@hardkas/accounts 0.11.2-alpha → 0.11.4-alpha

package/dist/chunk-YLG2NIAU.js

@@ -0,0 +1,166 @@
+// src/keystore.ts
+import fs from "fs";
+import path from "path";
+import crypto from "crypto";
+import { argon2id } from "hash-wasm";
+import { writeFileAtomic } from "@hardkas/core";
+var KeystoreManager = class {
+  /**
+   * Keystore container format version. Separate from ARTIFACT_VERSION.
+   * This versions the encrypted keystore envelope, not HardKAS artifacts.
+   */
+  static KEYSTORE_FORMAT_VERSION = "2.0.0";
+  static KEYSTORE_FORMAT_TYPE = "hardkas.encryptedKeystore.v2";
+  /**
+   * Creates an encrypted keystore from a payload and password.
+   */
+  static async createEncryptedKeystore(payload, password, options) {
+    if (!password) throw new Error("Password cannot be empty.");
+    if (password.length < 8)
+      throw new Error("Password must be at least 8 characters long.");
+    const salt = crypto.randomBytes(16);
+    const nonce = crypto.randomBytes(12);
+    const iterations = options.iterations || 3;
+    const memory = options.memory || 65536;
+    const parallelism = options.parallelism || 1;
+    const derivedKeyHex = await argon2id({
+      password,
+      salt,
+      parallelism,
+      iterations,
+      memorySize: memory,
+      hashLength: 32,
+      // 256 bits for AES-256
+      outputType: "hex"
+    });
+    const derivedKey = Buffer.from(derivedKeyHex, "hex");
+    const cipher = crypto.createCipheriv("aes-256-gcm", derivedKey, nonce);
+    const encryptedPayload = Buffer.concat([
+      cipher.update(JSON.stringify(payload), "utf8"),
+      cipher.final()
+    ]);
+    const tag = cipher.getAuthTag();
+    derivedKey.fill(0);
+    return {
+      version: this.KEYSTORE_FORMAT_VERSION,
+      type: this.KEYSTORE_FORMAT_TYPE,
+      kdf: {
+        algorithm: "argon2id",
+        memory,
+        iterations,
+        parallelism,
+        salt: salt.toString("base64")
+      },
+      cipher: {
+        algorithm: "aes-256-gcm",
+        nonce: nonce.toString("base64"),
+        tag: tag.toString("base64")
+      },
+      encryptedPayload: encryptedPayload.toString("base64"),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      metadata: {
+        label: options.label,
+        network: options.network,
+        address: payload.address
+      }
+    };
+  }
+  /**
+   * Decrypts an encrypted keystore using a password.
+   */
+  static async decryptEncryptedKeystore(keystore, password) {
+    if (keystore.version !== this.KEYSTORE_FORMAT_VERSION) {
+      return {
+        success: false,
+        error: `Unsupported keystore version: ${keystore.version}`
+      };
+    }
+    try {
+      const salt = Buffer.from(keystore.kdf.salt, "base64");
+      const nonce = Buffer.from(keystore.cipher.nonce, "base64");
+      const tag = Buffer.from(keystore.cipher.tag, "base64");
+      const encryptedData = Buffer.from(keystore.encryptedPayload, "base64");
+      const derivedKeyHex = await argon2id({
+        password,
+        salt,
+        parallelism: keystore.kdf.parallelism,
+        iterations: keystore.kdf.iterations,
+        memorySize: keystore.kdf.memory,
+        hashLength: 32,
+        outputType: "hex"
+      });
+      const derivedKey = Buffer.from(derivedKeyHex, "hex");
+      const decipher = crypto.createDecipheriv("aes-256-gcm", derivedKey, nonce);
+      decipher.setAuthTag(tag);
+      const decrypted = Buffer.concat([decipher.update(encryptedData), decipher.final()]);
+      derivedKey.fill(0);
+      const payload = JSON.parse(decrypted.toString("utf8"));
+      return { success: true, payload };
+    } catch (e) {
+      return { success: false, error: "Invalid password or corrupted keystore." };
+    }
+  }
+  /**
+   * Verifies if the password is correct for the keystore.
+   */
+  static async verifyKeystorePassword(keystore, password) {
+    const result = await this.decryptEncryptedKeystore(keystore, password);
+    return result.success;
+  }
+  /**
+   * Changes the password of an encrypted keystore.
+   */
+  static async changeKeystorePassword(keystore, oldPassword, newPassword) {
+    const unlock = await this.decryptEncryptedKeystore(keystore, oldPassword);
+    if (!unlock.success || !unlock.payload) {
+      throw new Error("Invalid current password.");
+    }
+    return this.createEncryptedKeystore(unlock.payload, newPassword, {
+      label: keystore.metadata.label,
+      network: keystore.metadata.network,
+      iterations: keystore.kdf.iterations,
+      memory: keystore.kdf.memory,
+      parallelism: keystore.kdf.parallelism
+    });
+  }
+  /**
+   * Loads an encrypted keystore from the filesystem.
+   */
+  static async loadEncryptedKeystore(filePath) {
+    try {
+      const data = await fs.promises.readFile(filePath, "utf-8");
+      const keystore = JSON.parse(data);
+      if (keystore.type !== this.KEYSTORE_FORMAT_TYPE) {
+        throw new Error(`Invalid keystore type: ${keystore.type}`);
+      }
+      return keystore;
+    } catch (e) {
+      throw new Error(
+        `Failed to load keystore at ${filePath}: ${e instanceof Error ? e instanceof Error ? e instanceof Error ? e.message : String(e) : String(e) : String(e)}`
+      );
+    }
+  }
+  /**
+   * Saves an encrypted keystore to the filesystem.
+   */
+  static async saveEncryptedKeystore(filePath, keystore) {
+    try {
+      const dir = path.dirname(filePath);
+      if (!fs.existsSync(dir)) {
+        await fs.promises.mkdir(dir, { recursive: true });
+      }
+      await writeFileAtomic(filePath, JSON.stringify(keystore, null, 2), {
+        encoding: "utf-8",
+        mode: 384
+      });
+    } catch (e) {
+      throw new Error(
+        `Failed to save keystore at ${filePath}: ${e instanceof Error ? e instanceof Error ? e instanceof Error ? e.message : String(e) : String(e) : String(e)}`
+      );
+    }
+  }
+};
+
+export {
+  KeystoreManager
+};

package/dist/dev-accounts-FU4XTSGF.js

@@ -0,0 +1,18 @@
+import {
+  DEV_ACCOUNTS_PASSWORD,
+  createDevSigner,
+  ensureDevAccounts,
+  getOrCreateDevAccount,
+  listDevAccountsSync
+} from "./chunk-TY5CXPHB.js";
+import "./chunk-WRRHW2WO.js";
+import "./chunk-ILASLDZU.js";
+import "./chunk-6DPO5V3N.js";
+import "./chunk-YLG2NIAU.js";
+export {
+  DEV_ACCOUNTS_PASSWORD,
+  createDevSigner,
+  ensureDevAccounts,
+  getOrCreateDevAccount,
+  listDevAccountsSync
+};

package/dist/index.d.ts

@@ -1,8 +1,45 @@
+import { TxPlanArtifact, SignedTxArtifact, HardkasArtifactBase } from '@hardkas/artifacts';
 import { HardkasConfig } from '@hardkas/config';
-import { TxPlanArtifact, SignedTxArtifact, ExternalHardkasSigner, HardkasArtifactBase } from '@hardkas/artifacts';
 import { NetworkId } from '@hardkas/core';
 import { TxPlan } from '@hardkas/tx-builder';
 
+interface TxInputAuthorizationContext {
+    readonly inputIndex: number;
+    readonly plan: TxPlanArtifact;
+    readonly wasmTransaction: unknown;
+    readonly wasm: any;
+}
+type InputAuthorization = {
+    readonly kind: "signature-script";
+    readonly signatureScript: string;
+} | {
+    readonly kind: "wasm-signer";
+    readonly signer: WasmInputSigner;
+};
+interface WasmInputSigner {
+    signInput(context: TxInputAuthorizationContext): Promise<string> | string;
+}
+interface TxInputAuthorizer {
+    authorize(context: TxInputAuthorizationContext): Promise<InputAuthorization> | InputAuthorization;
+}
+declare class StaticSignatureScriptAuthorizer implements TxInputAuthorizer {
+    private readonly signatureScript;
+    constructor(signatureScript: string);
+    authorize(): InputAuthorization;
+}
+declare class PrivateKeyAuthorizer implements TxInputAuthorizer {
+    readonly accountName: string;
+    readonly privateKeyHex: string;
+    constructor(accountName: string, privateKeyHex: string);
+    authorize(context: TxInputAuthorizationContext): InputAuthorization;
+}
+declare class LazyAccountAuthorizer implements TxInputAuthorizer {
+    readonly accountName: string;
+    private readonly workspaceRoot;
+    constructor(accountName: string, workspaceRoot: string);
+    authorize(context: TxInputAuthorizationContext): Promise<InputAuthorization>;
+}
+
 type HardkasAccountKind = "simulated" | "kaspa-private-key" | "external-wallet" | "evm-private-key";
 interface KeystorePayload {
     address: string;
@@ -73,9 +110,11 @@ interface HardkasEvmPrivateKeyAccount extends HardkasBaseAccount {
 }
 type HardkasAccount = HardkasSimulatedAccount | HardkasKaspaPrivateKeyAccount | HardkasExternalWalletAccount | HardkasEvmPrivateKeyAccount;
 type HardkasSignerKind = "simulated" | "kaspa-private-key" | "external-wallet" | "unsupported";
+
 interface SignTxPlanInput {
     planArtifact: any;
-    accountName: string;
+    accountName?: string;
+    authorizers?: Readonly<Record<number, TxInputAuthorizer>>;
 }
 interface SignTxPlanResult {
     signatureKind: HardkasSignerKind;
@@ -133,14 +172,6 @@ declare function prepareEvmAccountExport(account: HardkasAccount, networkId: str
 
 declare function getRequiredEnv(name: string): string;
 
-/**
- * Simulated signer for simnet development.
- * Produces deterministic signatures without real private keys.
- */
-declare class SimulatedTxPlanSigner implements HardkasTxPlanSigner {
-    kind: HardkasSignerKind;
-    signTxPlan(input: SignTxPlanInput): Promise<SignTxPlanResult>;
-}
 /**
  * Placeholder for real Kaspa signing.
  */
@@ -148,12 +179,14 @@ declare class UnsupportedRealKaspaSigner implements HardkasTxPlanSigner {
     kind: HardkasSignerKind;
     signTxPlan(_input: SignTxPlanInput): Promise<SignTxPlanResult>;
 }
+
 /**
  * Main entry point for signing transaction plan artifacts.
  */
 declare function signTxPlanArtifact(input: {
     planArtifact: TxPlanArtifact;
-    account: HardkasAccount;
+    account?: HardkasAccount;
+    authorizers?: Readonly<Record<number, TxInputAuthorizer>>;
     config?: HardkasConfig;
     allowMainnet?: boolean;
 }): Promise<SignedTxArtifact>;
@@ -167,11 +200,15 @@ interface KaspaSigningBackendStatus {
         transactionV1Signing: boolean;
     };
 }
+interface WasmProviderConfig {
+    provider: "npm" | "local" | "release-asset";
+    path?: string;
+}
 /**
  * Loads the official Kaspa WASM SDK dynamically.
  * This ensures the toolkit remains usable even if the SDK is not installed.
  */
-declare function loadKaspaWasm(): Promise<any>;
+declare function loadKaspaWasm(config?: WasmProviderConfig): Promise<any>;
 /**
  * Detects the specific capabilities supported by the installed kaspa-wasm SDK.
  */
@@ -181,7 +218,7 @@ declare function detectCapabilities(sdk: any): {
 /**
  * Checks if the Kaspa WASM SDK is available without throwing.
  */
-declare function getKaspaSigningBackendStatus(): Promise<KaspaSigningBackendStatus>;
+declare function getKaspaSigningBackendStatus(config?: WasmProviderConfig): Promise<KaspaSigningBackendStatus>;
 
 interface GeneratedKaspaDevAccount {
     readonly address: string;
@@ -219,8 +256,9 @@ declare class KaspaWasmPrivateKeySigner implements HardkasTxPlanSigner {
     private options;
     kind: HardkasSignerKind;
     constructor(options: {
-        account: HardkasKaspaPrivateKeyAccount;
+        account?: HardkasKaspaPrivateKeyAccount;
         allowMainnet?: boolean | undefined;
+        wasmConfig?: WasmProviderConfig;
     });
     signTxPlan(input: SignTxPlanInput): Promise<SignTxPlanResult>;
 }
@@ -233,19 +271,6 @@ declare function assertSigningNetworkAllowed(input: {
     allowMainnet?: boolean | undefined;
 }): void;
 
-/**
- * Deterministic fixture signer for Docker testing on simnet.
- * Never to be used with real funds or mainnet.
- */
-declare class HardkasFixtureSigner implements ExternalHardkasSigner {
-    private networkId;
-    private readonly FIXTURE_PK;
-    constructor(networkId?: string);
-    private loadKaspa;
-    getAddress(): Promise<string>;
-    signTransaction(plan: TxPlanArtifact): Promise<SignedTxArtifact>;
-}
-
 interface RealAccountStore extends HardkasArtifactBase {
     readonly schema: "hardkas.realAccountStore.v1";
     readonly networkId: NetworkId;
@@ -405,6 +430,7 @@ declare function listDevAccountsSync(workspaceDir: string): {
     name: string;
     address: string;
 }[];
+declare function createDevSigner(workspaceDir: string, accountNameOrAddress: string): Promise<HardkasTxPlanSigner>;
 
 type NetworkType = "simnet" | "testnet" | "mainnet" | "local-docker-simnet";
 type ChainType = "receive" | "change" | 0 | 1;
@@ -532,4 +558,4 @@ declare class WalletStateStoreJson {
     nextChangeIndex(walletId: string): number;
 }
 
-export { AddressManager, type ChainType, type CreateKaspaWalletOptions, DEV_ACCOUNTS_PASSWORD, type DeriveRequest, type DerivedAddress, type EncryptedKeystoreV2, type EvmExportResult, type GeneratedKaspaDevAccount, type HardkasAccount, type HardkasAccountKind, type HardkasBaseAccount, type HardkasEvmPrivateKeyAccount, type HardkasExternalWalletAccount, HardkasFixtureSigner, type HardkasKaspaPrivateKeyAccount, type HardkasSigner, type HardkasSignerKind, type HardkasSimulatedAccount, type HardkasTxPlanSigner, type HelperDeriveRequest, type KaspaKeyGenerator, KaspaSdkKeyGenerator, type KaspaSdkKeyGeneratorOptions, KaspaSdkRealTxSigner, type KaspaSdkRealTxSignerOptions, type KaspaSigningBackendStatus, KaspaWasmPrivateKeySigner, type KeystoreCipherParams, type KeystoreKdfParams, KeystoreManager, type KeystorePayload, type KeystoreUnlockResult, type NetworkType, type PathRequest, type RealAccountStore, type RealDevAccount, type RealTxSigner, type RealTxSigningInput, type RealTxSigningResult, type ResolveAccountOptions, type SignTxPlanInput, type SignTxPlanResult, SimulatedSigner, SimulatedTxPlanSigner, UnsupportedKaspaKeyGenerator, UnsupportedRealKaspaSigner, UnsupportedRealTxSigner, type WalletArtifact, type WalletClaims, type WalletCreateRequest, type WalletImportRequest, WalletManager, WalletManagerImpl, type WalletMetadata, type WalletState, WalletStateStoreJson, type WalletStateStoreOptions, appendToKeystoreJson, assertSigningNetworkAllowed, createEmptyRealAccountStore, createLocalKaspaWallet, describeAccount, detectCapabilities, ensureDevAccounts, getDefaultRealAccountsPath, getKaspaSigningBackendStatus, getOrCreateDevAccount, getRealDevAccount, getRequiredEnv, importRealDevAccount, listDevAccountsSync, listHardkasAccounts, listRealDevAccounts, loadKaspaWasm, loadOrCreateRealAccountStore, loadRealAccountStore, loadRealAccountStoreSync, prepareEvmAccountExport, removeRealDevAccount, resolveHardkasAccount, resolveHardkasAccountAddress, resolveRealAccountOrAddress, saveRealAccountStore, signTxPlanArtifact, validateAccountName, validateAddressNetwork, validateAddressPrefix, withKeystoreLock };
+export { AddressManager, type ChainType, type CreateKaspaWalletOptions, DEV_ACCOUNTS_PASSWORD, type DeriveRequest, type DerivedAddress, type EncryptedKeystoreV2, type EvmExportResult, type GeneratedKaspaDevAccount, type HardkasAccount, type HardkasAccountKind, type HardkasBaseAccount, type HardkasEvmPrivateKeyAccount, type HardkasExternalWalletAccount, type HardkasKaspaPrivateKeyAccount, type HardkasSigner, type HardkasSignerKind, type HardkasSimulatedAccount, type HardkasTxPlanSigner, type HelperDeriveRequest, type InputAuthorization, type KaspaKeyGenerator, KaspaSdkKeyGenerator, type KaspaSdkKeyGeneratorOptions, KaspaSdkRealTxSigner, type KaspaSdkRealTxSignerOptions, type KaspaSigningBackendStatus, KaspaWasmPrivateKeySigner, type KeystoreCipherParams, type KeystoreKdfParams, KeystoreManager, type KeystorePayload, type KeystoreUnlockResult, LazyAccountAuthorizer, type NetworkType, type PathRequest, PrivateKeyAuthorizer, type RealAccountStore, type RealDevAccount, type RealTxSigner, type RealTxSigningInput, type RealTxSigningResult, type ResolveAccountOptions, type SignTxPlanInput, type SignTxPlanResult, SimulatedSigner, StaticSignatureScriptAuthorizer, type TxInputAuthorizationContext, type TxInputAuthorizer, UnsupportedKaspaKeyGenerator, UnsupportedRealKaspaSigner, UnsupportedRealTxSigner, type WalletArtifact, type WalletClaims, type WalletCreateRequest, type WalletImportRequest, WalletManager, WalletManagerImpl, type WalletMetadata, type WalletState, WalletStateStoreJson, type WalletStateStoreOptions, type WasmInputSigner, type WasmProviderConfig, appendToKeystoreJson, assertSigningNetworkAllowed, createDevSigner, createEmptyRealAccountStore, createLocalKaspaWallet, describeAccount, detectCapabilities, ensureDevAccounts, getDefaultRealAccountsPath, getKaspaSigningBackendStatus, getOrCreateDevAccount, getRealDevAccount, getRequiredEnv, importRealDevAccount, listDevAccountsSync, listHardkasAccounts, listRealDevAccounts, loadKaspaWasm, loadOrCreateRealAccountStore, loadRealAccountStore, loadRealAccountStoreSync, prepareEvmAccountExport, removeRealDevAccount, resolveHardkasAccount, resolveHardkasAccountAddress, resolveRealAccountOrAddress, saveRealAccountStore, signTxPlanArtifact, validateAccountName, validateAddressNetwork, validateAddressPrefix, withKeystoreLock };