@brightchain/brightchain-api-lib 0.14.0 → 0.15.0

package/src/lib/encryption/poolEncryptionService.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Pool Encryption Service — Node.js implementation of pool-level encryption.
+ *
+ * Supports two encryption modes:
+ * - Node-specific: ECIES encrypt/decrypt using the node's secp256k1 key pair
+ * - Pool-shared: AES-256-GCM with a shared symmetric key, distributed per-member via ECIES
+ *
+ * Block IDs are computed from ciphertext (not plaintext) so Bloom filters
+ * and block lookups work correctly on encrypted pools.
+ *
+ * ECIES scheme:
+ *   1. Generate ephemeral secp256k1 key pair
+ *   2. Derive shared secret via ECDH with recipient's public key
+ *   3. Derive AES-256 key from shared secret using HKDF-SHA256
+ *   4. Encrypt with AES-256-GCM (random 12-byte IV)
+ *   5. Output: ephemeral public key (33 bytes) + IV (12 bytes) + auth tag (16 bytes) + ciphertext
+ *
+ * @see Requirements 14.2, 14.3, 14.5
+ */
+export declare class PoolEncryptionService {
+    /**
+     * Encrypt data using ECIES with the recipient's secp256k1 public key.
+     *
+     * @param data - Plaintext data to encrypt
+     * @param publicKey - Recipient's secp256k1 public key (33 or 65 bytes)
+     * @returns Ciphertext: ephemeralPubKey (33) + IV (12) + authTag (16) + encrypted data
+     */
+    encryptNodeSpecific(data: Uint8Array, publicKey: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Decrypt ECIES-encrypted data using the recipient's secp256k1 private key.
+     *
+     * @param ciphertext - Output from encryptNodeSpecific
+     * @param privateKey - Recipient's raw 32-byte secp256k1 private key
+     * @returns Decrypted plaintext
+     */
+    decryptNodeSpecific(ciphertext: Uint8Array, privateKey: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Encrypt data using AES-256-GCM with the shared pool key.
+     *
+     * @param data - Plaintext data to encrypt
+     * @param sharedKey - 32-byte (256-bit) symmetric pool key
+     * @returns Ciphertext: IV (12 bytes) + authTag (16 bytes) + encrypted data
+     */
+    encryptPoolShared(data: Uint8Array, sharedKey: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Decrypt AES-256-GCM-encrypted data using the shared pool key.
+     *
+     * @param ciphertext - Output from encryptPoolShared
+     * @param sharedKey - 32-byte (256-bit) symmetric pool key
+     * @returns Decrypted plaintext
+     */
+    decryptPoolShared(ciphertext: Uint8Array, sharedKey: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Compute a block ID from ciphertext using SHA-256.
+     * Per Requirement 14.5, block IDs are hashes of encrypted data, not plaintext.
+     *
+     * @param ciphertext - Encrypted block data
+     * @returns Hex-encoded SHA-256 hash
+     */
+    computeBlockId(ciphertext: Uint8Array): string;
+    /**
+     * Generate a random 256-bit symmetric key for pool-shared encryption.
+     *
+     * @returns 32-byte random key
+     */
+    generatePoolKey(): Uint8Array;
+    /**
+     * Encrypt a pool key for a specific member using ECIES.
+     * Used during key distribution for pool-shared encryption.
+     *
+     * @param poolKey - The 32-byte symmetric pool key
+     * @param memberPublicKey - Member's secp256k1 public key (33 or 65 bytes)
+     * @returns ECIES-encrypted pool key
+     */
+    encryptKeyForMember(poolKey: Uint8Array, memberPublicKey: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Decrypt a pool key that was encrypted for this member.
+     *
+     * @param encryptedKey - ECIES-encrypted pool key (from encryptKeyForMember)
+     * @param memberPrivateKey - Member's raw 32-byte secp256k1 private key
+     * @returns The 32-byte symmetric pool key
+     */
+    decryptKeyForMember(encryptedKey: Uint8Array, memberPrivateKey: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Derive a 256-bit AES key from a shared secret using HKDF-SHA256.
+     */
+    private hkdfDeriveKey;
+    /**
+     * Ensure a secp256k1 public key is in uncompressed (65-byte) format.
+     * Accepts compressed (33 bytes) or uncompressed (65 bytes) input.
+     */
+    private ensureUncompressed;
+}
+//# sourceMappingURL=poolEncryptionService.d.ts.map

package/src/lib/encryption/poolEncryptionService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"poolEncryptionService.d.ts","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/encryption/poolEncryptionService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAYH,qBAAa,qBAAqB;IAGhC;;;;;;OAMG;IACG,mBAAmB,CACvB,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,UAAU,CAAC;IAiDtB;;;;;;OAMG;IACG,mBAAmB,CACvB,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,UAAU,CAAC;IAsDtB;;;;;;OAMG;IACG,iBAAiB,CACrB,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,UAAU,CAAC;IAmCtB;;;;;;OAMG;IACG,iBAAiB,CACrB,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,UAAU,CAAC;IAwCtB;;;;;;OAMG;IACH,cAAc,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM;IAO9C;;;;OAIG;IACH,eAAe,IAAI,UAAU;IAI7B;;;;;;;OAOG;IACG,mBAAmB,CACvB,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,UAAU,GAC1B,OAAO,CAAC,UAAU,CAAC;IAItB;;;;;;OAMG;IACG,mBAAmB,CACvB,YAAY,EAAE,UAAU,EACxB,gBAAgB,EAAE,UAAU,GAC3B,OAAO,CAAC,UAAU,CAAC;IAMtB;;OAEG;IACH,OAAO,CAAC,aAAa;IAWrB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;CAoB3B"}

package/src/lib/encryption/poolEncryptionService.js

@@ -0,0 +1,252 @@
+"use strict";
+/**
+ * Pool Encryption Service — Node.js implementation of pool-level encryption.
+ *
+ * Supports two encryption modes:
+ * - Node-specific: ECIES encrypt/decrypt using the node's secp256k1 key pair
+ * - Pool-shared: AES-256-GCM with a shared symmetric key, distributed per-member via ECIES
+ *
+ * Block IDs are computed from ciphertext (not plaintext) so Bloom filters
+ * and block lookups work correctly on encrypted pools.
+ *
+ * ECIES scheme:
+ *   1. Generate ephemeral secp256k1 key pair
+ *   2. Derive shared secret via ECDH with recipient's public key
+ *   3. Derive AES-256 key from shared secret using HKDF-SHA256
+ *   4. Encrypt with AES-256-GCM (random 12-byte IV)
+ *   5. Output: ephemeral public key (33 bytes) + IV (12 bytes) + auth tag (16 bytes) + ciphertext
+ *
+ * @see Requirements 14.2, 14.3, 14.5
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PoolEncryptionService = void 0;
+const tslib_1 = require("tslib");
+const crypto = tslib_1.__importStar(require("crypto"));
+const errors_1 = require("./errors");
+/** Byte lengths for ECIES wire format components */
+const COMPRESSED_PUBLIC_KEY_LENGTH = 33;
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+const AES_KEY_LENGTH = 32; // 256 bits
+const HKDF_INFO = Buffer.from('brightchain-ecies-v1');
+class PoolEncryptionService {
+    // ─── Node-Specific (ECIES) ───────────────────────────────────────────
+    /**
+     * Encrypt data using ECIES with the recipient's secp256k1 public key.
+     *
+     * @param data - Plaintext data to encrypt
+     * @param publicKey - Recipient's secp256k1 public key (33 or 65 bytes)
+     * @returns Ciphertext: ephemeralPubKey (33) + IV (12) + authTag (16) + encrypted data
+     */
+    async encryptNodeSpecific(data, publicKey) {
+        try {
+            const recipientKey = this.ensureUncompressed(publicKey);
+            // Generate ephemeral key pair
+            const ephemeral = crypto.createECDH('secp256k1');
+            ephemeral.generateKeys();
+            const ephemeralPublicKey = ephemeral.getPublicKey(undefined, 'compressed');
+            // Derive shared secret via ECDH
+            const sharedSecret = ephemeral.computeSecret(recipientKey);
+            // Derive AES key via HKDF
+            const aesKey = this.hkdfDeriveKey(sharedSecret);
+            // Encrypt with AES-256-GCM
+            const iv = crypto.randomBytes(IV_LENGTH);
+            const cipher = crypto.createCipheriv('aes-256-gcm', aesKey, iv);
+            const encrypted = Buffer.concat([
+                cipher.update(Buffer.from(data)),
+                cipher.final(),
+            ]);
+            const authTag = cipher.getAuthTag();
+            // Pack: ephemeralPubKey + IV + authTag + ciphertext
+            const result = new Uint8Array(COMPRESSED_PUBLIC_KEY_LENGTH +
+                IV_LENGTH +
+                AUTH_TAG_LENGTH +
+                encrypted.length);
+            result.set(ephemeralPublicKey, 0);
+            result.set(iv, COMPRESSED_PUBLIC_KEY_LENGTH);
+            result.set(authTag, COMPRESSED_PUBLIC_KEY_LENGTH + IV_LENGTH);
+            result.set(encrypted, COMPRESSED_PUBLIC_KEY_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH);
+            return result;
+        }
+        catch (err) {
+            if (err instanceof errors_1.EncryptionError)
+                throw err;
+            throw new errors_1.EncryptionError('ECIES encryption failed', err);
+        }
+    }
+    /**
+     * Decrypt ECIES-encrypted data using the recipient's secp256k1 private key.
+     *
+     * @param ciphertext - Output from encryptNodeSpecific
+     * @param privateKey - Recipient's raw 32-byte secp256k1 private key
+     * @returns Decrypted plaintext
+     */
+    async decryptNodeSpecific(ciphertext, privateKey) {
+        const minLength = COMPRESSED_PUBLIC_KEY_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH;
+        if (ciphertext.length < minLength) {
+            throw new errors_1.DecryptionError(`ECIES ciphertext too short: expected at least ${minLength} bytes, got ${ciphertext.length}`);
+        }
+        try {
+            // Unpack components
+            const ephemeralPubKey = ciphertext.slice(0, COMPRESSED_PUBLIC_KEY_LENGTH);
+            const iv = ciphertext.slice(COMPRESSED_PUBLIC_KEY_LENGTH, COMPRESSED_PUBLIC_KEY_LENGTH + IV_LENGTH);
+            const authTag = ciphertext.slice(COMPRESSED_PUBLIC_KEY_LENGTH + IV_LENGTH, COMPRESSED_PUBLIC_KEY_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH);
+            const encryptedData = ciphertext.slice(COMPRESSED_PUBLIC_KEY_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH);
+            // Reconstruct shared secret
+            const ecdh = crypto.createECDH('secp256k1');
+            ecdh.setPrivateKey(Buffer.from(privateKey));
+            const ephemeralUncompressed = this.ensureUncompressed(ephemeralPubKey);
+            const sharedSecret = ecdh.computeSecret(ephemeralUncompressed);
+            // Derive AES key via HKDF
+            const aesKey = this.hkdfDeriveKey(sharedSecret);
+            // Decrypt with AES-256-GCM
+            const decipher = crypto.createDecipheriv('aes-256-gcm', aesKey, Buffer.from(iv));
+            decipher.setAuthTag(Buffer.from(authTag));
+            const decrypted = Buffer.concat([
+                decipher.update(Buffer.from(encryptedData)),
+                decipher.final(),
+            ]);
+            return new Uint8Array(decrypted);
+        }
+        catch (err) {
+            if (err instanceof errors_1.DecryptionError)
+                throw err;
+            throw new errors_1.DecryptionError('ECIES decryption failed', err);
+        }
+    }
+    // ─── Pool-Shared (AES-256-GCM) ──────────────────────────────────────
+    /**
+     * Encrypt data using AES-256-GCM with the shared pool key.
+     *
+     * @param data - Plaintext data to encrypt
+     * @param sharedKey - 32-byte (256-bit) symmetric pool key
+     * @returns Ciphertext: IV (12 bytes) + authTag (16 bytes) + encrypted data
+     */
+    async encryptPoolShared(data, sharedKey) {
+        if (sharedKey.length !== AES_KEY_LENGTH) {
+            throw new errors_1.EncryptionError(`Invalid shared key length: expected ${AES_KEY_LENGTH} bytes, got ${sharedKey.length}`);
+        }
+        try {
+            const iv = crypto.randomBytes(IV_LENGTH);
+            const cipher = crypto.createCipheriv('aes-256-gcm', Buffer.from(sharedKey), iv);
+            const encrypted = Buffer.concat([
+                cipher.update(Buffer.from(data)),
+                cipher.final(),
+            ]);
+            const authTag = cipher.getAuthTag();
+            // Pack: IV + authTag + ciphertext
+            const result = new Uint8Array(IV_LENGTH + AUTH_TAG_LENGTH + encrypted.length);
+            result.set(iv, 0);
+            result.set(authTag, IV_LENGTH);
+            result.set(encrypted, IV_LENGTH + AUTH_TAG_LENGTH);
+            return result;
+        }
+        catch (err) {
+            if (err instanceof errors_1.EncryptionError)
+                throw err;
+            throw new errors_1.EncryptionError('AES-256-GCM encryption failed', err);
+        }
+    }
+    /**
+     * Decrypt AES-256-GCM-encrypted data using the shared pool key.
+     *
+     * @param ciphertext - Output from encryptPoolShared
+     * @param sharedKey - 32-byte (256-bit) symmetric pool key
+     * @returns Decrypted plaintext
+     */
+    async decryptPoolShared(ciphertext, sharedKey) {
+        if (sharedKey.length !== AES_KEY_LENGTH) {
+            throw new errors_1.DecryptionError(`Invalid shared key length: expected ${AES_KEY_LENGTH} bytes, got ${sharedKey.length}`);
+        }
+        const minLength = IV_LENGTH + AUTH_TAG_LENGTH;
+        if (ciphertext.length < minLength) {
+            throw new errors_1.DecryptionError(`AES-256-GCM ciphertext too short: expected at least ${minLength} bytes, got ${ciphertext.length}`);
+        }
+        try {
+            // Unpack components
+            const iv = ciphertext.slice(0, IV_LENGTH);
+            const authTag = ciphertext.slice(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
+            const encryptedData = ciphertext.slice(IV_LENGTH + AUTH_TAG_LENGTH);
+            const decipher = crypto.createDecipheriv('aes-256-gcm', Buffer.from(sharedKey), Buffer.from(iv));
+            decipher.setAuthTag(Buffer.from(authTag));
+            const decrypted = Buffer.concat([
+                decipher.update(Buffer.from(encryptedData)),
+                decipher.final(),
+            ]);
+            return new Uint8Array(decrypted);
+        }
+        catch (err) {
+            if (err instanceof errors_1.DecryptionError)
+                throw err;
+            throw new errors_1.DecryptionError('AES-256-GCM decryption failed', err);
+        }
+    }
+    // ─── Block ID & Key Management ──────────────────────────────────────
+    /**
+     * Compute a block ID from ciphertext using SHA-256.
+     * Per Requirement 14.5, block IDs are hashes of encrypted data, not plaintext.
+     *
+     * @param ciphertext - Encrypted block data
+     * @returns Hex-encoded SHA-256 hash
+     */
+    computeBlockId(ciphertext) {
+        return crypto
+            .createHash('sha256')
+            .update(Buffer.from(ciphertext))
+            .digest('hex');
+    }
+    /**
+     * Generate a random 256-bit symmetric key for pool-shared encryption.
+     *
+     * @returns 32-byte random key
+     */
+    generatePoolKey() {
+        return new Uint8Array(crypto.randomBytes(AES_KEY_LENGTH));
+    }
+    /**
+     * Encrypt a pool key for a specific member using ECIES.
+     * Used during key distribution for pool-shared encryption.
+     *
+     * @param poolKey - The 32-byte symmetric pool key
+     * @param memberPublicKey - Member's secp256k1 public key (33 or 65 bytes)
+     * @returns ECIES-encrypted pool key
+     */
+    async encryptKeyForMember(poolKey, memberPublicKey) {
+        return this.encryptNodeSpecific(poolKey, memberPublicKey);
+    }
+    /**
+     * Decrypt a pool key that was encrypted for this member.
+     *
+     * @param encryptedKey - ECIES-encrypted pool key (from encryptKeyForMember)
+     * @param memberPrivateKey - Member's raw 32-byte secp256k1 private key
+     * @returns The 32-byte symmetric pool key
+     */
+    async decryptKeyForMember(encryptedKey, memberPrivateKey) {
+        return this.decryptNodeSpecific(encryptedKey, memberPrivateKey);
+    }
+    // ─── Private Helpers ────────────────────────────────────────────────
+    /**
+     * Derive a 256-bit AES key from a shared secret using HKDF-SHA256.
+     */
+    hkdfDeriveKey(sharedSecret) {
+        const derived = crypto.hkdfSync('sha256', sharedSecret, Buffer.alloc(0), // no salt
+        HKDF_INFO, AES_KEY_LENGTH);
+        return Buffer.from(derived);
+    }
+    /**
+     * Ensure a secp256k1 public key is in uncompressed (65-byte) format.
+     * Accepts compressed (33 bytes) or uncompressed (65 bytes) input.
+     */
+    ensureUncompressed(publicKey) {
+        if (publicKey.length === 65 && publicKey[0] === 0x04) {
+            return Buffer.from(publicKey);
+        }
+        if (publicKey.length === 33 &&
+            (publicKey[0] === 0x02 || publicKey[0] === 0x03)) {
+            return crypto.ECDH.convertKey(Buffer.from(publicKey), 'secp256k1', undefined, undefined, 'uncompressed');
+        }
+        throw new errors_1.EncryptionError(`Invalid secp256k1 public key: expected 33 or 65 bytes, got ${publicKey.length}`);
+    }
+}
+exports.PoolEncryptionService = PoolEncryptionService;
+//# sourceMappingURL=poolEncryptionService.js.map

package/src/lib/encryption/poolEncryptionService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"poolEncryptionService.js","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/encryption/poolEncryptionService.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;;AAEH,uDAAiC;AACjC,qCAA4D;AAE5D,oDAAoD;AACpD,MAAM,4BAA4B,GAAG,EAAE,CAAC;AACxC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,cAAc,GAAG,EAAE,CAAC,CAAC,WAAW;AACtC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAEtD,MAAa,qBAAqB;IAChC,wEAAwE;IAExE;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CACvB,IAAgB,EAChB,SAAqB;QAErB,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAExD,8BAA8B;YAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACjD,SAAS,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,kBAAkB,GAAG,SAAS,CAAC,YAAY,CAC/C,SAAS,EACT,YAAY,CACb,CAAC;YAEF,gCAAgC;YAChC,MAAM,YAAY,GAAG,SAAS,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAE3D,0BAA0B;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAEhD,2BAA2B;YAC3B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAChE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChC,MAAM,CAAC,KAAK,EAAE;aACf,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAEpC,oDAAoD;YACpD,MAAM,MAAM,GAAG,IAAI,UAAU,CAC3B,4BAA4B;gBAC1B,SAAS;gBACT,eAAe;gBACf,SAAS,CAAC,MAAM,CACnB,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,4BAA4B,CAAC,CAAC;YAC7C,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,4BAA4B,GAAG,SAAS,CAAC,CAAC;YAC9D,MAAM,CAAC,GAAG,CACR,SAAS,EACT,4BAA4B,GAAG,SAAS,GAAG,eAAe,CAC3D,CAAC;YAEF,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,wBAAe;gBAAE,MAAM,GAAG,CAAC;YAC9C,MAAM,IAAI,wBAAe,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CACvB,UAAsB,EACtB,UAAsB;QAEtB,MAAM,SAAS,GACb,4BAA4B,GAAG,SAAS,GAAG,eAAe,CAAC;QAC7D,IAAI,UAAU,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,wBAAe,CACvB,iDAAiD,SAAS,eAAe,UAAU,CAAC,MAAM,EAAE,CAC7F,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,oBAAoB;YACpB,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC;YAC1E,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CACzB,4BAA4B,EAC5B,4BAA4B,GAAG,SAAS,CACzC,CAAC;YACF,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAC9B,4BAA4B,GAAG,SAAS,EACxC,4BAA4B,GAAG,SAAS,GAAG,eAAe,CAC3D,CAAC;YACF,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CACpC,4BAA4B,GAAG,SAAS,GAAG,eAAe,CAC3D,CAAC;YAEF,4BAA4B;YAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAC5C,MAAM,qBAAqB,GAAG,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;YACvE,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC;YAE/D,0BAA0B;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAEhD,2BAA2B;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CACtC,aAAa,EACb,MAAM,EACN,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAChB,CAAC;YACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC3C,QAAQ,CAAC,KAAK,EAAE;aACjB,CAAC,CAAC;YAEH,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,wBAAe;gBAAE,MAAM,GAAG,CAAC;YAC9C,MAAM,IAAI,wBAAe,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,uEAAuE;IAEvE;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CACrB,IAAgB,EAChB,SAAqB;QAErB,IAAI,SAAS,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACxC,MAAM,IAAI,wBAAe,CACvB,uCAAuC,cAAc,eAAe,SAAS,CAAC,MAAM,EAAE,CACvF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAClC,aAAa,EACb,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EACtB,EAAE,CACH,CAAC;YACF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChC,MAAM,CAAC,KAAK,EAAE;aACf,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAEpC,kCAAkC;YAClC,MAAM,MAAM,GAAG,IAAI,UAAU,CAC3B,SAAS,GAAG,eAAe,GAAG,SAAS,CAAC,MAAM,CAC/C,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAClB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,GAAG,eAAe,CAAC,CAAC;YAEnD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,wBAAe;gBAAE,MAAM,GAAG,CAAC;YAC9C,MAAM,IAAI,wBAAe,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CACrB,UAAsB,EACtB,SAAqB;QAErB,IAAI,SAAS,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACxC,MAAM,IAAI,wBAAe,CACvB,uCAAuC,cAAc,eAAe,SAAS,CAAC,MAAM,EAAE,CACvF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,GAAG,eAAe,CAAC;QAC9C,IAAI,UAAU,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,wBAAe,CACvB,uDAAuD,SAAS,eAAe,UAAU,CAAC,MAAM,EAAE,CACnG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,oBAAoB;YACpB,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,GAAG,eAAe,CAAC,CAAC;YACzE,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,GAAG,eAAe,CAAC,CAAC;YAEpE,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CACtC,aAAa,EACb,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EACtB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAChB,CAAC;YACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC3C,QAAQ,CAAC,KAAK,EAAE;aACjB,CAAC,CAAC;YAEH,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,wBAAe;gBAAE,MAAM,GAAG,CAAC;YAC9C,MAAM,IAAI,wBAAe,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,uEAAuE;IAEvE;;;;;;OAMG;IACH,cAAc,CAAC,UAAsB;QACnC,OAAO,MAAM;aACV,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;aAC/B,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,eAAe;QACb,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAAmB,EACnB,eAA2B;QAE3B,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CACvB,YAAwB,EACxB,gBAA4B;QAE5B,OAAO,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IAClE,CAAC;IAED,uEAAuE;IAEvE;;OAEG;IACK,aAAa,CAAC,YAAoB;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAC7B,QAAQ,EACR,YAAY,EACZ,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU;QAC3B,SAAS,EACT,cAAc,CACf,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACK,kBAAkB,CAAC,SAAqB;QAC9C,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACrD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC;QACD,IACE,SAAS,CAAC,MAAM,KAAK,EAAE;YACvB,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAChD,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAC3B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EACtB,WAAW,EACX,SAAS,EACT,SAAS,EACT,cAAc,CACL,CAAC;QACd,CAAC;QACD,MAAM,IAAI,wBAAe,CACvB,8DAA8D,SAAS,CAAC,MAAM,EAAE,CACjF,CAAC;IACJ,CAAC;CACF;AAzTD,sDAyTC"}

package/src/lib/encryption/poolKeyManager.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Pool Key Manager — manages the lifecycle of pool encryption keys.
+ *
+ * Handles key generation, distribution, rotation, and member removal
+ * for pool-shared encryption mode. Old key versions are retained so
+ * older blocks can still be decrypted (Requirement 15.4).
+ *
+ * Node IDs are derived from public keys using SHA-256 hex, consistent
+ * with ECDSANodeAuthenticator.deriveNodeId.
+ *
+ * @see Requirements 15.1, 15.2, 15.3, 15.4, 15.5
+ */
+import type { IPoolEncryptionConfig } from '@brightchain/brightchain-lib';
+import { PoolEncryptionService } from './poolEncryptionService';
+export declare class PoolKeyManager {
+    private config;
+    private readonly encryptionService;
+    constructor(encryptionService: PoolEncryptionService, initialConfig: IPoolEncryptionConfig);
+    /**
+     * Generate a new pool key, encrypt it for each member, and create version 1.
+     *
+     * @param memberPublicKeys - secp256k1 public keys of all pool members
+     * @returns Updated pool encryption config with the first key version
+     * @see Requirement 15.2
+     */
+    initializePoolKey(memberPublicKeys: Uint8Array[]): Promise<IPoolEncryptionConfig>;
+    /**
+     * Generate a new key version, encrypt for all current members,
+     * and increment currentKeyVersion. Old versions remain active
+     * for decrypting older blocks (Requirement 15.4).
+     *
+     * @param currentMemberPublicKeys - secp256k1 public keys of current members
+     * @returns Updated pool encryption config with the new key version appended
+     * @see Requirements 15.3, 15.4
+     */
+    rotateKey(currentMemberPublicKeys: Uint8Array[]): Promise<IPoolEncryptionConfig>;
+    /**
+     * Remove a member by triggering key rotation excluding the removed member.
+     * The removed member will not have access to the new key version,
+     * so they cannot decrypt new blocks (Requirement 15.5).
+     *
+     * @param removedNodeId - Node ID of the member being removed
+     * @param remainingMemberPublicKeys - Public keys of members who remain
+     * @returns Updated pool encryption config after rotation
+     * @see Requirement 15.5
+     */
+    removeMember(removedNodeId: string, remainingMemberPublicKeys: Uint8Array[]): Promise<IPoolEncryptionConfig>;
+    /**
+     * Look up a key version in history, find the member's encrypted key,
+     * and decrypt it.
+     *
+     * @param keyVersion - The key version number to look up
+     * @param memberPrivateKey - Member's raw 32-byte secp256k1 private key
+     * @param memberNodeId - The member's node ID
+     * @returns The decrypted symmetric pool key for that version
+     * @see Requirement 15.4
+     */
+    getDecryptionKey(keyVersion: number, memberPrivateKey: Uint8Array, memberNodeId: string): Promise<Uint8Array>;
+    /**
+     * Shortcut for getting the current version's decrypted key.
+     *
+     * @param memberPrivateKey - Member's raw 32-byte secp256k1 private key
+     * @param memberNodeId - The member's node ID
+     * @returns The decrypted symmetric pool key for the current version
+     */
+    getCurrentEncryptionKey(memberPrivateKey: Uint8Array, memberNodeId: string): Promise<Uint8Array>;
+    /**
+     * Return a copy of the current pool encryption config.
+     */
+    getConfig(): IPoolEncryptionConfig;
+    /**
+     * Encrypt a pool key for each member, returning an array of
+     * { nodeId, encryptedKey } entries.
+     */
+    private encryptKeyForMembers;
+    /**
+     * Derive a node ID from a public key via SHA-256 hex.
+     * Consistent with ECDSANodeAuthenticator.deriveNodeId.
+     */
+    private deriveNodeId;
+}
+//# sourceMappingURL=poolKeyManager.d.ts.map

package/src/lib/encryption/poolKeyManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"poolKeyManager.d.ts","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/encryption/poolKeyManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAEV,qBAAqB,EACtB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAwB;gBAGxD,iBAAiB,EAAE,qBAAqB,EACxC,aAAa,EAAE,qBAAqB;IAMtC;;;;;;OAMG;IACG,iBAAiB,CACrB,gBAAgB,EAAE,UAAU,EAAE,GAC7B,OAAO,CAAC,qBAAqB,CAAC;IAuBjC;;;;;;;;OAQG;IACG,SAAS,CACb,uBAAuB,EAAE,UAAU,EAAE,GACpC,OAAO,CAAC,qBAAqB,CAAC;IAyBjC;;;;;;;;;OASG;IACG,YAAY,CAChB,aAAa,EAAE,MAAM,EACrB,yBAAyB,EAAE,UAAU,EAAE,GACtC,OAAO,CAAC,qBAAqB,CAAC;IASjC;;;;;;;;;OASG;IACG,gBAAgB,CACpB,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,UAAU,EAC5B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,UAAU,CAAC;IA6BtB;;;;;;OAMG;IACG,uBAAuB,CAC3B,gBAAgB,EAAE,UAAU,EAC5B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,UAAU,CAAC;IAQtB;;OAEG;IACH,SAAS,IAAI,qBAAqB;IASlC;;;OAGG;YACW,oBAAoB;IAiBlC;;;OAGG;IACH,OAAO,CAAC,YAAY;CAMrB"}

package/src/lib/encryption/poolKeyManager.js

@@ -0,0 +1,156 @@
+"use strict";
+/**
+ * Pool Key Manager — manages the lifecycle of pool encryption keys.
+ *
+ * Handles key generation, distribution, rotation, and member removal
+ * for pool-shared encryption mode. Old key versions are retained so
+ * older blocks can still be decrypted (Requirement 15.4).
+ *
+ * Node IDs are derived from public keys using SHA-256 hex, consistent
+ * with ECDSANodeAuthenticator.deriveNodeId.
+ *
+ * @see Requirements 15.1, 15.2, 15.3, 15.4, 15.5
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PoolKeyManager = void 0;
+const tslib_1 = require("tslib");
+const crypto = tslib_1.__importStar(require("crypto"));
+const errors_1 = require("./errors");
+class PoolKeyManager {
+    constructor(encryptionService, initialConfig) {
+        this.encryptionService = encryptionService;
+        this.config = { ...initialConfig };
+    }
+    /**
+     * Generate a new pool key, encrypt it for each member, and create version 1.
+     *
+     * @param memberPublicKeys - secp256k1 public keys of all pool members
+     * @returns Updated pool encryption config with the first key version
+     * @see Requirement 15.2
+     */
+    async initializePoolKey(memberPublicKeys) {
+        const poolKey = this.encryptionService.generatePoolKey();
+        const encryptedKeys = await this.encryptKeyForMembers(poolKey, memberPublicKeys);
+        const keyVersion = {
+            version: 1,
+            createdAt: new Date(),
+            encryptedKeys,
+            active: true,
+        };
+        this.config = {
+            ...this.config,
+            keyVersions: [keyVersion],
+            currentKeyVersion: 1,
+        };
+        return this.getConfig();
+    }
+    /**
+     * Generate a new key version, encrypt for all current members,
+     * and increment currentKeyVersion. Old versions remain active
+     * for decrypting older blocks (Requirement 15.4).
+     *
+     * @param currentMemberPublicKeys - secp256k1 public keys of current members
+     * @returns Updated pool encryption config with the new key version appended
+     * @see Requirements 15.3, 15.4
+     */
+    async rotateKey(currentMemberPublicKeys) {
+        const poolKey = this.encryptionService.generatePoolKey();
+        const newVersion = this.config.currentKeyVersion + 1;
+        const encryptedKeys = await this.encryptKeyForMembers(poolKey, currentMemberPublicKeys);
+        const keyVersion = {
+            version: newVersion,
+            createdAt: new Date(),
+            encryptedKeys,
+            active: true,
+        };
+        this.config = {
+            ...this.config,
+            keyVersions: [...this.config.keyVersions, keyVersion],
+            currentKeyVersion: newVersion,
+        };
+        return this.getConfig();
+    }
+    /**
+     * Remove a member by triggering key rotation excluding the removed member.
+     * The removed member will not have access to the new key version,
+     * so they cannot decrypt new blocks (Requirement 15.5).
+     *
+     * @param removedNodeId - Node ID of the member being removed
+     * @param remainingMemberPublicKeys - Public keys of members who remain
+     * @returns Updated pool encryption config after rotation
+     * @see Requirement 15.5
+     */
+    async removeMember(removedNodeId, remainingMemberPublicKeys) {
+        // Filter out the removed member's keys just in case they were included
+        const filteredKeys = remainingMemberPublicKeys.filter((pk) => this.deriveNodeId(pk) !== removedNodeId);
+        return this.rotateKey(filteredKeys);
+    }
+    /**
+     * Look up a key version in history, find the member's encrypted key,
+     * and decrypt it.
+     *
+     * @param keyVersion - The key version number to look up
+     * @param memberPrivateKey - Member's raw 32-byte secp256k1 private key
+     * @param memberNodeId - The member's node ID
+     * @returns The decrypted symmetric pool key for that version
+     * @see Requirement 15.4
+     */
+    async getDecryptionKey(keyVersion, memberPrivateKey, memberNodeId) {
+        const version = this.config.keyVersions.find((kv) => kv.version === keyVersion);
+        if (!version) {
+            throw new errors_1.KeyVersionNotFoundError(keyVersion);
+        }
+        if (!version.encryptedKeys || version.encryptedKeys.length === 0) {
+            throw new errors_1.DecryptionError(`Key version ${keyVersion} has no encrypted keys`);
+        }
+        const memberEntry = version.encryptedKeys.find((ek) => ek.nodeId === memberNodeId);
+        if (!memberEntry) {
+            throw new errors_1.DecryptionError(`No encrypted key found for member ${memberNodeId} in key version ${keyVersion}`);
+        }
+        return this.encryptionService.decryptKeyForMember(memberEntry.encryptedKey, memberPrivateKey);
+    }
+    /**
+     * Shortcut for getting the current version's decrypted key.
+     *
+     * @param memberPrivateKey - Member's raw 32-byte secp256k1 private key
+     * @param memberNodeId - The member's node ID
+     * @returns The decrypted symmetric pool key for the current version
+     */
+    async getCurrentEncryptionKey(memberPrivateKey, memberNodeId) {
+        return this.getDecryptionKey(this.config.currentKeyVersion, memberPrivateKey, memberNodeId);
+    }
+    /**
+     * Return a copy of the current pool encryption config.
+     */
+    getConfig() {
+        return {
+            ...this.config,
+            keyVersions: this.config.keyVersions.map((kv) => ({ ...kv })),
+        };
+    }
+    // ─── Private Helpers ────────────────────────────────────────────────
+    /**
+     * Encrypt a pool key for each member, returning an array of
+     * { nodeId, encryptedKey } entries.
+     */
+    async encryptKeyForMembers(poolKey, memberPublicKeys) {
+        const entries = await Promise.all(memberPublicKeys.map(async (publicKey) => {
+            const nodeId = this.deriveNodeId(publicKey);
+            const encryptedKey = await this.encryptionService.encryptKeyForMember(poolKey, publicKey);
+            return { nodeId, encryptedKey };
+        }));
+        return entries;
+    }
+    /**
+     * Derive a node ID from a public key via SHA-256 hex.
+     * Consistent with ECDSANodeAuthenticator.deriveNodeId.
+     */
+    deriveNodeId(publicKey) {
+        return crypto
+            .createHash('sha256')
+            .update(Buffer.from(publicKey))
+            .digest('hex');
+    }
+}
+exports.PoolKeyManager = PoolKeyManager;
+//# sourceMappingURL=poolKeyManager.js.map

package/src/lib/encryption/poolKeyManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"poolKeyManager.js","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/encryption/poolKeyManager.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;AAMH,uDAAiC;AACjC,qCAAoE;AAGpE,MAAa,cAAc;IAIzB,YACE,iBAAwC,EACxC,aAAoC;QAEpC,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CACrB,gBAA8B;QAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,CAAC;QACzD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,CACnD,OAAO,EACP,gBAAgB,CACjB,CAAC;QAEF,MAAM,UAAU,GAAgB;YAC9B,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,aAAa;YACb,MAAM,EAAE,IAAI;SACb,CAAC;QAEF,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,IAAI,CAAC,MAAM;YACd,WAAW,EAAE,CAAC,UAAU,CAAC;YACzB,iBAAiB,EAAE,CAAC;SACrB,CAAC;QAEF,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CACb,uBAAqC;QAErC,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,CAAC;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,GAAG,CAAC,CAAC;QAErD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,CACnD,OAAO,EACP,uBAAuB,CACxB,CAAC;QAEF,MAAM,UAAU,GAAgB;YAC9B,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,aAAa;YACb,MAAM,EAAE,IAAI;SACb,CAAC;QAEF,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,IAAI,CAAC,MAAM;YACd,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC;YACrD,iBAAiB,EAAE,UAAU;SAC9B,CAAC;QAEF,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY,CAChB,aAAqB,EACrB,yBAAuC;QAEvC,uEAAuE;QACvE,MAAM,YAAY,GAAG,yBAAyB,CAAC,MAAM,CACnD,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,aAAa,CAChD,CAAC;QAEF,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,gBAAgB,CACpB,UAAkB,EAClB,gBAA4B,EAC5B,YAAoB;QAEpB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAC1C,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,KAAK,UAAU,CAClC,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gCAAuB,CAAC,UAAU,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,wBAAe,CACvB,eAAe,UAAU,wBAAwB,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,CAC5C,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,YAAY,CACnC,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,wBAAe,CACvB,qCAAqC,YAAY,mBAAmB,UAAU,EAAE,CACjF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,CAC/C,WAAW,CAAC,YAAY,EACxB,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,uBAAuB,CAC3B,gBAA4B,EAC5B,YAAoB;QAEpB,OAAO,IAAI,CAAC,gBAAgB,CAC1B,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAC7B,gBAAgB,EAChB,YAAY,CACb,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO;YACL,GAAG,IAAI,CAAC,MAAM;YACd,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;SAC9D,CAAC;IACJ,CAAC;IAED,uEAAuE;IAEvE;;;OAGG;IACK,KAAK,CAAC,oBAAoB,CAChC,OAAmB,EACnB,gBAA8B;QAE9B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,CACnE,OAAO,EACP,SAAS,CACV,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAClC,CAAC,CAAC,CACH,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,SAAqB;QACxC,OAAO,MAAM;aACV,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;aAC9B,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;CACF;AA9MD,wCA8MC"}

package/src/lib/environment.d.ts

@@ -2,10 +2,12 @@ import { HexString } from '@digitaldefiance/ecies-lib';
 import { Environment as BaseEnvironment } from '@digitaldefiance/node-express-suite';
 import { BlockSize } from '@brightchain/brightchain-lib';
 import { PlatformID } from '@digitaldefiance/node-ecies-lib';
+import { IUpnpConfig } from '@digitaldefiance/node-express-suite';
 import { IEnvironment } from './interfaces/environment';
 import { IEnvironmentAws } from './interfaces/environment-aws';
 import { DefaultBackendIdType } from './shared-types';
 export declare class Environment<TID extends PlatformID = DefaultBackendIdType> extends BaseEnvironment<TID> implements IEnvironment<TID> {
+    private _upnp;
     private _fontAwesomeKitId;
     private _aws;
     private _blockStorePath?;
@@ -16,6 +18,7 @@ export declare class Environment<TID extends PlatformID = DefaultBackendIdType>
     set adminId(value: any);
     get idAdapter(): (bytes: Uint8Array) => HexString;
     constructor(path?: string, initialization?: boolean, override?: boolean);
+    get upnp(): IUpnpConfig;
     get fontAwesomeKitId(): string;
     get aws(): IEnvironmentAws;
     get blockStorePath(): string | undefined;

package/src/lib/environment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../../../brightchain-api-lib/src/lib/environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAgB,MAAM,4BAA4B,CAAC;AACrE,OAAO,EACL,WAAW,IAAI,eAAe,EAE/B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAG7D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,qBAAa,WAAW,CAAC,GAAG,SAAS,UAAU,GAAG,oBAAoB,CACpE,SAAQ,eAAe,CAAC,GAAG,CAC3B,YAAW,YAAY,CAAC,GAAG,CAAC;IAE5B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,IAAI,CAAkB;IAC9B,OAAO,CAAC,eAAe,CAAC,CAAS;IACjC,OAAO,CAAC,oBAAoB,CAAY;IACxC,OAAO,CAAC,uBAAuB,CAAU;IAEzC,OAAO,CAAC,QAAQ,CAAM;IACtB,IAAoB,OAAO,IAAI,GAAG,CAEjC;IACD,IAAoB,OAAO,CAAC,KAAK,EAAE,GAAG,EAErC;IAED,IAAW,SAAS,IAAI,CAAC,KAAK,EAAE,UAAU,KAAK,SAAS,CAMvD;gBAEW,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,UAAQ,EAAE,QAAQ,UAAO;IAoDlE,IAAW,gBAAgB,IAAI,MAAM,CAEpC;IAED,IAAW,GAAG,IAAI,eAAe,CAEhC;IAED,IAAW,cAAc,IAAI,MAAM,GAAG,SAAS,CAE9C;IAED,IAAW,mBAAmB,IAAI,SAAS,CAE1C;IAED,IAAW,sBAAsB,IAAI,OAAO,CAE3C;CACF"}
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../../../brightchain-api-lib/src/lib/environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAgB,MAAM,4BAA4B,CAAC;AACrE,OAAO,EACL,WAAW,IAAI,eAAe,EAE/B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAc,MAAM,qCAAqC,CAAC;AAG9E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,qBAAa,WAAW,CAAC,GAAG,SAAS,UAAU,GAAG,oBAAoB,CACpE,SAAQ,eAAe,CAAC,GAAG,CAC3B,YAAW,YAAY,CAAC,GAAG,CAAC;IAE5B,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,IAAI,CAAkB;IAC9B,OAAO,CAAC,eAAe,CAAC,CAAS;IACjC,OAAO,CAAC,oBAAoB,CAAY;IACxC,OAAO,CAAC,uBAAuB,CAAU;IAEzC,OAAO,CAAC,QAAQ,CAAM;IACtB,IAAoB,OAAO,IAAI,GAAG,CAEjC;IACD,IAAoB,OAAO,CAAC,KAAK,EAAE,GAAG,EAErC;IAED,IAAW,SAAS,IAAI,CAAC,KAAK,EAAE,UAAU,KAAK,SAAS,CAMvD;gBAEW,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,UAAQ,EAAE,QAAQ,UAAO;IAqDlE,IAAW,IAAI,IAAI,WAAW,CAE7B;IAED,IAAW,gBAAgB,IAAI,MAAM,CAEpC;IAED,IAAW,GAAG,IAAI,eAAe,CAEhC;IAED,IAAW,cAAc,IAAI,MAAM,GAAG,SAAS,CAE9C;IAED,IAAW,mBAAmB,IAAI,SAAS,CAE1C;IAED,IAAW,sBAAsB,IAAI,OAAO,CAE3C;CACF"}