@elisym/sdk 0.4.1 → 0.5.0

package/dist/node.cjs

@@ -65,100 +65,8 @@ function decryptSecret(encrypted, passphrase) {
   }
 }
 
-// src/primitives/config-node.ts
-function parseConfig(json, passphrase) {
-  const config = JSON.parse(json);
-  if (!config || typeof config !== "object" || Array.isArray(config)) {
-    throw new Error("Invalid config: expected JSON object.");
-  }
-  if (!config.identity?.secret_key || typeof config.identity.secret_key !== "string") {
-    throw new Error("Invalid config: missing or non-string identity.secret_key.");
-  }
-  if (typeof config.identity.name !== "string" || !config.identity.name) {
-    throw new Error("Invalid config: missing or non-string identity.name.");
-  }
-  if (!Array.isArray(config.relays) || !config.relays.every((r) => typeof r === "string")) {
-    throw new Error("Invalid config: relays must be an array of strings.");
-  }
-  if (config.capabilities !== void 0) {
-    if (!Array.isArray(config.capabilities)) {
-      throw new Error("Invalid config: capabilities must be an array.");
-    }
-    for (const cap of config.capabilities) {
-      if (!cap || typeof cap !== "object" || typeof cap.name !== "string" || typeof cap.description !== "string" || typeof cap.price !== "number") {
-        throw new Error(
-          "Invalid config: each capability must have name (string), description (string), and price (number)."
-        );
-      }
-      if (!Array.isArray(cap.tags) || !cap.tags.every((t) => typeof t === "string")) {
-        throw new Error("Invalid config: each capability must have tags (array of strings).");
-      }
-      if (!Number.isInteger(cap.price) || cap.price < 0) {
-        throw new Error(
-          "Invalid config: capability price must be a non-negative integer (lamports)."
-        );
-      }
-    }
-  }
-  if (config.payments !== void 0) {
-    if (!Array.isArray(config.payments)) {
-      throw new Error("Invalid config: payments must be an array.");
-    }
-    for (const p of config.payments) {
-      if (!p || typeof p !== "object" || typeof p.chain !== "string" || typeof p.network !== "string" || typeof p.address !== "string") {
-        throw new Error(
-          "Invalid config: each payment entry must have chain, network, and address (all strings)."
-        );
-      }
-    }
-  }
-  if (config.wallet !== void 0) {
-    if (!config.wallet || typeof config.wallet !== "object" || typeof config.wallet.chain !== "string" || typeof config.wallet.network !== "string" || typeof config.wallet.secret_key !== "string") {
-      throw new Error(
-        "Invalid config: wallet must have chain, network, and secret_key (all strings)."
-      );
-    }
-  }
-  if (config.llm !== void 0) {
-    if (!config.llm || typeof config.llm !== "object" || typeof config.llm.provider !== "string" || typeof config.llm.model !== "string" || typeof config.llm.api_key !== "string" || typeof config.llm.max_tokens !== "number" || !Number.isInteger(config.llm.max_tokens) || config.llm.max_tokens <= 0) {
-      throw new Error(
-        "Invalid config: llm must have provider, model, api_key (strings) and max_tokens (positive integer)."
-      );
-    }
-  }
-  if (!passphrase) {
-    const encrypted = [];
-    if (config.identity?.secret_key && isEncrypted(config.identity.secret_key)) {
-      encrypted.push("identity.secret_key");
-    }
-    if (config.wallet?.secret_key && isEncrypted(config.wallet.secret_key)) {
-      encrypted.push("wallet.secret_key");
-    }
-    if (config.llm?.api_key && isEncrypted(config.llm.api_key)) {
-      encrypted.push("llm.api_key");
-    }
-    if (encrypted.length > 0) {
-      throw new Error(
-        `Fields [${encrypted.join(", ")}] are encrypted but no passphrase provided. Set ELISYM_PASSPHRASE env var.`
-      );
-    }
-    return config;
-  }
-  if (config.identity?.secret_key && isEncrypted(config.identity.secret_key)) {
-    config.identity.secret_key = decryptSecret(config.identity.secret_key, passphrase);
-  }
-  if (config.wallet?.secret_key && isEncrypted(config.wallet.secret_key)) {
-    config.wallet.secret_key = decryptSecret(config.wallet.secret_key, passphrase);
-  }
-  if (config.llm?.api_key && isEncrypted(config.llm.api_key)) {
-    config.llm.api_key = decryptSecret(config.llm.api_key, passphrase);
-  }
-  return config;
-}
-
 exports.decryptSecret = decryptSecret;
 exports.encryptSecret = encryptSecret;
 exports.isEncrypted = isEncrypted;
-exports.parseConfig = parseConfig;
 //# sourceMappingURL=node.cjs.map
 //# sourceMappingURL=node.cjs.map

package/dist/node.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/primitives/encryption.ts","../src/primitives/config-node.ts"],"names":["randomBytes","scryptSync","createCipheriv","Buffer","createDecipheriv"],"mappings":";;;;;;AAcA,IAAM,MAAA,GAAS,eAAA;AACf,IAAM,WAAA,GAAc,EAAA;AACpB,IAAM,SAAA,GAAY,EAAA;AAClB,IAAM,UAAA,GAAa,EAAA;AACnB,IAAM,UAAA,GAAa,EAAA;AAEnB,IAAM,WAAW,CAAA,IAAK,EAAA;AACtB,IAAM,QAAA,GAAW,CAAA;AACjB,IAAM,QAAA,GAAW,CAAA;AACjB,IAAM,aAAA,GAAgB,GAAA,GAAM,QAAA,GAAW,QAAA,GAAW,CAAA;AAG3C,SAAS,YAAY,KAAA,EAAwB;AAClD,EAAA,OAAO,KAAA,CAAM,WAAW,MAAM,CAAA;AAChC;AAGO,SAAS,aAAA,CAAc,WAAmB,UAAA,EAA4B;AAC3E,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACjD;AAEA,EAAA,MAAM,IAAA,GAAOA,mBAAY,WAAW,CAAA;AACpC,EAAA,MAAM,GAAA,GAAMC,iBAAA,CAAW,UAAA,EAAY,IAAA,EAAM,UAAA,EAAY;AAAA,IACnD,CAAA,EAAG,QAAA;AAAA,IACH,CAAA,EAAG,QAAA;AAAA,IACH,CAAA,EAAG,QAAA;AAAA,IACH,MAAA,EAAQ;AAAA,GACT,CAAA;AACD,EAAA,MAAM,EAAA,GAAKD,mBAAY,SAAS,CAAA;AAEhC,EAAA,MAAM,MAAA,GAASE,qBAAA,CAAe,aAAA,EAAe,GAAA,EAAK,EAAE,CAAA;AACpD,EAAA,MAAM,SAAA,GAAYC,aAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,MAAM,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AAClF,EAAA,MAAM,GAAA,GAAM,OAAO,UAAA,EAAW;AAE9B,EAAA,MAAM,OAAA,GAAUA,cAAO,MAAA,CAAO,CAAC,MAAM,EAAA,EAAI,SAAA,EAAW,GAAG,CAAC,CAAA;AACxD,EAAA,OAAO,MAAA,GAAS,OAAA,CAAQ,QAAA,CAAS,QAAQ,CAAA;AAC3C;AAGO,SAAS,aAAA,CAAc,WAAmB,UAAA,EAA4B;AAC3E,EAAA,IAAI,CAAC,WAAA,CAAY,SAAS,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACjD;AAEA,EAAA,MAAM,OAAA,GAAUA,cAAO,IAAA,CAAK,SAAA,CAAU,MAAM,MAAA,CAAO,MAAM,GAAG,QAAQ,CAAA;AACpE,EAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,WAAA,GAAc,SAAA,GAAY,UAAA,EAAY;AACzD,IAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,EACnD;AAEA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,QAAA,CAAS,CAAA,EAAG,WAAW,CAAA;AAC5C,EAAA,MAAM,EAAA,GAAK,OAAA,CAAQ,QAAA,CAAS,WAAA,EAAa,cAAc,SAAS,CAAA;AAChE,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,QAAA,CAAS,OAAA,CAAQ,SAAS,UAAU,CAAA;AACxD,EAAA,MAAM,aAAa,OAAA,CAAQ,QAAA,CAAS,cAAc,SAAA,EAAW,OAAA,CAAQ,SAAS,UAAU,CAAA;AAExF,EAAA,MAAM,GAAA,GAAMF,iBAAA,CAAW,UAAA,EAAY,IAAA,EAAM,UAAA,EAAY;AAAA,IACnD,CAAA,EAAG,QAAA;AAAA,IACH,CAAA,EAAG,QAAA;AAAA,IACH,CAAA,EAAG,QAAA;AAAA,IACH,MAAA,EAAQ;AAAA,GACT,CAAA;AAED,EAAA,MAAM,QAAA,GAAWG,uBAAA,CAAiB,aAAA,EAAe,GAAA,EAAK,EAAE,CAAA;AACxD,EAAA,QAAA,CAAS,WAAW,GAAG,CAAA;AAEvB,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAYD,aAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,UAAU,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AAC/E,IAAA,OAAO,SAAA,CAAU,SAAS,MAAM,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AACF;;;AC3EO,SAAS,WAAA,CAAY,MAAc,UAAA,EAAkC;AAC1E,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAE9B,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClE,IAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,EACzD;AACA,EAAA,IAAI,CAAC,OAAO,QAAA,EAAU,UAAA,IAAc,OAAO,MAAA,CAAO,QAAA,CAAS,eAAe,QAAA,EAAU;AAClF,IAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAAA,EAC9E;AACA,EAAA,IAAI,OAAO,OAAO,QAAA,CAAS,IAAA,KAAS,YAAY,CAAC,MAAA,CAAO,SAAS,IAAA,EAAM;AACrE,IAAA,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAAA,EACxE;AACA,EAAA,IACE,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,MAAM,CAAA,IAC5B,CAAC,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAA,KAAe,OAAO,CAAA,KAAM,QAAQ,CAAA,EAC1D;AACA,IAAA,MAAM,IAAI,MAAM,qDAAqD,CAAA;AAAA,EACvE;AAEA,EAAA,IAAI,MAAA,CAAO,iBAAiB,MAAA,EAAW;AACrC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,YAAY,CAAA,EAAG;AACvC,MAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,IAClE;AACA,IAAA,KAAA,MAAW,GAAA,IAAO,OAAO,YAAA,EAAc;AACrC,MAAA,IACE,CAAC,GAAA,IACD,OAAO,GAAA,KAAQ,QAAA,IACf,OAAO,GAAA,CAAI,IAAA,KAAS,QAAA,IACpB,OAAO,IAAI,WAAA,KAAgB,QAAA,IAC3B,OAAO,GAAA,CAAI,UAAU,QAAA,EACrB;AACA,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,IAAK,CAAC,GAAA,CAAI,IAAA,CAAK,MAAM,CAAC,CAAA,KAAe,OAAO,CAAA,KAAM,QAAQ,CAAA,EAAG;AACtF,QAAA,MAAM,IAAI,MAAM,oEAAoE,CAAA;AAAA,MACtF;AACA,MAAA,IAAI,CAAC,OAAO,SAAA,CAAU,GAAA,CAAI,KAAK,CAAA,IAAK,GAAA,CAAI,QAAQ,CAAA,EAAG;AACjD,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,aAAa,MAAA,EAAW;AACjC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA,EAAG;AACnC,MAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,IAC9D;AACA,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,QAAA,EAAU;AAC/B,MAAA,IACE,CAAC,CAAA,IACD,OAAO,CAAA,KAAM,QAAA,IACb,OAAO,CAAA,CAAE,KAAA,KAAU,QAAA,IACnB,OAAO,EAAE,OAAA,KAAY,QAAA,IACrB,OAAO,CAAA,CAAE,YAAY,QAAA,EACrB;AACA,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,WAAW,MAAA,EAAW;AAC/B,IAAA,IACE,CAAC,OAAO,MAAA,IACR,OAAO,OAAO,MAAA,KAAW,QAAA,IACzB,OAAO,MAAA,CAAO,MAAA,CAAO,UAAU,QAAA,IAC/B,OAAO,OAAO,MAAA,CAAO,OAAA,KAAY,YACjC,OAAO,MAAA,CAAO,MAAA,CAAO,UAAA,KAAe,QAAA,EACpC;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAW;AAC5B,IAAA,IACE,CAAC,MAAA,CAAO,GAAA,IACR,OAAO,MAAA,CAAO,QAAQ,QAAA,IACtB,OAAO,MAAA,CAAO,GAAA,CAAI,aAAa,QAAA,IAC/B,OAAO,MAAA,CAAO,GAAA,CAAI,UAAU,QAAA,IAC5B,OAAO,MAAA,CAAO,GAAA,CAAI,YAAY,QAAA,IAC9B,OAAO,MAAA,CAAO,GAAA,CAAI,eAAe,QAAA,IACjC,CAAC,MAAA,CAAO,SAAA,CAAU,OAAO,GAAA,CAAI,UAAU,KACvC,MAAA,CAAO,GAAA,CAAI,cAAc,CAAA,EACzB;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,MAAM,YAAsB,EAAC;AAC7B,IAAA,IAAI,OAAO,QAAA,EAAU,UAAA,IAAc,YAAY,MAAA,CAAO,QAAA,CAAS,UAAU,CAAA,EAAG;AAC1E,MAAA,SAAA,CAAU,KAAK,qBAAqB,CAAA;AAAA,IACtC;AACA,IAAA,IAAI,OAAO,MAAA,EAAQ,UAAA,IAAc,YAAY,MAAA,CAAO,MAAA,CAAO,UAAU,CAAA,EAAG;AACtE,MAAA,SAAA,CAAU,KAAK,mBAAmB,CAAA;AAAA,IACpC;AACA,IAAA,IAAI,OAAO,GAAA,EAAK,OAAA,IAAW,YAAY,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG;AAC1D,MAAA,SAAA,CAAU,KAAK,aAAa,CAAA;AAAA,IAC9B;AACA,IAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACxB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,QAAA,EAAW,SAAA,CAAU,IAAA,CAAK,IAAI,CAAC,CAAA,0EAAA;AAAA,OACjC;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAO,QAAA,EAAU,UAAA,IAAc,YAAY,MAAA,CAAO,QAAA,CAAS,UAAU,CAAA,EAAG;AAC1E,IAAA,MAAA,CAAO,SAAS,UAAA,GAAa,aAAA,CAAc,MAAA,CAAO,QAAA,CAAS,YAAY,UAAU,CAAA;AAAA,EACnF;AACA,EAAA,IAAI,OAAO,MAAA,EAAQ,UAAA,IAAc,YAAY,MAAA,CAAO,MAAA,CAAO,UAAU,CAAA,EAAG;AACtE,IAAA,MAAA,CAAO,OAAO,UAAA,GAAa,aAAA,CAAc,MAAA,CAAO,MAAA,CAAO,YAAY,UAAU,CAAA;AAAA,EAC/E;AACA,EAAA,IAAI,OAAO,GAAA,EAAK,OAAA,IAAW,YAAY,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG;AAC1D,IAAA,MAAA,CAAO,IAAI,OAAA,GAAU,aAAA,CAAc,MAAA,CAAO,GAAA,CAAI,SAAS,UAAU,CAAA;AAAA,EACnE;AAEA,EAAA,OAAO,MAAA;AACT","file":"node.cjs","sourcesContent":["/**\n * Secret encryption/decryption for agent config files.\n * Uses scrypt (KDF) + AES-256-GCM (cipher).\n * Format: \"encrypted:v1:\" + base64(salt[16] + iv[12] + ciphertext + tag[16])\n *\n * scrypt params: N=2^17, r=8, p=1 (~128 MB RAM per derivation).\n *\n * Node.js/Bun only - not available in browsers. Reachable only via the\n * '@elisym/sdk/node' subpath, which browser bundlers will not resolve.\n */\n\nimport { Buffer } from 'node:buffer';\nimport { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';\n\nconst PREFIX = 'encrypted:v1:';\nconst SALT_LENGTH = 16;\nconst IV_LENGTH = 12;\nconst TAG_LENGTH = 16;\nconst KEY_LENGTH = 32; // AES-256\n// v1: N=2^17 (OWASP minimum). v2 will use N=2^20 with format migration.\nconst SCRYPT_N = 2 ** 17;\nconst SCRYPT_R = 8;\nconst SCRYPT_P = 1;\nconst SCRYPT_MAXMEM = 128 * SCRYPT_N * SCRYPT_R * 2; // 2x the minimum required memory\n\n/** Check if a value is encrypted (has the encrypted:v1: prefix). */\nexport function isEncrypted(value: string): boolean {\n  return value.startsWith(PREFIX);\n}\n\n/** Encrypt a plaintext secret with a passphrase. Returns \"encrypted:v1:base64...\". Node.js/Bun only. */\nexport function encryptSecret(plaintext: string, passphrase: string): string {\n  if (!passphrase) {\n    throw new Error('Passphrase must not be empty.');\n  }\n\n  const salt = randomBytes(SALT_LENGTH);\n  const key = scryptSync(passphrase, salt, KEY_LENGTH, {\n    N: SCRYPT_N,\n    r: SCRYPT_R,\n    p: SCRYPT_P,\n    maxmem: SCRYPT_MAXMEM,\n  });\n  const iv = randomBytes(IV_LENGTH);\n\n  const cipher = createCipheriv('aes-256-gcm', key, iv);\n  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);\n  const tag = cipher.getAuthTag();\n\n  const payload = Buffer.concat([salt, iv, encrypted, tag]);\n  return PREFIX + payload.toString('base64');\n}\n\n/** Decrypt an encrypted secret with a passphrase. Throws on wrong passphrase or corrupted data. Node.js/Bun only. */\nexport function decryptSecret(encrypted: string, passphrase: string): string {\n  if (!isEncrypted(encrypted)) {\n    throw new Error('Value is not encrypted (missing encrypted:v1: prefix).');\n  }\n  if (!passphrase) {\n    throw new Error('Passphrase must not be empty.');\n  }\n\n  const payload = Buffer.from(encrypted.slice(PREFIX.length), 'base64');\n  if (payload.length < SALT_LENGTH + IV_LENGTH + TAG_LENGTH) {\n    throw new Error('Encrypted payload is too short.');\n  }\n\n  const salt = payload.subarray(0, SALT_LENGTH);\n  const iv = payload.subarray(SALT_LENGTH, SALT_LENGTH + IV_LENGTH);\n  const tag = payload.subarray(payload.length - TAG_LENGTH);\n  const ciphertext = payload.subarray(SALT_LENGTH + IV_LENGTH, payload.length - TAG_LENGTH);\n\n  const key = scryptSync(passphrase, salt, KEY_LENGTH, {\n    N: SCRYPT_N,\n    r: SCRYPT_R,\n    p: SCRYPT_P,\n    maxmem: SCRYPT_MAXMEM,\n  });\n\n  const decipher = createDecipheriv('aes-256-gcm', key, iv);\n  decipher.setAuthTag(tag);\n\n  try {\n    const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n    return decrypted.toString('utf8');\n  } catch {\n    throw new Error('Decryption failed. Wrong passphrase or corrupted data.');\n  }\n}\n","/**\n * Node.js-only config parsing with secret decryption.\n * Exported from '@elisym/sdk/node'.\n */\n\nimport type { AgentConfig } from '../types';\nimport { isEncrypted, decryptSecret } from './encryption';\n\n/**\n * Parse a JSON string into an AgentConfig.\n * If passphrase is provided, decrypts all encrypted fields (requires Node.js/Bun).\n * If passphrase is not provided and encrypted fields exist, throws.\n */\nexport function parseConfig(json: string, passphrase?: string): AgentConfig {\n  const config = JSON.parse(json) as AgentConfig;\n\n  if (!config || typeof config !== 'object' || Array.isArray(config)) {\n    throw new Error('Invalid config: expected JSON object.');\n  }\n  if (!config.identity?.secret_key || typeof config.identity.secret_key !== 'string') {\n    throw new Error('Invalid config: missing or non-string identity.secret_key.');\n  }\n  if (typeof config.identity.name !== 'string' || !config.identity.name) {\n    throw new Error('Invalid config: missing or non-string identity.name.');\n  }\n  if (\n    !Array.isArray(config.relays) ||\n    !config.relays.every((r: unknown) => typeof r === 'string')\n  ) {\n    throw new Error('Invalid config: relays must be an array of strings.');\n  }\n\n  if (config.capabilities !== undefined) {\n    if (!Array.isArray(config.capabilities)) {\n      throw new Error('Invalid config: capabilities must be an array.');\n    }\n    for (const cap of config.capabilities) {\n      if (\n        !cap ||\n        typeof cap !== 'object' ||\n        typeof cap.name !== 'string' ||\n        typeof cap.description !== 'string' ||\n        typeof cap.price !== 'number'\n      ) {\n        throw new Error(\n          'Invalid config: each capability must have name (string), description (string), and price (number).',\n        );\n      }\n      if (!Array.isArray(cap.tags) || !cap.tags.every((t: unknown) => typeof t === 'string')) {\n        throw new Error('Invalid config: each capability must have tags (array of strings).');\n      }\n      if (!Number.isInteger(cap.price) || cap.price < 0) {\n        throw new Error(\n          'Invalid config: capability price must be a non-negative integer (lamports).',\n        );\n      }\n    }\n  }\n  if (config.payments !== undefined) {\n    if (!Array.isArray(config.payments)) {\n      throw new Error('Invalid config: payments must be an array.');\n    }\n    for (const p of config.payments) {\n      if (\n        !p ||\n        typeof p !== 'object' ||\n        typeof p.chain !== 'string' ||\n        typeof p.network !== 'string' ||\n        typeof p.address !== 'string'\n      ) {\n        throw new Error(\n          'Invalid config: each payment entry must have chain, network, and address (all strings).',\n        );\n      }\n    }\n  }\n  if (config.wallet !== undefined) {\n    if (\n      !config.wallet ||\n      typeof config.wallet !== 'object' ||\n      typeof config.wallet.chain !== 'string' ||\n      typeof config.wallet.network !== 'string' ||\n      typeof config.wallet.secret_key !== 'string'\n    ) {\n      throw new Error(\n        'Invalid config: wallet must have chain, network, and secret_key (all strings).',\n      );\n    }\n  }\n  if (config.llm !== undefined) {\n    if (\n      !config.llm ||\n      typeof config.llm !== 'object' ||\n      typeof config.llm.provider !== 'string' ||\n      typeof config.llm.model !== 'string' ||\n      typeof config.llm.api_key !== 'string' ||\n      typeof config.llm.max_tokens !== 'number' ||\n      !Number.isInteger(config.llm.max_tokens) ||\n      config.llm.max_tokens <= 0\n    ) {\n      throw new Error(\n        'Invalid config: llm must have provider, model, api_key (strings) and max_tokens (positive integer).',\n      );\n    }\n  }\n\n  if (!passphrase) {\n    const encrypted: string[] = [];\n    if (config.identity?.secret_key && isEncrypted(config.identity.secret_key)) {\n      encrypted.push('identity.secret_key');\n    }\n    if (config.wallet?.secret_key && isEncrypted(config.wallet.secret_key)) {\n      encrypted.push('wallet.secret_key');\n    }\n    if (config.llm?.api_key && isEncrypted(config.llm.api_key)) {\n      encrypted.push('llm.api_key');\n    }\n    if (encrypted.length > 0) {\n      throw new Error(\n        `Fields [${encrypted.join(', ')}] are encrypted but no passphrase provided. Set ELISYM_PASSPHRASE env var.`,\n      );\n    }\n    return config;\n  }\n\n  if (config.identity?.secret_key && isEncrypted(config.identity.secret_key)) {\n    config.identity.secret_key = decryptSecret(config.identity.secret_key, passphrase);\n  }\n  if (config.wallet?.secret_key && isEncrypted(config.wallet.secret_key)) {\n    config.wallet.secret_key = decryptSecret(config.wallet.secret_key, passphrase);\n  }\n  if (config.llm?.api_key && isEncrypted(config.llm.api_key)) {\n    config.llm.api_key = decryptSecret(config.llm.api_key, passphrase);\n  }\n\n  return config;\n}\n"]}
+{"version":3,"sources":["../src/primitives/encryption.ts"],"names":["randomBytes","scryptSync","createCipheriv","Buffer","createDecipheriv"],"mappings":";;;;;;AAcA,IAAM,MAAA,GAAS,eAAA;AACf,IAAM,WAAA,GAAc,EAAA;AACpB,IAAM,SAAA,GAAY,EAAA;AAClB,IAAM,UAAA,GAAa,EAAA;AACnB,IAAM,UAAA,GAAa,EAAA;AAEnB,IAAM,WAAW,CAAA,IAAK,EAAA;AACtB,IAAM,QAAA,GAAW,CAAA;AACjB,IAAM,QAAA,GAAW,CAAA;AACjB,IAAM,aAAA,GAAgB,GAAA,GAAM,QAAA,GAAW,QAAA,GAAW,CAAA;AAG3C,SAAS,YAAY,KAAA,EAAwB;AAClD,EAAA,OAAO,KAAA,CAAM,WAAW,MAAM,CAAA;AAChC;AAGO,SAAS,aAAA,CAAc,WAAmB,UAAA,EAA4B;AAC3E,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACjD;AAEA,EAAA,MAAM,IAAA,GAAOA,mBAAY,WAAW,CAAA;AACpC,EAAA,MAAM,GAAA,GAAMC,iBAAA,CAAW,UAAA,EAAY,IAAA,EAAM,UAAA,EAAY;AAAA,IACnD,CAAA,EAAG,QAAA;AAAA,IACH,CAAA,EAAG,QAAA;AAAA,IACH,CAAA,EAAG,QAAA;AAAA,IACH,MAAA,EAAQ;AAAA,GACT,CAAA;AACD,EAAA,MAAM,EAAA,GAAKD,mBAAY,SAAS,CAAA;AAEhC,EAAA,MAAM,MAAA,GAASE,qBAAA,CAAe,aAAA,EAAe,GAAA,EAAK,EAAE,CAAA;AACpD,EAAA,MAAM,SAAA,GAAYC,aAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,MAAM,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AAClF,EAAA,MAAM,GAAA,GAAM,OAAO,UAAA,EAAW;AAE9B,EAAA,MAAM,OAAA,GAAUA,cAAO,MAAA,CAAO,CAAC,MAAM,EAAA,EAAI,SAAA,EAAW,GAAG,CAAC,CAAA;AACxD,EAAA,OAAO,MAAA,GAAS,OAAA,CAAQ,QAAA,CAAS,QAAQ,CAAA;AAC3C;AAGO,SAAS,aAAA,CAAc,WAAmB,UAAA,EAA4B;AAC3E,EAAA,IAAI,CAAC,WAAA,CAAY,SAAS,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACjD;AAEA,EAAA,MAAM,OAAA,GAAUA,cAAO,IAAA,CAAK,SAAA,CAAU,MAAM,MAAA,CAAO,MAAM,GAAG,QAAQ,CAAA;AACpE,EAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,WAAA,GAAc,SAAA,GAAY,UAAA,EAAY;AACzD,IAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,EACnD;AAEA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,QAAA,CAAS,CAAA,EAAG,WAAW,CAAA;AAC5C,EAAA,MAAM,EAAA,GAAK,OAAA,CAAQ,QAAA,CAAS,WAAA,EAAa,cAAc,SAAS,CAAA;AAChE,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,QAAA,CAAS,OAAA,CAAQ,SAAS,UAAU,CAAA;AACxD,EAAA,MAAM,aAAa,OAAA,CAAQ,QAAA,CAAS,cAAc,SAAA,EAAW,OAAA,CAAQ,SAAS,UAAU,CAAA;AAExF,EAAA,MAAM,GAAA,GAAMF,iBAAA,CAAW,UAAA,EAAY,IAAA,EAAM,UAAA,EAAY;AAAA,IACnD,CAAA,EAAG,QAAA;AAAA,IACH,CAAA,EAAG,QAAA;AAAA,IACH,CAAA,EAAG,QAAA;AAAA,IACH,MAAA,EAAQ;AAAA,GACT,CAAA;AAED,EAAA,MAAM,QAAA,GAAWG,uBAAA,CAAiB,aAAA,EAAe,GAAA,EAAK,EAAE,CAAA;AACxD,EAAA,QAAA,CAAS,WAAW,GAAG,CAAA;AAEvB,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAYD,aAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,UAAU,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AAC/E,IAAA,OAAO,SAAA,CAAU,SAAS,MAAM,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AACF","file":"node.cjs","sourcesContent":["/**\n * Secret encryption/decryption for agent config files.\n * Uses scrypt (KDF) + AES-256-GCM (cipher).\n * Format: \"encrypted:v1:\" + base64(salt[16] + iv[12] + ciphertext + tag[16])\n *\n * scrypt params: N=2^17, r=8, p=1 (~128 MB RAM per derivation).\n *\n * Node.js/Bun only - not available in browsers. Reachable only via the\n * '@elisym/sdk/node' subpath, which browser bundlers will not resolve.\n */\n\nimport { Buffer } from 'node:buffer';\nimport { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';\n\nconst PREFIX = 'encrypted:v1:';\nconst SALT_LENGTH = 16;\nconst IV_LENGTH = 12;\nconst TAG_LENGTH = 16;\nconst KEY_LENGTH = 32; // AES-256\n// v1: N=2^17 (OWASP minimum). v2 will use N=2^20 with format migration.\nconst SCRYPT_N = 2 ** 17;\nconst SCRYPT_R = 8;\nconst SCRYPT_P = 1;\nconst SCRYPT_MAXMEM = 128 * SCRYPT_N * SCRYPT_R * 2; // 2x the minimum required memory\n\n/** Check if a value is encrypted (has the encrypted:v1: prefix). */\nexport function isEncrypted(value: string): boolean {\n  return value.startsWith(PREFIX);\n}\n\n/** Encrypt a plaintext secret with a passphrase. Returns \"encrypted:v1:base64...\". Node.js/Bun only. */\nexport function encryptSecret(plaintext: string, passphrase: string): string {\n  if (!passphrase) {\n    throw new Error('Passphrase must not be empty.');\n  }\n\n  const salt = randomBytes(SALT_LENGTH);\n  const key = scryptSync(passphrase, salt, KEY_LENGTH, {\n    N: SCRYPT_N,\n    r: SCRYPT_R,\n    p: SCRYPT_P,\n    maxmem: SCRYPT_MAXMEM,\n  });\n  const iv = randomBytes(IV_LENGTH);\n\n  const cipher = createCipheriv('aes-256-gcm', key, iv);\n  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);\n  const tag = cipher.getAuthTag();\n\n  const payload = Buffer.concat([salt, iv, encrypted, tag]);\n  return PREFIX + payload.toString('base64');\n}\n\n/** Decrypt an encrypted secret with a passphrase. Throws on wrong passphrase or corrupted data. Node.js/Bun only. */\nexport function decryptSecret(encrypted: string, passphrase: string): string {\n  if (!isEncrypted(encrypted)) {\n    throw new Error('Value is not encrypted (missing encrypted:v1: prefix).');\n  }\n  if (!passphrase) {\n    throw new Error('Passphrase must not be empty.');\n  }\n\n  const payload = Buffer.from(encrypted.slice(PREFIX.length), 'base64');\n  if (payload.length < SALT_LENGTH + IV_LENGTH + TAG_LENGTH) {\n    throw new Error('Encrypted payload is too short.');\n  }\n\n  const salt = payload.subarray(0, SALT_LENGTH);\n  const iv = payload.subarray(SALT_LENGTH, SALT_LENGTH + IV_LENGTH);\n  const tag = payload.subarray(payload.length - TAG_LENGTH);\n  const ciphertext = payload.subarray(SALT_LENGTH + IV_LENGTH, payload.length - TAG_LENGTH);\n\n  const key = scryptSync(passphrase, salt, KEY_LENGTH, {\n    N: SCRYPT_N,\n    r: SCRYPT_R,\n    p: SCRYPT_P,\n    maxmem: SCRYPT_MAXMEM,\n  });\n\n  const decipher = createDecipheriv('aes-256-gcm', key, iv);\n  decipher.setAuthTag(tag);\n\n  try {\n    const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n    return decrypted.toString('utf8');\n  } catch {\n    throw new Error('Decryption failed. Wrong passphrase or corrupted data.');\n  }\n}\n"]}

package/dist/node.d.cts

@@ -1,5 +1,3 @@
-import { g as AgentConfig } from './types-CII4k_8d.cjs';
-
 /**
  * Secret encryption/decryption for agent config files.
  * Uses scrypt (KDF) + AES-256-GCM (cipher).
@@ -17,16 +15,4 @@ declare function encryptSecret(plaintext: string, passphrase: string): string;
 /** Decrypt an encrypted secret with a passphrase. Throws on wrong passphrase or corrupted data. Node.js/Bun only. */
 declare function decryptSecret(encrypted: string, passphrase: string): string;
 
-/**
- * Node.js-only config parsing with secret decryption.
- * Exported from '@elisym/sdk/node'.
- */
-
-/**
- * Parse a JSON string into an AgentConfig.
- * If passphrase is provided, decrypts all encrypted fields (requires Node.js/Bun).
- * If passphrase is not provided and encrypted fields exist, throws.
- */
-declare function parseConfig(json: string, passphrase?: string): AgentConfig;
-
-export { decryptSecret, encryptSecret, isEncrypted, parseConfig };
+export { decryptSecret, encryptSecret, isEncrypted };

package/dist/node.d.ts

@@ -1,5 +1,3 @@
-import { g as AgentConfig } from './types-CII4k_8d.js';
-
 /**
  * Secret encryption/decryption for agent config files.
  * Uses scrypt (KDF) + AES-256-GCM (cipher).
@@ -17,16 +15,4 @@ declare function encryptSecret(plaintext: string, passphrase: string): string;
 /** Decrypt an encrypted secret with a passphrase. Throws on wrong passphrase or corrupted data. Node.js/Bun only. */
 declare function decryptSecret(encrypted: string, passphrase: string): string;
 
-/**
- * Node.js-only config parsing with secret decryption.
- * Exported from '@elisym/sdk/node'.
- */
-
-/**
- * Parse a JSON string into an AgentConfig.
- * If passphrase is provided, decrypts all encrypted fields (requires Node.js/Bun).
- * If passphrase is not provided and encrypted fields exist, throws.
- */
-declare function parseConfig(json: string, passphrase?: string): AgentConfig;
-
-export { decryptSecret, encryptSecret, isEncrypted, parseConfig };
+export { decryptSecret, encryptSecret, isEncrypted };

package/dist/node.js

@@ -63,97 +63,6 @@ function decryptSecret(encrypted, passphrase) {
   }
 }
 
-// src/primitives/config-node.ts
-function parseConfig(json, passphrase) {
-  const config = JSON.parse(json);
-  if (!config || typeof config !== "object" || Array.isArray(config)) {
-    throw new Error("Invalid config: expected JSON object.");
-  }
-  if (!config.identity?.secret_key || typeof config.identity.secret_key !== "string") {
-    throw new Error("Invalid config: missing or non-string identity.secret_key.");
-  }
-  if (typeof config.identity.name !== "string" || !config.identity.name) {
-    throw new Error("Invalid config: missing or non-string identity.name.");
-  }
-  if (!Array.isArray(config.relays) || !config.relays.every((r) => typeof r === "string")) {
-    throw new Error("Invalid config: relays must be an array of strings.");
-  }
-  if (config.capabilities !== void 0) {
-    if (!Array.isArray(config.capabilities)) {
-      throw new Error("Invalid config: capabilities must be an array.");
-    }
-    for (const cap of config.capabilities) {
-      if (!cap || typeof cap !== "object" || typeof cap.name !== "string" || typeof cap.description !== "string" || typeof cap.price !== "number") {
-        throw new Error(
-          "Invalid config: each capability must have name (string), description (string), and price (number)."
-        );
-      }
-      if (!Array.isArray(cap.tags) || !cap.tags.every((t) => typeof t === "string")) {
-        throw new Error("Invalid config: each capability must have tags (array of strings).");
-      }
-      if (!Number.isInteger(cap.price) || cap.price < 0) {
-        throw new Error(
-          "Invalid config: capability price must be a non-negative integer (lamports)."
-        );
-      }
-    }
-  }
-  if (config.payments !== void 0) {
-    if (!Array.isArray(config.payments)) {
-      throw new Error("Invalid config: payments must be an array.");
-    }
-    for (const p of config.payments) {
-      if (!p || typeof p !== "object" || typeof p.chain !== "string" || typeof p.network !== "string" || typeof p.address !== "string") {
-        throw new Error(
-          "Invalid config: each payment entry must have chain, network, and address (all strings)."
-        );
-      }
-    }
-  }
-  if (config.wallet !== void 0) {
-    if (!config.wallet || typeof config.wallet !== "object" || typeof config.wallet.chain !== "string" || typeof config.wallet.network !== "string" || typeof config.wallet.secret_key !== "string") {
-      throw new Error(
-        "Invalid config: wallet must have chain, network, and secret_key (all strings)."
-      );
-    }
-  }
-  if (config.llm !== void 0) {
-    if (!config.llm || typeof config.llm !== "object" || typeof config.llm.provider !== "string" || typeof config.llm.model !== "string" || typeof config.llm.api_key !== "string" || typeof config.llm.max_tokens !== "number" || !Number.isInteger(config.llm.max_tokens) || config.llm.max_tokens <= 0) {
-      throw new Error(
-        "Invalid config: llm must have provider, model, api_key (strings) and max_tokens (positive integer)."
-      );
-    }
-  }
-  if (!passphrase) {
-    const encrypted = [];
-    if (config.identity?.secret_key && isEncrypted(config.identity.secret_key)) {
-      encrypted.push("identity.secret_key");
-    }
-    if (config.wallet?.secret_key && isEncrypted(config.wallet.secret_key)) {
-      encrypted.push("wallet.secret_key");
-    }
-    if (config.llm?.api_key && isEncrypted(config.llm.api_key)) {
-      encrypted.push("llm.api_key");
-    }
-    if (encrypted.length > 0) {
-      throw new Error(
-        `Fields [${encrypted.join(", ")}] are encrypted but no passphrase provided. Set ELISYM_PASSPHRASE env var.`
-      );
-    }
-    return config;
-  }
-  if (config.identity?.secret_key && isEncrypted(config.identity.secret_key)) {
-    config.identity.secret_key = decryptSecret(config.identity.secret_key, passphrase);
-  }
-  if (config.wallet?.secret_key && isEncrypted(config.wallet.secret_key)) {
-    config.wallet.secret_key = decryptSecret(config.wallet.secret_key, passphrase);
-  }
-  if (config.llm?.api_key && isEncrypted(config.llm.api_key)) {
-    config.llm.api_key = decryptSecret(config.llm.api_key, passphrase);
-  }
-  return config;
-}
-
-export { decryptSecret, encryptSecret, isEncrypted, parseConfig };
+export { decryptSecret, encryptSecret, isEncrypted };
 //# sourceMappingURL=node.js.map
 //# sourceMappingURL=node.js.map

package/dist/node.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/primitives/encryption.ts","../src/primitives/config-node.ts"],"names":[],"mappings":";;;;AAcA,IAAM,MAAA,GAAS,eAAA;AACf,IAAM,WAAA,GAAc,EAAA;AACpB,IAAM,SAAA,GAAY,EAAA;AAClB,IAAM,UAAA,GAAa,EAAA;AACnB,IAAM,UAAA,GAAa,EAAA;AAEnB,IAAM,WAAW,CAAA,IAAK,EAAA;AACtB,IAAM,QAAA,GAAW,CAAA;AACjB,IAAM,QAAA,GAAW,CAAA;AACjB,IAAM,aAAA,GAAgB,GAAA,GAAM,QAAA,GAAW,QAAA,GAAW,CAAA;AAG3C,SAAS,YAAY,KAAA,EAAwB;AAClD,EAAA,OAAO,KAAA,CAAM,WAAW,MAAM,CAAA;AAChC;AAGO,SAAS,aAAA,CAAc,WAAmB,UAAA,EAA4B;AAC3E,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACjD;AAEA,EAAA,MAAM,IAAA,GAAO,YAAY,WAAW,CAAA;AACpC,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,UAAA,EAAY,IAAA,EAAM,UAAA,EAAY;AAAA,IACnD,CAAA,EAAG,QAAA;AAAA,IACH,CAAA,EAAG,QAAA;AAAA,IACH,CAAA,EAAG,QAAA;AAAA,IACH,MAAA,EAAQ;AAAA,GACT,CAAA;AACD,EAAA,MAAM,EAAA,GAAK,YAAY,SAAS,CAAA;AAEhC,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,aAAA,EAAe,GAAA,EAAK,EAAE,CAAA;AACpD,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,MAAM,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AAClF,EAAA,MAAM,GAAA,GAAM,OAAO,UAAA,EAAW;AAE9B,EAAA,MAAM,OAAA,GAAU,OAAO,MAAA,CAAO,CAAC,MAAM,EAAA,EAAI,SAAA,EAAW,GAAG,CAAC,CAAA;AACxD,EAAA,OAAO,MAAA,GAAS,OAAA,CAAQ,QAAA,CAAS,QAAQ,CAAA;AAC3C;AAGO,SAAS,aAAA,CAAc,WAAmB,UAAA,EAA4B;AAC3E,EAAA,IAAI,CAAC,WAAA,CAAY,SAAS,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACjD;AAEA,EAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,SAAA,CAAU,MAAM,MAAA,CAAO,MAAM,GAAG,QAAQ,CAAA;AACpE,EAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,WAAA,GAAc,SAAA,GAAY,UAAA,EAAY;AACzD,IAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,EACnD;AAEA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,QAAA,CAAS,CAAA,EAAG,WAAW,CAAA;AAC5C,EAAA,MAAM,EAAA,GAAK,OAAA,CAAQ,QAAA,CAAS,WAAA,EAAa,cAAc,SAAS,CAAA;AAChE,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,QAAA,CAAS,OAAA,CAAQ,SAAS,UAAU,CAAA;AACxD,EAAA,MAAM,aAAa,OAAA,CAAQ,QAAA,CAAS,cAAc,SAAA,EAAW,OAAA,CAAQ,SAAS,UAAU,CAAA;AAExF,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,UAAA,EAAY,IAAA,EAAM,UAAA,EAAY;AAAA,IACnD,CAAA,EAAG,QAAA;AAAA,IACH,CAAA,EAAG,QAAA;AAAA,IACH,CAAA,EAAG,QAAA;AAAA,IACH,MAAA,EAAQ;AAAA,GACT,CAAA;AAED,EAAA,MAAM,QAAA,GAAW,gBAAA,CAAiB,aAAA,EAAe,GAAA,EAAK,EAAE,CAAA;AACxD,EAAA,QAAA,CAAS,WAAW,GAAG,CAAA;AAEvB,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,UAAU,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AAC/E,IAAA,OAAO,SAAA,CAAU,SAAS,MAAM,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AACF;;;AC3EO,SAAS,WAAA,CAAY,MAAc,UAAA,EAAkC;AAC1E,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAE9B,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClE,IAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,EACzD;AACA,EAAA,IAAI,CAAC,OAAO,QAAA,EAAU,UAAA,IAAc,OAAO,MAAA,CAAO,QAAA,CAAS,eAAe,QAAA,EAAU;AAClF,IAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAAA,EAC9E;AACA,EAAA,IAAI,OAAO,OAAO,QAAA,CAAS,IAAA,KAAS,YAAY,CAAC,MAAA,CAAO,SAAS,IAAA,EAAM;AACrE,IAAA,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAAA,EACxE;AACA,EAAA,IACE,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,MAAM,CAAA,IAC5B,CAAC,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAA,KAAe,OAAO,CAAA,KAAM,QAAQ,CAAA,EAC1D;AACA,IAAA,MAAM,IAAI,MAAM,qDAAqD,CAAA;AAAA,EACvE;AAEA,EAAA,IAAI,MAAA,CAAO,iBAAiB,MAAA,EAAW;AACrC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,YAAY,CAAA,EAAG;AACvC,MAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,IAClE;AACA,IAAA,KAAA,MAAW,GAAA,IAAO,OAAO,YAAA,EAAc;AACrC,MAAA,IACE,CAAC,GAAA,IACD,OAAO,GAAA,KAAQ,QAAA,IACf,OAAO,GAAA,CAAI,IAAA,KAAS,QAAA,IACpB,OAAO,IAAI,WAAA,KAAgB,QAAA,IAC3B,OAAO,GAAA,CAAI,UAAU,QAAA,EACrB;AACA,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,IAAK,CAAC,GAAA,CAAI,IAAA,CAAK,MAAM,CAAC,CAAA,KAAe,OAAO,CAAA,KAAM,QAAQ,CAAA,EAAG;AACtF,QAAA,MAAM,IAAI,MAAM,oEAAoE,CAAA;AAAA,MACtF;AACA,MAAA,IAAI,CAAC,OAAO,SAAA,CAAU,GAAA,CAAI,KAAK,CAAA,IAAK,GAAA,CAAI,QAAQ,CAAA,EAAG;AACjD,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,aAAa,MAAA,EAAW;AACjC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA,EAAG;AACnC,MAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,IAC9D;AACA,IAAA,KAAA,MAAW,CAAA,IAAK,OAAO,QAAA,EAAU;AAC/B,MAAA,IACE,CAAC,CAAA,IACD,OAAO,CAAA,KAAM,QAAA,IACb,OAAO,CAAA,CAAE,KAAA,KAAU,QAAA,IACnB,OAAO,EAAE,OAAA,KAAY,QAAA,IACrB,OAAO,CAAA,CAAE,YAAY,QAAA,EACrB;AACA,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,WAAW,MAAA,EAAW;AAC/B,IAAA,IACE,CAAC,OAAO,MAAA,IACR,OAAO,OAAO,MAAA,KAAW,QAAA,IACzB,OAAO,MAAA,CAAO,MAAA,CAAO,UAAU,QAAA,IAC/B,OAAO,OAAO,MAAA,CAAO,OAAA,KAAY,YACjC,OAAO,MAAA,CAAO,MAAA,CAAO,UAAA,KAAe,QAAA,EACpC;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAW;AAC5B,IAAA,IACE,CAAC,MAAA,CAAO,GAAA,IACR,OAAO,MAAA,CAAO,QAAQ,QAAA,IACtB,OAAO,MAAA,CAAO,GAAA,CAAI,aAAa,QAAA,IAC/B,OAAO,MAAA,CAAO,GAAA,CAAI,UAAU,QAAA,IAC5B,OAAO,MAAA,CAAO,GAAA,CAAI,YAAY,QAAA,IAC9B,OAAO,MAAA,CAAO,GAAA,CAAI,eAAe,QAAA,IACjC,CAAC,MAAA,CAAO,SAAA,CAAU,OAAO,GAAA,CAAI,UAAU,KACvC,MAAA,CAAO,GAAA,CAAI,cAAc,CAAA,EACzB;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,MAAM,YAAsB,EAAC;AAC7B,IAAA,IAAI,OAAO,QAAA,EAAU,UAAA,IAAc,YAAY,MAAA,CAAO,QAAA,CAAS,UAAU,CAAA,EAAG;AAC1E,MAAA,SAAA,CAAU,KAAK,qBAAqB,CAAA;AAAA,IACtC;AACA,IAAA,IAAI,OAAO,MAAA,EAAQ,UAAA,IAAc,YAAY,MAAA,CAAO,MAAA,CAAO,UAAU,CAAA,EAAG;AACtE,MAAA,SAAA,CAAU,KAAK,mBAAmB,CAAA;AAAA,IACpC;AACA,IAAA,IAAI,OAAO,GAAA,EAAK,OAAA,IAAW,YAAY,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG;AAC1D,MAAA,SAAA,CAAU,KAAK,aAAa,CAAA;AAAA,IAC9B;AACA,IAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACxB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,QAAA,EAAW,SAAA,CAAU,IAAA,CAAK,IAAI,CAAC,CAAA,0EAAA;AAAA,OACjC;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAO,QAAA,EAAU,UAAA,IAAc,YAAY,MAAA,CAAO,QAAA,CAAS,UAAU,CAAA,EAAG;AAC1E,IAAA,MAAA,CAAO,SAAS,UAAA,GAAa,aAAA,CAAc,MAAA,CAAO,QAAA,CAAS,YAAY,UAAU,CAAA;AAAA,EACnF;AACA,EAAA,IAAI,OAAO,MAAA,EAAQ,UAAA,IAAc,YAAY,MAAA,CAAO,MAAA,CAAO,UAAU,CAAA,EAAG;AACtE,IAAA,MAAA,CAAO,OAAO,UAAA,GAAa,aAAA,CAAc,MAAA,CAAO,MAAA,CAAO,YAAY,UAAU,CAAA;AAAA,EAC/E;AACA,EAAA,IAAI,OAAO,GAAA,EAAK,OAAA,IAAW,YAAY,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG;AAC1D,IAAA,MAAA,CAAO,IAAI,OAAA,GAAU,aAAA,CAAc,MAAA,CAAO,GAAA,CAAI,SAAS,UAAU,CAAA;AAAA,EACnE;AAEA,EAAA,OAAO,MAAA;AACT","file":"node.js","sourcesContent":["/**\n * Secret encryption/decryption for agent config files.\n * Uses scrypt (KDF) + AES-256-GCM (cipher).\n * Format: \"encrypted:v1:\" + base64(salt[16] + iv[12] + ciphertext + tag[16])\n *\n * scrypt params: N=2^17, r=8, p=1 (~128 MB RAM per derivation).\n *\n * Node.js/Bun only - not available in browsers. Reachable only via the\n * '@elisym/sdk/node' subpath, which browser bundlers will not resolve.\n */\n\nimport { Buffer } from 'node:buffer';\nimport { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';\n\nconst PREFIX = 'encrypted:v1:';\nconst SALT_LENGTH = 16;\nconst IV_LENGTH = 12;\nconst TAG_LENGTH = 16;\nconst KEY_LENGTH = 32; // AES-256\n// v1: N=2^17 (OWASP minimum). v2 will use N=2^20 with format migration.\nconst SCRYPT_N = 2 ** 17;\nconst SCRYPT_R = 8;\nconst SCRYPT_P = 1;\nconst SCRYPT_MAXMEM = 128 * SCRYPT_N * SCRYPT_R * 2; // 2x the minimum required memory\n\n/** Check if a value is encrypted (has the encrypted:v1: prefix). */\nexport function isEncrypted(value: string): boolean {\n  return value.startsWith(PREFIX);\n}\n\n/** Encrypt a plaintext secret with a passphrase. Returns \"encrypted:v1:base64...\". Node.js/Bun only. */\nexport function encryptSecret(plaintext: string, passphrase: string): string {\n  if (!passphrase) {\n    throw new Error('Passphrase must not be empty.');\n  }\n\n  const salt = randomBytes(SALT_LENGTH);\n  const key = scryptSync(passphrase, salt, KEY_LENGTH, {\n    N: SCRYPT_N,\n    r: SCRYPT_R,\n    p: SCRYPT_P,\n    maxmem: SCRYPT_MAXMEM,\n  });\n  const iv = randomBytes(IV_LENGTH);\n\n  const cipher = createCipheriv('aes-256-gcm', key, iv);\n  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);\n  const tag = cipher.getAuthTag();\n\n  const payload = Buffer.concat([salt, iv, encrypted, tag]);\n  return PREFIX + payload.toString('base64');\n}\n\n/** Decrypt an encrypted secret with a passphrase. Throws on wrong passphrase or corrupted data. Node.js/Bun only. */\nexport function decryptSecret(encrypted: string, passphrase: string): string {\n  if (!isEncrypted(encrypted)) {\n    throw new Error('Value is not encrypted (missing encrypted:v1: prefix).');\n  }\n  if (!passphrase) {\n    throw new Error('Passphrase must not be empty.');\n  }\n\n  const payload = Buffer.from(encrypted.slice(PREFIX.length), 'base64');\n  if (payload.length < SALT_LENGTH + IV_LENGTH + TAG_LENGTH) {\n    throw new Error('Encrypted payload is too short.');\n  }\n\n  const salt = payload.subarray(0, SALT_LENGTH);\n  const iv = payload.subarray(SALT_LENGTH, SALT_LENGTH + IV_LENGTH);\n  const tag = payload.subarray(payload.length - TAG_LENGTH);\n  const ciphertext = payload.subarray(SALT_LENGTH + IV_LENGTH, payload.length - TAG_LENGTH);\n\n  const key = scryptSync(passphrase, salt, KEY_LENGTH, {\n    N: SCRYPT_N,\n    r: SCRYPT_R,\n    p: SCRYPT_P,\n    maxmem: SCRYPT_MAXMEM,\n  });\n\n  const decipher = createDecipheriv('aes-256-gcm', key, iv);\n  decipher.setAuthTag(tag);\n\n  try {\n    const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n    return decrypted.toString('utf8');\n  } catch {\n    throw new Error('Decryption failed. Wrong passphrase or corrupted data.');\n  }\n}\n","/**\n * Node.js-only config parsing with secret decryption.\n * Exported from '@elisym/sdk/node'.\n */\n\nimport type { AgentConfig } from '../types';\nimport { isEncrypted, decryptSecret } from './encryption';\n\n/**\n * Parse a JSON string into an AgentConfig.\n * If passphrase is provided, decrypts all encrypted fields (requires Node.js/Bun).\n * If passphrase is not provided and encrypted fields exist, throws.\n */\nexport function parseConfig(json: string, passphrase?: string): AgentConfig {\n  const config = JSON.parse(json) as AgentConfig;\n\n  if (!config || typeof config !== 'object' || Array.isArray(config)) {\n    throw new Error('Invalid config: expected JSON object.');\n  }\n  if (!config.identity?.secret_key || typeof config.identity.secret_key !== 'string') {\n    throw new Error('Invalid config: missing or non-string identity.secret_key.');\n  }\n  if (typeof config.identity.name !== 'string' || !config.identity.name) {\n    throw new Error('Invalid config: missing or non-string identity.name.');\n  }\n  if (\n    !Array.isArray(config.relays) ||\n    !config.relays.every((r: unknown) => typeof r === 'string')\n  ) {\n    throw new Error('Invalid config: relays must be an array of strings.');\n  }\n\n  if (config.capabilities !== undefined) {\n    if (!Array.isArray(config.capabilities)) {\n      throw new Error('Invalid config: capabilities must be an array.');\n    }\n    for (const cap of config.capabilities) {\n      if (\n        !cap ||\n        typeof cap !== 'object' ||\n        typeof cap.name !== 'string' ||\n        typeof cap.description !== 'string' ||\n        typeof cap.price !== 'number'\n      ) {\n        throw new Error(\n          'Invalid config: each capability must have name (string), description (string), and price (number).',\n        );\n      }\n      if (!Array.isArray(cap.tags) || !cap.tags.every((t: unknown) => typeof t === 'string')) {\n        throw new Error('Invalid config: each capability must have tags (array of strings).');\n      }\n      if (!Number.isInteger(cap.price) || cap.price < 0) {\n        throw new Error(\n          'Invalid config: capability price must be a non-negative integer (lamports).',\n        );\n      }\n    }\n  }\n  if (config.payments !== undefined) {\n    if (!Array.isArray(config.payments)) {\n      throw new Error('Invalid config: payments must be an array.');\n    }\n    for (const p of config.payments) {\n      if (\n        !p ||\n        typeof p !== 'object' ||\n        typeof p.chain !== 'string' ||\n        typeof p.network !== 'string' ||\n        typeof p.address !== 'string'\n      ) {\n        throw new Error(\n          'Invalid config: each payment entry must have chain, network, and address (all strings).',\n        );\n      }\n    }\n  }\n  if (config.wallet !== undefined) {\n    if (\n      !config.wallet ||\n      typeof config.wallet !== 'object' ||\n      typeof config.wallet.chain !== 'string' ||\n      typeof config.wallet.network !== 'string' ||\n      typeof config.wallet.secret_key !== 'string'\n    ) {\n      throw new Error(\n        'Invalid config: wallet must have chain, network, and secret_key (all strings).',\n      );\n    }\n  }\n  if (config.llm !== undefined) {\n    if (\n      !config.llm ||\n      typeof config.llm !== 'object' ||\n      typeof config.llm.provider !== 'string' ||\n      typeof config.llm.model !== 'string' ||\n      typeof config.llm.api_key !== 'string' ||\n      typeof config.llm.max_tokens !== 'number' ||\n      !Number.isInteger(config.llm.max_tokens) ||\n      config.llm.max_tokens <= 0\n    ) {\n      throw new Error(\n        'Invalid config: llm must have provider, model, api_key (strings) and max_tokens (positive integer).',\n      );\n    }\n  }\n\n  if (!passphrase) {\n    const encrypted: string[] = [];\n    if (config.identity?.secret_key && isEncrypted(config.identity.secret_key)) {\n      encrypted.push('identity.secret_key');\n    }\n    if (config.wallet?.secret_key && isEncrypted(config.wallet.secret_key)) {\n      encrypted.push('wallet.secret_key');\n    }\n    if (config.llm?.api_key && isEncrypted(config.llm.api_key)) {\n      encrypted.push('llm.api_key');\n    }\n    if (encrypted.length > 0) {\n      throw new Error(\n        `Fields [${encrypted.join(', ')}] are encrypted but no passphrase provided. Set ELISYM_PASSPHRASE env var.`,\n      );\n    }\n    return config;\n  }\n\n  if (config.identity?.secret_key && isEncrypted(config.identity.secret_key)) {\n    config.identity.secret_key = decryptSecret(config.identity.secret_key, passphrase);\n  }\n  if (config.wallet?.secret_key && isEncrypted(config.wallet.secret_key)) {\n    config.wallet.secret_key = decryptSecret(config.wallet.secret_key, passphrase);\n  }\n  if (config.llm?.api_key && isEncrypted(config.llm.api_key)) {\n    config.llm.api_key = decryptSecret(config.llm.api_key, passphrase);\n  }\n\n  return config;\n}\n"]}
+{"version":3,"sources":["../src/primitives/encryption.ts"],"names":[],"mappings":";;;;AAcA,IAAM,MAAA,GAAS,eAAA;AACf,IAAM,WAAA,GAAc,EAAA;AACpB,IAAM,SAAA,GAAY,EAAA;AAClB,IAAM,UAAA,GAAa,EAAA;AACnB,IAAM,UAAA,GAAa,EAAA;AAEnB,IAAM,WAAW,CAAA,IAAK,EAAA;AACtB,IAAM,QAAA,GAAW,CAAA;AACjB,IAAM,QAAA,GAAW,CAAA;AACjB,IAAM,aAAA,GAAgB,GAAA,GAAM,QAAA,GAAW,QAAA,GAAW,CAAA;AAG3C,SAAS,YAAY,KAAA,EAAwB;AAClD,EAAA,OAAO,KAAA,CAAM,WAAW,MAAM,CAAA;AAChC;AAGO,SAAS,aAAA,CAAc,WAAmB,UAAA,EAA4B;AAC3E,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACjD;AAEA,EAAA,MAAM,IAAA,GAAO,YAAY,WAAW,CAAA;AACpC,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,UAAA,EAAY,IAAA,EAAM,UAAA,EAAY;AAAA,IACnD,CAAA,EAAG,QAAA;AAAA,IACH,CAAA,EAAG,QAAA;AAAA,IACH,CAAA,EAAG,QAAA;AAAA,IACH,MAAA,EAAQ;AAAA,GACT,CAAA;AACD,EAAA,MAAM,EAAA,GAAK,YAAY,SAAS,CAAA;AAEhC,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,aAAA,EAAe,GAAA,EAAK,EAAE,CAAA;AACpD,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,MAAM,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AAClF,EAAA,MAAM,GAAA,GAAM,OAAO,UAAA,EAAW;AAE9B,EAAA,MAAM,OAAA,GAAU,OAAO,MAAA,CAAO,CAAC,MAAM,EAAA,EAAI,SAAA,EAAW,GAAG,CAAC,CAAA;AACxD,EAAA,OAAO,MAAA,GAAS,OAAA,CAAQ,QAAA,CAAS,QAAQ,CAAA;AAC3C;AAGO,SAAS,aAAA,CAAc,WAAmB,UAAA,EAA4B;AAC3E,EAAA,IAAI,CAAC,WAAA,CAAY,SAAS,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACjD;AAEA,EAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,SAAA,CAAU,MAAM,MAAA,CAAO,MAAM,GAAG,QAAQ,CAAA;AACpE,EAAA,IAAI,OAAA,CAAQ,MAAA,GAAS,WAAA,GAAc,SAAA,GAAY,UAAA,EAAY;AACzD,IAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,EACnD;AAEA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,QAAA,CAAS,CAAA,EAAG,WAAW,CAAA;AAC5C,EAAA,MAAM,EAAA,GAAK,OAAA,CAAQ,QAAA,CAAS,WAAA,EAAa,cAAc,SAAS,CAAA;AAChE,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,QAAA,CAAS,OAAA,CAAQ,SAAS,UAAU,CAAA;AACxD,EAAA,MAAM,aAAa,OAAA,CAAQ,QAAA,CAAS,cAAc,SAAA,EAAW,OAAA,CAAQ,SAAS,UAAU,CAAA;AAExF,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,UAAA,EAAY,IAAA,EAAM,UAAA,EAAY;AAAA,IACnD,CAAA,EAAG,QAAA;AAAA,IACH,CAAA,EAAG,QAAA;AAAA,IACH,CAAA,EAAG,QAAA;AAAA,IACH,MAAA,EAAQ;AAAA,GACT,CAAA;AAED,EAAA,MAAM,QAAA,GAAW,gBAAA,CAAiB,aAAA,EAAe,GAAA,EAAK,EAAE,CAAA;AACxD,EAAA,QAAA,CAAS,WAAW,GAAG,CAAA;AAEvB,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,UAAU,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AAC/E,IAAA,OAAO,SAAA,CAAU,SAAS,MAAM,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AACF","file":"node.js","sourcesContent":["/**\n * Secret encryption/decryption for agent config files.\n * Uses scrypt (KDF) + AES-256-GCM (cipher).\n * Format: \"encrypted:v1:\" + base64(salt[16] + iv[12] + ciphertext + tag[16])\n *\n * scrypt params: N=2^17, r=8, p=1 (~128 MB RAM per derivation).\n *\n * Node.js/Bun only - not available in browsers. Reachable only via the\n * '@elisym/sdk/node' subpath, which browser bundlers will not resolve.\n */\n\nimport { Buffer } from 'node:buffer';\nimport { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';\n\nconst PREFIX = 'encrypted:v1:';\nconst SALT_LENGTH = 16;\nconst IV_LENGTH = 12;\nconst TAG_LENGTH = 16;\nconst KEY_LENGTH = 32; // AES-256\n// v1: N=2^17 (OWASP minimum). v2 will use N=2^20 with format migration.\nconst SCRYPT_N = 2 ** 17;\nconst SCRYPT_R = 8;\nconst SCRYPT_P = 1;\nconst SCRYPT_MAXMEM = 128 * SCRYPT_N * SCRYPT_R * 2; // 2x the minimum required memory\n\n/** Check if a value is encrypted (has the encrypted:v1: prefix). */\nexport function isEncrypted(value: string): boolean {\n  return value.startsWith(PREFIX);\n}\n\n/** Encrypt a plaintext secret with a passphrase. Returns \"encrypted:v1:base64...\". Node.js/Bun only. */\nexport function encryptSecret(plaintext: string, passphrase: string): string {\n  if (!passphrase) {\n    throw new Error('Passphrase must not be empty.');\n  }\n\n  const salt = randomBytes(SALT_LENGTH);\n  const key = scryptSync(passphrase, salt, KEY_LENGTH, {\n    N: SCRYPT_N,\n    r: SCRYPT_R,\n    p: SCRYPT_P,\n    maxmem: SCRYPT_MAXMEM,\n  });\n  const iv = randomBytes(IV_LENGTH);\n\n  const cipher = createCipheriv('aes-256-gcm', key, iv);\n  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);\n  const tag = cipher.getAuthTag();\n\n  const payload = Buffer.concat([salt, iv, encrypted, tag]);\n  return PREFIX + payload.toString('base64');\n}\n\n/** Decrypt an encrypted secret with a passphrase. Throws on wrong passphrase or corrupted data. Node.js/Bun only. */\nexport function decryptSecret(encrypted: string, passphrase: string): string {\n  if (!isEncrypted(encrypted)) {\n    throw new Error('Value is not encrypted (missing encrypted:v1: prefix).');\n  }\n  if (!passphrase) {\n    throw new Error('Passphrase must not be empty.');\n  }\n\n  const payload = Buffer.from(encrypted.slice(PREFIX.length), 'base64');\n  if (payload.length < SALT_LENGTH + IV_LENGTH + TAG_LENGTH) {\n    throw new Error('Encrypted payload is too short.');\n  }\n\n  const salt = payload.subarray(0, SALT_LENGTH);\n  const iv = payload.subarray(SALT_LENGTH, SALT_LENGTH + IV_LENGTH);\n  const tag = payload.subarray(payload.length - TAG_LENGTH);\n  const ciphertext = payload.subarray(SALT_LENGTH + IV_LENGTH, payload.length - TAG_LENGTH);\n\n  const key = scryptSync(passphrase, salt, KEY_LENGTH, {\n    N: SCRYPT_N,\n    r: SCRYPT_R,\n    p: SCRYPT_P,\n    maxmem: SCRYPT_MAXMEM,\n  });\n\n  const decipher = createDecipheriv('aes-256-gcm', key, iv);\n  decipher.setAuthTag(tag);\n\n  try {\n    const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n    return decrypted.toString('utf8');\n  } catch {\n    throw new Error('Decryption failed. Wrong passphrase or corrupted data.');\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elisym/sdk",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "TypeScript SDK for elisym - AI agent discovery, marketplace, and payments on Nostr",
   "keywords": [
     "ai-agents",
@@ -53,6 +53,16 @@
         "types": "./dist/node.d.cts",
         "default": "./dist/node.cjs"
       }
+    },
+    "./agent-store": {
+      "import": {
+        "types": "./dist/agent-store.d.ts",
+        "default": "./dist/agent-store.js"
+      },
+      "require": {
+        "types": "./dist/agent-store.d.cts",
+        "default": "./dist/agent-store.cjs"
+      }
     }
   },
   "scripts": {
@@ -66,6 +76,10 @@
     "qa": "tsup && vitest run && tsc --noEmit && oxlint src/ && oxfmt --check src/ tests/",
     "clean": "rm -rf dist"
   },
+  "dependencies": {
+    "yaml": "~2.8.3",
+    "zod": "~3.25.0"
+  },
   "devDependencies": {
     "@elisym/config-client": "workspace:*",
     "@solana-program/system": "~0.12.0",

package/dist/types-CII4k_8d.d.cts

@@ -1,181 +0,0 @@
-declare class ElisymIdentity {
-    private _secretKey;
-    readonly publicKey: string;
-    readonly npub: string;
-    get secretKey(): Uint8Array;
-    private constructor();
-    static generate(): ElisymIdentity;
-    static fromSecretKey(sk: Uint8Array): ElisymIdentity;
-    toJSON(): {
-        publicKey: string;
-        npub: string;
-    };
-    /** Best-effort scrub of the secret key bytes in memory. */
-    scrub(): void;
-    static fromHex(hex: string): ElisymIdentity;
-}
-
-interface SubCloser {
-    close: (reason?: string) => void;
-}
-/** Capability card published to Nostr (NIP-89). */
-interface CapabilityCard {
-    name: string;
-    description: string;
-    capabilities: string[];
-    payment?: PaymentInfo;
-    image?: string;
-    static?: boolean;
-}
-/** Payment info embedded in capability card (legacy format for on-network events). */
-interface PaymentInfo {
-    chain: string;
-    network: string;
-    address: string;
-    /** Price in lamports (must be non-negative integer). */
-    job_price?: number;
-}
-/** Agent discovered from the network. */
-interface Agent {
-    pubkey: string;
-    npub: string;
-    cards: CapabilityCard[];
-    eventId: string;
-    supportedKinds: number[];
-    lastSeen: number;
-    picture?: string;
-    name?: string;
-    about?: string;
-}
-type Network = 'mainnet' | 'devnet';
-/**
- * Job lifecycle status.
- * Note: for broadcast jobs (no providerPubkey, no bid), fetchRecentJobs() keeps
- * status as 'processing' even if a provider sent 'payment-required' feedback,
- * because the customer hasn't committed to that provider yet. The real-time
- * payment-required transition is handled by subscribeToJobUpdates().
- */
-type JobStatus = 'payment-required' | 'payment-completed' | 'processing' | 'error' | 'success' | 'partial' | 'unknown';
-interface Job {
-    eventId: string;
-    customer: string;
-    agentPubkey?: string;
-    capability?: string;
-    bid?: number;
-    status: JobStatus;
-    result?: string;
-    resultEventId?: string;
-    amount?: number;
-    txHash?: string;
-    createdAt: number;
-}
-interface SubmitJobOptions {
-    /** Job input text. Sent unencrypted if providerPubkey is not set. */
-    input: string;
-    capability: string;
-    /** Target provider pubkey. If omitted, job is broadcast unencrypted and visible to all relays. */
-    providerPubkey?: string;
-    /** Kind offset (default 100 - kind 5100). */
-    kindOffset?: number;
-}
-interface JobUpdateCallbacks {
-    onFeedback?: (status: string, amount?: number, paymentRequest?: string, senderPubkey?: string) => void;
-    onResult?: (content: string, eventId: string) => void;
-    onError?: (error: string) => void;
-}
-interface JobSubscriptionOptions {
-    jobEventId: string;
-    providerPubkey?: string;
-    customerPublicKey: string;
-    callbacks: JobUpdateCallbacks;
-    timeoutMs?: number;
-    customerSecretKey?: Uint8Array;
-    kindOffsets?: number[];
-    sinceOverride?: number;
-}
-interface PingResult {
-    online: boolean;
-    /** The identity used for the ping session - reuse for job submission so pubkeys match. */
-    identity: ElisymIdentity | null;
-}
-interface PaymentRequestData {
-    recipient: string;
-    /** Total amount in lamports (must be positive integer). */
-    amount: number;
-    reference: string;
-    description?: string;
-    fee_address?: string;
-    fee_amount?: number;
-    /** Creation timestamp (Unix seconds). */
-    created_at: number;
-    /** Expiry duration in seconds. */
-    expiry_secs: number;
-}
-interface VerifyResult {
-    verified: boolean;
-    txSignature?: string;
-    error?: string;
-}
-interface VerifyOptions {
-    retries?: number;
-    intervalMs?: number;
-    txSignature?: string;
-}
-type PaymentValidationCode = 'invalid_json' | 'invalid_amount' | 'missing_recipient' | 'invalid_recipient_address' | 'missing_reference' | 'invalid_reference_address' | 'recipient_mismatch' | 'expired' | 'future_timestamp' | 'fee_address_mismatch' | 'fee_amount_mismatch' | 'missing_fee' | 'invalid_fee_params';
-interface PaymentValidationError {
-    code: PaymentValidationCode;
-    message: string;
-}
-interface NetworkStats {
-    totalAgentCount: number;
-    agentCount: number;
-    jobCount: number;
-    totalLamports: number;
-}
-interface ElisymClientConfig {
-    relays?: string[];
-}
-interface Identity {
-    secret_key: string;
-    name: string;
-    description?: string;
-    picture?: string;
-    banner?: string;
-}
-interface Capability {
-    name: string;
-    description: string;
-    tags: string[];
-    /** Price in smallest unit (lamports for Solana). */
-    price: number;
-    /** Hero image URL for app display. */
-    image?: string;
-}
-interface PaymentAddress {
-    chain: string;
-    network: string;
-    address: string;
-    /** Token mint/contract address. Absent = native coin. */
-    token?: string;
-}
-interface WalletConfig {
-    chain: string;
-    network: string;
-    secret_key: string;
-}
-interface LlmConfig {
-    provider: string;
-    api_key: string;
-    model: string;
-    max_tokens: number;
-}
-interface AgentConfig {
-    identity: Identity;
-    relays: string[];
-    capabilities?: Capability[];
-    payments?: PaymentAddress[];
-    wallet?: WalletConfig;
-    llm?: LlmConfig;
-}
-
-export { type Agent as A, type CapabilityCard as C, ElisymIdentity as E, type Identity as I, type JobSubscriptionOptions as J, type LlmConfig as L, type Network as N, type PaymentRequestData as P, type SubCloser as S, type VerifyOptions as V, type WalletConfig as W, type PaymentValidationError as a, type VerifyResult as b, type SubmitJobOptions as c, type Job as d, type PingResult as e, type ElisymClientConfig as f, type AgentConfig as g, type Capability as h, type JobStatus as i, type JobUpdateCallbacks as j, type NetworkStats as k, type PaymentAddress as l, type PaymentInfo as m, type PaymentValidationCode as n };