@ledgerhq/revault-sdk 0.27.8 → 0.27.10

package/lib/{crypto-DdEUFJar.js → crypto-BHYSptBe.js}

@@ -147,6 +147,7 @@ var KeyEncoder = class {
 				privateKeyObject = this.privateKeyObject(privateKey, rawPublicKey);
 				break;
 			}
+			/* v8 ignore next -- @preserve */
 			case "der":
 				if (typeof privateKey === "string") privateKey = Buffer.from(privateKey, "hex");
 				privateKeyObject = ECPrivateKeyASN.decode(privateKey, "der");
@@ -155,6 +156,7 @@ var KeyEncoder = class {
 				if (typeof privateKey !== "string") throw new Error("private key must be a string");
 				privateKeyObject = ECPrivateKeyASN.decode(privateKey, "pem", this.options.privatePEMOptions);
 				break;
+			/* v8 ignore next -- @preserve */
 			default: throw new Error("invalid private key format");
 		}
 		switch (destinationFormat) {
@@ -173,6 +175,7 @@ var KeyEncoder = class {
 					label: "PRIVATE KEY"
 				});
 				break;
+			/* v8 ignore next -- @preserve */
 			default: throw new Error("invalid destination format for private key");
 		}
 		throw new Error("unsupported destination format or type");
@@ -184,6 +187,7 @@ var KeyEncoder = class {
 				if (typeof publicKey !== "string") throw new Error("public key must be a string");
 				publicKeyObject = this.publicKeyObject(publicKey);
 				break;
+			/* v8 ignore next -- @preserve */
 			case "der":
 				if (typeof publicKey === "string") publicKey = Buffer.from(publicKey, "hex");
 				publicKeyObject = SubjectPublicKeyInfoASN.decode(publicKey, "der");
@@ -192,12 +196,14 @@ var KeyEncoder = class {
 				if (typeof publicKey !== "string") throw new Error("public key must be a string");
 				publicKeyObject = SubjectPublicKeyInfoASN.decode(publicKey, "pem", this.options.publicPEMOptions);
 				break;
+			/* v8 ignore next -- @preserve */
 			default: throw new Error("invalid public key format");
 		}
 		switch (destinationFormat) {
 			case "raw": return publicKeyObject.pub.data.toString("hex");
 			case "der": return SubjectPublicKeyInfoASN.encode(publicKeyObject, "der").toString("hex");
 			case "pem": return SubjectPublicKeyInfoASN.encode(publicKeyObject, "pem", this.options.publicPEMOptions);
+			/* v8 ignore next -- @preserve */
 			default: throw new Error("invalid destination format for public key");
 		}
 	}
@@ -258,4 +264,4 @@ const sign = async (privateKeyPem, base64Challenge) => {
 //#endregion
 export { getMasterSeed as i, sign as n, genSeed as r, genKeys as t };
 
-//# sourceMappingURL=crypto-DdEUFJar.js.map
+//# sourceMappingURL=crypto-BHYSptBe.js.map

package/lib/{crypto-DdEUFJar.js.map → crypto-BHYSptBe.js.map}

@@ -1 +1 @@
-{"version":3,"file":"crypto-DdEUFJar.js","names":[],"sources":["../src/crypto/gen-seed.ts","../src/crypto/key-encoder.ts","../src/crypto/utils.ts"],"sourcesContent":["import { sha256 } from \"@noble/hashes/sha2.js\";\nimport { HDKey } from \"@scure/bip32\";\nimport { entropyToMnemonic, mnemonicToSeed } from \"@scure/bip39\";\nimport { wordlist } from \"@scure/bip39/wordlists/english.js\";\n\n/**\n * Generate a deterministic BIP39 mnemonic from a salt and device index.\n *\n * Produces `entropyToMnemonic(SHA256(salt + \"_\" + index))`, matching\n * the behavior of `@ledgerhq/vault-common`'s `genSeed`.\n *\n * @param salt  The workspace salt\n * @param index The device index (1-based)\n * @returns A 24-word BIP39 mnemonic string\n */\nexport function genSeed(salt: string, index: number): string {\n  const input = new TextEncoder().encode(`${salt}_${index}`);\n  const entropy = sha256(input);\n  return entropyToMnemonic(entropy, wordlist);\n}\n\nconst getSeedFragment = async (salt: string, index: number): Promise<Uint8Array> => {\n  const seed = await mnemonicToSeed(genSeed(salt, index));\n  const secpKey = HDKey.fromMasterSeed(seed);\n  const fragment = secpKey.derive(\"m/5655636'/4932953'\");\n  return Buffer.concat([fragment.privateKey!, fragment.chainCode!]);\n};\n\nexport const getMasterSeed = async (salt: string): Promise<Uint8Array> => {\n  const fragments = await Promise.all([\n    getSeedFragment(salt, 7),\n    getSeedFragment(salt, 8),\n    getSeedFragment(salt, 9),\n  ]);\n\n  const masterSeed = new Uint8Array(fragments[0].length);\n  for (let i = 0; i < fragments[0].length; i++) {\n    masterSeed[i] = fragments[0][i]! ^ fragments[1][i]! ^ fragments[2][i]!;\n  }\n\n  return masterSeed;\n};\n","// ========================================================================== //\n//                                                                            //\n//                                 DISCLAIMER                                 //\n//                                                                            //\n//                This code has been blindly copy-pasted from:                //\n//                    https://github.com/LedgerHQ/pkey-ts                     //\n//                                                                            //\n// ========================================================================== //\n//\n// @ts-expect-error this library does not ship types\nimport asn1 from \"asn1.js\";\nimport BN from \"bn.js\";\nimport elliptic from \"elliptic\";\n\n/* cspell:disable */\nconst ECPrivateKeyASN = asn1.define(\"ECPrivateKey\", function () {\n  // @ts-expect-error pure black box\n  // biome-ignore lint/suspicious/noExplicitAny: black box\n  const self = this as any;\n  self\n    .seq()\n    .obj(\n      self.key(\"version\").int(),\n      self.key(\"privateKey\").octstr(),\n      self.key(\"parameters\").explicit(0).objid().optional(),\n      self.key(\"publicKey\").explicit(1).bitstr().optional(),\n    );\n});\n\nconst ECPrivateKey8ASN = asn1.define(\n  \"ECPrivateKey\",\n  /* v8 ignore next -- @preserve */\n  function () {\n    // @ts-expect-error pure black box\n    // biome-ignore lint/suspicious/noExplicitAny: black box\n    const self = this as any;\n    self\n      .seq()\n      .obj(\n        self.key(\"version\").int(),\n        self\n          .key(\"privateKeyAlgorithm\")\n          .seq()\n          .obj(self.key(\"ecPublicKey\").objid(), self.key(\"curve\").objid()),\n        self.key(\"privateKey\").octstr().contains(ECPrivateKeyASN),\n        self.key(\"attributes\").explicit(0).bitstr().optional(),\n      );\n  },\n);\n\nconst SubjectPublicKeyInfoASN = asn1.define(\"SubjectPublicKeyInfo\", function () {\n  // @ts-expect-error pure black box\n  // biome-ignore lint/suspicious/noExplicitAny: black box\n  const self = this as any;\n  self\n    .seq()\n    .obj(\n      self.key(\"algorithm\").seq().obj(self.key(\"id\").objid(), self.key(\"curve\").objid()),\n      self.key(\"pub\").bitstr(),\n    );\n});\n\ntype CurveOptions = {\n  curveParameters: number[];\n  privatePEMOptions: { label: string };\n  publicPEMOptions: { label: string };\n  curve: elliptic.ec;\n};\n\nconst curves: Record<string, CurveOptions> = {\n  secp256k1: {\n    curveParameters: [1, 3, 132, 0, 10],\n    privatePEMOptions: { label: \"EC PRIVATE KEY\" },\n    publicPEMOptions: { label: \"PUBLIC KEY\" },\n    curve: new elliptic.ec(\"secp256k1\"),\n  },\n  p256: {\n    curveParameters: [1, 2, 840, 10045, 3, 1, 7], // OID for p256 curve\n    privatePEMOptions: { label: \"EC PRIVATE KEY\" },\n    publicPEMOptions: { label: \"PUBLIC KEY\" },\n    curve: new elliptic.ec(\"p256\"),\n  },\n};\n\ntype PrivateKeyPKCS1 = {\n  version: BN;\n  privateKey: Buffer;\n  parameters: number[];\n  publicKey?: {\n    unused: number;\n    data: Buffer;\n  };\n};\n\ntype PrivateKeyPKCS8 = {\n  version: BN;\n  privateKey: PrivateKeyPKCS1;\n  privateKeyAlgorithm: { ecPublicKey: number[]; curve: number[] };\n};\n\nexport type KeyFormat = \"raw\" | \"pem\" | \"der\";\n\nexport class KeyEncoder {\n  algorithmID: number[];\n  options: CurveOptions;\n\n  constructor(options: string | CurveOptions) {\n    /* v8 ignore else -- @preserve */\n    if (typeof options === \"string\") {\n      /* v8 ignore if -- @preserve */\n      if (options !== \"secp256k1\" && options !== \"p256\") {\n        throw new Error(`Unknown curve ${options}`);\n      }\n      options = curves[options]!;\n    }\n    this.options = options;\n    this.algorithmID = [1, 2, 840, 10045, 2, 1];\n  }\n\n  /* v8 ignore next -- @preserve */\n  private PKCS1toPKCS8(privateKey: PrivateKeyPKCS1): PrivateKeyPKCS8 {\n    return {\n      version: new BN(0),\n      privateKey,\n      privateKeyAlgorithm: {\n        ecPublicKey: this.algorithmID,\n        curve: privateKey.parameters,\n      },\n    };\n  }\n\n  privateKeyObject(rawPrivateKey: string, rawPublicKey: string): PrivateKeyPKCS1 {\n    const privateKeyObject: PrivateKeyPKCS1 = {\n      version: new BN(1),\n      privateKey: Buffer.from(rawPrivateKey, \"hex\"),\n      parameters: this.options.curveParameters,\n    };\n\n    /* v8 ignore else -- @preserve */\n    if (rawPublicKey) {\n      privateKeyObject.publicKey = {\n        unused: 0,\n        data: Buffer.from(rawPublicKey, \"hex\"),\n      };\n    }\n\n    return privateKeyObject;\n  }\n\n  publicKeyObject(rawPublicKey: string): {\n    algorithm: { id: number[]; curve: number[] };\n    pub: { unused: number; data: Buffer };\n  } {\n    return {\n      algorithm: {\n        id: this.algorithmID,\n        curve: this.options.curveParameters,\n      },\n      pub: {\n        unused: 0,\n        data: Buffer.from(rawPublicKey, \"hex\"),\n      },\n    };\n  }\n\n  encodePrivate(\n    privateKey: string | Buffer,\n    originalFormat: KeyFormat,\n    destinationFormat: KeyFormat,\n    destinationFormatType: \"pkcs8\" | \"pkcs1\" = \"pkcs1\",\n  ): string {\n    let privateKeyObject: PrivateKeyPKCS1;\n\n    /* Parse the incoming private key and convert it to a private key object */\n    switch (originalFormat) {\n      case \"raw\": {\n        if (typeof privateKey !== \"string\") {\n          throw new Error(\"private key must be a string\");\n        }\n        const keyPair = this.options.curve.keyFromPrivate(privateKey, \"hex\");\n        const rawPublicKey = keyPair.getPublic(\"hex\");\n        privateKeyObject = this.privateKeyObject(privateKey, rawPublicKey);\n        break;\n      }\n      /* v8 ignore next -- @preserve */\n      case \"der\":\n        if (typeof privateKey === \"string\") {\n          privateKey = Buffer.from(privateKey, \"hex\");\n        }\n        privateKeyObject = ECPrivateKeyASN.decode(privateKey, \"der\");\n        break;\n      case \"pem\":\n        if (typeof privateKey !== \"string\") {\n          throw new Error(\"private key must be a string\");\n        }\n        privateKeyObject = ECPrivateKeyASN.decode(\n          privateKey,\n          \"pem\",\n          this.options.privatePEMOptions,\n        );\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid private key format\");\n    }\n\n    /* Export the private key object to the desired format */\n    switch (destinationFormat) {\n      case \"raw\":\n        if (destinationFormatType === \"pkcs1\") {\n          return privateKeyObject.privateKey.toString(\"hex\");\n        } else if (destinationFormatType === \"pkcs8\") {\n          return this.PKCS1toPKCS8(privateKeyObject).privateKey.privateKey.toString(\"hex\");\n        }\n        break;\n      case \"der\":\n        if (destinationFormatType === \"pkcs1\") {\n          return ECPrivateKeyASN.encode(privateKeyObject, \"der\").toString(\"hex\");\n        } else if (destinationFormatType === \"pkcs8\") {\n          return ECPrivateKey8ASN.encode(this.PKCS1toPKCS8(privateKeyObject), \"der\").toString(\n            \"hex\",\n          );\n        }\n        break;\n      case \"pem\":\n        if (destinationFormatType === \"pkcs1\") {\n          return ECPrivateKeyASN.encode(privateKeyObject, \"pem\", this.options.privatePEMOptions);\n        } else if (destinationFormatType === \"pkcs8\") {\n          return ECPrivateKey8ASN.encode(this.PKCS1toPKCS8(privateKeyObject), \"pem\", {\n            ...this.options.privatePEMOptions,\n            label: \"PRIVATE KEY\",\n          });\n        }\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid destination format for private key\");\n    }\n\n    throw new Error(\"unsupported destination format or type\");\n  }\n\n  encodePublic(\n    publicKey: string | Buffer,\n    originalFormat: KeyFormat,\n    destinationFormat: KeyFormat,\n  ): string {\n    // biome-ignore lint/suspicious/noImplicitAnyLet: melting pot object\n    let publicKeyObject;\n\n    switch (originalFormat) {\n      case \"raw\":\n        if (typeof publicKey !== \"string\") {\n          throw new Error(\"public key must be a string\");\n        }\n        publicKeyObject = this.publicKeyObject(publicKey);\n        break;\n      /* v8 ignore next -- @preserve */\n      case \"der\":\n        if (typeof publicKey === \"string\") {\n          publicKey = Buffer.from(publicKey, \"hex\");\n        }\n        publicKeyObject = SubjectPublicKeyInfoASN.decode(publicKey, \"der\");\n        break;\n      case \"pem\":\n        if (typeof publicKey !== \"string\") {\n          throw new Error(\"public key must be a string\");\n        }\n        publicKeyObject = SubjectPublicKeyInfoASN.decode(\n          publicKey,\n          \"pem\",\n          this.options.publicPEMOptions,\n        );\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid public key format\");\n    }\n\n    /* Export the private key object to the desired format */\n    switch (destinationFormat) {\n      case \"raw\":\n        return publicKeyObject.pub.data.toString(\"hex\");\n      case \"der\":\n        return SubjectPublicKeyInfoASN.encode(publicKeyObject, \"der\").toString(\"hex\");\n      case \"pem\":\n        return SubjectPublicKeyInfoASN.encode(\n          publicKeyObject,\n          \"pem\",\n          this.options.publicPEMOptions,\n        );\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid destination format for public key\");\n    }\n  }\n}\n/* cspell:enable */\n","import elliptic from \"elliptic\";\nimport * as jose from \"jose\";\n\nimport { KeyEncoder } from \"./key-encoder\";\nimport type { GeneratedKeys } from \"./types\";\nimport crypto from \"node:crypto\";\n\nfunction extractPublicKey(pemKey: string): string {\n  // convert the PEM formatted public key to raw public key in X9.62 uncompressed format\n  // this is an oversimplified method and may not work with different curves or PEM formats\n  const pem = pemKey.split(\"\\n\");\n  pem.shift(); // remove the first line (BEGIN PUBLIC KEY)\n  pem.pop(); // remove the last line (END PUBLIC KEY)\n  // convert base64 to buffer\n  const keyBuffer = Buffer.from(pem.join(\"\"), \"base64\");\n  // assuming the first 26 bytes are the header for the SPKI formatted key.\n  // the actual key should begin after this header.\n  const actualKeyBuffer = keyBuffer.slice(26);\n  return actualKeyBuffer.toString(\"hex\").toUpperCase();\n}\n\nfunction hexToPem(hexString: string, { isPrivate = true } = {}): string {\n  const keyEncoder = new KeyEncoder(\"p256\");\n  if (isPrivate) {\n    return keyEncoder.encodePrivate(hexString, \"raw\", \"pem\");\n  }\n  return keyEncoder.encodePublic(hexString, \"raw\", \"pem\");\n}\n\n/**\n * If `entropy` is passed, will generate keys pair deterministically\n * else, random keys pair generated\n */\nexport function genKeys(entropy?: string): GeneratedKeys {\n  if (entropy) {\n    const ec = new elliptic.ec(\"p256\");\n    const hashedEntropy = crypto.createHash(\"sha256\").update(entropy).digest(\"hex\");\n    const keyPair = ec.genKeyPair({\n      entropy: Buffer.from(hashedEntropy, \"hex\"),\n    });\n    return {\n      privateKey: String(hexToPem(keyPair.getPrivate(\"hex\"))),\n      publicKey: String(hexToPem(keyPair.getPublic(\"hex\"), { isPrivate: false })),\n      hexPubKey: extractPublicKey(String(hexToPem(keyPair.getPublic(\"hex\"), { isPrivate: false }))),\n    };\n  }\n  const { publicKey, privateKey } = crypto.generateKeyPairSync(\"ec\", {\n    namedCurve: \"P-256\",\n    publicKeyEncoding: { type: \"spki\", format: \"pem\" },\n    privateKeyEncoding: { type: \"sec1\", format: \"pem\" },\n  });\n  const hexPubKey = extractPublicKey(publicKey);\n  return {\n    privateKey,\n    publicKey,\n    hexPubKey,\n  };\n}\n\nexport const sign = async (privateKeyPem: string, base64Challenge: string): Promise<string> => {\n  // Decode base64url challenge to bytes\n  const challengeDataBytes = jose.base64url.decode(base64Challenge);\n\n  // For EC private key format, we need to use a different import method\n  // Since jose doesn't support SEC1 format directly, let's use Node.js crypto\n  // Create a KeyObject from the EC private key\n  const privateKey = crypto.createPrivateKey(privateKeyPem);\n\n  // Use jose with the KeyObject\n  return await new jose.CompactSign(challengeDataBytes)\n    .setProtectedHeader({ alg: \"ES256\", typ: \"JWT\" })\n    .sign(privateKey);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAeA,SAAgB,QAAQ,MAAc,OAAuB;AAG3D,QAAO,kBADS,OADF,IAAI,aAAa,CAAC,OAAO,GAAG,KAAK,GAAG,QAAQ,CAC7B,EACK,SAAS;;AAG7C,MAAM,kBAAkB,OAAO,MAAc,UAAuC;CAClF,MAAM,OAAO,MAAM,eAAe,QAAQ,MAAM,MAAM,CAAC;CAEvD,MAAM,WADU,MAAM,eAAe,KAAK,CACjB,OAAO,sBAAsB;AACtD,QAAO,OAAO,OAAO,CAAC,SAAS,YAAa,SAAS,UAAW,CAAC;;AAGnE,MAAa,gBAAgB,OAAO,SAAsC;CACxE,MAAM,YAAY,MAAM,QAAQ,IAAI;EAClC,gBAAgB,MAAM,EAAE;EACxB,gBAAgB,MAAM,EAAE;EACxB,gBAAgB,MAAM,EAAE;EACzB,CAAC;CAEF,MAAM,aAAa,IAAI,WAAW,UAAU,GAAG,OAAO;AACtD,MAAK,IAAI,IAAI,GAAG,IAAI,UAAU,GAAG,QAAQ,IACvC,YAAW,KAAK,UAAU,GAAG,KAAM,UAAU,GAAG,KAAM,UAAU,GAAG;AAGrE,QAAO;;;;ACzBT,MAAM,kBAAkB,KAAK,OAAO,gBAAgB,WAAY;CAG9D,MAAM,OAAO;AACb,MACG,KAAK,CACL,IACC,KAAK,IAAI,UAAU,CAAC,KAAK,EACzB,KAAK,IAAI,aAAa,CAAC,QAAQ,EAC/B,KAAK,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,UAAU,EACrD,KAAK,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,UAAU,CACtD;EACH;AAEF,MAAM,mBAAmB,KAAK;CAC5B;;CAEA,WAAY;EAGV,MAAM,OAAO;AACb,OACG,KAAK,CACL,IACC,KAAK,IAAI,UAAU,CAAC,KAAK,EACzB,KACG,IAAI,sBAAsB,CAC1B,KAAK,CACL,IAAI,KAAK,IAAI,cAAc,CAAC,OAAO,EAAE,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,EAClE,KAAK,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,gBAAgB,EACzD,KAAK,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,UAAU,CACvD;;CAEN;AAED,MAAM,0BAA0B,KAAK,OAAO,wBAAwB,WAAY;CAG9E,MAAM,OAAO;AACb,MACG,KAAK,CACL,IACC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,EAClF,KAAK,IAAI,MAAM,CAAC,QAAQ,CACzB;EACH;AASF,MAAM,SAAuC;CAC3C,WAAW;EACT,iBAAiB;GAAC;GAAG;GAAG;GAAK;GAAG;GAAG;EACnC,mBAAmB,EAAE,OAAO,kBAAkB;EAC9C,kBAAkB,EAAE,OAAO,cAAc;EACzC,OAAO,IAAI,SAAS,GAAG,YAAY;EACpC;CACD,MAAM;EACJ,iBAAiB;GAAC;GAAG;GAAG;GAAK;GAAO;GAAG;GAAG;GAAE;EAC5C,mBAAmB,EAAE,OAAO,kBAAkB;EAC9C,kBAAkB,EAAE,OAAO,cAAc;EACzC,OAAO,IAAI,SAAS,GAAG,OAAO;EAC/B;CACF;AAoBD,IAAa,aAAb,MAAwB;CACtB;CACA;CAEA,YAAY,SAAgC;;AAE1C,MAAI,OAAO,YAAY,UAAU;;AAE/B,OAAI,YAAY,eAAe,YAAY,OACzC,OAAM,IAAI,MAAM,iBAAiB,UAAU;AAE7C,aAAU,OAAO;;AAEnB,OAAK,UAAU;AACf,OAAK,cAAc;GAAC;GAAG;GAAG;GAAK;GAAO;GAAG;GAAE;;;CAI7C,aAAqB,YAA8C;AACjE,SAAO;GACL,SAAS,IAAI,GAAG,EAAE;GAClB;GACA,qBAAqB;IACnB,aAAa,KAAK;IAClB,OAAO,WAAW;IACnB;GACF;;CAGH,iBAAiB,eAAuB,cAAuC;EAC7E,MAAM,mBAAoC;GACxC,SAAS,IAAI,GAAG,EAAE;GAClB,YAAY,OAAO,KAAK,eAAe,MAAM;GAC7C,YAAY,KAAK,QAAQ;GAC1B;;AAGD,MAAI,aACF,kBAAiB,YAAY;GAC3B,QAAQ;GACR,MAAM,OAAO,KAAK,cAAc,MAAM;GACvC;AAGH,SAAO;;CAGT,gBAAgB,cAGd;AACA,SAAO;GACL,WAAW;IACT,IAAI,KAAK;IACT,OAAO,KAAK,QAAQ;IACrB;GACD,KAAK;IACH,QAAQ;IACR,MAAM,OAAO,KAAK,cAAc,MAAM;IACvC;GACF;;CAGH,cACE,YACA,gBACA,mBACA,wBAA2C,SACnC;EACR,IAAI;AAGJ,UAAQ,gBAAR;GACE,KAAK,OAAO;AACV,QAAI,OAAO,eAAe,SACxB,OAAM,IAAI,MAAM,+BAA+B;IAGjD,MAAM,eADU,KAAK,QAAQ,MAAM,eAAe,YAAY,MAAM,CACvC,UAAU,MAAM;AAC7C,uBAAmB,KAAK,iBAAiB,YAAY,aAAa;AAClE;;GAGF,KAAK;AACH,QAAI,OAAO,eAAe,SACxB,cAAa,OAAO,KAAK,YAAY,MAAM;AAE7C,uBAAmB,gBAAgB,OAAO,YAAY,MAAM;AAC5D;GACF,KAAK;AACH,QAAI,OAAO,eAAe,SACxB,OAAM,IAAI,MAAM,+BAA+B;AAEjD,uBAAmB,gBAAgB,OACjC,YACA,OACA,KAAK,QAAQ,kBACd;AACD;GAEF,QACE,OAAM,IAAI,MAAM,6BAA6B;;AAIjD,UAAQ,mBAAR;GACE,KAAK;AACH,QAAI,0BAA0B,QAC5B,QAAO,iBAAiB,WAAW,SAAS,MAAM;aACzC,0BAA0B,QACnC,QAAO,KAAK,aAAa,iBAAiB,CAAC,WAAW,WAAW,SAAS,MAAM;AAElF;GACF,KAAK;AACH,QAAI,0BAA0B,QAC5B,QAAO,gBAAgB,OAAO,kBAAkB,MAAM,CAAC,SAAS,MAAM;aAC7D,0BAA0B,QACnC,QAAO,iBAAiB,OAAO,KAAK,aAAa,iBAAiB,EAAE,MAAM,CAAC,SACzE,MACD;AAEH;GACF,KAAK;AACH,QAAI,0BAA0B,QAC5B,QAAO,gBAAgB,OAAO,kBAAkB,OAAO,KAAK,QAAQ,kBAAkB;aAC7E,0BAA0B,QACnC,QAAO,iBAAiB,OAAO,KAAK,aAAa,iBAAiB,EAAE,OAAO;KACzE,GAAG,KAAK,QAAQ;KAChB,OAAO;KACR,CAAC;AAEJ;GAEF,QACE,OAAM,IAAI,MAAM,6CAA6C;;AAGjE,QAAM,IAAI,MAAM,yCAAyC;;CAG3D,aACE,WACA,gBACA,mBACQ;EAER,IAAI;AAEJ,UAAQ,gBAAR;GACE,KAAK;AACH,QAAI,OAAO,cAAc,SACvB,OAAM,IAAI,MAAM,8BAA8B;AAEhD,sBAAkB,KAAK,gBAAgB,UAAU;AACjD;GAEF,KAAK;AACH,QAAI,OAAO,cAAc,SACvB,aAAY,OAAO,KAAK,WAAW,MAAM;AAE3C,sBAAkB,wBAAwB,OAAO,WAAW,MAAM;AAClE;GACF,KAAK;AACH,QAAI,OAAO,cAAc,SACvB,OAAM,IAAI,MAAM,8BAA8B;AAEhD,sBAAkB,wBAAwB,OACxC,WACA,OACA,KAAK,QAAQ,iBACd;AACD;GAEF,QACE,OAAM,IAAI,MAAM,4BAA4B;;AAIhD,UAAQ,mBAAR;GACE,KAAK,MACH,QAAO,gBAAgB,IAAI,KAAK,SAAS,MAAM;GACjD,KAAK,MACH,QAAO,wBAAwB,OAAO,iBAAiB,MAAM,CAAC,SAAS,MAAM;GAC/E,KAAK,MACH,QAAO,wBAAwB,OAC7B,iBACA,OACA,KAAK,QAAQ,iBACd;GAEH,QACE,OAAM,IAAI,MAAM,4CAA4C;;;;;;AC9RpE,SAAS,iBAAiB,QAAwB;CAGhD,MAAM,MAAM,OAAO,MAAM,KAAK;AAC9B,KAAI,OAAO;AACX,KAAI,KAAK;AAMT,QAJkB,OAAO,KAAK,IAAI,KAAK,GAAG,EAAE,SAAS,CAGnB,MAAM,GAAG,CACpB,SAAS,MAAM,CAAC,aAAa;;AAGtD,SAAS,SAAS,WAAmB,EAAE,YAAY,SAAS,EAAE,EAAU;CACtE,MAAM,aAAa,IAAI,WAAW,OAAO;AACzC,KAAI,UACF,QAAO,WAAW,cAAc,WAAW,OAAO,MAAM;AAE1D,QAAO,WAAW,aAAa,WAAW,OAAO,MAAM;;;;;;AAOzD,SAAgB,QAAQ,SAAiC;AACvD,KAAI,SAAS;EACX,MAAM,KAAK,IAAI,SAAS,GAAG,OAAO;EAClC,MAAM,gBAAgB,OAAO,WAAW,SAAS,CAAC,OAAO,QAAQ,CAAC,OAAO,MAAM;EAC/E,MAAM,UAAU,GAAG,WAAW,EAC5B,SAAS,OAAO,KAAK,eAAe,MAAM,EAC3C,CAAC;AACF,SAAO;GACL,YAAY,OAAO,SAAS,QAAQ,WAAW,MAAM,CAAC,CAAC;GACvD,WAAW,OAAO,SAAS,QAAQ,UAAU,MAAM,EAAE,EAAE,WAAW,OAAO,CAAC,CAAC;GAC3E,WAAW,iBAAiB,OAAO,SAAS,QAAQ,UAAU,MAAM,EAAE,EAAE,WAAW,OAAO,CAAC,CAAC,CAAC;GAC9F;;CAEH,MAAM,EAAE,WAAW,eAAe,OAAO,oBAAoB,MAAM;EACjE,YAAY;EACZ,mBAAmB;GAAE,MAAM;GAAQ,QAAQ;GAAO;EAClD,oBAAoB;GAAE,MAAM;GAAQ,QAAQ;GAAO;EACpD,CAAC;AAEF,QAAO;EACL;EACA;EACA,WAJgB,iBAAiB,UAAU;EAK5C;;AAGH,MAAa,OAAO,OAAO,eAAuB,oBAA6C;CAE7F,MAAM,qBAAqB,KAAK,UAAU,OAAO,gBAAgB;CAKjE,MAAM,aAAa,OAAO,iBAAiB,cAAc;AAGzD,QAAO,MAAM,IAAI,KAAK,YAAY,mBAAmB,CAClD,mBAAmB;EAAE,KAAK;EAAS,KAAK;EAAO,CAAC,CAChD,KAAK,WAAW"}
+{"version":3,"file":"crypto-BHYSptBe.js","names":[],"sources":["../src/crypto/gen-seed.ts","../src/crypto/key-encoder.ts","../src/crypto/utils.ts"],"sourcesContent":["import { sha256 } from \"@noble/hashes/sha2.js\";\nimport { HDKey } from \"@scure/bip32\";\nimport { entropyToMnemonic, mnemonicToSeed } from \"@scure/bip39\";\nimport { wordlist } from \"@scure/bip39/wordlists/english.js\";\n\n/**\n * Generate a deterministic BIP39 mnemonic from a salt and device index.\n *\n * Produces `entropyToMnemonic(SHA256(salt + \"_\" + index))`, matching\n * the behavior of `@ledgerhq/vault-common`'s `genSeed`.\n *\n * @param salt  The workspace salt\n * @param index The device index (1-based)\n * @returns A 24-word BIP39 mnemonic string\n */\nexport function genSeed(salt: string, index: number): string {\n  const input = new TextEncoder().encode(`${salt}_${index}`);\n  const entropy = sha256(input);\n  return entropyToMnemonic(entropy, wordlist);\n}\n\nconst getSeedFragment = async (salt: string, index: number): Promise<Uint8Array> => {\n  const seed = await mnemonicToSeed(genSeed(salt, index));\n  const secpKey = HDKey.fromMasterSeed(seed);\n  const fragment = secpKey.derive(\"m/5655636'/4932953'\");\n  return Buffer.concat([fragment.privateKey!, fragment.chainCode!]);\n};\n\nexport const getMasterSeed = async (salt: string): Promise<Uint8Array> => {\n  const fragments = await Promise.all([\n    getSeedFragment(salt, 7),\n    getSeedFragment(salt, 8),\n    getSeedFragment(salt, 9),\n  ]);\n\n  const masterSeed = new Uint8Array(fragments[0].length);\n  for (let i = 0; i < fragments[0].length; i++) {\n    masterSeed[i] = fragments[0][i]! ^ fragments[1][i]! ^ fragments[2][i]!;\n  }\n\n  return masterSeed;\n};\n","// ========================================================================== //\n//                                                                            //\n//                                 DISCLAIMER                                 //\n//                                                                            //\n//                This code has been blindly copy-pasted from:                //\n//                    https://github.com/LedgerHQ/pkey-ts                     //\n//                                                                            //\n// ========================================================================== //\n//\n// @ts-expect-error this library does not ship types\nimport asn1 from \"asn1.js\";\nimport BN from \"bn.js\";\nimport elliptic from \"elliptic\";\n\n/* cspell:disable */\nconst ECPrivateKeyASN = asn1.define(\"ECPrivateKey\", function () {\n  // @ts-expect-error pure black box\n  // biome-ignore lint/suspicious/noExplicitAny: black box\n  const self = this as any;\n  self\n    .seq()\n    .obj(\n      self.key(\"version\").int(),\n      self.key(\"privateKey\").octstr(),\n      self.key(\"parameters\").explicit(0).objid().optional(),\n      self.key(\"publicKey\").explicit(1).bitstr().optional(),\n    );\n});\n\nconst ECPrivateKey8ASN = asn1.define(\n  \"ECPrivateKey\",\n  /* v8 ignore next -- @preserve */\n  function () {\n    // @ts-expect-error pure black box\n    // biome-ignore lint/suspicious/noExplicitAny: black box\n    const self = this as any;\n    self\n      .seq()\n      .obj(\n        self.key(\"version\").int(),\n        self\n          .key(\"privateKeyAlgorithm\")\n          .seq()\n          .obj(self.key(\"ecPublicKey\").objid(), self.key(\"curve\").objid()),\n        self.key(\"privateKey\").octstr().contains(ECPrivateKeyASN),\n        self.key(\"attributes\").explicit(0).bitstr().optional(),\n      );\n  },\n);\n\nconst SubjectPublicKeyInfoASN = asn1.define(\"SubjectPublicKeyInfo\", function () {\n  // @ts-expect-error pure black box\n  // biome-ignore lint/suspicious/noExplicitAny: black box\n  const self = this as any;\n  self\n    .seq()\n    .obj(\n      self.key(\"algorithm\").seq().obj(self.key(\"id\").objid(), self.key(\"curve\").objid()),\n      self.key(\"pub\").bitstr(),\n    );\n});\n\ntype CurveOptions = {\n  curveParameters: number[];\n  privatePEMOptions: { label: string };\n  publicPEMOptions: { label: string };\n  curve: elliptic.ec;\n};\n\nconst curves: Record<string, CurveOptions> = {\n  secp256k1: {\n    curveParameters: [1, 3, 132, 0, 10],\n    privatePEMOptions: { label: \"EC PRIVATE KEY\" },\n    publicPEMOptions: { label: \"PUBLIC KEY\" },\n    curve: new elliptic.ec(\"secp256k1\"),\n  },\n  p256: {\n    curveParameters: [1, 2, 840, 10045, 3, 1, 7], // OID for p256 curve\n    privatePEMOptions: { label: \"EC PRIVATE KEY\" },\n    publicPEMOptions: { label: \"PUBLIC KEY\" },\n    curve: new elliptic.ec(\"p256\"),\n  },\n};\n\ntype PrivateKeyPKCS1 = {\n  version: BN;\n  privateKey: Buffer;\n  parameters: number[];\n  publicKey?: {\n    unused: number;\n    data: Buffer;\n  };\n};\n\ntype PrivateKeyPKCS8 = {\n  version: BN;\n  privateKey: PrivateKeyPKCS1;\n  privateKeyAlgorithm: { ecPublicKey: number[]; curve: number[] };\n};\n\nexport type KeyFormat = \"raw\" | \"pem\" | \"der\";\n\nexport class KeyEncoder {\n  algorithmID: number[];\n  options: CurveOptions;\n\n  constructor(options: string | CurveOptions) {\n    /* v8 ignore else -- @preserve */\n    if (typeof options === \"string\") {\n      /* v8 ignore if -- @preserve */\n      if (options !== \"secp256k1\" && options !== \"p256\") {\n        throw new Error(`Unknown curve ${options}`);\n      }\n      options = curves[options]!;\n    }\n    this.options = options;\n    this.algorithmID = [1, 2, 840, 10045, 2, 1];\n  }\n\n  /* v8 ignore next -- @preserve */\n  private PKCS1toPKCS8(privateKey: PrivateKeyPKCS1): PrivateKeyPKCS8 {\n    return {\n      version: new BN(0),\n      privateKey,\n      privateKeyAlgorithm: {\n        ecPublicKey: this.algorithmID,\n        curve: privateKey.parameters,\n      },\n    };\n  }\n\n  privateKeyObject(rawPrivateKey: string, rawPublicKey: string): PrivateKeyPKCS1 {\n    const privateKeyObject: PrivateKeyPKCS1 = {\n      version: new BN(1),\n      privateKey: Buffer.from(rawPrivateKey, \"hex\"),\n      parameters: this.options.curveParameters,\n    };\n\n    /* v8 ignore else -- @preserve */\n    if (rawPublicKey) {\n      privateKeyObject.publicKey = {\n        unused: 0,\n        data: Buffer.from(rawPublicKey, \"hex\"),\n      };\n    }\n\n    return privateKeyObject;\n  }\n\n  publicKeyObject(rawPublicKey: string): {\n    algorithm: { id: number[]; curve: number[] };\n    pub: { unused: number; data: Buffer };\n  } {\n    return {\n      algorithm: {\n        id: this.algorithmID,\n        curve: this.options.curveParameters,\n      },\n      pub: {\n        unused: 0,\n        data: Buffer.from(rawPublicKey, \"hex\"),\n      },\n    };\n  }\n\n  encodePrivate(\n    privateKey: string | Buffer,\n    originalFormat: KeyFormat,\n    destinationFormat: KeyFormat,\n    destinationFormatType: \"pkcs8\" | \"pkcs1\" = \"pkcs1\",\n  ): string {\n    let privateKeyObject: PrivateKeyPKCS1;\n\n    /* Parse the incoming private key and convert it to a private key object */\n    switch (originalFormat) {\n      case \"raw\": {\n        if (typeof privateKey !== \"string\") {\n          throw new Error(\"private key must be a string\");\n        }\n        const keyPair = this.options.curve.keyFromPrivate(privateKey, \"hex\");\n        const rawPublicKey = keyPair.getPublic(\"hex\");\n        privateKeyObject = this.privateKeyObject(privateKey, rawPublicKey);\n        break;\n      }\n      /* v8 ignore next -- @preserve */\n      case \"der\":\n        if (typeof privateKey === \"string\") {\n          privateKey = Buffer.from(privateKey, \"hex\");\n        }\n        privateKeyObject = ECPrivateKeyASN.decode(privateKey, \"der\");\n        break;\n      case \"pem\":\n        if (typeof privateKey !== \"string\") {\n          throw new Error(\"private key must be a string\");\n        }\n        privateKeyObject = ECPrivateKeyASN.decode(\n          privateKey,\n          \"pem\",\n          this.options.privatePEMOptions,\n        );\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid private key format\");\n    }\n\n    /* Export the private key object to the desired format */\n    switch (destinationFormat) {\n      case \"raw\":\n        if (destinationFormatType === \"pkcs1\") {\n          return privateKeyObject.privateKey.toString(\"hex\");\n        } else if (destinationFormatType === \"pkcs8\") {\n          return this.PKCS1toPKCS8(privateKeyObject).privateKey.privateKey.toString(\"hex\");\n        }\n        break;\n      case \"der\":\n        if (destinationFormatType === \"pkcs1\") {\n          return ECPrivateKeyASN.encode(privateKeyObject, \"der\").toString(\"hex\");\n        } else if (destinationFormatType === \"pkcs8\") {\n          return ECPrivateKey8ASN.encode(this.PKCS1toPKCS8(privateKeyObject), \"der\").toString(\n            \"hex\",\n          );\n        }\n        break;\n      case \"pem\":\n        if (destinationFormatType === \"pkcs1\") {\n          return ECPrivateKeyASN.encode(privateKeyObject, \"pem\", this.options.privatePEMOptions);\n        } else if (destinationFormatType === \"pkcs8\") {\n          return ECPrivateKey8ASN.encode(this.PKCS1toPKCS8(privateKeyObject), \"pem\", {\n            ...this.options.privatePEMOptions,\n            label: \"PRIVATE KEY\",\n          });\n        }\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid destination format for private key\");\n    }\n\n    throw new Error(\"unsupported destination format or type\");\n  }\n\n  encodePublic(\n    publicKey: string | Buffer,\n    originalFormat: KeyFormat,\n    destinationFormat: KeyFormat,\n  ): string {\n    // biome-ignore lint/suspicious/noImplicitAnyLet: melting pot object\n    let publicKeyObject;\n\n    switch (originalFormat) {\n      case \"raw\":\n        if (typeof publicKey !== \"string\") {\n          throw new Error(\"public key must be a string\");\n        }\n        publicKeyObject = this.publicKeyObject(publicKey);\n        break;\n      /* v8 ignore next -- @preserve */\n      case \"der\":\n        if (typeof publicKey === \"string\") {\n          publicKey = Buffer.from(publicKey, \"hex\");\n        }\n        publicKeyObject = SubjectPublicKeyInfoASN.decode(publicKey, \"der\");\n        break;\n      case \"pem\":\n        if (typeof publicKey !== \"string\") {\n          throw new Error(\"public key must be a string\");\n        }\n        publicKeyObject = SubjectPublicKeyInfoASN.decode(\n          publicKey,\n          \"pem\",\n          this.options.publicPEMOptions,\n        );\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid public key format\");\n    }\n\n    /* Export the private key object to the desired format */\n    switch (destinationFormat) {\n      case \"raw\":\n        return publicKeyObject.pub.data.toString(\"hex\");\n      case \"der\":\n        return SubjectPublicKeyInfoASN.encode(publicKeyObject, \"der\").toString(\"hex\");\n      case \"pem\":\n        return SubjectPublicKeyInfoASN.encode(\n          publicKeyObject,\n          \"pem\",\n          this.options.publicPEMOptions,\n        );\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid destination format for public key\");\n    }\n  }\n}\n/* cspell:enable */\n","import elliptic from \"elliptic\";\nimport * as jose from \"jose\";\n\nimport { KeyEncoder } from \"./key-encoder\";\nimport type { GeneratedKeys } from \"./types\";\nimport crypto from \"node:crypto\";\n\nfunction extractPublicKey(pemKey: string): string {\n  // convert the PEM formatted public key to raw public key in X9.62 uncompressed format\n  // this is an oversimplified method and may not work with different curves or PEM formats\n  const pem = pemKey.split(\"\\n\");\n  pem.shift(); // remove the first line (BEGIN PUBLIC KEY)\n  pem.pop(); // remove the last line (END PUBLIC KEY)\n  // convert base64 to buffer\n  const keyBuffer = Buffer.from(pem.join(\"\"), \"base64\");\n  // assuming the first 26 bytes are the header for the SPKI formatted key.\n  // the actual key should begin after this header.\n  const actualKeyBuffer = keyBuffer.slice(26);\n  return actualKeyBuffer.toString(\"hex\").toUpperCase();\n}\n\nfunction hexToPem(hexString: string, { isPrivate = true } = {}): string {\n  const keyEncoder = new KeyEncoder(\"p256\");\n  if (isPrivate) {\n    return keyEncoder.encodePrivate(hexString, \"raw\", \"pem\");\n  }\n  return keyEncoder.encodePublic(hexString, \"raw\", \"pem\");\n}\n\n/**\n * If `entropy` is passed, will generate keys pair deterministically\n * else, random keys pair generated\n */\nexport function genKeys(entropy?: string): GeneratedKeys {\n  if (entropy) {\n    const ec = new elliptic.ec(\"p256\");\n    const hashedEntropy = crypto.createHash(\"sha256\").update(entropy).digest(\"hex\");\n    const keyPair = ec.genKeyPair({\n      entropy: Buffer.from(hashedEntropy, \"hex\"),\n    });\n    return {\n      privateKey: String(hexToPem(keyPair.getPrivate(\"hex\"))),\n      publicKey: String(hexToPem(keyPair.getPublic(\"hex\"), { isPrivate: false })),\n      hexPubKey: extractPublicKey(String(hexToPem(keyPair.getPublic(\"hex\"), { isPrivate: false }))),\n    };\n  }\n  const { publicKey, privateKey } = crypto.generateKeyPairSync(\"ec\", {\n    namedCurve: \"P-256\",\n    publicKeyEncoding: { type: \"spki\", format: \"pem\" },\n    privateKeyEncoding: { type: \"sec1\", format: \"pem\" },\n  });\n  const hexPubKey = extractPublicKey(publicKey);\n  return {\n    privateKey,\n    publicKey,\n    hexPubKey,\n  };\n}\n\nexport const sign = async (privateKeyPem: string, base64Challenge: string): Promise<string> => {\n  // Decode base64url challenge to bytes\n  const challengeDataBytes = jose.base64url.decode(base64Challenge);\n\n  // For EC private key format, we need to use a different import method\n  // Since jose doesn't support SEC1 format directly, let's use Node.js crypto\n  // Create a KeyObject from the EC private key\n  const privateKey = crypto.createPrivateKey(privateKeyPem);\n\n  // Use jose with the KeyObject\n  return await new jose.CompactSign(challengeDataBytes)\n    .setProtectedHeader({ alg: \"ES256\", typ: \"JWT\" })\n    .sign(privateKey);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAeA,SAAgB,QAAQ,MAAc,OAAuB;CAG3D,OAAO,kBADS,OADF,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,KAAK,GAAG,OACvB,CACI,GAAG,QAAQ;AAC5C;AAEA,MAAM,kBAAkB,OAAO,MAAc,UAAuC;CAClF,MAAM,OAAO,MAAM,eAAe,QAAQ,MAAM,KAAK,CAAC;CAEtD,MAAM,WADU,MAAM,eAAe,IACd,CAAC,CAAC,OAAO,qBAAqB;CACrD,OAAO,OAAO,OAAO,CAAC,SAAS,YAAa,SAAS,SAAU,CAAC;AAClE;AAEA,MAAa,gBAAgB,OAAO,SAAsC;CACxE,MAAM,YAAY,MAAM,QAAQ,IAAI;EAClC,gBAAgB,MAAM,CAAC;EACvB,gBAAgB,MAAM,CAAC;EACvB,gBAAgB,MAAM,CAAC;CACzB,CAAC;CAED,MAAM,aAAa,IAAI,WAAW,UAAU,EAAE,CAAC,MAAM;CACrD,KAAK,IAAI,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC,QAAQ,KACvC,WAAW,KAAK,UAAU,EAAE,CAAC,KAAM,UAAU,EAAE,CAAC,KAAM,UAAU,EAAE,CAAC;CAGrE,OAAO;AACT;;;AC1BA,MAAM,kBAAkB,KAAK,OAAO,gBAAgB,WAAY;CAG9D,MAAM,OAAO;CACb,KACG,IAAI,CAAC,CACL,IACC,KAAK,IAAI,SAAS,CAAC,CAAC,IAAI,GACxB,KAAK,IAAI,YAAY,CAAC,CAAC,OAAO,GAC9B,KAAK,IAAI,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,GACpD,KAAK,IAAI,WAAW,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CACtD;AACJ,CAAC;AAED,MAAM,mBAAmB,KAAK;CAC5B;;CAEA,WAAY;EAGV,MAAM,OAAO;EACb,KACG,IAAI,CAAC,CACL,IACC,KAAK,IAAI,SAAS,CAAC,CAAC,IAAI,GACxB,KACG,IAAI,qBAAqB,CAAC,CAC1B,IAAI,CAAC,CACL,IAAI,KAAK,IAAI,aAAa,CAAC,CAAC,MAAM,GAAG,KAAK,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,GACjE,KAAK,IAAI,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,eAAe,GACxD,KAAK,IAAI,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CACvD;CACJ;AACF;AAEA,MAAM,0BAA0B,KAAK,OAAO,wBAAwB,WAAY;CAG9E,MAAM,OAAO;CACb,KACG,IAAI,CAAC,CACL,IACC,KAAK,IAAI,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,KAAK,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,GACjF,KAAK,IAAI,KAAK,CAAC,CAAC,OAAO,CACzB;AACJ,CAAC;AASD,MAAM,SAAuC;CAC3C,WAAW;EACT,iBAAiB;GAAC;GAAG;GAAG;GAAK;GAAG;EAAE;EAClC,mBAAmB,EAAE,OAAO,iBAAiB;EAC7C,kBAAkB,EAAE,OAAO,aAAa;EACxC,OAAO,IAAI,SAAS,GAAG,WAAW;CACpC;CACA,MAAM;EACJ,iBAAiB;GAAC;GAAG;GAAG;GAAK;GAAO;GAAG;GAAG;EAAC;EAC3C,mBAAmB,EAAE,OAAO,iBAAiB;EAC7C,kBAAkB,EAAE,OAAO,aAAa;EACxC,OAAO,IAAI,SAAS,GAAG,MAAM;CAC/B;AACF;AAoBA,IAAa,aAAb,MAAwB;CACtB;CACA;CAEA,YAAY,SAAgC;;EAE1C,IAAI,OAAO,YAAY,UAAU;;GAE/B,IAAI,YAAY,eAAe,YAAY,QACzC,MAAM,IAAI,MAAM,iBAAiB,SAAS;GAE5C,UAAU,OAAO;EACnB;EACA,KAAK,UAAU;EACf,KAAK,cAAc;GAAC;GAAG;GAAG;GAAK;GAAO;GAAG;EAAC;CAC5C;;CAGA,aAAqB,YAA8C;EACjE,OAAO;GACL,SAAS,IAAI,GAAG,CAAC;GACjB;GACA,qBAAqB;IACnB,aAAa,KAAK;IAClB,OAAO,WAAW;GACpB;EACF;CACF;CAEA,iBAAiB,eAAuB,cAAuC;EAC7E,MAAM,mBAAoC;GACxC,SAAS,IAAI,GAAG,CAAC;GACjB,YAAY,OAAO,KAAK,eAAe,KAAK;GAC5C,YAAY,KAAK,QAAQ;EAC3B;;EAGA,IAAI,cACF,iBAAiB,YAAY;GAC3B,QAAQ;GACR,MAAM,OAAO,KAAK,cAAc,KAAK;EACvC;EAGF,OAAO;CACT;CAEA,gBAAgB,cAGd;EACA,OAAO;GACL,WAAW;IACT,IAAI,KAAK;IACT,OAAO,KAAK,QAAQ;GACtB;GACA,KAAK;IACH,QAAQ;IACR,MAAM,OAAO,KAAK,cAAc,KAAK;GACvC;EACF;CACF;CAEA,cACE,YACA,gBACA,mBACA,wBAA2C,SACnC;EACR,IAAI;EAGJ,QAAQ,gBAAR;GACE,KAAK,OAAO;IACV,IAAI,OAAO,eAAe,UACxB,MAAM,IAAI,MAAM,8BAA8B;IAGhD,MAAM,eADU,KAAK,QAAQ,MAAM,eAAe,YAAY,KACnC,CAAC,CAAC,UAAU,KAAK;IAC5C,mBAAmB,KAAK,iBAAiB,YAAY,YAAY;IACjE;GACF;;GAEA,KAAK;IACH,IAAI,OAAO,eAAe,UACxB,aAAa,OAAO,KAAK,YAAY,KAAK;IAE5C,mBAAmB,gBAAgB,OAAO,YAAY,KAAK;IAC3D;GACF,KAAK;IACH,IAAI,OAAO,eAAe,UACxB,MAAM,IAAI,MAAM,8BAA8B;IAEhD,mBAAmB,gBAAgB,OACjC,YACA,OACA,KAAK,QAAQ,iBACf;IACA;;GAEF,SACE,MAAM,IAAI,MAAM,4BAA4B;EAChD;EAGA,QAAQ,mBAAR;GACE,KAAK;IACH,IAAI,0BAA0B,SAC5B,OAAO,iBAAiB,WAAW,SAAS,KAAK;SAC5C,IAAI,0BAA0B,SACnC,OAAO,KAAK,aAAa,gBAAgB,CAAC,CAAC,WAAW,WAAW,SAAS,KAAK;IAEjF;GACF,KAAK;IACH,IAAI,0BAA0B,SAC5B,OAAO,gBAAgB,OAAO,kBAAkB,KAAK,CAAC,CAAC,SAAS,KAAK;SAChE,IAAI,0BAA0B,SACnC,OAAO,iBAAiB,OAAO,KAAK,aAAa,gBAAgB,GAAG,KAAK,CAAC,CAAC,SACzE,KACF;IAEF;GACF,KAAK;IACH,IAAI,0BAA0B,SAC5B,OAAO,gBAAgB,OAAO,kBAAkB,OAAO,KAAK,QAAQ,iBAAiB;SAChF,IAAI,0BAA0B,SACnC,OAAO,iBAAiB,OAAO,KAAK,aAAa,gBAAgB,GAAG,OAAO;KACzE,GAAG,KAAK,QAAQ;KAChB,OAAO;IACT,CAAC;IAEH;;GAEF,SACE,MAAM,IAAI,MAAM,4CAA4C;EAChE;EAEA,MAAM,IAAI,MAAM,wCAAwC;CAC1D;CAEA,aACE,WACA,gBACA,mBACQ;EAER,IAAI;EAEJ,QAAQ,gBAAR;GACE,KAAK;IACH,IAAI,OAAO,cAAc,UACvB,MAAM,IAAI,MAAM,6BAA6B;IAE/C,kBAAkB,KAAK,gBAAgB,SAAS;IAChD;;GAEF,KAAK;IACH,IAAI,OAAO,cAAc,UACvB,YAAY,OAAO,KAAK,WAAW,KAAK;IAE1C,kBAAkB,wBAAwB,OAAO,WAAW,KAAK;IACjE;GACF,KAAK;IACH,IAAI,OAAO,cAAc,UACvB,MAAM,IAAI,MAAM,6BAA6B;IAE/C,kBAAkB,wBAAwB,OACxC,WACA,OACA,KAAK,QAAQ,gBACf;IACA;;GAEF,SACE,MAAM,IAAI,MAAM,2BAA2B;EAC/C;EAGA,QAAQ,mBAAR;GACE,KAAK,OACH,OAAO,gBAAgB,IAAI,KAAK,SAAS,KAAK;GAChD,KAAK,OACH,OAAO,wBAAwB,OAAO,iBAAiB,KAAK,CAAC,CAAC,SAAS,KAAK;GAC9E,KAAK,OACH,OAAO,wBAAwB,OAC7B,iBACA,OACA,KAAK,QAAQ,gBACf;;GAEF,SACE,MAAM,IAAI,MAAM,2CAA2C;EAC/D;CACF;AACF;;;ACjSA,SAAS,iBAAiB,QAAwB;CAGhD,MAAM,MAAM,OAAO,MAAM,IAAI;CAC7B,IAAI,MAAM;CACV,IAAI,IAAI;CAMR,OAJkB,OAAO,KAAK,IAAI,KAAK,EAAE,GAAG,QAGZ,CAAC,CAAC,MAAM,EACnB,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,YAAY;AACrD;AAEA,SAAS,SAAS,WAAmB,EAAE,YAAY,SAAS,CAAC,GAAW;CACtE,MAAM,aAAa,IAAI,WAAW,MAAM;CACxC,IAAI,WACF,OAAO,WAAW,cAAc,WAAW,OAAO,KAAK;CAEzD,OAAO,WAAW,aAAa,WAAW,OAAO,KAAK;AACxD;;;;;AAMA,SAAgB,QAAQ,SAAiC;CACvD,IAAI,SAAS;EACX,MAAM,KAAK,IAAI,SAAS,GAAG,MAAM;EACjC,MAAM,gBAAgB,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK;EAC9E,MAAM,UAAU,GAAG,WAAW,EAC5B,SAAS,OAAO,KAAK,eAAe,KAAK,EAC3C,CAAC;EACD,OAAO;GACL,YAAY,OAAO,SAAS,QAAQ,WAAW,KAAK,CAAC,CAAC;GACtD,WAAW,OAAO,SAAS,QAAQ,UAAU,KAAK,GAAG,EAAE,WAAW,MAAM,CAAC,CAAC;GAC1E,WAAW,iBAAiB,OAAO,SAAS,QAAQ,UAAU,KAAK,GAAG,EAAE,WAAW,MAAM,CAAC,CAAC,CAAC;EAC9F;CACF;CACA,MAAM,EAAE,WAAW,eAAe,OAAO,oBAAoB,MAAM;EACjE,YAAY;EACZ,mBAAmB;GAAE,MAAM;GAAQ,QAAQ;EAAM;EACjD,oBAAoB;GAAE,MAAM;GAAQ,QAAQ;EAAM;CACpD,CAAC;CAED,OAAO;EACL;EACA;EACA,WAJgB,iBAAiB,SAIzB;CACV;AACF;AAEA,MAAa,OAAO,OAAO,eAAuB,oBAA6C;CAE7F,MAAM,qBAAqB,KAAK,UAAU,OAAO,eAAe;CAKhE,MAAM,aAAa,OAAO,iBAAiB,aAAa;CAGxD,OAAO,MAAM,IAAI,KAAK,YAAY,kBAAkB,CAAC,CAClD,mBAAmB;EAAE,KAAK;EAAS,KAAK;CAAM,CAAC,CAAC,CAChD,KAAK,UAAU;AACpB"}

package/lib/{crypto-rlKUKWhL.cjs → crypto-C2vNZ2v5.cjs}

@@ -1,18 +1,18 @@
-const require_chunk = require("./chunk-CKQMccvm.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-D6vf50IK.cjs");
 let _noble_hashes_sha2_js = require("@noble/hashes/sha2.js");
 let _scure_bip32 = require("@scure/bip32");
 let _scure_bip39 = require("@scure/bip39");
 let _scure_bip39_wordlists_english_js = require("@scure/bip39/wordlists/english.js");
 let elliptic = require("elliptic");
-elliptic = require_chunk.__toESM(elliptic);
+elliptic = require_rolldown_runtime.__toESM(elliptic, 1);
 let jose = require("jose");
-jose = require_chunk.__toESM(jose);
+jose = require_rolldown_runtime.__toESM(jose, 1);
 let asn1_js = require("asn1.js");
-asn1_js = require_chunk.__toESM(asn1_js);
+asn1_js = require_rolldown_runtime.__toESM(asn1_js, 1);
 let bn_js = require("bn.js");
-bn_js = require_chunk.__toESM(bn_js);
+bn_js = require_rolldown_runtime.__toESM(bn_js, 1);
 let node_crypto = require("node:crypto");
-node_crypto = require_chunk.__toESM(node_crypto);
+node_crypto = require_rolldown_runtime.__toESM(node_crypto, 1);
 //#region src/crypto/gen-seed.ts
 /**
 * Generate a deterministic BIP39 mnemonic from a salt and device index.
@@ -153,6 +153,7 @@ var KeyEncoder = class {
 				privateKeyObject = this.privateKeyObject(privateKey, rawPublicKey);
 				break;
 			}
+			/* v8 ignore next -- @preserve */
 			case "der":
 				if (typeof privateKey === "string") privateKey = Buffer.from(privateKey, "hex");
 				privateKeyObject = ECPrivateKeyASN.decode(privateKey, "der");
@@ -161,6 +162,7 @@ var KeyEncoder = class {
 				if (typeof privateKey !== "string") throw new Error("private key must be a string");
 				privateKeyObject = ECPrivateKeyASN.decode(privateKey, "pem", this.options.privatePEMOptions);
 				break;
+			/* v8 ignore next -- @preserve */
 			default: throw new Error("invalid private key format");
 		}
 		switch (destinationFormat) {
@@ -179,6 +181,7 @@ var KeyEncoder = class {
 					label: "PRIVATE KEY"
 				});
 				break;
+			/* v8 ignore next -- @preserve */
 			default: throw new Error("invalid destination format for private key");
 		}
 		throw new Error("unsupported destination format or type");
@@ -190,6 +193,7 @@ var KeyEncoder = class {
 				if (typeof publicKey !== "string") throw new Error("public key must be a string");
 				publicKeyObject = this.publicKeyObject(publicKey);
 				break;
+			/* v8 ignore next -- @preserve */
 			case "der":
 				if (typeof publicKey === "string") publicKey = Buffer.from(publicKey, "hex");
 				publicKeyObject = SubjectPublicKeyInfoASN.decode(publicKey, "der");
@@ -198,12 +202,14 @@ var KeyEncoder = class {
 				if (typeof publicKey !== "string") throw new Error("public key must be a string");
 				publicKeyObject = SubjectPublicKeyInfoASN.decode(publicKey, "pem", this.options.publicPEMOptions);
 				break;
+			/* v8 ignore next -- @preserve */
 			default: throw new Error("invalid public key format");
 		}
 		switch (destinationFormat) {
 			case "raw": return publicKeyObject.pub.data.toString("hex");
 			case "der": return SubjectPublicKeyInfoASN.encode(publicKeyObject, "der").toString("hex");
 			case "pem": return SubjectPublicKeyInfoASN.encode(publicKeyObject, "pem", this.options.publicPEMOptions);
+			/* v8 ignore next -- @preserve */
 			default: throw new Error("invalid destination format for public key");
 		}
 	}
@@ -286,3 +292,5 @@ Object.defineProperty(exports, "sign", {
 		return sign;
 	}
 });
+
+//# sourceMappingURL=crypto-C2vNZ2v5.cjs.map

package/lib/{crypto-rlKUKWhL.cjs.map → crypto-C2vNZ2v5.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"crypto-rlKUKWhL.cjs","names":["wordlist","HDKey","asn1","BN","crypto"],"sources":["../src/crypto/gen-seed.ts","../src/crypto/key-encoder.ts","../src/crypto/utils.ts"],"sourcesContent":["import { sha256 } from \"@noble/hashes/sha2.js\";\nimport { HDKey } from \"@scure/bip32\";\nimport { entropyToMnemonic, mnemonicToSeed } from \"@scure/bip39\";\nimport { wordlist } from \"@scure/bip39/wordlists/english.js\";\n\n/**\n * Generate a deterministic BIP39 mnemonic from a salt and device index.\n *\n * Produces `entropyToMnemonic(SHA256(salt + \"_\" + index))`, matching\n * the behavior of `@ledgerhq/vault-common`'s `genSeed`.\n *\n * @param salt  The workspace salt\n * @param index The device index (1-based)\n * @returns A 24-word BIP39 mnemonic string\n */\nexport function genSeed(salt: string, index: number): string {\n  const input = new TextEncoder().encode(`${salt}_${index}`);\n  const entropy = sha256(input);\n  return entropyToMnemonic(entropy, wordlist);\n}\n\nconst getSeedFragment = async (salt: string, index: number): Promise<Uint8Array> => {\n  const seed = await mnemonicToSeed(genSeed(salt, index));\n  const secpKey = HDKey.fromMasterSeed(seed);\n  const fragment = secpKey.derive(\"m/5655636'/4932953'\");\n  return Buffer.concat([fragment.privateKey!, fragment.chainCode!]);\n};\n\nexport const getMasterSeed = async (salt: string): Promise<Uint8Array> => {\n  const fragments = await Promise.all([\n    getSeedFragment(salt, 7),\n    getSeedFragment(salt, 8),\n    getSeedFragment(salt, 9),\n  ]);\n\n  const masterSeed = new Uint8Array(fragments[0].length);\n  for (let i = 0; i < fragments[0].length; i++) {\n    masterSeed[i] = fragments[0][i]! ^ fragments[1][i]! ^ fragments[2][i]!;\n  }\n\n  return masterSeed;\n};\n","// ========================================================================== //\n//                                                                            //\n//                                 DISCLAIMER                                 //\n//                                                                            //\n//                This code has been blindly copy-pasted from:                //\n//                    https://github.com/LedgerHQ/pkey-ts                     //\n//                                                                            //\n// ========================================================================== //\n//\n// @ts-expect-error this library does not ship types\nimport asn1 from \"asn1.js\";\nimport BN from \"bn.js\";\nimport elliptic from \"elliptic\";\n\n/* cspell:disable */\nconst ECPrivateKeyASN = asn1.define(\"ECPrivateKey\", function () {\n  // @ts-expect-error pure black box\n  // biome-ignore lint/suspicious/noExplicitAny: black box\n  const self = this as any;\n  self\n    .seq()\n    .obj(\n      self.key(\"version\").int(),\n      self.key(\"privateKey\").octstr(),\n      self.key(\"parameters\").explicit(0).objid().optional(),\n      self.key(\"publicKey\").explicit(1).bitstr().optional(),\n    );\n});\n\nconst ECPrivateKey8ASN = asn1.define(\n  \"ECPrivateKey\",\n  /* v8 ignore next -- @preserve */\n  function () {\n    // @ts-expect-error pure black box\n    // biome-ignore lint/suspicious/noExplicitAny: black box\n    const self = this as any;\n    self\n      .seq()\n      .obj(\n        self.key(\"version\").int(),\n        self\n          .key(\"privateKeyAlgorithm\")\n          .seq()\n          .obj(self.key(\"ecPublicKey\").objid(), self.key(\"curve\").objid()),\n        self.key(\"privateKey\").octstr().contains(ECPrivateKeyASN),\n        self.key(\"attributes\").explicit(0).bitstr().optional(),\n      );\n  },\n);\n\nconst SubjectPublicKeyInfoASN = asn1.define(\"SubjectPublicKeyInfo\", function () {\n  // @ts-expect-error pure black box\n  // biome-ignore lint/suspicious/noExplicitAny: black box\n  const self = this as any;\n  self\n    .seq()\n    .obj(\n      self.key(\"algorithm\").seq().obj(self.key(\"id\").objid(), self.key(\"curve\").objid()),\n      self.key(\"pub\").bitstr(),\n    );\n});\n\ntype CurveOptions = {\n  curveParameters: number[];\n  privatePEMOptions: { label: string };\n  publicPEMOptions: { label: string };\n  curve: elliptic.ec;\n};\n\nconst curves: Record<string, CurveOptions> = {\n  secp256k1: {\n    curveParameters: [1, 3, 132, 0, 10],\n    privatePEMOptions: { label: \"EC PRIVATE KEY\" },\n    publicPEMOptions: { label: \"PUBLIC KEY\" },\n    curve: new elliptic.ec(\"secp256k1\"),\n  },\n  p256: {\n    curveParameters: [1, 2, 840, 10045, 3, 1, 7], // OID for p256 curve\n    privatePEMOptions: { label: \"EC PRIVATE KEY\" },\n    publicPEMOptions: { label: \"PUBLIC KEY\" },\n    curve: new elliptic.ec(\"p256\"),\n  },\n};\n\ntype PrivateKeyPKCS1 = {\n  version: BN;\n  privateKey: Buffer;\n  parameters: number[];\n  publicKey?: {\n    unused: number;\n    data: Buffer;\n  };\n};\n\ntype PrivateKeyPKCS8 = {\n  version: BN;\n  privateKey: PrivateKeyPKCS1;\n  privateKeyAlgorithm: { ecPublicKey: number[]; curve: number[] };\n};\n\nexport type KeyFormat = \"raw\" | \"pem\" | \"der\";\n\nexport class KeyEncoder {\n  algorithmID: number[];\n  options: CurveOptions;\n\n  constructor(options: string | CurveOptions) {\n    /* v8 ignore else -- @preserve */\n    if (typeof options === \"string\") {\n      /* v8 ignore if -- @preserve */\n      if (options !== \"secp256k1\" && options !== \"p256\") {\n        throw new Error(`Unknown curve ${options}`);\n      }\n      options = curves[options]!;\n    }\n    this.options = options;\n    this.algorithmID = [1, 2, 840, 10045, 2, 1];\n  }\n\n  /* v8 ignore next -- @preserve */\n  private PKCS1toPKCS8(privateKey: PrivateKeyPKCS1): PrivateKeyPKCS8 {\n    return {\n      version: new BN(0),\n      privateKey,\n      privateKeyAlgorithm: {\n        ecPublicKey: this.algorithmID,\n        curve: privateKey.parameters,\n      },\n    };\n  }\n\n  privateKeyObject(rawPrivateKey: string, rawPublicKey: string): PrivateKeyPKCS1 {\n    const privateKeyObject: PrivateKeyPKCS1 = {\n      version: new BN(1),\n      privateKey: Buffer.from(rawPrivateKey, \"hex\"),\n      parameters: this.options.curveParameters,\n    };\n\n    /* v8 ignore else -- @preserve */\n    if (rawPublicKey) {\n      privateKeyObject.publicKey = {\n        unused: 0,\n        data: Buffer.from(rawPublicKey, \"hex\"),\n      };\n    }\n\n    return privateKeyObject;\n  }\n\n  publicKeyObject(rawPublicKey: string): {\n    algorithm: { id: number[]; curve: number[] };\n    pub: { unused: number; data: Buffer };\n  } {\n    return {\n      algorithm: {\n        id: this.algorithmID,\n        curve: this.options.curveParameters,\n      },\n      pub: {\n        unused: 0,\n        data: Buffer.from(rawPublicKey, \"hex\"),\n      },\n    };\n  }\n\n  encodePrivate(\n    privateKey: string | Buffer,\n    originalFormat: KeyFormat,\n    destinationFormat: KeyFormat,\n    destinationFormatType: \"pkcs8\" | \"pkcs1\" = \"pkcs1\",\n  ): string {\n    let privateKeyObject: PrivateKeyPKCS1;\n\n    /* Parse the incoming private key and convert it to a private key object */\n    switch (originalFormat) {\n      case \"raw\": {\n        if (typeof privateKey !== \"string\") {\n          throw new Error(\"private key must be a string\");\n        }\n        const keyPair = this.options.curve.keyFromPrivate(privateKey, \"hex\");\n        const rawPublicKey = keyPair.getPublic(\"hex\");\n        privateKeyObject = this.privateKeyObject(privateKey, rawPublicKey);\n        break;\n      }\n      /* v8 ignore next -- @preserve */\n      case \"der\":\n        if (typeof privateKey === \"string\") {\n          privateKey = Buffer.from(privateKey, \"hex\");\n        }\n        privateKeyObject = ECPrivateKeyASN.decode(privateKey, \"der\");\n        break;\n      case \"pem\":\n        if (typeof privateKey !== \"string\") {\n          throw new Error(\"private key must be a string\");\n        }\n        privateKeyObject = ECPrivateKeyASN.decode(\n          privateKey,\n          \"pem\",\n          this.options.privatePEMOptions,\n        );\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid private key format\");\n    }\n\n    /* Export the private key object to the desired format */\n    switch (destinationFormat) {\n      case \"raw\":\n        if (destinationFormatType === \"pkcs1\") {\n          return privateKeyObject.privateKey.toString(\"hex\");\n        } else if (destinationFormatType === \"pkcs8\") {\n          return this.PKCS1toPKCS8(privateKeyObject).privateKey.privateKey.toString(\"hex\");\n        }\n        break;\n      case \"der\":\n        if (destinationFormatType === \"pkcs1\") {\n          return ECPrivateKeyASN.encode(privateKeyObject, \"der\").toString(\"hex\");\n        } else if (destinationFormatType === \"pkcs8\") {\n          return ECPrivateKey8ASN.encode(this.PKCS1toPKCS8(privateKeyObject), \"der\").toString(\n            \"hex\",\n          );\n        }\n        break;\n      case \"pem\":\n        if (destinationFormatType === \"pkcs1\") {\n          return ECPrivateKeyASN.encode(privateKeyObject, \"pem\", this.options.privatePEMOptions);\n        } else if (destinationFormatType === \"pkcs8\") {\n          return ECPrivateKey8ASN.encode(this.PKCS1toPKCS8(privateKeyObject), \"pem\", {\n            ...this.options.privatePEMOptions,\n            label: \"PRIVATE KEY\",\n          });\n        }\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid destination format for private key\");\n    }\n\n    throw new Error(\"unsupported destination format or type\");\n  }\n\n  encodePublic(\n    publicKey: string | Buffer,\n    originalFormat: KeyFormat,\n    destinationFormat: KeyFormat,\n  ): string {\n    // biome-ignore lint/suspicious/noImplicitAnyLet: melting pot object\n    let publicKeyObject;\n\n    switch (originalFormat) {\n      case \"raw\":\n        if (typeof publicKey !== \"string\") {\n          throw new Error(\"public key must be a string\");\n        }\n        publicKeyObject = this.publicKeyObject(publicKey);\n        break;\n      /* v8 ignore next -- @preserve */\n      case \"der\":\n        if (typeof publicKey === \"string\") {\n          publicKey = Buffer.from(publicKey, \"hex\");\n        }\n        publicKeyObject = SubjectPublicKeyInfoASN.decode(publicKey, \"der\");\n        break;\n      case \"pem\":\n        if (typeof publicKey !== \"string\") {\n          throw new Error(\"public key must be a string\");\n        }\n        publicKeyObject = SubjectPublicKeyInfoASN.decode(\n          publicKey,\n          \"pem\",\n          this.options.publicPEMOptions,\n        );\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid public key format\");\n    }\n\n    /* Export the private key object to the desired format */\n    switch (destinationFormat) {\n      case \"raw\":\n        return publicKeyObject.pub.data.toString(\"hex\");\n      case \"der\":\n        return SubjectPublicKeyInfoASN.encode(publicKeyObject, \"der\").toString(\"hex\");\n      case \"pem\":\n        return SubjectPublicKeyInfoASN.encode(\n          publicKeyObject,\n          \"pem\",\n          this.options.publicPEMOptions,\n        );\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid destination format for public key\");\n    }\n  }\n}\n/* cspell:enable */\n","import elliptic from \"elliptic\";\nimport * as jose from \"jose\";\n\nimport { KeyEncoder } from \"./key-encoder\";\nimport type { GeneratedKeys } from \"./types\";\nimport crypto from \"node:crypto\";\n\nfunction extractPublicKey(pemKey: string): string {\n  // convert the PEM formatted public key to raw public key in X9.62 uncompressed format\n  // this is an oversimplified method and may not work with different curves or PEM formats\n  const pem = pemKey.split(\"\\n\");\n  pem.shift(); // remove the first line (BEGIN PUBLIC KEY)\n  pem.pop(); // remove the last line (END PUBLIC KEY)\n  // convert base64 to buffer\n  const keyBuffer = Buffer.from(pem.join(\"\"), \"base64\");\n  // assuming the first 26 bytes are the header for the SPKI formatted key.\n  // the actual key should begin after this header.\n  const actualKeyBuffer = keyBuffer.slice(26);\n  return actualKeyBuffer.toString(\"hex\").toUpperCase();\n}\n\nfunction hexToPem(hexString: string, { isPrivate = true } = {}): string {\n  const keyEncoder = new KeyEncoder(\"p256\");\n  if (isPrivate) {\n    return keyEncoder.encodePrivate(hexString, \"raw\", \"pem\");\n  }\n  return keyEncoder.encodePublic(hexString, \"raw\", \"pem\");\n}\n\n/**\n * If `entropy` is passed, will generate keys pair deterministically\n * else, random keys pair generated\n */\nexport function genKeys(entropy?: string): GeneratedKeys {\n  if (entropy) {\n    const ec = new elliptic.ec(\"p256\");\n    const hashedEntropy = crypto.createHash(\"sha256\").update(entropy).digest(\"hex\");\n    const keyPair = ec.genKeyPair({\n      entropy: Buffer.from(hashedEntropy, \"hex\"),\n    });\n    return {\n      privateKey: String(hexToPem(keyPair.getPrivate(\"hex\"))),\n      publicKey: String(hexToPem(keyPair.getPublic(\"hex\"), { isPrivate: false })),\n      hexPubKey: extractPublicKey(String(hexToPem(keyPair.getPublic(\"hex\"), { isPrivate: false }))),\n    };\n  }\n  const { publicKey, privateKey } = crypto.generateKeyPairSync(\"ec\", {\n    namedCurve: \"P-256\",\n    publicKeyEncoding: { type: \"spki\", format: \"pem\" },\n    privateKeyEncoding: { type: \"sec1\", format: \"pem\" },\n  });\n  const hexPubKey = extractPublicKey(publicKey);\n  return {\n    privateKey,\n    publicKey,\n    hexPubKey,\n  };\n}\n\nexport const sign = async (privateKeyPem: string, base64Challenge: string): Promise<string> => {\n  // Decode base64url challenge to bytes\n  const challengeDataBytes = jose.base64url.decode(base64Challenge);\n\n  // For EC private key format, we need to use a different import method\n  // Since jose doesn't support SEC1 format directly, let's use Node.js crypto\n  // Create a KeyObject from the EC private key\n  const privateKey = crypto.createPrivateKey(privateKeyPem);\n\n  // Use jose with the KeyObject\n  return await new jose.CompactSign(challengeDataBytes)\n    .setProtectedHeader({ alg: \"ES256\", typ: \"JWT\" })\n    .sign(privateKey);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,SAAgB,QAAQ,MAAc,OAAuB;AAG3D,SAAA,GAAA,aAAA,oBAAA,GAAA,sBAAA,QAFc,IAAI,aAAa,CAAC,OAAO,GAAG,KAAK,GAAG,QAAQ,CAC7B,EACKA,kCAAAA,SAAS;;AAG7C,MAAM,kBAAkB,OAAO,MAAc,UAAuC;CAClF,MAAM,OAAO,OAAA,GAAA,aAAA,gBAAqB,QAAQ,MAAM,MAAM,CAAC;CAEvD,MAAM,WADUC,aAAAA,MAAM,eAAe,KAAK,CACjB,OAAO,sBAAsB;AACtD,QAAO,OAAO,OAAO,CAAC,SAAS,YAAa,SAAS,UAAW,CAAC;;AAGnE,MAAa,gBAAgB,OAAO,SAAsC;CACxE,MAAM,YAAY,MAAM,QAAQ,IAAI;EAClC,gBAAgB,MAAM,EAAE;EACxB,gBAAgB,MAAM,EAAE;EACxB,gBAAgB,MAAM,EAAE;EACzB,CAAC;CAEF,MAAM,aAAa,IAAI,WAAW,UAAU,GAAG,OAAO;AACtD,MAAK,IAAI,IAAI,GAAG,IAAI,UAAU,GAAG,QAAQ,IACvC,YAAW,KAAK,UAAU,GAAG,KAAM,UAAU,GAAG,KAAM,UAAU,GAAG;AAGrE,QAAO;;;;ACzBT,MAAM,kBAAkBC,QAAAA,QAAK,OAAO,gBAAgB,WAAY;CAG9D,MAAM,OAAO;AACb,MACG,KAAK,CACL,IACC,KAAK,IAAI,UAAU,CAAC,KAAK,EACzB,KAAK,IAAI,aAAa,CAAC,QAAQ,EAC/B,KAAK,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,UAAU,EACrD,KAAK,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,UAAU,CACtD;EACH;AAEF,MAAM,mBAAmBA,QAAAA,QAAK;CAC5B;;CAEA,WAAY;EAGV,MAAM,OAAO;AACb,OACG,KAAK,CACL,IACC,KAAK,IAAI,UAAU,CAAC,KAAK,EACzB,KACG,IAAI,sBAAsB,CAC1B,KAAK,CACL,IAAI,KAAK,IAAI,cAAc,CAAC,OAAO,EAAE,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,EAClE,KAAK,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,gBAAgB,EACzD,KAAK,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,UAAU,CACvD;;CAEN;AAED,MAAM,0BAA0BA,QAAAA,QAAK,OAAO,wBAAwB,WAAY;CAG9E,MAAM,OAAO;AACb,MACG,KAAK,CACL,IACC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,EAClF,KAAK,IAAI,MAAM,CAAC,QAAQ,CACzB;EACH;AASF,MAAM,SAAuC;CAC3C,WAAW;EACT,iBAAiB;GAAC;GAAG;GAAG;GAAK;GAAG;GAAG;EACnC,mBAAmB,EAAE,OAAO,kBAAkB;EAC9C,kBAAkB,EAAE,OAAO,cAAc;EACzC,OAAO,IAAI,SAAA,QAAS,GAAG,YAAY;EACpC;CACD,MAAM;EACJ,iBAAiB;GAAC;GAAG;GAAG;GAAK;GAAO;GAAG;GAAG;GAAE;EAC5C,mBAAmB,EAAE,OAAO,kBAAkB;EAC9C,kBAAkB,EAAE,OAAO,cAAc;EACzC,OAAO,IAAI,SAAA,QAAS,GAAG,OAAO;EAC/B;CACF;AAoBD,IAAa,aAAb,MAAwB;CACtB;CACA;CAEA,YAAY,SAAgC;;AAE1C,MAAI,OAAO,YAAY,UAAU;;AAE/B,OAAI,YAAY,eAAe,YAAY,OACzC,OAAM,IAAI,MAAM,iBAAiB,UAAU;AAE7C,aAAU,OAAO;;AAEnB,OAAK,UAAU;AACf,OAAK,cAAc;GAAC;GAAG;GAAG;GAAK;GAAO;GAAG;GAAE;;;CAI7C,aAAqB,YAA8C;AACjE,SAAO;GACL,SAAS,IAAIC,MAAAA,QAAG,EAAE;GAClB;GACA,qBAAqB;IACnB,aAAa,KAAK;IAClB,OAAO,WAAW;IACnB;GACF;;CAGH,iBAAiB,eAAuB,cAAuC;EAC7E,MAAM,mBAAoC;GACxC,SAAS,IAAIA,MAAAA,QAAG,EAAE;GAClB,YAAY,OAAO,KAAK,eAAe,MAAM;GAC7C,YAAY,KAAK,QAAQ;GAC1B;;AAGD,MAAI,aACF,kBAAiB,YAAY;GAC3B,QAAQ;GACR,MAAM,OAAO,KAAK,cAAc,MAAM;GACvC;AAGH,SAAO;;CAGT,gBAAgB,cAGd;AACA,SAAO;GACL,WAAW;IACT,IAAI,KAAK;IACT,OAAO,KAAK,QAAQ;IACrB;GACD,KAAK;IACH,QAAQ;IACR,MAAM,OAAO,KAAK,cAAc,MAAM;IACvC;GACF;;CAGH,cACE,YACA,gBACA,mBACA,wBAA2C,SACnC;EACR,IAAI;AAGJ,UAAQ,gBAAR;GACE,KAAK,OAAO;AACV,QAAI,OAAO,eAAe,SACxB,OAAM,IAAI,MAAM,+BAA+B;IAGjD,MAAM,eADU,KAAK,QAAQ,MAAM,eAAe,YAAY,MAAM,CACvC,UAAU,MAAM;AAC7C,uBAAmB,KAAK,iBAAiB,YAAY,aAAa;AAClE;;GAGF,KAAK;AACH,QAAI,OAAO,eAAe,SACxB,cAAa,OAAO,KAAK,YAAY,MAAM;AAE7C,uBAAmB,gBAAgB,OAAO,YAAY,MAAM;AAC5D;GACF,KAAK;AACH,QAAI,OAAO,eAAe,SACxB,OAAM,IAAI,MAAM,+BAA+B;AAEjD,uBAAmB,gBAAgB,OACjC,YACA,OACA,KAAK,QAAQ,kBACd;AACD;GAEF,QACE,OAAM,IAAI,MAAM,6BAA6B;;AAIjD,UAAQ,mBAAR;GACE,KAAK;AACH,QAAI,0BAA0B,QAC5B,QAAO,iBAAiB,WAAW,SAAS,MAAM;aACzC,0BAA0B,QACnC,QAAO,KAAK,aAAa,iBAAiB,CAAC,WAAW,WAAW,SAAS,MAAM;AAElF;GACF,KAAK;AACH,QAAI,0BAA0B,QAC5B,QAAO,gBAAgB,OAAO,kBAAkB,MAAM,CAAC,SAAS,MAAM;aAC7D,0BAA0B,QACnC,QAAO,iBAAiB,OAAO,KAAK,aAAa,iBAAiB,EAAE,MAAM,CAAC,SACzE,MACD;AAEH;GACF,KAAK;AACH,QAAI,0BAA0B,QAC5B,QAAO,gBAAgB,OAAO,kBAAkB,OAAO,KAAK,QAAQ,kBAAkB;aAC7E,0BAA0B,QACnC,QAAO,iBAAiB,OAAO,KAAK,aAAa,iBAAiB,EAAE,OAAO;KACzE,GAAG,KAAK,QAAQ;KAChB,OAAO;KACR,CAAC;AAEJ;GAEF,QACE,OAAM,IAAI,MAAM,6CAA6C;;AAGjE,QAAM,IAAI,MAAM,yCAAyC;;CAG3D,aACE,WACA,gBACA,mBACQ;EAER,IAAI;AAEJ,UAAQ,gBAAR;GACE,KAAK;AACH,QAAI,OAAO,cAAc,SACvB,OAAM,IAAI,MAAM,8BAA8B;AAEhD,sBAAkB,KAAK,gBAAgB,UAAU;AACjD;GAEF,KAAK;AACH,QAAI,OAAO,cAAc,SACvB,aAAY,OAAO,KAAK,WAAW,MAAM;AAE3C,sBAAkB,wBAAwB,OAAO,WAAW,MAAM;AAClE;GACF,KAAK;AACH,QAAI,OAAO,cAAc,SACvB,OAAM,IAAI,MAAM,8BAA8B;AAEhD,sBAAkB,wBAAwB,OACxC,WACA,OACA,KAAK,QAAQ,iBACd;AACD;GAEF,QACE,OAAM,IAAI,MAAM,4BAA4B;;AAIhD,UAAQ,mBAAR;GACE,KAAK,MACH,QAAO,gBAAgB,IAAI,KAAK,SAAS,MAAM;GACjD,KAAK,MACH,QAAO,wBAAwB,OAAO,iBAAiB,MAAM,CAAC,SAAS,MAAM;GAC/E,KAAK,MACH,QAAO,wBAAwB,OAC7B,iBACA,OACA,KAAK,QAAQ,iBACd;GAEH,QACE,OAAM,IAAI,MAAM,4CAA4C;;;;;;AC9RpE,SAAS,iBAAiB,QAAwB;CAGhD,MAAM,MAAM,OAAO,MAAM,KAAK;AAC9B,KAAI,OAAO;AACX,KAAI,KAAK;AAMT,QAJkB,OAAO,KAAK,IAAI,KAAK,GAAG,EAAE,SAAS,CAGnB,MAAM,GAAG,CACpB,SAAS,MAAM,CAAC,aAAa;;AAGtD,SAAS,SAAS,WAAmB,EAAE,YAAY,SAAS,EAAE,EAAU;CACtE,MAAM,aAAa,IAAI,WAAW,OAAO;AACzC,KAAI,UACF,QAAO,WAAW,cAAc,WAAW,OAAO,MAAM;AAE1D,QAAO,WAAW,aAAa,WAAW,OAAO,MAAM;;;;;;AAOzD,SAAgB,QAAQ,SAAiC;AACvD,KAAI,SAAS;EACX,MAAM,KAAK,IAAI,SAAA,QAAS,GAAG,OAAO;EAClC,MAAM,gBAAgBC,YAAAA,QAAO,WAAW,SAAS,CAAC,OAAO,QAAQ,CAAC,OAAO,MAAM;EAC/E,MAAM,UAAU,GAAG,WAAW,EAC5B,SAAS,OAAO,KAAK,eAAe,MAAM,EAC3C,CAAC;AACF,SAAO;GACL,YAAY,OAAO,SAAS,QAAQ,WAAW,MAAM,CAAC,CAAC;GACvD,WAAW,OAAO,SAAS,QAAQ,UAAU,MAAM,EAAE,EAAE,WAAW,OAAO,CAAC,CAAC;GAC3E,WAAW,iBAAiB,OAAO,SAAS,QAAQ,UAAU,MAAM,EAAE,EAAE,WAAW,OAAO,CAAC,CAAC,CAAC;GAC9F;;CAEH,MAAM,EAAE,WAAW,eAAeA,YAAAA,QAAO,oBAAoB,MAAM;EACjE,YAAY;EACZ,mBAAmB;GAAE,MAAM;GAAQ,QAAQ;GAAO;EAClD,oBAAoB;GAAE,MAAM;GAAQ,QAAQ;GAAO;EACpD,CAAC;AAEF,QAAO;EACL;EACA;EACA,WAJgB,iBAAiB,UAAU;EAK5C;;AAGH,MAAa,OAAO,OAAO,eAAuB,oBAA6C;CAE7F,MAAM,qBAAqB,KAAK,UAAU,OAAO,gBAAgB;CAKjE,MAAM,aAAaA,YAAAA,QAAO,iBAAiB,cAAc;AAGzD,QAAO,MAAM,IAAI,KAAK,YAAY,mBAAmB,CAClD,mBAAmB;EAAE,KAAK;EAAS,KAAK;EAAO,CAAC,CAChD,KAAK,WAAW"}
+{"version":3,"file":"crypto-C2vNZ2v5.cjs","names":["wordlist","HDKey","asn1","BN","crypto"],"sources":["../src/crypto/gen-seed.ts","../src/crypto/key-encoder.ts","../src/crypto/utils.ts"],"sourcesContent":["import { sha256 } from \"@noble/hashes/sha2.js\";\nimport { HDKey } from \"@scure/bip32\";\nimport { entropyToMnemonic, mnemonicToSeed } from \"@scure/bip39\";\nimport { wordlist } from \"@scure/bip39/wordlists/english.js\";\n\n/**\n * Generate a deterministic BIP39 mnemonic from a salt and device index.\n *\n * Produces `entropyToMnemonic(SHA256(salt + \"_\" + index))`, matching\n * the behavior of `@ledgerhq/vault-common`'s `genSeed`.\n *\n * @param salt  The workspace salt\n * @param index The device index (1-based)\n * @returns A 24-word BIP39 mnemonic string\n */\nexport function genSeed(salt: string, index: number): string {\n  const input = new TextEncoder().encode(`${salt}_${index}`);\n  const entropy = sha256(input);\n  return entropyToMnemonic(entropy, wordlist);\n}\n\nconst getSeedFragment = async (salt: string, index: number): Promise<Uint8Array> => {\n  const seed = await mnemonicToSeed(genSeed(salt, index));\n  const secpKey = HDKey.fromMasterSeed(seed);\n  const fragment = secpKey.derive(\"m/5655636'/4932953'\");\n  return Buffer.concat([fragment.privateKey!, fragment.chainCode!]);\n};\n\nexport const getMasterSeed = async (salt: string): Promise<Uint8Array> => {\n  const fragments = await Promise.all([\n    getSeedFragment(salt, 7),\n    getSeedFragment(salt, 8),\n    getSeedFragment(salt, 9),\n  ]);\n\n  const masterSeed = new Uint8Array(fragments[0].length);\n  for (let i = 0; i < fragments[0].length; i++) {\n    masterSeed[i] = fragments[0][i]! ^ fragments[1][i]! ^ fragments[2][i]!;\n  }\n\n  return masterSeed;\n};\n","// ========================================================================== //\n//                                                                            //\n//                                 DISCLAIMER                                 //\n//                                                                            //\n//                This code has been blindly copy-pasted from:                //\n//                    https://github.com/LedgerHQ/pkey-ts                     //\n//                                                                            //\n// ========================================================================== //\n//\n// @ts-expect-error this library does not ship types\nimport asn1 from \"asn1.js\";\nimport BN from \"bn.js\";\nimport elliptic from \"elliptic\";\n\n/* cspell:disable */\nconst ECPrivateKeyASN = asn1.define(\"ECPrivateKey\", function () {\n  // @ts-expect-error pure black box\n  // biome-ignore lint/suspicious/noExplicitAny: black box\n  const self = this as any;\n  self\n    .seq()\n    .obj(\n      self.key(\"version\").int(),\n      self.key(\"privateKey\").octstr(),\n      self.key(\"parameters\").explicit(0).objid().optional(),\n      self.key(\"publicKey\").explicit(1).bitstr().optional(),\n    );\n});\n\nconst ECPrivateKey8ASN = asn1.define(\n  \"ECPrivateKey\",\n  /* v8 ignore next -- @preserve */\n  function () {\n    // @ts-expect-error pure black box\n    // biome-ignore lint/suspicious/noExplicitAny: black box\n    const self = this as any;\n    self\n      .seq()\n      .obj(\n        self.key(\"version\").int(),\n        self\n          .key(\"privateKeyAlgorithm\")\n          .seq()\n          .obj(self.key(\"ecPublicKey\").objid(), self.key(\"curve\").objid()),\n        self.key(\"privateKey\").octstr().contains(ECPrivateKeyASN),\n        self.key(\"attributes\").explicit(0).bitstr().optional(),\n      );\n  },\n);\n\nconst SubjectPublicKeyInfoASN = asn1.define(\"SubjectPublicKeyInfo\", function () {\n  // @ts-expect-error pure black box\n  // biome-ignore lint/suspicious/noExplicitAny: black box\n  const self = this as any;\n  self\n    .seq()\n    .obj(\n      self.key(\"algorithm\").seq().obj(self.key(\"id\").objid(), self.key(\"curve\").objid()),\n      self.key(\"pub\").bitstr(),\n    );\n});\n\ntype CurveOptions = {\n  curveParameters: number[];\n  privatePEMOptions: { label: string };\n  publicPEMOptions: { label: string };\n  curve: elliptic.ec;\n};\n\nconst curves: Record<string, CurveOptions> = {\n  secp256k1: {\n    curveParameters: [1, 3, 132, 0, 10],\n    privatePEMOptions: { label: \"EC PRIVATE KEY\" },\n    publicPEMOptions: { label: \"PUBLIC KEY\" },\n    curve: new elliptic.ec(\"secp256k1\"),\n  },\n  p256: {\n    curveParameters: [1, 2, 840, 10045, 3, 1, 7], // OID for p256 curve\n    privatePEMOptions: { label: \"EC PRIVATE KEY\" },\n    publicPEMOptions: { label: \"PUBLIC KEY\" },\n    curve: new elliptic.ec(\"p256\"),\n  },\n};\n\ntype PrivateKeyPKCS1 = {\n  version: BN;\n  privateKey: Buffer;\n  parameters: number[];\n  publicKey?: {\n    unused: number;\n    data: Buffer;\n  };\n};\n\ntype PrivateKeyPKCS8 = {\n  version: BN;\n  privateKey: PrivateKeyPKCS1;\n  privateKeyAlgorithm: { ecPublicKey: number[]; curve: number[] };\n};\n\nexport type KeyFormat = \"raw\" | \"pem\" | \"der\";\n\nexport class KeyEncoder {\n  algorithmID: number[];\n  options: CurveOptions;\n\n  constructor(options: string | CurveOptions) {\n    /* v8 ignore else -- @preserve */\n    if (typeof options === \"string\") {\n      /* v8 ignore if -- @preserve */\n      if (options !== \"secp256k1\" && options !== \"p256\") {\n        throw new Error(`Unknown curve ${options}`);\n      }\n      options = curves[options]!;\n    }\n    this.options = options;\n    this.algorithmID = [1, 2, 840, 10045, 2, 1];\n  }\n\n  /* v8 ignore next -- @preserve */\n  private PKCS1toPKCS8(privateKey: PrivateKeyPKCS1): PrivateKeyPKCS8 {\n    return {\n      version: new BN(0),\n      privateKey,\n      privateKeyAlgorithm: {\n        ecPublicKey: this.algorithmID,\n        curve: privateKey.parameters,\n      },\n    };\n  }\n\n  privateKeyObject(rawPrivateKey: string, rawPublicKey: string): PrivateKeyPKCS1 {\n    const privateKeyObject: PrivateKeyPKCS1 = {\n      version: new BN(1),\n      privateKey: Buffer.from(rawPrivateKey, \"hex\"),\n      parameters: this.options.curveParameters,\n    };\n\n    /* v8 ignore else -- @preserve */\n    if (rawPublicKey) {\n      privateKeyObject.publicKey = {\n        unused: 0,\n        data: Buffer.from(rawPublicKey, \"hex\"),\n      };\n    }\n\n    return privateKeyObject;\n  }\n\n  publicKeyObject(rawPublicKey: string): {\n    algorithm: { id: number[]; curve: number[] };\n    pub: { unused: number; data: Buffer };\n  } {\n    return {\n      algorithm: {\n        id: this.algorithmID,\n        curve: this.options.curveParameters,\n      },\n      pub: {\n        unused: 0,\n        data: Buffer.from(rawPublicKey, \"hex\"),\n      },\n    };\n  }\n\n  encodePrivate(\n    privateKey: string | Buffer,\n    originalFormat: KeyFormat,\n    destinationFormat: KeyFormat,\n    destinationFormatType: \"pkcs8\" | \"pkcs1\" = \"pkcs1\",\n  ): string {\n    let privateKeyObject: PrivateKeyPKCS1;\n\n    /* Parse the incoming private key and convert it to a private key object */\n    switch (originalFormat) {\n      case \"raw\": {\n        if (typeof privateKey !== \"string\") {\n          throw new Error(\"private key must be a string\");\n        }\n        const keyPair = this.options.curve.keyFromPrivate(privateKey, \"hex\");\n        const rawPublicKey = keyPair.getPublic(\"hex\");\n        privateKeyObject = this.privateKeyObject(privateKey, rawPublicKey);\n        break;\n      }\n      /* v8 ignore next -- @preserve */\n      case \"der\":\n        if (typeof privateKey === \"string\") {\n          privateKey = Buffer.from(privateKey, \"hex\");\n        }\n        privateKeyObject = ECPrivateKeyASN.decode(privateKey, \"der\");\n        break;\n      case \"pem\":\n        if (typeof privateKey !== \"string\") {\n          throw new Error(\"private key must be a string\");\n        }\n        privateKeyObject = ECPrivateKeyASN.decode(\n          privateKey,\n          \"pem\",\n          this.options.privatePEMOptions,\n        );\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid private key format\");\n    }\n\n    /* Export the private key object to the desired format */\n    switch (destinationFormat) {\n      case \"raw\":\n        if (destinationFormatType === \"pkcs1\") {\n          return privateKeyObject.privateKey.toString(\"hex\");\n        } else if (destinationFormatType === \"pkcs8\") {\n          return this.PKCS1toPKCS8(privateKeyObject).privateKey.privateKey.toString(\"hex\");\n        }\n        break;\n      case \"der\":\n        if (destinationFormatType === \"pkcs1\") {\n          return ECPrivateKeyASN.encode(privateKeyObject, \"der\").toString(\"hex\");\n        } else if (destinationFormatType === \"pkcs8\") {\n          return ECPrivateKey8ASN.encode(this.PKCS1toPKCS8(privateKeyObject), \"der\").toString(\n            \"hex\",\n          );\n        }\n        break;\n      case \"pem\":\n        if (destinationFormatType === \"pkcs1\") {\n          return ECPrivateKeyASN.encode(privateKeyObject, \"pem\", this.options.privatePEMOptions);\n        } else if (destinationFormatType === \"pkcs8\") {\n          return ECPrivateKey8ASN.encode(this.PKCS1toPKCS8(privateKeyObject), \"pem\", {\n            ...this.options.privatePEMOptions,\n            label: \"PRIVATE KEY\",\n          });\n        }\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid destination format for private key\");\n    }\n\n    throw new Error(\"unsupported destination format or type\");\n  }\n\n  encodePublic(\n    publicKey: string | Buffer,\n    originalFormat: KeyFormat,\n    destinationFormat: KeyFormat,\n  ): string {\n    // biome-ignore lint/suspicious/noImplicitAnyLet: melting pot object\n    let publicKeyObject;\n\n    switch (originalFormat) {\n      case \"raw\":\n        if (typeof publicKey !== \"string\") {\n          throw new Error(\"public key must be a string\");\n        }\n        publicKeyObject = this.publicKeyObject(publicKey);\n        break;\n      /* v8 ignore next -- @preserve */\n      case \"der\":\n        if (typeof publicKey === \"string\") {\n          publicKey = Buffer.from(publicKey, \"hex\");\n        }\n        publicKeyObject = SubjectPublicKeyInfoASN.decode(publicKey, \"der\");\n        break;\n      case \"pem\":\n        if (typeof publicKey !== \"string\") {\n          throw new Error(\"public key must be a string\");\n        }\n        publicKeyObject = SubjectPublicKeyInfoASN.decode(\n          publicKey,\n          \"pem\",\n          this.options.publicPEMOptions,\n        );\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid public key format\");\n    }\n\n    /* Export the private key object to the desired format */\n    switch (destinationFormat) {\n      case \"raw\":\n        return publicKeyObject.pub.data.toString(\"hex\");\n      case \"der\":\n        return SubjectPublicKeyInfoASN.encode(publicKeyObject, \"der\").toString(\"hex\");\n      case \"pem\":\n        return SubjectPublicKeyInfoASN.encode(\n          publicKeyObject,\n          \"pem\",\n          this.options.publicPEMOptions,\n        );\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid destination format for public key\");\n    }\n  }\n}\n/* cspell:enable */\n","import elliptic from \"elliptic\";\nimport * as jose from \"jose\";\n\nimport { KeyEncoder } from \"./key-encoder\";\nimport type { GeneratedKeys } from \"./types\";\nimport crypto from \"node:crypto\";\n\nfunction extractPublicKey(pemKey: string): string {\n  // convert the PEM formatted public key to raw public key in X9.62 uncompressed format\n  // this is an oversimplified method and may not work with different curves or PEM formats\n  const pem = pemKey.split(\"\\n\");\n  pem.shift(); // remove the first line (BEGIN PUBLIC KEY)\n  pem.pop(); // remove the last line (END PUBLIC KEY)\n  // convert base64 to buffer\n  const keyBuffer = Buffer.from(pem.join(\"\"), \"base64\");\n  // assuming the first 26 bytes are the header for the SPKI formatted key.\n  // the actual key should begin after this header.\n  const actualKeyBuffer = keyBuffer.slice(26);\n  return actualKeyBuffer.toString(\"hex\").toUpperCase();\n}\n\nfunction hexToPem(hexString: string, { isPrivate = true } = {}): string {\n  const keyEncoder = new KeyEncoder(\"p256\");\n  if (isPrivate) {\n    return keyEncoder.encodePrivate(hexString, \"raw\", \"pem\");\n  }\n  return keyEncoder.encodePublic(hexString, \"raw\", \"pem\");\n}\n\n/**\n * If `entropy` is passed, will generate keys pair deterministically\n * else, random keys pair generated\n */\nexport function genKeys(entropy?: string): GeneratedKeys {\n  if (entropy) {\n    const ec = new elliptic.ec(\"p256\");\n    const hashedEntropy = crypto.createHash(\"sha256\").update(entropy).digest(\"hex\");\n    const keyPair = ec.genKeyPair({\n      entropy: Buffer.from(hashedEntropy, \"hex\"),\n    });\n    return {\n      privateKey: String(hexToPem(keyPair.getPrivate(\"hex\"))),\n      publicKey: String(hexToPem(keyPair.getPublic(\"hex\"), { isPrivate: false })),\n      hexPubKey: extractPublicKey(String(hexToPem(keyPair.getPublic(\"hex\"), { isPrivate: false }))),\n    };\n  }\n  const { publicKey, privateKey } = crypto.generateKeyPairSync(\"ec\", {\n    namedCurve: \"P-256\",\n    publicKeyEncoding: { type: \"spki\", format: \"pem\" },\n    privateKeyEncoding: { type: \"sec1\", format: \"pem\" },\n  });\n  const hexPubKey = extractPublicKey(publicKey);\n  return {\n    privateKey,\n    publicKey,\n    hexPubKey,\n  };\n}\n\nexport const sign = async (privateKeyPem: string, base64Challenge: string): Promise<string> => {\n  // Decode base64url challenge to bytes\n  const challengeDataBytes = jose.base64url.decode(base64Challenge);\n\n  // For EC private key format, we need to use a different import method\n  // Since jose doesn't support SEC1 format directly, let's use Node.js crypto\n  // Create a KeyObject from the EC private key\n  const privateKey = crypto.createPrivateKey(privateKeyPem);\n\n  // Use jose with the KeyObject\n  return await new jose.CompactSign(challengeDataBytes)\n    .setProtectedHeader({ alg: \"ES256\", typ: \"JWT\" })\n    .sign(privateKey);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,SAAgB,QAAQ,MAAc,OAAuB;CAG3D,QAAA,GAAA,aAAA,kBAAA,EAAA,GAAA,sBAAA,OAAA,CAFc,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,KAAK,GAAG,OACvB,CACI,GAAGA,kCAAAA,QAAQ;AAC5C;AAEA,MAAM,kBAAkB,OAAO,MAAc,UAAuC;CAClF,MAAM,OAAO,OAAA,GAAA,aAAA,eAAA,CAAqB,QAAQ,MAAM,KAAK,CAAC;CAEtD,MAAM,WADUC,aAAAA,MAAM,eAAe,IACd,CAAC,CAAC,OAAO,qBAAqB;CACrD,OAAO,OAAO,OAAO,CAAC,SAAS,YAAa,SAAS,SAAU,CAAC;AAClE;AAEA,MAAa,gBAAgB,OAAO,SAAsC;CACxE,MAAM,YAAY,MAAM,QAAQ,IAAI;EAClC,gBAAgB,MAAM,CAAC;EACvB,gBAAgB,MAAM,CAAC;EACvB,gBAAgB,MAAM,CAAC;CACzB,CAAC;CAED,MAAM,aAAa,IAAI,WAAW,UAAU,EAAE,CAAC,MAAM;CACrD,KAAK,IAAI,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC,QAAQ,KACvC,WAAW,KAAK,UAAU,EAAE,CAAC,KAAM,UAAU,EAAE,CAAC,KAAM,UAAU,EAAE,CAAC;CAGrE,OAAO;AACT;;;AC1BA,MAAM,kBAAkBC,QAAAA,QAAK,OAAO,gBAAgB,WAAY;CAG9D,MAAM,OAAO;CACb,KACG,IAAI,CAAC,CACL,IACC,KAAK,IAAI,SAAS,CAAC,CAAC,IAAI,GACxB,KAAK,IAAI,YAAY,CAAC,CAAC,OAAO,GAC9B,KAAK,IAAI,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,GACpD,KAAK,IAAI,WAAW,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CACtD;AACJ,CAAC;AAED,MAAM,mBAAmBA,QAAAA,QAAK;CAC5B;;CAEA,WAAY;EAGV,MAAM,OAAO;EACb,KACG,IAAI,CAAC,CACL,IACC,KAAK,IAAI,SAAS,CAAC,CAAC,IAAI,GACxB,KACG,IAAI,qBAAqB,CAAC,CAC1B,IAAI,CAAC,CACL,IAAI,KAAK,IAAI,aAAa,CAAC,CAAC,MAAM,GAAG,KAAK,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,GACjE,KAAK,IAAI,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,eAAe,GACxD,KAAK,IAAI,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CACvD;CACJ;AACF;AAEA,MAAM,0BAA0BA,QAAAA,QAAK,OAAO,wBAAwB,WAAY;CAG9E,MAAM,OAAO;CACb,KACG,IAAI,CAAC,CACL,IACC,KAAK,IAAI,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,KAAK,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,GACjF,KAAK,IAAI,KAAK,CAAC,CAAC,OAAO,CACzB;AACJ,CAAC;AASD,MAAM,SAAuC;CAC3C,WAAW;EACT,iBAAiB;GAAC;GAAG;GAAG;GAAK;GAAG;EAAE;EAClC,mBAAmB,EAAE,OAAO,iBAAiB;EAC7C,kBAAkB,EAAE,OAAO,aAAa;EACxC,OAAO,IAAI,SAAA,QAAS,GAAG,WAAW;CACpC;CACA,MAAM;EACJ,iBAAiB;GAAC;GAAG;GAAG;GAAK;GAAO;GAAG;GAAG;EAAC;EAC3C,mBAAmB,EAAE,OAAO,iBAAiB;EAC7C,kBAAkB,EAAE,OAAO,aAAa;EACxC,OAAO,IAAI,SAAA,QAAS,GAAG,MAAM;CAC/B;AACF;AAoBA,IAAa,aAAb,MAAwB;CACtB;CACA;CAEA,YAAY,SAAgC;;EAE1C,IAAI,OAAO,YAAY,UAAU;;GAE/B,IAAI,YAAY,eAAe,YAAY,QACzC,MAAM,IAAI,MAAM,iBAAiB,SAAS;GAE5C,UAAU,OAAO;EACnB;EACA,KAAK,UAAU;EACf,KAAK,cAAc;GAAC;GAAG;GAAG;GAAK;GAAO;GAAG;EAAC;CAC5C;;CAGA,aAAqB,YAA8C;EACjE,OAAO;GACL,SAAS,IAAIC,MAAAA,QAAG,CAAC;GACjB;GACA,qBAAqB;IACnB,aAAa,KAAK;IAClB,OAAO,WAAW;GACpB;EACF;CACF;CAEA,iBAAiB,eAAuB,cAAuC;EAC7E,MAAM,mBAAoC;GACxC,SAAS,IAAIA,MAAAA,QAAG,CAAC;GACjB,YAAY,OAAO,KAAK,eAAe,KAAK;GAC5C,YAAY,KAAK,QAAQ;EAC3B;;EAGA,IAAI,cACF,iBAAiB,YAAY;GAC3B,QAAQ;GACR,MAAM,OAAO,KAAK,cAAc,KAAK;EACvC;EAGF,OAAO;CACT;CAEA,gBAAgB,cAGd;EACA,OAAO;GACL,WAAW;IACT,IAAI,KAAK;IACT,OAAO,KAAK,QAAQ;GACtB;GACA,KAAK;IACH,QAAQ;IACR,MAAM,OAAO,KAAK,cAAc,KAAK;GACvC;EACF;CACF;CAEA,cACE,YACA,gBACA,mBACA,wBAA2C,SACnC;EACR,IAAI;EAGJ,QAAQ,gBAAR;GACE,KAAK,OAAO;IACV,IAAI,OAAO,eAAe,UACxB,MAAM,IAAI,MAAM,8BAA8B;IAGhD,MAAM,eADU,KAAK,QAAQ,MAAM,eAAe,YAAY,KACnC,CAAC,CAAC,UAAU,KAAK;IAC5C,mBAAmB,KAAK,iBAAiB,YAAY,YAAY;IACjE;GACF;;GAEA,KAAK;IACH,IAAI,OAAO,eAAe,UACxB,aAAa,OAAO,KAAK,YAAY,KAAK;IAE5C,mBAAmB,gBAAgB,OAAO,YAAY,KAAK;IAC3D;GACF,KAAK;IACH,IAAI,OAAO,eAAe,UACxB,MAAM,IAAI,MAAM,8BAA8B;IAEhD,mBAAmB,gBAAgB,OACjC,YACA,OACA,KAAK,QAAQ,iBACf;IACA;;GAEF,SACE,MAAM,IAAI,MAAM,4BAA4B;EAChD;EAGA,QAAQ,mBAAR;GACE,KAAK;IACH,IAAI,0BAA0B,SAC5B,OAAO,iBAAiB,WAAW,SAAS,KAAK;SAC5C,IAAI,0BAA0B,SACnC,OAAO,KAAK,aAAa,gBAAgB,CAAC,CAAC,WAAW,WAAW,SAAS,KAAK;IAEjF;GACF,KAAK;IACH,IAAI,0BAA0B,SAC5B,OAAO,gBAAgB,OAAO,kBAAkB,KAAK,CAAC,CAAC,SAAS,KAAK;SAChE,IAAI,0BAA0B,SACnC,OAAO,iBAAiB,OAAO,KAAK,aAAa,gBAAgB,GAAG,KAAK,CAAC,CAAC,SACzE,KACF;IAEF;GACF,KAAK;IACH,IAAI,0BAA0B,SAC5B,OAAO,gBAAgB,OAAO,kBAAkB,OAAO,KAAK,QAAQ,iBAAiB;SAChF,IAAI,0BAA0B,SACnC,OAAO,iBAAiB,OAAO,KAAK,aAAa,gBAAgB,GAAG,OAAO;KACzE,GAAG,KAAK,QAAQ;KAChB,OAAO;IACT,CAAC;IAEH;;GAEF,SACE,MAAM,IAAI,MAAM,4CAA4C;EAChE;EAEA,MAAM,IAAI,MAAM,wCAAwC;CAC1D;CAEA,aACE,WACA,gBACA,mBACQ;EAER,IAAI;EAEJ,QAAQ,gBAAR;GACE,KAAK;IACH,IAAI,OAAO,cAAc,UACvB,MAAM,IAAI,MAAM,6BAA6B;IAE/C,kBAAkB,KAAK,gBAAgB,SAAS;IAChD;;GAEF,KAAK;IACH,IAAI,OAAO,cAAc,UACvB,YAAY,OAAO,KAAK,WAAW,KAAK;IAE1C,kBAAkB,wBAAwB,OAAO,WAAW,KAAK;IACjE;GACF,KAAK;IACH,IAAI,OAAO,cAAc,UACvB,MAAM,IAAI,MAAM,6BAA6B;IAE/C,kBAAkB,wBAAwB,OACxC,WACA,OACA,KAAK,QAAQ,gBACf;IACA;;GAEF,SACE,MAAM,IAAI,MAAM,2BAA2B;EAC/C;EAGA,QAAQ,mBAAR;GACE,KAAK,OACH,OAAO,gBAAgB,IAAI,KAAK,SAAS,KAAK;GAChD,KAAK,OACH,OAAO,wBAAwB,OAAO,iBAAiB,KAAK,CAAC,CAAC,SAAS,KAAK;GAC9E,KAAK,OACH,OAAO,wBAAwB,OAC7B,iBACA,OACA,KAAK,QAAQ,gBACf;;GAEF,SACE,MAAM,IAAI,MAAM,2CAA2C;EAC/D;CACF;AACF;;;ACjSA,SAAS,iBAAiB,QAAwB;CAGhD,MAAM,MAAM,OAAO,MAAM,IAAI;CAC7B,IAAI,MAAM;CACV,IAAI,IAAI;CAMR,OAJkB,OAAO,KAAK,IAAI,KAAK,EAAE,GAAG,QAGZ,CAAC,CAAC,MAAM,EACnB,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,YAAY;AACrD;AAEA,SAAS,SAAS,WAAmB,EAAE,YAAY,SAAS,CAAC,GAAW;CACtE,MAAM,aAAa,IAAI,WAAW,MAAM;CACxC,IAAI,WACF,OAAO,WAAW,cAAc,WAAW,OAAO,KAAK;CAEzD,OAAO,WAAW,aAAa,WAAW,OAAO,KAAK;AACxD;;;;;AAMA,SAAgB,QAAQ,SAAiC;CACvD,IAAI,SAAS;EACX,MAAM,KAAK,IAAI,SAAA,QAAS,GAAG,MAAM;EACjC,MAAM,gBAAgBC,YAAAA,QAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK;EAC9E,MAAM,UAAU,GAAG,WAAW,EAC5B,SAAS,OAAO,KAAK,eAAe,KAAK,EAC3C,CAAC;EACD,OAAO;GACL,YAAY,OAAO,SAAS,QAAQ,WAAW,KAAK,CAAC,CAAC;GACtD,WAAW,OAAO,SAAS,QAAQ,UAAU,KAAK,GAAG,EAAE,WAAW,MAAM,CAAC,CAAC;GAC1E,WAAW,iBAAiB,OAAO,SAAS,QAAQ,UAAU,KAAK,GAAG,EAAE,WAAW,MAAM,CAAC,CAAC,CAAC;EAC9F;CACF;CACA,MAAM,EAAE,WAAW,eAAeA,YAAAA,QAAO,oBAAoB,MAAM;EACjE,YAAY;EACZ,mBAAmB;GAAE,MAAM;GAAQ,QAAQ;EAAM;EACjD,oBAAoB;GAAE,MAAM;GAAQ,QAAQ;EAAM;CACpD,CAAC;CAED,OAAO;EACL;EACA;EACA,WAJgB,iBAAiB,SAIzB;CACV;AACF;AAEA,MAAa,OAAO,OAAO,eAAuB,oBAA6C;CAE7F,MAAM,qBAAqB,KAAK,UAAU,OAAO,eAAe;CAKhE,MAAM,aAAaA,YAAAA,QAAO,iBAAiB,aAAa;CAGxD,OAAO,MAAM,IAAI,KAAK,YAAY,kBAAkB,CAAC,CAClD,mBAAmB;EAAE,KAAK;EAAS,KAAK;CAAM,CAAC,CAAC,CAChD,KAAK,UAAU;AACpB"}

package/lib/crypto.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_crypto = require("./crypto-rlKUKWhL.cjs");
+const require_crypto = require("./crypto-C2vNZ2v5.cjs");
 exports.genKeys = require_crypto.genKeys;
 exports.genSeed = require_crypto.genSeed;
 exports.getMasterSeed = require_crypto.getMasterSeed;

package/lib/crypto.js

@@ -1,2 +1,2 @@
-import { i as getMasterSeed, n as sign, r as genSeed, t as genKeys } from "./crypto-DdEUFJar.js";
+import { i as getMasterSeed, n as sign, r as genSeed, t as genKeys } from "./crypto-BHYSptBe.js";
 export { genKeys, genSeed, getMasterSeed, sign };

package/lib/{device-B8Fww8_6.js → device-CLaCrhYs.js}

@@ -32,6 +32,7 @@ function createApiDevice(options, logger) {
 	axiosRetry(deviceApi, {
 		retryDelay: axiosRetry.linearDelay(1e3),
 		retries: 3,
+		/* v8 ignore start -- @preserve */
 		retryCondition: () => true,
 		onRetry: (retryCount, err) => {
 			const formattedErr = `${err.code ?? `UNKNOWN`} on ${err.config?.method?.toUpperCase() ?? "UNKNOWN_METHOD"} ${err.config?.url ?? "UNKNOWN_URL"}`;
@@ -716,4 +717,4 @@ const isDeviceCancelError = (error) => {
 //#endregion
 export { DisconnectedDevice as a, APPID_VAULT_ADMINISTRATOR as c, SCRIPT_IDS as d, STR_ROLES as f, withDevicePolling as i, PAGINATED_STATUS as l, isTransportStatusError as n, LockedDeviceError as o, registerTransportModule as r, createApiDevice as s, isDeviceCancelError as t, PATHS as u };
 
-//# sourceMappingURL=device-B8Fww8_6.js.map
+//# sourceMappingURL=device-CLaCrhYs.js.map