@idos-network/enclave 1.1.0

package/dist/local.mjs

@@ -0,0 +1,253 @@
+import { n as BaseProvider, t as STORAGE_KEYS } from "./keys-RuC1M-_K.mjs";
+import { t as Client } from "./client-BSkUuHYm.mjs";
+import { base64Codec, base64Encode, hexDecode, hexEncode, utf8Decode, utf8Encode } from "@idos-network/utils/codecs";
+import { generatePassword } from "@idos-network/utils/cryptography";
+import { decrypt, encrypt, keyDerivation } from "@idos-network/utils/encryption";
+import { LocalStorageStore } from "@idos-network/utils/store";
+import { syncScrypt } from "scrypt-js";
+import nacl from "tweetnacl";
+//#region src/local.ts
+var LocalEnclave = class extends BaseProvider {
+	allowedEncryptionStores;
+	store;
+	storeBase64;
+	storeObfuscated;
+	storeObfuscatedBase64;
+	mpcClientInstance;
+	storedEncryptionProfile;
+	constructor(options) {
+		super(options);
+		this.allowedEncryptionStores = options.allowedEncryptionStores ?? ["user"];
+		this.store = options.store ?? new LocalStorageStore();
+		this.storeObfuscated = this.store.pipeCodec(this.userIdObfuscationCodec());
+		this.storeBase64 = this.store.pipeCodec(base64Codec);
+		this.storeObfuscatedBase64 = this.store.pipeCodec(this.userIdObfuscationCodec()).pipeCodec(base64Codec);
+		if (options.mpcConfiguration) this.mpcClientInstance = new Client(options.mpcConfiguration.nodeUrl, options.mpcConfiguration.contractAddress, options.mpcConfiguration.numMalicious, options.mpcConfiguration.numNodes, options.mpcConfiguration.numToReconstruct, options.walletType ?? "EVM", options.walletAddress ?? "", options.walletPublicKey);
+	}
+	/** @override parent method to reset the enclave */
+	async reset() {
+		await super.reset();
+		this.storedEncryptionProfile = void 0;
+		this.store.reset();
+	}
+	/** @override parent method to reconfigure the enclave */
+	async reconfigure(options = {}) {
+		await super.reconfigure(options);
+		if (this.mpcClientInstance && options.walletType && options.walletAddress) this.mpcClientInstance.reconfigure(options.walletType, options.walletAddress ?? "", options.walletPublicKey);
+	}
+	/**
+	* Return a codec that encrypts/decrypts data using a key derived from the provider's user ID.
+	*
+	* This ensures that data is minimally obfuscated to avoid low-sophistication attacks.
+	*/
+	userIdObfuscationCodec() {
+		const self = this;
+		const toKey = (userId, salt) => syncScrypt(utf8Encode(userId), salt, 16384, 8, 1, nacl.secretbox.keyLength);
+		return {
+			encode(data) {
+				if (!self.options.userId) throw new Error("User ID required for encryption");
+				const dataBytes = utf8Encode(data);
+				const nonce = nacl.randomBytes(nacl.secretbox.nonceLength);
+				const salt = nacl.randomBytes(16);
+				const key = toKey(self.options.userId, salt);
+				const payload = nacl.secretbox(dataBytes, nonce, key);
+				const combined = new Uint8Array(salt.length + nonce.length + payload.length);
+				combined.set(salt, 0);
+				combined.set(nonce, salt.length);
+				combined.set(payload, salt.length + nonce.length);
+				return `0x${hexEncode(combined)}`;
+			},
+			decode(payload) {
+				if (!self.options.userId) throw new Error("User ID required for decryption");
+				if (payload.slice(0, 2) !== "0x") throw new Error(`missing 0x prefix: ${payload}`);
+				const combined = hexDecode(payload.slice(2));
+				const salt = combined.slice(0, 16);
+				const nonce = combined.slice(16, 16 + nacl.secretbox.nonceLength);
+				const ciphertext = combined.slice(16 + nacl.secretbox.nonceLength);
+				const key = toKey(self.options.userId, salt);
+				const result = nacl.secretbox.open(ciphertext, nonce, key);
+				if (!result) throw new Error("Failed to decrypt data");
+				return utf8Decode(result);
+			}
+		};
+	}
+	/** @see parent method extended with loading the profile from the store */
+	async load() {
+		await super.load();
+		const userId = await this.store.get(STORAGE_KEYS.USER_ID);
+		if (userId) this.options.userId = userId;
+		let password = await this.storeObfuscated.get(STORAGE_KEYS.OBFUSCATED_PASSWORD);
+		if (!password) {
+			password = await this.store.get(STORAGE_KEYS.DEPRECATED___PASSWORD);
+			if (!password) return;
+			await this.storeObfuscated.set(STORAGE_KEYS.OBFUSCATED_PASSWORD, password);
+		}
+		await this.store.delete(STORAGE_KEYS.DEPRECATED___PASSWORD);
+		let encryptionSecretKey = await this.storeObfuscatedBase64.get(STORAGE_KEYS.OBFUSCATED_BASE64_ENCRYPTION_SECRET_KEY);
+		if (!encryptionSecretKey) {
+			encryptionSecretKey = await this.storeBase64.get(STORAGE_KEYS.DEPRECATED___ENCRYPTION_SECRET_KEY);
+			if (!encryptionSecretKey) return;
+			await this.storeObfuscatedBase64.set(STORAGE_KEYS.OBFUSCATED_BASE64_ENCRYPTION_SECRET_KEY, encryptionSecretKey);
+		}
+		await this.store.delete(STORAGE_KEYS.DEPRECATED___ENCRYPTION_SECRET_KEY);
+		await this.store.delete(STORAGE_KEYS.DEPRECATED___ENCRYPTION_PRIVATE_KEY);
+		if (!password || !userId || !encryptionSecretKey) return;
+		let encryptionPasswordStore = await this.store.get(STORAGE_KEYS.ENCRYPTION_PASSWORD_STORE);
+		if (!encryptionPasswordStore || encryptionPasswordStore === "password") {
+			encryptionPasswordStore = "user";
+			await this.store.set(STORAGE_KEYS.ENCRYPTION_PASSWORD_STORE, encryptionPasswordStore);
+		}
+		this.storedEncryptionProfile = {
+			userId,
+			password,
+			keyPair: nacl.box.keyPair.fromSecretKey(encryptionSecretKey),
+			encryptionPasswordStore
+		};
+	}
+	/**
+	* Encrypts a message to a receiver.
+	* This method also checks if the user is authorized to use the keys.
+	*
+	* @param message - The message to encrypt.
+	* @param receiverPublicKey - The public key of the receiver.
+	*
+	* @returns The encrypted message.
+	*/
+	async encrypt(message, receiverPublicKey) {
+		const { keyPair } = await this.getPrivateEncryptionProfile();
+		return encrypt(message, keyPair.publicKey, receiverPublicKey);
+	}
+	/**
+	* Decrypts a message from a sender.
+	* This method also checks if the user is authorized to use the keys.
+	*
+	* @param message - The message to decrypt.
+	* @param senderPublicKey - The public key of the sender.
+	*
+	* @returns The decrypted message.
+	*/
+	async decrypt(message, senderPublicKey) {
+		const { keyPair } = await this.getPrivateEncryptionProfile();
+		return decrypt(message, keyPair, senderPublicKey);
+	}
+	/**
+	* @see BaseProvider#getPrivateEncryptionProfile
+	*/
+	async getPrivateEncryptionProfile(skipGuard = false) {
+		if (this.storedEncryptionProfile) {
+			let canBeUsed = this.storedEncryptionProfile.userId === this.userId;
+			if (canBeUsed && !skipGuard) canBeUsed = await this.guardKeys();
+			if (canBeUsed) return this.storedEncryptionProfile;
+			await this.reset();
+		}
+		let password;
+		let encryptionPasswordStore;
+		const context = await this.getPasswordContext();
+		if (context.encryptionPasswordStore === "user") {
+			await this.store.setRememberDuration(context.duration);
+			password = context.password;
+			encryptionPasswordStore = context.encryptionPasswordStore;
+		}
+		if (context.encryptionPasswordStore === "mpc") {
+			await this.store.setRememberDuration(void 0);
+			password = await this.ensureMPCPassword();
+			encryptionPasswordStore = "mpc";
+		}
+		if (!password || !encryptionPasswordStore) throw new Error("Password or encryption password store is not found");
+		return this.createEncryptionProfileFromPassword(password, this.userId, encryptionPasswordStore);
+	}
+	/** @see BaseProvider#ensureUserEncryptionProfile */
+	async ensureUserEncryptionProfile() {
+		const { keyPair, encryptionPasswordStore, userId } = await this.getPrivateEncryptionProfile();
+		return {
+			userId,
+			userEncryptionPublicKey: base64Encode(keyPair.publicKey),
+			encryptionPasswordStore
+		};
+	}
+	/**
+	* This method needs to check `options` and should derive the password context from it.
+	*
+	* @returns The password context.
+	*/
+	async getPasswordContext() {
+		throw new Error("Method 'getPasswordContext' has to be implemented in the subclass.");
+	}
+	/**
+	* Creates and store encryption profile from a password.
+	*
+	* @param password - The password to use.
+	* @param userId - The user id to use.
+	* @param encryptionPasswordStore - The encryption password store to use.
+	*
+	* @returns The encryption profile.
+	*/
+	async createEncryptionProfileFromPassword(password, userId, encryptionPasswordStore) {
+		const secretKey = await keyDerivation(password, userId);
+		const keyPair = nacl.box.keyPair.fromSecretKey(secretKey);
+		await this.store.set(STORAGE_KEYS.USER_ID, userId);
+		await this.storeObfuscated.set(STORAGE_KEYS.OBFUSCATED_PASSWORD, password);
+		await this.store.delete(STORAGE_KEYS.DEPRECATED___PASSWORD);
+		await this.store.set(STORAGE_KEYS.ENCRYPTION_PASSWORD_STORE, encryptionPasswordStore);
+		await this.storeObfuscatedBase64.set(STORAGE_KEYS.OBFUSCATED_BASE64_ENCRYPTION_SECRET_KEY, keyPair.secretKey);
+		await this.store.delete(STORAGE_KEYS.DEPRECATED___ENCRYPTION_SECRET_KEY);
+		await this.storeBase64.set(STORAGE_KEYS.ENCRYPTION_PUBLIC_KEY, keyPair.publicKey);
+		this.storedEncryptionProfile = {
+			userId,
+			password,
+			keyPair,
+			encryptionPasswordStore
+		};
+		return this.storedEncryptionProfile;
+	}
+	async ensureMPCPassword() {
+		if (this.options?.mode !== "new") {
+			const { status: downloadStatus, secret: downloadedPassword } = await this.downloadSecret();
+			if (downloadStatus === "ok" && downloadedPassword) return utf8Decode(downloadedPassword);
+			throw Error("A secret might be stored at MPC ZK nodes, but can't be obtained");
+		}
+		const password = generatePassword();
+		const { status: uploadStatus } = await this.uploadSecret(password);
+		if (uploadStatus !== "success") throw Error(`A secret upload failed with status: ${uploadStatus}`);
+		return password;
+	}
+	get mpcClient() {
+		if (!this.mpcClientInstance) throw new Error("MPC client is not initialized");
+		return this.mpcClientInstance;
+	}
+	async downloadSecret() {
+		if (!this.options.walletAddress) throw new Error("walletAddress is not found");
+		const ephemeralKeyPair = nacl.box.keyPair();
+		const downloadRequest = this.mpcClient.downloadRequest(ephemeralKeyPair.publicKey);
+		const messageToSign = this.mpcClient.downloadMessageToSign(downloadRequest);
+		const signedMessage = await this.signTypedData(messageToSign.domain, messageToSign.types, messageToSign.value);
+		return this.mpcClient.downloadSecret(this.userId, downloadRequest, signedMessage, ephemeralKeyPair.secretKey);
+	}
+	async uploadSecret(secret) {
+		if (!this.options.walletAddress) {
+			console.error("signerAddress is not found");
+			return { status: "no-signer-address" };
+		}
+		const blindedShares = this.mpcClient.getBlindedShares(Buffer.from(secret, "utf8"));
+		const uploadRequest = this.mpcClient.uploadRequest(blindedShares);
+		const messageToSign = this.mpcClient.uploadMessageToSign(uploadRequest);
+		const signedMessage = await this.signTypedData(messageToSign.domain, messageToSign.types, messageToSign.value);
+		return this.mpcClient.uploadSecret(this.userId, uploadRequest, signedMessage, blindedShares);
+	}
+	async addAddressMessageToSign(address, publicKey, addressToAddType) {
+		return this.mpcClient.addAddressMessageToSign(address, publicKey, addressToAddType);
+	}
+	async removeAddressMessageToSign(address, publicKey, addressToRemoveType) {
+		return this.mpcClient.removeAddressMessageToSign(address, publicKey, addressToRemoveType);
+	}
+	async addAddressToMpcSecret(userId, message, signature) {
+		return this.mpcClient.addAddress(userId, message, signature);
+	}
+	async removeAddressFromMpcSecret(userId, message, signature) {
+		return this.mpcClient.removeAddress(userId, message, signature);
+	}
+};
+//#endregion
+export { LocalEnclave };
+
+//# sourceMappingURL=local.mjs.map

package/dist/local.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.mjs","names":["MPCClient"],"sources":["../src/local.ts"],"sourcesContent":["import type { EncryptionPasswordStore } from \"@idos-network/kwil-infra/actions\";\n\nimport {\n  base64Codec,\n  base64Encode,\n  hexDecode,\n  hexEncode,\n  utf8Decode,\n  utf8Encode,\n} from \"@idos-network/utils/codecs\";\nimport { generatePassword } from \"@idos-network/utils/cryptography\";\nimport { decrypt, encrypt, keyDerivation } from \"@idos-network/utils/encryption\";\nimport { LocalStorageStore, type PipeCodecArgs, type Store } from \"@idos-network/utils/store\";\nimport { syncScrypt } from \"scrypt-js\";\nimport nacl from \"tweetnacl\";\n\nimport type {\n  AddAddressMessageToSign,\n  AddAddressSignatureMessage,\n  DownloadMessageToSign,\n  RemoveAddressMessageToSign,\n  RemoveAddressSignatureMessage,\n  UploadMessageToSign,\n} from \"./mpc/types\";\nimport type {\n  EnclaveOptions,\n  MPCPasswordContext,\n  PasswordContext,\n  PrivateEncryptionProfile,\n  PublicEncryptionProfile,\n} from \"./types\";\n\nimport { BaseProvider } from \"./base\";\nimport { STORAGE_KEYS } from \"./keys\";\nimport { Client as MPCClient } from \"./mpc/client\";\n\nexport interface LocalEnclaveOptions extends EnclaveOptions {\n  store?: Store;\n  allowedEncryptionStores?: EncryptionPasswordStore[];\n  mpcConfiguration?: {\n    nodeUrl: string;\n    contractAddress: string;\n    numMalicious: number;\n    numNodes: number;\n    numToReconstruct: number;\n  };\n}\n\nexport class LocalEnclave<\n  K extends LocalEnclaveOptions = LocalEnclaveOptions,\n> extends BaseProvider<K> {\n  protected allowedEncryptionStores: EncryptionPasswordStore[];\n\n  // Store for data\n  protected store: Store;\n  protected storeBase64: Store;\n  protected storeObfuscated: Store;\n  protected storeObfuscatedBase64: Store;\n\n  // In case of MPC usage\n  protected mpcClientInstance?: MPCClient;\n\n  // Stored key pair and user id for that key pair\n  // those are most likely loaded from the store\n  // during the load() method.\n  protected storedEncryptionProfile?: PrivateEncryptionProfile;\n\n  constructor(options: K) {\n    super(options);\n\n    // By default, we only allow password auth method\n    this.allowedEncryptionStores = options.allowedEncryptionStores ?? [\"user\"];\n    this.store = options.store ?? new LocalStorageStore();\n    this.storeObfuscated = this.store.pipeCodec(this.userIdObfuscationCodec());\n    this.storeBase64 = this.store.pipeCodec(base64Codec);\n    this.storeObfuscatedBase64 = this.store\n      .pipeCodec(this.userIdObfuscationCodec())\n      .pipeCodec(base64Codec);\n\n    if (options.mpcConfiguration) {\n      this.mpcClientInstance = new MPCClient(\n        options.mpcConfiguration.nodeUrl,\n        options.mpcConfiguration.contractAddress,\n        options.mpcConfiguration.numMalicious,\n        options.mpcConfiguration.numNodes,\n        options.mpcConfiguration.numToReconstruct,\n        // TODO: This is weird, we should not be forcing this\n        options.walletType ?? \"EVM\",\n        options.walletAddress ?? \"\",\n        options.walletPublicKey,\n      );\n    }\n  }\n\n  /** @override parent method to reset the enclave */\n  async reset(): Promise<void> {\n    await super.reset();\n    this.storedEncryptionProfile = undefined;\n    this.store.reset();\n  }\n\n  /** @override parent method to reconfigure the enclave */\n  async reconfigure(options: Partial<K> = {}): Promise<void> {\n    await super.reconfigure(options);\n    // Reconfigure MPC client if any signer information changed\n    if (this.mpcClientInstance && options.walletType && options.walletAddress) {\n      this.mpcClientInstance.reconfigure(\n        options.walletType,\n        options.walletAddress ?? \"\",\n        options.walletPublicKey,\n      );\n    }\n  }\n\n  /**\n   * Return a codec that encrypts/decrypts data using a key derived from the provider's user ID.\n   *\n   * This ensures that data is minimally obfuscated to avoid low-sophistication attacks.\n   */\n  private userIdObfuscationCodec(): PipeCodecArgs<string> {\n    // oxlint-disable-next-line typescript/no-this-alias -- Needed for `this` in nested encode/decode functions\n    const self = this;\n\n    const toKey = (userId: string, salt: Uint8Array) =>\n      syncScrypt(utf8Encode(userId), salt, 16384, 8, 1, nacl.secretbox.keyLength);\n\n    return {\n      encode(data: string): string {\n        if (!self.options.userId) {\n          throw new Error(\"User ID required for encryption\");\n        }\n\n        const dataBytes = utf8Encode(data); // Convert string to Uint8Array\n        const nonce = nacl.randomBytes(nacl.secretbox.nonceLength);\n        const salt = nacl.randomBytes(16);\n        const key = toKey(self.options.userId, salt);\n        const payload = nacl.secretbox(dataBytes, nonce, key);\n\n        // Store salt + nonce + ciphertext\n        const combined = new Uint8Array(salt.length + nonce.length + payload.length);\n        combined.set(salt, 0);\n        combined.set(nonce, salt.length);\n        combined.set(payload, salt.length + nonce.length);\n\n        return `0x${hexEncode(combined)}`;\n      },\n\n      decode(payload: string): string {\n        if (!self.options.userId) {\n          throw new Error(\"User ID required for decryption\");\n        }\n\n        if (payload.slice(0, 2) !== \"0x\") {\n          throw new Error(`missing 0x prefix: ${payload}`);\n        }\n\n        const combined = hexDecode(payload.slice(2));\n        const salt = combined.slice(0, 16);\n        const nonce = combined.slice(16, 16 + nacl.secretbox.nonceLength);\n        const ciphertext = combined.slice(16 + nacl.secretbox.nonceLength);\n\n        const key = toKey(self.options.userId, salt);\n        const result = nacl.secretbox.open(ciphertext, nonce, key);\n\n        if (!result) throw new Error(\"Failed to decrypt data\");\n\n        return utf8Decode(result); // Convert Uint8Array back to string\n      },\n    };\n  }\n  /** @see parent method extended with loading the profile from the store */\n  async load(): Promise<void> {\n    await super.load();\n\n    const userId = await this.store.get<string>(STORAGE_KEYS.USER_ID);\n    if (userId) this.options.userId = userId;\n\n    let password = await this.storeObfuscated.get<string>(STORAGE_KEYS.OBFUSCATED_PASSWORD);\n    if (!password) {\n      password = await this.store.get<string>(STORAGE_KEYS.DEPRECATED___PASSWORD);\n      if (!password) return;\n\n      await this.storeObfuscated.set(STORAGE_KEYS.OBFUSCATED_PASSWORD, password);\n    }\n    await this.store.delete(STORAGE_KEYS.DEPRECATED___PASSWORD);\n\n    let encryptionSecretKey = await this.storeObfuscatedBase64.get<Uint8Array>(\n      STORAGE_KEYS.OBFUSCATED_BASE64_ENCRYPTION_SECRET_KEY,\n    );\n    if (!encryptionSecretKey) {\n      encryptionSecretKey = await this.storeBase64.get<Uint8Array>(\n        STORAGE_KEYS.DEPRECATED___ENCRYPTION_SECRET_KEY,\n      );\n      if (!encryptionSecretKey) return;\n\n      await this.storeObfuscatedBase64.set(\n        STORAGE_KEYS.OBFUSCATED_BASE64_ENCRYPTION_SECRET_KEY,\n        encryptionSecretKey,\n      );\n    }\n    await this.store.delete(STORAGE_KEYS.DEPRECATED___ENCRYPTION_SECRET_KEY);\n    // Even older version.\n    await this.store.delete(STORAGE_KEYS.DEPRECATED___ENCRYPTION_PRIVATE_KEY);\n\n    if (!password || !userId || !encryptionSecretKey) {\n      return;\n    }\n\n    let encryptionPasswordStore = await this.store.get<EncryptionPasswordStore>(\n      STORAGE_KEYS.ENCRYPTION_PASSWORD_STORE,\n    );\n\n    // Migration from \"password\" to \"user\"\n    // TODO: Remove this after a while\n    if (!encryptionPasswordStore || (encryptionPasswordStore as string) === \"password\") {\n      encryptionPasswordStore = \"user\";\n      await this.store.set<EncryptionPasswordStore>(\n        STORAGE_KEYS.ENCRYPTION_PASSWORD_STORE,\n        encryptionPasswordStore,\n      );\n    }\n\n    this.storedEncryptionProfile = {\n      userId,\n      password,\n      keyPair: nacl.box.keyPair.fromSecretKey(encryptionSecretKey),\n      encryptionPasswordStore,\n    };\n  }\n\n  /**\n   * Encrypts a message to a receiver.\n   * This method also checks if the user is authorized to use the keys.\n   *\n   * @param message - The message to encrypt.\n   * @param receiverPublicKey - The public key of the receiver.\n   *\n   * @returns The encrypted message.\n   */\n  async encrypt(\n    message: Uint8Array,\n    receiverPublicKey: Uint8Array,\n  ): Promise<{ content: Uint8Array; encryptorPublicKey: Uint8Array }> {\n    const { keyPair } = await this.getPrivateEncryptionProfile();\n    return encrypt(message, keyPair.publicKey, receiverPublicKey);\n  }\n\n  /**\n   * Decrypts a message from a sender.\n   * This method also checks if the user is authorized to use the keys.\n   *\n   * @param message - The message to decrypt.\n   * @param senderPublicKey - The public key of the sender.\n   *\n   * @returns The decrypted message.\n   */\n  async decrypt(\n    message: Uint8Array,\n    senderPublicKey: Uint8Array,\n  ): Promise<Uint8Array<ArrayBufferLike>> {\n    const { keyPair } = await this.getPrivateEncryptionProfile();\n    return decrypt(message, keyPair, senderPublicKey);\n  }\n\n  /**\n   * @see BaseProvider#getPrivateEncryptionProfile\n   */\n  async getPrivateEncryptionProfile(skipGuard = false): Promise<PrivateEncryptionProfile> {\n    // In case there is a no key pair, which matches we don't need a new one.\n    if (this.storedEncryptionProfile) {\n      let canBeUsed = this.storedEncryptionProfile.userId === this.userId;\n\n      if (canBeUsed && !skipGuard) {\n        // When users matches, we also need to check\n        // if origin is authorized to use the keys.\n        canBeUsed = await this.guardKeys();\n      }\n\n      if (canBeUsed) {\n        return this.storedEncryptionProfile;\n      }\n\n      // Something did not match, we need to create a new key pair\n      // and reset the enclave.\n      await this.reset();\n    }\n\n    // The stored profile can't be used, or we have to create a new one.\n    let password: string | undefined;\n    let encryptionPasswordStore: EncryptionPasswordStore | undefined;\n\n    const context = await this.getPasswordContext();\n\n    if (context.encryptionPasswordStore === \"user\") {\n      await this.store.setRememberDuration(context.duration);\n\n      password = context.password;\n      encryptionPasswordStore = context.encryptionPasswordStore;\n    }\n\n    if (context.encryptionPasswordStore === \"mpc\") {\n      // TODO: This is resetting duration, but should?\n      await this.store.setRememberDuration(undefined);\n\n      password = await this.ensureMPCPassword();\n      encryptionPasswordStore = \"mpc\";\n    }\n\n    if (!password || !encryptionPasswordStore) {\n      throw new Error(\"Password or encryption password store is not found\");\n    }\n\n    return this.createEncryptionProfileFromPassword(password, this.userId, encryptionPasswordStore);\n  }\n\n  /** @see BaseProvider#ensureUserEncryptionProfile */\n  async ensureUserEncryptionProfile(): Promise<PublicEncryptionProfile> {\n    const { keyPair, encryptionPasswordStore, userId } = await this.getPrivateEncryptionProfile();\n\n    return {\n      userId,\n      userEncryptionPublicKey: base64Encode(keyPair.publicKey),\n      encryptionPasswordStore: encryptionPasswordStore,\n    };\n  }\n\n  /**\n   * This method needs to check `options` and should derive the password context from it.\n   *\n   * @returns The password context.\n   */\n  async getPasswordContext(): Promise<PasswordContext | MPCPasswordContext> {\n    throw new Error(\"Method 'getPasswordContext' has to be implemented in the subclass.\");\n  }\n\n  /**\n   * Creates and store encryption profile from a password.\n   *\n   * @param password - The password to use.\n   * @param userId - The user id to use.\n   * @param encryptionPasswordStore - The encryption password store to use.\n   *\n   * @returns The encryption profile.\n   */\n  async createEncryptionProfileFromPassword(\n    password: string,\n    userId: string,\n    encryptionPasswordStore: EncryptionPasswordStore,\n  ): Promise<PrivateEncryptionProfile> {\n    const secretKey = await keyDerivation(password, userId);\n\n    const keyPair = nacl.box.keyPair.fromSecretKey(secretKey);\n\n    await this.store.set(STORAGE_KEYS.USER_ID, userId);\n    await this.storeObfuscated.set(STORAGE_KEYS.OBFUSCATED_PASSWORD, password);\n    await this.store.delete(STORAGE_KEYS.DEPRECATED___PASSWORD);\n    await this.store.set(STORAGE_KEYS.ENCRYPTION_PASSWORD_STORE, encryptionPasswordStore);\n    await this.storeObfuscatedBase64.set(\n      STORAGE_KEYS.OBFUSCATED_BASE64_ENCRYPTION_SECRET_KEY,\n      keyPair.secretKey,\n    );\n    await this.store.delete(STORAGE_KEYS.DEPRECATED___ENCRYPTION_SECRET_KEY);\n    await this.storeBase64.set(STORAGE_KEYS.ENCRYPTION_PUBLIC_KEY, keyPair.publicKey);\n\n    this.storedEncryptionProfile = {\n      userId,\n      password,\n      keyPair,\n      encryptionPasswordStore,\n    };\n\n    return this.storedEncryptionProfile;\n  }\n\n  protected async ensureMPCPassword(): Promise<string> {\n    if (this.options?.mode !== \"new\") {\n      const { status: downloadStatus, secret: downloadedPassword } = await this.downloadSecret();\n\n      if (downloadStatus === \"ok\" && downloadedPassword) {\n        return utf8Decode(downloadedPassword);\n      }\n\n      throw Error(\"A secret might be stored at MPC ZK nodes, but can't be obtained\");\n    }\n\n    const password = generatePassword();\n    const { status: uploadStatus } = await this.uploadSecret(password);\n\n    if (uploadStatus !== \"success\") {\n      throw Error(`A secret upload failed with status: ${uploadStatus}`);\n    }\n\n    return password;\n  }\n\n  private get mpcClient(): MPCClient {\n    if (!this.mpcClientInstance) {\n      throw new Error(\"MPC client is not initialized\");\n    }\n    return this.mpcClientInstance;\n  }\n\n  private async downloadSecret(): Promise<{\n    status: string;\n    secret: Buffer<ArrayBufferLike> | undefined;\n  }> {\n    // I really don't like this, I guess the walletAddress should be stored in the store.\n    if (!this.options.walletAddress) {\n      throw new Error(\"walletAddress is not found\");\n    }\n\n    const ephemeralKeyPair = nacl.box.keyPair();\n\n    const downloadRequest = this.mpcClient.downloadRequest(ephemeralKeyPair.publicKey);\n\n    const messageToSign = this.mpcClient.downloadMessageToSign(\n      downloadRequest,\n    ) as DownloadMessageToSign;\n\n    const signedMessage = await this.signTypedData(\n      messageToSign.domain,\n      messageToSign.types,\n      messageToSign.value,\n    );\n\n    return this.mpcClient.downloadSecret(\n      this.userId,\n      downloadRequest,\n      signedMessage,\n      ephemeralKeyPair.secretKey,\n    );\n  }\n\n  private async uploadSecret(secret: string): Promise<{ status: string }> {\n    if (!this.options.walletAddress) {\n      console.error(\"signerAddress is not found\");\n      return { status: \"no-signer-address\" };\n    }\n\n    const blindedShares = this.mpcClient.getBlindedShares(Buffer.from(secret, \"utf8\"));\n    const uploadRequest = this.mpcClient.uploadRequest(blindedShares);\n    const messageToSign = this.mpcClient.uploadMessageToSign(uploadRequest) as UploadMessageToSign;\n\n    const signedMessage = await this.signTypedData(\n      // oxlint-disable-next-line typescript/no-explicit-any -- TODO: Change this when we know how to MPC & other chains\n      messageToSign.domain as any,\n      // oxlint-disable-next-line typescript/no-explicit-any -- TODO: Change this when we know how to MPC & other chains\n      messageToSign.types as any,\n      // oxlint-disable-next-line typescript/no-explicit-any -- TODO: Change this when we know how to MPC & other chains\n      messageToSign.value as any,\n    );\n\n    return this.mpcClient.uploadSecret(this.userId, uploadRequest, signedMessage, blindedShares);\n  }\n\n  async addAddressMessageToSign(\n    address: string,\n    publicKey: string | undefined,\n    addressToAddType: string,\n  ): Promise<AddAddressMessageToSign> {\n    return this.mpcClient.addAddressMessageToSign(\n      address,\n      publicKey,\n      addressToAddType,\n    ) as AddAddressMessageToSign;\n  }\n\n  async removeAddressMessageToSign(\n    address: string,\n    publicKey: string | undefined,\n    addressToRemoveType: string,\n  ): Promise<RemoveAddressMessageToSign> {\n    return this.mpcClient.removeAddressMessageToSign(\n      address,\n      publicKey,\n      addressToRemoveType,\n    ) as RemoveAddressMessageToSign;\n  }\n\n  async addAddressToMpcSecret(\n    userId: string,\n    message: AddAddressSignatureMessage,\n    signature: string,\n  ): Promise<string> {\n    return this.mpcClient.addAddress(userId, message, signature);\n  }\n\n  async removeAddressFromMpcSecret(\n    userId: string,\n    message: RemoveAddressSignatureMessage,\n    signature: string,\n  ): Promise<string> {\n    return this.mpcClient.removeAddress(userId, message, signature);\n  }\n}\n"],"mappings":";;;;;;;;;AAgDA,IAAa,eAAb,cAEU,aAAgB;CACxB;CAGA;CACA;CACA;CACA;CAGA;CAKA;CAEA,YAAY,SAAY;AACtB,QAAM,QAAQ;AAGd,OAAK,0BAA0B,QAAQ,2BAA2B,CAAC,OAAO;AAC1E,OAAK,QAAQ,QAAQ,SAAS,IAAI,mBAAmB;AACrD,OAAK,kBAAkB,KAAK,MAAM,UAAU,KAAK,wBAAwB,CAAC;AAC1E,OAAK,cAAc,KAAK,MAAM,UAAU,YAAY;AACpD,OAAK,wBAAwB,KAAK,MAC/B,UAAU,KAAK,wBAAwB,CAAC,CACxC,UAAU,YAAY;AAEzB,MAAI,QAAQ,iBACV,MAAK,oBAAoB,IAAIA,OAC3B,QAAQ,iBAAiB,SACzB,QAAQ,iBAAiB,iBACzB,QAAQ,iBAAiB,cACzB,QAAQ,iBAAiB,UACzB,QAAQ,iBAAiB,kBAEzB,QAAQ,cAAc,OACtB,QAAQ,iBAAiB,IACzB,QAAQ,gBACT;;;CAKL,MAAM,QAAuB;AAC3B,QAAM,MAAM,OAAO;AACnB,OAAK,0BAA0B,KAAA;AAC/B,OAAK,MAAM,OAAO;;;CAIpB,MAAM,YAAY,UAAsB,EAAE,EAAiB;AACzD,QAAM,MAAM,YAAY,QAAQ;AAEhC,MAAI,KAAK,qBAAqB,QAAQ,cAAc,QAAQ,cAC1D,MAAK,kBAAkB,YACrB,QAAQ,YACR,QAAQ,iBAAiB,IACzB,QAAQ,gBACT;;;;;;;CASL,yBAAwD;EAEtD,MAAM,OAAO;EAEb,MAAM,SAAS,QAAgB,SAC7B,WAAW,WAAW,OAAO,EAAE,MAAM,OAAO,GAAG,GAAG,KAAK,UAAU,UAAU;AAE7E,SAAO;GACL,OAAO,MAAsB;AAC3B,QAAI,CAAC,KAAK,QAAQ,OAChB,OAAM,IAAI,MAAM,kCAAkC;IAGpD,MAAM,YAAY,WAAW,KAAK;IAClC,MAAM,QAAQ,KAAK,YAAY,KAAK,UAAU,YAAY;IAC1D,MAAM,OAAO,KAAK,YAAY,GAAG;IACjC,MAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;IAC5C,MAAM,UAAU,KAAK,UAAU,WAAW,OAAO,IAAI;IAGrD,MAAM,WAAW,IAAI,WAAW,KAAK,SAAS,MAAM,SAAS,QAAQ,OAAO;AAC5E,aAAS,IAAI,MAAM,EAAE;AACrB,aAAS,IAAI,OAAO,KAAK,OAAO;AAChC,aAAS,IAAI,SAAS,KAAK,SAAS,MAAM,OAAO;AAEjD,WAAO,KAAK,UAAU,SAAS;;GAGjC,OAAO,SAAyB;AAC9B,QAAI,CAAC,KAAK,QAAQ,OAChB,OAAM,IAAI,MAAM,kCAAkC;AAGpD,QAAI,QAAQ,MAAM,GAAG,EAAE,KAAK,KAC1B,OAAM,IAAI,MAAM,sBAAsB,UAAU;IAGlD,MAAM,WAAW,UAAU,QAAQ,MAAM,EAAE,CAAC;IAC5C,MAAM,OAAO,SAAS,MAAM,GAAG,GAAG;IAClC,MAAM,QAAQ,SAAS,MAAM,IAAI,KAAK,KAAK,UAAU,YAAY;IACjE,MAAM,aAAa,SAAS,MAAM,KAAK,KAAK,UAAU,YAAY;IAElE,MAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;IAC5C,MAAM,SAAS,KAAK,UAAU,KAAK,YAAY,OAAO,IAAI;AAE1D,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,yBAAyB;AAEtD,WAAO,WAAW,OAAO;;GAE5B;;;CAGH,MAAM,OAAsB;AAC1B,QAAM,MAAM,MAAM;EAElB,MAAM,SAAS,MAAM,KAAK,MAAM,IAAY,aAAa,QAAQ;AACjE,MAAI,OAAQ,MAAK,QAAQ,SAAS;EAElC,IAAI,WAAW,MAAM,KAAK,gBAAgB,IAAY,aAAa,oBAAoB;AACvF,MAAI,CAAC,UAAU;AACb,cAAW,MAAM,KAAK,MAAM,IAAY,aAAa,sBAAsB;AAC3E,OAAI,CAAC,SAAU;AAEf,SAAM,KAAK,gBAAgB,IAAI,aAAa,qBAAqB,SAAS;;AAE5E,QAAM,KAAK,MAAM,OAAO,aAAa,sBAAsB;EAE3D,IAAI,sBAAsB,MAAM,KAAK,sBAAsB,IACzD,aAAa,wCACd;AACD,MAAI,CAAC,qBAAqB;AACxB,yBAAsB,MAAM,KAAK,YAAY,IAC3C,aAAa,mCACd;AACD,OAAI,CAAC,oBAAqB;AAE1B,SAAM,KAAK,sBAAsB,IAC/B,aAAa,yCACb,oBACD;;AAEH,QAAM,KAAK,MAAM,OAAO,aAAa,mCAAmC;AAExE,QAAM,KAAK,MAAM,OAAO,aAAa,oCAAoC;AAEzE,MAAI,CAAC,YAAY,CAAC,UAAU,CAAC,oBAC3B;EAGF,IAAI,0BAA0B,MAAM,KAAK,MAAM,IAC7C,aAAa,0BACd;AAID,MAAI,CAAC,2BAA4B,4BAAuC,YAAY;AAClF,6BAA0B;AAC1B,SAAM,KAAK,MAAM,IACf,aAAa,2BACb,wBACD;;AAGH,OAAK,0BAA0B;GAC7B;GACA;GACA,SAAS,KAAK,IAAI,QAAQ,cAAc,oBAAoB;GAC5D;GACD;;;;;;;;;;;CAYH,MAAM,QACJ,SACA,mBACkE;EAClE,MAAM,EAAE,YAAY,MAAM,KAAK,6BAA6B;AAC5D,SAAO,QAAQ,SAAS,QAAQ,WAAW,kBAAkB;;;;;;;;;;;CAY/D,MAAM,QACJ,SACA,iBACsC;EACtC,MAAM,EAAE,YAAY,MAAM,KAAK,6BAA6B;AAC5D,SAAO,QAAQ,SAAS,SAAS,gBAAgB;;;;;CAMnD,MAAM,4BAA4B,YAAY,OAA0C;AAEtF,MAAI,KAAK,yBAAyB;GAChC,IAAI,YAAY,KAAK,wBAAwB,WAAW,KAAK;AAE7D,OAAI,aAAa,CAAC,UAGhB,aAAY,MAAM,KAAK,WAAW;AAGpC,OAAI,UACF,QAAO,KAAK;AAKd,SAAM,KAAK,OAAO;;EAIpB,IAAI;EACJ,IAAI;EAEJ,MAAM,UAAU,MAAM,KAAK,oBAAoB;AAE/C,MAAI,QAAQ,4BAA4B,QAAQ;AAC9C,SAAM,KAAK,MAAM,oBAAoB,QAAQ,SAAS;AAEtD,cAAW,QAAQ;AACnB,6BAA0B,QAAQ;;AAGpC,MAAI,QAAQ,4BAA4B,OAAO;AAE7C,SAAM,KAAK,MAAM,oBAAoB,KAAA,EAAU;AAE/C,cAAW,MAAM,KAAK,mBAAmB;AACzC,6BAA0B;;AAG5B,MAAI,CAAC,YAAY,CAAC,wBAChB,OAAM,IAAI,MAAM,qDAAqD;AAGvE,SAAO,KAAK,oCAAoC,UAAU,KAAK,QAAQ,wBAAwB;;;CAIjG,MAAM,8BAAgE;EACpE,MAAM,EAAE,SAAS,yBAAyB,WAAW,MAAM,KAAK,6BAA6B;AAE7F,SAAO;GACL;GACA,yBAAyB,aAAa,QAAQ,UAAU;GAC/B;GAC1B;;;;;;;CAQH,MAAM,qBAAoE;AACxE,QAAM,IAAI,MAAM,qEAAqE;;;;;;;;;;;CAYvF,MAAM,oCACJ,UACA,QACA,yBACmC;EACnC,MAAM,YAAY,MAAM,cAAc,UAAU,OAAO;EAEvD,MAAM,UAAU,KAAK,IAAI,QAAQ,cAAc,UAAU;AAEzD,QAAM,KAAK,MAAM,IAAI,aAAa,SAAS,OAAO;AAClD,QAAM,KAAK,gBAAgB,IAAI,aAAa,qBAAqB,SAAS;AAC1E,QAAM,KAAK,MAAM,OAAO,aAAa,sBAAsB;AAC3D,QAAM,KAAK,MAAM,IAAI,aAAa,2BAA2B,wBAAwB;AACrF,QAAM,KAAK,sBAAsB,IAC/B,aAAa,yCACb,QAAQ,UACT;AACD,QAAM,KAAK,MAAM,OAAO,aAAa,mCAAmC;AACxE,QAAM,KAAK,YAAY,IAAI,aAAa,uBAAuB,QAAQ,UAAU;AAEjF,OAAK,0BAA0B;GAC7B;GACA;GACA;GACA;GACD;AAED,SAAO,KAAK;;CAGd,MAAgB,oBAAqC;AACnD,MAAI,KAAK,SAAS,SAAS,OAAO;GAChC,MAAM,EAAE,QAAQ,gBAAgB,QAAQ,uBAAuB,MAAM,KAAK,gBAAgB;AAE1F,OAAI,mBAAmB,QAAQ,mBAC7B,QAAO,WAAW,mBAAmB;AAGvC,SAAM,MAAM,kEAAkE;;EAGhF,MAAM,WAAW,kBAAkB;EACnC,MAAM,EAAE,QAAQ,iBAAiB,MAAM,KAAK,aAAa,SAAS;AAElE,MAAI,iBAAiB,UACnB,OAAM,MAAM,uCAAuC,eAAe;AAGpE,SAAO;;CAGT,IAAY,YAAuB;AACjC,MAAI,CAAC,KAAK,kBACR,OAAM,IAAI,MAAM,gCAAgC;AAElD,SAAO,KAAK;;CAGd,MAAc,iBAGX;AAED,MAAI,CAAC,KAAK,QAAQ,cAChB,OAAM,IAAI,MAAM,6BAA6B;EAG/C,MAAM,mBAAmB,KAAK,IAAI,SAAS;EAE3C,MAAM,kBAAkB,KAAK,UAAU,gBAAgB,iBAAiB,UAAU;EAElF,MAAM,gBAAgB,KAAK,UAAU,sBACnC,gBACD;EAED,MAAM,gBAAgB,MAAM,KAAK,cAC/B,cAAc,QACd,cAAc,OACd,cAAc,MACf;AAED,SAAO,KAAK,UAAU,eACpB,KAAK,QACL,iBACA,eACA,iBAAiB,UAClB;;CAGH,MAAc,aAAa,QAA6C;AACtE,MAAI,CAAC,KAAK,QAAQ,eAAe;AAC/B,WAAQ,MAAM,6BAA6B;AAC3C,UAAO,EAAE,QAAQ,qBAAqB;;EAGxC,MAAM,gBAAgB,KAAK,UAAU,iBAAiB,OAAO,KAAK,QAAQ,OAAO,CAAC;EAClF,MAAM,gBAAgB,KAAK,UAAU,cAAc,cAAc;EACjE,MAAM,gBAAgB,KAAK,UAAU,oBAAoB,cAAc;EAEvE,MAAM,gBAAgB,MAAM,KAAK,cAE/B,cAAc,QAEd,cAAc,OAEd,cAAc,MACf;AAED,SAAO,KAAK,UAAU,aAAa,KAAK,QAAQ,eAAe,eAAe,cAAc;;CAG9F,MAAM,wBACJ,SACA,WACA,kBACkC;AAClC,SAAO,KAAK,UAAU,wBACpB,SACA,WACA,iBACD;;CAGH,MAAM,2BACJ,SACA,WACA,qBACqC;AACrC,SAAO,KAAK,UAAU,2BACpB,SACA,WACA,oBACD;;CAGH,MAAM,sBACJ,QACA,SACA,WACiB;AACjB,SAAO,KAAK,UAAU,WAAW,QAAQ,SAAS,UAAU;;CAG9D,MAAM,2BACJ,QACA,SACA,WACiB;AACjB,SAAO,KAAK,UAAU,cAAc,QAAQ,SAAS,UAAU"}

package/dist/mpc/index.d.mts

@@ -0,0 +1,3 @@
+import { C as UpdateWalletsSignatureMessage, S as UpdateWalletsRequest, T as UploadSignatureMessage, _ as RemoveAddressRequest, a as Address, b as UPDATE_TYPES, c as Bytes32, d as DownloadRequest, f as DownloadSignatureMessage, g as RemoveAddressMessageToSign, h as REMOVE_ADDRESS_TYPES, i as AddAddressSignatureMessage, l as DOWNLOAD_TYPES, m as PbcAddress, n as AddAddressMessageToSign, o as Bytes, p as EncryptedShare, r as AddAddressRequest, s as Bytes24, t as ADD_ADDRESS_TYPES, u as DownloadMessageToSign, v as RemoveAddressSignatureMessage, w as UploadMessageToSign, x as UPLOAD_TYPES, y as Sharing } from "../types-DKsOwtWL.mjs";
+import { t as Client } from "../client-Bu0aO5sT.mjs";
+export { ADD_ADDRESS_TYPES, AddAddressMessageToSign, AddAddressRequest, AddAddressSignatureMessage, Address, Bytes, Bytes24, Bytes32, Client, DOWNLOAD_TYPES, DownloadMessageToSign, DownloadRequest, DownloadSignatureMessage, EncryptedShare, PbcAddress, REMOVE_ADDRESS_TYPES, RemoveAddressMessageToSign, RemoveAddressRequest, RemoveAddressSignatureMessage, Sharing, UPDATE_TYPES, UPLOAD_TYPES, UpdateWalletsRequest, UpdateWalletsSignatureMessage, UploadMessageToSign, UploadSignatureMessage };

package/dist/mpc/index.mjs

@@ -0,0 +1,2 @@
+import { a as UPDATE_TYPES, i as REMOVE_ADDRESS_TYPES, n as ADD_ADDRESS_TYPES, o as UPLOAD_TYPES, r as DOWNLOAD_TYPES, t as Client } from "../client-BSkUuHYm.mjs";
+export { ADD_ADDRESS_TYPES, Client, DOWNLOAD_TYPES, REMOVE_ADDRESS_TYPES, UPDATE_TYPES, UPLOAD_TYPES };

package/dist/types-DKsOwtWL.d.mts

@@ -0,0 +1,73 @@
+import { TypedDataDomain, TypedDataField } from "ethers";
+
+//#region src/mpc/types.d.ts
+type PbcAddress = string;
+type Bytes32 = string;
+type Bytes24 = string;
+type Address = string;
+type Bytes = string;
+declare const UPLOAD_TYPES: Record<string, TypedDataField[]>;
+declare const DOWNLOAD_TYPES: Record<string, TypedDataField[]>;
+declare const UPDATE_TYPES: Record<string, TypedDataField[]>;
+declare const ADD_ADDRESS_TYPES: Record<string, TypedDataField[]>;
+declare const REMOVE_ADDRESS_TYPES: Record<string, TypedDataField[]>;
+interface UploadSignatureMessage {
+  share_commitments: Bytes32[];
+  recovering_addresses: Address[];
+}
+interface Sharing {
+  share_commitments: Bytes32[];
+  recovering_addresses: Address[];
+  share_data: Bytes;
+}
+interface DownloadSignatureMessage {
+  recovering_address: Address;
+  timestamp: number;
+  public_key: Bytes32;
+}
+type DownloadRequest = DownloadSignatureMessage;
+interface AddAddressSignatureMessage {
+  recovering_address: Address;
+  address_to_add: Address;
+  timestamp: number;
+}
+type AddAddressRequest = AddAddressSignatureMessage;
+interface RemoveAddressSignatureMessage {
+  recovering_address: Address;
+  address_to_remove: Address;
+  timestamp: number;
+}
+type RemoveAddressRequest = RemoveAddressSignatureMessage;
+interface UpdateWalletsSignatureMessage {
+  recovering_addresses: Address[];
+  timestamp: number;
+}
+type UpdateWalletsRequest = UpdateWalletsSignatureMessage;
+interface EncryptedShare {
+  encrypted_share: Bytes;
+  public_key: Bytes32;
+  nonce: Bytes24;
+}
+type DownloadMessageToSign = {
+  domain: TypedDataDomain;
+  types: Record<string, TypedDataField[]>;
+  value: DownloadSignatureMessage;
+};
+type UploadMessageToSign = {
+  domain: TypedDataDomain;
+  types: Record<string, TypedDataField[]>;
+  value: UploadSignatureMessage;
+};
+type AddAddressMessageToSign = {
+  domain: TypedDataDomain;
+  types: Record<string, TypedDataField[]>;
+  value: AddAddressSignatureMessage;
+};
+type RemoveAddressMessageToSign = {
+  domain: TypedDataDomain;
+  types: Record<string, TypedDataField[]>;
+  value: RemoveAddressSignatureMessage;
+};
+//#endregion
+export { UpdateWalletsSignatureMessage as C, UpdateWalletsRequest as S, UploadSignatureMessage as T, RemoveAddressRequest as _, Address as a, UPDATE_TYPES as b, Bytes32 as c, DownloadRequest as d, DownloadSignatureMessage as f, RemoveAddressMessageToSign as g, REMOVE_ADDRESS_TYPES as h, AddAddressSignatureMessage as i, DOWNLOAD_TYPES as l, PbcAddress as m, AddAddressMessageToSign as n, Bytes as o, EncryptedShare as p, AddAddressRequest as r, Bytes24 as s, ADD_ADDRESS_TYPES as t, DownloadMessageToSign as u, RemoveAddressSignatureMessage as v, UploadMessageToSign as w, UPLOAD_TYPES as x, Sharing as y };
+//# sourceMappingURL=types-DKsOwtWL.d.mts.map

package/dist/types-DKsOwtWL.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-DKsOwtWL.d.mts","names":[],"sources":["../src/mpc/types.ts"],"mappings":";;;KAEY,UAAA;AAAA,KACA,OAAA;AAAA,KACA,OAAA;AAAA,KACA,OAAA;AAAA,KACA,KAAA;AAAA,cAEC,YAAA,EAAc,MAAA,SAAe,cAAA;AAAA,cAO7B,cAAA,EAAgB,MAAA,SAAe,cAAA;AAAA,cAQ/B,YAAA,EAAc,MAAA,SAAe,cAAA;AAAA,cAO7B,iBAAA,EAAmB,MAAA,SAAe,cAAA;AAAA,cAQlC,oBAAA,EAAsB,MAAA,SAAe,cAAA;AAAA,UAQjC,sBAAA;EACf,iBAAA,EAAmB,OAAA;EACnB,oBAAA,EAAsB,OAAA;AAAA;AAAA,UAGP,OAAA;EACf,iBAAA,EAAmB,OAAA;EACnB,oBAAA,EAAsB,OAAA;EACtB,UAAA,EAAY,KAAA;AAAA;AAAA,UAGG,wBAAA;EACf,kBAAA,EAAoB,OAAA;EACpB,SAAA;EACA,UAAA,EAAY,OAAA;AAAA;AAAA,KAGF,eAAA,GAAkB,wBAAA;AAAA,UAEb,0BAAA;EACf,kBAAA,EAAoB,OAAA;EACpB,cAAA,EAAgB,OAAA;EAChB,SAAA;AAAA;AAAA,KAGU,iBAAA,GAAoB,0BAAA;AAAA,UAEf,6BAAA;EACf,kBAAA,EAAoB,OAAA;EACpB,iBAAA,EAAmB,OAAA;EACnB,SAAA;AAAA;AAAA,KAGU,oBAAA,GAAuB,6BAAA;AAAA,UAElB,6BAAA;EACf,oBAAA,EAAsB,OAAA;EACtB,SAAA;AAAA;AAAA,KAGU,oBAAA,GAAuB,6BAAA;AAAA,UAElB,cAAA;EACf,eAAA,EAAiB,KAAA;EACjB,UAAA,EAAY,OAAA;EACZ,KAAA,EAAO,OAAA;AAAA;AAAA,KAGG,qBAAA;EACV,MAAA,EAAQ,eAAA;EACR,KAAA,EAAO,MAAA,SAAe,cAAA;EACtB,KAAA,EAAO,wBAAA;AAAA;AAAA,KAGG,mBAAA;EACV,MAAA,EAAQ,eAAA;EACR,KAAA,EAAO,MAAA,SAAe,cAAA;EACtB,KAAA,EAAO,sBAAA;AAAA;AAAA,KAGG,uBAAA;EACV,MAAA,EAAQ,eAAA;EACR,KAAA,EAAO,MAAA,SAAe,cAAA;EACtB,KAAA,EAAO,0BAAA;AAAA;AAAA,KAGG,0BAAA;EACV,MAAA,EAAQ,eAAA;EACR,KAAA,EAAO,MAAA,SAAe,cAAA;EACtB,KAAA,EAAO,6BAAA;AAAA"}

package/package.json

@@ -0,0 +1,76 @@
+{
+  "name": "@idos-network/enclave",
+  "version": "1.1.0",
+  "description": "idOS Enclave JavaScript SDK",
+  "homepage": "https://idos.network",
+  "license": "MIT",
+  "repository": "github:idos-network/idos-sdk-js",
+  "files": [
+    "dist/**/*",
+    "src/**/*"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.mjs",
+  "types": "./dist/index.d.mts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs"
+    },
+    "./local": {
+      "types": "./dist/local.d.mts",
+      "import": "./dist/local.mjs"
+    },
+    "./mpc": {
+      "types": "./dist/mpc/index.d.mts",
+      "import": "./dist/mpc/index.mjs"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "scrypt-js": "^3.0.1",
+    "tiny-invariant": "^1.3.3",
+    "tweetnacl": "^1.0.3",
+    "zod": "4.3.6",
+    "@idos-network/credentials": "1.1.0",
+    "@idos-network/utils": "1.1.0",
+    "@idos-network/kwil-infra": "1.1.0"
+  },
+  "devDependencies": {
+    "@types/chrome": "^0.1.0",
+    "@types/node": "25.5.2",
+    "jsdom": "^22.1.0",
+    "tsdown": "^0.21.0",
+    "typescript": "^5.8.3",
+    "vitest": "4.1.4"
+  },
+  "peerDependencies": {
+    "@partisiablockchain/abi-client": "^5.207.0",
+    "@partisiablockchain/blockchain-api-transaction-client": "^5.149.0",
+    "ethers": "^6.14.0"
+  },
+  "peerDependenciesMeta": {
+    "@partisiablockchain/blockchain-api-transaction-client": {
+      "optional": true
+    },
+    "@partisiablockchain/abi-client": {
+      "optional": true
+    },
+    "ethers": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=22.19.0"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "dev": "tsdown  --watch",
+    "publint": "pnpx publint --strict",
+    "test": "vitest",
+    "typecheck": "tsc --noEmit"
+  }
+}

package/src/base.test.ts

@@ -0,0 +1,137 @@
+import type { idOSCredential } from "@idos-network/credentials/types";
+
+import { base64Encode, utf8Encode } from "@idos-network/utils/codecs";
+import { describe, expect, it, vi } from "vitest";
+
+import type { PublicEncryptionProfile } from "./types.js";
+
+import { BaseProvider } from "./base.js";
+
+type TestOptions = { userId?: string };
+
+class TestProvider extends BaseProvider<TestOptions> {
+  async decrypt(message: Uint8Array): Promise<Uint8Array> {
+    return message;
+  }
+
+  async ensureUserEncryptionProfile(): Promise<PublicEncryptionProfile> {
+    return {
+      userId: crypto.randomUUID(),
+      userEncryptionPublicKey: base64Encode(new Uint8Array([1, 2, 3])),
+      encryptionPasswordStore: "user",
+    };
+  }
+}
+
+describe("BaseProvider", () => {
+  it("uses signTypedData when available", async () => {
+    const provider = new TestProvider({ userId: "user" });
+    const signTypedData = vi.fn().mockResolvedValue("sig");
+    provider.setSigner({ signTypedData });
+
+    const result = await provider.signTypedData({ domain: 1 }, { types: 2 }, { value: 3 });
+
+    expect(result).toBe("sig");
+    expect(signTypedData).toHaveBeenCalledWith({ domain: 1 }, { types: 2 }, { value: 3 });
+  });
+
+  it("falls back to signMessage and extracts signedMessage", async () => {
+    const provider = new TestProvider({ userId: "user" });
+    const signMessage = vi.fn().mockResolvedValue({ result: { signedMessage: "sig" } });
+    provider.setSigner({ signMessage });
+
+    const result = await provider.signTypedData({}, {}, { hello: "world" });
+
+    expect(result).toBe("sig");
+    expect(signMessage).toHaveBeenCalledWith(JSON.stringify({ hello: "world" }));
+  });
+
+  it("accepts signMessage string response", async () => {
+    const provider = new TestProvider({ userId: "user" });
+    const signMessage = vi.fn().mockResolvedValue("sig");
+    provider.setSigner({ signMessage });
+
+    await expect(provider.signTypedData({}, {}, { ok: true })).resolves.toBe("sig");
+  });
+
+  it("throws when signer is not set", async () => {
+    const provider = new TestProvider({ userId: "user" });
+    await expect(provider.signTypedData({}, {}, {})).rejects.toThrow("Signer is not set");
+  });
+
+  it("throws when no sign method is provided", () => {
+    const provider = new TestProvider({ userId: "user" });
+    expect(() => provider.setSigner({} as unknown as Record<string, never>)).toThrow(
+      "No sign method found in passed signer",
+    );
+  });
+
+  it("requires userId in options for userId getter", () => {
+    const provider = new TestProvider({});
+    expect(() => provider.userId).toThrow("User ID is not present");
+  });
+
+  it("filters credentials and strips content", async () => {
+    const provider = new TestProvider({ userId: "user" });
+    const publicKey = base64Encode(new Uint8Array([1, 2, 3]));
+
+    const matches = { type: "kyc", level: "basic" };
+    const misses = { type: "aml", level: "basic" };
+
+    const credentials: idOSCredential[] = [
+      {
+        id: "cred-1",
+        user_id: "user-1",
+        public_notes: "{}",
+        content: base64Encode(utf8Encode(JSON.stringify(matches))),
+        encryptor_public_key: publicKey,
+        issuer_auth_public_key: "issuer",
+      },
+      {
+        id: "cred-2",
+        user_id: "user-1",
+        public_notes: "{}",
+        content: base64Encode(utf8Encode(JSON.stringify(misses))),
+        encryptor_public_key: publicKey,
+        issuer_auth_public_key: "issuer",
+      },
+    ];
+
+    const filtered = await provider.filterCredentials(credentials, {
+      pick: { type: ["kyc"] },
+      omit: {},
+    });
+
+    expect(filtered).toHaveLength(1);
+    expect(filtered[0]?.id).toBe("cred-1");
+    expect(filtered[0]?.content).toBe("");
+  });
+
+  it("returns all credentials when no filters are provided", async () => {
+    const provider = new TestProvider({ userId: "user" });
+    const publicKey = base64Encode(new Uint8Array([1, 2, 3]));
+    const credentials: idOSCredential[] = [
+      {
+        id: "cred-1",
+        user_id: "user-1",
+        public_notes: "{}",
+        content: base64Encode(utf8Encode(JSON.stringify({ value: 1 }))),
+        encryptor_public_key: publicKey,
+        issuer_auth_public_key: "issuer",
+      },
+      {
+        id: "cred-2",
+        user_id: "user-1",
+        public_notes: "{}",
+        content: base64Encode(utf8Encode(JSON.stringify({ value: 2 }))),
+        encryptor_public_key: publicKey,
+        issuer_auth_public_key: "issuer",
+      },
+    ];
+
+    const filtered = await provider.filterCredentials(credentials, { pick: {}, omit: {} });
+
+    expect(filtered).toHaveLength(2);
+    expect(filtered.every((credential) => credential.content === "")).toBe(true);
+  });
+});