@iicp/client 0.7.36 → 0.7.38

package/dist/operator_crypto.js

@@ -0,0 +1,78 @@
+"use strict";
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * #460 — at-rest encryption of the operator secret (ed25519 seed) in `operator.json`.
+ *
+ * The operator_secret is the private key behind the operator_id; by default it is stored as
+ * plaintext base64 in a 0600 file. An operator may opt in to passphrase encryption: the seed
+ * is sealed with AES-256-GCM, the key derived from the passphrase with PBKDF2-HMAC-SHA256
+ * (OWASP-2023 iteration count). Both primitives are Node built-ins (`node:crypto`) — no new
+ * dependency, so this never trips the third-party due-diligence gate (TC-11).
+ *
+ * The encrypted record byte-shape is identical across the Python/TS/Rust SDKs — a file sealed
+ * by one opens in another given the passphrase (pinned by a cross-language KAT). The
+ * operator_id is bound as AES-GCM additional authenticated data (AAD): a sealed seed cannot be
+ * transplanted onto a different identity. Unlock is headless via `$IICP_OPERATOR_PASSPHRASE`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENV_PASSPHRASE = exports.PBKDF2_ITERATIONS = void 0;
+exports.encryptSeed = encryptSeed;
+exports.decryptSeed = decryptSeed;
+exports.passphraseFromEnv = passphraseFromEnv;
+const node_crypto_1 = require("node:crypto");
+/** OWASP 2023 minimum for PBKDF2-HMAC-SHA256. Stored in the record so it can be raised later. */
+exports.PBKDF2_ITERATIONS = 600000;
+const KDF = "pbkdf2-hmac-sha256";
+const VERSION = 1;
+exports.ENV_PASSPHRASE = "IICP_OPERATOR_PASSPHRASE";
+function deriveKey(passphrase, salt, iterations) {
+    return (0, node_crypto_1.pbkdf2Sync)(Buffer.from(passphrase, "utf8"), salt, iterations, 32, "sha256");
+}
+/** Seal the raw 32-byte ed25519 seed (given as base64) under `passphrase`. operator_id is AAD. */
+function encryptSeed(passphrase, seedB64, operatorId) {
+    if (!passphrase)
+        throw new Error("passphrase must not be empty");
+    const seed = Buffer.from(seedB64, "base64");
+    const salt = (0, node_crypto_1.randomBytes)(16);
+    const nonce = (0, node_crypto_1.randomBytes)(12);
+    const key = deriveKey(passphrase, salt, exports.PBKDF2_ITERATIONS);
+    const cipher = (0, node_crypto_1.createCipheriv)("aes-256-gcm", key, nonce);
+    cipher.setAAD(Buffer.from(operatorId, "utf8"));
+    const body = Buffer.concat([cipher.update(seed), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return {
+        v: VERSION,
+        kdf: KDF,
+        iter: exports.PBKDF2_ITERATIONS,
+        salt: salt.toString("base64"),
+        nonce: nonce.toString("base64"),
+        ct: Buffer.concat([body, tag]).toString("base64"),
+    };
+}
+/** Open an encrypted record → base64 seed. Throws on wrong passphrase / tamper / wrong AAD. */
+function decryptSeed(passphrase, enc, operatorId) {
+    if (enc.kdf !== KDF || enc.v !== VERSION) {
+        throw new Error(`unsupported operator_secret_enc format: ${enc.kdf} v${enc.v}`);
+    }
+    const salt = Buffer.from(enc.salt, "base64");
+    const nonce = Buffer.from(enc.nonce, "base64");
+    const blob = Buffer.from(enc.ct, "base64");
+    const body = blob.subarray(0, blob.length - 16);
+    const tag = blob.subarray(blob.length - 16);
+    const key = deriveKey(passphrase, salt, enc.iter);
+    const decipher = (0, node_crypto_1.createDecipheriv)("aes-256-gcm", key, nonce);
+    decipher.setAAD(Buffer.from(operatorId, "utf8"));
+    decipher.setAuthTag(tag);
+    try {
+        const seed = Buffer.concat([decipher.update(body), decipher.final()]);
+        return seed.toString("base64");
+    }
+    catch {
+        throw new Error("operator secret decryption failed (wrong passphrase or corrupt file)");
+    }
+}
+/** Headless unlock source — never an interactive prompt for a serving node. */
+function passphraseFromEnv() {
+    return process.env[exports.ENV_PASSPHRASE] || undefined;
+}
+//# sourceMappingURL=operator_crypto.js.map

package/dist/operator_crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator_crypto.js","sourceRoot":"","sources":["../src/operator_crypto.ts"],"names":[],"mappings":";AAAA,sCAAsC;AACtC;;;;;;;;;;;;;GAaG;;;AAwBH,kCAkBC;AAGD,kCAmBC;AAGD,8CAEC;AAnED,6CAAwF;AAExF,iGAAiG;AACpF,QAAA,iBAAiB,GAAG,MAAM,CAAC;AACxC,MAAM,GAAG,GAAG,oBAAoB,CAAC;AACjC,MAAM,OAAO,GAAG,CAAC,CAAC;AACL,QAAA,cAAc,GAAG,0BAA0B,CAAC;AAWzD,SAAS,SAAS,CAAC,UAAkB,EAAE,IAAY,EAAE,UAAkB;IACrE,OAAO,IAAA,wBAAU,EAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;AACrF,CAAC;AAED,kGAAkG;AAClG,SAAgB,WAAW,CAAC,UAAkB,EAAE,OAAe,EAAE,UAAkB;IACjF,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,yBAAiB,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO;QACL,CAAC,EAAE,OAAO;QACV,GAAG,EAAE,GAAG;QACR,IAAI,EAAE,yBAAiB;QACvB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/B,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,SAAgB,WAAW,CAAC,UAAkB,EAAE,GAAoB,EAAE,UAAkB;IACtF,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7D,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAgB,iBAAiB;IAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAc,CAAC,IAAI,SAAS,CAAC;AAClD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iicp/client",
-  "version": "0.7.36",
+  "version": "0.7.38",
   "description": "Official TypeScript/JavaScript SDK for the IICP protocol (ADR-016)",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",