@cogcoin/client 0.5.15 → 1.0.1

package/dist/wallet/state/crypto.d.ts

@@ -1,34 +1,15 @@
-import type { Argon2EnvelopeParams, EncryptedEnvelopeV1 } from "../types.js";
+import type { EncryptedEnvelopeV1 } from "../types.js";
 import type { WalletSecretProvider, WalletSecretReference } from "./provider.js";
-export interface DeriveKeyOptions {
-    memoryKib?: number;
-    iterations?: number;
-    parallelism?: number;
-    salt?: Uint8Array;
-}
-export interface DerivedKeyMaterial {
-    readonly key: Buffer;
-    readonly params: Argon2EnvelopeParams;
-}
-export declare function deriveKeyFromPassphrase(passphrase: Uint8Array | string, options?: DeriveKeyOptions): Promise<DerivedKeyMaterial>;
-export declare function rederiveKeyFromEnvelope(passphrase: Uint8Array | string, envelope: EncryptedEnvelopeV1): Promise<Buffer>;
 export declare function encryptBytesWithKey(plaintext: Uint8Array, key: Uint8Array, metadata: {
     format: string;
     wrappedBy: string;
     walletRootIdHint?: string | null;
-    argon2id?: Argon2EnvelopeParams | null;
     secretProvider?: WalletSecretReference | null;
 }): EncryptedEnvelopeV1;
 export declare function decryptBytesWithKey(envelope: EncryptedEnvelopeV1, key: Uint8Array): Buffer;
-export declare function encryptJsonWithPassphrase<T>(value: T, passphrase: Uint8Array | string, metadata: {
-    format: string;
-    wrappedBy?: string;
-    walletRootIdHint?: string | null;
-}): Promise<EncryptedEnvelopeV1>;
 export declare function encryptJsonWithSecretProvider<T>(value: T, provider: WalletSecretProvider, secretReference: WalletSecretReference, metadata: {
     format: string;
     wrappedBy?: string;
     walletRootIdHint?: string | null;
 }): Promise<EncryptedEnvelopeV1>;
-export declare function decryptJsonWithPassphrase<T>(envelope: EncryptedEnvelopeV1, passphrase: Uint8Array | string): Promise<T>;
 export declare function decryptJsonWithSecretProvider<T>(envelope: EncryptedEnvelopeV1, provider: WalletSecretProvider): Promise<T>;

package/dist/wallet/state/crypto.js

@@ -1,11 +1,5 @@
-import { argon2id } from "hash-wasm";
 import { createCipheriv, createDecipheriv, randomBytes, } from "node:crypto";
-const DEFAULT_ARGON2_MEMORY_KIB = 65_536;
-const DEFAULT_ARGON2_ITERATIONS = 3;
-const DEFAULT_ARGON2_PARALLELISM = 1;
-const DERIVED_KEY_LENGTH = 32;
 const GCM_NONCE_BYTES = 12;
-const ARGON2_SALT_BYTES = 16;
 const BIGINT_JSON_TAG = "$cogcoinBigInt";
 function jsonReplacer(_key, value) {
     if (typeof value === "bigint") {
@@ -24,48 +18,6 @@ function jsonReviver(_key, value) {
     }
     return value;
 }
-async function deriveArgon2Key(message, nonce, memoryKib, iterations, parallelism) {
-    const derivedKey = await argon2id({
-        password: message,
-        salt: nonce,
-        memorySize: memoryKib,
-        iterations,
-        parallelism,
-        hashLength: DERIVED_KEY_LENGTH,
-        outputType: "binary",
-    });
-    return Buffer.from(derivedKey);
-}
-export async function deriveKeyFromPassphrase(passphrase, options = {}) {
-    const salt = Buffer.from(options.salt ?? randomBytes(ARGON2_SALT_BYTES));
-    const passphraseBytes = typeof passphrase === "string"
-        ? Buffer.from(passphrase, "utf8")
-        : Buffer.from(passphrase);
-    const memoryKib = options.memoryKib ?? DEFAULT_ARGON2_MEMORY_KIB;
-    const iterations = options.iterations ?? DEFAULT_ARGON2_ITERATIONS;
-    const parallelism = options.parallelism ?? DEFAULT_ARGON2_PARALLELISM;
-    const key = await deriveArgon2Key(passphraseBytes, salt, memoryKib, iterations, parallelism);
-    return {
-        key,
-        params: {
-            name: "argon2id",
-            memoryKib,
-            iterations,
-            parallelism,
-            salt: salt.toString("base64"),
-        },
-    };
-}
-export async function rederiveKeyFromEnvelope(passphrase, envelope) {
-    if (envelope.argon2id == null) {
-        throw new Error("wallet_envelope_not_passphrase_wrapped");
-    }
-    const passphraseBytes = typeof passphrase === "string"
-        ? Buffer.from(passphrase, "utf8")
-        : Buffer.from(passphrase);
-    const salt = Buffer.from(envelope.argon2id.salt, "base64");
-    return deriveArgon2Key(passphraseBytes, salt, envelope.argon2id.memoryKib, envelope.argon2id.iterations, envelope.argon2id.parallelism);
-}
 export function encryptBytesWithKey(plaintext, key, metadata) {
     const nonce = randomBytes(GCM_NONCE_BYTES);
     const cipher = createCipheriv("aes-256-gcm", Buffer.from(key), nonce);
@@ -77,7 +29,6 @@ export function encryptBytesWithKey(plaintext, key, metadata) {
         cipher: "aes-256-gcm",
         wrappedBy: metadata.wrappedBy,
         walletRootIdHint: metadata.walletRootIdHint ?? null,
-        argon2id: metadata.argon2id ?? null,
         secretProvider: metadata.secretProvider ?? null,
         nonce: nonce.toString("base64"),
         tag: tag.toString("base64"),
@@ -92,15 +43,6 @@ export function decryptBytesWithKey(envelope, key) {
         decipher.final(),
     ]);
 }
-export async function encryptJsonWithPassphrase(value, passphrase, metadata) {
-    const derived = await deriveKeyFromPassphrase(passphrase);
-    return encryptBytesWithKey(Buffer.from(JSON.stringify(value, jsonReplacer)), derived.key, {
-        format: metadata.format,
-        wrappedBy: metadata.wrappedBy ?? "passphrase",
-        walletRootIdHint: metadata.walletRootIdHint ?? null,
-        argon2id: derived.params,
-    });
-}
 export async function encryptJsonWithSecretProvider(value, provider, secretReference, metadata) {
     const key = await provider.loadSecret(secretReference.keyId);
     return encryptBytesWithKey(Buffer.from(JSON.stringify(value, jsonReplacer)), key, {
@@ -110,11 +52,6 @@ export async function encryptJsonWithSecretProvider(value, provider, secretRefer
         secretProvider: secretReference,
     });
 }
-export async function decryptJsonWithPassphrase(envelope, passphrase) {
-    const key = await rederiveKeyFromEnvelope(passphrase, envelope);
-    const plaintext = decryptBytesWithKey(envelope, key);
-    return JSON.parse(plaintext.toString("utf8"), jsonReviver);
-}
 export async function decryptJsonWithSecretProvider(envelope, provider) {
     if (envelope.secretProvider == null) {
         throw new Error("wallet_envelope_missing_secret_provider");

package/dist/wallet/state/provider.d.ts

@@ -1,17 +1,8 @@
-export interface LinuxSecretToolResult {
-    stdout: string;
-    stderr: string;
-    exitCode: number | null;
-    signal: NodeJS.Signals | null;
-}
-export interface LinuxSecretToolInvocationOptions {
-    stdin?: string;
-}
-export type LinuxSecretToolRunner = (args: readonly string[], options?: LinuxSecretToolInvocationOptions) => Promise<LinuxSecretToolResult>;
+import { type ClientPasswordPrompt, type ClientPasswordReadiness, type ClientPasswordSessionStatus, type ClientPasswordSetupAction } from "./client-password.js";
 export interface DefaultWalletSecretProviderFactoryOptions {
     platform?: NodeJS.Platform;
-    linuxSecretToolRunner?: LinuxSecretToolRunner;
     stateRoot?: string;
+    runtimeRoot?: string;
 }
 export interface WalletSecretReference {
     kind: string;
@@ -22,6 +13,13 @@ export interface WalletSecretProvider {
     loadSecret(keyId: string): Promise<Uint8Array>;
     storeSecret(keyId: string, secret: Uint8Array): Promise<void>;
     deleteSecret(keyId: string): Promise<void>;
+    withPrompter?(prompter: ClientPasswordPrompt): WalletSecretProvider;
+    inspectClientPasswordReadiness?(): Promise<ClientPasswordReadiness>;
+    ensureClientPasswordConfigured?(prompter: ClientPasswordPrompt): Promise<ClientPasswordSetupAction>;
+    changeClientPassword?(prompter: ClientPasswordPrompt): Promise<ClientPasswordSessionStatus>;
+    unlockClientPasswordSession?(prompter: ClientPasswordPrompt): Promise<ClientPasswordSessionStatus>;
+    lockClientPasswordSession?(): Promise<ClientPasswordSessionStatus>;
+    readClientPasswordSessionStatus?(): Promise<ClientPasswordSessionStatus>;
 }
 export declare function createWalletSecretReference(walletRootId: string): WalletSecretReference;
 export declare function createWalletPendingInitSecretReference(stateRoot: string): WalletSecretReference;
@@ -31,9 +29,23 @@ export declare class MemoryWalletSecretProvider implements WalletSecretProvider
     loadSecret(keyId: string): Promise<Uint8Array>;
     storeSecret(keyId: string, secret: Uint8Array): Promise<void>;
     deleteSecret(keyId: string): Promise<void>;
+    withPrompter(_prompter: ClientPasswordPrompt): WalletSecretProvider;
+    inspectClientPasswordReadiness(): Promise<ClientPasswordReadiness>;
+    ensureClientPasswordConfigured(_prompter: ClientPasswordPrompt): Promise<ClientPasswordSetupAction>;
+    unlockClientPasswordSession(_prompter: ClientPasswordPrompt): Promise<ClientPasswordSessionStatus>;
+    changeClientPassword(_prompter: ClientPasswordPrompt): Promise<ClientPasswordSessionStatus>;
+    lockClientPasswordSession(): Promise<ClientPasswordSessionStatus>;
+    readClientPasswordSessionStatus(): Promise<ClientPasswordSessionStatus>;
 }
 export declare function createDefaultWalletSecretProvider(): WalletSecretProvider;
 export declare function createDefaultWalletSecretProviderForTesting(options?: DefaultWalletSecretProviderFactoryOptions): WalletSecretProvider;
 export declare function createLazyDefaultWalletSecretProvider(): WalletSecretProvider;
 export declare function createMemoryWalletSecretProviderForTesting(): WalletSecretProvider;
+export declare function withInteractiveWalletSecretProvider(provider: WalletSecretProvider, prompter: ClientPasswordPrompt): WalletSecretProvider;
+export declare function ensureClientPasswordConfigured(provider: WalletSecretProvider, prompter: ClientPasswordPrompt): Promise<ClientPasswordSetupAction>;
+export declare function inspectClientPasswordSetupReadiness(provider: WalletSecretProvider): Promise<ClientPasswordReadiness>;
+export declare function unlockClientPassword(provider: WalletSecretProvider, prompter: ClientPasswordPrompt): Promise<ClientPasswordSessionStatus>;
+export declare function changeClientPassword(provider: WalletSecretProvider, prompter: ClientPasswordPrompt): Promise<ClientPasswordSessionStatus>;
+export declare function lockClientPassword(provider: WalletSecretProvider): Promise<ClientPasswordSessionStatus>;
+export declare function readClientPasswordStatus(provider: WalletSecretProvider): Promise<ClientPasswordSessionStatus>;
 export declare function createWalletRootId(): string;