@anuma/sdk 4.2.0 → 4.2.1

package/dist/server/index.cjs

@@ -15012,14 +15012,11 @@ function notifyKeyAvailable(address) {
     }
   }
 }
-function getStoredKey(address) {
-  const keys = encryptionKeyStore.get(address);
-  return keys?.current ?? null;
-}
 function getStoredKeyByVersion(address, version) {
   const keys = encryptionKeyStore.get(address);
   if (!keys) return null;
-  return version === "v2" ? keys.legacy : keys.current;
+  const value = version === "v2" ? keys.legacy : keys.current;
+  return value ?? null;
 }
 function setStoredKey(address, keys) {
   encryptionKeyStore.set(address, keys);
@@ -15028,6 +15025,8 @@ function clearEncryptionKey(address) {
   encryptionKeyStore.delete(address);
   cryptoKeyCache.delete(`${address}:v2`);
   cryptoKeyCache.delete(`${address}:v3`);
+  refreshCandidatesByAddress.delete(address);
+  divergentDeriveAddresses.delete(address);
 }
 function clearAllEncryptionState() {
   sessionEpoch += 1;
@@ -15035,6 +15034,9 @@ function clearAllEncryptionState() {
   cryptoKeyCache.clear();
   keyAvailableCallbacks.clear();
   pendingKeyRequests.clear();
+  pendingCandidateDerives.clear();
+  refreshCandidatesByAddress.clear();
+  divergentDeriveAddresses.clear();
   clearAllKeyPairs();
   for (const cb of clearAllEncryptionStateCallbacks) {
     try {
@@ -15218,9 +15220,7 @@ async function getEncryptionKey(address, version = "v3") {
   }
   const keyHex = getStoredKeyByVersion(address, version);
   if (!keyHex) {
-    throw new Error(
-      "Encryption key not found. Please sign a message to generate your encryption key."
-    );
+    throw new EncryptionKeyMissingError(address, version);
   }
   const keyBytes = hexToBytes(keyHex);
   const cryptoKey = await crypto.subtle.importKey(
@@ -15284,8 +15284,42 @@ async function decryptDataBytesFromBytes(encrypted, address, version = "v3") {
   );
   return new Uint8Array(decryptedData);
 }
-function hasEncryptionKey(address) {
-  return getStoredKey(address) !== null;
+function hasEncryptionKey(address, version) {
+  return getStoredKeyByVersion(address, version ?? "v3") !== null;
+}
+function seedEncryptionKeys(address, keys) {
+  if (!isValidWalletAddress(address)) {
+    throw new Error(
+      `Invalid wallet address: ${address}. Address must start with 0x and be 42 characters (0x + 40 hex characters).`
+    );
+  }
+  if (!keys.legacy && !keys.current) {
+    throw new Error("seedEncryptionKeys: at least one of legacy or current is required");
+  }
+  if (keys.legacy !== void 0) {
+    assertAes256KeyHex("legacy", keys.legacy);
+  }
+  if (keys.current !== void 0) {
+    assertAes256KeyHex("current", keys.current);
+  }
+  const existing = encryptionKeyStore.get(address);
+  const next = {
+    legacy: keys.legacy ?? existing?.legacy,
+    current: keys.current ?? existing?.current
+  };
+  setStoredKey(address, next);
+  if (keys.legacy !== void 0) cryptoKeyCache.delete(`${address}:v2`);
+  if (keys.current !== void 0) cryptoKeyCache.delete(`${address}:v3`);
+  refreshCandidatesByAddress.delete(address);
+  divergentDeriveAddresses.delete(address);
+  notifyKeyAvailable(address);
+}
+function assertAes256KeyHex(field10, value) {
+  if (!AES_256_KEY_HEX.test(value)) {
+    throw new Error(
+      `seedEncryptionKeys: ${field10} must be 64 hex characters (32-byte AES key), got length ${value.length}`
+    );
+  }
 }
 async function encryptBytesWithKey(plaintext, key) {
   const plaintextBytes = typeof plaintext === "string" ? SHARED_TEXT_ENCODER.encode(plaintext) : plaintext;
@@ -15334,20 +15368,23 @@ async function decryptDataBatch(encryptedValues, address) {
   const key = await getEncryptionKey(address);
   return Promise.all(encryptedValues.map((value) => decryptDataWithKey(value, key)));
 }
-async function requestEncryptionKey(walletAddress, signMessage, embeddedWalletSigner) {
+async function requestEncryptionKey(walletAddress, signMessage, embeddedWalletSigner, options) {
   if (!isValidWalletAddress(walletAddress)) {
     throw new Error(
       `Invalid wallet address: ${walletAddress}. Address must start with 0x and be 42 characters (0x + 40 hex characters).`
     );
   }
-  const existingKey = getStoredKey(walletAddress);
-  if (existingKey) {
-    return;
+  if (!options?.force && getStoredKeyByVersion(walletAddress, "v3") && getStoredKeyByVersion(walletAddress, "v2")) {
+    return true;
   }
-  const pending = pendingKeyRequests.get(walletAddress);
-  if (pending) {
-    await pending;
-    return;
+  if (!options?.force && divergentDeriveAddresses.has(walletAddress)) {
+    return false;
+  }
+  if (!options?.force) {
+    const pending = pendingKeyRequests.get(walletAddress);
+    if (pending) {
+      return pending;
+    }
   }
   const startEpoch = sessionEpoch;
   const promise = (async () => {
@@ -15375,20 +15412,143 @@ async function requestEncryptionKey(walletAddress, signMessage, embeddedWalletSi
       deriveKeyFromSignatureV3(signature)
     ]);
     if (sessionEpoch !== startEpoch) {
-      return;
+      return false;
+    }
+    const existing = encryptionKeyStore.get(walletAddress);
+    if (!options?.force && existing && (existing.legacy || existing.current)) {
+      const matchesCurrent = Boolean(existing.current && existing.current === currentKey);
+      const matchesLegacy = Boolean(existing.legacy && existing.legacy === legacyKey);
+      if (!matchesCurrent && !matchesLegacy) {
+        getLogger().warn(
+          "requestEncryptionKey: derived keys do not match existing store; leaving unchanged"
+        );
+        divergentDeriveAddresses.add(walletAddress);
+        return false;
+      }
+      setStoredKey(walletAddress, {
+        legacy: existing.legacy ?? legacyKey,
+        current: existing.current ?? currentKey
+      });
+    } else {
+      setStoredKey(walletAddress, { legacy: legacyKey, current: currentKey });
     }
-    setStoredKey(walletAddress, { legacy: legacyKey, current: currentKey });
+    cryptoKeyCache.delete(`${walletAddress}:v2`);
+    cryptoKeyCache.delete(`${walletAddress}:v3`);
+    refreshCandidatesByAddress.delete(walletAddress);
+    divergentDeriveAddresses.delete(walletAddress);
     notifyKeyAvailable(walletAddress);
+    return true;
   })();
   pendingKeyRequests.set(walletAddress, promise);
   try {
-    await promise;
+    return await promise;
   } finally {
     if (pendingKeyRequests.get(walletAddress) === promise) {
       pendingKeyRequests.delete(walletAddress);
     }
   }
 }
+async function refreshEncryptionKeyIfMatches(walletAddress, probeCiphertext, signMessage, embeddedWalletSigner) {
+  if (!isValidWalletAddress(walletAddress)) {
+    throw new Error(
+      `Invalid wallet address: ${walletAddress}. Address must start with 0x and be 42 characters (0x + 40 hex characters).`
+    );
+  }
+  const parsed = parsePrefixedCiphertext(probeCiphertext);
+  if (!parsed) {
+    return false;
+  }
+  const cached = refreshCandidatesByAddress.get(walletAddress);
+  if (cached) {
+    return tryCommitCandidatesIfProbeMatches(walletAddress, parsed, cached);
+  }
+  let derivePromise = pendingCandidateDerives.get(walletAddress);
+  if (!derivePromise) {
+    derivePromise = (async () => {
+      const candidates2 = await deriveRefreshCandidates(signMessage, embeddedWalletSigner);
+      if (candidates2) {
+        refreshCandidatesByAddress.set(walletAddress, candidates2);
+      }
+      return candidates2;
+    })().finally(() => {
+      if (pendingCandidateDerives.get(walletAddress) === derivePromise) {
+        pendingCandidateDerives.delete(walletAddress);
+      }
+    });
+    pendingCandidateDerives.set(walletAddress, derivePromise);
+  }
+  const candidates = await derivePromise;
+  if (!candidates) {
+    return false;
+  }
+  return tryCommitCandidatesIfProbeMatches(walletAddress, parsed, candidates);
+}
+function parsePrefixedCiphertext(probeCiphertext) {
+  const version = probeCiphertext.startsWith("enc:v3:") ? "v3" : probeCiphertext.startsWith("enc:v2:") ? "v2" : null;
+  if (!version) return null;
+  const encryptedData = probeCiphertext.slice(
+    version === "v3" ? "enc:v3:".length : "enc:v2:".length
+  );
+  if (encryptedData.length < 56 || !/^[0-9a-f]+$/i.test(encryptedData)) {
+    return null;
+  }
+  return { version, encryptedData };
+}
+async function deriveRefreshCandidates(signMessage, embeddedWalletSigner) {
+  const startEpoch = sessionEpoch;
+  const signOptions = { showWalletUIs: false };
+  let signature;
+  try {
+    if (embeddedWalletSigner) {
+      signature = await embeddedWalletSigner(SIGN_MESSAGE, signOptions);
+    } else {
+      signature = await signMessage(SIGN_MESSAGE, signOptions);
+    }
+  } catch (error) {
+    if (embeddedWalletSigner && error instanceof Error) {
+      getLogger().warn(
+        "Embedded wallet signing failed during key refresh, falling back to standard signMessage:",
+        error.message
+      );
+      signature = await signMessage(SIGN_MESSAGE, signOptions);
+    } else {
+      throw error;
+    }
+  }
+  const [legacyKey, currentKey] = await Promise.all([
+    deriveKeyFromSignature(signature),
+    deriveKeyFromSignatureV3(signature)
+  ]);
+  if (sessionEpoch !== startEpoch) {
+    return null;
+  }
+  return { legacy: legacyKey, current: currentKey };
+}
+async function tryCommitCandidatesIfProbeMatches(walletAddress, parsed, candidates) {
+  const candidateHex = parsed.version === "v2" ? candidates.legacy : candidates.current;
+  const keyBytes = hexToBytes(candidateHex);
+  const candidateCryptoKey = await crypto.subtle.importKey(
+    "raw",
+    keyBytes.buffer,
+    { name: "AES-GCM" },
+    false,
+    ["encrypt", "decrypt"]
+  );
+  try {
+    await decryptDataWithKey(parsed.encryptedData, candidateCryptoKey);
+  } catch {
+    getLogger().warn(
+      "refreshEncryptionKeyIfMatches: candidate keys failed to decrypt probe; leaving store unchanged"
+    );
+    return false;
+  }
+  setStoredKey(walletAddress, { legacy: candidates.legacy, current: candidates.current });
+  cryptoKeyCache.delete(`${walletAddress}:v2`);
+  cryptoKeyCache.delete(`${walletAddress}:v3`);
+  divergentDeriveAddresses.delete(walletAddress);
+  notifyKeyAvailable(walletAddress);
+  return true;
+}
 async function persistKeyPair(address, startEpoch) {
   if (typeof window === "undefined") {
     return;
@@ -15613,15 +15773,28 @@ function clearAllKeyPairs() {
     }
   }
 }
-var SIGN_MESSAGE, encryptionKeyStore, pendingKeyRequests, sessionEpoch, cryptoKeyCache, keyAvailableCallbacks, clearAllEncryptionStateCallbacks, keyPairStore, SHARED_TEXT_ENCODER, SHARED_TEXT_DECODER, KEYPAIR_STORAGE_PREFIX;
+var SIGN_MESSAGE, EncryptionKeyMissingError, encryptionKeyStore, pendingKeyRequests, pendingCandidateDerives, refreshCandidatesByAddress, divergentDeriveAddresses, sessionEpoch, cryptoKeyCache, keyAvailableCallbacks, clearAllEncryptionStateCallbacks, keyPairStore, SHARED_TEXT_ENCODER, SHARED_TEXT_DECODER, AES_256_KEY_HEX, KEYPAIR_STORAGE_PREFIX;
 var init_useEncryption = __esm({
   "src/react/useEncryption.ts"() {
     "use strict";
     "use client";
     init_logger();
     SIGN_MESSAGE = "The app is asking you to sign this message to generate a key, which will be used to encrypt data.";
+    EncryptionKeyMissingError = class extends Error {
+      constructor(address, version) {
+        super(
+          `Encryption key (${version}) not found for ${address}. Please sign a message to generate your encryption key.`
+        );
+        this.name = "EncryptionKeyMissingError";
+        this.address = address;
+        this.version = version;
+      }
+    };
     encryptionKeyStore = /* @__PURE__ */ new Map();
     pendingKeyRequests = /* @__PURE__ */ new Map();
+    pendingCandidateDerives = /* @__PURE__ */ new Map();
+    refreshCandidatesByAddress = /* @__PURE__ */ new Map();
+    divergentDeriveAddresses = /* @__PURE__ */ new Set();
     sessionEpoch = 0;
     cryptoKeyCache = /* @__PURE__ */ new Map();
     keyAvailableCallbacks = /* @__PURE__ */ new Map();
@@ -15629,6 +15802,7 @@ var init_useEncryption = __esm({
     keyPairStore = /* @__PURE__ */ new Map();
     SHARED_TEXT_ENCODER = new TextEncoder();
     SHARED_TEXT_DECODER = new TextDecoder();
+    AES_256_KEY_HEX = /^[0-9a-fA-F]{64}$/;
     KEYPAIR_STORAGE_PREFIX = "ecdh_keypair_";
   }
 });
@@ -15661,20 +15835,29 @@ async function encryptField(value, address, signMessage, embeddedWalletSigner, s
   const encrypted = await encryptData(value, address);
   return `${ENCRYPTION_PREFIX}${encrypted}`;
 }
-async function decryptField(value, address) {
-  if (!value) return value;
+async function decryptFieldDetailed(value, address) {
+  if (!value) return { status: "plaintext", value };
   const detected = detectEncryptionVersion(value);
-  if (!detected) return value;
+  if (!detected) return { status: "plaintext", value };
   if (detected.encryptedData.length < 56 || !/^[0-9a-f]+$/i.test(detected.encryptedData)) {
-    return value;
+    return { status: "invalid_payload", value, version: detected.version };
   }
   try {
-    return await decryptData(detected.encryptedData, address, detected.version);
+    const plaintext = await decryptData(detected.encryptedData, address, detected.version);
+    return { status: "ok", value: plaintext, version: detected.version };
   } catch (error) {
-    getLogger().warn("Failed to decrypt field, returning as-is:", error);
-    return value;
+    if (error instanceof EncryptionKeyMissingError) {
+      getLogger().warn("Failed to decrypt field (key missing for version):", error.message);
+      return { status: "key_missing", value, version: detected.version };
+    }
+    getLogger().warn("Failed to decrypt field (auth mismatch or crypto error):", error);
+    return { status: "auth_mismatch", value, version: detected.version };
   }
 }
+async function decryptField(value, address) {
+  const result = await decryptFieldDetailed(value, address);
+  return result.value;
+}
 async function encryptJsonField(value, address, signMessage, embeddedWalletSigner, skipKeyRequest) {
   if (!value) return void 0;
   const jsonString = JSON.stringify(value);
@@ -15811,20 +15994,40 @@ async function encryptMessageFields(message, address, signMessage, embeddedWalle
     throw error;
   }
 }
-async function decryptMaybeJsonField(value, address) {
-  if (value === void 0) return void 0;
-  if (value === null) return value;
+async function decryptMaybeJsonFieldDetailed(value, address) {
+  if (value === void 0) return { value: void 0, status: "plaintext" };
+  if (value === null) return { value, status: "plaintext" };
   if (typeof value === "string") {
     if (isEncrypted(value)) {
-      return await decryptJsonField(value, address);
+      const detailed = await decryptFieldDetailed(value, address);
+      if (detailed.status !== "ok") {
+        return { value: void 0, status: detailed.status, probe: value };
+      }
+      try {
+        return { value: JSON.parse(detailed.value), status: "ok" };
+      } catch (error) {
+        getLogger().warn("Failed to parse decrypted JSON field:", error);
+        return { value: void 0, status: "invalid_payload", probe: value };
+      }
     }
     try {
-      return JSON.parse(value);
+      return { value: JSON.parse(value), status: "plaintext" };
     } catch {
-      return void 0;
+      return { value: void 0, status: "plaintext" };
     }
   }
-  return value;
+  return { value, status: "plaintext" };
+}
+function worseDecryptStatus(a, b) {
+  if (b === "ok" || b === "plaintext") return a;
+  if (!a || a === "ok" || a === "plaintext") return b;
+  const rank = (s) => {
+    if (s === "auth_mismatch") return 3;
+    if (s === "key_missing") return 2;
+    if (s === "invalid_payload") return 1;
+    return 0;
+  };
+  return rank(b) >= rank(a) ? b : a;
 }
 async function decryptMessageFields(message, address, signMessage, embeddedWalletSigner) {
   if (!address) {
@@ -15837,33 +16040,82 @@ async function decryptMessageFields(message, address, signMessage, embeddedWalle
       getLogger().warn("Failed to request encryption key for decryption:", error);
     }
   }
-  const decryptedContent = await decryptField(message.content, address);
-  const decryptedThinking = message.thinking ? await decryptField(message.thinking, address) : message.thinking;
-  const decryptedVector = await decryptMaybeJsonField(
+  let assembled = await assembleDecryptedMessage(message, address);
+  const needsRefresh = assembled.decryptionStatus === "auth_mismatch" || assembled.decryptionStatus === "key_missing";
+  if (needsRefresh && signMessage && assembled.refreshProbe) {
+    try {
+      const refreshed = await refreshEncryptionKeyIfMatches(
+        address,
+        assembled.refreshProbe,
+        signMessage,
+        embeddedWalletSigner
+      );
+      if (refreshed) {
+        assembled = await assembleDecryptedMessage(message, address);
+      }
+    } catch (error) {
+      getLogger().warn("Failed to refresh encryption key after decrypt failure:", error);
+    }
+  }
+  const { refreshProbe: _probe, ...result } = assembled;
+  return result;
+}
+async function assembleDecryptedMessage(message, address) {
+  const contentResult = await decryptFieldDetailed(message.content, address);
+  const thinkingResult = message.thinking ? await decryptFieldDetailed(message.thinking, address) : null;
+  const vectorResult = await decryptMaybeJsonFieldDetailed(
     message.vector,
     address
   );
-  const decryptedChunks = await decryptMaybeJsonField(
+  const chunksResult = await decryptMaybeJsonFieldDetailed(
     message.chunks,
     address
   );
-  const decryptedSources = await decryptMaybeJsonField(
+  const sourcesResult = await decryptMaybeJsonFieldDetailed(
     message.sources,
     address
   );
-  const decryptedThoughtProcess = await decryptMaybeJsonField(
+  const thoughtProcessResult = await decryptMaybeJsonFieldDetailed(
     message.thoughtProcess,
     address
   );
-  return {
+  let decryptionStatus;
+  let refreshProbe;
+  const consider = (status, probe) => {
+    decryptionStatus = worseDecryptStatus(decryptionStatus, status);
+    if (!refreshProbe && probe && (status === "auth_mismatch" || status === "key_missing")) {
+      refreshProbe = probe;
+    }
+  };
+  consider(contentResult.status, isEncrypted(message.content) ? message.content : void 0);
+  if (thinkingResult && message.thinking && typeof message.thinking === "string") {
+    consider(thinkingResult.status, isEncrypted(message.thinking) ? message.thinking : void 0);
+  }
+  if (vectorResult.probe) consider(vectorResult.status, vectorResult.probe);
+  if (chunksResult.probe) consider(chunksResult.status, chunksResult.probe);
+  if (sourcesResult.probe) consider(sourcesResult.status, sourcesResult.probe);
+  if (thoughtProcessResult.probe) {
+    consider(thoughtProcessResult.status, thoughtProcessResult.probe);
+  }
+  const statusForConsumer = decryptionStatus === "ok" || decryptionStatus === "plaintext" || !decryptionStatus ? void 0 : decryptionStatus;
+  const result = {
     ...message,
-    content: decryptedContent,
-    thinking: decryptedThinking,
-    vector: decryptedVector,
-    chunks: decryptedChunks,
-    sources: decryptedSources,
-    thoughtProcess: decryptedThoughtProcess
+    content: contentResult.value,
+    thinking: thinkingResult ? thinkingResult.value : message.thinking,
+    vector: vectorResult.value,
+    chunks: chunksResult.value,
+    sources: sourcesResult.value,
+    thoughtProcess: thoughtProcessResult.value
   };
+  if (statusForConsumer) {
+    result.decryptionStatus = statusForConsumer;
+  } else {
+    delete result.decryptionStatus;
+  }
+  if (refreshProbe) {
+    result.refreshProbe = refreshProbe;
+  }
+  return result;
 }
 var init_encryption = __esm({
   "src/lib/db/chat/encryption.ts"() {
@@ -23465,6 +23717,7 @@ __export(index_exports, {
   DEFAULT_VAULT_CACHE_SIZE: () => DEFAULT_VAULT_CACHE_SIZE,
   DatabaseManager: () => DatabaseManager,
   ENTITY_FANOUT: () => ENTITY_FANOUT,
+  EncryptionKeyMissingError: () => EncryptionKeyMissingError,
   ExcelProcessor: () => ExcelProcessor,
   HARD_DELETE_WINDOW_MS: () => HARD_DELETE_WINDOW_MS,
   INFERENCE_ID_HEADER: () => INFERENCE_ID_HEADER,
@@ -23665,6 +23918,7 @@ __export(index_exports, {
   rankProfileCandidates: () => rankProfileCandidates,
   recall: () => recall,
   reflect: () => reflect,
+  refreshEncryptionKeyIfMatches: () => refreshEncryptionKeyIfMatches,
   relinkMemoryTopicsOp: () => relinkMemoryTopicsOp,
   relinkMisclassifiedVideosOp: () => relinkMisclassifiedVideosOp,
   renderTemplate: () => renderTemplate,
@@ -23685,6 +23939,7 @@ __export(index_exports, {
   searchMediaOp: () => searchMediaOp,
   searchMessagesOp: () => searchMessagesOp,
   searchVaultMemories: () => searchVaultMemories,
+  seedEncryptionKeys: () => seedEncryptionKeys,
   selectServerToolsForPrompt: () => selectServerToolsForPrompt,
   serverPlatformStorage: () => serverPlatformStorage,
   setMemoryVisibilityOp: () => setMemoryVisibilityOp,
@@ -36169,6 +36424,7 @@ function buildSystemPrompt(ctx, options) {
   DEFAULT_VAULT_CACHE_SIZE,
   DatabaseManager,
   ENTITY_FANOUT,
+  EncryptionKeyMissingError,
   ExcelProcessor,
   HARD_DELETE_WINDOW_MS,
   INFERENCE_ID_HEADER,
@@ -36369,6 +36625,7 @@ function buildSystemPrompt(ctx, options) {
   rankProfileCandidates,
   recall,
   reflect,
+  refreshEncryptionKeyIfMatches,
   relinkMemoryTopicsOp,
   relinkMisclassifiedVideosOp,
   renderTemplate,
@@ -36389,6 +36646,7 @@ function buildSystemPrompt(ctx, options) {
   searchMediaOp,
   searchMessagesOp,
   searchVaultMemories,
+  seedEncryptionKeys,
   selectServerToolsForPrompt,
   serverPlatformStorage,
   setMemoryVisibilityOp,