@hashgraphonline/standards-sdk 0.1.168 → 0.1.170

package/dist/es/standards-sdk.es174.js

@@ -1,164 +1,175 @@
-import { resolveResponseSchema, registrationQuoteResponseSchema, registerAgentResponseSchema, registrationProgressResponseSchema, uaidValidationResponseSchema, uaidConnectionStatusSchema, dashboardStatsResponseSchema } from "./standards-sdk.es140.js";
-import { serialiseAgentRegistrationRequest, DEFAULT_PROGRESS_INTERVAL_MS, DEFAULT_PROGRESS_TIMEOUT_MS, createAbortError } from "./standards-sdk.es171.js";
-import { RegistryBrokerError } from "./standards-sdk.es141.js";
-async function resolveUaid(client, uaid) {
-  const raw = await client.requestJson(
-    `/resolve/${encodeURIComponent(uaid)}`,
-    {
-      method: "GET"
-    }
-  );
-  return client.parseWithSchema(
-    raw,
-    resolveResponseSchema,
-    "resolve UAID response"
-  );
-}
-async function getRegistrationQuote(client, payload) {
-  const raw = await client.requestJson("/register/quote", {
+import * as path from "path";
+import { Buffer } from "buffer";
+import { randomBytes } from "crypto";
+import { secp256k1 } from "@noble/curves/secp256k1.js";
+import { registerEncryptionKeyResponseSchema } from "./standards-sdk.es145.js";
+import { optionalImport } from "./standards-sdk.es162.js";
+const getFs = async () => {
+  const fsModule = await optionalImport("node:fs");
+  if (fsModule && typeof fsModule.existsSync === "function" && typeof fsModule.readFileSync === "function" && typeof fsModule.writeFileSync === "function" && typeof fsModule.appendFileSync === "function") {
+    return fsModule;
+  }
+  return null;
+};
+async function registerEncryptionKey(client, payload) {
+  const raw = await client.requestJson("/encryption/keys", {
     method: "POST",
-    body: serialiseAgentRegistrationRequest(payload),
-    headers: { "content-type": "application/json" }
+    headers: { "content-type": "application/json" },
+    body: payload
   });
   return client.parseWithSchema(
     raw,
-    registrationQuoteResponseSchema,
-    "registration quote response"
+    registerEncryptionKeyResponseSchema,
+    "register encryption key response"
   );
 }
-async function updateAgent(client, uaid, payload) {
-  const raw = await client.requestJson(
-    `/register/${encodeURIComponent(uaid)}`,
-    {
-      method: "PUT",
-      body: serialiseAgentRegistrationRequest(payload),
-      headers: { "content-type": "application/json" }
+function normalizeAutoRegisterIdentity(config) {
+  const identity = {};
+  if (config.uaid) {
+    identity.uaid = config.uaid;
+  }
+  if (config.ledgerAccountId) {
+    identity.ledgerAccountId = config.ledgerAccountId;
+    if (config.ledgerNetwork) {
+      identity.ledgerNetwork = config.ledgerNetwork;
     }
-  );
-  return client.parseWithSchema(
-    raw,
-    registerAgentResponseSchema,
-    "update agent response"
-  );
+  }
+  if (config.email) {
+    identity.email = config.email;
+  }
+  if (identity.uaid || identity.ledgerAccountId || identity.email) {
+    return identity;
+  }
+  return null;
 }
-async function getRegistrationProgress(client, attemptId) {
-  const normalisedAttemptId = attemptId.trim();
-  if (!normalisedAttemptId) {
-    throw new Error("attemptId is required");
+function derivePublicKeyFromPrivateKey(client, privateKey) {
+  const normalized = client.hexToBuffer(privateKey);
+  const publicKey = secp256k1.getPublicKey(normalized, true);
+  return Buffer.from(publicKey).toString("hex");
+}
+async function resolveAutoRegisterKeyMaterial(client, config) {
+  if (config.publicKey?.trim()) {
+    return { publicKey: config.publicKey.trim() };
+  }
+  let privateKey = config.privateKey?.trim();
+  const envVar = config.envVar ?? "RB_ENCRYPTION_PRIVATE_KEY";
+  if (!privateKey && envVar && process?.env?.[envVar]?.trim()) {
+    privateKey = process.env[envVar]?.trim();
   }
-  try {
-    const raw = await client.requestJson(
-      `/register/progress/${encodeURIComponent(normalisedAttemptId)}`,
-      { method: "GET" }
+  if (!privateKey && config.generateIfMissing) {
+    const pair = await client.generateEncryptionKeyPair({
+      keyType: config.keyType ?? "secp256k1",
+      envVar,
+      envPath: config.envPath,
+      overwrite: config.overwriteEnv
+    });
+    return { publicKey: pair.publicKey, privateKey: pair.privateKey };
+  }
+  if (privateKey) {
+    const publicKey = derivePublicKeyFromPrivateKey(client, privateKey);
+    return { publicKey, privateKey };
+  }
+  return null;
+}
+async function autoRegisterEncryptionKey(client, config) {
+  const identity = normalizeAutoRegisterIdentity(config);
+  if (!identity) {
+    throw new Error(
+      "Auto-registration requires uaid, ledgerAccountId, or email"
     );
-    const parsed = client.parseWithSchema(
-      raw,
-      registrationProgressResponseSchema,
-      "registration progress response"
+  }
+  const material = await resolveAutoRegisterKeyMaterial(client, config);
+  if (!material) {
+    throw new Error(
+      "Unable to resolve encryption public key for auto-registration"
     );
-    return parsed.progress;
-  } catch (error) {
-    if (error instanceof RegistryBrokerError && error.status === 404) {
-      return null;
-    }
-    throw error;
   }
+  await registerEncryptionKey(client, {
+    keyType: config.keyType ?? "secp256k1",
+    publicKey: material.publicKey,
+    ...identity
+  });
+  return material;
 }
-async function waitForRegistrationCompletion(client, attemptId, options = {}) {
-  const normalisedAttemptId = attemptId.trim();
-  if (!normalisedAttemptId) {
-    throw new Error("attemptId is required");
+async function ensureAgentEncryptionKey(client, options) {
+  return autoRegisterEncryptionKey(client, {
+    ...options,
+    uaid: options.uaid
+  });
+}
+function createEncryptionApi(client) {
+  return {
+    registerKey: (payload) => registerEncryptionKey(client, payload),
+    generateEphemeralKeyPair: () => client.createEphemeralKeyPair(),
+    deriveSharedSecret: (options) => client.deriveSharedSecret(options),
+    encryptCipherEnvelope: (options) => client.buildCipherEnvelope(options),
+    decryptCipherEnvelope: (options) => client.openCipherEnvelope(options),
+    ensureAgentKey: (options) => ensureAgentEncryptionKey(client, options)
+  };
+}
+async function bootstrapEncryptionOptions(client, options) {
+  if (!options?.autoRegister || options.autoRegister.enabled === false) {
+    return null;
   }
-  const interval = Math.max(
-    250,
-    options.intervalMs ?? DEFAULT_PROGRESS_INTERVAL_MS
-  );
-  const timeoutMs = options.timeoutMs ?? DEFAULT_PROGRESS_TIMEOUT_MS;
-  const throwOnFailure = options.throwOnFailure ?? true;
-  const signal = options.signal;
-  const startedAt = Date.now();
-  while (true) {
-    if (signal?.aborted) {
-      throw createAbortError();
+  return autoRegisterEncryptionKey(client, options.autoRegister);
+}
+async function generateEncryptionKeyPair(client, options = {}) {
+  client.assertNodeRuntime("generateEncryptionKeyPair");
+  const keyType = options.keyType ?? "secp256k1";
+  if (keyType !== "secp256k1") {
+    throw new Error("Only secp256k1 key generation is supported currently");
+  }
+  const privateKeyBytes = randomBytes(32);
+  const privateKey = Buffer.from(privateKeyBytes).toString("hex");
+  const publicKeyBytes = secp256k1.getPublicKey(privateKeyBytes, true);
+  const publicKey = Buffer.from(publicKeyBytes).toString("hex");
+  const envVar = options.envVar ?? "RB_ENCRYPTION_PRIVATE_KEY";
+  const resolvedPath = options.envPath ? path.resolve(options.envPath) : void 0;
+  if (resolvedPath) {
+    const fsModule = await getFs();
+    if (!fsModule) {
+      throw new Error(
+        "File system module is not available; cannot write encryption key env file"
+      );
     }
-    const progress = await client.getRegistrationProgress(normalisedAttemptId);
-    if (progress) {
-      options.onProgress?.(progress);
-      if (progress.status === "completed") {
-        return progress;
-      }
-      if (progress.status === "partial" || progress.status === "failed") {
-        if (throwOnFailure) {
-          throw new RegistryBrokerError(
-            "Registration did not complete successfully",
-            {
-              status: 409,
-              statusText: progress.status,
-              body: progress
-            }
+    const envLine = `${envVar}=${privateKey}`;
+    if (fsModule.existsSync(resolvedPath)) {
+      const content = fsModule.readFileSync(resolvedPath, "utf-8");
+      const lineRegex = new RegExp(`^${envVar}=.*$`, "m");
+      if (lineRegex.test(content)) {
+        if (!options.overwrite) {
+          throw new Error(
+            `${envVar} already exists in ${resolvedPath}; set overwrite=true to replace it`
           );
         }
-        return progress;
+        const updated = content.replace(lineRegex, envLine);
+        fsModule.writeFileSync(resolvedPath, updated);
+      } else {
+        const needsNewline = !content.endsWith("\n");
+        fsModule.appendFileSync(
+          resolvedPath,
+          `${needsNewline ? "\n" : ""}${envLine}
+`
+        );
       }
+    } else {
+      fsModule.writeFileSync(resolvedPath, `${envLine}
+`);
     }
-    if (Date.now() - startedAt >= timeoutMs) {
-      throw new Error(
-        `Registration progress polling timed out after ${timeoutMs}ms`
-      );
-    }
-    await client.delay(interval, signal);
   }
-}
-async function validateUaid(client, uaid) {
-  const raw = await client.requestJson(
-    `/uaids/validate/${encodeURIComponent(uaid)}`,
-    {
-      method: "GET"
-    }
-  );
-  return client.parseWithSchema(
-    raw,
-    uaidValidationResponseSchema,
-    "UAID validation response"
-  );
-}
-async function getUaidConnectionStatus(client, uaid) {
-  const raw = await client.requestJson(
-    `/uaids/connections/${encodeURIComponent(uaid)}/status`,
-    {
-      method: "GET"
-    }
-  );
-  return client.parseWithSchema(
-    raw,
-    uaidConnectionStatusSchema,
-    "UAID connection status"
-  );
-}
-async function closeUaidConnection(client, uaid) {
-  await client.request(`/uaids/connections/${encodeURIComponent(uaid)}`, {
-    method: "DELETE"
-  });
-}
-async function dashboardStats(client) {
-  const raw = await client.requestJson("/dashboard/stats", {
-    method: "GET"
-  });
-  return client.parseWithSchema(
-    raw,
-    dashboardStatsResponseSchema,
-    "dashboard stats response"
-  );
+  return {
+    privateKey,
+    publicKey,
+    envPath: resolvedPath,
+    envVar
+  };
 }
 export {
-  closeUaidConnection,
-  dashboardStats,
-  getRegistrationProgress,
-  getRegistrationQuote,
-  getUaidConnectionStatus,
-  resolveUaid,
-  updateAgent,
-  validateUaid,
-  waitForRegistrationCompletion
+  autoRegisterEncryptionKey,
+  bootstrapEncryptionOptions,
+  createEncryptionApi,
+  ensureAgentEncryptionKey,
+  generateEncryptionKeyPair,
+  registerEncryptionKey
 };
 //# sourceMappingURL=standards-sdk.es174.js.map

package/dist/es/standards-sdk.es174.js.map

@@ -1 +1 @@
-{"version":3,"file":"standards-sdk.es174.js","sources":["../../src/services/registry-broker/client/agents.ts"],"sourcesContent":["import type {\n  AgentRegistrationRequest,\n  DashboardStatsResponse,\n  JsonValue,\n  RegisterAgentOptions,\n  RegisterAgentQuoteResponse,\n  RegisterAgentResponse,\n  RegistrationProgressRecord,\n  RegistrationProgressWaitOptions,\n  ResolvedAgentResponse,\n  UaidConnectionStatus,\n  UaidValidationResponse,\n} from '../types';\nimport {\n  dashboardStatsResponseSchema,\n  registerAgentResponseSchema,\n  registrationProgressResponseSchema,\n  registrationQuoteResponseSchema,\n  resolveResponseSchema,\n  uaidConnectionStatusSchema,\n  uaidValidationResponseSchema,\n} from '../schemas';\nimport type { RegistryBrokerClient } from './base-client';\nimport { purchaseCreditsWithHbar } from './credits';\nimport {\n  createAbortError,\n  DEFAULT_PROGRESS_INTERVAL_MS,\n  DEFAULT_PROGRESS_TIMEOUT_MS,\n  MINIMUM_REGISTRATION_AUTO_TOP_UP_CREDITS,\n  serialiseAgentRegistrationRequest,\n} from './utils';\nimport { RegistryBrokerError } from './errors';\n\nasync function performRegisterAgent(\n  client: RegistryBrokerClient,\n  payload: AgentRegistrationRequest,\n): Promise<RegisterAgentResponse> {\n  const raw = await client.requestJson<JsonValue>('/register', {\n    method: 'POST',\n    body: serialiseAgentRegistrationRequest(payload),\n    headers: { 'content-type': 'application/json' },\n  });\n  return client.parseWithSchema(\n    raw,\n    registerAgentResponseSchema,\n    'register agent response',\n  );\n}\n\nfunction calculateHbarAmount(\n  creditsToPurchase: number,\n  creditsPerHbar: number,\n): number {\n  if (creditsPerHbar <= 0) {\n    throw new Error('creditsPerHbar must be positive');\n  }\n  if (creditsToPurchase <= 0) {\n    throw new Error('creditsToPurchase must be positive');\n  }\n  const rawHbar = creditsToPurchase / creditsPerHbar;\n  const tinybars = Math.ceil(rawHbar * 1e8);\n  return tinybars / 1e8;\n}\n\nfunction resolveCreditsToPurchase(shortfallCredits: number): number {\n  if (!Number.isFinite(shortfallCredits) || shortfallCredits <= 0) {\n    return 0;\n  }\n  return Math.max(\n    Math.ceil(shortfallCredits),\n    MINIMUM_REGISTRATION_AUTO_TOP_UP_CREDITS,\n  );\n}\n\nasync function ensureCreditsForRegistration(\n  client: RegistryBrokerClient,\n  payload: AgentRegistrationRequest,\n  autoTopUp: RegisterAgentOptions['autoTopUp'],\n): Promise<void> {\n  const details = autoTopUp ?? null;\n  if (!details) {\n    return;\n  }\n\n  if (!details.accountId || !details.accountId.trim()) {\n    throw new Error('autoTopUp.accountId is required');\n  }\n\n  if (!details.privateKey || !details.privateKey.trim()) {\n    throw new Error('autoTopUp.privateKey is required');\n  }\n\n  for (let attempt = 0; attempt < 3; attempt += 1) {\n    const quote = await getRegistrationQuote(client, payload);\n    const shortfall = quote.shortfallCredits ?? 0;\n    if (shortfall <= 0) {\n      return;\n    }\n    const creditsToPurchase = resolveCreditsToPurchase(shortfall);\n    if (creditsToPurchase <= 0) {\n      return;\n    }\n\n    const creditsPerHbar = quote.creditsPerHbar ?? null;\n    if (!creditsPerHbar || creditsPerHbar <= 0) {\n      throw new Error('Unable to determine credits per HBAR for auto top-up');\n    }\n\n    const hbarAmount = calculateHbarAmount(creditsToPurchase, creditsPerHbar);\n\n    await purchaseCreditsWithHbar(client, {\n      accountId: details.accountId.trim(),\n      privateKey: details.privateKey.trim(),\n      hbarAmount,\n      memo: details.memo ?? 'Registry Broker auto top-up',\n      metadata: {\n        shortfallCredits: shortfall,\n        requiredCredits: quote.requiredCredits,\n        purchasedCredits: creditsToPurchase,\n      },\n    });\n  }\n\n  const finalQuote = await getRegistrationQuote(client, payload);\n  if ((finalQuote.shortfallCredits ?? 0) > 0) {\n    throw new Error('Unable to purchase sufficient credits for registration');\n  }\n}\n\nexport async function resolveUaid(\n  client: RegistryBrokerClient,\n  uaid: string,\n): Promise<ResolvedAgentResponse> {\n  const raw = await client.requestJson<JsonValue>(\n    `/resolve/${encodeURIComponent(uaid)}`,\n    {\n      method: 'GET',\n    },\n  );\n  return client.parseWithSchema(\n    raw,\n    resolveResponseSchema,\n    'resolve UAID response',\n  );\n}\n\nexport async function registerAgent(\n  client: RegistryBrokerClient,\n  payload: AgentRegistrationRequest,\n  options?: RegisterAgentOptions,\n): Promise<RegisterAgentResponse> {\n  const autoTopUp = options?.autoTopUp ?? client.registrationAutoTopUp;\n\n  if (!autoTopUp) {\n    return performRegisterAgent(client, payload);\n  }\n\n  await ensureCreditsForRegistration(client, payload, autoTopUp);\n\n  let retried = false;\n  while (true) {\n    try {\n      return await performRegisterAgent(client, payload);\n    } catch (error) {\n      const shortfall = client.extractInsufficientCreditsDetails(error);\n      if (shortfall && !retried) {\n        await ensureCreditsForRegistration(client, payload, autoTopUp);\n        retried = true;\n        continue;\n      }\n      throw error;\n    }\n  }\n}\n\nexport async function getRegistrationQuote(\n  client: RegistryBrokerClient,\n  payload: AgentRegistrationRequest,\n): Promise<RegisterAgentQuoteResponse> {\n  const raw = await client.requestJson<JsonValue>('/register/quote', {\n    method: 'POST',\n    body: serialiseAgentRegistrationRequest(payload),\n    headers: { 'content-type': 'application/json' },\n  });\n\n  return client.parseWithSchema(\n    raw,\n    registrationQuoteResponseSchema,\n    'registration quote response',\n  );\n}\n\nexport async function updateAgent(\n  client: RegistryBrokerClient,\n  uaid: string,\n  payload: AgentRegistrationRequest,\n): Promise<RegisterAgentResponse> {\n  const raw = await client.requestJson<JsonValue>(\n    `/register/${encodeURIComponent(uaid)}`,\n    {\n      method: 'PUT',\n      body: serialiseAgentRegistrationRequest(payload),\n      headers: { 'content-type': 'application/json' },\n    },\n  );\n\n  return client.parseWithSchema(\n    raw,\n    registerAgentResponseSchema,\n    'update agent response',\n  );\n}\n\nexport async function getRegistrationProgress(\n  client: RegistryBrokerClient,\n  attemptId: string,\n): Promise<RegistrationProgressRecord | null> {\n  const normalisedAttemptId = attemptId.trim();\n  if (!normalisedAttemptId) {\n    throw new Error('attemptId is required');\n  }\n\n  try {\n    const raw = await client.requestJson<JsonValue>(\n      `/register/progress/${encodeURIComponent(normalisedAttemptId)}`,\n      { method: 'GET' },\n    );\n\n    const parsed = client.parseWithSchema(\n      raw,\n      registrationProgressResponseSchema,\n      'registration progress response',\n    );\n\n    return parsed.progress;\n  } catch (error) {\n    if (error instanceof RegistryBrokerError && error.status === 404) {\n      return null;\n    }\n    throw error;\n  }\n}\n\nexport async function waitForRegistrationCompletion(\n  client: RegistryBrokerClient,\n  attemptId: string,\n  options: RegistrationProgressWaitOptions = {},\n): Promise<RegistrationProgressRecord> {\n  const normalisedAttemptId = attemptId.trim();\n  if (!normalisedAttemptId) {\n    throw new Error('attemptId is required');\n  }\n\n  const interval = Math.max(\n    250,\n    options.intervalMs ?? DEFAULT_PROGRESS_INTERVAL_MS,\n  );\n  const timeoutMs = options.timeoutMs ?? DEFAULT_PROGRESS_TIMEOUT_MS;\n  const throwOnFailure = options.throwOnFailure ?? true;\n  const signal = options.signal;\n  const startedAt = Date.now();\n\n  while (true) {\n    if (signal?.aborted) {\n      throw createAbortError();\n    }\n\n    const progress = await client.getRegistrationProgress(normalisedAttemptId);\n\n    if (progress) {\n      options.onProgress?.(progress);\n\n      if (progress.status === 'completed') {\n        return progress;\n      }\n\n      if (progress.status === 'partial' || progress.status === 'failed') {\n        if (throwOnFailure) {\n          throw new RegistryBrokerError(\n            'Registration did not complete successfully',\n            {\n              status: 409,\n              statusText: progress.status,\n              body: progress,\n            },\n          );\n        }\n        return progress;\n      }\n    }\n\n    if (Date.now() - startedAt >= timeoutMs) {\n      throw new Error(\n        `Registration progress polling timed out after ${timeoutMs}ms`,\n      );\n    }\n\n    await client.delay(interval, signal);\n  }\n}\n\nexport async function validateUaid(\n  client: RegistryBrokerClient,\n  uaid: string,\n): Promise<UaidValidationResponse> {\n  const raw = await client.requestJson<JsonValue>(\n    `/uaids/validate/${encodeURIComponent(uaid)}`,\n    {\n      method: 'GET',\n    },\n  );\n  return client.parseWithSchema(\n    raw,\n    uaidValidationResponseSchema,\n    'UAID validation response',\n  );\n}\n\nexport async function getUaidConnectionStatus(\n  client: RegistryBrokerClient,\n  uaid: string,\n): Promise<UaidConnectionStatus> {\n  const raw = await client.requestJson<JsonValue>(\n    `/uaids/connections/${encodeURIComponent(uaid)}/status`,\n    {\n      method: 'GET',\n    },\n  );\n  return client.parseWithSchema(\n    raw,\n    uaidConnectionStatusSchema,\n    'UAID connection status',\n  );\n}\n\nexport async function closeUaidConnection(\n  client: RegistryBrokerClient,\n  uaid: string,\n): Promise<void> {\n  await client.request(`/uaids/connections/${encodeURIComponent(uaid)}`, {\n    method: 'DELETE',\n  });\n}\n\nexport async function dashboardStats(\n  client: RegistryBrokerClient,\n): Promise<DashboardStatsResponse> {\n  const raw = await client.requestJson<JsonValue>('/dashboard/stats', {\n    method: 'GET',\n  });\n  return client.parseWithSchema(\n    raw,\n    dashboardStatsResponseSchema,\n    'dashboard stats response',\n  );\n}\n"],"names":[],"mappings":";;;AAiIA,eAAsB,YACpB,QACA,MACgC;AAChC,QAAM,MAAM,MAAM,OAAO;AAAA,IACvB,YAAY,mBAAmB,IAAI,CAAC;AAAA,IACpC;AAAA,MACE,QAAQ;AAAA,IAAA;AAAA,EACV;AAEF,SAAO,OAAO;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEJ;AA+BA,eAAsB,qBACpB,QACA,SACqC;AACrC,QAAM,MAAM,MAAM,OAAO,YAAuB,mBAAmB;AAAA,IACjE,QAAQ;AAAA,IACR,MAAM,kCAAkC,OAAO;AAAA,IAC/C,SAAS,EAAE,gBAAgB,mBAAA;AAAA,EAAmB,CAC/C;AAED,SAAO,OAAO;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEJ;AAEA,eAAsB,YACpB,QACA,MACA,SACgC;AAChC,QAAM,MAAM,MAAM,OAAO;AAAA,IACvB,aAAa,mBAAmB,IAAI,CAAC;AAAA,IACrC;AAAA,MACE,QAAQ;AAAA,MACR,MAAM,kCAAkC,OAAO;AAAA,MAC/C,SAAS,EAAE,gBAAgB,mBAAA;AAAA,IAAmB;AAAA,EAChD;AAGF,SAAO,OAAO;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEJ;AAEA,eAAsB,wBACpB,QACA,WAC4C;AAC5C,QAAM,sBAAsB,UAAU,KAAA;AACtC,MAAI,CAAC,qBAAqB;AACxB,UAAM,IAAI,MAAM,uBAAuB;AAAA,EACzC;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,OAAO;AAAA,MACvB,sBAAsB,mBAAmB,mBAAmB,CAAC;AAAA,MAC7D,EAAE,QAAQ,MAAA;AAAA,IAAM;AAGlB,UAAM,SAAS,OAAO;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAGF,WAAO,OAAO;AAAA,EAChB,SAAS,OAAO;AACd,QAAI,iBAAiB,uBAAuB,MAAM,WAAW,KAAK;AAChE,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,8BACpB,QACA,WACA,UAA2C,CAAA,GACN;AACrC,QAAM,sBAAsB,UAAU,KAAA;AACtC,MAAI,CAAC,qBAAqB;AACxB,UAAM,IAAI,MAAM,uBAAuB;AAAA,EACzC;AAEA,QAAM,WAAW,KAAK;AAAA,IACpB;AAAA,IACA,QAAQ,cAAc;AAAA,EAAA;AAExB,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,SAAS,QAAQ;AACvB,QAAM,YAAY,KAAK,IAAA;AAEvB,SAAO,MAAM;AACX,QAAI,QAAQ,SAAS;AACnB,YAAM,iBAAA;AAAA,IACR;AAEA,UAAM,WAAW,MAAM,OAAO,wBAAwB,mBAAmB;AAEzE,QAAI,UAAU;AACZ,cAAQ,aAAa,QAAQ;AAE7B,UAAI,SAAS,WAAW,aAAa;AACnC,eAAO;AAAA,MACT;AAEA,UAAI,SAAS,WAAW,aAAa,SAAS,WAAW,UAAU;AACjE,YAAI,gBAAgB;AAClB,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,cACE,QAAQ;AAAA,cACR,YAAY,SAAS;AAAA,cACrB,MAAM;AAAA,YAAA;AAAA,UACR;AAAA,QAEJ;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAEA,QAAI,KAAK,QAAQ,aAAa,WAAW;AACvC,YAAM,IAAI;AAAA,QACR,iDAAiD,SAAS;AAAA,MAAA;AAAA,IAE9D;AAEA,UAAM,OAAO,MAAM,UAAU,MAAM;AAAA,EACrC;AACF;AAEA,eAAsB,aACpB,QACA,MACiC;AACjC,QAAM,MAAM,MAAM,OAAO;AAAA,IACvB,mBAAmB,mBAAmB,IAAI,CAAC;AAAA,IAC3C;AAAA,MACE,QAAQ;AAAA,IAAA;AAAA,EACV;AAEF,SAAO,OAAO;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEJ;AAEA,eAAsB,wBACpB,QACA,MAC+B;AAC/B,QAAM,MAAM,MAAM,OAAO;AAAA,IACvB,sBAAsB,mBAAmB,IAAI,CAAC;AAAA,IAC9C;AAAA,MACE,QAAQ;AAAA,IAAA;AAAA,EACV;AAEF,SAAO,OAAO;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEJ;AAEA,eAAsB,oBACpB,QACA,MACe;AACf,QAAM,OAAO,QAAQ,sBAAsB,mBAAmB,IAAI,CAAC,IAAI;AAAA,IACrE,QAAQ;AAAA,EAAA,CACT;AACH;AAEA,eAAsB,eACpB,QACiC;AACjC,QAAM,MAAM,MAAM,OAAO,YAAuB,oBAAoB;AAAA,IAClE,QAAQ;AAAA,EAAA,CACT;AACD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEJ;"}
+{"version":3,"file":"standards-sdk.es174.js","sources":["../../src/services/registry-broker/client/encryption.ts"],"sourcesContent":["import * as path from 'path';\nimport { Buffer } from 'buffer';\nimport { randomBytes } from 'crypto';\nimport { secp256k1 } from '@noble/curves/secp256k1.js';\nimport type {\n  AutoRegisterEncryptionKeyOptions,\n  CipherEnvelope,\n  ClientEncryptionOptions,\n  DecryptCipherEnvelopeOptions,\n  DeriveSharedSecretOptions,\n  EncryptCipherEnvelopeOptions,\n  EphemeralKeyPair,\n  EnsureAgentKeyOptions,\n  RegisterEncryptionKeyPayload,\n  RegisterEncryptionKeyResponse,\n  SharedSecretInput,\n} from '../types';\nimport { registerEncryptionKeyResponseSchema } from '../schemas';\nimport { optionalImport } from '../../../utils/dynamic-import';\nimport type {\n  RegistryBrokerClient,\n  GenerateEncryptionKeyPairOptions,\n} from './base-client';\n\ntype FsModule = {\n  existsSync: (path: string) => boolean;\n  readFileSync: (path: string, encoding: BufferEncoding) => string;\n  writeFileSync: (path: string, data: string) => void;\n  appendFileSync: (path: string, data: string) => void;\n};\n\nconst getFs = async (): Promise<FsModule | null> => {\n  const fsModule = await optionalImport<Partial<FsModule>>('node:fs');\n\n  if (\n    fsModule &&\n    typeof fsModule.existsSync === 'function' &&\n    typeof fsModule.readFileSync === 'function' &&\n    typeof fsModule.writeFileSync === 'function' &&\n    typeof fsModule.appendFileSync === 'function'\n  ) {\n    return fsModule as FsModule;\n  }\n\n  return null;\n};\n\nexport interface RegistryBrokerEncryptionApi {\n  registerKey: (\n    payload: RegisterEncryptionKeyPayload,\n  ) => Promise<RegisterEncryptionKeyResponse>;\n  generateEphemeralKeyPair: () => EphemeralKeyPair;\n  deriveSharedSecret: (options: DeriveSharedSecretOptions) => Buffer;\n  encryptCipherEnvelope: (\n    options: EncryptCipherEnvelopeOptions,\n  ) => CipherEnvelope;\n  decryptCipherEnvelope: (options: DecryptCipherEnvelopeOptions) => string;\n  ensureAgentKey: (\n    options: EnsureAgentKeyOptions,\n  ) => Promise<{ publicKey: string; privateKey?: string }>;\n}\n\nexport async function registerEncryptionKey(\n  client: RegistryBrokerClient,\n  payload: RegisterEncryptionKeyPayload,\n): Promise<RegisterEncryptionKeyResponse> {\n  const raw = await client.requestJson('/encryption/keys', {\n    method: 'POST',\n    headers: { 'content-type': 'application/json' },\n    body: payload,\n  });\n  return client.parseWithSchema(\n    raw,\n    registerEncryptionKeyResponseSchema,\n    'register encryption key response',\n  );\n}\n\nfunction normalizeAutoRegisterIdentity(\n  config: AutoRegisterEncryptionKeyOptions,\n): Pick<\n  RegisterEncryptionKeyPayload,\n  'uaid' | 'ledgerAccountId' | 'ledgerNetwork' | 'email'\n> | null {\n  const identity: Pick<\n    RegisterEncryptionKeyPayload,\n    'uaid' | 'ledgerAccountId' | 'ledgerNetwork' | 'email'\n  > = {};\n  if (config.uaid) {\n    identity.uaid = config.uaid;\n  }\n  if (config.ledgerAccountId) {\n    identity.ledgerAccountId = config.ledgerAccountId;\n    if (config.ledgerNetwork) {\n      identity.ledgerNetwork = config.ledgerNetwork;\n    }\n  }\n  if (config.email) {\n    identity.email = config.email;\n  }\n  if (identity.uaid || identity.ledgerAccountId || identity.email) {\n    return identity;\n  }\n  return null;\n}\n\nfunction derivePublicKeyFromPrivateKey(\n  client: RegistryBrokerClient,\n  privateKey: string,\n): string {\n  const normalized = client.hexToBuffer(privateKey);\n  const publicKey = secp256k1.getPublicKey(normalized, true);\n  return Buffer.from(publicKey).toString('hex');\n}\n\nasync function resolveAutoRegisterKeyMaterial(\n  client: RegistryBrokerClient,\n  config: AutoRegisterEncryptionKeyOptions,\n): Promise<{ publicKey: string; privateKey?: string } | null> {\n  if (config.publicKey?.trim()) {\n    return { publicKey: config.publicKey.trim() };\n  }\n  let privateKey = config.privateKey?.trim();\n  const envVar = config.envVar ?? 'RB_ENCRYPTION_PRIVATE_KEY';\n  if (!privateKey && envVar && process?.env?.[envVar]?.trim()) {\n    privateKey = process.env[envVar]?.trim();\n  }\n  if (!privateKey && config.generateIfMissing) {\n    const pair = await client.generateEncryptionKeyPair({\n      keyType: config.keyType ?? 'secp256k1',\n      envVar,\n      envPath: config.envPath,\n      overwrite: config.overwriteEnv,\n    });\n    return { publicKey: pair.publicKey, privateKey: pair.privateKey };\n  }\n  if (privateKey) {\n    const publicKey = derivePublicKeyFromPrivateKey(client, privateKey);\n    return { publicKey, privateKey };\n  }\n  return null;\n}\n\nexport async function autoRegisterEncryptionKey(\n  client: RegistryBrokerClient,\n  config: AutoRegisterEncryptionKeyOptions,\n): Promise<{ publicKey: string; privateKey?: string }> {\n  const identity = normalizeAutoRegisterIdentity(config);\n  if (!identity) {\n    throw new Error(\n      'Auto-registration requires uaid, ledgerAccountId, or email',\n    );\n  }\n  const material = await resolveAutoRegisterKeyMaterial(client, config);\n  if (!material) {\n    throw new Error(\n      'Unable to resolve encryption public key for auto-registration',\n    );\n  }\n  await registerEncryptionKey(client, {\n    keyType: config.keyType ?? 'secp256k1',\n    publicKey: material.publicKey,\n    ...identity,\n  });\n  return material;\n}\n\nexport async function ensureAgentEncryptionKey(\n  client: RegistryBrokerClient,\n  options: EnsureAgentKeyOptions,\n): Promise<{ publicKey: string; privateKey?: string }> {\n  return autoRegisterEncryptionKey(client, {\n    ...options,\n    uaid: options.uaid,\n    enabled: true,\n  });\n}\n\nexport function createEncryptionApi(\n  client: RegistryBrokerClient,\n): RegistryBrokerEncryptionApi {\n  return {\n    registerKey: (payload: RegisterEncryptionKeyPayload) =>\n      registerEncryptionKey(client, payload),\n    generateEphemeralKeyPair: () => client.createEphemeralKeyPair(),\n    deriveSharedSecret: (options: DeriveSharedSecretOptions) =>\n      client.deriveSharedSecret(options),\n    encryptCipherEnvelope: (options: EncryptCipherEnvelopeOptions) =>\n      client.buildCipherEnvelope(options),\n    decryptCipherEnvelope: (options: DecryptCipherEnvelopeOptions) =>\n      client.openCipherEnvelope(options),\n    ensureAgentKey: (options: EnsureAgentKeyOptions) =>\n      ensureAgentEncryptionKey(client, options),\n  };\n}\n\nexport async function bootstrapEncryptionOptions(\n  client: RegistryBrokerClient,\n  options?: ClientEncryptionOptions,\n): Promise<{ publicKey: string; privateKey?: string } | null> {\n  if (!options?.autoRegister || options.autoRegister.enabled === false) {\n    return null;\n  }\n  return autoRegisterEncryptionKey(client, options.autoRegister);\n}\n\nexport async function generateEncryptionKeyPair(\n  client: RegistryBrokerClient,\n  options: GenerateEncryptionKeyPairOptions = {},\n): Promise<{\n  privateKey: string;\n  publicKey: string;\n  envPath?: string;\n  envVar: string;\n}> {\n  client.assertNodeRuntime('generateEncryptionKeyPair');\n\n  const keyType = options.keyType ?? 'secp256k1';\n  if (keyType !== 'secp256k1') {\n    throw new Error('Only secp256k1 key generation is supported currently');\n  }\n\n  const privateKeyBytes = randomBytes(32);\n  const privateKey = Buffer.from(privateKeyBytes).toString('hex');\n  const publicKeyBytes = secp256k1.getPublicKey(privateKeyBytes, true);\n  const publicKey = Buffer.from(publicKeyBytes).toString('hex');\n\n  const envVar = options.envVar ?? 'RB_ENCRYPTION_PRIVATE_KEY';\n  const resolvedPath = options.envPath\n    ? path.resolve(options.envPath)\n    : undefined;\n\n  if (resolvedPath) {\n    const fsModule = await getFs();\n\n    if (!fsModule) {\n      throw new Error(\n        'File system module is not available; cannot write encryption key env file',\n      );\n    }\n\n    const envLine = `${envVar}=${privateKey}`;\n    if (fsModule.existsSync(resolvedPath)) {\n      const content = fsModule.readFileSync(resolvedPath, 'utf-8');\n      const lineRegex = new RegExp(`^${envVar}=.*$`, 'm');\n      if (lineRegex.test(content)) {\n        if (!options.overwrite) {\n          throw new Error(\n            `${envVar} already exists in ${resolvedPath}; set overwrite=true to replace it`,\n          );\n        }\n        const updated = content.replace(lineRegex, envLine);\n        fsModule.writeFileSync(resolvedPath, updated);\n      } else {\n        const needsNewline = !content.endsWith('\\n');\n        fsModule.appendFileSync(\n          resolvedPath,\n          `${needsNewline ? '\\n' : ''}${envLine}\\n`,\n        );\n      }\n    } else {\n      fsModule.writeFileSync(resolvedPath, `${envLine}\\n`);\n    }\n  }\n\n  return {\n    privateKey,\n    publicKey,\n    envPath: resolvedPath,\n    envVar,\n  };\n}\n"],"names":[],"mappings":";;;;;;AA+BA,MAAM,QAAQ,YAAsC;AAClD,QAAM,WAAW,MAAM,eAAkC,SAAS;AAElE,MACE,YACA,OAAO,SAAS,eAAe,cAC/B,OAAO,SAAS,iBAAiB,cACjC,OAAO,SAAS,kBAAkB,cAClC,OAAO,SAAS,mBAAmB,YACnC;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAiBA,eAAsB,sBACpB,QACA,SACwC;AACxC,QAAM,MAAM,MAAM,OAAO,YAAY,oBAAoB;AAAA,IACvD,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAA;AAAA,IAC3B,MAAM;AAAA,EAAA,CACP;AACD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEJ;AAEA,SAAS,8BACP,QAIO;AACP,QAAM,WAGF,CAAA;AACJ,MAAI,OAAO,MAAM;AACf,aAAS,OAAO,OAAO;AAAA,EACzB;AACA,MAAI,OAAO,iBAAiB;AAC1B,aAAS,kBAAkB,OAAO;AAClC,QAAI,OAAO,eAAe;AACxB,eAAS,gBAAgB,OAAO;AAAA,IAClC;AAAA,EACF;AACA,MAAI,OAAO,OAAO;AAChB,aAAS,QAAQ,OAAO;AAAA,EAC1B;AACA,MAAI,SAAS,QAAQ,SAAS,mBAAmB,SAAS,OAAO;AAC/D,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,8BACP,QACA,YACQ;AACR,QAAM,aAAa,OAAO,YAAY,UAAU;AAChD,QAAM,YAAY,UAAU,aAAa,YAAY,IAAI;AACzD,SAAO,OAAO,KAAK,SAAS,EAAE,SAAS,KAAK;AAC9C;AAEA,eAAe,+BACb,QACA,QAC4D;AAC5D,MAAI,OAAO,WAAW,QAAQ;AAC5B,WAAO,EAAE,WAAW,OAAO,UAAU,OAAK;AAAA,EAC5C;AACA,MAAI,aAAa,OAAO,YAAY,KAAA;AACpC,QAAM,SAAS,OAAO,UAAU;AAChC,MAAI,CAAC,cAAc,UAAU,SAAS,MAAM,MAAM,GAAG,QAAQ;AAC3D,iBAAa,QAAQ,IAAI,MAAM,GAAG,KAAA;AAAA,EACpC;AACA,MAAI,CAAC,cAAc,OAAO,mBAAmB;AAC3C,UAAM,OAAO,MAAM,OAAO,0BAA0B;AAAA,MAClD,SAAS,OAAO,WAAW;AAAA,MAC3B;AAAA,MACA,SAAS,OAAO;AAAA,MAChB,WAAW,OAAO;AAAA,IAAA,CACnB;AACD,WAAO,EAAE,WAAW,KAAK,WAAW,YAAY,KAAK,WAAA;AAAA,EACvD;AACA,MAAI,YAAY;AACd,UAAM,YAAY,8BAA8B,QAAQ,UAAU;AAClE,WAAO,EAAE,WAAW,WAAA;AAAA,EACtB;AACA,SAAO;AACT;AAEA,eAAsB,0BACpB,QACA,QACqD;AACrD,QAAM,WAAW,8BAA8B,MAAM;AACrD,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAAA,EAEJ;AACA,QAAM,WAAW,MAAM,+BAA+B,QAAQ,MAAM;AACpE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAAA,EAEJ;AACA,QAAM,sBAAsB,QAAQ;AAAA,IAClC,SAAS,OAAO,WAAW;AAAA,IAC3B,WAAW,SAAS;AAAA,IACpB,GAAG;AAAA,EAAA,CACJ;AACD,SAAO;AACT;AAEA,eAAsB,yBACpB,QACA,SACqD;AACrD,SAAO,0BAA0B,QAAQ;AAAA,IACvC,GAAG;AAAA,IACH,MAAM,QAAQ;AAAA,EAEhB,CAAC;AACH;AAEO,SAAS,oBACd,QAC6B;AAC7B,SAAO;AAAA,IACL,aAAa,CAAC,YACZ,sBAAsB,QAAQ,OAAO;AAAA,IACvC,0BAA0B,MAAM,OAAO,uBAAA;AAAA,IACvC,oBAAoB,CAAC,YACnB,OAAO,mBAAmB,OAAO;AAAA,IACnC,uBAAuB,CAAC,YACtB,OAAO,oBAAoB,OAAO;AAAA,IACpC,uBAAuB,CAAC,YACtB,OAAO,mBAAmB,OAAO;AAAA,IACnC,gBAAgB,CAAC,YACf,yBAAyB,QAAQ,OAAO;AAAA,EAAA;AAE9C;AAEA,eAAsB,2BACpB,QACA,SAC4D;AAC5D,MAAI,CAAC,SAAS,gBAAgB,QAAQ,aAAa,YAAY,OAAO;AACpE,WAAO;AAAA,EACT;AACA,SAAO,0BAA0B,QAAQ,QAAQ,YAAY;AAC/D;AAEA,eAAsB,0BACpB,QACA,UAA4C,IAM3C;AACD,SAAO,kBAAkB,2BAA2B;AAEpD,QAAM,UAAU,QAAQ,WAAW;AACnC,MAAI,YAAY,aAAa;AAC3B,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AAEA,QAAM,kBAAkB,YAAY,EAAE;AACtC,QAAM,aAAa,OAAO,KAAK,eAAe,EAAE,SAAS,KAAK;AAC9D,QAAM,iBAAiB,UAAU,aAAa,iBAAiB,IAAI;AACnE,QAAM,YAAY,OAAO,KAAK,cAAc,EAAE,SAAS,KAAK;AAE5D,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,eAAe,QAAQ,UACzB,KAAK,QAAQ,QAAQ,OAAO,IAC5B;AAEJ,MAAI,cAAc;AAChB,UAAM,WAAW,MAAM,MAAA;AAEvB,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR;AAAA,MAAA;AAAA,IAEJ;AAEA,UAAM,UAAU,GAAG,MAAM,IAAI,UAAU;AACvC,QAAI,SAAS,WAAW,YAAY,GAAG;AACrC,YAAM,UAAU,SAAS,aAAa,cAAc,OAAO;AAC3D,YAAM,YAAY,IAAI,OAAO,IAAI,MAAM,QAAQ,GAAG;AAClD,UAAI,UAAU,KAAK,OAAO,GAAG;AAC3B,YAAI,CAAC,QAAQ,WAAW;AACtB,gBAAM,IAAI;AAAA,YACR,GAAG,MAAM,sBAAsB,YAAY;AAAA,UAAA;AAAA,QAE/C;AACA,cAAM,UAAU,QAAQ,QAAQ,WAAW,OAAO;AAClD,iBAAS,cAAc,cAAc,OAAO;AAAA,MAC9C,OAAO;AACL,cAAM,eAAe,CAAC,QAAQ,SAAS,IAAI;AAC3C,iBAAS;AAAA,UACP;AAAA,UACA,GAAG,eAAe,OAAO,EAAE,GAAG,OAAO;AAAA;AAAA,QAAA;AAAA,MAEzC;AAAA,IACF,OAAO;AACL,eAAS,cAAc,cAAc,GAAG,OAAO;AAAA,CAAI;AAAA,IACrD;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT;AAAA,EAAA;AAEJ;"}