@drakkar.software/octobot-client 0.4.0

package/dist/collections/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/collections/paths.ts"],"names":[],"mappings":"AAAA;;yEAEyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,MAA8B;IACpF,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAClC,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAC9E,WAAW,CACZ,CAAA;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,WAAmB,EAAE,MAA8B;IAC1E,OAAO,SAAS,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAA;AAC3D,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,WAAmB,EAAE,MAA8B;IAC1E,OAAO,SAAS,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAA;AAC3D,CAAC"}

package/dist/crypto/collectionKeys.d.ts

@@ -0,0 +1,28 @@
+import { type NodeCollectionKey } from '../collections/nodeCollections.js';
+/**
+ * Derive one base64-encoded, per-collection AES-256 key for each of
+ * `collections`, from the wallet's derived encryption secret. Each key is
+ * `HKDF-SHA256(secret, STARFISH_ENCRYPTION_SALT, collection.encryptionInfo)`
+ * — the exact same derivation `createSecretEncryptor` performs internally,
+ * just stopped one step early (raw bytes instead of an imported `CryptoKey`)
+ * so the bytes can travel in a read-only pairing payload.
+ *
+ * One-way and collection-independent by construction: HKDF cannot be
+ * inverted to recover `secret`, and a key derived for one `info` string
+ * reveals nothing about a key derived for a different one — so a payload
+ * carrying `{userData, accounts}` keys grants exactly those two collections,
+ * never the wallet secret itself and never `settings`/`strategies`/
+ * `accountTrading`, even though every collection's key is a deterministic
+ * function of the same underlying secret.
+ *
+ * Returns a `Partial` record deliberately: a grant covers a subset of
+ * collections, never all of them, and TypeScript should not let a caller
+ * assume every key is present.
+ */
+export declare function deriveCollectionKeys(secret: string, collections: readonly NodeCollectionKey[]): Partial<Record<NodeCollectionKey, string>>;
+/** Decode one collection's base64 key back to raw bytes, for
+ *  `createRawKeyEncryptor`. Throws on malformed base64 or a length other
+ *  than 32 bytes (AES-256) — a corrupt or truncated grant should fail loudly
+ *  at import time, not produce silent garbage ciphertext later. */
+export declare function decodeCollectionKey(base64Key: string): Uint8Array<ArrayBuffer>;
+//# sourceMappingURL=collectionKeys.d.ts.map

package/dist/crypto/collectionKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collectionKeys.d.ts","sourceRoot":"","sources":["../../src/crypto/collectionKeys.ts"],"names":[],"mappings":"AAGA,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,mCAAmC,CAAA;AAU5F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,SAAS,iBAAiB,EAAE,GACxC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAS5C;AAED;;;mEAGmE;AACnE,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAM9E"}

package/dist/crypto/collectionKeys.js

@@ -0,0 +1,53 @@
+import { deriveAesKeyBytes } from './hkdf.js';
+import { STARFISH_ENCRYPTION_SALT } from './wireConstants.js';
+import { toBase64, fromBase64 } from '../internal/bytes.js';
+import { NODE_COLLECTIONS } from '../collections/nodeCollections.js';
+/** `"0x"`-strip, matching `secretEncryptor.ts`'s `normalizeSecret` — HKDF
+ *  treats its secret as an opaque byte string, so the prefixed and
+ *  unprefixed forms of the same key derive completely different bytes, and
+ *  the node always HKDFs the stripped form. */
+function normalizeSecret(secret) {
+    return secret.startsWith('0x') ? secret.slice(2) : secret;
+}
+/**
+ * Derive one base64-encoded, per-collection AES-256 key for each of
+ * `collections`, from the wallet's derived encryption secret. Each key is
+ * `HKDF-SHA256(secret, STARFISH_ENCRYPTION_SALT, collection.encryptionInfo)`
+ * — the exact same derivation `createSecretEncryptor` performs internally,
+ * just stopped one step early (raw bytes instead of an imported `CryptoKey`)
+ * so the bytes can travel in a read-only pairing payload.
+ *
+ * One-way and collection-independent by construction: HKDF cannot be
+ * inverted to recover `secret`, and a key derived for one `info` string
+ * reveals nothing about a key derived for a different one — so a payload
+ * carrying `{userData, accounts}` keys grants exactly those two collections,
+ * never the wallet secret itself and never `settings`/`strategies`/
+ * `accountTrading`, even though every collection's key is a deterministic
+ * function of the same underlying secret.
+ *
+ * Returns a `Partial` record deliberately: a grant covers a subset of
+ * collections, never all of them, and TypeScript should not let a caller
+ * assume every key is present.
+ */
+export function deriveCollectionKeys(secret, collections) {
+    const normalized = normalizeSecret(secret);
+    const keys = {};
+    for (const collection of collections) {
+        const info = NODE_COLLECTIONS[collection].encryptionInfo;
+        const bytes = deriveAesKeyBytes(normalized, STARFISH_ENCRYPTION_SALT, info);
+        keys[collection] = toBase64(bytes);
+    }
+    return keys;
+}
+/** Decode one collection's base64 key back to raw bytes, for
+ *  `createRawKeyEncryptor`. Throws on malformed base64 or a length other
+ *  than 32 bytes (AES-256) — a corrupt or truncated grant should fail loudly
+ *  at import time, not produce silent garbage ciphertext later. */
+export function decodeCollectionKey(base64Key) {
+    const bytes = fromBase64(base64Key);
+    if (bytes.length !== 32) {
+        throw new Error(`invalid collection key: expected 32 bytes, got ${bytes.length}`);
+    }
+    return bytes;
+}
+//# sourceMappingURL=collectionKeys.js.map

package/dist/crypto/collectionKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collectionKeys.js","sourceRoot":"","sources":["../../src/crypto/collectionKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,gBAAgB,EAA0B,MAAM,mCAAmC,CAAA;AAE5F;;;+CAG+C;AAC/C,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,WAAyC;IAEzC,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC1C,MAAM,IAAI,GAA+C,EAAE,CAAA;IAC3D,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,cAAc,CAAA;QACxD,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,EAAE,wBAAwB,EAAE,IAAI,CAAC,CAAA;QAC3E,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;mEAGmE;AACnE,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,kDAAkD,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IACnF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/crypto/hkdf.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Derive a raw 32-byte AES-256 key via HKDF-SHA256 over UTF-8(secret) with
+ * UTF-8(salt) / UTF-8(info) — the same algorithm `@drakkar.software/
+ * starfish-protocol`'s `deriveAesKeyBytes` uses (verified byte-for-byte
+ * identical against its WebCrypto implementation for a fixed vector).
+ *
+ * Reimplemented locally because `deriveAesKeyBytes` is not reachable from
+ * that package's public entry point: only `deriveKey`, `IV_BYTES`,
+ * `ENCRYPTED_KEY` are re-exported from `./crypto.js`, and there is no
+ * `./crypto` subpath in its `exports` map. `@noble/hashes` is already a
+ * direct dependency of this package.
+ */
+export declare function deriveAesKeyBytes(secret: string, salt: string, info: string): Uint8Array;
+//# sourceMappingURL=hkdf.d.ts.map

package/dist/crypto/hkdf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hkdf.d.ts","sourceRoot":"","sources":["../../src/crypto/hkdf.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAExF"}

package/dist/crypto/hkdf.js

@@ -0,0 +1,19 @@
+import { sha256 } from '@noble/hashes/sha2.js';
+import { hkdf } from '@noble/hashes/hkdf.js';
+import { utf8ToBytes } from '@noble/hashes/utils.js';
+/**
+ * Derive a raw 32-byte AES-256 key via HKDF-SHA256 over UTF-8(secret) with
+ * UTF-8(salt) / UTF-8(info) — the same algorithm `@drakkar.software/
+ * starfish-protocol`'s `deriveAesKeyBytes` uses (verified byte-for-byte
+ * identical against its WebCrypto implementation for a fixed vector).
+ *
+ * Reimplemented locally because `deriveAesKeyBytes` is not reachable from
+ * that package's public entry point: only `deriveKey`, `IV_BYTES`,
+ * `ENCRYPTED_KEY` are re-exported from `./crypto.js`, and there is no
+ * `./crypto` subpath in its `exports` map. `@noble/hashes` is already a
+ * direct dependency of this package.
+ */
+export function deriveAesKeyBytes(secret, salt, info) {
+    return hkdf(sha256, utf8ToBytes(secret), utf8ToBytes(salt), utf8ToBytes(info), 32);
+}
+//# sourceMappingURL=hkdf.js.map

package/dist/crypto/hkdf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hkdf.js","sourceRoot":"","sources":["../../src/crypto/hkdf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAEpD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,IAAY,EAAE,IAAY;IAC1E,OAAO,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;AACpF,CAAC"}

package/dist/crypto/index.d.ts

@@ -0,0 +1,5 @@
+export { createSecretEncryptor, createRawKeyEncryptor } from './secretEncryptor.js';
+export { deriveCollectionKeys, decodeCollectionKey } from './collectionKeys.js';
+export { deriveAesKeyBytes } from './hkdf.js';
+export { SYNC_MOUNT_PATH, SYNC_NAMESPACE, SYNC_FETCH_TIMEOUT_MS, DEFAULT_PROBE_TIMEOUT_MS, STARFISH_ENCRYPTION_SALT, } from './wireConstants.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/crypto/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EACL,eAAe,EACf,cAAc,EACd,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,oBAAoB,CAAA"}

package/dist/crypto/index.js

@@ -0,0 +1,5 @@
+export { createSecretEncryptor, createRawKeyEncryptor } from './secretEncryptor.js';
+export { deriveCollectionKeys, decodeCollectionKey } from './collectionKeys.js';
+export { deriveAesKeyBytes } from './hkdf.js';
+export { SYNC_MOUNT_PATH, SYNC_NAMESPACE, SYNC_FETCH_TIMEOUT_MS, DEFAULT_PROBE_TIMEOUT_MS, STARFISH_ENCRYPTION_SALT, } from './wireConstants.js';
+//# sourceMappingURL=index.js.map

package/dist/crypto/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EACL,eAAe,EACf,cAAc,EACd,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,oBAAoB,CAAA"}

package/dist/crypto/secretEncryptor.d.ts

@@ -0,0 +1,20 @@
+import type { Encryptor } from '@drakkar.software/starfish-protocol';
+/**
+ * Build a symmetric Encryptor keyed by HKDF-SHA256(secret, salt, info) → AES-256-GCM.
+ *
+ * Mirrors octobot_sync/crypto.py SecretEncryptor. The {iv, data} envelope is
+ * compatible with Python's encrypt_bytes_to_blob_dict / decrypt_blob_dict_to_bytes.
+ *
+ * The key is derived once and cached in the returned Encryptor instance.
+ */
+export declare function createSecretEncryptor(secret: string, salt: string, info: string): Encryptor;
+/**
+ * Build an Encryptor from an already-derived raw AES-256 key (32 bytes),
+ * imported as a non-extractable AES-GCM `CryptoKey` — no HKDF step. Used for
+ * the read-only pairing path, where the payload carries a precomputed
+ * per-collection subkey (see `crypto/collectionKeys.ts`) instead of the
+ * wallet secret, so the recipient can decrypt exactly the granted
+ * collections and nothing else, and can never re-derive any other key.
+ */
+export declare function createRawKeyEncryptor(keyBytes: Uint8Array<ArrayBuffer>): Encryptor;
+//# sourceMappingURL=secretEncryptor.d.ts.map

package/dist/crypto/secretEncryptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretEncryptor.d.ts","sourceRoot":"","sources":["../../src/crypto/secretEncryptor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAmEpE;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,SAAS,CAEX;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,SAAS,CASlF"}

package/dist/crypto/secretEncryptor.js

@@ -0,0 +1,82 @@
+import { deriveKey } from '@drakkar.software/starfish-protocol';
+import { toBase64, fromBase64 } from '../internal/bytes.js';
+// Envelope keys — must match octobot_sync/constants.py BLOB_IV_KEY / BLOB_DATA_KEY.
+const BLOB_IV_KEY = 'iv';
+const BLOB_DATA_KEY = 'data';
+// 96-bit IV for AES-256-GCM — matches Python's IV_BYTES = 12.
+const IV_BYTES = 12;
+/** The node stores wallet private keys with the `0x` prefix stripped
+ *  (`community_wallet.py`: `private_key=private_key.removeprefix("0x")`) and
+ *  HKDFs that stripped string directly (`octobot_sync/crypto.py`). HKDF
+ *  treats its secret as an opaque byte string, not parsed hex, so `"0x1234"`
+ *  and `"1234"` derive completely different keys despite representing the
+ *  same private key numerically. Every caller here must agree with the node
+ *  on the stripped form, so normalize once, centrally, rather than trusting
+ *  each call site to strip before calling in. */
+function normalizeSecret(secret) {
+    return secret.startsWith('0x') ? secret.slice(2) : secret;
+}
+/** Build an `Encryptor` from an already-resolved (or resolving) AES-256-GCM
+ *  `CryptoKey`. Shared by `createSecretEncryptor` (derives the key from a
+ *  wallet secret) and `createRawKeyEncryptor` (imports an already-derived
+ *  key directly — the read-only pairing path, where the payload carries a
+ *  precomputed per-collection subkey rather than the wallet secret itself). */
+function buildAesGcmEncryptor(keyPromise) {
+    return {
+        async encrypt(data) {
+            const key = await keyPromise;
+            const ivBuf = new ArrayBuffer(IV_BYTES);
+            globalThis.crypto.getRandomValues(new Uint8Array(ivBuf));
+            const iv = new Uint8Array(ivBuf);
+            const plaintext = new TextEncoder().encode(JSON.stringify(data));
+            const ciphertext = new Uint8Array(await globalThis.crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, plaintext));
+            return {
+                [BLOB_IV_KEY]: toBase64(iv),
+                [BLOB_DATA_KEY]: toBase64(ciphertext),
+            };
+        },
+        async decrypt(wrapper) {
+            // Server wraps the {iv,data} blob as a JSON string inside StoredDocument.data.
+            // Parse it when needed so both current (string) and future (object) server formats work.
+            const blob = typeof wrapper === 'string'
+                ? JSON.parse(wrapper)
+                : wrapper;
+            // A collection that has never been pushed for this identity pulls back
+            // as the STRING "null" (the same opaque-string convention every real
+            // blob uses, just carrying the JSON literal `null` instead of a real
+            // {iv,data} envelope) — parsing it above yields the JS value `null`,
+            // not an object. Nothing to decrypt yet.
+            if (blob == null)
+                return {};
+            const key = await keyPromise;
+            const iv = fromBase64(blob[BLOB_IV_KEY]);
+            const ciphertext = fromBase64(blob[BLOB_DATA_KEY]);
+            const plaintext = new Uint8Array(await globalThis.crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, ciphertext));
+            return JSON.parse(new TextDecoder().decode(plaintext));
+        },
+    };
+}
+/**
+ * Build a symmetric Encryptor keyed by HKDF-SHA256(secret, salt, info) → AES-256-GCM.
+ *
+ * Mirrors octobot_sync/crypto.py SecretEncryptor. The {iv, data} envelope is
+ * compatible with Python's encrypt_bytes_to_blob_dict / decrypt_blob_dict_to_bytes.
+ *
+ * The key is derived once and cached in the returned Encryptor instance.
+ */
+export function createSecretEncryptor(secret, salt, info) {
+    return buildAesGcmEncryptor(deriveKey(normalizeSecret(secret), salt, info));
+}
+/**
+ * Build an Encryptor from an already-derived raw AES-256 key (32 bytes),
+ * imported as a non-extractable AES-GCM `CryptoKey` — no HKDF step. Used for
+ * the read-only pairing path, where the payload carries a precomputed
+ * per-collection subkey (see `crypto/collectionKeys.ts`) instead of the
+ * wallet secret, so the recipient can decrypt exactly the granted
+ * collections and nothing else, and can never re-derive any other key.
+ */
+export function createRawKeyEncryptor(keyBytes) {
+    const keyPromise = globalThis.crypto.subtle.importKey('raw', keyBytes, { name: 'AES-GCM' }, false, ['encrypt', 'decrypt']);
+    return buildAesGcmEncryptor(keyPromise);
+}
+//# sourceMappingURL=secretEncryptor.js.map

package/dist/crypto/secretEncryptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretEncryptor.js","sourceRoot":"","sources":["../../src/crypto/secretEncryptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAE/D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAE3D,oFAAoF;AACpF,MAAM,WAAW,GAAG,IAAI,CAAA;AACxB,MAAM,aAAa,GAAG,MAAM,CAAA;AAC5B,8DAA8D;AAC9D,MAAM,QAAQ,GAAG,EAAE,CAAA;AAEnB;;;;;;;iDAOiD;AACjD,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;AAC3D,CAAC;AAED;;;;+EAI+E;AAC/E,SAAS,oBAAoB,CAAC,UAA8B;IAC1D,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,IAA6B;YACzC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAA;YAC5B,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAA;YACvC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;YACxD,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;YAChC,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;YAChE,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAChF,CAAA;YACD,OAAO;gBACL,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC3B,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC;aACtC,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,OAAgC;YAC5C,+EAA+E;YAC/E,yFAAyF;YACzF,MAAM,IAAI,GACR,OAAO,OAAO,KAAK,QAAQ;gBACzB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoC;gBACzD,CAAC,CAAE,OAA0C,CAAA;YACjD,uEAAuE;YACvE,qEAAqE;YACrE,qEAAqE;YACrE,qEAAqE;YACrE,yCAAyC;YACzC,IAAI,IAAI,IAAI,IAAI;gBAAE,OAAO,EAAE,CAAA;YAC3B,MAAM,GAAG,GAAG,MAAM,UAAU,CAAA;YAC5B,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAW,CAAC,CAAA;YAClD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,aAAa,CAAW,CAAC,CAAA;YAC5D,MAAM,SAAS,GAAG,IAAI,UAAU,CAC9B,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CACjF,CAAA;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAA4B,CAAA;QACnF,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,IAAY,EACZ,IAAY;IAEZ,OAAO,oBAAoB,CAAC,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAiC;IACrE,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CACnD,KAAK,EACL,QAAQ,EACR,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAA;IACD,OAAO,oBAAoB,CAAC,UAAU,CAAC,CAAA;AACzC,CAAC"}

package/dist/crypto/wireConstants.d.ts

@@ -0,0 +1,14 @@
+/** The server mounts the sync sub-app at this path. The Starfish client
+ *  receives this as the baseUrl suffix and handles /v1/{namespace}/... internally. */
+export declare const SYNC_MOUNT_PATH = "sync";
+export declare const SYNC_NAMESPACE = "octobot";
+/** Per-request timeout on sync clients. Bounds a merging pull's write-gating
+ *  window when the target node is offline (raw fetch would hang for the OS
+ *  TCP timeout, 60s+). Documents are small JSON — 10s is ample for push too. */
+export declare const SYNC_FETCH_TIMEOUT_MS = 10000;
+export declare const DEFAULT_PROBE_TIMEOUT_MS = 4000;
+/** HKDF salt for identity-encryption key derivation.
+ *  @see packages/sync/octobot_sync/constants.py — HKDF_SALT_STRING
+ *  @remarks Changing this breaks decryption of every existing document. */
+export declare const STARFISH_ENCRYPTION_SALT = "octobot-starfish-identity-v1";
+//# sourceMappingURL=wireConstants.d.ts.map

package/dist/crypto/wireConstants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wireConstants.d.ts","sourceRoot":"","sources":["../../src/crypto/wireConstants.ts"],"names":[],"mappings":"AAIA;sFACsF;AACtF,eAAO,MAAM,eAAe,SAAS,CAAA;AACrC,eAAO,MAAM,cAAc,YAAY,CAAA;AAEvC;;gFAEgF;AAChF,eAAO,MAAM,qBAAqB,QAAS,CAAA;AAC3C,eAAO,MAAM,wBAAwB,OAAO,CAAA;AAE5C;;2EAE2E;AAC3E,eAAO,MAAM,wBAAwB,iCAAiC,CAAA"}

package/dist/crypto/wireConstants.js

@@ -0,0 +1,17 @@
+// Literal strings and numbers shared with the node's Python implementation.
+// A change on either side breaks sync SILENTLY — see tests/wireContract.test.ts
+// and https://docs.octobot.cloud/client-sdk/wire-contract for the full inventory.
+/** The server mounts the sync sub-app at this path. The Starfish client
+ *  receives this as the baseUrl suffix and handles /v1/{namespace}/... internally. */
+export const SYNC_MOUNT_PATH = 'sync';
+export const SYNC_NAMESPACE = 'octobot';
+/** Per-request timeout on sync clients. Bounds a merging pull's write-gating
+ *  window when the target node is offline (raw fetch would hang for the OS
+ *  TCP timeout, 60s+). Documents are small JSON — 10s is ample for push too. */
+export const SYNC_FETCH_TIMEOUT_MS = 10_000;
+export const DEFAULT_PROBE_TIMEOUT_MS = 4000;
+/** HKDF salt for identity-encryption key derivation.
+ *  @see packages/sync/octobot_sync/constants.py — HKDF_SALT_STRING
+ *  @remarks Changing this breaks decryption of every existing document. */
+export const STARFISH_ENCRYPTION_SALT = 'octobot-starfish-identity-v1';
+//# sourceMappingURL=wireConstants.js.map

package/dist/crypto/wireConstants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wireConstants.js","sourceRoot":"","sources":["../../src/crypto/wireConstants.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,gFAAgF;AAChF,kFAAkF;AAElF;sFACsF;AACtF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAA;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAA;AAEvC;;gFAEgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAC3C,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAA;AAE5C;;2EAE2E;AAC3E,MAAM,CAAC,MAAM,wBAAwB,GAAG,8BAA8B,CAAA"}

package/dist/identity/address.d.ts

@@ -0,0 +1,3 @@
+/** EIP-55 checksummed EVM address derived from a secp256k1 private key. */
+export declare function deriveEvmAddress(privateKey: Uint8Array): string;
+//# sourceMappingURL=address.d.ts.map

package/dist/identity/address.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"address.d.ts","sourceRoot":"","sources":["../../src/identity/address.ts"],"names":[],"mappings":"AAaA,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAI/D"}

package/dist/identity/address.js

@@ -0,0 +1,17 @@
+import { secp256k1 } from '@noble/curves/secp256k1.js';
+import { keccak_256 } from '@noble/hashes/sha3.js';
+import { toHex } from '../internal/bytes.js';
+// EIP-55 checksum-casing and EVM address derivation. Previously duplicated
+// verbatim across auth/cap-provider.ts and auth/auth-core.ts in
+// @drakkar.software/octobot-sdk — consolidated here.
+function eip55Address(lower) {
+    const hash = toHex(keccak_256(new TextEncoder().encode(lower)));
+    return '0x' + Array.from(lower, (c, i) => (parseInt(hash[i], 16) >= 8 ? c.toUpperCase() : c)).join('');
+}
+/** EIP-55 checksummed EVM address derived from a secp256k1 private key. */
+export function deriveEvmAddress(privateKey) {
+    const pubkey = secp256k1.getPublicKey(privateKey, false); // 65-byte uncompressed
+    const hash = keccak_256(pubkey.slice(1)); // keccak256 of 64-byte (x, y)
+    return eip55Address(toHex(hash.slice(12))); // last 20 bytes → checksummed address
+}
+//# sourceMappingURL=address.js.map

package/dist/identity/address.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"address.js","sourceRoot":"","sources":["../../src/identity/address.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAE5C,2EAA2E;AAC3E,gEAAgE;AAChE,qDAAqD;AAErD,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC/D,OAAO,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACxG,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,UAAsB;IACrD,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA,CAAC,uBAAuB;IAChF,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA,CAAiB,8BAA8B;IACvF,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAe,sCAAsC;AACjG,CAAC"}

package/dist/identity/bip39-wordlist.d.ts

@@ -0,0 +1,2 @@
+export declare const BIP39_WORDLIST: readonly string[];
+//# sourceMappingURL=bip39-wordlist.d.ts.map

package/dist/identity/bip39-wordlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bip39-wordlist.d.ts","sourceRoot":"","sources":["../../src/identity/bip39-wordlist.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAigElC,CAAA"}