultHandler(vaultRepository, eventEmitter));
+        messageHandlerRegistry.registerMessageHandler(new handlers_1.VaultStoredAckHandler(logger, eventEmitter));
+        messageHandlerRegistry.registerMessageHandler(new handlers_1.RetrieveVaultHandler(this.vaultService));
+        messageHandlerRegistry.registerMessageHandler(new handlers_1.VaultDataHandler(vaultRepository, eventEmitter));
+        // Storage/retrieval handlers (external storage)
+        messageHandlerRegistry.registerMessageHandler(new handlers_1.VaultReferenceHandler(logger, vaultRepository, storageService, eventEmitter));
+        messageHandlerRegistry.registerMessageHandler(new handlers_1.RequestStorageHandler(logger, storageService, eventEmitter));
+        // Lifecycle handlers
+        messageHandlerRegistry.registerMessageHandler(new handlers_1.CreateVaultHandler(logger, vaultRepository, eventEmitter));
+        messageHandlerRegistry.registerMessageHandler(new handlers_1.VaultCreatedAckHandler(logger, eventEmitter));
+        messageHandlerRegistry.registerMessageHandler(new handlers_1.UpdateVaultHandler(logger, vaultRepository, eventEmitter));
+        messageHandlerRegistry.registerMessageHandler(new handlers_1.DeleteVaultHandler(logger, vaultRepository, eventEmitter));
+        // Access control handlers
+        messageHandlerRegistry.registerMessageHandler(new handlers_1.RequestAccessHandler(logger, vaultRepository, eventEmitter));
+        messageHandlerRegistry.registerMessageHandler(new handlers_1.GrantAccessHandler(logger, vaultRepository, eventEmitter));
+        messageHandlerRegistry.registerMessageHandler(new handlers_1.DenyAccessHandler(logger, eventEmitter));
+        // Threshold handlers
+        messageHandlerRegistry.registerMessageHandler(new handlers_1.RequestShareHandler(logger, vaultRepository, sessionRepository, eventEmitter));
+        messageHandlerRegistry.registerMessageHandler(new handlers_1.ProvideShareHandler(logger, sessionRepository, eventEmitter));
+        messageHandlerRegistry.registerMessageHandler(new handlers_1.DenyShareHandler(logger, sessionRepository, eventEmitter));
+        // Error handler
+        messageHandlerRegistry.registerMessageHandler(new handlers_1.VaultProblemReportHandler(logger, eventEmitter));
+    }
+    // ═══════════════════════════════════════════════════════════════════════════
+    // Storage Configuration
+    // ═══════════════════════════════════════════════════════════════════════════
+    /**
+     * Configure external storage (S3) for large file support
+     *
+     * @param config - S3 storage configuration
+     *
+     * @example
+     * ```typescript
+     * await agent.modules.vaults.configureStorage({
+     *   type: 's3',
+     *   bucket: 'my-vault-bucket',
+     *   region: 'us-east-1',
+     *   accessKeyId: process.env.AWS_ACCESS_KEY_ID,
+     *   secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
+     * })
+     * ```
+     */
+    async configureStorage(config) {
+        await this.storageService.configure(config);
+        // Connect storage service to signing service for large file support
+        this.vaultSigningService.setStorageService(this.storageService);
+        this.logger.info(`Storage configured: bucket=${config.bucket}, region=${config.region}`);
+    }
+    /**
+     * Check if external storage is configured
+     */
+    isStorageConfigured() {
+        return this.storageService.isConfigured();
+    }
+    /**
+     * Get the storage service for direct operations
+     */
+    getStorageService() {
+        return this.storageService;
+    }
+    /**
+     * Create a new encrypted vault
+     *
+     * @param data - Raw data to encrypt (e.g., PDF bytes)
+     * @param options - Creation options including passphrase
+     * @returns Created vault identifiers
+     *
+     * @example
+     * ```typescript
+     * const pdfBytes = await fs.readFile('contract.pdf')
+     * const { vaultId } = await agent.modules.vaults.create(pdfBytes, {
+     *   passphrase: 'my-secure-passphrase',
+     *   metadata: { description: 'Employment Contract' }
+     * })
+     * ```
+     */
+    async create(data, options) {
+        return this.vaultService.createVault(this.agentContext, data, options);
+    }
+    /**
+     * Open (decrypt) a vault
+     *
+     * @param vaultId - Vault identifier
+     * @param options - Open options including passphrase
+     * @returns Decrypted data
+     *
+     * @example
+     * ```typescript
+     * const decrypted = await agent.modules.vaults.open(vaultId, {
+     *   passphrase: 'my-secure-passphrase'
+     * })
+     * await fs.writeFile('contract-decrypted.pdf', decrypted)
+     * ```
+     */
+    async open(vaultId, options) {
+        return this.vaultService.openVault(this.agentContext, vaultId, options);
+    }
+    /**
+     * Update vault with new data
+     *
+     * @param vaultId - Vault identifier
+     * @param data - New data to encrypt
+     * @param options - Update options including passphrase
+     *
+     * @example
+     * ```typescript
+     * const newPdfBytes = await fs.readFile('contract-v2.pdf')
+     * await agent.modules.vaults.update(vaultId, newPdfBytes, {
+     *   passphrase: 'my-secure-passphrase'
+     * })
+     * ```
+     */
+    async update(vaultId, data, options) {
+        return this.vaultService.updateVault(this.agentContext, vaultId, data, options);
+    }
+    /**
+     * Delete a vault
+     *
+     * @param vaultId - Vault identifier
+     *
+     * @example
+     * ```typescript
+     * await agent.modules.vaults.delete(vaultId)
+     * ```
+     */
+    async delete(vaultId) {
+        return this.vaultService.deleteVault(this.agentContext, vaultId);
+    }
+    /**
+     * List all vaults
+     *
+     * @returns Array of vault records
+     *
+     * @example
+     * ```typescript
+     * const vaults = await agent.modules.vaults.list()
+     * console.log(`Total vaults: ${vaults.length}`)
+     * ```
+     */
+    async list() {
+        return this.vaultService.listVaults(this.agentContext);
+    }
+    /**
+     * Get vault info (metadata without decrypting)
+     *
+     * @param vaultId - Vault identifier
+     * @returns Vault information
+     *
+     * @example
+     * ```typescript
+     * const info = await agent.modules.vaults.getInfo(vaultId)
+     * console.log(`Vault: ${info.vaultId}, Epoch: ${info.header.epoch}`)
+     * ```
+     */
+    async getInfo(vaultId) {
+        return this.vaultService.getVaultInfo(this.agentContext, vaultId);
+    }
+    /**
+     * Check if a vault exists
+     *
+     * @param vaultId - Vault identifier
+     * @returns True if vault exists
+     *
+     * @example
+     * ```typescript
+     * if (await agent.modules.vaults.exists(vaultId)) {
+     *   console.log('Vault found!')
+     * }
+     * ```
+     */
+    async exists(vaultId) {
+        return this.vaultService.vaultExists(this.agentContext, vaultId);
+    }
+    /**
+     * Get the raw vault record (for advanced operations)
+     *
+     * @param vaultId - Vault identifier
+     * @returns Vault record or null
+     */
+    async getRecord(vaultId) {
+        return this.vaultService.getVaultRecord(this.agentContext, vaultId);
+    }
+    // ═══════════════════════════════════════════════════════════════════════════
+    // KEM Key Exchange (for P2P vault sharing)
+    // ═══════════════════════════════════════════════════════════════════════════
+    /**
+     * Generate a new ML-KEM keypair for vault sharing
+     *
+     * @returns Keypair with key ID
+     *
+     * @example
+     * ```typescript
+     * const keypair = agent.modules.vaults.generateKemKeypair()
+     * console.log(`Generated KEM key: ${keypair.kid}`)
+     * ```
+     */
+    generateKemKeypair() {
+        return this.kemKeyExchangeService.generateKemKeypair();
+    }
+    /**
+     * Store peer's ML-KEM public key for vault encryption
+     *
+     * @param connectionId - Connection to associate the key with
+     * @param kid - Key identifier
+     * @param publicKey - ML-KEM public key
+     *
+     * @example
+     * ```typescript
+     * await agent.modules.vaults.storePeerKemKey(connectionId, {
+     *   kid: 'peer-key-id',
+     *   publicKey: peerPublicKey
+     * })
+     * ```
+     */
+    async storePeerKemKey(connectionId, keyInfo) {
+        return this.kemKeyExchangeService.storePeerKemKey(this.agentContext, connectionId, keyInfo);
+    }
+    /**
+     * Get peer's ML-KEM public key
+     *
+     * @param connectionId - Connection ID
+     * @returns Peer's key info or null
+     *
+     * @example
+     * ```typescript
+     * const peerKey = await agent.modules.vaults.getPeerKemKey(connectionId)
+     * if (peerKey) {
+     *   // Can now create vault encrypted to peer
+     * }
+     * ```
+     */
+    async getPeerKemKey(connectionId) {
+        return this.kemKeyExchangeService.getPeerKemKey(this.agentContext, connectionId);
+    }
+    /**
+     * Check if peer has a KEM key stored
+     *
+     * @param connectionId - Connection ID
+     * @returns True if peer has KEM key
+     */
+    async hasPeerKemKey(connectionId) {
+        return this.kemKeyExchangeService.hasPeerKemKey(this.agentContext, connectionId);
+    }
+    // ═══════════════════════════════════════════════════════════════════════════
+    // Local KEM Keypair Storage
+    // ═══════════════════════════════════════════════════════════════════════════
+    /**
+     * Store a local KEM keypair for a connection
+     *
+     * Call this after generateKemKeypair() to persist the keypair locally
+     * for later vault decryption.
+     *
+     * @param connectionId - Connection to associate the keypair with
+     * @param keypair - Full keypair including secret key
+     */
+    async storeLocalKeypair(connectionId, keypair) {
+        return this.kemKeyExchangeService.storeLocalKeypair(this.agentContext, connectionId, keypair);
+    }
+    /**
+     * Get the local KEM keypair for a connection
+     *
+     * @param connectionId - Connection ID
+     * @returns Full keypair or null
+     */
+    async getLocalKeypair(connectionId) {
+        return this.kemKeyExchangeService.getLocalKeypair(this.agentContext, connectionId);
+    }
+    /**
+     * Check if a local keypair exists for a connection
+     *
+     * @param connectionId - Connection ID
+     * @returns True if local keypair exists
+     */
+    async hasLocalKeypair(connectionId) {
+        return this.kemKeyExchangeService.hasLocalKeypair(this.agentContext, connectionId);
+    }
+    /**
+     * Find a local keypair by key identifier (kid)
+     *
+     * @param kid - Key identifier to search for
+     * @returns Keypair and associated connectionId, or null
+     */
+    async findKeypairByKid(kid) {
+        return this.kemKeyExchangeService.findKeypairByKid(this.agentContext, kid);
+    }
+    /**
+     * Delete the local keypair for a connection
+     *
+     * @param connectionId - Connection ID
+     */
+    async deleteLocalKeypair(connectionId) {
+        return this.kemKeyExchangeService.deleteLocalKeypair(this.agentContext, connectionId);
+    }
+    // ═══════════════════════════════════════════════════════════════════════════
+    // Signing Vault Operations (for document signing workflows)
+    // ═══════════════════════════════════════════════════════════════════════════
+    /**
+     * Create a signing vault encrypted to a signer's ML-KEM key
+     *
+     * Use this to send a document to someone for signing.
+     * The document is encrypted so only the intended signer can decrypt it.
+     *
+     * @param options - Creation options
+     * @returns Created vault identifiers
+     *
+     * @example
+     * ```typescript
+     * // Create vault for Bob to sign
+     * const { vaultId } = await agent.modules.vaults.createSigningVault({
+     *   document: pdfBytes,
+     *   signerConnectionId: bobConnectionId,
+     *   documentType: 'pdf',
+     *   metadata: { description: 'Contract for signing' }
+     * })
+     *
+     * // Share with Bob
+     * await agent.modules.vaults.shareSigningVault(vaultId, bobConnectionId)
+     * ```
+     */
+    async createSigningVault(options) {
+        return this.vaultSigningService.createSigningVault(this.agentContext, options);
+    }
+    /**
+     * Open (decrypt) a vault received for signing
+     *
+     * @param vaultData - Received vault data (message or record)
+     * @param secretKey - Your ML-KEM secret key
+     * @param kid - Your key identifier
+     * @returns Decrypted document and metadata
+     *
+     * @example
+     * ```typescript
+     * // Decrypt vault received for signing
+     * const { document, header } = await agent.modules.vaults.openSigningVault(
+     *   vaultRecord,
+     *   myKemKeypair.secretKey,
+     *   myKemKeypair.kid
+     * )
+     *
+     * // Sign the document
+     * const signedPdf = await signPdf(document)
+     * ```
+     */
+    async openSigningVault(vaultData, secretKey, kid) {
+        return this.vaultSigningService.openSigningVault(this.agentContext, vaultData, secretKey, kid);
+    }
+    /**
+     * Share a signing vault with a connection
+     *
+     * Sends the encrypted vault to the specified connection via DIDComm
+     *
+     * @param vaultId - Vault to share
+     * @param connectionId - Connection to send to
+     *
+     * @example
+     * ```typescript
+     * await agent.modules.vaults.shareSigningVault(vaultId, bobConnectionId)
+     * ```
+     */
+    async shareSigningVault(vaultId, connectionId) {
+        return this.vaultSigningService.shareSigningVault(this.agentContext, vaultId, connectionId);
+    }
+    /**
+     * Return a signed document to the vault owner
+     *
+     * Creates a new vault with the signed document encrypted to the owner's key
+     *
+     * @param options - Return options
+     * @returns New vault containing the signed document
+     *
+     * @example
+     * ```typescript
+     * await agent.modules.vaults.returnSignedDocument({
+     *   signedDocument: signedPdfBytes,
+     *   originalVaultId: receivedVaultId,
+     *   ownerConnectionId: aliceConnectionId,
+     *   documentType: 'pdf',
+     *   metadata: { signatureType: 'pades-b-lta' }
+     * })
+     * ```
+     */
+    async returnSignedDocument(options) {
+        return this.vaultSigningService.returnSignedDocument(this.agentContext, options);
+    }
+    /**
+     * Resolve the decryption key for a vault
+     *
+     * Automatically finds the correct local KEM keypair that can decrypt
+     * the specified vault by matching recipient kids in the vault header.
+     *
+     * @param vaultId - Vault to find decryption key for
+     * @returns Secret key, kid, and connectionId; or null if no matching key found
+     *
+     * @example
+     * ```typescript
+     * const key = await agent.modules.vaults.resolveVaultDecryptionKey(vaultId)
+     * if (key) {
+     *   const { document } = await agent.modules.vaults.openSigningVault(
+     *     vaultRecord, key.secretKey, key.kid
+     *   )
+     * }
+     * ```
+     */
+    async resolveVaultDecryptionKey(vaultId) {
+        return this.vaultSigningService.resolveVaultDecryptionKey(this.agentContext, vaultId);
+    }
+};
 exports.VaultsApi = VaultsApi;
+exports.VaultsApi = VaultsApi = __decorate([
+    (0, core_1.injectable)(),
+    __param(3, (0, core_1.inject)(core_1.InjectionSymbols.Logger)),
+    __metadata("design:paramtypes", [core_1.AgentContext,
+        core_1.MessageHandlerRegistry,
+        core_1.EventEmitter, Object, VaultService_1.VaultService,
+        KemKeyExchangeService_1.KemKeyExchangeService,
+        VaultSigningService_1.VaultSigningService,
+        VaultStorageService_1.VaultStorageService,
+        VaultRepository_1.VaultRepository,
+        ThresholdSessionRepository_1.ThresholdSessionRepository])
+], VaultsApi);
+//# sourceMappingURL=VaultsApi.js.map