@bandeira-tech/b3nd-save 0.8.1

package/esm/deps/jsr.io/@bandeira-tech/b3nd-core/0.22.0/src/rig/hooks.d.ts

@@ -0,0 +1,164 @@
+/**
+ * @module
+ * Hook types and runners for the Rig.
+ *
+ * Security model:
+ * - Before-hooks THROW to reject an operation. The caller must catch explicitly.
+ *   No silent aborts — if validation fails, it's an exception.
+ * - After-hooks OBSERVE but cannot modify the result.
+ *   They can throw if a post-condition is violated.
+ * - Hooks are immutable after init. Want different hooks? Create a new rig.
+ * - One function per hook. Need composition? Compose on your end.
+ *
+ * Pure module — no Rig dependency, testable in isolation.
+ */
+import type { B3ndError, Output, ProgramResult } from "../types/types.js";
+/**
+ * Context for a send hook.
+ *
+ * `message` is the input tuple the host application is putting on the
+ * wire. Send hooks fire per-tuple; before-hooks may rewrite the tuple
+ * by returning `{ ctx: { message: newTuple } }`.
+ */
+export interface SendCtx {
+    message: Output;
+}
+/** Context for a receive hook. */
+export interface ReceiveCtx {
+    uri: string;
+    data: unknown;
+}
+/**
+ * Context for a read hook.
+ *
+ * Carries only the `url` — an opaque locator string the framework
+ * passes through unchanged. If a hook needs to inspect the locator's
+ * grammar it brings its own parser. Before-hooks may rewrite the
+ * locator by returning `{ ctx: { url: newUrl } }`; the rig dispatches
+ * the returned locator unchanged.
+ *
+ * If you need to manipulate downstream behavior more invasively, wrap
+ * the executing client itself rather than threading transformations
+ * through the rig.
+ */
+export interface ReadCtx {
+    url: string;
+}
+/**
+ * Before-hook. Runs before the operation.
+ *
+ * - Return `void` to proceed unchanged.
+ * - Return `{ ctx }` to replace the context (e.g. rewrite a URI).
+ * - **Throw** to reject the operation.
+ */
+export type BeforeHook<C> = (ctx: Readonly<C>) => void | {
+    ctx: C;
+} | Promise<void | {
+    ctx: C;
+}>;
+/**
+ * After-hook. Runs after the operation completes.
+ *
+ * Cannot modify the result. Use for logging, auditing, or enforcement.
+ * Throw if a post-condition is violated.
+ */
+export type AfterHook<C> = (ctx: Readonly<C>, result: unknown) => void | Promise<void>;
+/** Where in the pipeline the error occurred. */
+export type ErrorPhase = "process" | "handle" | "route" | "reaction";
+/**
+ * Context passed to the `onError` hook.
+ *
+ * Carries enough detail to identify the failing pipeline stage and
+ * the tuple involved. Optional fields are populated per phase:
+ *
+ * - `process` — `input`, `error`, `cause` (when an exception was thrown)
+ * - `handle`  — `input`, `classification`, `error`, `cause`
+ * - `route`   — `input`, `emission`, `connectionId`, `error`, `errorDetail`
+ * - `reaction`— `input`, `emission`, `pattern`, `error`, `cause`
+ */
+export interface ErrorHookCtx {
+    /** Which pipeline stage produced the error. */
+    readonly phase: ErrorPhase;
+    /** The original input tuple driving this slice of work. */
+    readonly input: Output;
+    /** For `route` and `reaction`, the emission being dispatched. */
+    readonly emission?: Output;
+    /** For `route`, the stable ID of the connection that rejected. */
+    readonly connectionId?: string;
+    /** For `handle`, the classification produced by `process()`. */
+    readonly classification?: ProgramResult;
+    /** For `reaction`, the URI pattern that matched. */
+    readonly pattern?: string;
+    /** Human-readable error message. */
+    readonly error: string;
+    /** Structured error info when the underlying client returned one. */
+    readonly errorDetail?: B3ndError;
+    /** The original thrown value, when an exception occurred. */
+    readonly cause?: unknown;
+}
+/**
+ * Error hook — called synchronously (in the catch path) for every
+ * error the rig observes during a `send`/`receive` operation.
+ *
+ * **Throw to abort.** A throw propagates up through the operation
+ * handle: `await op` rejects with the thrown value, `await op.settled`
+ * rejects, and any in-flight reactions/routes for the operation stop
+ * being dispatched. (Routes already in flight at the underlying client
+ * cannot be unrun; the rig stops scheduling new ones.)
+ *
+ * **Return** to let the rig keep going with normal error handling: the
+ * affected tuple records `accepted: false`, the corresponding
+ * direction-level `*:error` event fires, and the operation's other
+ * tuples continue.
+ *
+ * Use the hook for fail-fast policies (drop the whole batch on first
+ * program rejection), structured error reporting, or to convert
+ * specific phases into application-level exceptions.
+ */
+export type OnErrorHook = (ctx: Readonly<ErrorHookCtx>) => void | Promise<void>;
+/** The full set of hooks for all operations. Frozen after init. */
+export interface RigHooks {
+    readonly beforeSend: BeforeHook<SendCtx> | null;
+    readonly afterSend: AfterHook<SendCtx> | null;
+    readonly beforeReceive: BeforeHook<ReceiveCtx> | null;
+    readonly afterReceive: AfterHook<ReceiveCtx> | null;
+    readonly beforeRead: BeforeHook<ReadCtx> | null;
+    readonly afterRead: AfterHook<ReadCtx> | null;
+    readonly onError: OnErrorHook | null;
+}
+/** Config shape for hooks on RigConfig. */
+export interface HooksConfig {
+    beforeSend?: BeforeHook<SendCtx>;
+    afterSend?: AfterHook<SendCtx>;
+    beforeReceive?: BeforeHook<ReceiveCtx>;
+    afterReceive?: AfterHook<ReceiveCtx>;
+    beforeRead?: BeforeHook<ReadCtx>;
+    afterRead?: AfterHook<ReadCtx>;
+    /** Synchronous error hook — throw to abort the operation. */
+    onError?: OnErrorHook;
+}
+/** Create frozen hooks from config. */
+export declare function resolveHooks(config?: HooksConfig): RigHooks;
+/**
+ * Run the onError hook with a given context. Returns `true` if the
+ * hook threw — the caller is expected to propagate the throw and
+ * abort the operation. Returns `false` if the hook returned normally
+ * (or there is no hook installed) — the caller proceeds with normal
+ * error handling.
+ *
+ * The hook's own throw is re-thrown by this runner so the call site
+ * sees it. Returning `true` here is just a convenience for call sites
+ * that want to branch.
+ */
+export declare function runOnError(hook: OnErrorHook | null, ctx: ErrorHookCtx): Promise<void>;
+/**
+ * Run a before-hook. Returns the (possibly replaced) context.
+ * Throws if the hook throws — this is the rejection mechanism.
+ */
+export declare function runBefore<C>(hook: BeforeHook<C> | null, ctx: C): Promise<C>;
+/**
+ * Run an after-hook. The result is passed as read-only context.
+ * After-hooks cannot modify the result.
+ */
+export declare function runAfter<C>(hook: AfterHook<C> | null, ctx: C, result: unknown): Promise<void>;
+//# sourceMappingURL=hooks.d.ts.map

package/esm/deps/jsr.io/@bandeira-tech/b3nd-core/0.22.0/src/rig/hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../../../../../../../src/deps/jsr.io/@bandeira-tech/b3nd-core/0.22.0/src/rig/hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAI1E;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,kCAAkC;AAClC,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAID;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,CAC1B,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,KACb,IAAI,GAAG;IAAE,GAAG,EAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,GAAG;IAAE,GAAG,EAAE,CAAC,CAAA;CAAE,CAAC,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,CACzB,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,EAChB,MAAM,EAAE,OAAO,KACZ,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAI1B,gDAAgD;AAChD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAErE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,gEAAgE;IAChE,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;IACxC,oDAAoD;IACpD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,oCAAoC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC;IACjC,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,QAAQ,CAAC,YAAY,CAAC,KACxB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAI1B,mEAAmE;AACnE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC9C,QAAQ,CAAC,aAAa,EAAE,UAAU,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACtD,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACpD,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;CACtC;AAED,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,SAAS,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,aAAa,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IACvC,YAAY,CAAC,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IACrC,UAAU,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,SAAS,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,6DAA6D;IAC7D,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAID,uCAAuC;AACvC,wBAAgB,YAAY,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,QAAQ,CAU3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf;AAID;;;GAGG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAC/B,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,EAC1B,GAAG,EAAE,CAAC,GACL,OAAO,CAAC,CAAC,CAAC,CAOZ;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,CAAC,EAC9B,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,EACzB,GAAG,EAAE,CAAC,EACN,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,IAAI,CAAC,CAGf"}

package/esm/deps/jsr.io/@bandeira-tech/b3nd-core/0.22.0/src/rig/hooks.js

@@ -0,0 +1,67 @@
+/**
+ * @module
+ * Hook types and runners for the Rig.
+ *
+ * Security model:
+ * - Before-hooks THROW to reject an operation. The caller must catch explicitly.
+ *   No silent aborts — if validation fails, it's an exception.
+ * - After-hooks OBSERVE but cannot modify the result.
+ *   They can throw if a post-condition is violated.
+ * - Hooks are immutable after init. Want different hooks? Create a new rig.
+ * - One function per hook. Need composition? Compose on your end.
+ *
+ * Pure module — no Rig dependency, testable in isolation.
+ */
+// ── Factory ──
+/** Create frozen hooks from config. */
+export function resolveHooks(config) {
+    return Object.freeze({
+        beforeSend: config?.beforeSend ?? null,
+        afterSend: config?.afterSend ?? null,
+        beforeReceive: config?.beforeReceive ?? null,
+        afterReceive: config?.afterReceive ?? null,
+        beforeRead: config?.beforeRead ?? null,
+        afterRead: config?.afterRead ?? null,
+        onError: config?.onError ?? null,
+    });
+}
+/**
+ * Run the onError hook with a given context. Returns `true` if the
+ * hook threw — the caller is expected to propagate the throw and
+ * abort the operation. Returns `false` if the hook returned normally
+ * (or there is no hook installed) — the caller proceeds with normal
+ * error handling.
+ *
+ * The hook's own throw is re-thrown by this runner so the call site
+ * sees it. Returning `true` here is just a convenience for call sites
+ * that want to branch.
+ */
+export async function runOnError(hook, ctx) {
+    if (!hook)
+        return;
+    // Hook may be sync or return a promise. Await it; throws propagate.
+    await hook(ctx);
+}
+// ── Runners ──
+/**
+ * Run a before-hook. Returns the (possibly replaced) context.
+ * Throws if the hook throws — this is the rejection mechanism.
+ */
+export async function runBefore(hook, ctx) {
+    if (!hook)
+        return ctx;
+    const result = await hook(ctx);
+    if (result != null && typeof result === "object" && "ctx" in result) {
+        return result.ctx;
+    }
+    return ctx;
+}
+/**
+ * Run an after-hook. The result is passed as read-only context.
+ * After-hooks cannot modify the result.
+ */
+export async function runAfter(hook, ctx, result) {
+    if (!hook)
+        return;
+    await hook(ctx, result);
+}

package/esm/deps/jsr.io/@bandeira-tech/b3nd-core/0.22.0/src/rig/identity.d.ts

@@ -0,0 +1,99 @@
+/**
+ * @module
+ * Identity — unified keypair bundle for b3nd.
+ *
+ * Wraps Ed25519 signing + X25519 encryption into a single object.
+ * Deterministic derivation from seed, or fresh random generation.
+ */
+import { type AuthenticatedMessage, type EncryptedPayload } from "../encrypt/mod.js";
+/**
+ * Portable identity data — JSON-serializable for persistence.
+ *
+ * Store this in localStorage, a file, or a database to restore
+ * a full signing+encryption identity across sessions.
+ */
+export interface ExportedIdentity {
+    /** Ed25519 public key hex. */
+    signingPublicKeyHex: string;
+    /** Ed25519 private key hex (PKCS8). Present only for full identities. */
+    signingPrivateKeyHex?: string;
+    /** X25519 public encryption key hex. */
+    encryptionPublicKeyHex: string;
+    /** X25519 private encryption key hex (PKCS8). Present only for full identities. */
+    encryptionPrivateKeyHex?: string;
+}
+/**
+ * Identity bundles signing (Ed25519) and encryption (X25519) keypairs.
+ *
+ * It can be created with full private keys (for signing/decrypting)
+ * or as a public-only identity (for addressing/encrypting to others).
+ */
+export declare class Identity {
+    /** Ed25519 public key hex — the user's address on the network. */
+    readonly pubkey: string;
+    /** X25519 public encryption key hex. */
+    readonly encryptionPubkey: string;
+    /** Whether this identity has a signing private key (can sign messages). */
+    readonly canSign: boolean;
+    /** Whether this identity has an encryption private key (can decrypt). */
+    readonly canEncrypt: boolean;
+    private readonly _signingPrivateKey;
+    private readonly _encryptionPrivateKey;
+    private constructor();
+    /** Generate a fresh random identity. */
+    static generate(): Promise<Identity>;
+    /** Derive a deterministic identity from a seed string. */
+    static fromSeed(seed: string): Promise<Identity>;
+    /** Create identity from an Ed25519 PEM private key. */
+    static fromPem(signingPem: string, pubkeyHex: string, encryptionPrivateKeyHex?: string, encryptionPublicKeyHex?: string): Promise<Identity>;
+    /** Create a public-only identity (for addressing others). Cannot sign or decrypt. */
+    static publicOnly(keys: {
+        signing: string;
+        encryption?: string;
+    }): Identity;
+    /**
+     * Reconstruct an Identity from exported data.
+     *
+     * @example Persist across browser sessions
+     * ```typescript
+     * // Save
+     * const exported = await identity.export();
+     * localStorage.setItem("b3nd-id", JSON.stringify(exported));
+     *
+     * // Restore
+     * const saved = JSON.parse(localStorage.getItem("b3nd-id")!);
+     * const identity = await Identity.fromExport(saved);
+     * ```
+     */
+    static fromExport(data: ExportedIdentity): Promise<Identity>;
+    /** Sign a payload — returns `{ pubkey, signature }` auth entry. */
+    sign(payload: unknown): Promise<{
+        pubkey: string;
+        signature: string;
+    }>;
+    /** Wrap a payload into an AuthenticatedMessage with this identity's signature. */
+    signMessage<T>(payload: T): Promise<AuthenticatedMessage<T>>;
+    /** Verify a signature against this identity's public key. */
+    verify(payload: unknown, signature: string): Promise<boolean>;
+    /** Encrypt data for a recipient's public encryption key. */
+    encrypt(data: Uint8Array, recipientEncPubkeyHex: string): Promise<EncryptedPayload>;
+    /** Decrypt data sent to this identity. */
+    decrypt(payload: EncryptedPayload): Promise<Uint8Array>;
+    /**
+     * Export this identity to a JSON-serializable object.
+     *
+     * For full identities (with private keys), exports everything needed
+     * to reconstruct the identity later via `Identity.fromExport()`.
+     * For public-only identities, only public keys are exported.
+     */
+    export(): Promise<ExportedIdentity>;
+    /**
+     * Get the signer object for use with managed-node and other APIs
+     * that expect `{ privateKey: CryptoKey; publicKeyHex: string }`.
+     */
+    get signer(): {
+        privateKey: CryptoKey;
+        publicKeyHex: string;
+    };
+}
+//# sourceMappingURL=identity.d.ts.map

package/esm/deps/jsr.io/@bandeira-tech/b3nd-core/0.22.0/src/rig/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../../../../../src/deps/jsr.io/@bandeira-tech/b3nd-core/0.22.0/src/rig/identity.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,KAAK,oBAAoB,EAMzB,KAAK,gBAAgB,EAMtB,MAAM,mBAAmB,CAAC;AAG3B;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yEAAyE;IACzE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wCAAwC;IACxC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,mFAAmF;IACnF,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;GAKG;AACH,qBAAa,QAAQ;IACnB,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAE7B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAmB;IACtD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAmB;IAEzD,OAAO;IAgBP,wCAAwC;WAC3B,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IAW1C,0DAA0D;WAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAWtD,uDAAuD;WAC1C,OAAO,CAClB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,uBAAuB,CAAC,EAAE,MAAM,EAChC,sBAAsB,CAAC,EAAE,MAAM,GAC9B,OAAO,CAAC,QAAQ,CAAC;IAwCpB,qFAAqF;IACrF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,QAAQ;IASZ;;;;;;;;;;;;;OAaG;WACU,UAAU,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAoClE,mEAAmE;IAC7D,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAQ5E,kFAAkF;IAClF,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAY5D,6DAA6D;IAC7D,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7D,4DAA4D;IAC5D,OAAO,CACL,IAAI,EAAE,UAAU,EAChB,qBAAqB,EAAE,MAAM,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAI5B,0CAA0C;IAC1C,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;IASvD;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAyBzC;;;OAGG;IACH,IAAI,MAAM,IAAI;QAAE,UAAU,EAAE,SAAS,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAQ5D;CACF"}

package/esm/deps/jsr.io/@bandeira-tech/b3nd-core/0.22.0/src/rig/identity.js

@@ -0,0 +1,190 @@
+/**
+ * @module
+ * Identity — unified keypair bundle for b3nd.
+ *
+ * Wraps Ed25519 signing + X25519 encryption into a single object.
+ * Deterministic derivation from seed, or fresh random generation.
+ */
+import { createAuthenticatedMessage, decrypt as asymDecrypt, deriveEncryptionKeyPairFromSeed, deriveSigningKeyPairFromSeed, encrypt as asymEncrypt, generateEncryptionKeyPair, generateSigningKeyPair, pemToCryptoKey, sign as edSign, verify as edVerify, } from "../encrypt/mod.js";
+import { decodeHex, encodeHex } from "../encoding/encoding.js";
+/**
+ * Identity bundles signing (Ed25519) and encryption (X25519) keypairs.
+ *
+ * It can be created with full private keys (for signing/decrypting)
+ * or as a public-only identity (for addressing/encrypting to others).
+ */
+export class Identity {
+    /** Ed25519 public key hex — the user's address on the network. */
+    pubkey;
+    /** X25519 public encryption key hex. */
+    encryptionPubkey;
+    /** Whether this identity has a signing private key (can sign messages). */
+    canSign;
+    /** Whether this identity has an encryption private key (can decrypt). */
+    canEncrypt;
+    _signingPrivateKey;
+    _encryptionPrivateKey;
+    constructor(opts) {
+        this.pubkey = opts.pubkey;
+        this.encryptionPubkey = opts.encryptionPubkey;
+        this._signingPrivateKey = opts.signingPrivateKey;
+        this._encryptionPrivateKey = opts.encryptionPrivateKey;
+        this.canSign = opts.signingPrivateKey !== null;
+        this.canEncrypt = opts.encryptionPrivateKey !== null;
+    }
+    // ── Factory methods ──
+    /** Generate a fresh random identity. */
+    static async generate() {
+        const signing = await generateSigningKeyPair();
+        const encryption = await generateEncryptionKeyPair();
+        return new Identity({
+            pubkey: signing.publicKeyHex,
+            encryptionPubkey: encryption.publicKeyHex,
+            signingPrivateKey: signing.privateKey,
+            encryptionPrivateKey: encryption.privateKey,
+        });
+    }
+    /** Derive a deterministic identity from a seed string. */
+    static async fromSeed(seed) {
+        const signing = await deriveSigningKeyPairFromSeed(seed);
+        const encryption = await deriveEncryptionKeyPairFromSeed(seed);
+        return new Identity({
+            pubkey: signing.publicKeyHex,
+            encryptionPubkey: encryption.publicKeyHex,
+            signingPrivateKey: signing.privateKey,
+            encryptionPrivateKey: encryption.privateKey,
+        });
+    }
+    /** Create identity from an Ed25519 PEM private key. */
+    static async fromPem(signingPem, pubkeyHex, encryptionPrivateKeyHex, encryptionPublicKeyHex) {
+        const signingPrivateKey = await pemToCryptoKey(signingPem, "Ed25519");
+        let encPrivKey = null;
+        let encPubHex = encryptionPublicKeyHex || "";
+        if (encryptionPrivateKeyHex) {
+            const privBytes = decodeHex(encryptionPrivateKeyHex).buffer;
+            encPrivKey = await crypto.subtle.importKey("pkcs8", privBytes, { name: "X25519", namedCurve: "X25519" }, true, ["deriveBits"]);
+            if (!encPubHex) {
+                // Derive public from private via JWK round-trip
+                const jwk = await crypto.subtle.exportKey("jwk", encPrivKey);
+                const pub = await crypto.subtle.importKey("jwk", { kty: jwk.kty, crv: jwk.crv, x: jwk.x, key_ops: [] }, { name: "X25519", namedCurve: "X25519" }, true, []);
+                encPubHex = encodeHex(new Uint8Array(await crypto.subtle.exportKey("raw", pub)));
+            }
+        }
+        return new Identity({
+            pubkey: pubkeyHex,
+            encryptionPubkey: encPubHex,
+            signingPrivateKey,
+            encryptionPrivateKey: encPrivKey,
+        });
+    }
+    /** Create a public-only identity (for addressing others). Cannot sign or decrypt. */
+    static publicOnly(keys) {
+        return new Identity({
+            pubkey: keys.signing,
+            encryptionPubkey: keys.encryption || "",
+            signingPrivateKey: null,
+            encryptionPrivateKey: null,
+        });
+    }
+    /**
+     * Reconstruct an Identity from exported data.
+     *
+     * @example Persist across browser sessions
+     * ```typescript
+     * // Save
+     * const exported = await identity.export();
+     * localStorage.setItem("b3nd-id", JSON.stringify(exported));
+     *
+     * // Restore
+     * const saved = JSON.parse(localStorage.getItem("b3nd-id")!);
+     * const identity = await Identity.fromExport(saved);
+     * ```
+     */
+    static async fromExport(data) {
+        let signingPrivateKey = null;
+        let encryptionPrivateKey = null;
+        if (data.signingPrivateKeyHex) {
+            const pkcs8Bytes = decodeHex(data.signingPrivateKeyHex);
+            signingPrivateKey = await crypto.subtle.importKey("pkcs8", pkcs8Bytes.buffer, { name: "Ed25519", namedCurve: "Ed25519" }, true, ["sign"]);
+        }
+        if (data.encryptionPrivateKeyHex) {
+            const pkcs8Bytes = decodeHex(data.encryptionPrivateKeyHex);
+            encryptionPrivateKey = await crypto.subtle.importKey("pkcs8", pkcs8Bytes.buffer, { name: "X25519", namedCurve: "X25519" }, true, ["deriveBits"]);
+        }
+        return new Identity({
+            pubkey: data.signingPublicKeyHex,
+            encryptionPubkey: data.encryptionPublicKeyHex,
+            signingPrivateKey,
+            encryptionPrivateKey,
+        });
+    }
+    // ── Operations ──
+    /** Sign a payload — returns `{ pubkey, signature }` auth entry. */
+    async sign(payload) {
+        if (!this._signingPrivateKey) {
+            throw new Error("Cannot sign: this is a public-only identity");
+        }
+        const signature = await edSign(this._signingPrivateKey, payload);
+        return { pubkey: this.pubkey, signature };
+    }
+    /** Wrap a payload into an AuthenticatedMessage with this identity's signature. */
+    signMessage(payload) {
+        if (!this._signingPrivateKey) {
+            return Promise.reject(new Error("Cannot sign: this is a public-only identity"));
+        }
+        return createAuthenticatedMessage(payload, [{
+                privateKey: this._signingPrivateKey,
+                publicKeyHex: this.pubkey,
+            }]);
+    }
+    /** Verify a signature against this identity's public key. */
+    verify(payload, signature) {
+        return edVerify(this.pubkey, signature, payload);
+    }
+    /** Encrypt data for a recipient's public encryption key. */
+    encrypt(data, recipientEncPubkeyHex) {
+        return asymEncrypt(data, recipientEncPubkeyHex);
+    }
+    /** Decrypt data sent to this identity. */
+    decrypt(payload) {
+        if (!this._encryptionPrivateKey) {
+            return Promise.reject(new Error("Cannot decrypt: no encryption private key"));
+        }
+        return asymDecrypt(payload, this._encryptionPrivateKey);
+    }
+    /**
+     * Export this identity to a JSON-serializable object.
+     *
+     * For full identities (with private keys), exports everything needed
+     * to reconstruct the identity later via `Identity.fromExport()`.
+     * For public-only identities, only public keys are exported.
+     */
+    async export() {
+        const result = {
+            signingPublicKeyHex: this.pubkey,
+            encryptionPublicKeyHex: this.encryptionPubkey,
+        };
+        if (this._signingPrivateKey) {
+            const pkcs8 = await crypto.subtle.exportKey("pkcs8", this._signingPrivateKey);
+            result.signingPrivateKeyHex = encodeHex(new Uint8Array(pkcs8));
+        }
+        if (this._encryptionPrivateKey) {
+            const pkcs8 = await crypto.subtle.exportKey("pkcs8", this._encryptionPrivateKey);
+            result.encryptionPrivateKeyHex = encodeHex(new Uint8Array(pkcs8));
+        }
+        return result;
+    }
+    /**
+     * Get the signer object for use with managed-node and other APIs
+     * that expect `{ privateKey: CryptoKey; publicKeyHex: string }`.
+     */
+    get signer() {
+        if (!this._signingPrivateKey) {
+            throw new Error("Cannot get signer: this is a public-only identity");
+        }
+        return {
+            privateKey: this._signingPrivateKey,
+            publicKeyHex: this.pubkey,
+        };
+    }
+}