@naylence/runtime 0.3.4 → 0.3.5-test.0

package/dist/cjs/src/naylence/fame/security/policy/default-security-policy.js

@@ -0,0 +1,729 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DefaultSecurityPolicy = void 0;
+const core_1 = require("@naylence/core");
+const logging_js_1 = require("../../util/logging.js");
+const util_js_1 = require("../../util/util.js");
+const key_provider_js_1 = require("../keys/key-provider.js");
+const jwk_validation_js_1 = require("../crypto/jwk-validation.js");
+const security_policy_js_1 = require("./security-policy.js");
+const policy_alias_normalizer_js_1 = require("./policy-alias-normalizer.js");
+const logger = (0, logging_js_1.getLogger)('naylence.fame.security.policy.default_security_policy');
+function normalizePolicyOptions(options) {
+    if (!options || typeof options !== 'object') {
+        return {};
+    }
+    const candidate = options;
+    const normalized = {};
+    const customSigningPolicy = (0, policy_alias_normalizer_js_1.resolveAlias)(candidate, ['customSigningPolicy', 'custom_signing_policy']);
+    if (customSigningPolicy !== undefined) {
+        normalized.customSigningPolicy = customSigningPolicy;
+    }
+    const customEncryptionPolicy = (0, policy_alias_normalizer_js_1.resolveAlias)(candidate, ['customEncryptionPolicy', 'custom_encryption_policy']);
+    if (customEncryptionPolicy !== undefined) {
+        normalized.customEncryptionPolicy = customEncryptionPolicy;
+    }
+    const signing = (0, policy_alias_normalizer_js_1.resolveAlias)(candidate, ['signing', 'signing_config', 'signingConfig']);
+    if (signing !== undefined) {
+        normalized.signing = (0, policy_alias_normalizer_js_1.normalizeSigningCase)(signing);
+    }
+    const encryption = (0, policy_alias_normalizer_js_1.resolveAlias)(candidate, ['encryption', 'encryption_config', 'encryptionConfig']);
+    if (encryption !== undefined) {
+        normalized.encryption = (0, policy_alias_normalizer_js_1.normalizeEncryptionCase)(encryption);
+    }
+    const keyProvider = (0, policy_alias_normalizer_js_1.resolveAlias)(candidate, [
+        'keyProvider',
+        'key_provider',
+    ]);
+    if (keyProvider !== undefined) {
+        normalized.keyProvider = keyProvider;
+    }
+    return normalized;
+}
+function asStringAddress(address) {
+    if (!address) {
+        return null;
+    }
+    if (typeof address === 'string') {
+        return address;
+    }
+    return address.toString();
+}
+function extractFrameType(envelope) {
+    const frame = envelope.frame;
+    return frame?.type;
+}
+async function toArray(iterable) {
+    const resolved = await iterable;
+    const items = [];
+    for (const item of resolved) {
+        items.push(item);
+    }
+    return items;
+}
+class DefaultSecurityPolicy {
+    constructor(options = {}) {
+        const normalized = normalizePolicyOptions(options);
+        const signingOption = normalized.signing !== undefined ? normalized.signing : options.signing;
+        const encryptionOption = normalized.encryption !== undefined
+            ? normalized.encryption
+            : options.encryption;
+        const customSigning = normalized.customSigningPolicy !== undefined
+            ? normalized.customSigningPolicy
+            : options.customSigningPolicy;
+        const customEncryption = normalized.customEncryptionPolicy !== undefined
+            ? normalized.customEncryptionPolicy
+            : options.customEncryptionPolicy;
+        const keyProviderOption = normalized.keyProvider !== undefined
+            ? normalized.keyProvider
+            : options.keyProvider;
+        this.customSigningPolicy = customSigning ?? undefined;
+        this.customEncryptionPolicy = customEncryption ?? undefined;
+        this.encryption =
+            encryptionOption instanceof security_policy_js_1.EncryptionConfiguration
+                ? encryptionOption
+                : encryptionOption
+                    ? new security_policy_js_1.EncryptionConfiguration(encryptionOption)
+                    : security_policy_js_1.EncryptionConfiguration.forDevelopment();
+        this.signing =
+            signingOption instanceof security_policy_js_1.SigningConfiguration
+                ? signingOption
+                : signingOption
+                    ? new security_policy_js_1.SigningConfiguration(signingOption)
+                    : security_policy_js_1.SigningConfiguration.forDevelopment();
+        this.keyProvider = keyProviderOption ?? null;
+    }
+    async shouldSignEnvelope(envelope, context, nodeLike) {
+        if (this.customSigningPolicy) {
+            const customResult = await this.customSigningPolicy(envelope, context, nodeLike);
+            if (typeof customResult === 'boolean') {
+                return customResult;
+            }
+        }
+        if (envelope.sec?.sig) {
+            return false;
+        }
+        const frameType = extractFrameType(envelope);
+        if (frameType === 'NodeAttach') {
+            return false;
+        }
+        const shouldEncrypt = await this.shouldEncryptEnvelope(envelope, context, nodeLike);
+        if (shouldEncrypt) {
+            const isResponse = this.isResponseEnvelope(envelope, context);
+            if (isResponse && !this.signing.response.mirrorRequestSigning) {
+                logger.debug('envelope_encryption_without_signing_due_to_disabled_mirroring', {
+                    envelope_id: envelope.id,
+                    reason: 'response_signature_mirroring_disabled',
+                });
+            }
+            else {
+                logger.debug('envelope_requires_signing_due_to_encryption', {
+                    envelope_id: envelope.id,
+                    reason: 'outbound_encryption_requires_signing',
+                });
+                return true;
+            }
+        }
+        if (this.isResponseEnvelope(envelope, context)) {
+            return this.shouldSignResponse(envelope, context, nodeLike);
+        }
+        return this.shouldSignOutboundRequest(envelope, context, nodeLike);
+    }
+    async shouldEncryptEnvelope(envelope, context, nodeLike) {
+        if (!context || context.originType !== core_1.DeliveryOriginType.LOCAL) {
+            return false;
+        }
+        if (this.customEncryptionPolicy) {
+            const customResult = await this.customEncryptionPolicy(envelope, context, nodeLike);
+            if (typeof customResult === 'boolean') {
+                return customResult;
+            }
+        }
+        if (envelope.sec?.enc) {
+            return false;
+        }
+        const desiredLevel = this.isResponseEnvelope(envelope, context)
+            ? await this.decideResponseCryptoLevel(context?.security?.inboundCryptoLevel ?? security_policy_js_1.CryptoLevel.PLAINTEXT, envelope, context)
+            : await this.decideOutboundCryptoLevel(envelope, context, nodeLike);
+        return (desiredLevel === security_policy_js_1.CryptoLevel.CHANNEL ||
+            desiredLevel === security_policy_js_1.CryptoLevel.SEALED);
+    }
+    async getEncryptionOptions(envelope, context, nodeLike) {
+        if (!envelope.to) {
+            logger.debug('no_encryption_options_no_recipient', {
+                envelope_id: envelope.id,
+            });
+            return undefined;
+        }
+        const useChannel = await this.shouldUseChannelEncryption(envelope, context, nodeLike);
+        logger.debug('encryption_decision_debug', {
+            envelope_id: envelope.id,
+            should_use_channel: useChannel,
+            context_meta: context?.meta,
+            has_context: Boolean(context),
+            context_inbound_level: context?.security?.inboundCryptoLevel,
+            context_origin: context?.originType,
+        });
+        if (useChannel) {
+            return {
+                encryptionType: 'channel',
+                destination: envelope.to,
+            };
+        }
+        try {
+            const [recipientKeyId, recipientPublicKey] = await this.lookupRecipientEncryptionKey(envelope.to, nodeLike);
+            logger.debug('found_encryption_key_for_recipient', {
+                envelope_id: envelope.id,
+                recipient_key_id: recipientKeyId,
+                recipient: envelope.to,
+            });
+            return {
+                recipientKeyId,
+                recipientPublicKey,
+            };
+        }
+        catch (error) {
+            logger.debug('encryption_key_not_found_locally_will_request_by_address', {
+                envelope_id: envelope.id,
+                recipient: envelope.to,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return {
+                requestAddress: envelope.to,
+            };
+        }
+    }
+    async shouldVerifySignature(envelope, _context) {
+        const rules = this.signing.inbound;
+        if (!envelope.sec?.sig) {
+            if (rules.signaturePolicy === security_policy_js_1.SignaturePolicy.REQUIRED) {
+                logger.warning('unsigned_envelope_but_signatures_required', {
+                    envelope_id: envelope.id,
+                    action: rules.unsignedViolationAction,
+                });
+            }
+            return false;
+        }
+        switch (rules.signaturePolicy) {
+            case security_policy_js_1.SignaturePolicy.REQUIRED:
+                return true;
+            case security_policy_js_1.SignaturePolicy.OPTIONAL:
+                return true;
+            case security_policy_js_1.SignaturePolicy.DISABLED:
+                return false;
+            case security_policy_js_1.SignaturePolicy.FORBIDDEN:
+                return false;
+            default:
+                return true;
+        }
+    }
+    async shouldDecryptEnvelope(envelope, _context, nodeLike) {
+        if (!envelope.sec?.enc) {
+            return false;
+        }
+        if (envelope.to) {
+            if (this.isLocalAddress(envelope.to, nodeLike)) {
+                logger.debug('should_decrypt_envelope_local', {
+                    envelope_id: envelope.id,
+                    destination: envelope.to,
+                    reason: 'destination_is_local_binding',
+                });
+                return true;
+            }
+            logger.debug('should_not_decrypt_envelope_forwarding', {
+                envelope_id: envelope.id,
+                destination: envelope.to,
+                reason: 'destination_not_local_forwarding_only',
+            });
+            return false;
+        }
+        logger.debug('should_decrypt_envelope_fallback', {
+            envelope_id: envelope.id,
+            reason: 'no_destination_using_default_policy',
+        });
+        return true;
+    }
+    classifyMessageCryptoLevel(envelope, _context) {
+        const algorithm = envelope.sec?.enc?.alg;
+        if (algorithm) {
+            if (this.encryption.supportedChannelAlgorithms.includes(algorithm)) {
+                logger.debug('classified_as_channel_encryption', {
+                    envelope_id: envelope.id,
+                    algorithm,
+                });
+                return security_policy_js_1.CryptoLevel.CHANNEL;
+            }
+            if (this.encryption.supportedSealedAlgorithms.includes(algorithm)) {
+                logger.debug('classified_as_sealed_encryption', {
+                    envelope_id: envelope.id,
+                    algorithm,
+                });
+                return security_policy_js_1.CryptoLevel.SEALED;
+            }
+            logger.warning('unknown_encryption_algorithm', {
+                envelope_id: envelope.id,
+                algorithm,
+                supported_channel: this.encryption.supportedChannelAlgorithms,
+                supported_sealed: this.encryption.supportedSealedAlgorithms,
+                defaulting_to: 'SEALED',
+            });
+            return security_policy_js_1.CryptoLevel.SEALED;
+        }
+        if (envelope.sec?.enc) {
+            logger.warning('encryption_present_but_no_algorithm', {
+                envelope_id: envelope.id,
+                defaulting_to: 'SEALED',
+            });
+            return security_policy_js_1.CryptoLevel.SEALED;
+        }
+        logger.debug('classified_as_plaintext', {
+            envelope_id: envelope.id,
+            reason: 'no_encryption_headers',
+        });
+        return security_policy_js_1.CryptoLevel.PLAINTEXT;
+    }
+    isInboundCryptoLevelAllowed(cryptoLevel, _envelope, _context) {
+        const rules = this.encryption.inbound;
+        switch (cryptoLevel) {
+            case security_policy_js_1.CryptoLevel.PLAINTEXT:
+                return rules.allowPlaintext;
+            case security_policy_js_1.CryptoLevel.CHANNEL:
+                return rules.allowChannel;
+            case security_policy_js_1.CryptoLevel.SEALED:
+                return rules.allowSealed;
+            default:
+                return false;
+        }
+    }
+    getInboundViolationAction(cryptoLevel, _envelope, _context) {
+        const rules = this.encryption.inbound;
+        switch (cryptoLevel) {
+            case security_policy_js_1.CryptoLevel.PLAINTEXT:
+                return rules.plaintextViolationAction;
+            case security_policy_js_1.CryptoLevel.CHANNEL:
+                return rules.channelViolationAction;
+            case security_policy_js_1.CryptoLevel.SEALED:
+                return rules.sealedViolationAction;
+            default:
+                return security_policy_js_1.SecurityAction.NACK;
+        }
+    }
+    async decideResponseCryptoLevel(requestCryptoLevel, envelope, _context) {
+        const frameType = extractFrameType(envelope);
+        if (frameType && frameType !== 'Data') {
+            return security_policy_js_1.CryptoLevel.PLAINTEXT;
+        }
+        const rules = this.encryption.response;
+        if (rules.escalateSealedResponses) {
+            return security_policy_js_1.CryptoLevel.SEALED;
+        }
+        let responseLevel = rules.mirrorRequestLevel
+            ? requestCryptoLevel
+            : rules.minimumResponseLevel;
+        if ((0, security_policy_js_1.compareCryptoLevels)(responseLevel, rules.minimumResponseLevel) < 0) {
+            responseLevel = rules.minimumResponseLevel;
+        }
+        return responseLevel;
+    }
+    async decideOutboundCryptoLevel(envelope, _context, nodeLike) {
+        const frameType = extractFrameType(envelope);
+        if (frameType && frameType !== 'Data') {
+            return security_policy_js_1.CryptoLevel.PLAINTEXT;
+        }
+        const rules = this.encryption.outbound;
+        let cryptoLevel = rules.defaultLevel;
+        if (rules.escalateIfPeerSupports && envelope.to) {
+            try {
+                await this.lookupRecipientEncryptionKey(envelope.to, nodeLike);
+                cryptoLevel = security_policy_js_1.CryptoLevel.SEALED;
+            }
+            catch {
+                // Ignore errors; default level remains
+            }
+        }
+        if (rules.preferSealedForSensitive && this.isSensitiveOperation(envelope)) {
+            cryptoLevel = security_policy_js_1.CryptoLevel.SEALED;
+        }
+        return cryptoLevel;
+    }
+    isSignatureRequired(envelope, _context) {
+        const frameType = extractFrameType(envelope);
+        if (frameType === 'KeyRequest' ||
+            frameType === 'KeyAnnounce' ||
+            frameType === 'SecureOpen' ||
+            frameType === 'SecureAccept') {
+            return true;
+        }
+        if (frameType === 'NodeAttach' || frameType === 'NodeHeartbeat') {
+            return false;
+        }
+        const rules = this.signing.inbound;
+        if (rules.signaturePolicy === security_policy_js_1.SignaturePolicy.REQUIRED) {
+            return true;
+        }
+        if (rules.signaturePolicy === security_policy_js_1.SignaturePolicy.FORBIDDEN) {
+            return Boolean(envelope.sec?.sig);
+        }
+        return false;
+    }
+    getUnsignedViolationAction(_envelope, _context) {
+        return this.signing.inbound.unsignedViolationAction;
+    }
+    getInvalidSignatureViolationAction(_envelope, _context) {
+        return this.signing.inbound.invalidSignatureAction;
+    }
+    requirements() {
+        let signingRequired = false;
+        let verificationRequired = false;
+        let encryptionRequired = false;
+        let decryptionRequired = false;
+        const outbound = this.signing.outbound;
+        const response = this.signing.response;
+        const inbound = this.signing.inbound;
+        const encryption = this.encryption;
+        if (outbound.defaultSigning ||
+            outbound.signSensitiveOperations ||
+            response.mirrorRequestSigning ||
+            response.alwaysSignResponses ||
+            response.signErrorResponses) {
+            signingRequired = true;
+        }
+        if (inbound.signaturePolicy === security_policy_js_1.SignaturePolicy.REQUIRED ||
+            inbound.signaturePolicy === security_policy_js_1.SignaturePolicy.OPTIONAL) {
+            verificationRequired = true;
+        }
+        if (encryption.outbound.defaultLevel !== security_policy_js_1.CryptoLevel.PLAINTEXT ||
+            encryption.response.minimumResponseLevel !== security_policy_js_1.CryptoLevel.PLAINTEXT) {
+            encryptionRequired = true;
+        }
+        if (encryption.inbound.allowChannel || encryption.inbound.allowSealed) {
+            decryptionRequired = true;
+        }
+        const requireSigningKeyExchange = signingRequired;
+        const requireEncryptionKeyExchange = encryptionRequired || decryptionRequired;
+        let minimumCryptoLevel = security_policy_js_1.CryptoLevel.PLAINTEXT;
+        if (!encryption.inbound.allowPlaintext) {
+            if (encryption.inbound.allowChannel) {
+                minimumCryptoLevel = security_policy_js_1.CryptoLevel.CHANNEL;
+            }
+            else if (encryption.inbound.allowSealed) {
+                minimumCryptoLevel = security_policy_js_1.CryptoLevel.SEALED;
+            }
+        }
+        const requireCertificates = this.signing.signingMaterial === core_1.SigningMaterial.X509_CHAIN;
+        const supportedEncryptionAlgorithms = new Set([
+            ...encryption.supportedSealedAlgorithms,
+            ...encryption.supportedChannelAlgorithms,
+        ]);
+        return new security_policy_js_1.SecurityRequirements({
+            signingRequired,
+            verificationRequired,
+            encryptionRequired,
+            decryptionRequired,
+            requireKeyExchange: requireSigningKeyExchange || requireEncryptionKeyExchange,
+            requireSigningKeyExchange,
+            requireEncryptionKeyExchange,
+            requireNodeAuthorization: true,
+            requireCertificates,
+            minimumCryptoLevel,
+            supportedSigningAlgorithms: new Set(['EdDSA']),
+            supportedEncryptionAlgorithms,
+            preferredSigningAlgorithms: ['EdDSA'],
+            preferredEncryptionAlgorithms: ['X25519', 'ChaCha20Poly1305'],
+            preferredSigningAlgorithm: 'EdDSA',
+            preferredEncryptionAlgorithm: 'X25519',
+        });
+    }
+    validateAttachSecurityCompatibility(options) {
+        const { peerKeys, peerRequirements } = options;
+        const requirements = this.requirements();
+        if (requirements.requireSigningKeyExchange) {
+            const hasSigningKey = peerKeys?.some((key) => (key.use === 'sig' || key.use === undefined) &&
+                key.kty === 'OKP' &&
+                key.crv === 'Ed25519');
+            if (!hasSigningKey) {
+                return [
+                    false,
+                    'Policy requires signing key exchange but no signing keys provided',
+                ];
+            }
+        }
+        if (requirements.requireEncryptionKeyExchange) {
+            const hasEncKey = peerKeys?.some((key) => (key.use === 'enc' || key.use === undefined) &&
+                key.kty === 'OKP' &&
+                key.crv === 'X25519');
+            if (!hasEncKey) {
+                return [
+                    false,
+                    'Policy requires encryption key exchange but no encryption keys provided',
+                ];
+            }
+        }
+        if (peerRequirements) {
+            if ((0, security_policy_js_1.compareCryptoLevels)(peerRequirements.minimumCryptoLevel, requirements.minimumCryptoLevel) > 0) {
+                if (peerRequirements.minimumCryptoLevel === security_policy_js_1.CryptoLevel.SEALED &&
+                    !requirements.encryptionRequired) {
+                    return [
+                        false,
+                        'Peer requires SEALED but we do not support encryption',
+                    ];
+                }
+            }
+            if (peerRequirements.signingRequired &&
+                requirements.verificationRequired) {
+                const commonSigning = new Set([...peerRequirements.supportedSigningAlgorithms].filter((alg) => requirements.supportedSigningAlgorithms.has(alg)));
+                if (commonSigning.size === 0) {
+                    return [
+                        false,
+                        `No compatible signing algorithms: peer supports ${Array.from(peerRequirements.supportedSigningAlgorithms).join(', ')}, we support ${Array.from(requirements.supportedSigningAlgorithms).join(', ')}`,
+                    ];
+                }
+            }
+            if (peerRequirements.encryptionRequired &&
+                requirements.decryptionRequired) {
+                const commonEncryption = new Set([...peerRequirements.supportedEncryptionAlgorithms].filter((alg) => requirements.supportedEncryptionAlgorithms.has(alg)));
+                if (commonEncryption.size === 0) {
+                    return [
+                        false,
+                        `No compatible encryption algorithms: peer supports ${Array.from(peerRequirements.supportedEncryptionAlgorithms).join(', ')}, we support ${Array.from(requirements.supportedEncryptionAlgorithms).join(', ')}`,
+                    ];
+                }
+            }
+        }
+        return [true];
+    }
+    async shouldUseChannelEncryption(envelope, context, _nodeLike) {
+        if (!context || context.originType !== core_1.DeliveryOriginType.LOCAL) {
+            logger.debug('channel_encryption_rejected_non_local', {
+                envelope_id: envelope.id,
+                has_context: Boolean(context),
+                origin: context?.originType,
+            });
+            return false;
+        }
+        if (extractFrameType(envelope) !== 'Data') {
+            logger.debug('channel_encryption_rejected_non_data', {
+                envelope_id: envelope.id,
+                frame_type: extractFrameType(envelope),
+            });
+            return false;
+        }
+        if (envelope.sec?.enc) {
+            logger.debug('channel_encryption_rejected_already_encrypted', {
+                envelope_id: envelope.id,
+            });
+            return false;
+        }
+        const messageType = context?.meta?.['message-type'];
+        const isResponse = messageType === 'response' || messageType === 'protocol-response';
+        logger.debug('channel_encryption_response_check', {
+            envelope_id: envelope.id,
+            is_response: isResponse,
+            context_meta: context?.meta,
+            has_context: Boolean(context),
+            context_inbound_crypto_level: context?.security?.inboundCryptoLevel,
+            mirror_request_level: this.encryption.response.mirrorRequestLevel,
+        });
+        if (isResponse) {
+            if (context?.security?.inboundCryptoLevel === security_policy_js_1.CryptoLevel.SEALED &&
+                this.encryption.response.mirrorRequestLevel) {
+                logger.debug('channel_encryption_rejected_sealed_mirror', {
+                    envelope_id: envelope.id,
+                    original_request_level: context.security.inboundCryptoLevel,
+                    mirror_enabled: this.encryption.response.mirrorRequestLevel,
+                });
+                return false;
+            }
+            const desiredLevel = await this.decideOutboundCryptoLevel(envelope, context, _nodeLike);
+            logger.debug('channel_encryption_response_fallback', {
+                envelope_id: envelope.id,
+                desired_level: desiredLevel,
+                result: desiredLevel === security_policy_js_1.CryptoLevel.CHANNEL,
+            });
+            return desiredLevel === security_policy_js_1.CryptoLevel.CHANNEL;
+        }
+        const desiredLevel = await this.decideOutboundCryptoLevel(envelope, context, _nodeLike);
+        logger.debug('channel_encryption_outbound_decision', {
+            envelope_id: envelope.id,
+            desired_level: desiredLevel,
+            result: desiredLevel === security_policy_js_1.CryptoLevel.CHANNEL,
+        });
+        return desiredLevel === security_policy_js_1.CryptoLevel.CHANNEL;
+    }
+    isLocalAddress(address, nodeLike) {
+        if (!nodeLike) {
+            return false;
+        }
+        try {
+            const fameAddress = typeof address === 'string' ? address : address.toString();
+            return nodeLike.hasLocal(fameAddress);
+        }
+        catch {
+            return false;
+        }
+    }
+    isResponseEnvelope(_envelope, context) {
+        const messageType = context?.meta?.['message-type'];
+        return messageType === 'response' || messageType === 'protocol-response';
+    }
+    shouldSignResponse(envelope, context, _nodeLike) {
+        const rules = this.signing.response;
+        if (rules.alwaysSignResponses) {
+            return true;
+        }
+        if (rules.signErrorResponses && this.isErrorResponse(envelope)) {
+            return true;
+        }
+        if (rules.mirrorRequestSigning) {
+            const inboundWasSigned = context?.security?.inboundWasSigned;
+            if (inboundWasSigned) {
+                logger.debug('mirroring_signature_due_to_signed_request', {
+                    envelope_id: envelope.id,
+                    reason: 'inbound_request_was_signed',
+                });
+                return true;
+            }
+            const inboundLevel = context?.security?.inboundCryptoLevel;
+            if (inboundLevel && inboundLevel !== security_policy_js_1.CryptoLevel.PLAINTEXT) {
+                logger.debug('mirroring_signature_due_to_encrypted_request', {
+                    envelope_id: envelope.id,
+                    reason: 'inbound_request_was_encrypted',
+                    crypto_level: inboundLevel,
+                });
+                return true;
+            }
+        }
+        return false;
+    }
+    shouldSignOutboundRequest(envelope, _context, _nodeLike) {
+        const rules = this.signing.outbound;
+        if (rules.signSensitiveOperations && this.isSensitiveOperation(envelope)) {
+            return true;
+        }
+        if (rules.signIfRecipientExpects) {
+            return true;
+        }
+        return rules.defaultSigning;
+    }
+    isErrorResponse(envelope) {
+        return extractFrameType(envelope) === 'Error';
+    }
+    isSensitiveOperation(_envelope) {
+        return false;
+    }
+    async lookupRecipientEncryptionKey(address, nodeLike) {
+        const addressStr = asStringAddress(address);
+        if (!addressStr) {
+            throw new Error('No recipient address in envelope');
+        }
+        const keyProvider = this.resolveKeyProvider();
+        logger.debug('starting_recipient_encryption_key_lookup', {
+            address: addressStr,
+        });
+        const [participant, path] = (0, core_1.parseAddress)(addressStr);
+        if (!participant) {
+            throw new Error(`Cannot determine participant from address ${addressStr}`);
+        }
+        const localKey = await this.tryResolveLocalEncryptionKey(path, nodeLike);
+        if (localKey) {
+            return localKey;
+        }
+        const keysByAddress = await toArray(keyProvider.getKeysForPath(addressStr));
+        const keys = [...keysByAddress];
+        if (keys.length === 0 && path) {
+            const pathKeys = await toArray(keyProvider.getKeysForPath(path));
+            keys.push(...pathKeys);
+        }
+        if (keys.length === 0) {
+            const participantKeys = await toArray(keyProvider.getKeysForPath(participant));
+            keys.push(...participantKeys);
+        }
+        for (const key of keys) {
+            const kid = typeof key.kid === 'string' ? key.kid : '';
+            const use = typeof key.use === 'string' ? key.use : undefined;
+            const kty = typeof key.kty === 'string' ? key.kty : undefined;
+            const crv = typeof key.crv === 'string' ? key.crv : undefined;
+            logger.debug('examining_key', { key_id: kid, use, kty, crv });
+            if (use === 'enc' && kty === 'OKP' && crv === 'X25519') {
+                try {
+                    (0, jwk_validation_js_1.validateEncryptionKey)(key);
+                }
+                catch (error) {
+                    if (error instanceof jwk_validation_js_1.JWKValidationError) {
+                        logger.warning('invalid_encryption_key', {
+                            kid,
+                            error: error.message,
+                        });
+                        continue;
+                    }
+                    throw error;
+                }
+                const x = typeof key.x === 'string' ? key.x : undefined;
+                if (!x) {
+                    logger.warning('encryption_key_missing_x_parameter', { kid });
+                    continue;
+                }
+                const pubBytes = (0, util_js_1.urlsafeBase64Decode)(x);
+                logger.debug('successfully_extracted_public_key', {
+                    kid,
+                    pub_key_length: pubBytes.length,
+                });
+                return [kid, pubBytes];
+            }
+        }
+        logger.debug('no_local_encryption_key_found_will_request_from_upstream', {
+            address: addressStr,
+            participant,
+            available_keys: keys.map((key) => typeof key.kid === 'string' ? key.kid : 'unknown'),
+        });
+        throw new Error(`No encryption key found for address ${addressStr}`);
+    }
+    resolveKeyProvider() {
+        if (this.keyProvider) {
+            return this.keyProvider;
+        }
+        return (0, key_provider_js_1.getKeyProvider)();
+    }
+    async tryResolveLocalEncryptionKey(path, nodeLike) {
+        if (!nodeLike || path !== nodeLike.physicalPath) {
+            return null;
+        }
+        const cryptoProvider = nodeLike.cryptoProvider; //getCryptoProvider();
+        const keys = cryptoProvider?.getJwks?.()?.keys;
+        if (Array.isArray(keys)) {
+            for (const key of keys) {
+                if (key.use === 'enc' &&
+                    key.kty === 'OKP' &&
+                    key.crv === 'X25519' &&
+                    typeof key.kid === 'string') {
+                    const x = typeof key.x === 'string' ? key.x : undefined;
+                    if (!x) {
+                        continue;
+                    }
+                    try {
+                        (0, jwk_validation_js_1.validateEncryptionKey)(key);
+                        const pubBytes = (0, util_js_1.urlsafeBase64Decode)(x);
+                        logger.debug('found_local_node_encryption_key', {
+                            kid: key.kid,
+                            pub_key_length: pubBytes.length,
+                        });
+                        return [key.kid, pubBytes];
+                    }
+                    catch (error) {
+                        if (error instanceof jwk_validation_js_1.JWKValidationError) {
+                            logger.warning('invalid_local_encryption_key', {
+                                kid: key.kid,
+                                error: error.message,
+                            });
+                            continue;
+                        }
+                        throw error;
+                    }
+                }
+            }
+        }
+        return null;
+    }
+}
+exports.DefaultSecurityPolicy = DefaultSecurityPolicy;
+//# sourceMappingURL=default-security-policy.js.map