@dynamic-labs-wallet/forward-mpc-shared 0.1.0-alpha.6 → 0.1.0-alpha.7

package/dist/index.cjs

@@ -0,0 +1,823 @@
+'use strict';
+
+var fpTs = require('fp-ts');
+var ioTs = require('io-ts');
+var utils_js = require('@noble/hashes/utils.js');
+var core = require('@dynamic-labs-wallet/core');
+var mlKem_js = require('@noble/post-quantum/ml-kem.js');
+var hkdf_js = require('@noble/hashes/hkdf.js');
+var sha2_js = require('@noble/hashes/sha2.js');
+var aes = require('@noble/ciphers/aes');
+
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+// src/types.ts
+var WebSocketErrorType = /* @__PURE__ */ (function(WebSocketErrorType2) {
+  WebSocketErrorType2["INVALID_MESSAGE"] = "INVALID_MESSAGE";
+  WebSocketErrorType2["HANDLER_NOT_FOUND"] = "HANDLER_NOT_FOUND";
+  WebSocketErrorType2["HANDLER_ERROR"] = "HANDLER_ERROR";
+  WebSocketErrorType2["CONNECTION_ERROR"] = "CONNECTION_ERROR";
+  WebSocketErrorType2["VALIDATION_ERROR"] = "VALIDATION_ERROR";
+  return WebSocketErrorType2;
+})({});
+
+// src/messages/base.ts
+var BaseMessage = class {
+  static {
+    __name(this, "BaseMessage");
+  }
+  data;
+  constructor(data) {
+    this.data = data;
+  }
+  getData() {
+    return this.data;
+  }
+};
+var Uint8ArrayCodec = new ioTs.Type(
+  "Uint8Array",
+  (u) => u instanceof Uint8Array,
+  (u, c) => {
+    if (typeof u !== "string") {
+      return ioTs.failure(u, c, "Expected a hex string for Uint8Array");
+    }
+    try {
+      const cleanHex = u.startsWith("0x") ? u.slice(2) : u;
+      if (cleanHex.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(cleanHex)) {
+        return ioTs.failure(u, c, "Invalid hex string format");
+      }
+      const decoded = utils_js.hexToBytes(cleanHex);
+      return ioTs.success(decoded);
+    } catch (e) {
+      return ioTs.failure(u, c, `Invalid hex string: ${e}`);
+    }
+  },
+  // The `encode` function for converting back to the output type
+  (a) => utils_js.bytesToHex(a)
+);
+var Uint32ArrayCodec = new ioTs.Type(
+  "Uint32Array",
+  (u) => u instanceof Uint32Array,
+  (u, c) => {
+    if (typeof u !== "string") {
+      return ioTs.failure(u, c, "Expected a hex string for Uint32Array");
+    }
+    try {
+      const cleanHex = u.startsWith("0x") ? u.slice(2) : u;
+      if (cleanHex.length === 0) {
+        return ioTs.failure(u, c, "Empty hex string not allowed for Uint32Array");
+      }
+      if (cleanHex.length % 8 !== 0) {
+        return ioTs.failure(u, c, "Invalid hex string format for Uint32Array (must be multiple of 8 hex characters)");
+      }
+      const uint8Array = utils_js.hexToBytes(cleanHex);
+      const uint32Array = new Uint32Array(uint8Array.buffer);
+      return ioTs.success(uint32Array);
+    } catch (e) {
+      return ioTs.failure(u, c, `Invalid hex string: ${e}`);
+    }
+  },
+  // The `encode` function for converting back to the output type
+  (a) => {
+    const uint8Array = new Uint8Array(a.buffer);
+    return utils_js.bytesToHex(uint8Array);
+  }
+);
+var EncryptedKeyshareCodec = ioTs.type({
+  salt: Uint8ArrayCodec,
+  encryptedPayload: Uint8ArrayCodec
+});
+function buildMessageSchema(messageType, version, additionalFields = {}, ...additionalSchemas) {
+  const schema = ioTs.type({
+    type: ioTs.literal(messageType),
+    version: ioTs.literal(version),
+    ...additionalFields
+  });
+  if (additionalSchemas.length === 0) {
+    return schema;
+  }
+  if (additionalSchemas.length === 1) {
+    return ioTs.intersection([
+      schema,
+      additionalSchemas[0]
+    ]);
+  }
+  let result = ioTs.intersection([
+    schema,
+    additionalSchemas[0]
+  ]);
+  for (let i = 1; i < additionalSchemas.length; i++) {
+    result = ioTs.intersection([
+      result,
+      additionalSchemas[i]
+    ]);
+  }
+  return result;
+}
+__name(buildMessageSchema, "buildMessageSchema");
+
+// src/messages/utils/encodingHelpers.ts
+function createComplexEncoder(messageType, version, fieldTransforms = {}) {
+  return (data) => {
+    const encoded = {
+      type: messageType,
+      version
+    };
+    for (const [key, value] of Object.entries(data)) {
+      if (value !== void 0) {
+        encoded[key] = fieldTransforms[key] ? fieldTransforms[key](value) : value;
+      }
+    }
+    return encoded;
+  };
+}
+__name(createComplexEncoder, "createComplexEncoder");
+function createStandardDecoder(fieldExtractor) {
+  return (decoded) => fieldExtractor(decoded);
+}
+__name(createStandardDecoder, "createStandardDecoder");
+function createStandardMessage(config) {
+  let StandardMessageClass = class StandardMessageClass2 extends BaseMessage {
+    static {
+      __name(this, "StandardMessageClass");
+    }
+    static MESSAGE_TYPE = config.messageType;
+    static MESSAGE_VERSION = config.version;
+    static schema = config.schema;
+    type = config.messageType;
+    version = config.version;
+    constructor(data) {
+      super(data);
+    }
+    encode() {
+      return config.encodeData(this.data, this.type, this.version);
+    }
+    static decode(wireData) {
+      const result = config.schema.decode(wireData);
+      if (fpTs.either.isLeft(result)) {
+        return result;
+      }
+      const decoded = result.right;
+      return {
+        _tag: "Right",
+        right: new StandardMessageClass2(config.decodeData(decoded))
+      };
+    }
+  };
+  return StandardMessageClass;
+}
+__name(createStandardMessage, "createStandardMessage");
+function createSimpleMessage(config) {
+  return createStandardMessage({
+    messageType: config.messageType,
+    version: config.version,
+    schema: config.schema,
+    encodeData: /* @__PURE__ */ __name((data) => ({
+      type: config.messageType,
+      version: config.version,
+      ...data
+    }), "encodeData"),
+    decodeData: /* @__PURE__ */ __name((decoded) => {
+      const { type: type7, version, ...data } = decoded;
+      return data;
+    }, "decodeData")
+  });
+}
+__name(createSimpleMessage, "createSimpleMessage");
+
+// src/messages/HandshakeV1Request.ts
+var HandshakeRequestSchema = buildMessageSchema("handshake", 1, {
+  challenge: Uint8ArrayCodec,
+  nonce: Uint8ArrayCodec
+});
+var HandshakeV1RequestMessage = createStandardMessage({
+  messageType: "handshake",
+  version: 1,
+  schema: HandshakeRequestSchema,
+  encodeData: /* @__PURE__ */ __name((data) => HandshakeRequestSchema.encode({
+    type: "handshake",
+    version: 1,
+    challenge: data.challenge,
+    nonce: data.nonce
+  }), "encodeData"),
+  decodeData: createStandardDecoder((decoded) => ({
+    challenge: decoded.challenge,
+    nonce: decoded.nonce
+  }))
+});
+var HandshakeResponseSchema = buildMessageSchema("handshake_response", 1, {
+  encapsulatedSharedSecret: ioTs.string,
+  attestationDoc: ioTs.string,
+  connectionId: ioTs.string
+});
+var HandshakeV1ResponseMessage = createSimpleMessage({
+  messageType: "handshake_response",
+  version: 1,
+  schema: HandshakeResponseSchema
+});
+
+// src/signing/base.ts
+var BaseSigningAlgorithm = class {
+  static {
+    __name(this, "BaseSigningAlgorithm");
+  }
+};
+var Ed25519SigningAlgorithm = class extends BaseSigningAlgorithm {
+  static {
+    __name(this, "Ed25519SigningAlgorithm");
+  }
+  algorithmName = "ed25519";
+  version = 1;
+  schema = ioTs.intersection([
+    ioTs.type({
+      signingAlgo: ioTs.literal("ed25519")
+    }),
+    ioTs.partial({
+      derivationPath: Uint32ArrayCodec
+    })
+  ]);
+  createKeygenResultFromSecretShare(secretShare) {
+    return {
+      secretShare,
+      pubkey: new Uint8Array(32)
+    };
+  }
+  createSignRequest(keygenResult, params) {
+    return {
+      secretShare: keygenResult.secretShare,
+      ...params
+    };
+  }
+  processSignResult(_result) {
+    return new Uint8Array(64);
+  }
+};
+var BIP340SigningAlgorithm = class extends BaseSigningAlgorithm {
+  static {
+    __name(this, "BIP340SigningAlgorithm");
+  }
+  algorithmName = "bip340";
+  version = 1;
+  schema = ioTs.intersection([
+    ioTs.type({
+      signingAlgo: ioTs.literal("bip340")
+    }),
+    ioTs.partial({
+      derivationPath: Uint32ArrayCodec,
+      tweak: Uint8ArrayCodec
+    })
+  ]);
+  createKeygenResultFromSecretShare(secretShare) {
+    return {
+      secretShare,
+      pubkey: new Uint8Array(32)
+    };
+  }
+  createSignRequest(keygenResult, params) {
+    return {
+      secretShare: keygenResult.secretShare,
+      ...params
+    };
+  }
+  processSignResult(_result) {
+    return new Uint8Array(64);
+  }
+};
+var EcdsaSigningAlgorithm = class extends BaseSigningAlgorithm {
+  static {
+    __name(this, "EcdsaSigningAlgorithm");
+  }
+  algorithmName = "ecdsa";
+  version = 1;
+  schema = ioTs.intersection([
+    ioTs.type({
+      signingAlgo: ioTs.literal("ecdsa")
+    }),
+    ioTs.partial({
+      hashAlgo: ioTs.union([
+        ioTs.literal("sha256"),
+        ioTs.literal("sha256d"),
+        ioTs.literal("keccak256")
+      ]),
+      derivationPath: Uint32ArrayCodec
+    })
+  ]);
+  createKeygenResultFromSecretShare(secretShare) {
+    return {
+      secretShare,
+      pubkey: {
+        pubKeyAsHex: /* @__PURE__ */ __name(() => "0x" + "00".repeat(33), "pubKeyAsHex"),
+        serializeCompressed: /* @__PURE__ */ __name(() => new Uint8Array(33), "serializeCompressed"),
+        serializeUncompressed: /* @__PURE__ */ __name(() => new Uint8Array(65), "serializeUncompressed")
+      }
+    };
+  }
+  createSignRequest(keygenResult, params) {
+    return {
+      secretShare: keygenResult.secretShare,
+      ...params
+    };
+  }
+  processSignResult(_result) {
+    return new Uint8Array(64);
+  }
+};
+
+// src/signing/allAlgorithms.ts
+var SIGNING_ALGORITHM_CLASSES = {
+  ed25519: Ed25519SigningAlgorithm,
+  bip340: BIP340SigningAlgorithm,
+  ecdsa: EcdsaSigningAlgorithm
+};
+var ALL_SIGNING_ALGORITHM_NAMES = Object.keys(SIGNING_ALGORITHM_CLASSES);
+var SIGNING_ALGORITHM_INSTANCES = {
+  ed25519: new SIGNING_ALGORITHM_CLASSES.ed25519(),
+  bip340: new SIGNING_ALGORITHM_CLASSES.bip340(),
+  ecdsa: new SIGNING_ALGORITHM_CLASSES.ecdsa()
+};
+var ALL_SIGNING_ALGORITHM_SCHEMA = (() => {
+  const schemas = Object.values(SIGNING_ALGORITHM_INSTANCES).map((instance) => instance.schema);
+  if (schemas.length === 0) {
+    throw new Error("No signing algorithms defined");
+  }
+  if (schemas.length === 1) {
+    return schemas[0];
+  }
+  return ioTs.union([
+    schemas[0],
+    schemas[1],
+    ...schemas.slice(2)
+  ]);
+})();
+function isValidSigningAlgorithm(name) {
+  return name in SIGNING_ALGORITHM_CLASSES;
+}
+__name(isValidSigningAlgorithm, "isValidSigningAlgorithm");
+function createKeygenResultFromSecretShare(algorithmName, secretShare) {
+  const algorithm = SIGNING_ALGORITHM_INSTANCES[algorithmName];
+  if (!algorithm) {
+    throw new Error(`Unknown signing algorithm: ${algorithmName}`);
+  }
+  return algorithm.createKeygenResultFromSecretShare(secretShare);
+}
+__name(createKeygenResultFromSecretShare, "createKeygenResultFromSecretShare");
+var ALGORITHMS = {
+  [core.SigningAlgorithm.ECDSA]: {
+    name: "ecdsa",
+    dynamicEnum: core.SigningAlgorithm.ECDSA,
+    className: "Ecdsa",
+    requiresHashAlgo: true,
+    supportsDerivationPath: true,
+    supportsTweak: false,
+    supportedHashAlgos: [
+      "sha256",
+      "sha256d",
+      "keccak256"
+    ]
+  },
+  [core.SigningAlgorithm.ED25519]: {
+    name: "ed25519",
+    dynamicEnum: core.SigningAlgorithm.ED25519,
+    className: "Ed25519",
+    requiresHashAlgo: false,
+    supportsDerivationPath: true,
+    supportsTweak: false,
+    supportedHashAlgos: []
+  },
+  [core.SigningAlgorithm.BIP340]: {
+    name: "bip340",
+    dynamicEnum: core.SigningAlgorithm.BIP340,
+    className: "BIP340",
+    requiresHashAlgo: false,
+    supportsDerivationPath: true,
+    supportsTweak: true,
+    supportedHashAlgos: []
+  }
+};
+function toDynamicSigningAlgorithm(algorithmName) {
+  const algorithmConfig = Object.values(ALGORITHMS).find((config) => config.name === algorithmName);
+  if (!algorithmConfig) {
+    throw new Error(`Unknown algorithm: ${algorithmName}`);
+  }
+  return algorithmConfig.dynamicEnum;
+}
+__name(toDynamicSigningAlgorithm, "toDynamicSigningAlgorithm");
+function fromDynamicSigningAlgorithm(dynamicAlgorithm) {
+  const algorithmConfig = ALGORITHMS[dynamicAlgorithm];
+  if (!algorithmConfig) {
+    throw new Error(`Unknown Dynamic SDK algorithm: ${dynamicAlgorithm}`);
+  }
+  return algorithmConfig.name;
+}
+__name(fromDynamicSigningAlgorithm, "fromDynamicSigningAlgorithm");
+var SignatureAlgoSchema = ALL_SIGNING_ALGORITHM_SCHEMA;
+var DomainCodec = new ioTs.Type("DomainCodec", (u) => typeof u === "string", (u, c) => {
+  if (typeof u !== "string") {
+    return ioTs.failure(u, c, "Value must be a string");
+  }
+  const domainPattern = /^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*(?::\d{1,5})?$/;
+  if (!domainPattern.test(u)) {
+    return ioTs.failure(u, c, "Invalid domain format");
+  }
+  return ioTs.success(u);
+}, ioTs.identity);
+var Uint8ArrayOrHexCodec = new ioTs.Type(
+  "Uint8ArrayOrHex",
+  (u) => u instanceof Uint8Array,
+  (u, c) => {
+    if (u instanceof Uint8Array) {
+      return ioTs.success(u);
+    }
+    if (typeof u !== "string") {
+      return ioTs.failure(u, c, "Expected a hex string or Uint8Array");
+    }
+    try {
+      const cleanHex = u.startsWith("0x") ? u.slice(2) : u;
+      if (cleanHex.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(cleanHex)) {
+        return ioTs.failure(u, c, "Invalid hex string format");
+      }
+      const decoded = utils_js.hexToBytes(cleanHex);
+      return ioTs.success(decoded);
+    } catch (e) {
+      return ioTs.failure(u, c, `Invalid hex string: ${e}`);
+    }
+  },
+  // The `encode` function for converting back to the output type
+  (a) => {
+    if (typeof a === "string") {
+      return a;
+    }
+    return utils_js.bytesToHex(a);
+  }
+);
+
+// src/messages/SignMessageV1Request.ts
+var SignMessageRequestSchema = buildMessageSchema("signMessage", 1, {
+  relayDomain: DomainCodec,
+  keyshare: EncryptedKeyshareCodec,
+  message: Uint8ArrayOrHexCodec,
+  roomUuid: ioTs.string
+}, SignatureAlgoSchema);
+var SignMessageV1RequestMessage = createStandardMessage({
+  messageType: "signMessage",
+  version: 1,
+  schema: SignMessageRequestSchema,
+  encodeData: createComplexEncoder("signMessage", 1, {
+    signingAlgo: /* @__PURE__ */ __name((value) => fromDynamicSigningAlgorithm(value), "signingAlgo"),
+    derivationPath: /* @__PURE__ */ __name((value) => Uint32ArrayCodec.encode(value), "derivationPath"),
+    tweak: /* @__PURE__ */ __name((value) => Uint8ArrayCodec.encode(value), "tweak"),
+    keyshare: /* @__PURE__ */ __name((value) => EncryptedKeyshareCodec.encode(value), "keyshare"),
+    message: /* @__PURE__ */ __name((value) => Uint8ArrayOrHexCodec.encode(value), "message")
+  }),
+  decodeData: createStandardDecoder((decoded) => ({
+    relayDomain: decoded.relayDomain,
+    signingAlgo: decoded.signingAlgo,
+    hashAlgo: decoded.hashAlgo,
+    derivationPath: decoded.derivationPath,
+    tweak: decoded.tweak,
+    keyshare: decoded.keyshare,
+    message: decoded.message,
+    roomUuid: decoded.roomUuid
+  }))
+});
+var WebSocketErrorTypeCodec = ioTs.string;
+var WebSocketErrorCodec = ioTs.type({
+  type: WebSocketErrorTypeCodec,
+  message: ioTs.string,
+  details: ioTs.union([
+    ioTs.unknown,
+    ioTs.undefined
+  ])
+});
+
+// src/messages/SignMessageV1Response.ts
+var SignMessageResponseSchema = buildMessageSchema("signMessage_response", 1, {
+  signature: ioTs.union([
+    Uint8ArrayOrHexCodec,
+    ioTs.undefined
+  ]),
+  error: ioTs.union([
+    WebSocketErrorCodec,
+    ioTs.undefined
+  ])
+});
+var SignMessageV1ResponseMessage = createStandardMessage({
+  messageType: "signMessage_response",
+  version: 1,
+  schema: SignMessageResponseSchema,
+  encodeData: createComplexEncoder("signMessage_response", 1, {
+    signature: /* @__PURE__ */ __name((value) => Uint8ArrayOrHexCodec.encode(value), "signature")
+  }),
+  decodeData: createStandardDecoder((decoded) => ({
+    signature: decoded.signature,
+    error: decoded.error
+  }))
+});
+var ConnectionAckRequestSchema = buildMessageSchema("connection_ack", 1, {
+  connectionId: ioTs.union([
+    ioTs.string,
+    ioTs.undefined
+  ])
+});
+var ConnectionAckV1RequestMessage = createSimpleMessage({
+  messageType: "connection_ack",
+  version: 1,
+  schema: ConnectionAckRequestSchema
+});
+var ConnectionAckResponseSchema = buildMessageSchema("connection_ack_response", 1, {
+  status: ioTs.literal("acknowledged"),
+  timestamp: ioTs.string
+});
+var ConnectionAckV1ResponseMessage = createSimpleMessage({
+  messageType: "connection_ack_response",
+  version: 1,
+  schema: ConnectionAckResponseSchema
+});
+
+// src/messages/allMessages.ts
+var ALL_MESSAGE_CLASSES = {
+  "handshake@1": HandshakeV1RequestMessage,
+  "handshake_response@1": HandshakeV1ResponseMessage,
+  "signMessage@1": SignMessageV1RequestMessage,
+  "signMessage_response@1": SignMessageV1ResponseMessage,
+  "connection_ack@1": ConnectionAckV1RequestMessage,
+  "connection_ack_response@1": ConnectionAckV1ResponseMessage
+};
+var ALL_MESSAGE_KEYS = Object.keys(ALL_MESSAGE_CLASSES);
+function getMessageClass(type7, version) {
+  const key = `${type7}@${version}`;
+  const MessageClass = ALL_MESSAGE_CLASSES[key];
+  if (!MessageClass) {
+    throw new Error(`Unknown message type: ${type7} version ${version}`);
+  }
+  return MessageClass;
+}
+__name(getMessageClass, "getMessageClass");
+function isValidMessageType(type7, version) {
+  const key = `${type7}@${version}`;
+  return key in ALL_MESSAGE_CLASSES;
+}
+__name(isValidMessageType, "isValidMessageType");
+function getAllSupportedMessages() {
+  return ALL_MESSAGE_KEYS.map((key) => {
+    const [type7, versionStr] = key.split("@");
+    return {
+      type: type7,
+      version: parseInt(versionStr, 10)
+    };
+  });
+}
+__name(getAllSupportedMessages, "getAllSupportedMessages");
+function parseMessageKey(key) {
+  const [type7, versionStr] = key.split("@");
+  return {
+    type: type7,
+    version: parseInt(versionStr, 10)
+  };
+}
+__name(parseMessageKey, "parseMessageKey");
+
+// src/messages/registry.ts
+var MessageRegistry = class _MessageRegistry {
+  static {
+    __name(this, "MessageRegistry");
+  }
+  static instance;
+  constructor() {
+  }
+  static getInstance() {
+    if (!_MessageRegistry.instance) {
+      _MessageRegistry.instance = new _MessageRegistry();
+    }
+    return _MessageRegistry.instance;
+  }
+  /**
+  * Get a message class by type and version (derived from single source)
+  */
+  getMessageClass(type7, version) {
+    try {
+      return getMessageClass(type7, version);
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+  * Create a message instance from wire data (using derived message classes)
+  */
+  decode(wireData) {
+    if (!wireData || typeof wireData !== "object") {
+      return {
+        _tag: "Left",
+        left: "Invalid wire data: must be an object"
+      };
+    }
+    const { type: type7, version } = wireData;
+    if (!type7 || !version) {
+      return {
+        _tag: "Left",
+        left: "Invalid wire data: missing type or version"
+      };
+    }
+    const MessageClass = this.getMessageClass(type7, version);
+    if (!MessageClass) {
+      return {
+        _tag: "Left",
+        left: `Unknown message type: ${type7}@${version}`
+      };
+    }
+    const result = MessageClass.decode(wireData);
+    if (fpTs.either.isLeft(result)) {
+      return {
+        _tag: "Left",
+        left: `Decode error: ${result.left.map((e) => e.message).join(", ")}`
+      };
+    }
+    return {
+      _tag: "Right",
+      right: result.right
+    };
+  }
+  /**
+  * Encode a message to wire format
+  */
+  encode(message) {
+    return message.encode();
+  }
+  /**
+  * Get all registered message types (derived from single source)
+  */
+  getRegisteredTypes() {
+    return getAllSupportedMessages().map(({ type: type7, version }) => `${type7}@${version}`);
+  }
+};
+var messageRegistry = MessageRegistry.getInstance();
+
+// src/utils/assertDefined.ts
+function assertDefined(value, message) {
+  if (value === null || value === void 0) {
+    throw new Error(message ?? "Value must be defined");
+  }
+}
+__name(assertDefined, "assertDefined");
+function assertNotNull(value, message) {
+  if (value === null) {
+    throw new Error(message ?? "Value must not be null");
+  }
+}
+__name(assertNotNull, "assertNotNull");
+function getDefined(value, message) {
+  assertDefined(value, message);
+  return value;
+}
+__name(getDefined, "getDefined");
+
+// src/crypto/generateKeypair.ts
+var generateMlKem768Keypair = /* @__PURE__ */ __name(() => {
+  try {
+    const keys = mlKem_js.ml_kem768.keygen();
+    assertNotNull(keys.publicKey, "Encapsulation key must be defined");
+    assertNotNull(keys.secretKey, "Decapsulation key must be defined");
+    return {
+      encapsulationKey: keys.publicKey,
+      decapsulationKey: keys.secretKey
+    };
+  } catch (error) {
+    throw new Error(`Failed to generate ML-KEM-768 keypair: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}, "generateMlKem768Keypair");
+var encapsulateMlKem768 = /* @__PURE__ */ __name((encapsulationKey) => {
+  return mlKem_js.ml_kem768.encapsulate(encapsulationKey);
+}, "encapsulateMlKem768");
+var decapsulateMlKem768 = /* @__PURE__ */ __name((decapsulationKey, cipherText) => {
+  return mlKem_js.ml_kem768.decapsulate(cipherText, decapsulationKey);
+}, "decapsulateMlKem768");
+var AES_256_GCM_KEY_SIZE = 32;
+var AES_256_GCM_NONCE_SIZE = 12;
+var AES_256_GCM_TAG_SIZE = 16;
+var HKDF_SALT_SIZE = 32;
+function deriveAESKey(sharedSecret, salt, info) {
+  const infoBytes = new TextEncoder().encode(info);
+  return hkdf_js.hkdf(sha2_js.sha256, sharedSecret, salt, infoBytes, AES_256_GCM_KEY_SIZE);
+}
+__name(deriveAESKey, "deriveAESKey");
+function createKeyDerivationInfo(purpose, connectionId, version = 1) {
+  return `forward-mpc-${purpose}-v${version}-${connectionId}`;
+}
+__name(createKeyDerivationInfo, "createKeyDerivationInfo");
+async function encryptKeyshare(keyshare, sharedSecret, connectionId, signingAlgorithm) {
+  const salt = utils_js.randomBytes(32);
+  const keyshareInfo = createKeyDerivationInfo("keyshare", connectionId);
+  const aesKey = deriveAESKey(sharedSecret, salt, keyshareInfo);
+  const keyshareData = {
+    keyshare,
+    signingAlgorithm,
+    timestamp: Date.now(),
+    nonce: utils_js.bytesToHex(utils_js.randomBytes(16))
+  };
+  const nonce = utils_js.randomBytes(12);
+  const aes256Gcm = aes.gcm(aesKey, nonce);
+  const plaintext = new TextEncoder().encode(JSON.stringify(keyshareData));
+  const ciphertext = aes256Gcm.encrypt(plaintext);
+  const encryptedPayload = new Uint8Array(nonce.length + ciphertext.length);
+  encryptedPayload.set(nonce, 0);
+  encryptedPayload.set(ciphertext, nonce.length);
+  aesKey.fill(0);
+  return {
+    salt,
+    encryptedPayload
+  };
+}
+__name(encryptKeyshare, "encryptKeyshare");
+
+// src/signing/registry.ts
+var SigningAlgorithmRegistry = class SigningAlgorithmRegistry2 {
+  static {
+    __name(this, "SigningAlgorithmRegistry");
+  }
+  /**
+  * Get algorithm instance (derived from single source of truth)
+  */
+  get(name) {
+    const algorithm = SIGNING_ALGORITHM_INSTANCES[name];
+    if (!algorithm) {
+      throw new Error(`Unknown signing algorithm: ${name}`);
+    }
+    return algorithm;
+  }
+  /**
+  * Type-safe check if algorithm exists
+  */
+  has(name) {
+    return isValidSigningAlgorithm(name);
+  }
+  /**
+  * Get all algorithm names (derived from classes)
+  */
+  getAllNames() {
+    return ALL_SIGNING_ALGORITHM_NAMES;
+  }
+  /**
+  * Get all algorithm instances (derived from classes)
+  */
+  getAllInstances() {
+    return SIGNING_ALGORITHM_INSTANCES;
+  }
+};
+var signingAlgorithmRegistry = new SigningAlgorithmRegistry();
+
+exports.AES_256_GCM_KEY_SIZE = AES_256_GCM_KEY_SIZE;
+exports.AES_256_GCM_NONCE_SIZE = AES_256_GCM_NONCE_SIZE;
+exports.AES_256_GCM_TAG_SIZE = AES_256_GCM_TAG_SIZE;
+exports.ALGORITHMS = ALGORITHMS;
+exports.ALL_MESSAGE_CLASSES = ALL_MESSAGE_CLASSES;
+exports.ALL_MESSAGE_KEYS = ALL_MESSAGE_KEYS;
+exports.ALL_SIGNING_ALGORITHM_NAMES = ALL_SIGNING_ALGORITHM_NAMES;
+exports.ALL_SIGNING_ALGORITHM_SCHEMA = ALL_SIGNING_ALGORITHM_SCHEMA;
+exports.BIP340SigningAlgorithm = BIP340SigningAlgorithm;
+exports.BaseMessage = BaseMessage;
+exports.BaseSigningAlgorithm = BaseSigningAlgorithm;
+exports.ConnectionAckRequestSchema = ConnectionAckRequestSchema;
+exports.ConnectionAckResponseSchema = ConnectionAckResponseSchema;
+exports.ConnectionAckV1RequestMessage = ConnectionAckV1RequestMessage;
+exports.ConnectionAckV1ResponseMessage = ConnectionAckV1ResponseMessage;
+exports.EcdsaSigningAlgorithm = EcdsaSigningAlgorithm;
+exports.Ed25519SigningAlgorithm = Ed25519SigningAlgorithm;
+exports.EncryptedKeyshareCodec = EncryptedKeyshareCodec;
+exports.HKDF_SALT_SIZE = HKDF_SALT_SIZE;
+exports.HandshakeRequestSchema = HandshakeRequestSchema;
+exports.HandshakeResponseSchema = HandshakeResponseSchema;
+exports.HandshakeV1RequestMessage = HandshakeV1RequestMessage;
+exports.HandshakeV1ResponseMessage = HandshakeV1ResponseMessage;
+exports.MessageRegistry = MessageRegistry;
+exports.SIGNING_ALGORITHM_CLASSES = SIGNING_ALGORITHM_CLASSES;
+exports.SIGNING_ALGORITHM_INSTANCES = SIGNING_ALGORITHM_INSTANCES;
+exports.SignMessageRequestSchema = SignMessageRequestSchema;
+exports.SignMessageResponseSchema = SignMessageResponseSchema;
+exports.SignMessageV1RequestMessage = SignMessageV1RequestMessage;
+exports.SignMessageV1ResponseMessage = SignMessageV1ResponseMessage;
+exports.SignatureAlgoSchema = SignatureAlgoSchema;
+exports.Uint32ArrayCodec = Uint32ArrayCodec;
+exports.Uint8ArrayCodec = Uint8ArrayCodec;
+exports.WebSocketErrorType = WebSocketErrorType;
+exports.assertDefined = assertDefined;
+exports.assertNotNull = assertNotNull;
+exports.createKeyDerivationInfo = createKeyDerivationInfo;
+exports.createKeygenResultFromSecretShare = createKeygenResultFromSecretShare;
+exports.decapsulateMlKem768 = decapsulateMlKem768;
+exports.deriveAESKey = deriveAESKey;
+exports.encapsulateMlKem768 = encapsulateMlKem768;
+exports.encryptKeyshare = encryptKeyshare;
+exports.fromDynamicSigningAlgorithm = fromDynamicSigningAlgorithm;
+exports.generateMlKem768Keypair = generateMlKem768Keypair;
+exports.getAllSupportedMessages = getAllSupportedMessages;
+exports.getDefined = getDefined;
+exports.getMessageClass = getMessageClass;
+exports.isValidMessageType = isValidMessageType;
+exports.isValidSigningAlgorithm = isValidSigningAlgorithm;
+exports.messageRegistry = messageRegistry;
+exports.parseMessageKey = parseMessageKey;
+exports.signingAlgorithmRegistry = signingAlgorithmRegistry;
+exports.toDynamicSigningAlgorithm = toDynamicSigningAlgorithm;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map