@cmdoss/memwal-sdk 0.6.0

package/dist/client/namespaces/consolidated/SecurityNamespace.d.ts

@@ -0,0 +1,354 @@
+/**
+ * Security Namespace - Consolidated Security & Access Control
+ *
+ * Merges functionality from:
+ * - EncryptionNamespace: SEAL-based encryption/decryption
+ * - PermissionsNamespace: OAuth-style access control
+ * - ContextNamespace: App context (MemoryCap) management
+ *
+ * Provides a unified interface for all security operations.
+ *
+ * Key features:
+ * - SEAL encryption with identity-based access control
+ * - Decryption with capability-based or legacy allowlist patterns
+ * - App contexts (MemoryCap) for app-scoped data
+ * - OAuth-style permission grants and revocations
+ *
+ * @module client/namespaces/consolidated
+ */
+import type { ServiceContainer } from '../../SimplePDWClient';
+import type { SessionKey } from '@mysten/seal';
+import type { MemoryCap } from '../../../core/types/capability';
+import type { ConsentRequestRecord, AccessGrant, PermissionScope } from '../../../core/types/wallet';
+/**
+ * Encryption result
+ */
+export interface EncryptionResult {
+    encryptedData: Uint8Array;
+    backupKey: Uint8Array;
+}
+/**
+ * Decryption options
+ */
+export interface DecryptionOptions {
+    encryptedData: Uint8Array;
+    sessionKey?: SessionKey;
+    requestingWallet?: string;
+    /** MemoryCap object ID for capability-based access control */
+    memoryCapId?: string;
+    /** SEAL key ID bytes - required with memoryCapId */
+    keyId?: Uint8Array;
+}
+/**
+ * Context info with additional metadata
+ */
+export interface ContextInfo extends MemoryCap {
+    /** Number of memories in this context */
+    memoryCount?: number;
+    /** Last activity timestamp */
+    lastActivity?: number;
+}
+/**
+ * Context sub-namespace for app context management
+ */
+declare class ContextSubNamespace {
+    private services;
+    private capService;
+    constructor(services: ServiceContainer);
+    private ensureService;
+    /**
+     * Create a new context for an app
+     *
+     * @param appId - Application identifier (e.g., "MEMO", "HEALTH", "FINANCE")
+     * @returns Created context (MemoryCap)
+     *
+     * @example
+     * ```typescript
+     * const memoContext = await pdw.security.context.create('MEMO');
+     * ```
+     */
+    create(appId: string): Promise<MemoryCap>;
+    /**
+     * Get context by app ID
+     *
+     * @param appId - Application identifier
+     * @returns Context or null if not found
+     */
+    get(appId: string): Promise<MemoryCap | null>;
+    /**
+     * Get or create context for an app
+     *
+     * @param appId - Application identifier
+     * @returns Existing or newly created context
+     *
+     * @example
+     * ```typescript
+     * const ctx = await pdw.security.context.getOrCreate('MEMO');
+     * ```
+     */
+    getOrCreate(appId: string): Promise<MemoryCap>;
+    /**
+     * List all contexts owned by the user
+     *
+     * @returns Array of contexts (MemoryCaps)
+     */
+    list(): Promise<MemoryCap[]>;
+    /**
+     * Delete a context (burns the capability)
+     *
+     * Warning: This permanently revokes access to all memories
+     * encrypted with this context's key.
+     *
+     * @param appId - Application identifier
+     */
+    delete(appId: string): Promise<void>;
+    /**
+     * Transfer context to another user
+     *
+     * @param appId - Application identifier
+     * @param recipient - Recipient's Sui address
+     */
+    transfer(appId: string, recipient: string): Promise<void>;
+    /**
+     * Check if context exists for an app
+     *
+     * @param appId - Application identifier
+     * @returns True if context exists
+     */
+    exists(appId: string): Promise<boolean>;
+    /**
+     * Get SEAL key ID for a context
+     *
+     * @param appId - Application identifier
+     * @returns Key ID as hex string
+     */
+    getKeyId(appId: string): Promise<string | null>;
+    /**
+     * Get all app IDs for user's contexts
+     *
+     * @returns Array of app IDs
+     */
+    getAppIds(): Promise<string[]>;
+}
+/**
+ * Permissions sub-namespace for OAuth-style access control
+ */
+declare class PermissionsSubNamespace {
+    private services;
+    constructor(services: ServiceContainer);
+    /**
+     * Request user consent for data access
+     *
+     * @param appId - Application identifier
+     * @param scopes - Requested permission scopes
+     * @param purpose - Purpose description
+     * @returns Consent request record
+     */
+    request(appId: string, scopes: PermissionScope[], purpose: string): Promise<ConsentRequestRecord>;
+    /**
+     * Grant permissions to an app
+     *
+     * @param appId - Application to grant access
+     * @param scopes - Scopes to grant
+     * @param expiresAt - Optional expiration timestamp
+     * @returns Access grant record
+     *
+     * @example
+     * ```typescript
+     * await pdw.security.permissions.grant('HEALTH_APP', ['read', 'write']);
+     * ```
+     */
+    grant(appId: string, scopes: PermissionScope[], expiresAt?: number): Promise<AccessGrant>;
+    /**
+     * Revoke permission scope from an app
+     *
+     * @param appId - Application to revoke from
+     * @param scope - Scope to revoke
+     * @returns Success status
+     *
+     * @example
+     * ```typescript
+     * await pdw.security.permissions.revoke('HEALTH_APP', 'write');
+     * ```
+     */
+    revoke(appId: string, scope: PermissionScope): Promise<boolean>;
+    /**
+     * Check if app has specific permission
+     *
+     * @param appId - Application to check
+     * @param scope - Scope to check
+     * @returns True if permission exists and valid
+     */
+    check(appId: string, scope: PermissionScope): Promise<boolean>;
+    /**
+     * List all permission grants for the current user
+     *
+     * @returns Array of active grants
+     */
+    list(): Promise<AccessGrant[]>;
+    /**
+     * Get pending consent requests
+     *
+     * @returns Array of pending consent requests
+     */
+    getPending(): Promise<ConsentRequestRecord[]>;
+    /**
+     * Approve a consent request
+     *
+     * @param consentId - Consent request ID
+     * @returns Access grant
+     */
+    approve(consentId: string): Promise<AccessGrant>;
+    /**
+     * Deny a consent request
+     *
+     * @param consentId - Consent request ID
+     * @returns Success status
+     */
+    deny(consentId: string): Promise<boolean>;
+}
+/**
+ * Security Namespace - Unified Security Operations
+ *
+ * Consolidates encryption, decryption, permissions, and context management.
+ *
+ * @example
+ * ```typescript
+ * // Encrypt data
+ * const { encryptedData, backupKey } = await pdw.security.encrypt(data);
+ *
+ * // Decrypt data
+ * const decrypted = await pdw.security.decrypt({ encryptedData });
+ *
+ * // Manage app contexts
+ * const ctx = await pdw.security.context.getOrCreate('MEMO');
+ *
+ * // Grant permissions
+ * await pdw.security.permissions.grant('APP_ID', ['read', 'write']);
+ * ```
+ */
+export declare class SecurityNamespace {
+    private services;
+    private _context;
+    private _permissions;
+    constructor(services: ServiceContainer);
+    /**
+     * App context (MemoryCap) management
+     */
+    get context(): ContextSubNamespace;
+    /**
+     * OAuth-style permission management
+     */
+    get permissions(): PermissionsSubNamespace;
+    /**
+     * Encrypt data using SEAL
+     *
+     * NOTE: This uses userAddress as identity. For capability pattern,
+     * use encryptWithKeyId() instead.
+     *
+     * @param data - Data to encrypt
+     * @param threshold - Min key servers required (default: 2)
+     * @returns Encrypted data and backup key
+     *
+     * @example
+     * ```typescript
+     * const encoder = new TextEncoder();
+     * const data = encoder.encode('sensitive data');
+     * const { encryptedData, backupKey } = await pdw.security.encrypt(data);
+     * ```
+     */
+    encrypt(data: Uint8Array, threshold?: number): Promise<EncryptionResult>;
+    /**
+     * Encrypt data using SEAL with capability-based key ID
+     *
+     * Use this for capability pattern where keyId = keccak256(owner || nonce).
+     * The keyId MUST match what's passed to seal_approve during decryption.
+     *
+     * @param data - Data to encrypt
+     * @param keyId - Key ID bytes (compute with computeKeyId())
+     * @param threshold - Min key servers required (default: 2)
+     * @returns Encrypted data and backup key
+     *
+     * @example
+     * ```typescript
+     * const keyId = pdw.security.computeKeyId(ownerAddress, nonce);
+     * const { encryptedData } = await pdw.security.encryptWithKeyId(data, keyId);
+     * ```
+     */
+    encryptWithKeyId(data: Uint8Array, keyId: Uint8Array, threshold?: number): Promise<EncryptionResult>;
+    /**
+     * Decrypt SEAL-encrypted data
+     *
+     * Supports two access control patterns:
+     * 1. Capability pattern (recommended): Pass memoryCapId and keyId
+     * 2. Legacy allowlist pattern: Only requestingWallet needed
+     *
+     * @param options - Decryption options
+     * @returns Decrypted data
+     *
+     * @example
+     * ```typescript
+     * // Capability-based decryption
+     * const decrypted = await pdw.security.decrypt({
+     *   encryptedData,
+     *   memoryCapId: cap.id,
+     *   keyId: keyIdBytes
+     * });
+     *
+     * // Or simple decryption (legacy)
+     * const decrypted = await pdw.security.decrypt({ encryptedData });
+     * ```
+     */
+    decrypt(options: DecryptionOptions): Promise<Uint8Array>;
+    /**
+     * Compute SEAL key_id from owner and nonce
+     *
+     * Use this to compute the key_id needed for capability-based encryption/decryption.
+     * The nonce comes from the MemoryCap object on-chain.
+     *
+     * @param ownerAddress - Owner's Sui address
+     * @param nonce - Nonce from MemoryCap object (32 bytes)
+     * @returns key_id bytes for SEAL operations
+     *
+     * @example
+     * ```typescript
+     * const ctx = await pdw.security.context.get('MEMO');
+     * const keyId = pdw.security.computeKeyId(userAddress, ctx.nonce);
+     * ```
+     */
+    computeKeyId(ownerAddress: string, nonce: Uint8Array): Uint8Array;
+    /**
+     * Create session key for SEAL operations
+     *
+     * @param signer - Optional signer (keypair or signPersonalMessage function)
+     * @returns Session key
+     */
+    createSessionKey(signer?: {
+        signPersonalMessageFn?: (message: string) => Promise<{
+            signature: string;
+        }>;
+        keypair?: any;
+    }): Promise<SessionKey>;
+    /**
+     * Get or create session key (cached)
+     *
+     * @returns Cached or new session key
+     */
+    getSessionKey(): Promise<SessionKey>;
+    /**
+     * Export session key for persistence
+     *
+     * @param sessionKey - Session key to export
+     * @returns Serialized session key
+     */
+    exportSessionKey(sessionKey: SessionKey): Promise<string>;
+    /**
+     * Import previously exported session key
+     *
+     * @param exportedKey - Serialized session key
+     * @returns Session key instance
+     */
+    importSessionKey(exportedKey: string): Promise<SessionKey>;
+}
+export {};
+//# sourceMappingURL=SecurityNamespace.d.ts.map

package/dist/client/namespaces/consolidated/SecurityNamespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityNamespace.d.ts","sourceRoot":"","sources":["../../../../src/client/namespaces/consolidated/SecurityNamespace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,KAAK,EACV,oBAAoB,EACpB,WAAW,EACX,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAOpC;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,UAAU,CAAC;IAC1B,SAAS,EAAE,UAAU,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,UAAU,CAAC;IAC1B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC5C,yCAAyC;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8BAA8B;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD;;GAEG;AACH,cAAM,mBAAmB;IAGX,OAAO,CAAC,QAAQ;IAF5B,OAAO,CAAC,UAAU,CAAkC;gBAEhC,QAAQ,EAAE,gBAAgB;IAS9C,OAAO,CAAC,aAAa;IAOrB;;;;;;;;;;OAUG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAM/C;;;;;OAKG;IACG,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAKnD;;;;;;;;;;OAUG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IASpD;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAKlC;;;;;;;OAOG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU1C;;;;;OAKG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU/D;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK7C;;;;;OAKG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAOrD;;;;OAIG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;CAIrC;AAED;;GAEG;AACH,cAAM,uBAAuB;IACf,OAAO,CAAC,QAAQ;gBAAR,QAAQ,EAAE,gBAAgB;IAE9C;;;;;;;OAOG;IACG,OAAO,CACX,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,eAAe,EAAE,EACzB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,oBAAoB,CAAC;IAYhC;;;;;;;;;;;;OAYG;IACG,KAAK,CACT,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,eAAe,EAAE,EACzB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAgBvB;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAerE;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAWpE;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAWpC;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAgBnD;;;;;OAKG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAgBtD;;;;;OAKG;IACG,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAchD;AAMD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,iBAAiB;IAIhB,OAAO,CAAC,QAAQ;IAH5B,OAAO,CAAC,QAAQ,CAAsB;IACtC,OAAO,CAAC,YAAY,CAA0B;gBAE1B,QAAQ,EAAE,gBAAgB;IAS9C;;OAEG;IACH,IAAI,OAAO,IAAI,mBAAmB,CAEjC;IAED;;OAEG;IACH,IAAI,WAAW,IAAI,uBAAuB,CAEzC;IAMD;;;;;;;;;;;;;;;;OAgBG;IACG,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,GAAE,MAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAejF;;;;;;;;;;;;;;;;OAgBG;IACG,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,GAAE,MAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAY7G;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,OAAO,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC;IAc9D;;;;;;;;;;;;;;;OAeG;IACH,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,UAAU;IAWjE;;;;;OAKG;IACG,gBAAgB,CAAC,MAAM,CAAC,EAAE;QAC9B,qBAAqB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,EAAE,GAAG,CAAC;KACf,GAAG,OAAO,CAAC,UAAU,CAAC;IAUvB;;;;OAIG;IACG,aAAa,IAAI,OAAO,CAAC,UAAU,CAAC;IAS1C;;;;;OAKG;IACG,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAO/D;;;;;OAKG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CASjE"}