@opendatalabs/vana-sdk 0.1.0-alpha.7ee7635 → 0.1.0-alpha.80df35f

package/dist/core.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core.ts"],"sourcesContent":["import type {\n  VanaConfig,\n  VanaConfigWithStorage,\n  RuntimeConfig,\n  VanaChainId,\n  StorageRequiredMarker,\n} from \"./types\";\nimport {\n  isWalletConfig,\n  isChainConfig,\n  isVanaChainId,\n  hasStorageConfig,\n} from \"./types\";\nimport type {\n  RelayerCallbacks,\n  DownloadRelayerCallbacks,\n} from \"./types/config\";\nimport { InvalidConfigurationError } from \"./errors\";\nimport {\n  PermissionsController,\n  ControllerContext,\n} from \"./controllers/permissions\";\nimport { DataController } from \"./controllers/data\";\nimport { SchemaController } from \"./controllers/schemas\";\nimport { ServerController } from \"./controllers/server\";\nimport { ProtocolController } from \"./controllers/protocol\";\nimport { StorageManager, StorageProvider } from \"./storage\";\nimport { createWalletClient, createPublicClient, http } from \"viem\";\nimport { chains } from \"./config/chains\";\nimport { getChainConfig } from \"./chains\";\nimport type { VanaPlatformAdapter } from \"./platform/interface\";\nimport {\n  encryptBlobWithSignedKey,\n  decryptBlobWithSignedKey,\n} from \"./utils/encryption\";\n\n/**\n * Factory functions for creating VanaCore instances with proper type safety\n */\nexport class VanaCoreFactory {\n  /**\n   * Creates a VanaCore instance that enforces storage requirements at compile time.\n   * Use this factory when you know you'll need storage-dependent operations.\n   *\n   * @param platform - The platform adapter for environment-specific operations\n   * @param config - Configuration that includes required storage providers\n   * @returns VanaCore instance with storage validation\n   * @example\n   * ```typescript\n   * const vanaCore = VanaCoreFactory.createWithStorage(platformAdapter, {\n   *   walletClient: myWalletClient,\n   *   storage: {\n   *     providers: { ipfs: new IPFSStorage() },\n   *     defaultProvider: 'ipfs'\n   *   }\n   * });\n   * ```\n   */\n  static createWithStorage(\n    platform: VanaPlatformAdapter,\n    config: VanaConfigWithStorage,\n  ): VanaCore & StorageRequiredMarker {\n    const core = new VanaCore(platform, config);\n    return core as VanaCore & StorageRequiredMarker;\n  }\n\n  /**\n   * Creates a VanaCore instance without storage requirements.\n   * Storage-dependent operations will fail at runtime if not configured.\n   *\n   * @param platform - The platform adapter for environment-specific operations\n   * @param config - Basic configuration without required storage\n   * @returns VanaCore instance\n   * @example\n   * ```typescript\n   * const vanaCore = VanaCoreFactory.create(platformAdapter, {\n   *   walletClient: myWalletClient\n   * });\n   * ```\n   */\n  static create(platform: VanaPlatformAdapter, config: VanaConfig): VanaCore {\n    return new VanaCore(platform, config);\n  }\n}\n\n/**\n * Provides the core SDK functionality for interacting with the Vana network.\n *\n * @remarks\n * This environment-agnostic class contains all SDK logic and accepts a platform\n * adapter to handle environment-specific operations. It initializes all controllers\n * and manages shared context between them, providing a unified interface for\n * data management, permissions, smart contracts, and storage operations.\n *\n * The class uses TypeScript overloading to enforce storage requirements at compile time.\n * Methods that require storage will throw `InvalidConfigurationError` at runtime if\n * storage providers are not configured, implementing a fail-fast approach to prevent\n * errors during expensive operations.\n *\n * **Core Architecture:**\n * - **Controllers**: Specialized modules for different Vana features (data, permissions, etc.)\n * - **Platform Adapters**: Environment-specific implementations (browser vs Node.js)\n * - **Storage Managers**: Abstraction layer for multiple storage providers\n * - **Context Sharing**: Unified configuration and services across all controllers\n *\n * For public usage, use the platform-specific factory functions:\n * - Browser: `import { Vana } from '@opendatalabs/vana-sdk/browser'`\n * - Node.js: `import { Vana } from '@opendatalabs/vana-sdk/node'`\n *\n * @example\n * ```typescript\n * // Direct instantiation (advanced usage)\n * import { VanaCore, BrowserPlatformAdapter } from '@opendatalabs/vana-sdk/browser';\n *\n * const core = new VanaCore(new BrowserPlatformAdapter(), {\n *   walletClient: myWalletClient,\n *   storage: {\n *     providers: { ipfs: new IPFSStorage() },\n *     defaultProvider: 'ipfs'\n *   }\n * });\n *\n * // Access all controllers\n * const files = await core.data.getUserFiles();\n * const permissions = await core.permissions.grant({\n *   grantee: '0x742d35...',\n *   operation: 'read'\n * });\n * ```\n * @category Core SDK\n */\nexport class VanaCore {\n  /** Manages gasless data access permissions and trusted server registry. */\n  public readonly permissions: PermissionsController;\n\n  /** Handles user data file operations. */\n  public readonly data: DataController;\n\n  /** Manages data schemas and refiners. */\n  public readonly schemas: SchemaController;\n\n  /** Provides personal server setup and trusted server interactions. */\n  public readonly server: ServerController;\n\n  /** Offers low-level access to Vana protocol smart contracts. */\n  public readonly protocol: ProtocolController;\n\n  /** Handles environment-specific operations like encryption and file systems. */\n  protected platform: VanaPlatformAdapter;\n\n  private readonly relayerCallbacks?: RelayerCallbacks;\n  private readonly downloadRelayer?: DownloadRelayerCallbacks;\n  private readonly storageManager?: StorageManager;\n  private readonly hasRequiredStorage: boolean;\n  private readonly ipfsGateways?: string[];\n  private readonly defaultPersonalServerUrl?: string;\n  private readonly publicClient: import(\"viem\").PublicClient;\n  private readonly walletClient: import(\"viem\").WalletClient;\n\n  /**\n   * Initializes a new VanaCore client instance with the provided configuration.\n   *\n   * @remarks\n   * The constructor validates the configuration, initializes storage providers if configured,\n   * creates wallet and public clients, and sets up all SDK controllers with shared context.\n   *\n   * IMPORTANT: This constructor will validate storage requirements at runtime to fail fast.\n   * Methods that require storage will throw runtime errors if storage is not configured.\n   *\n   * @param platform - The platform adapter for environment-specific operations\n   * @param config - The configuration object specifying wallet or chain settings\n   * @throws {InvalidConfigurationError} When the configuration is invalid or incomplete\n   * @example\n   * ```typescript\n   * // Direct instantiation (consider using factory methods instead)\n   * const vanaCore = new VanaCore(platformAdapter, {\n   *   walletClient: myWalletClient,\n   * });\n   * ```\n   */\n  constructor(platform: VanaPlatformAdapter, config: VanaConfig) {\n    // Store the platform adapter\n    this.platform = platform;\n\n    // Validate configuration\n    this.validateConfig(config);\n\n    // Store relayer callbacks if provided\n    this.relayerCallbacks = config.relayerCallbacks;\n\n    // Store download relayer if provided\n    this.downloadRelayer = config.downloadRelayer;\n\n    // Store IPFS gateways if provided\n    this.ipfsGateways = config.ipfsGateways;\n\n    // Store default personal server URL if provided\n    this.defaultPersonalServerUrl = config.defaultPersonalServerUrl;\n\n    // Check if storage is properly configured\n    this.hasRequiredStorage = hasStorageConfig(config);\n\n    // Initialize storage manager if storage providers are provided\n    if (config.storage?.providers) {\n      this.storageManager = new StorageManager();\n\n      // Register all provided storage providers\n      for (const [name, provider] of Object.entries(config.storage.providers)) {\n        const isDefault = name === config.storage.defaultProvider;\n        this.storageManager.register(\n          name,\n          provider as StorageProvider,\n          isDefault,\n        );\n      }\n\n      // If no default was explicitly set but providers exist, use the first one\n      if (\n        !config.storage.defaultProvider &&\n        Object.keys(config.storage.providers).length > 0\n      ) {\n        const firstProviderName = Object.keys(config.storage.providers)[0];\n        this.storageManager.setDefaultProvider(firstProviderName);\n      }\n    }\n\n    // Create wallet client based on configuration type\n    let walletClient;\n\n    if (isWalletConfig(config)) {\n      // Direct wallet client configuration\n      walletClient = config.walletClient;\n    } else if (isChainConfig(config)) {\n      // Chain configuration - create wallet client\n      if (!config.account) {\n        throw new InvalidConfigurationError(\n          \"Account is required when using ChainConfig\",\n        );\n      }\n\n      const chain = chains[config.chainId];\n      if (!chain) {\n        throw new InvalidConfigurationError(\n          `Unsupported chain ID: ${config.chainId}`,\n        );\n      }\n\n      walletClient = createWalletClient({\n        chain,\n        transport: http(config.rpcUrl || chain.rpcUrls.default.http[0]),\n        account: config.account,\n      });\n    } else {\n      throw new InvalidConfigurationError(\n        \"Invalid configuration: must be either WalletConfig or ChainConfig\",\n      );\n    }\n\n    // Create public client for reading contracts\n    const publicClient = createPublicClient({\n      chain: walletClient.chain,\n      transport: http(),\n    });\n\n    // Store the clients for later use\n    this.publicClient = publicClient;\n    this.walletClient = walletClient;\n\n    // Get default subgraph URL if not provided in config\n    const chainConfig = getChainConfig(walletClient.chain.id);\n    const subgraphUrl = config.subgraphUrl || chainConfig?.subgraphUrl;\n\n    // Create shared context for all controllers, now including the platform adapter\n    const sharedContext: ControllerContext = {\n      walletClient,\n      publicClient,\n      applicationClient: walletClient, // Using same wallet for now\n      relayerCallbacks: this.relayerCallbacks,\n      downloadRelayer: this.downloadRelayer,\n      storageManager: this.storageManager,\n      subgraphUrl,\n      platform: this.platform, // Pass the platform adapter to controllers\n      validateStorageRequired: this.validateStorageRequired.bind(this),\n      hasStorage: this.hasStorage.bind(this),\n      ipfsGateways: this.ipfsGateways,\n      defaultPersonalServerUrl: this.defaultPersonalServerUrl,\n      waitForTransactionEvents: this.waitForTransactionEvents.bind(this),\n      waitForOperation: this.waitForOperation.bind(this),\n    };\n\n    // Initialize controllers\n    this.permissions = new PermissionsController(sharedContext);\n    this.data = new DataController(sharedContext);\n    this.schemas = new SchemaController(sharedContext);\n    this.server = new ServerController(sharedContext);\n    this.protocol = new ProtocolController(sharedContext);\n  }\n\n  /**\n   * Validates that storage is available for storage-dependent operations.\n   * This method enforces the fail-fast principle by checking storage availability\n   * at method call time rather than during expensive operations.\n   *\n   * @throws {InvalidConfigurationError} When storage is required but not configured\n   * @example\n   * ```typescript\n   * // This will throw if storage is not configured\n   * vana.validateStorageRequired();\n   * await vana.data.uploadFile(file); // Safe to proceed\n   * ```\n   */\n  public validateStorageRequired(): void {\n    if (!this.hasRequiredStorage) {\n      throw new InvalidConfigurationError(\n        \"Storage configuration is required for this operation. \" +\n          \"Please configure storage providers in VanaConfig.storage, \" +\n          \"provide a relayerCallbacks.storeGrantFile implementation, \" +\n          \"or pass pre-stored URLs to avoid this dependency. \" +\n          \"\\n\\nFor better type safety, consider using VanaCoreFactory.createWithStorage() \" +\n          \"with VanaConfigWithStorage to catch this error at compile time.\",\n      );\n    }\n  }\n\n  /**\n   * Checks whether storage is configured without throwing an error.\n   *\n   * @returns True if storage is properly configured\n   * @example\n   * ```typescript\n   * if (vana.hasStorage()) {\n   *   await vana.data.uploadFile(file);\n   * } else {\n   *   console.warn('Storage not configured - using pre-stored URLs only');\n   * }\n   * ```\n   */\n  public hasStorage(): boolean {\n    return this.hasRequiredStorage;\n  }\n\n  /**\n   * Type guard to check if this instance has storage enabled at compile time.\n   * Use this when you need TypeScript to understand that storage is available.\n   *\n   * @returns True if storage is configured, with type narrowing\n   * @example\n   * ```typescript\n   * if (vana.isStorageEnabled()) {\n   *   // TypeScript knows storage is available here\n   *   await vana.data.uploadFile(file);\n   * }\n   * ```\n   */\n  public isStorageEnabled(): this is VanaCore & StorageRequiredMarker {\n    return this.hasRequiredStorage;\n  }\n\n  /**\n   * Validates the provided configuration object against all requirements.\n   *\n   * @remarks\n   * This method performs comprehensive validation of wallet client configuration,\n   * chain configuration, storage providers, and relayer callbacks.\n   * @param config - The configuration object to validate\n   * @throws {InvalidConfigurationError} When any configuration parameter is invalid\n   */\n  private validateConfig(config: VanaConfig): void {\n    if (!config) {\n      throw new InvalidConfigurationError(\"Configuration object is required\");\n    }\n\n    // Validate relayerCallbacks if provided\n    if (config.relayerCallbacks !== undefined) {\n      if (typeof config.relayerCallbacks !== \"object\") {\n        throw new InvalidConfigurationError(\n          \"relayerCallbacks must be an object\",\n        );\n      }\n    }\n\n    // Validate storage configuration if provided\n    if (config.storage?.providers) {\n      if (typeof config.storage.providers !== \"object\") {\n        throw new InvalidConfigurationError(\n          \"storage.providers must be an object\",\n        );\n      }\n\n      // Validate that all providers have required methods\n      for (const [name, provider] of Object.entries(config.storage.providers)) {\n        if (!provider || typeof provider !== \"object\") {\n          throw new InvalidConfigurationError(\n            `Storage provider '${name}' must be a valid StorageProvider object`,\n          );\n        }\n      }\n\n      // Validate default provider if specified\n      if (config.storage.defaultProvider) {\n        if (!(config.storage.defaultProvider in config.storage.providers)) {\n          throw new InvalidConfigurationError(\n            `Default storage provider '${config.storage.defaultProvider}' not found in providers`,\n          );\n        }\n      }\n    }\n\n    if (isWalletConfig(config)) {\n      // Validate WalletConfig\n      if (!config.walletClient) {\n        throw new InvalidConfigurationError(\"walletClient is required\");\n      }\n\n      // Validate that walletClient is actually a WalletClient\n      if (\n        typeof config.walletClient !== \"object\" ||\n        !config.walletClient.signTypedData\n      ) {\n        throw new InvalidConfigurationError(\n          \"walletClient must be a valid viem WalletClient\",\n        );\n      }\n\n      // Validate that wallet client has a chain\n      if (!config.walletClient.chain) {\n        throw new InvalidConfigurationError(\n          \"walletClient must have a chain configured\",\n        );\n      }\n\n      // Validate that the chain is supported\n      if (!isVanaChainId(config.walletClient.chain.id)) {\n        throw new InvalidConfigurationError(\n          `Unsupported chain ID: ${config.walletClient.chain.id}. Supported chains: 14800 (Moksha testnet), 1480 (Vana mainnet)`,\n        );\n      }\n    } else if (isChainConfig(config)) {\n      // Validate ChainConfig\n      if (!isVanaChainId(config.chainId)) {\n        throw new InvalidConfigurationError(\n          `Unsupported chain ID: ${config.chainId}. Supported chains: 14800 (Moksha testnet), 1480 (Vana mainnet)`,\n        );\n      }\n\n      // Validate rpcUrl if provided\n      if (config.rpcUrl) {\n        if (typeof config.rpcUrl !== \"string\") {\n          throw new InvalidConfigurationError(\"rpcUrl must be a string\");\n        }\n\n        if (config.rpcUrl.trim() === \"\") {\n          throw new InvalidConfigurationError(\"rpcUrl cannot be empty\");\n        }\n\n        // Basic URL validation for RPC URL\n        try {\n          new URL(config.rpcUrl);\n        } catch {\n          throw new InvalidConfigurationError(\"rpcUrl must be a valid URL\");\n        }\n      }\n\n      // Account is optional for ChainConfig, but if provided, validate it\n      if (config.account) {\n        if (typeof config.account !== \"object\" || !config.account.address) {\n          throw new InvalidConfigurationError(\n            \"account must be a valid viem Account object\",\n          );\n        }\n      }\n    } else {\n      throw new InvalidConfigurationError(\n        \"Configuration must be either WalletConfig or ChainConfig\",\n      );\n    }\n  }\n\n  /**\n   * Gets the current chain ID from the wallet client.\n   *\n   * @returns The numeric chain ID of the connected network\n   * @example\n   * ```typescript\n   * const chainId = vana.chainId;\n   * console.log(`Connected to chain: ${chainId}`); // e.g., \"Connected to chain: 14800\"\n   * ```\n   */\n  get chainId(): number {\n    return this.protocol.getChainId();\n  }\n\n  /**\n   * Gets the current chain name from the wallet client.\n   *\n   * @returns The human-readable name of the connected network\n   * @example\n   * ```typescript\n   * const chainName = vana.chainName;\n   * console.log(`Connected to: ${chainName}`); // e.g., \"Connected to: Moksha Testnet\"\n   * ```\n   */\n  get chainName(): string {\n    return this.protocol.getChainName();\n  }\n\n  /**\n   * Retrieves the user's wallet address from the connected client.\n   *\n   * @returns A Promise that resolves to the user's Ethereum address\n   * @example\n   * ```typescript\n   * const address = await vana.getUserAddress();\n   * console.log(`User address: ${address}`); // e.g., \"User address: 0x742d35...\"\n   * ```\n   */\n  async getUserAddress(): Promise<import(\"viem\").Address> {\n    if (!this.walletClient.account) {\n      throw new Error(\"No wallet account connected\");\n    }\n\n    const account = this.walletClient.account;\n\n    // Return the account address directly if available\n    if (typeof account === \"string\") {\n      return account as import(\"viem\").Address;\n    }\n\n    // If account is an object, get the address property\n    if (typeof account === \"object\" && account.address) {\n      return account.address;\n    }\n\n    throw new Error(\"Unable to determine wallet address\");\n  }\n\n  /**\n   * Retrieves comprehensive runtime configuration information.\n   *\n   * @returns The current runtime configuration including chain, storage, and relayer settings\n   * @example\n   * ```typescript\n   * const config = vana.getConfig();\n   * console.log(`Chain: ${config.chainName} (${config.chainId})`);\n   * console.log(`Storage providers: ${config.storageProviders.join(\", \")}`);\n   * ```\n   */\n  getConfig(): RuntimeConfig {\n    return {\n      chainId: this.chainId as VanaChainId,\n      chainName: this.chainName,\n      relayerCallbacks: this.relayerCallbacks,\n      storageProviders: this.storageManager?.getStorageProviders() || [],\n      defaultStorageProvider: this.storageManager?.getDefaultStorageProvider(),\n    };\n  }\n\n  /**\n   * Sets the platform adapter for environment-specific operations.\n   * This is useful for testing and advanced use cases where you need\n   * to override the default platform detection.\n   *\n   * @param adapter - The platform adapter to use\n   * @example\n   * ```typescript\n   * // For testing with a mock adapter\n   * const mockAdapter = new MockPlatformAdapter();\n   * vana.setPlatformAdapter(mockAdapter);\n   *\n   * // For advanced use cases with custom adapters\n   * const customAdapter = new CustomPlatformAdapter();\n   * vana.setPlatformAdapter(customAdapter);\n   * ```\n   */\n  setPlatformAdapter(adapter: VanaPlatformAdapter): void {\n    this.platform = adapter;\n\n    // Note: Controllers will use the new platform adapter on their next operation\n    // since they access this.platform from the shared context\n  }\n\n  /**\n   * Gets the current platform adapter.\n   * This is useful for advanced use cases where you need to access\n   * the platform adapter directly.\n   *\n   * @returns The current platform adapter\n   * @example\n   * ```typescript\n   * const adapter = vana.getPlatformAdapter();\n   * const encrypted = await adapter.encrypt(data, key);\n   * ```\n   */\n  getPlatformAdapter(): VanaPlatformAdapter {\n    return this.platform;\n  }\n\n  /**\n   * Encrypts data using the Vana protocol standard encryption.\n   *\n   * @remarks\n   * This method implements the Vana network's standard encryption protocol using\n   * platform-appropriate cryptographic libraries. It automatically handles different\n   * input types (string or Blob) and produces encrypted output suitable for secure\n   * storage or transmission. The encryption is compatible with the network's\n   * decryption protocols and can be decrypted by authorized parties.\n   *\n   * @param data - The data to encrypt (string or Blob)\n   * @param key - The encryption key (typically generated via `generateEncryptionKey`)\n   * @returns The encrypted data as a Blob\n   * @throws {Error} When encryption fails due to invalid key or data format\n   * @example\n   * ```typescript\n   * import { generateEncryptionKey } from '@opendatalabs/vana-sdk/node';\n   *\n   * // Generate encryption key from wallet signature\n   * const encryptionKey = await generateEncryptionKey(vana.walletClient);\n   *\n   * // Encrypt string data\n   * const sensitiveData = \"User's private information\";\n   * const encrypted = await vana.encryptBlob(sensitiveData, encryptionKey);\n   *\n   * // Encrypt file data\n   * const fileBlob = new Blob([fileContent], { type: 'application/json' });\n   * const encryptedFile = await vana.encryptBlob(fileBlob, encryptionKey);\n   *\n   * // Store encrypted data safely\n   * await storageProvider.upload(encrypted, 'encrypted-data.bin');\n   * ```\n   */\n  public async encryptBlob(data: string | Blob, key: string): Promise<Blob> {\n    return encryptBlobWithSignedKey(data, key, this.platform);\n  }\n\n  /**\n   * Decrypts data that was encrypted using the Vana protocol.\n   *\n   * @remarks\n   * This method decrypts data that was previously encrypted using the Vana network's\n   * standard encryption protocol. It requires the same wallet signature that was used\n   * for encryption and automatically uses the appropriate platform adapter for\n   * cryptographic operations. The decrypted output maintains the original data format.\n   *\n   * @param encryptedData - The encrypted data (string or Blob)\n   * @param walletSignature - The wallet signature used as decryption key\n   * @returns The decrypted data as a Blob\n   * @throws {Error} When decryption fails due to invalid signature or corrupted data\n   * @example\n   * ```typescript\n   * import { generateEncryptionKey } from '@opendatalabs/vana-sdk/node';\n   *\n   * // Retrieve encrypted data from storage\n   * const encryptedBlob = await storageProvider.download('encrypted-data.bin');\n   *\n   * // Generate the same key used for encryption\n   * const decryptionKey = await generateEncryptionKey(vana.walletClient);\n   *\n   * // Decrypt the data\n   * const decrypted = await vana.decryptBlob(encryptedBlob, decryptionKey);\n   *\n   * // Convert back to original format\n   * const originalText = await decrypted.text();\n   * const originalJson = JSON.parse(originalText);\n   *\n   * console.log('Decrypted data:', originalJson);\n   * ```\n   *\n   * @example\n   * ```typescript\n   * // Decrypt file downloaded from Vana network\n   * const userFiles = await vana.data.getUserFiles();\n   * const file = userFiles[0];\n   *\n   * // Download encrypted content\n   * const encrypted = await fetch(file.url).then(r => r.blob());\n   *\n   * // Decrypt with user's key\n   * const decryptionKey = await generateEncryptionKey(vana.walletClient);\n   * const decrypted = await vana.decryptBlob(encrypted, decryptionKey);\n   *\n   * // Process original data\n   * const fileContent = await decrypted.arrayBuffer();\n   * ```\n   */\n  public async decryptBlob(\n    encryptedData: string | Blob,\n    walletSignature: string,\n  ): Promise<Blob> {\n    return decryptBlobWithSignedKey(\n      encryptedData,\n      walletSignature,\n      this.platform,\n    );\n  }\n\n  /**\n   * Waits for an operation to complete and returns the final result.\n   *\n   * @remarks\n   * This method polls the operation status at regular intervals until it\n   * reaches a terminal state (succeeded, failed, or canceled). Supports\n   * ergonomic overloads to accept either an Operation object or just the ID.\n   *\n   * @param opOrId - Either an Operation object or operation ID string\n   * @param options - Optional polling configuration\n   * @returns The completed operation with result or error\n   * @throws {PersonalServerError} When the operation fails or times out\n   * @example\n   * ```typescript\n   * // Using operation object\n   * const operation = await vana.server.createOperation({ permissionId: 123 });\n   * const completed = await vana.waitForOperation(operation);\n   *\n   * // Using just the ID\n   * const completed = await vana.waitForOperation(\"op_abc123\");\n   *\n   * // With custom timeout\n   * const completed = await vana.waitForOperation(operation, {\n   *   timeout: 60000,\n   *   pollingInterval: 1000\n   * });\n   * ```\n   */\n  public async waitForOperation<T = unknown>(\n    opOrId: import(\"./types/operations\").Operation<T> | string,\n    options?: import(\"./types/operations\").PollingOptions,\n  ): Promise<import(\"./types/operations\").Operation<T>> {\n    return this.server.waitForOperation(opOrId, options);\n  }\n\n  /**\n   * Waits for a transaction to be confirmed and returns the receipt.\n   *\n   * @remarks\n   * This method polls for transaction confirmation on the blockchain.\n   * Supports ergonomic overloads to accept either a transaction result\n   * object or just the hash string.\n   *\n   * @param hashOrObj - Either a TransactionResult object or hash string\n   * @param options - Optional wait configuration\n   * @returns The transaction receipt with logs and status\n   * @example\n   * ```typescript\n   * // Using transaction result object\n   * const tx = await vana.permissions.grant(params);\n   * const receipt = await vana.waitForTransactionReceipt(tx);\n   *\n   * // Using just the hash\n   * const receipt = await vana.waitForTransactionReceipt(\"0x123...\");\n   *\n   * // With custom confirmations\n   * const receipt = await vana.waitForTransactionReceipt(tx, {\n   *   confirmations: 3,\n   *   timeout: 60000\n   * });\n   * ```\n   */\n  public async waitForTransactionReceipt(\n    hashOrObj:\n      | import(\"./types/operations\").TransactionResult\n      | { hash: import(\"viem\").Hash }\n      | import(\"viem\").Hash,\n    options?: import(\"./types/operations\").TransactionWaitOptions,\n  ): Promise<import(\"viem\").TransactionReceipt> {\n    const hash = typeof hashOrObj === \"string\" ? hashOrObj : hashOrObj.hash;\n\n    return this.publicClient.waitForTransactionReceipt({\n      hash,\n      confirmations: options?.confirmations,\n      pollingInterval: options?.pollingInterval,\n      timeout: options?.timeout,\n    });\n  }\n\n  /**\n   * Waits for transaction confirmation and extracts blockchain event data.\n   *\n   * @remarks\n   * This method leverages the context-carrying POJO architecture. When passed a\n   * `TransactionResult` with an `operation` field, it automatically parses the\n   * correct events from the transaction logs. For legacy compatibility, it accepts\n   * raw hashes but will not parse events without operation context.\n   *\n   * @param transaction - Transaction result with operation context\n   * @param options - Optional confirmation and timeout settings\n   * @returns Parsed event data specific to the transaction's operation type\n   * @throws {NetworkError} When transaction confirmation times out\n   * @throws {BlockchainError} When expected events are not found in the transaction\n   *\n   * @example\n   * ```typescript\n   * // Recommended: Pass the transaction result for automatic event parsing\n   * const tx = await vana.permissions.submitAddServerFilesAndPermissions(params);\n   * const events = await vana.waitForTransactionEvents<{ permissionId: bigint }>(tx);\n   * console.log(`Permission ID: ${events.permissionId}`);\n   *\n   * // Legacy: Raw hash without event parsing (returns receipt)\n   * const receipt = await vana.waitForTransactionEvents(\"0x123...\");\n   * ```\n   *\n   * @see For understanding transaction flows, visit https://docs.vana.org/docs/transactions\n   */\n  public async waitForTransactionEvents<\n    C extends import(\"./generated/event-types\").Contract,\n    F extends import(\"./generated/event-types\").Fn<C>\n  >(\n    transaction: import(\"./types/operations\").TransactionResult<C, F>,\n    options?: import(\"./types/operations\").TransactionWaitOptions,\n  ): Promise<import(\"./generated/event-types\").TypedTransactionResult<C, F>> {\n    // Import the POJO-based parser\n    const { parseTransaction } = await import(\"./utils/parseTransactionPojo\");\n    \n    // Wait for the transaction to be mined\n    const receipt = await this.waitForTransactionReceipt(transaction.hash, options);\n    \n    // Parse events using our heuristic-free POJO system\n    const result = parseTransaction(transaction, receipt);\n    \n    // Return the strongly-typed result\n    // TypeScript knows exactly what events are possible!\n    return result;\n  }\n}\n"],"mappings":";;;AAOA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKP,SAAS,iCAAiC;AAC1C;AAAA,EACE;AAAA,OAEK;AACP,SAAS,sBAAsB;AAC/B,SAAS,wBAAwB;AACjC,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AACnC,SAAS,sBAAuC;AAChD,SAAS,oBAAoB,oBAAoB,YAAY;AAC7D,SAAS,cAAc;AACvB,SAAS,sBAAsB;AAE/B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAKA,MAAM,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmB3B,OAAO,kBACL,UACA,QACkC;AAClC,UAAM,OAAO,IAAI,SAAS,UAAU,MAAM;AAC1C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,OAAO,OAAO,UAA+B,QAA8B;AACzE,WAAO,IAAI,SAAS,UAAU,MAAM;AAAA,EACtC;AACF;AAgDO,MAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiDpB,YAAY,UAA+B,QAAoB;AA/C/D;AAAA,wBAAgB;AAGhB;AAAA,wBAAgB;AAGhB;AAAA,wBAAgB;AAGhB;AAAA,wBAAgB;AAGhB;AAAA,wBAAgB;AAGhB;AAAA,wBAAU;AAEV,wBAAiB;AACjB,wBAAiB;AACjB,wBAAiB;AACjB,wBAAiB;AACjB,wBAAiB;AACjB,wBAAiB;AACjB,wBAAiB;AACjB,wBAAiB;AAyBf,SAAK,WAAW;AAGhB,SAAK,eAAe,MAAM;AAG1B,SAAK,mBAAmB,OAAO;AAG/B,SAAK,kBAAkB,OAAO;AAG9B,SAAK,eAAe,OAAO;AAG3B,SAAK,2BAA2B,OAAO;AAGvC,SAAK,qBAAqB,iBAAiB,MAAM;AAGjD,QAAI,OAAO,SAAS,WAAW;AAC7B,WAAK,iBAAiB,IAAI,eAAe;AAGzC,iBAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,OAAO,QAAQ,SAAS,GAAG;AACvE,cAAM,YAAY,SAAS,OAAO,QAAQ;AAC1C,aAAK,eAAe;AAAA,UAClB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAGA,UACE,CAAC,OAAO,QAAQ,mBAChB,OAAO,KAAK,OAAO,QAAQ,SAAS,EAAE,SAAS,GAC/C;AACA,cAAM,oBAAoB,OAAO,KAAK,OAAO,QAAQ,SAAS,EAAE,CAAC;AACjE,aAAK,eAAe,mBAAmB,iBAAiB;AAAA,MAC1D;AAAA,IACF;AAGA,QAAI;AAEJ,QAAI,eAAe,MAAM,GAAG;AAE1B,qBAAe,OAAO;AAAA,IACxB,WAAW,cAAc,MAAM,GAAG;AAEhC,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAEA,YAAM,QAAQ,OAAO,OAAO,OAAO;AACnC,UAAI,CAAC,OAAO;AACV,cAAM,IAAI;AAAA,UACR,yBAAyB,OAAO,OAAO;AAAA,QACzC;AAAA,MACF;AAEA,qBAAe,mBAAmB;AAAA,QAChC;AAAA,QACA,WAAW,KAAK,OAAO,UAAU,MAAM,QAAQ,QAAQ,KAAK,CAAC,CAAC;AAAA,QAC9D,SAAS,OAAO;AAAA,MAClB,CAAC;AAAA,IACH,OAAO;AACL,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAGA,UAAM,eAAe,mBAAmB;AAAA,MACtC,OAAO,aAAa;AAAA,MACpB,WAAW,KAAK;AAAA,IAClB,CAAC;AAGD,SAAK,eAAe;AACpB,SAAK,eAAe;AAGpB,UAAM,cAAc,eAAe,aAAa,MAAM,EAAE;AACxD,UAAM,cAAc,OAAO,eAAe,aAAa;AAGvD,UAAM,gBAAmC;AAAA,MACvC;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA;AAAA,MACnB,kBAAkB,KAAK;AAAA,MACvB,iBAAiB,KAAK;AAAA,MACtB,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA,UAAU,KAAK;AAAA;AAAA,MACf,yBAAyB,KAAK,wBAAwB,KAAK,IAAI;AAAA,MAC/D,YAAY,KAAK,WAAW,KAAK,IAAI;AAAA,MACrC,cAAc,KAAK;AAAA,MACnB,0BAA0B,KAAK;AAAA,MAC/B,0BAA0B,KAAK,yBAAyB,KAAK,IAAI;AAAA,MACjE,kBAAkB,KAAK,iBAAiB,KAAK,IAAI;AAAA,IACnD;AAGA,SAAK,cAAc,IAAI,sBAAsB,aAAa;AAC1D,SAAK,OAAO,IAAI,eAAe,aAAa;AAC5C,SAAK,UAAU,IAAI,iBAAiB,aAAa;AACjD,SAAK,SAAS,IAAI,iBAAiB,aAAa;AAChD,SAAK,WAAW,IAAI,mBAAmB,aAAa;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeO,0BAAgC;AACrC,QAAI,CAAC,KAAK,oBAAoB;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MAMF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeO,aAAsB;AAC3B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeO,mBAA6D;AAClE,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,eAAe,QAA0B;AAC/C,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,0BAA0B,kCAAkC;AAAA,IACxE;AAGA,QAAI,OAAO,qBAAqB,QAAW;AACzC,UAAI,OAAO,OAAO,qBAAqB,UAAU;AAC/C,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,OAAO,SAAS,WAAW;AAC7B,UAAI,OAAO,OAAO,QAAQ,cAAc,UAAU;AAChD,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAGA,iBAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,OAAO,QAAQ,SAAS,GAAG;AACvE,YAAI,CAAC,YAAY,OAAO,aAAa,UAAU;AAC7C,gBAAM,IAAI;AAAA,YACR,qBAAqB,IAAI;AAAA,UAC3B;AAAA,QACF;AAAA,MACF;AAGA,UAAI,OAAO,QAAQ,iBAAiB;AAClC,YAAI,EAAE,OAAO,QAAQ,mBAAmB,OAAO,QAAQ,YAAY;AACjE,gBAAM,IAAI;AAAA,YACR,6BAA6B,OAAO,QAAQ,eAAe;AAAA,UAC7D;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,eAAe,MAAM,GAAG;AAE1B,UAAI,CAAC,OAAO,cAAc;AACxB,cAAM,IAAI,0BAA0B,0BAA0B;AAAA,MAChE;AAGA,UACE,OAAO,OAAO,iBAAiB,YAC/B,CAAC,OAAO,aAAa,eACrB;AACA,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAGA,UAAI,CAAC,OAAO,aAAa,OAAO;AAC9B,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAGA,UAAI,CAAC,cAAc,OAAO,aAAa,MAAM,EAAE,GAAG;AAChD,cAAM,IAAI;AAAA,UACR,yBAAyB,OAAO,aAAa,MAAM,EAAE;AAAA,QACvD;AAAA,MACF;AAAA,IACF,WAAW,cAAc,MAAM,GAAG;AAEhC,UAAI,CAAC,cAAc,OAAO,OAAO,GAAG;AAClC,cAAM,IAAI;AAAA,UACR,yBAAyB,OAAO,OAAO;AAAA,QACzC;AAAA,MACF;AAGA,UAAI,OAAO,QAAQ;AACjB,YAAI,OAAO,OAAO,WAAW,UAAU;AACrC,gBAAM,IAAI,0BAA0B,yBAAyB;AAAA,QAC/D;AAEA,YAAI,OAAO,OAAO,KAAK,MAAM,IAAI;AAC/B,gBAAM,IAAI,0BAA0B,wBAAwB;AAAA,QAC9D;AAGA,YAAI;AACF,cAAI,IAAI,OAAO,MAAM;AAAA,QACvB,QAAQ;AACN,gBAAM,IAAI,0BAA0B,4BAA4B;AAAA,QAClE;AAAA,MACF;AAGA,UAAI,OAAO,SAAS;AAClB,YAAI,OAAO,OAAO,YAAY,YAAY,CAAC,OAAO,QAAQ,SAAS;AACjE,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,OAAO;AACL,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,IAAI,UAAkB;AACpB,WAAO,KAAK,SAAS,WAAW;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,IAAI,YAAoB;AACtB,WAAO,KAAK,SAAS,aAAa;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,iBAAkD;AACtD,QAAI,CAAC,KAAK,aAAa,SAAS;AAC9B,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AAEA,UAAM,UAAU,KAAK,aAAa;AAGlC,QAAI,OAAO,YAAY,UAAU;AAC/B,aAAO;AAAA,IACT;AAGA,QAAI,OAAO,YAAY,YAAY,QAAQ,SAAS;AAClD,aAAO,QAAQ;AAAA,IACjB;AAEA,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,YAA2B;AACzB,WAAO;AAAA,MACL,SAAS,KAAK;AAAA,MACd,WAAW,KAAK;AAAA,MAChB,kBAAkB,KAAK;AAAA,MACvB,kBAAkB,KAAK,gBAAgB,oBAAoB,KAAK,CAAC;AAAA,MACjE,wBAAwB,KAAK,gBAAgB,0BAA0B;AAAA,IACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,mBAAmB,SAAoC;AACrD,SAAK,WAAW;AAAA,EAIlB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,qBAA0C;AACxC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmCA,MAAa,YAAY,MAAqB,KAA4B;AACxE,WAAO,yBAAyB,MAAM,KAAK,KAAK,QAAQ;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoDA,MAAa,YACX,eACA,iBACe;AACf,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,MAAa,iBACX,QACA,SACoD;AACpD,WAAO,KAAK,OAAO,iBAAiB,QAAQ,OAAO;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6BA,MAAa,0BACX,WAIA,SAC4C;AAC5C,UAAM,OAAO,OAAO,cAAc,WAAW,YAAY,UAAU;AAEnE,WAAO,KAAK,aAAa,0BAA0B;AAAA,MACjD;AAAA,MACA,eAAe,SAAS;AAAA,MACxB,iBAAiB,SAAS;AAAA,MAC1B,SAAS,SAAS;AAAA,IACpB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,MAAa,yBAIX,aACA,SACyE;AAEzE,UAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,8BAA8B;AAGxE,UAAM,UAAU,MAAM,KAAK,0BAA0B,YAAY,MAAM,OAAO;AAG9E,UAAM,SAAS,iBAAiB,aAAa,OAAO;AAIpD,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../src/core.ts"],"sourcesContent":["import type {\n  VanaConfig,\n  VanaConfigWithStorage,\n  RuntimeConfig,\n  VanaChainId,\n  StorageRequiredMarker,\n} from \"./types\";\nimport {\n  isWalletConfig,\n  isChainConfig,\n  isReadOnlyConfig,\n  isAddressOnlyConfig,\n  isVanaChainId,\n  hasStorageConfig,\n} from \"./types\";\nimport type {\n  RelayerCallbacks,\n  DownloadRelayerCallbacks,\n} from \"./types/config\";\nimport { InvalidConfigurationError } from \"./errors\";\nimport type { ControllerContext } from \"./controllers/permissions\";\nimport { PermissionsController } from \"./controllers/permissions\";\nimport { DataController } from \"./controllers/data\";\nimport { SchemaController } from \"./controllers/schemas\";\nimport { ServerController } from \"./controllers/server\";\nimport { ProtocolController } from \"./controllers/protocol\";\nimport { StorageManager } from \"./storage\";\nimport { createWalletClient, createPublicClient, http } from \"viem\";\nimport type {\n  PublicClient,\n  WalletClient,\n  Address,\n  Hash,\n  TransactionReceipt,\n  Chain,\n} from \"viem\";\nimport { extractAddress } from \"./utils/wallet\";\nimport type {\n  Operation,\n  PollingOptions,\n  TransactionResult,\n  TransactionWaitOptions,\n} from \"./types/operations\";\nimport type {\n  Contract,\n  Fn,\n  TypedTransactionResult,\n} from \"./generated/event-types\";\nimport { chains } from \"./config/chains\";\nimport { getChainConfig, vanaMainnet } from \"./chains\";\nimport type { VanaPlatformAdapter } from \"./platform/interface\";\nimport {\n  encryptBlobWithSignedKey,\n  decryptBlobWithSignedKey,\n} from \"./utils/encryption\";\n\n/**\n * Factory functions for creating VanaCore instances with proper type safety\n */\nexport class VanaCoreFactory {\n  /**\n   * Creates a VanaCore instance that enforces storage requirements at compile time.\n   * Use this factory when you know you'll need storage-dependent operations.\n   *\n   * @param platform - The platform adapter for environment-specific operations\n   * @param config - Configuration that includes required storage providers\n   * @returns VanaCore instance with storage validation\n   * @example\n   * ```typescript\n   * const vanaCore = VanaCoreFactory.createWithStorage(platformAdapter, {\n   *   walletClient: myWalletClient,\n   *   storage: {\n   *     providers: { ipfs: new IPFSStorage() },\n   *     defaultProvider: 'ipfs'\n   *   }\n   * });\n   * ```\n   */\n  static createWithStorage(\n    platform: VanaPlatformAdapter,\n    config: VanaConfigWithStorage,\n  ): VanaCore & StorageRequiredMarker {\n    const core = new VanaCore(platform, config);\n    return core as VanaCore & StorageRequiredMarker;\n  }\n\n  /**\n   * Creates a VanaCore instance without storage requirements.\n   * Storage-dependent operations will fail at runtime if not configured.\n   *\n   * @param platform - The platform adapter for environment-specific operations\n   * @param config - Basic configuration without required storage\n   * @returns VanaCore instance\n   * @example\n   * ```typescript\n   * const vanaCore = VanaCoreFactory.create(platformAdapter, {\n   *   walletClient: myWalletClient\n   * });\n   * ```\n   */\n  static create(platform: VanaPlatformAdapter, config: VanaConfig): VanaCore {\n    return new VanaCore(platform, config);\n  }\n}\n\n/**\n * Provides the core SDK functionality for interacting with the Vana network.\n *\n * @remarks\n * This environment-agnostic class contains all SDK logic and accepts a platform\n * adapter to handle environment-specific operations. It initializes all controllers\n * and manages shared context between them, providing a unified interface for\n * data management, permissions, smart contracts, and storage operations.\n *\n * The class uses TypeScript overloading to enforce storage requirements at compile time.\n * Methods that require storage will throw `InvalidConfigurationError` at runtime if\n * storage providers are not configured, implementing a fail-fast approach to prevent\n * errors during expensive operations.\n *\n * **Core Architecture:**\n * - **Controllers**: Specialized modules for different Vana features (data, permissions, etc.)\n * - **Platform Adapters**: Environment-specific implementations (browser vs Node.js)\n * - **Storage Managers**: Abstraction layer for multiple storage providers\n * - **Context Sharing**: Unified configuration and services across all controllers\n *\n * For public usage, use the platform-specific factory functions:\n * - Browser: `import { Vana } from '@opendatalabs/vana-sdk/browser'`\n * - Node.js: `import { Vana } from '@opendatalabs/vana-sdk/node'`\n *\n * @example\n * ```typescript\n * // Direct instantiation (advanced usage)\n * import { VanaCore, BrowserPlatformAdapter } from '@opendatalabs/vana-sdk/browser';\n *\n * const core = new VanaCore(new BrowserPlatformAdapter(), {\n *   walletClient: myWalletClient,\n *   storage: {\n *     providers: { ipfs: new IPFSStorage() },\n *     defaultProvider: 'ipfs'\n *   }\n * });\n *\n * // Access all controllers\n * const files = await core.data.getUserFiles();\n * const permissions = await core.permissions.grant({\n *   grantee: '0x742d35...',\n *   operation: 'read'\n * });\n * ```\n * @category Core SDK\n */\nexport class VanaCore {\n  /** Manages gasless data access permissions and trusted server registry. */\n  public readonly permissions: PermissionsController;\n\n  /** Handles user data file operations. */\n  public readonly data: DataController;\n\n  /** Manages data schemas and refiners. */\n  public readonly schemas: SchemaController;\n\n  /** Provides personal server setup and trusted server interactions. */\n  public readonly server: ServerController;\n\n  /** Offers low-level access to Vana protocol smart contracts. */\n  public readonly protocol: ProtocolController;\n\n  /** Handles environment-specific operations like encryption and file systems. */\n  protected platform: VanaPlatformAdapter;\n\n  private readonly relayerCallbacks?: RelayerCallbacks;\n  private readonly downloadRelayer?: DownloadRelayerCallbacks;\n  private readonly storageManager?: StorageManager;\n  private readonly hasRequiredStorage: boolean;\n  private readonly ipfsGateways?: string[];\n  private readonly publicClient: PublicClient;\n  private readonly walletClient?: WalletClient;\n  private readonly _staticUserAddress?: Address; // For read-only mode\n\n  /**\n   * Initializes a new VanaCore client instance with the provided configuration.\n   *\n   * @remarks\n   * The constructor validates the configuration, initializes storage providers if configured,\n   * creates wallet and public clients, and sets up all SDK controllers with shared context.\n   *\n   * IMPORTANT: This constructor will validate storage requirements at runtime to fail fast.\n   * Methods that require storage will throw runtime errors if storage is not configured.\n   *\n   * @param platform - The platform adapter for environment-specific operations\n   * @param config - The configuration object specifying wallet or chain settings\n   * @throws {InvalidConfigurationError} When the configuration is invalid or incomplete\n   * @example\n   * ```typescript\n   * // Direct instantiation (consider using factory methods instead)\n   * const vanaCore = new VanaCore(platformAdapter, {\n   *   walletClient: myWalletClient,\n   * });\n   * ```\n   */\n  constructor(platform: VanaPlatformAdapter, config: VanaConfig) {\n    // Store the platform adapter\n    this.platform = platform;\n\n    // Validate configuration\n    this.validateConfig(config);\n\n    // Store relayer callbacks if provided\n    this.relayerCallbacks = config.relayerCallbacks;\n\n    // Store download relayer if provided\n    this.downloadRelayer = config.downloadRelayer;\n\n    // Store IPFS gateways if provided\n    this.ipfsGateways = config.ipfsGateways;\n\n    // Check if storage is properly configured\n    this.hasRequiredStorage = hasStorageConfig(config);\n\n    // Initialize storage manager if storage providers are provided\n    if (config.storage?.providers) {\n      this.storageManager = new StorageManager();\n\n      // Register all provided storage providers\n      for (const [name, provider] of Object.entries(config.storage.providers)) {\n        const isDefault = name === config.storage.defaultProvider;\n        this.storageManager.register(name, provider, isDefault);\n      }\n\n      // If no default was explicitly set but providers exist, use the first one\n      if (\n        !config.storage.defaultProvider &&\n        Object.keys(config.storage.providers).length > 0\n      ) {\n        const firstProviderName = Object.keys(config.storage.providers)[0];\n        this.storageManager.setDefaultProvider(firstProviderName);\n      }\n    }\n\n    // Initialize clients based on configuration type\n    let walletClient: WalletClient | undefined;\n    let publicClient: PublicClient;\n    let staticUserAddress: Address | undefined; // Only for read-only mode\n    let chainToUse: Chain;\n\n    if (isWalletConfig(config)) {\n      // Full mode with wallet client\n      walletClient = config.walletClient;\n      chainToUse = (walletClient.chain as Chain) ?? vanaMainnet;\n\n      // In wallet mode, address is dynamic (not stored)\n      staticUserAddress = undefined;\n\n      // Use provided publicClient or create one\n      if (\"publicClient\" in config && config.publicClient) {\n        publicClient = config.publicClient;\n      } else {\n        publicClient = createPublicClient({\n          chain: chainToUse,\n          transport: http(),\n        });\n      }\n    } else if (isReadOnlyConfig(config)) {\n      // Read-only mode with public client and address\n      walletClient = undefined;\n      publicClient = config.publicClient;\n      staticUserAddress = config.address;\n      chainToUse = config.publicClient.chain ?? vanaMainnet;\n    } else if (isAddressOnlyConfig(config)) {\n      // Read-only mode with just address (create public client)\n      walletClient = undefined;\n      staticUserAddress = config.address;\n      chainToUse = config.chain ?? vanaMainnet;\n\n      publicClient = createPublicClient({\n        chain: chainToUse,\n        transport: http(),\n      });\n    } else if (isChainConfig(config)) {\n      // Legacy chain configuration - create wallet client\n      if (!config.account) {\n        throw new InvalidConfigurationError(\n          \"Account is required when using ChainConfig\",\n        );\n      }\n\n      const chain = chains[config.chainId];\n      if (!chain) {\n        throw new InvalidConfigurationError(\n          `Unsupported chain ID: ${config.chainId}`,\n        );\n      }\n\n      chainToUse = chain;\n      walletClient = createWalletClient({\n        chain,\n        transport: http(config.rpcUrl ?? chain.rpcUrls.default.http[0]),\n        account: config.account,\n      });\n      // In wallet mode, address is dynamic (not stored)\n      staticUserAddress = undefined;\n      publicClient = createPublicClient({\n        chain,\n        transport: http(),\n      });\n    } else {\n      throw new InvalidConfigurationError(\n        \"Invalid configuration: must provide either walletClient, publicClient + address, or address alone\",\n      );\n    }\n\n    // Store the clients and static address for later use\n    this.publicClient = publicClient;\n    this.walletClient = walletClient;\n    this._staticUserAddress = staticUserAddress;\n\n    // Get default service URLs from chain config if not provided\n    const chainConfig = getChainConfig(chainToUse.id);\n    const subgraphUrl = config.subgraphUrl ?? chainConfig?.subgraphUrl;\n    const personalServerUrl =\n      config.defaultPersonalServerUrl ?? chainConfig?.personalServerUrl;\n\n    // Create shared context for all controllers with dynamic userAddress getter\n    const self = this; // Capture VanaCore instance for getter delegation\n    const sharedContext: ControllerContext = {\n      walletClient,\n      publicClient,\n      get userAddress() {\n        // Delegate to VanaCore's getter for dynamic resolution\n        return self.userAddress;\n      },\n      applicationClient: walletClient, // Using same wallet for now\n      relayerCallbacks: this.relayerCallbacks,\n      downloadRelayer: this.downloadRelayer,\n      storageManager: this.storageManager,\n      subgraphUrl,\n      platform: this.platform, // Pass the platform adapter to controllers\n      validateStorageRequired: this.validateStorageRequired.bind(this),\n      hasStorage: this.hasStorage.bind(this),\n      ipfsGateways: this.ipfsGateways,\n      defaultPersonalServerUrl: personalServerUrl,\n      waitForTransactionEvents: this.waitForTransactionEvents.bind(this),\n      waitForOperation: this.waitForOperation.bind(this),\n    };\n\n    // Initialize controllers\n    this.permissions = new PermissionsController(sharedContext);\n    this.data = new DataController(sharedContext);\n    this.schemas = new SchemaController(sharedContext);\n    this.server = new ServerController(sharedContext);\n    this.protocol = new ProtocolController(sharedContext);\n  }\n\n  /**\n   * Validates that storage is available for storage-dependent operations.\n   * This method enforces the fail-fast principle by checking storage availability\n   * at method call time rather than during expensive operations.\n   *\n   * @throws {InvalidConfigurationError} When storage is required but not configured\n   * @example\n   * ```typescript\n   * // This will throw if storage is not configured\n   * vana.validateStorageRequired();\n   * await vana.data.uploadFile(file); // Safe to proceed\n   * ```\n   */\n  public validateStorageRequired(): void {\n    if (!this.hasRequiredStorage) {\n      throw new InvalidConfigurationError(\n        \"Storage configuration is required for this operation. \" +\n          \"Please configure storage providers in VanaConfig.storage, \" +\n          \"provide a relayerCallbacks.storeGrantFile implementation, \" +\n          \"or pass pre-stored URLs to avoid this dependency. \" +\n          \"\\n\\nFor better type safety, consider using VanaCoreFactory.createWithStorage() \" +\n          \"with VanaConfigWithStorage to catch this error at compile time.\",\n      );\n    }\n  }\n\n  /**\n   * Checks whether storage is configured without throwing an error.\n   *\n   * @returns True if storage is properly configured\n   * @example\n   * ```typescript\n   * if (vana.hasStorage()) {\n   *   await vana.data.uploadFile(file);\n   * } else {\n   *   console.warn('Storage not configured - using pre-stored URLs only');\n   * }\n   * ```\n   */\n  public hasStorage(): boolean {\n    return this.hasRequiredStorage;\n  }\n\n  /**\n   * Type guard to check if this instance has storage enabled at compile time.\n   * Use this when you need TypeScript to understand that storage is available.\n   *\n   * @returns True if storage is configured, with type narrowing\n   * @example\n   * ```typescript\n   * if (vana.isStorageEnabled()) {\n   *   // TypeScript knows storage is available here\n   *   await vana.data.uploadFile(file);\n   * }\n   * ```\n   */\n  public isStorageEnabled(): this is VanaCore & StorageRequiredMarker {\n    return this.hasRequiredStorage;\n  }\n\n  /**\n   * Validates the provided configuration object against all requirements.\n   *\n   * @remarks\n   * This method performs comprehensive validation of wallet client configuration,\n   * chain configuration, storage providers, and relayer callbacks.\n   * @param config - The configuration object to validate\n   * @throws {InvalidConfigurationError} When any configuration parameter is invalid\n   */\n  private validateConfig(config: VanaConfig): void {\n    if (!config) {\n      throw new InvalidConfigurationError(\"Configuration object is required\");\n    }\n\n    // Validate relayerCallbacks if provided\n    if (config.relayerCallbacks !== undefined) {\n      if (typeof config.relayerCallbacks !== \"object\") {\n        throw new InvalidConfigurationError(\n          \"relayerCallbacks must be an object\",\n        );\n      }\n    }\n\n    // Validate storage configuration if provided\n    if (config.storage?.providers) {\n      if (typeof config.storage.providers !== \"object\") {\n        throw new InvalidConfigurationError(\n          \"storage.providers must be an object\",\n        );\n      }\n\n      // Validate that all providers have required methods\n      for (const [name, provider] of Object.entries(config.storage.providers)) {\n        if (!provider || typeof provider !== \"object\") {\n          throw new InvalidConfigurationError(\n            `Storage provider '${name}' must be a valid StorageProvider object`,\n          );\n        }\n      }\n\n      // Validate default provider if specified\n      if (config.storage.defaultProvider) {\n        if (!(config.storage.defaultProvider in config.storage.providers)) {\n          throw new InvalidConfigurationError(\n            `Default storage provider '${config.storage.defaultProvider}' not found in providers`,\n          );\n        }\n      }\n    }\n\n    if (isWalletConfig(config)) {\n      // Validate WalletConfig\n      if (!config.walletClient) {\n        throw new InvalidConfigurationError(\"walletClient is required\");\n      }\n\n      // Validate that walletClient is actually a WalletClient\n      if (\n        typeof config.walletClient !== \"object\" ||\n        !config.walletClient.signTypedData\n      ) {\n        throw new InvalidConfigurationError(\n          \"walletClient must be a valid viem WalletClient\",\n        );\n      }\n\n      // Validate that wallet client has a chain\n      if (!config.walletClient.chain) {\n        throw new InvalidConfigurationError(\n          \"walletClient must have a chain configured\",\n        );\n      }\n\n      // Validate that the chain is supported\n      if (!isVanaChainId(config.walletClient.chain.id)) {\n        throw new InvalidConfigurationError(\n          `Unsupported chain ID: ${String(config.walletClient.chain.id)}. Supported chains: 14800 (Moksha testnet), 1480 (Vana mainnet)`,\n        );\n      }\n    } else if (isChainConfig(config)) {\n      // Validate ChainConfig\n      if (!isVanaChainId(config.chainId)) {\n        throw new InvalidConfigurationError(\n          `Unsupported chain ID: ${String(config.chainId)}. Supported chains: 14800 (Moksha testnet), 1480 (Vana mainnet)`,\n        );\n      }\n\n      // Validate rpcUrl if provided\n      if (config.rpcUrl) {\n        if (typeof config.rpcUrl !== \"string\") {\n          throw new InvalidConfigurationError(\"rpcUrl must be a string\");\n        }\n\n        if (config.rpcUrl.trim() === \"\") {\n          throw new InvalidConfigurationError(\"rpcUrl cannot be empty\");\n        }\n\n        // Basic URL validation for RPC URL\n        try {\n          new URL(config.rpcUrl);\n        } catch {\n          throw new InvalidConfigurationError(\"rpcUrl must be a valid URL\");\n        }\n      }\n\n      // Account is optional for ChainConfig, but if provided, validate it\n      if (config.account) {\n        if (typeof config.account !== \"object\" || !config.account.address) {\n          throw new InvalidConfigurationError(\n            \"account must be a valid viem Account object\",\n          );\n        }\n      }\n    } else if (isReadOnlyConfig(config)) {\n      // Validate read-only config with publicClient and address\n      if (!config.publicClient) {\n        throw new InvalidConfigurationError(\n          \"publicClient is required for read-only configuration\",\n        );\n      }\n      if (!config.address) {\n        throw new InvalidConfigurationError(\n          \"address is required for read-only configuration\",\n        );\n      }\n    } else if (isAddressOnlyConfig(config)) {\n      // Validate address-only config\n      if (!config.address) {\n        throw new InvalidConfigurationError(\n          \"address is required for address-only configuration\",\n        );\n      }\n      // chain is optional, will use default\n    } else {\n      throw new InvalidConfigurationError(\n        \"Invalid configuration: must provide either walletClient, publicClient + address, or address alone\",\n      );\n    }\n  }\n\n  /**\n   * Gets the current chain ID from the wallet client.\n   *\n   * @returns The numeric chain ID of the connected network\n   * @example\n   * ```typescript\n   * const chainId = vana.chainId;\n   * console.log(`Connected to chain: ${chainId}`); // e.g., \"Connected to chain: 14800\"\n   * ```\n   */\n  get chainId(): number {\n    return this.protocol.getChainId();\n  }\n\n  /**\n   * Gets the current chain name from the wallet client.\n   *\n   * @returns The human-readable name of the connected network\n   * @example\n   * ```typescript\n   * const chainName = vana.chainName;\n   * console.log(`Connected to: ${chainName}`); // e.g., \"Connected to: Moksha Testnet\"\n   * ```\n   */\n  get chainName(): string {\n    return this.protocol.getChainName();\n  }\n\n  /**\n   * The user's wallet address.\n   * In wallet mode, this always returns the current wallet account address.\n   * In read-only mode, this returns the static address provided during initialization.\n   *\n   * @example\n   * ```typescript\n   * const address = vana.userAddress;\n   * console.log(`User address: ${address}`); // e.g., \"User address: 0x742d35...\"\n   * ```\n   */\n  get userAddress(): Address {\n    // In wallet mode: dynamically read from wallet\n    if (this.walletClient?.account) {\n      return extractAddress(this.walletClient.account);\n    }\n\n    // In read-only mode: use static address\n    if (this._staticUserAddress) {\n      return this._staticUserAddress;\n    }\n\n    throw new Error(\"No user address available\");\n  }\n\n  /**\n   * Retrieves comprehensive runtime configuration information.\n   *\n   * @returns The current runtime configuration including chain, storage, and relayer settings\n   * @example\n   * ```typescript\n   * const config = vana.getConfig();\n   * console.log(`Chain: ${config.chainName} (${config.chainId})`);\n   * console.log(`Storage providers: ${config.storageProviders.join(\", \")}`);\n   * ```\n   */\n  getConfig(): RuntimeConfig {\n    return {\n      chainId: this.chainId as VanaChainId,\n      chainName: this.chainName,\n      relayerCallbacks: this.relayerCallbacks,\n      storageProviders: this.storageManager?.getStorageProviders() ?? [],\n      defaultStorageProvider: this.storageManager?.getDefaultStorageProvider(),\n    };\n  }\n\n  /**\n   * Sets the platform adapter for environment-specific operations.\n   * This is useful for testing and advanced use cases where you need\n   * to override the default platform detection.\n   *\n   * @param adapter - The platform adapter to use\n   * @example\n   * ```typescript\n   * // For testing with a mock adapter\n   * const mockAdapter = new MockPlatformAdapter();\n   * vana.setPlatformAdapter(mockAdapter);\n   *\n   * // For advanced use cases with custom adapters\n   * const customAdapter = new CustomPlatformAdapter();\n   * vana.setPlatformAdapter(customAdapter);\n   * ```\n   */\n  setPlatformAdapter(adapter: VanaPlatformAdapter): void {\n    this.platform = adapter;\n\n    // Note: Controllers will use the new platform adapter on their next operation\n    // since they access this.platform from the shared context\n  }\n\n  /**\n   * Gets the current platform adapter.\n   * This is useful for advanced use cases where you need to access\n   * the platform adapter directly.\n   *\n   * @returns The current platform adapter\n   * @example\n   * ```typescript\n   * const adapter = vana.getPlatformAdapter();\n   * const encrypted = await adapter.encrypt(data, key);\n   * ```\n   */\n  getPlatformAdapter(): VanaPlatformAdapter {\n    return this.platform;\n  }\n\n  /**\n   * Encrypts data using the Vana protocol standard encryption.\n   *\n   * @remarks\n   * This method implements the Vana network's standard encryption protocol using\n   * platform-appropriate cryptographic libraries. It automatically handles different\n   * input types (string or Blob) and produces encrypted output suitable for secure\n   * storage or transmission. The encryption is compatible with the network's\n   * decryption protocols and can be decrypted by authorized parties.\n   *\n   * @param data - The data to encrypt (string or Blob)\n   * @param key - The encryption key (typically generated via `generateEncryptionKey`)\n   * @returns The encrypted data as a Blob\n   * @throws {Error} When encryption fails due to invalid key or data format\n   * @example\n   * ```typescript\n   * import { generateEncryptionKey } from '@opendatalabs/vana-sdk/node';\n   *\n   * // Generate encryption key from wallet signature\n   * const encryptionKey = await generateEncryptionKey(vana.walletClient);\n   *\n   * // Encrypt string data\n   * const sensitiveData = \"User's private information\";\n   * const encrypted = await vana.encryptBlob(sensitiveData, encryptionKey);\n   *\n   * // Encrypt file data\n   * const fileBlob = new Blob([fileContent], { type: 'application/json' });\n   * const encryptedFile = await vana.encryptBlob(fileBlob, encryptionKey);\n   *\n   * // Store encrypted data safely\n   * await storageProvider.upload(encrypted, 'encrypted-data.bin');\n   * ```\n   */\n  public async encryptBlob(data: string | Blob, key: string): Promise<Blob> {\n    return encryptBlobWithSignedKey(data, key, this.platform);\n  }\n\n  /**\n   * Decrypts data that was encrypted using the Vana protocol.\n   *\n   * @remarks\n   * This method decrypts data that was previously encrypted using the Vana network's\n   * standard encryption protocol. It requires the same wallet signature that was used\n   * for encryption and automatically uses the appropriate platform adapter for\n   * cryptographic operations. The decrypted output maintains the original data format.\n   *\n   * @param encryptedData - The encrypted data (string or Blob)\n   * @param walletSignature - The wallet signature used as decryption key\n   * @returns The decrypted data as a Blob\n   * @throws {Error} When decryption fails due to invalid signature or corrupted data\n   * @example\n   * ```typescript\n   * import { generateEncryptionKey } from '@opendatalabs/vana-sdk/node';\n   *\n   * // Retrieve encrypted data from storage\n   * const encryptedBlob = await storageProvider.download('encrypted-data.bin');\n   *\n   * // Generate the same key used for encryption\n   * const decryptionKey = await generateEncryptionKey(vana.walletClient);\n   *\n   * // Decrypt the data\n   * const decrypted = await vana.decryptBlob(encryptedBlob, decryptionKey);\n   *\n   * // Convert back to original format\n   * const originalText = await decrypted.text();\n   * const originalJson = JSON.parse(originalText);\n   *\n   * console.log('Decrypted data:', originalJson);\n   * ```\n   *\n   * @example\n   * ```typescript\n   * // Decrypt file downloaded from Vana network\n   * const userFiles = await vana.data.getUserFiles();\n   * const file = userFiles[0];\n   *\n   * // Download encrypted content\n   * const encrypted = await fetch(file.url).then(r => r.blob());\n   *\n   * // Decrypt with user's key\n   * const decryptionKey = await generateEncryptionKey(vana.walletClient);\n   * const decrypted = await vana.decryptBlob(encrypted, decryptionKey);\n   *\n   * // Process original data\n   * const fileContent = await decrypted.arrayBuffer();\n   * ```\n   */\n  public async decryptBlob(\n    encryptedData: string | Blob,\n    walletSignature: string,\n  ): Promise<Blob> {\n    return decryptBlobWithSignedKey(\n      encryptedData,\n      walletSignature,\n      this.platform,\n    );\n  }\n\n  /**\n   * Waits for an operation to complete and returns the final result.\n   *\n   * @remarks\n   * This method polls the operation status at regular intervals until it\n   * reaches a terminal state (succeeded, failed, or canceled). Supports\n   * ergonomic overloads to accept either an Operation object or just the ID.\n   *\n   * @param opOrId - Either an Operation object or operation ID string\n   * @param options - Optional polling configuration\n   * @returns The completed operation with result or error\n   * @throws {PersonalServerError} When the operation fails or times out\n   * @example\n   * ```typescript\n   * // Using operation object\n   * const operation = await vana.server.createOperation({ permissionId: 123 });\n   * const completed = await vana.waitForOperation(operation);\n   *\n   * // Using just the ID\n   * const completed = await vana.waitForOperation(\"op_abc123\");\n   *\n   * // With custom timeout\n   * const completed = await vana.waitForOperation(operation, {\n   *   timeout: 60000,\n   *   pollingInterval: 1000\n   * });\n   * ```\n   */\n  public async waitForOperation<T = unknown>(\n    opOrId: Operation<T> | string,\n    options?: PollingOptions,\n  ): Promise<Operation<T>> {\n    return this.server.waitForOperation(opOrId, options);\n  }\n\n  /**\n   * Waits for a transaction to be confirmed and returns the receipt.\n   *\n   * @remarks\n   * This method polls for transaction confirmation on the blockchain.\n   * Supports ergonomic overloads to accept either a transaction result\n   * object or just the hash string.\n   *\n   * @param hashOrObj - Either a TransactionResult object or hash string\n   * @param options - Optional wait configuration\n   * @returns The transaction receipt with logs and status\n   * @example\n   * ```typescript\n   * // Using transaction result object\n   * const tx = await vana.permissions.grant(params);\n   * const receipt = await vana.waitForTransactionReceipt(tx);\n   *\n   * // Using just the hash\n   * const receipt = await vana.waitForTransactionReceipt(\"0x123...\");\n   *\n   * // With custom confirmations\n   * const receipt = await vana.waitForTransactionReceipt(tx, {\n   *   confirmations: 3,\n   *   timeout: 60000\n   * });\n   * ```\n   */\n  public async waitForTransactionReceipt(\n    hashOrObj: TransactionResult | { hash: Hash } | Hash,\n    options?: TransactionWaitOptions,\n  ): Promise<TransactionReceipt> {\n    const hash = typeof hashOrObj === \"string\" ? hashOrObj : hashOrObj.hash;\n\n    return this.publicClient.waitForTransactionReceipt({\n      hash,\n      confirmations: options?.confirmations,\n      pollingInterval: options?.pollingInterval,\n      timeout: options?.timeout,\n    });\n  }\n\n  /**\n   * Waits for transaction confirmation and extracts blockchain event data.\n   *\n   * @remarks\n   * This method leverages the context-carrying POJO architecture. When passed a\n   * `TransactionResult` with an `operation` field, it automatically parses the\n   * correct events from the transaction logs. For legacy compatibility, it accepts\n   * raw hashes but will not parse events without operation context.\n   *\n   * @param transaction - Transaction result with operation context\n   * @param options - Optional confirmation and timeout settings\n   * @returns Parsed event data specific to the transaction's operation type\n   * @throws {NetworkError} When transaction confirmation times out\n   * @throws {BlockchainError} When expected events are not found in the transaction\n   *\n   * @example\n   * ```typescript\n   * // Recommended: Pass the transaction result for automatic event parsing\n   * const tx = await vana.permissions.submitAddServerFilesAndPermissions(params);\n   * const events = await vana.waitForTransactionEvents<{ permissionId: bigint }>(tx);\n   * console.log(`Permission ID: ${events.permissionId}`);\n   *\n   * // Legacy: Raw hash without event parsing (returns receipt)\n   * const receipt = await vana.waitForTransactionEvents(\"0x123...\");\n   * ```\n   *\n   * @see For understanding transaction flows, visit https://docs.vana.org/docs/transactions\n   */\n  public async waitForTransactionEvents<C extends Contract, F extends Fn<C>>(\n    transaction: TransactionResult<C, F>,\n    options?: TransactionWaitOptions,\n  ): Promise<TypedTransactionResult<C, F>> {\n    // Import the POJO-based parser\n    const { parseTransaction } = await import(\"./utils/parseTransactionPojo\");\n\n    // Wait for the transaction to be mined\n    const receipt = await this.waitForTransactionReceipt(\n      transaction.hash,\n      options,\n    );\n\n    // Parse events using our heuristic-free POJO system\n    const result = parseTransaction(transaction, receipt);\n\n    // Return the strongly-typed result\n    // TypeScript knows exactly what events are possible!\n    return result;\n  }\n}\n"],"mappings":"AAOA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKP,SAAS,iCAAiC;AAE1C,SAAS,6BAA6B;AACtC,SAAS,sBAAsB;AAC/B,SAAS,wBAAwB;AACjC,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AACnC,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB,oBAAoB,YAAY;AAS7D,SAAS,sBAAsB;AAY/B,SAAS,cAAc;AACvB,SAAS,gBAAgB,mBAAmB;AAE5C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAKA,MAAM,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmB3B,OAAO,kBACL,UACA,QACkC;AAClC,UAAM,OAAO,IAAI,SAAS,UAAU,MAAM;AAC1C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,OAAO,OAAO,UAA+B,QAA8B;AACzE,WAAO,IAAI,SAAS,UAAU,MAAM;AAAA,EACtC;AACF;AAgDO,MAAM,SAAS;AAAA;AAAA,EAEJ;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGN;AAAA,EAEO;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBjB,YAAY,UAA+B,QAAoB;AAE7D,SAAK,WAAW;AAGhB,SAAK,eAAe,MAAM;AAG1B,SAAK,mBAAmB,OAAO;AAG/B,SAAK,kBAAkB,OAAO;AAG9B,SAAK,eAAe,OAAO;AAG3B,SAAK,qBAAqB,iBAAiB,MAAM;AAGjD,QAAI,OAAO,SAAS,WAAW;AAC7B,WAAK,iBAAiB,IAAI,eAAe;AAGzC,iBAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,OAAO,QAAQ,SAAS,GAAG;AACvE,cAAM,YAAY,SAAS,OAAO,QAAQ;AAC1C,aAAK,eAAe,SAAS,MAAM,UAAU,SAAS;AAAA,MACxD;AAGA,UACE,CAAC,OAAO,QAAQ,mBAChB,OAAO,KAAK,OAAO,QAAQ,SAAS,EAAE,SAAS,GAC/C;AACA,cAAM,oBAAoB,OAAO,KAAK,OAAO,QAAQ,SAAS,EAAE,CAAC;AACjE,aAAK,eAAe,mBAAmB,iBAAiB;AAAA,MAC1D;AAAA,IACF;AAGA,QAAI;AACJ,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI,eAAe,MAAM,GAAG;AAE1B,qBAAe,OAAO;AACtB,mBAAc,aAAa,SAAmB;AAG9C,0BAAoB;AAGpB,UAAI,kBAAkB,UAAU,OAAO,cAAc;AACnD,uBAAe,OAAO;AAAA,MACxB,OAAO;AACL,uBAAe,mBAAmB;AAAA,UAChC,OAAO;AAAA,UACP,WAAW,KAAK;AAAA,QAClB,CAAC;AAAA,MACH;AAAA,IACF,WAAW,iBAAiB,MAAM,GAAG;AAEnC,qBAAe;AACf,qBAAe,OAAO;AACtB,0BAAoB,OAAO;AAC3B,mBAAa,OAAO,aAAa,SAAS;AAAA,IAC5C,WAAW,oBAAoB,MAAM,GAAG;AAEtC,qBAAe;AACf,0BAAoB,OAAO;AAC3B,mBAAa,OAAO,SAAS;AAE7B,qBAAe,mBAAmB;AAAA,QAChC,OAAO;AAAA,QACP,WAAW,KAAK;AAAA,MAClB,CAAC;AAAA,IACH,WAAW,cAAc,MAAM,GAAG;AAEhC,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAEA,YAAM,QAAQ,OAAO,OAAO,OAAO;AACnC,UAAI,CAAC,OAAO;AACV,cAAM,IAAI;AAAA,UACR,yBAAyB,OAAO,OAAO;AAAA,QACzC;AAAA,MACF;AAEA,mBAAa;AACb,qBAAe,mBAAmB;AAAA,QAChC;AAAA,QACA,WAAW,KAAK,OAAO,UAAU,MAAM,QAAQ,QAAQ,KAAK,CAAC,CAAC;AAAA,QAC9D,SAAS,OAAO;AAAA,MAClB,CAAC;AAED,0BAAoB;AACpB,qBAAe,mBAAmB;AAAA,QAChC;AAAA,QACA,WAAW,KAAK;AAAA,MAClB,CAAC;AAAA,IACH,OAAO;AACL,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAGA,SAAK,eAAe;AACpB,SAAK,eAAe;AACpB,SAAK,qBAAqB;AAG1B,UAAM,cAAc,eAAe,WAAW,EAAE;AAChD,UAAM,cAAc,OAAO,eAAe,aAAa;AACvD,UAAM,oBACJ,OAAO,4BAA4B,aAAa;AAGlD,UAAM,OAAO;AACb,UAAM,gBAAmC;AAAA,MACvC;AAAA,MACA;AAAA,MACA,IAAI,cAAc;AAEhB,eAAO,KAAK;AAAA,MACd;AAAA,MACA,mBAAmB;AAAA;AAAA,MACnB,kBAAkB,KAAK;AAAA,MACvB,iBAAiB,KAAK;AAAA,MACtB,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA,UAAU,KAAK;AAAA;AAAA,MACf,yBAAyB,KAAK,wBAAwB,KAAK,IAAI;AAAA,MAC/D,YAAY,KAAK,WAAW,KAAK,IAAI;AAAA,MACrC,cAAc,KAAK;AAAA,MACnB,0BAA0B;AAAA,MAC1B,0BAA0B,KAAK,yBAAyB,KAAK,IAAI;AAAA,MACjE,kBAAkB,KAAK,iBAAiB,KAAK,IAAI;AAAA,IACnD;AAGA,SAAK,cAAc,IAAI,sBAAsB,aAAa;AAC1D,SAAK,OAAO,IAAI,eAAe,aAAa;AAC5C,SAAK,UAAU,IAAI,iBAAiB,aAAa;AACjD,SAAK,SAAS,IAAI,iBAAiB,aAAa;AAChD,SAAK,WAAW,IAAI,mBAAmB,aAAa;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeO,0BAAgC;AACrC,QAAI,CAAC,KAAK,oBAAoB;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MAMF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeO,aAAsB;AAC3B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeO,mBAA6D;AAClE,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,eAAe,QAA0B;AAC/C,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,0BAA0B,kCAAkC;AAAA,IACxE;AAGA,QAAI,OAAO,qBAAqB,QAAW;AACzC,UAAI,OAAO,OAAO,qBAAqB,UAAU;AAC/C,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,OAAO,SAAS,WAAW;AAC7B,UAAI,OAAO,OAAO,QAAQ,cAAc,UAAU;AAChD,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAGA,iBAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,OAAO,QAAQ,SAAS,GAAG;AACvE,YAAI,CAAC,YAAY,OAAO,aAAa,UAAU;AAC7C,gBAAM,IAAI;AAAA,YACR,qBAAqB,IAAI;AAAA,UAC3B;AAAA,QACF;AAAA,MACF;AAGA,UAAI,OAAO,QAAQ,iBAAiB;AAClC,YAAI,EAAE,OAAO,QAAQ,mBAAmB,OAAO,QAAQ,YAAY;AACjE,gBAAM,IAAI;AAAA,YACR,6BAA6B,OAAO,QAAQ,eAAe;AAAA,UAC7D;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,eAAe,MAAM,GAAG;AAE1B,UAAI,CAAC,OAAO,cAAc;AACxB,cAAM,IAAI,0BAA0B,0BAA0B;AAAA,MAChE;AAGA,UACE,OAAO,OAAO,iBAAiB,YAC/B,CAAC,OAAO,aAAa,eACrB;AACA,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAGA,UAAI,CAAC,OAAO,aAAa,OAAO;AAC9B,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAGA,UAAI,CAAC,cAAc,OAAO,aAAa,MAAM,EAAE,GAAG;AAChD,cAAM,IAAI;AAAA,UACR,yBAAyB,OAAO,OAAO,aAAa,MAAM,EAAE,CAAC;AAAA,QAC/D;AAAA,MACF;AAAA,IACF,WAAW,cAAc,MAAM,GAAG;AAEhC,UAAI,CAAC,cAAc,OAAO,OAAO,GAAG;AAClC,cAAM,IAAI;AAAA,UACR,yBAAyB,OAAO,OAAO,OAAO,CAAC;AAAA,QACjD;AAAA,MACF;AAGA,UAAI,OAAO,QAAQ;AACjB,YAAI,OAAO,OAAO,WAAW,UAAU;AACrC,gBAAM,IAAI,0BAA0B,yBAAyB;AAAA,QAC/D;AAEA,YAAI,OAAO,OAAO,KAAK,MAAM,IAAI;AAC/B,gBAAM,IAAI,0BAA0B,wBAAwB;AAAA,QAC9D;AAGA,YAAI;AACF,cAAI,IAAI,OAAO,MAAM;AAAA,QACvB,QAAQ;AACN,gBAAM,IAAI,0BAA0B,4BAA4B;AAAA,QAClE;AAAA,MACF;AAGA,UAAI,OAAO,SAAS;AAClB,YAAI,OAAO,OAAO,YAAY,YAAY,CAAC,OAAO,QAAQ,SAAS;AACjE,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,WAAW,iBAAiB,MAAM,GAAG;AAEnC,UAAI,CAAC,OAAO,cAAc;AACxB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,WAAW,oBAAoB,MAAM,GAAG;AAEtC,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IAEF,OAAO;AACL,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,IAAI,UAAkB;AACpB,WAAO,KAAK,SAAS,WAAW;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,IAAI,YAAoB;AACtB,WAAO,KAAK,SAAS,aAAa;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,IAAI,cAAuB;AAEzB,QAAI,KAAK,cAAc,SAAS;AAC9B,aAAO,eAAe,KAAK,aAAa,OAAO;AAAA,IACjD;AAGA,QAAI,KAAK,oBAAoB;AAC3B,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,IAAI,MAAM,2BAA2B;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,YAA2B;AACzB,WAAO;AAAA,MACL,SAAS,KAAK;AAAA,MACd,WAAW,KAAK;AAAA,MAChB,kBAAkB,KAAK;AAAA,MACvB,kBAAkB,KAAK,gBAAgB,oBAAoB,KAAK,CAAC;AAAA,MACjE,wBAAwB,KAAK,gBAAgB,0BAA0B;AAAA,IACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,mBAAmB,SAAoC;AACrD,SAAK,WAAW;AAAA,EAIlB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,qBAA0C;AACxC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmCA,MAAa,YAAY,MAAqB,KAA4B;AACxE,WAAO,yBAAyB,MAAM,KAAK,KAAK,QAAQ;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoDA,MAAa,YACX,eACA,iBACe;AACf,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,MAAa,iBACX,QACA,SACuB;AACvB,WAAO,KAAK,OAAO,iBAAiB,QAAQ,OAAO;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6BA,MAAa,0BACX,WACA,SAC6B;AAC7B,UAAM,OAAO,OAAO,cAAc,WAAW,YAAY,UAAU;AAEnE,WAAO,KAAK,aAAa,0BAA0B;AAAA,MACjD;AAAA,MACA,eAAe,SAAS;AAAA,MACxB,iBAAiB,SAAS;AAAA,MAC1B,SAAS,SAAS;AAAA,IACpB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,MAAa,yBACX,aACA,SACuC;AAEvC,UAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,8BAA8B;AAGxE,UAAM,UAAU,MAAM,KAAK;AAAA,MACzB,YAAY;AAAA,MACZ;AAAA,IACF;AAGA,UAAM,SAAS,iBAAiB,aAAa,OAAO;AAIpD,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/crypto/ecies/__tests__/base.test.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Tests for BaseECIES protected methods and utilities
+ */
+export {};

package/dist/crypto/ecies/__tests__/compatibility.test.d.ts

@@ -0,0 +1,8 @@
+/**
+ * ECIES Compatibility Test Suite
+ *
+ * Verifies that our new ECIES implementation is 100% compatible with eccrypto.
+ * Uses pre-generated test vectors from eccrypto to ensure backward compatibility
+ * with existing encrypted data in the Vana network.
+ */
+export {};

package/dist/crypto/ecies/__tests__/constants.test.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Tests for ECIES constants and validation helpers
+ */
+export {};

package/dist/crypto/ecies/__tests__/native-parity.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Native secp256k1 Parity Tests
+ *
+ * Critical tests to ensure native secp256k1 produces identical results
+ * to @noble/secp256k1, especially for ECDH operations.
+ */
+export {};

package/dist/crypto/ecies/__tests__/normalization.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/crypto/ecies/__tests__/test-vectors.d.ts

@@ -5,7 +5,7 @@
  *
  * These vectors ensure our ECIES implementation is compatible with eccrypto
  */
-declare const eccryptoTestVectors: ({
+export declare const eccryptoTestVectors: ({
     name: string;
     privateKey: string;
     publicKey: string;
@@ -30,11 +30,9 @@ declare const eccryptoTestVectors: ({
         mac: string;
     };
 })[];
-declare const eccryptoFormat: {
+export declare const eccryptoFormat: {
     ivLength: number;
     ephemPublicKeyLength: number;
     macLength: number;
     getFormatLength: (ciphertextLength: number) => number;
 };
-
-export { eccryptoFormat, eccryptoTestVectors };

package/dist/crypto/ecies/base.cjs

@@ -24,6 +24,7 @@ module.exports = __toCommonJS(base_exports);
 var import_interface = require("./interface");
 var import_constants = require("./constants");
 var import_utils = require("./utils");
+var import_viem = require("viem");
 class BaseECIESUint8 {
   // Cache for validated public keys to avoid repeated validation
   static validatedKeys = /* @__PURE__ */ new WeakMap();
@@ -114,7 +115,7 @@ class BaseECIESUint8 {
       );
       const iv = this.generateRandomBytes(import_constants.CIPHER.IV_LENGTH);
       const ciphertext = await this.aesEncrypt(encryptionKey, iv, message);
-      const macData = (0, import_utils.concatBytes)(iv, ephemeralPublicKey, ciphertext);
+      const macData = (0, import_viem.concat)([iv, ephemeralPublicKey, ciphertext]);
       const mac = this.hmacSha256(macKey, macData);
       this.clearBuffer(ephemeralPrivateKey);
       this.clearBuffer(sharedSecret);
@@ -174,11 +175,11 @@ class BaseECIESUint8 {
         import_constants.KDF.MAC_KEY_OFFSET,
         import_constants.KDF.MAC_KEY_OFFSET + import_constants.KDF.MAC_KEY_LENGTH
       );
-      const macData = (0, import_utils.concatBytes)(
+      const macData = (0, import_viem.concat)([
         encrypted.iv,
         encrypted.ephemPublicKey,
         encrypted.ciphertext
-      );
+      ]);
       const expectedMac = this.hmacSha256(macKey, macData);
       if (!(0, import_utils.constantTimeEqual)(encrypted.mac, expectedMac)) {
         throw new import_interface.ECIESError("MAC verification failed", "MAC_MISMATCH");

package/dist/crypto/ecies/base.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/crypto/ecies/base.ts"],"sourcesContent":["import type { ECIESProvider, ECIESEncrypted } from \"./interface\";\nimport { ECIESError, isECIESEncrypted } from \"./interface\";\nimport { CURVE, CIPHER, KDF } from \"./constants\";\nimport { concatBytes, constantTimeEqual } from \"./utils\";\n\n/**\n * Provides shared ECIES encryption logic across platforms using Uint8Array.\n *\n * @remarks\n * Platform implementations extend this class and provide crypto primitives.\n * The base class handles the ECIES protocol flow while maintaining\n * compatibility with the eccrypto data format.\n *\n * **Implementation details:**\n * - KDF: SHA-512(shared_secret) → encKey (32B) || macKey (32B)\n * - Cipher: AES-256-CBC with random 16-byte IV\n * - MAC: HMAC-SHA256(macKey, iv || ephemPublicKey || ciphertext)\n *\n * @category Cryptography\n */\nexport abstract class BaseECIESUint8 implements ECIESProvider {\n  // Cache for validated public keys to avoid repeated validation\n  private static readonly validatedKeys = new WeakMap<Uint8Array, boolean>();\n\n  /**\n   * Generates cryptographically secure random bytes.\n   *\n   * @param length - Number of random bytes to generate.\n   * @returns Random bytes array.\n   */\n  protected abstract generateRandomBytes(length: number): Uint8Array;\n\n  /**\n   * Verifies a private key is valid for secp256k1.\n   *\n   * @param privateKey - Private key to verify (32 bytes).\n   * @returns `true` if valid private key.\n   */\n  protected abstract verifyPrivateKey(privateKey: Uint8Array): boolean;\n\n  /**\n   * Creates a public key from a private key.\n   *\n   * @param privateKey - Source private key (32 bytes).\n   * @param compressed - Generate compressed (33B) or uncompressed (65B) format.\n   * @returns Public key or `null` if creation failed.\n   */\n  protected abstract createPublicKey(\n    privateKey: Uint8Array,\n    compressed: boolean,\n  ): Uint8Array | null;\n\n  /**\n   * Validates a public key on the secp256k1 curve.\n   *\n   * @param publicKey - Public key to validate.\n   * @returns `true` if valid public key.\n   */\n  protected abstract validatePublicKey(publicKey: Uint8Array): boolean;\n\n  /**\n   * Decompresses a compressed public key.\n   *\n   * @param publicKey - Compressed public key (33 bytes).\n   * @returns Uncompressed public key (65 bytes) or `null` if decompression failed.\n   */\n  protected abstract decompressPublicKey(\n    publicKey: Uint8Array,\n  ): Uint8Array | null;\n\n  /**\n   * Performs ECDH key agreement.\n   *\n   * @param publicKey - Other party's public key.\n   * @param privateKey - Your private key.\n   * @returns Raw X coordinate of shared point (32 bytes).\n   */\n  protected abstract performECDH(\n    publicKey: Uint8Array,\n    privateKey: Uint8Array,\n  ): Uint8Array;\n\n  /**\n   * Computes SHA-512 hash.\n   *\n   * @param data - Data to hash.\n   * @returns SHA-512 hash (64 bytes).\n   */\n  protected abstract sha512(data: Uint8Array): Uint8Array;\n\n  /**\n   * Computes HMAC-SHA256 authentication tag.\n   *\n   * @param key - HMAC key.\n   * @param data - Data to authenticate.\n   * @returns HMAC-SHA256 (32 bytes).\n   */\n  protected abstract hmacSha256(key: Uint8Array, data: Uint8Array): Uint8Array;\n\n  /**\n   * Encrypts data using AES-256-CBC.\n   *\n   * @param key - Encryption key (32 bytes).\n   * @param iv - Initialization vector (16 bytes).\n   * @param plaintext - Data to encrypt.\n   * @returns Ciphertext with PKCS#7 padding.\n   */\n  protected abstract aesEncrypt(\n    key: Uint8Array,\n    iv: Uint8Array,\n    plaintext: Uint8Array,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Decrypts data using AES-256-CBC.\n   *\n   * @param key - Decryption key (32 bytes).\n   * @param iv - Initialization vector (16 bytes).\n   * @param ciphertext - Data to decrypt.\n   * @returns Plaintext with padding removed.\n   */\n  protected abstract aesDecrypt(\n    key: Uint8Array,\n    iv: Uint8Array,\n    ciphertext: Uint8Array,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Normalizes a public key to uncompressed format.\n   *\n   * @param publicKey - Public key in any format.\n   * @returns Uncompressed public key (65 bytes).\n   * @throws {ECIESError} If key format is invalid.\n   */\n  protected normalizePublicKey(publicKey: Uint8Array): Uint8Array {\n    // Check cache first\n    if (BaseECIESUint8.validatedKeys.has(publicKey)) {\n      return publicKey;\n    }\n\n    if (publicKey.length === CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH) {\n      if (publicKey[0] !== CURVE.PREFIX.UNCOMPRESSED) {\n        throw new ECIESError(\n          \"Invalid uncompressed public key prefix\",\n          \"INVALID_KEY\",\n        );\n      }\n      // Validate and cache\n      if (!this.validatePublicKey(publicKey)) {\n        throw new ECIESError(\"Invalid public key\", \"INVALID_KEY\");\n      }\n      BaseECIESUint8.validatedKeys.set(publicKey, true);\n      return publicKey;\n    }\n\n    if (publicKey.length === CURVE.COMPRESSED_PUBLIC_KEY_LENGTH) {\n      const decompressed = this.decompressPublicKey(publicKey);\n      if (!decompressed) {\n        throw new ECIESError(\"Failed to decompress public key\", \"INVALID_KEY\");\n      }\n      // Cache the decompressed key\n      BaseECIESUint8.validatedKeys.set(decompressed, true);\n      return decompressed;\n    }\n\n    throw new ECIESError(\n      `Invalid public key length: ${publicKey.length}`,\n      \"INVALID_KEY\",\n    );\n  }\n\n  /**\n   * Normalizes a public key to uncompressed format (65 bytes with 0x04 prefix).\n   * Must be implemented by derived classes to handle platform-specific operations.\n   *\n   * @param publicKey - The public key to normalize\n   * @returns The normalized uncompressed public key\n   */\n  public abstract normalizeToUncompressed(publicKey: Uint8Array): Uint8Array;\n\n  /**\n   * Encrypts data using ECIES.\n   *\n   * @param publicKey - The recipient's public key (compressed or uncompressed)\n   * @param message - The data to encrypt\n   * @returns Promise resolving to encrypted data structure\n   */\n  async encrypt(\n    publicKey: Uint8Array,\n    message: Uint8Array,\n  ): Promise<ECIESEncrypted> {\n    try {\n      // Validate inputs\n      if (!(publicKey instanceof Uint8Array)) {\n        throw new ECIESError(\"Public key must be a Uint8Array\", \"INVALID_KEY\");\n      }\n      if (!(message instanceof Uint8Array)) {\n        throw new ECIESError(\n          \"Message must be a Uint8Array\",\n          \"ENCRYPTION_FAILED\",\n        );\n      }\n      if (publicKey.length === 0) {\n        throw new ECIESError(\"Public key cannot be empty\", \"INVALID_KEY\");\n      }\n\n      // Normalize public key to uncompressed format\n      const pubKey = this.normalizePublicKey(publicKey);\n\n      // Generate ephemeral key pair\n      let ephemeralPrivateKey: Uint8Array;\n      do {\n        ephemeralPrivateKey = this.generateRandomBytes(\n          CURVE.PRIVATE_KEY_LENGTH,\n        );\n      } while (!this.verifyPrivateKey(ephemeralPrivateKey));\n\n      const ephemeralPublicKey = this.createPublicKey(\n        ephemeralPrivateKey,\n        false,\n      );\n      if (!ephemeralPublicKey) {\n        throw new ECIESError(\n          \"Failed to generate ephemeral public key\",\n          \"ENCRYPTION_FAILED\",\n        );\n      }\n\n      // Perform ECDH to get shared secret (raw X coordinate)\n      const sharedSecret = this.performECDH(pubKey, ephemeralPrivateKey);\n\n      // Derive keys using SHA-512 (eccrypto-compatible KDF)\n      const kdf = this.sha512(sharedSecret);\n      const encryptionKey = kdf.slice(\n        KDF.ENCRYPTION_KEY_OFFSET,\n        KDF.ENCRYPTION_KEY_OFFSET + KDF.ENCRYPTION_KEY_LENGTH,\n      );\n      const macKey = kdf.slice(\n        KDF.MAC_KEY_OFFSET,\n        KDF.MAC_KEY_OFFSET + KDF.MAC_KEY_LENGTH,\n      );\n\n      // Generate random IV and encrypt\n      const iv = this.generateRandomBytes(CIPHER.IV_LENGTH);\n      const ciphertext = await this.aesEncrypt(encryptionKey, iv, message);\n\n      // Calculate MAC (Encrypt-then-MAC)\n      const macData = concatBytes(iv, ephemeralPublicKey, ciphertext);\n      const mac = this.hmacSha256(macKey, macData);\n\n      // Clear sensitive data\n      this.clearBuffer(ephemeralPrivateKey);\n      this.clearBuffer(sharedSecret);\n      this.clearBuffer(kdf);\n\n      return {\n        iv,\n        ephemPublicKey: ephemeralPublicKey,\n        ciphertext,\n        mac,\n      };\n    } catch (error) {\n      if (error instanceof ECIESError) throw error;\n      throw new ECIESError(\n        `Encryption failed: ${error instanceof Error ? error.message : \"Unknown error\"}`,\n        \"ENCRYPTION_FAILED\",\n        error instanceof Error ? error : undefined,\n      );\n    }\n  }\n\n  /**\n   * Decrypts ECIES encrypted data.\n   *\n   * @param privateKey - The recipient's private key (32 bytes)\n   * @param encrypted - The encrypted data structure from encrypt()\n   * @returns Promise resolving to the original plaintext\n   */\n  async decrypt(\n    privateKey: Uint8Array,\n    encrypted: ECIESEncrypted,\n  ): Promise<Uint8Array> {\n    try {\n      // Validate inputs\n      if (!(privateKey instanceof Uint8Array)) {\n        throw new ECIESError(\"Private key must be a Uint8Array\", \"INVALID_KEY\");\n      }\n      if (!isECIESEncrypted(encrypted)) {\n        throw new ECIESError(\n          \"Invalid encrypted data structure\",\n          \"DECRYPTION_FAILED\",\n        );\n      }\n      if (privateKey.length !== CURVE.PRIVATE_KEY_LENGTH) {\n        throw new ECIESError(\n          `Invalid private key length: ${privateKey.length}`,\n          \"INVALID_KEY\",\n        );\n      }\n      if (!this.verifyPrivateKey(privateKey)) {\n        throw new ECIESError(\"Invalid private key\", \"INVALID_KEY\");\n      }\n\n      // Normalize ephemeral public key to uncompressed format\n      const ephemeralPublicKey = this.normalizePublicKey(\n        encrypted.ephemPublicKey,\n      );\n\n      // Perform ECDH to recover shared secret\n      const sharedSecret = this.performECDH(ephemeralPublicKey, privateKey);\n\n      // Derive keys using SHA-512 (eccrypto-compatible KDF)\n      const kdf = this.sha512(sharedSecret);\n      const encryptionKey = kdf.slice(\n        KDF.ENCRYPTION_KEY_OFFSET,\n        KDF.ENCRYPTION_KEY_OFFSET + KDF.ENCRYPTION_KEY_LENGTH,\n      );\n      const macKey = kdf.slice(\n        KDF.MAC_KEY_OFFSET,\n        KDF.MAC_KEY_OFFSET + KDF.MAC_KEY_LENGTH,\n      );\n\n      // Verify MAC before decryption (Encrypt-then-MAC)\n      const macData = concatBytes(\n        encrypted.iv,\n        encrypted.ephemPublicKey,\n        encrypted.ciphertext,\n      );\n      const expectedMac = this.hmacSha256(macKey, macData);\n\n      if (!constantTimeEqual(encrypted.mac, expectedMac)) {\n        throw new ECIESError(\"MAC verification failed\", \"MAC_MISMATCH\");\n      }\n\n      // Decrypt the ciphertext\n      const decrypted = await this.aesDecrypt(\n        encryptionKey,\n        encrypted.iv,\n        encrypted.ciphertext,\n      );\n\n      // Clear sensitive data\n      this.clearBuffer(sharedSecret);\n      this.clearBuffer(kdf);\n\n      return decrypted;\n    } catch (error) {\n      if (error instanceof ECIESError) throw error;\n      throw new ECIESError(\n        `Decryption failed: ${error instanceof Error ? error.message : \"Unknown error\"}`,\n        \"DECRYPTION_FAILED\",\n        error instanceof Error ? error : undefined,\n      );\n    }\n  }\n\n  /**\n   * Clears sensitive data from memory using multi-pass overwrite.\n   *\n   * @remarks\n   * Uses multiple passes with different patterns to make it harder\n   * for JIT compilers to optimize away the operation. While not\n   * guaranteed in JavaScript, this is a best-effort approach to\n   * clear sensitive data from memory.\n   *\n   * @param buffer - The buffer to clear\n   */\n  protected clearBuffer(buffer: Uint8Array): void {\n    if (buffer && buffer.length > 0) {\n      // Multi-pass overwrite to resist compiler optimization\n      buffer.fill(0x00); // Fill with zeros\n      buffer.fill(0xff); // Fill with ones\n      buffer.fill(0xaa); // Fill with alternating pattern\n      buffer.fill(0x00); // Final zero fill\n\n      // Additional pattern write to further discourage optimization\n      for (let i = 0; i < buffer.length; i++) {\n        buffer[i] = (i & 0xff) ^ 0x5a; // XOR with pattern\n      }\n      buffer.fill(0x00); // Final clear\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,uBAA6C;AAC7C,uBAAmC;AACnC,mBAA+C;AAiBxC,MAAe,eAAwC;AAAA;AAAA,EAE5D,OAAwB,gBAAgB,oBAAI,QAA6B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgH/D,mBAAmB,WAAmC;AAE9D,QAAI,eAAe,cAAc,IAAI,SAAS,GAAG;AAC/C,aAAO;AAAA,IACT;AAEA,QAAI,UAAU,WAAW,uBAAM,gCAAgC;AAC7D,UAAI,UAAU,CAAC,MAAM,uBAAM,OAAO,cAAc;AAC9C,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,UAAI,CAAC,KAAK,kBAAkB,SAAS,GAAG;AACtC,cAAM,IAAI,4BAAW,sBAAsB,aAAa;AAAA,MAC1D;AACA,qBAAe,cAAc,IAAI,WAAW,IAAI;AAChD,aAAO;AAAA,IACT;AAEA,QAAI,UAAU,WAAW,uBAAM,8BAA8B;AAC3D,YAAM,eAAe,KAAK,oBAAoB,SAAS;AACvD,UAAI,CAAC,cAAc;AACjB,cAAM,IAAI,4BAAW,mCAAmC,aAAa;AAAA,MACvE;AAEA,qBAAe,cAAc,IAAI,cAAc,IAAI;AACnD,aAAO;AAAA,IACT;AAEA,UAAM,IAAI;AAAA,MACR,8BAA8B,UAAU,MAAM;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAM,QACJ,WACA,SACyB;AACzB,QAAI;AAEF,UAAI,EAAE,qBAAqB,aAAa;AACtC,cAAM,IAAI,4BAAW,mCAAmC,aAAa;AAAA,MACvE;AACA,UAAI,EAAE,mBAAmB,aAAa;AACpC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,UAAU,WAAW,GAAG;AAC1B,cAAM,IAAI,4BAAW,8BAA8B,aAAa;AAAA,MAClE;AAGA,YAAM,SAAS,KAAK,mBAAmB,SAAS;AAGhD,UAAI;AACJ,SAAG;AACD,8BAAsB,KAAK;AAAA,UACzB,uBAAM;AAAA,QACR;AAAA,MACF,SAAS,CAAC,KAAK,iBAAiB,mBAAmB;AAEnD,YAAM,qBAAqB,KAAK;AAAA,QAC9B;AAAA,QACA;AAAA,MACF;AACA,UAAI,CAAC,oBAAoB;AACvB,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAGA,YAAM,eAAe,KAAK,YAAY,QAAQ,mBAAmB;AAGjE,YAAM,MAAM,KAAK,OAAO,YAAY;AACpC,YAAM,gBAAgB,IAAI;AAAA,QACxB,qBAAI;AAAA,QACJ,qBAAI,wBAAwB,qBAAI;AAAA,MAClC;AACA,YAAM,SAAS,IAAI;AAAA,QACjB,qBAAI;AAAA,QACJ,qBAAI,iBAAiB,qBAAI;AAAA,MAC3B;AAGA,YAAM,KAAK,KAAK,oBAAoB,wBAAO,SAAS;AACpD,YAAM,aAAa,MAAM,KAAK,WAAW,eAAe,IAAI,OAAO;AAGnE,YAAM,cAAU,0BAAY,IAAI,oBAAoB,UAAU;AAC9D,YAAM,MAAM,KAAK,WAAW,QAAQ,OAAO;AAG3C,WAAK,YAAY,mBAAmB;AACpC,WAAK,YAAY,YAAY;AAC7B,WAAK,YAAY,GAAG;AAEpB,aAAO;AAAA,QACL;AAAA,QACA,gBAAgB;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,4BAAY,OAAM;AACvC,YAAM,IAAI;AAAA,QACR,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,QAC9E;AAAA,QACA,iBAAiB,QAAQ,QAAQ;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,QACJ,YACA,WACqB;AACrB,QAAI;AAEF,UAAI,EAAE,sBAAsB,aAAa;AACvC,cAAM,IAAI,4BAAW,oCAAoC,aAAa;AAAA,MACxE;AACA,UAAI,KAAC,mCAAiB,SAAS,GAAG;AAChC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,WAAW,WAAW,uBAAM,oBAAoB;AAClD,cAAM,IAAI;AAAA,UACR,+BAA+B,WAAW,MAAM;AAAA,UAChD;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,KAAK,iBAAiB,UAAU,GAAG;AACtC,cAAM,IAAI,4BAAW,uBAAuB,aAAa;AAAA,MAC3D;AAGA,YAAM,qBAAqB,KAAK;AAAA,QAC9B,UAAU;AAAA,MACZ;AAGA,YAAM,eAAe,KAAK,YAAY,oBAAoB,UAAU;AAGpE,YAAM,MAAM,KAAK,OAAO,YAAY;AACpC,YAAM,gBAAgB,IAAI;AAAA,QACxB,qBAAI;AAAA,QACJ,qBAAI,wBAAwB,qBAAI;AAAA,MAClC;AACA,YAAM,SAAS,IAAI;AAAA,QACjB,qBAAI;AAAA,QACJ,qBAAI,iBAAiB,qBAAI;AAAA,MAC3B;AAGA,YAAM,cAAU;AAAA,QACd,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,MACZ;AACA,YAAM,cAAc,KAAK,WAAW,QAAQ,OAAO;AAEnD,UAAI,KAAC,gCAAkB,UAAU,KAAK,WAAW,GAAG;AAClD,cAAM,IAAI,4BAAW,2BAA2B,cAAc;AAAA,MAChE;AAGA,YAAM,YAAY,MAAM,KAAK;AAAA,QAC3B;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,MACZ;AAGA,WAAK,YAAY,YAAY;AAC7B,WAAK,YAAY,GAAG;AAEpB,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,iBAAiB,4BAAY,OAAM;AACvC,YAAM,IAAI;AAAA,QACR,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,QAC9E;AAAA,QACA,iBAAiB,QAAQ,QAAQ;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaU,YAAY,QAA0B;AAC9C,QAAI,UAAU,OAAO,SAAS,GAAG;AAE/B,aAAO,KAAK,CAAI;AAChB,aAAO,KAAK,GAAI;AAChB,aAAO,KAAK,GAAI;AAChB,aAAO,KAAK,CAAI;AAGhB,eAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,eAAO,CAAC,IAAK,IAAI,MAAQ;AAAA,MAC3B;AACA,aAAO,KAAK,CAAI;AAAA,IAClB;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/crypto/ecies/base.ts"],"sourcesContent":["import type { ECIESProvider, ECIESEncrypted } from \"./interface\";\nimport { ECIESError, isECIESEncrypted } from \"./interface\";\nimport { CURVE, CIPHER, KDF } from \"./constants\";\nimport { constantTimeEqual } from \"./utils\";\nimport { concat } from \"viem\";\n\n/**\n * Provides shared ECIES encryption logic across platforms using Uint8Array.\n *\n * @remarks\n * Platform implementations extend this class and provide crypto primitives.\n * The base class handles the ECIES protocol flow while maintaining\n * compatibility with the eccrypto data format.\n *\n * **Implementation details:**\n * - KDF: SHA-512(shared_secret) → encKey (32B) || macKey (32B)\n * - Cipher: AES-256-CBC with random 16-byte IV\n * - MAC: HMAC-SHA256(macKey, iv || ephemPublicKey || ciphertext)\n *\n * @category Cryptography\n */\nexport abstract class BaseECIESUint8 implements ECIESProvider {\n  // Cache for validated public keys to avoid repeated validation\n  private static readonly validatedKeys = new WeakMap<Uint8Array, boolean>();\n\n  /**\n   * Generates cryptographically secure random bytes.\n   *\n   * @param length - Number of random bytes to generate.\n   * @returns Random bytes array.\n   */\n  protected abstract generateRandomBytes(length: number): Uint8Array;\n\n  /**\n   * Verifies a private key is valid for secp256k1.\n   *\n   * @param privateKey - Private key to verify (32 bytes).\n   * @returns `true` if valid private key.\n   */\n  protected abstract verifyPrivateKey(privateKey: Uint8Array): boolean;\n\n  /**\n   * Creates a public key from a private key.\n   *\n   * @param privateKey - Source private key (32 bytes).\n   * @param compressed - Generate compressed (33B) or uncompressed (65B) format.\n   * @returns Public key or `null` if creation failed.\n   */\n  protected abstract createPublicKey(\n    privateKey: Uint8Array,\n    compressed: boolean,\n  ): Uint8Array | null;\n\n  /**\n   * Validates a public key on the secp256k1 curve.\n   *\n   * @param publicKey - Public key to validate.\n   * @returns `true` if valid public key.\n   */\n  protected abstract validatePublicKey(publicKey: Uint8Array): boolean;\n\n  /**\n   * Decompresses a compressed public key.\n   *\n   * @param publicKey - Compressed public key (33 bytes).\n   * @returns Uncompressed public key (65 bytes) or `null` if decompression failed.\n   */\n  protected abstract decompressPublicKey(\n    publicKey: Uint8Array,\n  ): Uint8Array | null;\n\n  /**\n   * Performs ECDH key agreement.\n   *\n   * @param publicKey - Other party's public key.\n   * @param privateKey - Your private key.\n   * @returns Raw X coordinate of shared point (32 bytes).\n   */\n  protected abstract performECDH(\n    publicKey: Uint8Array,\n    privateKey: Uint8Array,\n  ): Uint8Array;\n\n  /**\n   * Computes SHA-512 hash.\n   *\n   * @param data - Data to hash.\n   * @returns SHA-512 hash (64 bytes).\n   */\n  protected abstract sha512(data: Uint8Array): Uint8Array;\n\n  /**\n   * Computes HMAC-SHA256 authentication tag.\n   *\n   * @param key - HMAC key.\n   * @param data - Data to authenticate.\n   * @returns HMAC-SHA256 (32 bytes).\n   */\n  protected abstract hmacSha256(key: Uint8Array, data: Uint8Array): Uint8Array;\n\n  /**\n   * Encrypts data using AES-256-CBC.\n   *\n   * @param key - Encryption key (32 bytes).\n   * @param iv - Initialization vector (16 bytes).\n   * @param plaintext - Data to encrypt.\n   * @returns Ciphertext with PKCS#7 padding.\n   */\n  protected abstract aesEncrypt(\n    key: Uint8Array,\n    iv: Uint8Array,\n    plaintext: Uint8Array,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Decrypts data using AES-256-CBC.\n   *\n   * @param key - Decryption key (32 bytes).\n   * @param iv - Initialization vector (16 bytes).\n   * @param ciphertext - Data to decrypt.\n   * @returns Plaintext with padding removed.\n   */\n  protected abstract aesDecrypt(\n    key: Uint8Array,\n    iv: Uint8Array,\n    ciphertext: Uint8Array,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Normalizes a public key to uncompressed format.\n   *\n   * @param publicKey - Public key in any format.\n   * @returns Uncompressed public key (65 bytes).\n   * @throws {ECIESError} If key format is invalid.\n   */\n  protected normalizePublicKey(publicKey: Uint8Array): Uint8Array {\n    // Check cache first\n    if (BaseECIESUint8.validatedKeys.has(publicKey)) {\n      return publicKey;\n    }\n\n    if (publicKey.length === CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH) {\n      if (publicKey[0] !== CURVE.PREFIX.UNCOMPRESSED) {\n        throw new ECIESError(\n          \"Invalid uncompressed public key prefix\",\n          \"INVALID_KEY\",\n        );\n      }\n      // Validate and cache\n      if (!this.validatePublicKey(publicKey)) {\n        throw new ECIESError(\"Invalid public key\", \"INVALID_KEY\");\n      }\n      BaseECIESUint8.validatedKeys.set(publicKey, true);\n      return publicKey;\n    }\n\n    if (publicKey.length === CURVE.COMPRESSED_PUBLIC_KEY_LENGTH) {\n      const decompressed = this.decompressPublicKey(publicKey);\n      if (!decompressed) {\n        throw new ECIESError(\"Failed to decompress public key\", \"INVALID_KEY\");\n      }\n      // Cache the decompressed key\n      BaseECIESUint8.validatedKeys.set(decompressed, true);\n      return decompressed;\n    }\n\n    throw new ECIESError(\n      `Invalid public key length: ${publicKey.length}`,\n      \"INVALID_KEY\",\n    );\n  }\n\n  /**\n   * Normalizes a public key to uncompressed format (65 bytes with 0x04 prefix).\n   * Must be implemented by derived classes to handle platform-specific operations.\n   *\n   * @param publicKey - The public key to normalize\n   * @returns The normalized uncompressed public key\n   */\n  public abstract normalizeToUncompressed(publicKey: Uint8Array): Uint8Array;\n\n  /**\n   * Encrypts data using ECIES.\n   *\n   * @param publicKey - The recipient's public key (compressed or uncompressed)\n   * @param message - The data to encrypt\n   * @returns Promise resolving to encrypted data structure\n   */\n  async encrypt(\n    publicKey: Uint8Array,\n    message: Uint8Array,\n  ): Promise<ECIESEncrypted> {\n    try {\n      // Validate inputs\n      if (!(publicKey instanceof Uint8Array)) {\n        throw new ECIESError(\"Public key must be a Uint8Array\", \"INVALID_KEY\");\n      }\n      if (!(message instanceof Uint8Array)) {\n        throw new ECIESError(\n          \"Message must be a Uint8Array\",\n          \"ENCRYPTION_FAILED\",\n        );\n      }\n      if (publicKey.length === 0) {\n        throw new ECIESError(\"Public key cannot be empty\", \"INVALID_KEY\");\n      }\n\n      // Normalize public key to uncompressed format\n      const pubKey = this.normalizePublicKey(publicKey);\n\n      // Generate ephemeral key pair\n      let ephemeralPrivateKey: Uint8Array;\n      do {\n        ephemeralPrivateKey = this.generateRandomBytes(\n          CURVE.PRIVATE_KEY_LENGTH,\n        );\n      } while (!this.verifyPrivateKey(ephemeralPrivateKey));\n\n      const ephemeralPublicKey = this.createPublicKey(\n        ephemeralPrivateKey,\n        false,\n      );\n      if (!ephemeralPublicKey) {\n        throw new ECIESError(\n          \"Failed to generate ephemeral public key\",\n          \"ENCRYPTION_FAILED\",\n        );\n      }\n\n      // Perform ECDH to get shared secret (raw X coordinate)\n      const sharedSecret = this.performECDH(pubKey, ephemeralPrivateKey);\n\n      // Derive keys using SHA-512 (eccrypto-compatible KDF)\n      const kdf = this.sha512(sharedSecret);\n      const encryptionKey = kdf.slice(\n        KDF.ENCRYPTION_KEY_OFFSET,\n        KDF.ENCRYPTION_KEY_OFFSET + KDF.ENCRYPTION_KEY_LENGTH,\n      );\n      const macKey = kdf.slice(\n        KDF.MAC_KEY_OFFSET,\n        KDF.MAC_KEY_OFFSET + KDF.MAC_KEY_LENGTH,\n      );\n\n      // Generate random IV and encrypt\n      const iv = this.generateRandomBytes(CIPHER.IV_LENGTH);\n      const ciphertext = await this.aesEncrypt(encryptionKey, iv, message);\n\n      // Calculate MAC (Encrypt-then-MAC)\n      const macData = concat([iv, ephemeralPublicKey, ciphertext]);\n      const mac = this.hmacSha256(macKey, macData);\n\n      // Clear sensitive data\n      this.clearBuffer(ephemeralPrivateKey);\n      this.clearBuffer(sharedSecret);\n      this.clearBuffer(kdf);\n\n      return {\n        iv,\n        ephemPublicKey: ephemeralPublicKey,\n        ciphertext,\n        mac,\n      };\n    } catch (error) {\n      if (error instanceof ECIESError) throw error;\n      throw new ECIESError(\n        `Encryption failed: ${error instanceof Error ? error.message : \"Unknown error\"}`,\n        \"ENCRYPTION_FAILED\",\n        error instanceof Error ? error : undefined,\n      );\n    }\n  }\n\n  /**\n   * Decrypts ECIES encrypted data.\n   *\n   * @param privateKey - The recipient's private key (32 bytes)\n   * @param encrypted - The encrypted data structure from encrypt()\n   * @returns Promise resolving to the original plaintext\n   */\n  async decrypt(\n    privateKey: Uint8Array,\n    encrypted: ECIESEncrypted,\n  ): Promise<Uint8Array> {\n    try {\n      // Validate inputs\n      if (!(privateKey instanceof Uint8Array)) {\n        throw new ECIESError(\"Private key must be a Uint8Array\", \"INVALID_KEY\");\n      }\n      if (!isECIESEncrypted(encrypted)) {\n        throw new ECIESError(\n          \"Invalid encrypted data structure\",\n          \"DECRYPTION_FAILED\",\n        );\n      }\n      if (privateKey.length !== CURVE.PRIVATE_KEY_LENGTH) {\n        throw new ECIESError(\n          `Invalid private key length: ${privateKey.length}`,\n          \"INVALID_KEY\",\n        );\n      }\n      if (!this.verifyPrivateKey(privateKey)) {\n        throw new ECIESError(\"Invalid private key\", \"INVALID_KEY\");\n      }\n\n      // Normalize ephemeral public key to uncompressed format\n      const ephemeralPublicKey = this.normalizePublicKey(\n        encrypted.ephemPublicKey,\n      );\n\n      // Perform ECDH to recover shared secret\n      const sharedSecret = this.performECDH(ephemeralPublicKey, privateKey);\n\n      // Derive keys using SHA-512 (eccrypto-compatible KDF)\n      const kdf = this.sha512(sharedSecret);\n      const encryptionKey = kdf.slice(\n        KDF.ENCRYPTION_KEY_OFFSET,\n        KDF.ENCRYPTION_KEY_OFFSET + KDF.ENCRYPTION_KEY_LENGTH,\n      );\n      const macKey = kdf.slice(\n        KDF.MAC_KEY_OFFSET,\n        KDF.MAC_KEY_OFFSET + KDF.MAC_KEY_LENGTH,\n      );\n\n      // Verify MAC before decryption (Encrypt-then-MAC)\n      const macData = concat([\n        encrypted.iv,\n        encrypted.ephemPublicKey,\n        encrypted.ciphertext,\n      ]);\n      const expectedMac = this.hmacSha256(macKey, macData);\n\n      if (!constantTimeEqual(encrypted.mac, expectedMac)) {\n        throw new ECIESError(\"MAC verification failed\", \"MAC_MISMATCH\");\n      }\n\n      // Decrypt the ciphertext\n      const decrypted = await this.aesDecrypt(\n        encryptionKey,\n        encrypted.iv,\n        encrypted.ciphertext,\n      );\n\n      // Clear sensitive data\n      this.clearBuffer(sharedSecret);\n      this.clearBuffer(kdf);\n\n      return decrypted;\n    } catch (error) {\n      if (error instanceof ECIESError) throw error;\n      throw new ECIESError(\n        `Decryption failed: ${error instanceof Error ? error.message : \"Unknown error\"}`,\n        \"DECRYPTION_FAILED\",\n        error instanceof Error ? error : undefined,\n      );\n    }\n  }\n\n  /**\n   * Clears sensitive data from memory using multi-pass overwrite.\n   *\n   * @remarks\n   * Uses multiple passes with different patterns to make it harder\n   * for JIT compilers to optimize away the operation. While not\n   * guaranteed in JavaScript, this is a best-effort approach to\n   * clear sensitive data from memory.\n   *\n   * @param buffer - The buffer to clear\n   */\n  protected clearBuffer(buffer: Uint8Array): void {\n    if (buffer && buffer.length > 0) {\n      // Multi-pass overwrite to resist compiler optimization\n      buffer.fill(0x00); // Fill with zeros\n      buffer.fill(0xff); // Fill with ones\n      buffer.fill(0xaa); // Fill with alternating pattern\n      buffer.fill(0x00); // Final zero fill\n\n      // Additional pattern write to further discourage optimization\n      for (let i = 0; i < buffer.length; i++) {\n        buffer[i] = (i & 0xff) ^ 0x5a; // XOR with pattern\n      }\n      buffer.fill(0x00); // Final clear\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,uBAA6C;AAC7C,uBAAmC;AACnC,mBAAkC;AAClC,kBAAuB;AAiBhB,MAAe,eAAwC;AAAA;AAAA,EAE5D,OAAwB,gBAAgB,oBAAI,QAA6B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgH/D,mBAAmB,WAAmC;AAE9D,QAAI,eAAe,cAAc,IAAI,SAAS,GAAG;AAC/C,aAAO;AAAA,IACT;AAEA,QAAI,UAAU,WAAW,uBAAM,gCAAgC;AAC7D,UAAI,UAAU,CAAC,MAAM,uBAAM,OAAO,cAAc;AAC9C,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,UAAI,CAAC,KAAK,kBAAkB,SAAS,GAAG;AACtC,cAAM,IAAI,4BAAW,sBAAsB,aAAa;AAAA,MAC1D;AACA,qBAAe,cAAc,IAAI,WAAW,IAAI;AAChD,aAAO;AAAA,IACT;AAEA,QAAI,UAAU,WAAW,uBAAM,8BAA8B;AAC3D,YAAM,eAAe,KAAK,oBAAoB,SAAS;AACvD,UAAI,CAAC,cAAc;AACjB,cAAM,IAAI,4BAAW,mCAAmC,aAAa;AAAA,MACvE;AAEA,qBAAe,cAAc,IAAI,cAAc,IAAI;AACnD,aAAO;AAAA,IACT;AAEA,UAAM,IAAI;AAAA,MACR,8BAA8B,UAAU,MAAM;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAM,QACJ,WACA,SACyB;AACzB,QAAI;AAEF,UAAI,EAAE,qBAAqB,aAAa;AACtC,cAAM,IAAI,4BAAW,mCAAmC,aAAa;AAAA,MACvE;AACA,UAAI,EAAE,mBAAmB,aAAa;AACpC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,UAAU,WAAW,GAAG;AAC1B,cAAM,IAAI,4BAAW,8BAA8B,aAAa;AAAA,MAClE;AAGA,YAAM,SAAS,KAAK,mBAAmB,SAAS;AAGhD,UAAI;AACJ,SAAG;AACD,8BAAsB,KAAK;AAAA,UACzB,uBAAM;AAAA,QACR;AAAA,MACF,SAAS,CAAC,KAAK,iBAAiB,mBAAmB;AAEnD,YAAM,qBAAqB,KAAK;AAAA,QAC9B;AAAA,QACA;AAAA,MACF;AACA,UAAI,CAAC,oBAAoB;AACvB,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAGA,YAAM,eAAe,KAAK,YAAY,QAAQ,mBAAmB;AAGjE,YAAM,MAAM,KAAK,OAAO,YAAY;AACpC,YAAM,gBAAgB,IAAI;AAAA,QACxB,qBAAI;AAAA,QACJ,qBAAI,wBAAwB,qBAAI;AAAA,MAClC;AACA,YAAM,SAAS,IAAI;AAAA,QACjB,qBAAI;AAAA,QACJ,qBAAI,iBAAiB,qBAAI;AAAA,MAC3B;AAGA,YAAM,KAAK,KAAK,oBAAoB,wBAAO,SAAS;AACpD,YAAM,aAAa,MAAM,KAAK,WAAW,eAAe,IAAI,OAAO;AAGnE,YAAM,cAAU,oBAAO,CAAC,IAAI,oBAAoB,UAAU,CAAC;AAC3D,YAAM,MAAM,KAAK,WAAW,QAAQ,OAAO;AAG3C,WAAK,YAAY,mBAAmB;AACpC,WAAK,YAAY,YAAY;AAC7B,WAAK,YAAY,GAAG;AAEpB,aAAO;AAAA,QACL;AAAA,QACA,gBAAgB;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,4BAAY,OAAM;AACvC,YAAM,IAAI;AAAA,QACR,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,QAC9E;AAAA,QACA,iBAAiB,QAAQ,QAAQ;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,QACJ,YACA,WACqB;AACrB,QAAI;AAEF,UAAI,EAAE,sBAAsB,aAAa;AACvC,cAAM,IAAI,4BAAW,oCAAoC,aAAa;AAAA,MACxE;AACA,UAAI,KAAC,mCAAiB,SAAS,GAAG;AAChC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,WAAW,WAAW,uBAAM,oBAAoB;AAClD,cAAM,IAAI;AAAA,UACR,+BAA+B,WAAW,MAAM;AAAA,UAChD;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,KAAK,iBAAiB,UAAU,GAAG;AACtC,cAAM,IAAI,4BAAW,uBAAuB,aAAa;AAAA,MAC3D;AAGA,YAAM,qBAAqB,KAAK;AAAA,QAC9B,UAAU;AAAA,MACZ;AAGA,YAAM,eAAe,KAAK,YAAY,oBAAoB,UAAU;AAGpE,YAAM,MAAM,KAAK,OAAO,YAAY;AACpC,YAAM,gBAAgB,IAAI;AAAA,QACxB,qBAAI;AAAA,QACJ,qBAAI,wBAAwB,qBAAI;AAAA,MAClC;AACA,YAAM,SAAS,IAAI;AAAA,QACjB,qBAAI;AAAA,QACJ,qBAAI,iBAAiB,qBAAI;AAAA,MAC3B;AAGA,YAAM,cAAU,oBAAO;AAAA,QACrB,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,MACZ,CAAC;AACD,YAAM,cAAc,KAAK,WAAW,QAAQ,OAAO;AAEnD,UAAI,KAAC,gCAAkB,UAAU,KAAK,WAAW,GAAG;AAClD,cAAM,IAAI,4BAAW,2BAA2B,cAAc;AAAA,MAChE;AAGA,YAAM,YAAY,MAAM,KAAK;AAAA,QAC3B;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,MACZ;AAGA,WAAK,YAAY,YAAY;AAC7B,WAAK,YAAY,GAAG;AAEpB,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,iBAAiB,4BAAY,OAAM;AACvC,YAAM,IAAI;AAAA,QACR,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,QAC9E;AAAA,QACA,iBAAiB,QAAQ,QAAQ;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaU,YAAY,QAA0B;AAC9C,QAAI,UAAU,OAAO,SAAS,GAAG;AAE/B,aAAO,KAAK,CAAI;AAChB,aAAO,KAAK,GAAI;AAChB,aAAO,KAAK,GAAI;AAChB,aAAO,KAAK,CAAI;AAGhB,eAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,eAAO,CAAC,IAAK,IAAI,MAAQ;AAAA,MAC3B;AACA,aAAO,KAAK,CAAI;AAAA,IAClB;AAAA,EACF;AACF;","names":[]}

package/dist/crypto/ecies/base.d.ts

@@ -1,5 +1,4 @@
-import { ECIESProvider, ECIESEncrypted } from './interface.js';
-
+import type { ECIESProvider, ECIESEncrypted } from "./interface";
 /**
  * Provides shared ECIES encryption logic across platforms using Uint8Array.
  *
@@ -15,7 +14,7 @@ import { ECIESProvider, ECIESEncrypted } from './interface.js';
  *
  * @category Cryptography
  */
-declare abstract class BaseECIESUint8 implements ECIESProvider {
+export declare abstract class BaseECIESUint8 implements ECIESProvider {
     private static readonly validatedKeys;
     /**
      * Generates cryptographically secure random bytes.
@@ -139,5 +138,3 @@ declare abstract class BaseECIESUint8 implements ECIESProvider {
      */
     protected clearBuffer(buffer: Uint8Array): void;
 }
-
-export { BaseECIESUint8 };

package/dist/crypto/ecies/base.js

@@ -1,10 +1,10 @@
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 import { ECIESError, isECIESEncrypted } from "./interface";
 import { CURVE, CIPHER, KDF } from "./constants";
-import { concatBytes, constantTimeEqual } from "./utils";
-const _BaseECIESUint8 = class _BaseECIESUint8 {
+import { constantTimeEqual } from "./utils";
+import { concat } from "viem";
+class BaseECIESUint8 {
+  // Cache for validated public keys to avoid repeated validation
+  static validatedKeys = /* @__PURE__ */ new WeakMap();
   /**
    * Normalizes a public key to uncompressed format.
    *
@@ -13,7 +13,7 @@ const _BaseECIESUint8 = class _BaseECIESUint8 {
    * @throws {ECIESError} If key format is invalid.
    */
   normalizePublicKey(publicKey) {
-    if (_BaseECIESUint8.validatedKeys.has(publicKey)) {
+    if (BaseECIESUint8.validatedKeys.has(publicKey)) {
       return publicKey;
     }
     if (publicKey.length === CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH) {
@@ -26,7 +26,7 @@ const _BaseECIESUint8 = class _BaseECIESUint8 {
       if (!this.validatePublicKey(publicKey)) {
         throw new ECIESError("Invalid public key", "INVALID_KEY");
       }
-      _BaseECIESUint8.validatedKeys.set(publicKey, true);
+      BaseECIESUint8.validatedKeys.set(publicKey, true);
       return publicKey;
     }
     if (publicKey.length === CURVE.COMPRESSED_PUBLIC_KEY_LENGTH) {
@@ -34,7 +34,7 @@ const _BaseECIESUint8 = class _BaseECIESUint8 {
       if (!decompressed) {
         throw new ECIESError("Failed to decompress public key", "INVALID_KEY");
       }
-      _BaseECIESUint8.validatedKeys.set(decompressed, true);
+      BaseECIESUint8.validatedKeys.set(decompressed, true);
       return decompressed;
     }
     throw new ECIESError(
@@ -92,7 +92,7 @@ const _BaseECIESUint8 = class _BaseECIESUint8 {
       );
       const iv = this.generateRandomBytes(CIPHER.IV_LENGTH);
       const ciphertext = await this.aesEncrypt(encryptionKey, iv, message);
-      const macData = concatBytes(iv, ephemeralPublicKey, ciphertext);
+      const macData = concat([iv, ephemeralPublicKey, ciphertext]);
       const mac = this.hmacSha256(macKey, macData);
       this.clearBuffer(ephemeralPrivateKey);
       this.clearBuffer(sharedSecret);
@@ -152,11 +152,11 @@ const _BaseECIESUint8 = class _BaseECIESUint8 {
         KDF.MAC_KEY_OFFSET,
         KDF.MAC_KEY_OFFSET + KDF.MAC_KEY_LENGTH
       );
-      const macData = concatBytes(
+      const macData = concat([
         encrypted.iv,
         encrypted.ephemPublicKey,
         encrypted.ciphertext
-      );
+      ]);
       const expectedMac = this.hmacSha256(macKey, macData);
       if (!constantTimeEqual(encrypted.mac, expectedMac)) {
         throw new ECIESError("MAC verification failed", "MAC_MISMATCH");
@@ -201,10 +201,7 @@ const _BaseECIESUint8 = class _BaseECIESUint8 {
       buffer.fill(0);
     }
   }
-};
-// Cache for validated public keys to avoid repeated validation
-__publicField(_BaseECIESUint8, "validatedKeys", /* @__PURE__ */ new WeakMap());
-let BaseECIESUint8 = _BaseECIESUint8;
+}
 export {
   BaseECIESUint8
 };

package/dist/crypto/ecies/base.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/crypto/ecies/base.ts"],"sourcesContent":["import type { ECIESProvider, ECIESEncrypted } from \"./interface\";\nimport { ECIESError, isECIESEncrypted } from \"./interface\";\nimport { CURVE, CIPHER, KDF } from \"./constants\";\nimport { concatBytes, constantTimeEqual } from \"./utils\";\n\n/**\n * Provides shared ECIES encryption logic across platforms using Uint8Array.\n *\n * @remarks\n * Platform implementations extend this class and provide crypto primitives.\n * The base class handles the ECIES protocol flow while maintaining\n * compatibility with the eccrypto data format.\n *\n * **Implementation details:**\n * - KDF: SHA-512(shared_secret) → encKey (32B) || macKey (32B)\n * - Cipher: AES-256-CBC with random 16-byte IV\n * - MAC: HMAC-SHA256(macKey, iv || ephemPublicKey || ciphertext)\n *\n * @category Cryptography\n */\nexport abstract class BaseECIESUint8 implements ECIESProvider {\n  // Cache for validated public keys to avoid repeated validation\n  private static readonly validatedKeys = new WeakMap<Uint8Array, boolean>();\n\n  /**\n   * Generates cryptographically secure random bytes.\n   *\n   * @param length - Number of random bytes to generate.\n   * @returns Random bytes array.\n   */\n  protected abstract generateRandomBytes(length: number): Uint8Array;\n\n  /**\n   * Verifies a private key is valid for secp256k1.\n   *\n   * @param privateKey - Private key to verify (32 bytes).\n   * @returns `true` if valid private key.\n   */\n  protected abstract verifyPrivateKey(privateKey: Uint8Array): boolean;\n\n  /**\n   * Creates a public key from a private key.\n   *\n   * @param privateKey - Source private key (32 bytes).\n   * @param compressed - Generate compressed (33B) or uncompressed (65B) format.\n   * @returns Public key or `null` if creation failed.\n   */\n  protected abstract createPublicKey(\n    privateKey: Uint8Array,\n    compressed: boolean,\n  ): Uint8Array | null;\n\n  /**\n   * Validates a public key on the secp256k1 curve.\n   *\n   * @param publicKey - Public key to validate.\n   * @returns `true` if valid public key.\n   */\n  protected abstract validatePublicKey(publicKey: Uint8Array): boolean;\n\n  /**\n   * Decompresses a compressed public key.\n   *\n   * @param publicKey - Compressed public key (33 bytes).\n   * @returns Uncompressed public key (65 bytes) or `null` if decompression failed.\n   */\n  protected abstract decompressPublicKey(\n    publicKey: Uint8Array,\n  ): Uint8Array | null;\n\n  /**\n   * Performs ECDH key agreement.\n   *\n   * @param publicKey - Other party's public key.\n   * @param privateKey - Your private key.\n   * @returns Raw X coordinate of shared point (32 bytes).\n   */\n  protected abstract performECDH(\n    publicKey: Uint8Array,\n    privateKey: Uint8Array,\n  ): Uint8Array;\n\n  /**\n   * Computes SHA-512 hash.\n   *\n   * @param data - Data to hash.\n   * @returns SHA-512 hash (64 bytes).\n   */\n  protected abstract sha512(data: Uint8Array): Uint8Array;\n\n  /**\n   * Computes HMAC-SHA256 authentication tag.\n   *\n   * @param key - HMAC key.\n   * @param data - Data to authenticate.\n   * @returns HMAC-SHA256 (32 bytes).\n   */\n  protected abstract hmacSha256(key: Uint8Array, data: Uint8Array): Uint8Array;\n\n  /**\n   * Encrypts data using AES-256-CBC.\n   *\n   * @param key - Encryption key (32 bytes).\n   * @param iv - Initialization vector (16 bytes).\n   * @param plaintext - Data to encrypt.\n   * @returns Ciphertext with PKCS#7 padding.\n   */\n  protected abstract aesEncrypt(\n    key: Uint8Array,\n    iv: Uint8Array,\n    plaintext: Uint8Array,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Decrypts data using AES-256-CBC.\n   *\n   * @param key - Decryption key (32 bytes).\n   * @param iv - Initialization vector (16 bytes).\n   * @param ciphertext - Data to decrypt.\n   * @returns Plaintext with padding removed.\n   */\n  protected abstract aesDecrypt(\n    key: Uint8Array,\n    iv: Uint8Array,\n    ciphertext: Uint8Array,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Normalizes a public key to uncompressed format.\n   *\n   * @param publicKey - Public key in any format.\n   * @returns Uncompressed public key (65 bytes).\n   * @throws {ECIESError} If key format is invalid.\n   */\n  protected normalizePublicKey(publicKey: Uint8Array): Uint8Array {\n    // Check cache first\n    if (BaseECIESUint8.validatedKeys.has(publicKey)) {\n      return publicKey;\n    }\n\n    if (publicKey.length === CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH) {\n      if (publicKey[0] !== CURVE.PREFIX.UNCOMPRESSED) {\n        throw new ECIESError(\n          \"Invalid uncompressed public key prefix\",\n          \"INVALID_KEY\",\n        );\n      }\n      // Validate and cache\n      if (!this.validatePublicKey(publicKey)) {\n        throw new ECIESError(\"Invalid public key\", \"INVALID_KEY\");\n      }\n      BaseECIESUint8.validatedKeys.set(publicKey, true);\n      return publicKey;\n    }\n\n    if (publicKey.length === CURVE.COMPRESSED_PUBLIC_KEY_LENGTH) {\n      const decompressed = this.decompressPublicKey(publicKey);\n      if (!decompressed) {\n        throw new ECIESError(\"Failed to decompress public key\", \"INVALID_KEY\");\n      }\n      // Cache the decompressed key\n      BaseECIESUint8.validatedKeys.set(decompressed, true);\n      return decompressed;\n    }\n\n    throw new ECIESError(\n      `Invalid public key length: ${publicKey.length}`,\n      \"INVALID_KEY\",\n    );\n  }\n\n  /**\n   * Normalizes a public key to uncompressed format (65 bytes with 0x04 prefix).\n   * Must be implemented by derived classes to handle platform-specific operations.\n   *\n   * @param publicKey - The public key to normalize\n   * @returns The normalized uncompressed public key\n   */\n  public abstract normalizeToUncompressed(publicKey: Uint8Array): Uint8Array;\n\n  /**\n   * Encrypts data using ECIES.\n   *\n   * @param publicKey - The recipient's public key (compressed or uncompressed)\n   * @param message - The data to encrypt\n   * @returns Promise resolving to encrypted data structure\n   */\n  async encrypt(\n    publicKey: Uint8Array,\n    message: Uint8Array,\n  ): Promise<ECIESEncrypted> {\n    try {\n      // Validate inputs\n      if (!(publicKey instanceof Uint8Array)) {\n        throw new ECIESError(\"Public key must be a Uint8Array\", \"INVALID_KEY\");\n      }\n      if (!(message instanceof Uint8Array)) {\n        throw new ECIESError(\n          \"Message must be a Uint8Array\",\n          \"ENCRYPTION_FAILED\",\n        );\n      }\n      if (publicKey.length === 0) {\n        throw new ECIESError(\"Public key cannot be empty\", \"INVALID_KEY\");\n      }\n\n      // Normalize public key to uncompressed format\n      const pubKey = this.normalizePublicKey(publicKey);\n\n      // Generate ephemeral key pair\n      let ephemeralPrivateKey: Uint8Array;\n      do {\n        ephemeralPrivateKey = this.generateRandomBytes(\n          CURVE.PRIVATE_KEY_LENGTH,\n        );\n      } while (!this.verifyPrivateKey(ephemeralPrivateKey));\n\n      const ephemeralPublicKey = this.createPublicKey(\n        ephemeralPrivateKey,\n        false,\n      );\n      if (!ephemeralPublicKey) {\n        throw new ECIESError(\n          \"Failed to generate ephemeral public key\",\n          \"ENCRYPTION_FAILED\",\n        );\n      }\n\n      // Perform ECDH to get shared secret (raw X coordinate)\n      const sharedSecret = this.performECDH(pubKey, ephemeralPrivateKey);\n\n      // Derive keys using SHA-512 (eccrypto-compatible KDF)\n      const kdf = this.sha512(sharedSecret);\n      const encryptionKey = kdf.slice(\n        KDF.ENCRYPTION_KEY_OFFSET,\n        KDF.ENCRYPTION_KEY_OFFSET + KDF.ENCRYPTION_KEY_LENGTH,\n      );\n      const macKey = kdf.slice(\n        KDF.MAC_KEY_OFFSET,\n        KDF.MAC_KEY_OFFSET + KDF.MAC_KEY_LENGTH,\n      );\n\n      // Generate random IV and encrypt\n      const iv = this.generateRandomBytes(CIPHER.IV_LENGTH);\n      const ciphertext = await this.aesEncrypt(encryptionKey, iv, message);\n\n      // Calculate MAC (Encrypt-then-MAC)\n      const macData = concatBytes(iv, ephemeralPublicKey, ciphertext);\n      const mac = this.hmacSha256(macKey, macData);\n\n      // Clear sensitive data\n      this.clearBuffer(ephemeralPrivateKey);\n      this.clearBuffer(sharedSecret);\n      this.clearBuffer(kdf);\n\n      return {\n        iv,\n        ephemPublicKey: ephemeralPublicKey,\n        ciphertext,\n        mac,\n      };\n    } catch (error) {\n      if (error instanceof ECIESError) throw error;\n      throw new ECIESError(\n        `Encryption failed: ${error instanceof Error ? error.message : \"Unknown error\"}`,\n        \"ENCRYPTION_FAILED\",\n        error instanceof Error ? error : undefined,\n      );\n    }\n  }\n\n  /**\n   * Decrypts ECIES encrypted data.\n   *\n   * @param privateKey - The recipient's private key (32 bytes)\n   * @param encrypted - The encrypted data structure from encrypt()\n   * @returns Promise resolving to the original plaintext\n   */\n  async decrypt(\n    privateKey: Uint8Array,\n    encrypted: ECIESEncrypted,\n  ): Promise<Uint8Array> {\n    try {\n      // Validate inputs\n      if (!(privateKey instanceof Uint8Array)) {\n        throw new ECIESError(\"Private key must be a Uint8Array\", \"INVALID_KEY\");\n      }\n      if (!isECIESEncrypted(encrypted)) {\n        throw new ECIESError(\n          \"Invalid encrypted data structure\",\n          \"DECRYPTION_FAILED\",\n        );\n      }\n      if (privateKey.length !== CURVE.PRIVATE_KEY_LENGTH) {\n        throw new ECIESError(\n          `Invalid private key length: ${privateKey.length}`,\n          \"INVALID_KEY\",\n        );\n      }\n      if (!this.verifyPrivateKey(privateKey)) {\n        throw new ECIESError(\"Invalid private key\", \"INVALID_KEY\");\n      }\n\n      // Normalize ephemeral public key to uncompressed format\n      const ephemeralPublicKey = this.normalizePublicKey(\n        encrypted.ephemPublicKey,\n      );\n\n      // Perform ECDH to recover shared secret\n      const sharedSecret = this.performECDH(ephemeralPublicKey, privateKey);\n\n      // Derive keys using SHA-512 (eccrypto-compatible KDF)\n      const kdf = this.sha512(sharedSecret);\n      const encryptionKey = kdf.slice(\n        KDF.ENCRYPTION_KEY_OFFSET,\n        KDF.ENCRYPTION_KEY_OFFSET + KDF.ENCRYPTION_KEY_LENGTH,\n      );\n      const macKey = kdf.slice(\n        KDF.MAC_KEY_OFFSET,\n        KDF.MAC_KEY_OFFSET + KDF.MAC_KEY_LENGTH,\n      );\n\n      // Verify MAC before decryption (Encrypt-then-MAC)\n      const macData = concatBytes(\n        encrypted.iv,\n        encrypted.ephemPublicKey,\n        encrypted.ciphertext,\n      );\n      const expectedMac = this.hmacSha256(macKey, macData);\n\n      if (!constantTimeEqual(encrypted.mac, expectedMac)) {\n        throw new ECIESError(\"MAC verification failed\", \"MAC_MISMATCH\");\n      }\n\n      // Decrypt the ciphertext\n      const decrypted = await this.aesDecrypt(\n        encryptionKey,\n        encrypted.iv,\n        encrypted.ciphertext,\n      );\n\n      // Clear sensitive data\n      this.clearBuffer(sharedSecret);\n      this.clearBuffer(kdf);\n\n      return decrypted;\n    } catch (error) {\n      if (error instanceof ECIESError) throw error;\n      throw new ECIESError(\n        `Decryption failed: ${error instanceof Error ? error.message : \"Unknown error\"}`,\n        \"DECRYPTION_FAILED\",\n        error instanceof Error ? error : undefined,\n      );\n    }\n  }\n\n  /**\n   * Clears sensitive data from memory using multi-pass overwrite.\n   *\n   * @remarks\n   * Uses multiple passes with different patterns to make it harder\n   * for JIT compilers to optimize away the operation. While not\n   * guaranteed in JavaScript, this is a best-effort approach to\n   * clear sensitive data from memory.\n   *\n   * @param buffer - The buffer to clear\n   */\n  protected clearBuffer(buffer: Uint8Array): void {\n    if (buffer && buffer.length > 0) {\n      // Multi-pass overwrite to resist compiler optimization\n      buffer.fill(0x00); // Fill with zeros\n      buffer.fill(0xff); // Fill with ones\n      buffer.fill(0xaa); // Fill with alternating pattern\n      buffer.fill(0x00); // Final zero fill\n\n      // Additional pattern write to further discourage optimization\n      for (let i = 0; i < buffer.length; i++) {\n        buffer[i] = (i & 0xff) ^ 0x5a; // XOR with pattern\n      }\n      buffer.fill(0x00); // Final clear\n    }\n  }\n}\n"],"mappings":";;;AACA,SAAS,YAAY,wBAAwB;AAC7C,SAAS,OAAO,QAAQ,WAAW;AACnC,SAAS,aAAa,yBAAyB;AAiBxC,MAAe,kBAAf,MAAe,gBAAwC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkHlD,mBAAmB,WAAmC;AAE9D,QAAI,gBAAe,cAAc,IAAI,SAAS,GAAG;AAC/C,aAAO;AAAA,IACT;AAEA,QAAI,UAAU,WAAW,MAAM,gCAAgC;AAC7D,UAAI,UAAU,CAAC,MAAM,MAAM,OAAO,cAAc;AAC9C,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,UAAI,CAAC,KAAK,kBAAkB,SAAS,GAAG;AACtC,cAAM,IAAI,WAAW,sBAAsB,aAAa;AAAA,MAC1D;AACA,sBAAe,cAAc,IAAI,WAAW,IAAI;AAChD,aAAO;AAAA,IACT;AAEA,QAAI,UAAU,WAAW,MAAM,8BAA8B;AAC3D,YAAM,eAAe,KAAK,oBAAoB,SAAS;AACvD,UAAI,CAAC,cAAc;AACjB,cAAM,IAAI,WAAW,mCAAmC,aAAa;AAAA,MACvE;AAEA,sBAAe,cAAc,IAAI,cAAc,IAAI;AACnD,aAAO;AAAA,IACT;AAEA,UAAM,IAAI;AAAA,MACR,8BAA8B,UAAU,MAAM;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAM,QACJ,WACA,SACyB;AACzB,QAAI;AAEF,UAAI,EAAE,qBAAqB,aAAa;AACtC,cAAM,IAAI,WAAW,mCAAmC,aAAa;AAAA,MACvE;AACA,UAAI,EAAE,mBAAmB,aAAa;AACpC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,UAAU,WAAW,GAAG;AAC1B,cAAM,IAAI,WAAW,8BAA8B,aAAa;AAAA,MAClE;AAGA,YAAM,SAAS,KAAK,mBAAmB,SAAS;AAGhD,UAAI;AACJ,SAAG;AACD,8BAAsB,KAAK;AAAA,UACzB,MAAM;AAAA,QACR;AAAA,MACF,SAAS,CAAC,KAAK,iBAAiB,mBAAmB;AAEnD,YAAM,qBAAqB,KAAK;AAAA,QAC9B;AAAA,QACA;AAAA,MACF;AACA,UAAI,CAAC,oBAAoB;AACvB,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAGA,YAAM,eAAe,KAAK,YAAY,QAAQ,mBAAmB;AAGjE,YAAM,MAAM,KAAK,OAAO,YAAY;AACpC,YAAM,gBAAgB,IAAI;AAAA,QACxB,IAAI;AAAA,QACJ,IAAI,wBAAwB,IAAI;AAAA,MAClC;AACA,YAAM,SAAS,IAAI;AAAA,QACjB,IAAI;AAAA,QACJ,IAAI,iBAAiB,IAAI;AAAA,MAC3B;AAGA,YAAM,KAAK,KAAK,oBAAoB,OAAO,SAAS;AACpD,YAAM,aAAa,MAAM,KAAK,WAAW,eAAe,IAAI,OAAO;AAGnE,YAAM,UAAU,YAAY,IAAI,oBAAoB,UAAU;AAC9D,YAAM,MAAM,KAAK,WAAW,QAAQ,OAAO;AAG3C,WAAK,YAAY,mBAAmB;AACpC,WAAK,YAAY,YAAY;AAC7B,WAAK,YAAY,GAAG;AAEpB,aAAO;AAAA,QACL;AAAA,QACA,gBAAgB;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,WAAY,OAAM;AACvC,YAAM,IAAI;AAAA,QACR,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,QAC9E;AAAA,QACA,iBAAiB,QAAQ,QAAQ;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,QACJ,YACA,WACqB;AACrB,QAAI;AAEF,UAAI,EAAE,sBAAsB,aAAa;AACvC,cAAM,IAAI,WAAW,oCAAoC,aAAa;AAAA,MACxE;AACA,UAAI,CAAC,iBAAiB,SAAS,GAAG;AAChC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,WAAW,WAAW,MAAM,oBAAoB;AAClD,cAAM,IAAI;AAAA,UACR,+BAA+B,WAAW,MAAM;AAAA,UAChD;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,KAAK,iBAAiB,UAAU,GAAG;AACtC,cAAM,IAAI,WAAW,uBAAuB,aAAa;AAAA,MAC3D;AAGA,YAAM,qBAAqB,KAAK;AAAA,QAC9B,UAAU;AAAA,MACZ;AAGA,YAAM,eAAe,KAAK,YAAY,oBAAoB,UAAU;AAGpE,YAAM,MAAM,KAAK,OAAO,YAAY;AACpC,YAAM,gBAAgB,IAAI;AAAA,QACxB,IAAI;AAAA,QACJ,IAAI,wBAAwB,IAAI;AAAA,MAClC;AACA,YAAM,SAAS,IAAI;AAAA,QACjB,IAAI;AAAA,QACJ,IAAI,iBAAiB,IAAI;AAAA,MAC3B;AAGA,YAAM,UAAU;AAAA,QACd,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,MACZ;AACA,YAAM,cAAc,KAAK,WAAW,QAAQ,OAAO;AAEnD,UAAI,CAAC,kBAAkB,UAAU,KAAK,WAAW,GAAG;AAClD,cAAM,IAAI,WAAW,2BAA2B,cAAc;AAAA,MAChE;AAGA,YAAM,YAAY,MAAM,KAAK;AAAA,QAC3B;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,MACZ;AAGA,WAAK,YAAY,YAAY;AAC7B,WAAK,YAAY,GAAG;AAEpB,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,iBAAiB,WAAY,OAAM;AACvC,YAAM,IAAI;AAAA,QACR,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,QAC9E;AAAA,QACA,iBAAiB,QAAQ,QAAQ;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaU,YAAY,QAA0B;AAC9C,QAAI,UAAU,OAAO,SAAS,GAAG;AAE/B,aAAO,KAAK,CAAI;AAChB,aAAO,KAAK,GAAI;AAChB,aAAO,KAAK,GAAI;AAChB,aAAO,KAAK,CAAI;AAGhB,eAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,eAAO,CAAC,IAAK,IAAI,MAAQ;AAAA,MAC3B;AACA,aAAO,KAAK,CAAI;AAAA,IAClB;AAAA,EACF;AACF;AAAA;AAxWE,cAFoB,iBAEI,iBAAgB,oBAAI,QAA6B;AAFpE,IAAe,iBAAf;","names":[]}
+{"version":3,"sources":["../../../src/crypto/ecies/base.ts"],"sourcesContent":["import type { ECIESProvider, ECIESEncrypted } from \"./interface\";\nimport { ECIESError, isECIESEncrypted } from \"./interface\";\nimport { CURVE, CIPHER, KDF } from \"./constants\";\nimport { constantTimeEqual } from \"./utils\";\nimport { concat } from \"viem\";\n\n/**\n * Provides shared ECIES encryption logic across platforms using Uint8Array.\n *\n * @remarks\n * Platform implementations extend this class and provide crypto primitives.\n * The base class handles the ECIES protocol flow while maintaining\n * compatibility with the eccrypto data format.\n *\n * **Implementation details:**\n * - KDF: SHA-512(shared_secret) → encKey (32B) || macKey (32B)\n * - Cipher: AES-256-CBC with random 16-byte IV\n * - MAC: HMAC-SHA256(macKey, iv || ephemPublicKey || ciphertext)\n *\n * @category Cryptography\n */\nexport abstract class BaseECIESUint8 implements ECIESProvider {\n  // Cache for validated public keys to avoid repeated validation\n  private static readonly validatedKeys = new WeakMap<Uint8Array, boolean>();\n\n  /**\n   * Generates cryptographically secure random bytes.\n   *\n   * @param length - Number of random bytes to generate.\n   * @returns Random bytes array.\n   */\n  protected abstract generateRandomBytes(length: number): Uint8Array;\n\n  /**\n   * Verifies a private key is valid for secp256k1.\n   *\n   * @param privateKey - Private key to verify (32 bytes).\n   * @returns `true` if valid private key.\n   */\n  protected abstract verifyPrivateKey(privateKey: Uint8Array): boolean;\n\n  /**\n   * Creates a public key from a private key.\n   *\n   * @param privateKey - Source private key (32 bytes).\n   * @param compressed - Generate compressed (33B) or uncompressed (65B) format.\n   * @returns Public key or `null` if creation failed.\n   */\n  protected abstract createPublicKey(\n    privateKey: Uint8Array,\n    compressed: boolean,\n  ): Uint8Array | null;\n\n  /**\n   * Validates a public key on the secp256k1 curve.\n   *\n   * @param publicKey - Public key to validate.\n   * @returns `true` if valid public key.\n   */\n  protected abstract validatePublicKey(publicKey: Uint8Array): boolean;\n\n  /**\n   * Decompresses a compressed public key.\n   *\n   * @param publicKey - Compressed public key (33 bytes).\n   * @returns Uncompressed public key (65 bytes) or `null` if decompression failed.\n   */\n  protected abstract decompressPublicKey(\n    publicKey: Uint8Array,\n  ): Uint8Array | null;\n\n  /**\n   * Performs ECDH key agreement.\n   *\n   * @param publicKey - Other party's public key.\n   * @param privateKey - Your private key.\n   * @returns Raw X coordinate of shared point (32 bytes).\n   */\n  protected abstract performECDH(\n    publicKey: Uint8Array,\n    privateKey: Uint8Array,\n  ): Uint8Array;\n\n  /**\n   * Computes SHA-512 hash.\n   *\n   * @param data - Data to hash.\n   * @returns SHA-512 hash (64 bytes).\n   */\n  protected abstract sha512(data: Uint8Array): Uint8Array;\n\n  /**\n   * Computes HMAC-SHA256 authentication tag.\n   *\n   * @param key - HMAC key.\n   * @param data - Data to authenticate.\n   * @returns HMAC-SHA256 (32 bytes).\n   */\n  protected abstract hmacSha256(key: Uint8Array, data: Uint8Array): Uint8Array;\n\n  /**\n   * Encrypts data using AES-256-CBC.\n   *\n   * @param key - Encryption key (32 bytes).\n   * @param iv - Initialization vector (16 bytes).\n   * @param plaintext - Data to encrypt.\n   * @returns Ciphertext with PKCS#7 padding.\n   */\n  protected abstract aesEncrypt(\n    key: Uint8Array,\n    iv: Uint8Array,\n    plaintext: Uint8Array,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Decrypts data using AES-256-CBC.\n   *\n   * @param key - Decryption key (32 bytes).\n   * @param iv - Initialization vector (16 bytes).\n   * @param ciphertext - Data to decrypt.\n   * @returns Plaintext with padding removed.\n   */\n  protected abstract aesDecrypt(\n    key: Uint8Array,\n    iv: Uint8Array,\n    ciphertext: Uint8Array,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Normalizes a public key to uncompressed format.\n   *\n   * @param publicKey - Public key in any format.\n   * @returns Uncompressed public key (65 bytes).\n   * @throws {ECIESError} If key format is invalid.\n   */\n  protected normalizePublicKey(publicKey: Uint8Array): Uint8Array {\n    // Check cache first\n    if (BaseECIESUint8.validatedKeys.has(publicKey)) {\n      return publicKey;\n    }\n\n    if (publicKey.length === CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH) {\n      if (publicKey[0] !== CURVE.PREFIX.UNCOMPRESSED) {\n        throw new ECIESError(\n          \"Invalid uncompressed public key prefix\",\n          \"INVALID_KEY\",\n        );\n      }\n      // Validate and cache\n      if (!this.validatePublicKey(publicKey)) {\n        throw new ECIESError(\"Invalid public key\", \"INVALID_KEY\");\n      }\n      BaseECIESUint8.validatedKeys.set(publicKey, true);\n      return publicKey;\n    }\n\n    if (publicKey.length === CURVE.COMPRESSED_PUBLIC_KEY_LENGTH) {\n      const decompressed = this.decompressPublicKey(publicKey);\n      if (!decompressed) {\n        throw new ECIESError(\"Failed to decompress public key\", \"INVALID_KEY\");\n      }\n      // Cache the decompressed key\n      BaseECIESUint8.validatedKeys.set(decompressed, true);\n      return decompressed;\n    }\n\n    throw new ECIESError(\n      `Invalid public key length: ${publicKey.length}`,\n      \"INVALID_KEY\",\n    );\n  }\n\n  /**\n   * Normalizes a public key to uncompressed format (65 bytes with 0x04 prefix).\n   * Must be implemented by derived classes to handle platform-specific operations.\n   *\n   * @param publicKey - The public key to normalize\n   * @returns The normalized uncompressed public key\n   */\n  public abstract normalizeToUncompressed(publicKey: Uint8Array): Uint8Array;\n\n  /**\n   * Encrypts data using ECIES.\n   *\n   * @param publicKey - The recipient's public key (compressed or uncompressed)\n   * @param message - The data to encrypt\n   * @returns Promise resolving to encrypted data structure\n   */\n  async encrypt(\n    publicKey: Uint8Array,\n    message: Uint8Array,\n  ): Promise<ECIESEncrypted> {\n    try {\n      // Validate inputs\n      if (!(publicKey instanceof Uint8Array)) {\n        throw new ECIESError(\"Public key must be a Uint8Array\", \"INVALID_KEY\");\n      }\n      if (!(message instanceof Uint8Array)) {\n        throw new ECIESError(\n          \"Message must be a Uint8Array\",\n          \"ENCRYPTION_FAILED\",\n        );\n      }\n      if (publicKey.length === 0) {\n        throw new ECIESError(\"Public key cannot be empty\", \"INVALID_KEY\");\n      }\n\n      // Normalize public key to uncompressed format\n      const pubKey = this.normalizePublicKey(publicKey);\n\n      // Generate ephemeral key pair\n      let ephemeralPrivateKey: Uint8Array;\n      do {\n        ephemeralPrivateKey = this.generateRandomBytes(\n          CURVE.PRIVATE_KEY_LENGTH,\n        );\n      } while (!this.verifyPrivateKey(ephemeralPrivateKey));\n\n      const ephemeralPublicKey = this.createPublicKey(\n        ephemeralPrivateKey,\n        false,\n      );\n      if (!ephemeralPublicKey) {\n        throw new ECIESError(\n          \"Failed to generate ephemeral public key\",\n          \"ENCRYPTION_FAILED\",\n        );\n      }\n\n      // Perform ECDH to get shared secret (raw X coordinate)\n      const sharedSecret = this.performECDH(pubKey, ephemeralPrivateKey);\n\n      // Derive keys using SHA-512 (eccrypto-compatible KDF)\n      const kdf = this.sha512(sharedSecret);\n      const encryptionKey = kdf.slice(\n        KDF.ENCRYPTION_KEY_OFFSET,\n        KDF.ENCRYPTION_KEY_OFFSET + KDF.ENCRYPTION_KEY_LENGTH,\n      );\n      const macKey = kdf.slice(\n        KDF.MAC_KEY_OFFSET,\n        KDF.MAC_KEY_OFFSET + KDF.MAC_KEY_LENGTH,\n      );\n\n      // Generate random IV and encrypt\n      const iv = this.generateRandomBytes(CIPHER.IV_LENGTH);\n      const ciphertext = await this.aesEncrypt(encryptionKey, iv, message);\n\n      // Calculate MAC (Encrypt-then-MAC)\n      const macData = concat([iv, ephemeralPublicKey, ciphertext]);\n      const mac = this.hmacSha256(macKey, macData);\n\n      // Clear sensitive data\n      this.clearBuffer(ephemeralPrivateKey);\n      this.clearBuffer(sharedSecret);\n      this.clearBuffer(kdf);\n\n      return {\n        iv,\n        ephemPublicKey: ephemeralPublicKey,\n        ciphertext,\n        mac,\n      };\n    } catch (error) {\n      if (error instanceof ECIESError) throw error;\n      throw new ECIESError(\n        `Encryption failed: ${error instanceof Error ? error.message : \"Unknown error\"}`,\n        \"ENCRYPTION_FAILED\",\n        error instanceof Error ? error : undefined,\n      );\n    }\n  }\n\n  /**\n   * Decrypts ECIES encrypted data.\n   *\n   * @param privateKey - The recipient's private key (32 bytes)\n   * @param encrypted - The encrypted data structure from encrypt()\n   * @returns Promise resolving to the original plaintext\n   */\n  async decrypt(\n    privateKey: Uint8Array,\n    encrypted: ECIESEncrypted,\n  ): Promise<Uint8Array> {\n    try {\n      // Validate inputs\n      if (!(privateKey instanceof Uint8Array)) {\n        throw new ECIESError(\"Private key must be a Uint8Array\", \"INVALID_KEY\");\n      }\n      if (!isECIESEncrypted(encrypted)) {\n        throw new ECIESError(\n          \"Invalid encrypted data structure\",\n          \"DECRYPTION_FAILED\",\n        );\n      }\n      if (privateKey.length !== CURVE.PRIVATE_KEY_LENGTH) {\n        throw new ECIESError(\n          `Invalid private key length: ${privateKey.length}`,\n          \"INVALID_KEY\",\n        );\n      }\n      if (!this.verifyPrivateKey(privateKey)) {\n        throw new ECIESError(\"Invalid private key\", \"INVALID_KEY\");\n      }\n\n      // Normalize ephemeral public key to uncompressed format\n      const ephemeralPublicKey = this.normalizePublicKey(\n        encrypted.ephemPublicKey,\n      );\n\n      // Perform ECDH to recover shared secret\n      const sharedSecret = this.performECDH(ephemeralPublicKey, privateKey);\n\n      // Derive keys using SHA-512 (eccrypto-compatible KDF)\n      const kdf = this.sha512(sharedSecret);\n      const encryptionKey = kdf.slice(\n        KDF.ENCRYPTION_KEY_OFFSET,\n        KDF.ENCRYPTION_KEY_OFFSET + KDF.ENCRYPTION_KEY_LENGTH,\n      );\n      const macKey = kdf.slice(\n        KDF.MAC_KEY_OFFSET,\n        KDF.MAC_KEY_OFFSET + KDF.MAC_KEY_LENGTH,\n      );\n\n      // Verify MAC before decryption (Encrypt-then-MAC)\n      const macData = concat([\n        encrypted.iv,\n        encrypted.ephemPublicKey,\n        encrypted.ciphertext,\n      ]);\n      const expectedMac = this.hmacSha256(macKey, macData);\n\n      if (!constantTimeEqual(encrypted.mac, expectedMac)) {\n        throw new ECIESError(\"MAC verification failed\", \"MAC_MISMATCH\");\n      }\n\n      // Decrypt the ciphertext\n      const decrypted = await this.aesDecrypt(\n        encryptionKey,\n        encrypted.iv,\n        encrypted.ciphertext,\n      );\n\n      // Clear sensitive data\n      this.clearBuffer(sharedSecret);\n      this.clearBuffer(kdf);\n\n      return decrypted;\n    } catch (error) {\n      if (error instanceof ECIESError) throw error;\n      throw new ECIESError(\n        `Decryption failed: ${error instanceof Error ? error.message : \"Unknown error\"}`,\n        \"DECRYPTION_FAILED\",\n        error instanceof Error ? error : undefined,\n      );\n    }\n  }\n\n  /**\n   * Clears sensitive data from memory using multi-pass overwrite.\n   *\n   * @remarks\n   * Uses multiple passes with different patterns to make it harder\n   * for JIT compilers to optimize away the operation. While not\n   * guaranteed in JavaScript, this is a best-effort approach to\n   * clear sensitive data from memory.\n   *\n   * @param buffer - The buffer to clear\n   */\n  protected clearBuffer(buffer: Uint8Array): void {\n    if (buffer && buffer.length > 0) {\n      // Multi-pass overwrite to resist compiler optimization\n      buffer.fill(0x00); // Fill with zeros\n      buffer.fill(0xff); // Fill with ones\n      buffer.fill(0xaa); // Fill with alternating pattern\n      buffer.fill(0x00); // Final zero fill\n\n      // Additional pattern write to further discourage optimization\n      for (let i = 0; i < buffer.length; i++) {\n        buffer[i] = (i & 0xff) ^ 0x5a; // XOR with pattern\n      }\n      buffer.fill(0x00); // Final clear\n    }\n  }\n}\n"],"mappings":"AACA,SAAS,YAAY,wBAAwB;AAC7C,SAAS,OAAO,QAAQ,WAAW;AACnC,SAAS,yBAAyB;AAClC,SAAS,cAAc;AAiBhB,MAAe,eAAwC;AAAA;AAAA,EAE5D,OAAwB,gBAAgB,oBAAI,QAA6B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgH/D,mBAAmB,WAAmC;AAE9D,QAAI,eAAe,cAAc,IAAI,SAAS,GAAG;AAC/C,aAAO;AAAA,IACT;AAEA,QAAI,UAAU,WAAW,MAAM,gCAAgC;AAC7D,UAAI,UAAU,CAAC,MAAM,MAAM,OAAO,cAAc;AAC9C,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,UAAI,CAAC,KAAK,kBAAkB,SAAS,GAAG;AACtC,cAAM,IAAI,WAAW,sBAAsB,aAAa;AAAA,MAC1D;AACA,qBAAe,cAAc,IAAI,WAAW,IAAI;AAChD,aAAO;AAAA,IACT;AAEA,QAAI,UAAU,WAAW,MAAM,8BAA8B;AAC3D,YAAM,eAAe,KAAK,oBAAoB,SAAS;AACvD,UAAI,CAAC,cAAc;AACjB,cAAM,IAAI,WAAW,mCAAmC,aAAa;AAAA,MACvE;AAEA,qBAAe,cAAc,IAAI,cAAc,IAAI;AACnD,aAAO;AAAA,IACT;AAEA,UAAM,IAAI;AAAA,MACR,8BAA8B,UAAU,MAAM;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAM,QACJ,WACA,SACyB;AACzB,QAAI;AAEF,UAAI,EAAE,qBAAqB,aAAa;AACtC,cAAM,IAAI,WAAW,mCAAmC,aAAa;AAAA,MACvE;AACA,UAAI,EAAE,mBAAmB,aAAa;AACpC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,UAAU,WAAW,GAAG;AAC1B,cAAM,IAAI,WAAW,8BAA8B,aAAa;AAAA,MAClE;AAGA,YAAM,SAAS,KAAK,mBAAmB,SAAS;AAGhD,UAAI;AACJ,SAAG;AACD,8BAAsB,KAAK;AAAA,UACzB,MAAM;AAAA,QACR;AAAA,MACF,SAAS,CAAC,KAAK,iBAAiB,mBAAmB;AAEnD,YAAM,qBAAqB,KAAK;AAAA,QAC9B;AAAA,QACA;AAAA,MACF;AACA,UAAI,CAAC,oBAAoB;AACvB,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAGA,YAAM,eAAe,KAAK,YAAY,QAAQ,mBAAmB;AAGjE,YAAM,MAAM,KAAK,OAAO,YAAY;AACpC,YAAM,gBAAgB,IAAI;AAAA,QACxB,IAAI;AAAA,QACJ,IAAI,wBAAwB,IAAI;AAAA,MAClC;AACA,YAAM,SAAS,IAAI;AAAA,QACjB,IAAI;AAAA,QACJ,IAAI,iBAAiB,IAAI;AAAA,MAC3B;AAGA,YAAM,KAAK,KAAK,oBAAoB,OAAO,SAAS;AACpD,YAAM,aAAa,MAAM,KAAK,WAAW,eAAe,IAAI,OAAO;AAGnE,YAAM,UAAU,OAAO,CAAC,IAAI,oBAAoB,UAAU,CAAC;AAC3D,YAAM,MAAM,KAAK,WAAW,QAAQ,OAAO;AAG3C,WAAK,YAAY,mBAAmB;AACpC,WAAK,YAAY,YAAY;AAC7B,WAAK,YAAY,GAAG;AAEpB,aAAO;AAAA,QACL;AAAA,QACA,gBAAgB;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,WAAY,OAAM;AACvC,YAAM,IAAI;AAAA,QACR,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,QAC9E;AAAA,QACA,iBAAiB,QAAQ,QAAQ;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,QACJ,YACA,WACqB;AACrB,QAAI;AAEF,UAAI,EAAE,sBAAsB,aAAa;AACvC,cAAM,IAAI,WAAW,oCAAoC,aAAa;AAAA,MACxE;AACA,UAAI,CAAC,iBAAiB,SAAS,GAAG;AAChC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,WAAW,WAAW,MAAM,oBAAoB;AAClD,cAAM,IAAI;AAAA,UACR,+BAA+B,WAAW,MAAM;AAAA,UAChD;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,KAAK,iBAAiB,UAAU,GAAG;AACtC,cAAM,IAAI,WAAW,uBAAuB,aAAa;AAAA,MAC3D;AAGA,YAAM,qBAAqB,KAAK;AAAA,QAC9B,UAAU;AAAA,MACZ;AAGA,YAAM,eAAe,KAAK,YAAY,oBAAoB,UAAU;AAGpE,YAAM,MAAM,KAAK,OAAO,YAAY;AACpC,YAAM,gBAAgB,IAAI;AAAA,QACxB,IAAI;AAAA,QACJ,IAAI,wBAAwB,IAAI;AAAA,MAClC;AACA,YAAM,SAAS,IAAI;AAAA,QACjB,IAAI;AAAA,QACJ,IAAI,iBAAiB,IAAI;AAAA,MAC3B;AAGA,YAAM,UAAU,OAAO;AAAA,QACrB,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,MACZ,CAAC;AACD,YAAM,cAAc,KAAK,WAAW,QAAQ,OAAO;AAEnD,UAAI,CAAC,kBAAkB,UAAU,KAAK,WAAW,GAAG;AAClD,cAAM,IAAI,WAAW,2BAA2B,cAAc;AAAA,MAChE;AAGA,YAAM,YAAY,MAAM,KAAK;AAAA,QAC3B;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,MACZ;AAGA,WAAK,YAAY,YAAY;AAC7B,WAAK,YAAY,GAAG;AAEpB,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,iBAAiB,WAAY,OAAM;AACvC,YAAM,IAAI;AAAA,QACR,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,QAC9E;AAAA,QACA,iBAAiB,QAAQ,QAAQ;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaU,YAAY,QAA0B;AAC9C,QAAI,UAAU,OAAO,SAAS,GAAG;AAE/B,aAAO,KAAK,CAAI;AAChB,aAAO,KAAK,GAAI;AAChB,aAAO,KAAK,GAAI;AAChB,aAAO,KAAK,CAAI;AAGhB,eAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,eAAO,CAAC,IAAK,IAAI,MAAQ;AAAA,MAC3B;AACA,aAAO,KAAK,CAAI;AAAA,IAClB;AAAA,EACF;AACF;","names":[]}

package/dist/crypto/ecies/browser.cjs

@@ -33,6 +33,7 @@ __export(browser_exports, {
 module.exports = __toCommonJS(browser_exports);
 var secp256k1 = __toESM(require("@noble/secp256k1"), 1);
 var import_base = require("./base");
+var import_viem = require("viem");
 var import_hmac = require("@noble/hashes/hmac");
 var import_sha2 = require("@noble/hashes/sha2");
 class BrowserECIESUint8Provider extends import_base.BaseECIESUint8 {
@@ -142,7 +143,7 @@ class BrowserECIESUint8Provider extends import_base.BaseECIESUint8 {
       const decompressed = this.decompressPublicKey(publicKey);
       if (!decompressed) {
         throw new Error(
-          `Failed to decompress public key with prefix 0x${publicKey[0].toString(16).padStart(2, "0")}`
+          `Failed to decompress public key with prefix ${(0, import_viem.toHex)(publicKey[0])}`
         );
       }
       return decompressed;

package/dist/crypto/ecies/browser.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/crypto/ecies/browser.ts"],"sourcesContent":["/**\n * Browser implementation of ECIES using @noble/secp256k1 with Uint8Array\n *\n * @remarks\n * Uses native browser crypto APIs and @noble/secp256k1 for elliptic curve operations.\n * This implementation is polyfill-free and works in all modern browsers.\n */\n\nimport * as secp256k1 from \"@noble/secp256k1\";\nimport { BaseECIESUint8 } from \"./base\";\nimport { hmac } from \"@noble/hashes/hmac\";\nimport { sha256, sha512 as nobleSha512 } from \"@noble/hashes/sha2\";\n\n/**\n * Browser-specific ECIES provider using @noble/secp256k1\n *\n * @remarks\n * This implementation uses:\n * - Web Crypto API for AES operations\n * - @noble/secp256k1 for elliptic curve operations\n * - @noble/hashes for SHA and HMAC operations\n * - No Buffer or Node.js dependencies\n */\nexport class BrowserECIESUint8Provider extends BaseECIESUint8 {\n  protected generateRandomBytes(length: number): Uint8Array {\n    const bytes = new Uint8Array(length);\n    crypto.getRandomValues(bytes);\n    return bytes;\n  }\n\n  protected verifyPrivateKey(privateKey: Uint8Array): boolean {\n    try {\n      return secp256k1.utils.isValidPrivateKey(privateKey);\n    } catch {\n      return false;\n    }\n  }\n\n  protected createPublicKey(\n    privateKey: Uint8Array,\n    compressed: boolean,\n  ): Uint8Array | null {\n    try {\n      return secp256k1.getPublicKey(privateKey, compressed);\n    } catch {\n      return null;\n    }\n  }\n\n  protected validatePublicKey(publicKey: Uint8Array): boolean {\n    try {\n      // @noble/secp256k1 will throw if the point is not on the curve\n      secp256k1.Point.fromHex(publicKey);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  protected decompressPublicKey(publicKey: Uint8Array): Uint8Array | null {\n    try {\n      // @noble/secp256k1 handles both compressed and uncompressed\n      const point = secp256k1.Point.fromHex(publicKey);\n      return point.toRawBytes(false); // false = uncompressed\n    } catch {\n      return null;\n    }\n  }\n\n  protected performECDH(\n    publicKey: Uint8Array,\n    privateKey: Uint8Array,\n  ): Uint8Array {\n    try {\n      // Use @noble/secp256k1's getSharedSecret which is optimized and secure\n      // The 'true' parameter returns the raw x-coordinate (32 bytes)\n      // This matches eccrypto's behavior\n      const sharedPoint = secp256k1.getSharedSecret(\n        privateKey,\n        publicKey,\n        true,\n      );\n\n      // getSharedSecret returns compressed point (33 bytes) when true\n      // We need just the x-coordinate (32 bytes) for eccrypto compatibility\n      // Remove the prefix byte\n      return sharedPoint.slice(1);\n    } catch (error) {\n      throw new Error(\n        `ECDH failed: ${error instanceof Error ? error.message : \"Unknown error\"}`,\n      );\n    }\n  }\n\n  protected sha512(data: Uint8Array): Uint8Array {\n    return nobleSha512(data);\n  }\n\n  protected hmacSha256(key: Uint8Array, data: Uint8Array): Uint8Array {\n    return hmac(sha256, key, data);\n  }\n\n  protected async aesEncrypt(\n    key: Uint8Array,\n    iv: Uint8Array,\n    plaintext: Uint8Array,\n  ): Promise<Uint8Array> {\n    // Import the key for AES-CBC\n    const cryptoKey = await crypto.subtle.importKey(\n      \"raw\",\n      key as BufferSource,\n      { name: \"AES-CBC\" },\n      false,\n      [\"encrypt\"],\n    );\n\n    // Encrypt with Web Crypto API\n    // Note: Web Crypto API automatically handles PKCS#7 padding for AES-CBC\n    const encrypted = await crypto.subtle.encrypt(\n      { name: \"AES-CBC\", iv: iv as BufferSource },\n      cryptoKey,\n      plaintext as BufferSource,\n    );\n\n    return new Uint8Array(encrypted);\n  }\n\n  protected async aesDecrypt(\n    key: Uint8Array,\n    iv: Uint8Array,\n    ciphertext: Uint8Array,\n  ): Promise<Uint8Array> {\n    // Import the key for AES-CBC\n    const cryptoKey = await crypto.subtle.importKey(\n      \"raw\",\n      key as BufferSource,\n      { name: \"AES-CBC\" },\n      false,\n      [\"decrypt\"],\n    );\n\n    // Decrypt with Web Crypto API\n    // Note: Web Crypto API automatically handles PKCS#7 padding removal\n    const decrypted = await crypto.subtle.decrypt(\n      { name: \"AES-CBC\", iv: iv as BufferSource },\n      cryptoKey,\n      ciphertext as BufferSource,\n    );\n\n    return new Uint8Array(decrypted);\n  }\n\n  /**\n   * Normalizes a public key to uncompressed format (65 bytes with 0x04 prefix).\n   * Handles compressed (33 bytes) and uncompressed (65 bytes) formats only.\n   *\n   * @remarks\n   * Strict policy: Does not accept 64-byte raw coordinates to avoid masking\n   * malformed data. Callers must provide properly formatted keys.\n   *\n   * @param publicKey - The public key to normalize (33 or 65 bytes)\n   * @returns The normalized uncompressed public key (65 bytes)\n   * @throws {Error} When public key format is invalid or decompression fails\n   */\n  normalizeToUncompressed(publicKey: Uint8Array): Uint8Array {\n    const len = publicKey.length;\n\n    // Already uncompressed\n    if (len === 65 && publicKey[0] === 0x04) {\n      return publicKey;\n    }\n\n    // Compressed - decompress using @noble/secp256k1\n    if (len === 33 && (publicKey[0] === 0x02 || publicKey[0] === 0x03)) {\n      const decompressed = this.decompressPublicKey(publicKey);\n      if (!decompressed) {\n        throw new Error(\n          `Failed to decompress public key with prefix 0x${publicKey[0].toString(16).padStart(2, \"0\")}`,\n        );\n      }\n      return decompressed;\n    }\n\n    // Reject raw coordinates (64 bytes) - require proper formatting\n    if (len === 64) {\n      throw new Error(\n        \"Raw public key coordinates (64 bytes) are not accepted. \" +\n          \"Please provide a properly formatted compressed (33 bytes) or uncompressed (65 bytes) public key.\",\n      );\n    }\n\n    throw new Error(\n      `Invalid public key format: expected compressed (33 bytes) or uncompressed (65 bytes), got ${len} bytes`,\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,gBAA2B;AAC3B,kBAA+B;AAC/B,kBAAqB;AACrB,kBAA8C;AAYvC,MAAM,kCAAkC,2BAAe;AAAA,EAClD,oBAAoB,QAA4B;AACxD,UAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,WAAO,gBAAgB,KAAK;AAC5B,WAAO;AAAA,EACT;AAAA,EAEU,iBAAiB,YAAiC;AAC1D,QAAI;AACF,aAAO,UAAU,MAAM,kBAAkB,UAAU;AAAA,IACrD,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEU,gBACR,YACA,YACmB;AACnB,QAAI;AACF,aAAO,UAAU,aAAa,YAAY,UAAU;AAAA,IACtD,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEU,kBAAkB,WAAgC;AAC1D,QAAI;AAEF,gBAAU,MAAM,QAAQ,SAAS;AACjC,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEU,oBAAoB,WAA0C;AACtE,QAAI;AAEF,YAAM,QAAQ,UAAU,MAAM,QAAQ,SAAS;AAC/C,aAAO,MAAM,WAAW,KAAK;AAAA,IAC/B,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEU,YACR,WACA,YACY;AACZ,QAAI;AAIF,YAAM,cAAc,UAAU;AAAA,QAC5B;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAKA,aAAO,YAAY,MAAM,CAAC;AAAA,IAC5B,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAAA,EAEU,OAAO,MAA8B;AAC7C,eAAO,YAAAA,QAAY,IAAI;AAAA,EACzB;AAAA,EAEU,WAAW,KAAiB,MAA8B;AAClE,eAAO,kBAAK,oBAAQ,KAAK,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAgB,WACd,KACA,IACA,WACqB;AAErB,UAAM,YAAY,MAAM,OAAO,OAAO;AAAA,MACpC;AAAA,MACA;AAAA,MACA,EAAE,MAAM,UAAU;AAAA,MAClB;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AAIA,UAAM,YAAY,MAAM,OAAO,OAAO;AAAA,MACpC,EAAE,MAAM,WAAW,GAAuB;AAAA,MAC1C;AAAA,MACA;AAAA,IACF;AAEA,WAAO,IAAI,WAAW,SAAS;AAAA,EACjC;AAAA,EAEA,MAAgB,WACd,KACA,IACA,YACqB;AAErB,UAAM,YAAY,MAAM,OAAO,OAAO;AAAA,MACpC;AAAA,MACA;AAAA,MACA,EAAE,MAAM,UAAU;AAAA,MAClB;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AAIA,UAAM,YAAY,MAAM,OAAO,OAAO;AAAA,MACpC,EAAE,MAAM,WAAW,GAAuB;AAAA,MAC1C;AAAA,MACA;AAAA,IACF;AAEA,WAAO,IAAI,WAAW,SAAS;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,wBAAwB,WAAmC;AACzD,UAAM,MAAM,UAAU;AAGtB,QAAI,QAAQ,MAAM,UAAU,CAAC,MAAM,GAAM;AACvC,aAAO;AAAA,IACT;AAGA,QAAI,QAAQ,OAAO,UAAU,CAAC,MAAM,KAAQ,UAAU,CAAC,MAAM,IAAO;AAClE,YAAM,eAAe,KAAK,oBAAoB,SAAS;AACvD,UAAI,CAAC,cAAc;AACjB,cAAM,IAAI;AAAA,UACR,iDAAiD,UAAU,CAAC,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,QAC7F;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAGA,QAAI,QAAQ,IAAI;AACd,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AAEA,UAAM,IAAI;AAAA,MACR,6FAA6F,GAAG;AAAA,IAClG;AAAA,EACF;AACF;","names":["nobleSha512"]}
+{"version":3,"sources":["../../../src/crypto/ecies/browser.ts"],"sourcesContent":["/**\n * Browser implementation of ECIES using @noble/secp256k1 with Uint8Array\n *\n * @remarks\n * Uses native browser crypto APIs and @noble/secp256k1 for elliptic curve operations.\n * This implementation is polyfill-free and works in all modern browsers.\n */\n\nimport * as secp256k1 from \"@noble/secp256k1\";\nimport { BaseECIESUint8 } from \"./base\";\nimport { toHex } from \"viem\";\nimport { hmac } from \"@noble/hashes/hmac\";\nimport { sha256, sha512 as nobleSha512 } from \"@noble/hashes/sha2\";\n\n/**\n * Browser-specific ECIES provider using @noble/secp256k1\n *\n * @remarks\n * This implementation uses:\n * - Web Crypto API for AES operations\n * - @noble/secp256k1 for elliptic curve operations\n * - @noble/hashes for SHA and HMAC operations\n * - No Buffer or Node.js dependencies\n */\nexport class BrowserECIESUint8Provider extends BaseECIESUint8 {\n  protected generateRandomBytes(length: number): Uint8Array {\n    const bytes = new Uint8Array(length);\n    crypto.getRandomValues(bytes);\n    return bytes;\n  }\n\n  protected verifyPrivateKey(privateKey: Uint8Array): boolean {\n    try {\n      return secp256k1.utils.isValidPrivateKey(privateKey);\n    } catch {\n      return false;\n    }\n  }\n\n  protected createPublicKey(\n    privateKey: Uint8Array,\n    compressed: boolean,\n  ): Uint8Array | null {\n    try {\n      return secp256k1.getPublicKey(privateKey, compressed);\n    } catch {\n      return null;\n    }\n  }\n\n  protected validatePublicKey(publicKey: Uint8Array): boolean {\n    try {\n      // @noble/secp256k1 will throw if the point is not on the curve\n      secp256k1.Point.fromHex(publicKey);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  protected decompressPublicKey(publicKey: Uint8Array): Uint8Array | null {\n    try {\n      // @noble/secp256k1 handles both compressed and uncompressed\n      const point = secp256k1.Point.fromHex(publicKey);\n      return point.toRawBytes(false); // false = uncompressed\n    } catch {\n      return null;\n    }\n  }\n\n  protected performECDH(\n    publicKey: Uint8Array,\n    privateKey: Uint8Array,\n  ): Uint8Array {\n    try {\n      // Use @noble/secp256k1's getSharedSecret which is optimized and secure\n      // The 'true' parameter returns the raw x-coordinate (32 bytes)\n      // This matches eccrypto's behavior\n      const sharedPoint = secp256k1.getSharedSecret(\n        privateKey,\n        publicKey,\n        true,\n      );\n\n      // getSharedSecret returns compressed point (33 bytes) when true\n      // We need just the x-coordinate (32 bytes) for eccrypto compatibility\n      // Remove the prefix byte\n      return sharedPoint.slice(1);\n    } catch (error) {\n      throw new Error(\n        `ECDH failed: ${error instanceof Error ? error.message : \"Unknown error\"}`,\n      );\n    }\n  }\n\n  protected sha512(data: Uint8Array): Uint8Array {\n    return nobleSha512(data);\n  }\n\n  protected hmacSha256(key: Uint8Array, data: Uint8Array): Uint8Array {\n    return hmac(sha256, key, data);\n  }\n\n  protected async aesEncrypt(\n    key: Uint8Array,\n    iv: Uint8Array,\n    plaintext: Uint8Array,\n  ): Promise<Uint8Array> {\n    // Import the key for AES-CBC\n    const cryptoKey = await crypto.subtle.importKey(\n      \"raw\",\n      key as BufferSource,\n      { name: \"AES-CBC\" },\n      false,\n      [\"encrypt\"],\n    );\n\n    // Encrypt with Web Crypto API\n    // Note: Web Crypto API automatically handles PKCS#7 padding for AES-CBC\n    const encrypted = await crypto.subtle.encrypt(\n      { name: \"AES-CBC\", iv: iv as BufferSource },\n      cryptoKey,\n      plaintext as BufferSource,\n    );\n\n    return new Uint8Array(encrypted);\n  }\n\n  protected async aesDecrypt(\n    key: Uint8Array,\n    iv: Uint8Array,\n    ciphertext: Uint8Array,\n  ): Promise<Uint8Array> {\n    // Import the key for AES-CBC\n    const cryptoKey = await crypto.subtle.importKey(\n      \"raw\",\n      key as BufferSource,\n      { name: \"AES-CBC\" },\n      false,\n      [\"decrypt\"],\n    );\n\n    // Decrypt with Web Crypto API\n    // Note: Web Crypto API automatically handles PKCS#7 padding removal\n    const decrypted = await crypto.subtle.decrypt(\n      { name: \"AES-CBC\", iv: iv as BufferSource },\n      cryptoKey,\n      ciphertext as BufferSource,\n    );\n\n    return new Uint8Array(decrypted);\n  }\n\n  /**\n   * Normalizes a public key to uncompressed format (65 bytes with 0x04 prefix).\n   * Handles compressed (33 bytes) and uncompressed (65 bytes) formats only.\n   *\n   * @remarks\n   * Strict policy: Does not accept 64-byte raw coordinates to avoid masking\n   * malformed data. Callers must provide properly formatted keys.\n   *\n   * @param publicKey - The public key to normalize (33 or 65 bytes)\n   * @returns The normalized uncompressed public key (65 bytes)\n   * @throws {Error} When public key format is invalid or decompression fails\n   */\n  normalizeToUncompressed(publicKey: Uint8Array): Uint8Array {\n    const len = publicKey.length;\n\n    // Already uncompressed\n    if (len === 65 && publicKey[0] === 0x04) {\n      return publicKey;\n    }\n\n    // Compressed - decompress using @noble/secp256k1\n    if (len === 33 && (publicKey[0] === 0x02 || publicKey[0] === 0x03)) {\n      const decompressed = this.decompressPublicKey(publicKey);\n      if (!decompressed) {\n        throw new Error(\n          `Failed to decompress public key with prefix ${toHex(publicKey[0])}`,\n        );\n      }\n      return decompressed;\n    }\n\n    // Reject raw coordinates (64 bytes) - require proper formatting\n    if (len === 64) {\n      throw new Error(\n        \"Raw public key coordinates (64 bytes) are not accepted. \" +\n          \"Please provide a properly formatted compressed (33 bytes) or uncompressed (65 bytes) public key.\",\n      );\n    }\n\n    throw new Error(\n      `Invalid public key format: expected compressed (33 bytes) or uncompressed (65 bytes), got ${len} bytes`,\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,gBAA2B;AAC3B,kBAA+B;AAC/B,kBAAsB;AACtB,kBAAqB;AACrB,kBAA8C;AAYvC,MAAM,kCAAkC,2BAAe;AAAA,EAClD,oBAAoB,QAA4B;AACxD,UAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,WAAO,gBAAgB,KAAK;AAC5B,WAAO;AAAA,EACT;AAAA,EAEU,iBAAiB,YAAiC;AAC1D,QAAI;AACF,aAAO,UAAU,MAAM,kBAAkB,UAAU;AAAA,IACrD,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEU,gBACR,YACA,YACmB;AACnB,QAAI;AACF,aAAO,UAAU,aAAa,YAAY,UAAU;AAAA,IACtD,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEU,kBAAkB,WAAgC;AAC1D,QAAI;AAEF,gBAAU,MAAM,QAAQ,SAAS;AACjC,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEU,oBAAoB,WAA0C;AACtE,QAAI;AAEF,YAAM,QAAQ,UAAU,MAAM,QAAQ,SAAS;AAC/C,aAAO,MAAM,WAAW,KAAK;AAAA,IAC/B,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEU,YACR,WACA,YACY;AACZ,QAAI;AAIF,YAAM,cAAc,UAAU;AAAA,QAC5B;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAKA,aAAO,YAAY,MAAM,CAAC;AAAA,IAC5B,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAAA,EAEU,OAAO,MAA8B;AAC7C,eAAO,YAAAA,QAAY,IAAI;AAAA,EACzB;AAAA,EAEU,WAAW,KAAiB,MAA8B;AAClE,eAAO,kBAAK,oBAAQ,KAAK,IAAI;AAAA,EAC/B;AAAA,EAEA,MAAgB,WACd,KACA,IACA,WACqB;AAErB,UAAM,YAAY,MAAM,OAAO,OAAO;AAAA,MACpC;AAAA,MACA;AAAA,MACA,EAAE,MAAM,UAAU;AAAA,MAClB;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AAIA,UAAM,YAAY,MAAM,OAAO,OAAO;AAAA,MACpC,EAAE,MAAM,WAAW,GAAuB;AAAA,MAC1C;AAAA,MACA;AAAA,IACF;AAEA,WAAO,IAAI,WAAW,SAAS;AAAA,EACjC;AAAA,EAEA,MAAgB,WACd,KACA,IACA,YACqB;AAErB,UAAM,YAAY,MAAM,OAAO,OAAO;AAAA,MACpC;AAAA,MACA;AAAA,MACA,EAAE,MAAM,UAAU;AAAA,MAClB;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AAIA,UAAM,YAAY,MAAM,OAAO,OAAO;AAAA,MACpC,EAAE,MAAM,WAAW,GAAuB;AAAA,MAC1C;AAAA,MACA;AAAA,IACF;AAEA,WAAO,IAAI,WAAW,SAAS;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,wBAAwB,WAAmC;AACzD,UAAM,MAAM,UAAU;AAGtB,QAAI,QAAQ,MAAM,UAAU,CAAC,MAAM,GAAM;AACvC,aAAO;AAAA,IACT;AAGA,QAAI,QAAQ,OAAO,UAAU,CAAC,MAAM,KAAQ,UAAU,CAAC,MAAM,IAAO;AAClE,YAAM,eAAe,KAAK,oBAAoB,SAAS;AACvD,UAAI,CAAC,cAAc;AACjB,cAAM,IAAI;AAAA,UACR,mDAA+C,mBAAM,UAAU,CAAC,CAAC,CAAC;AAAA,QACpE;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAGA,QAAI,QAAQ,IAAI;AACd,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AAEA,UAAM,IAAI;AAAA,MACR,6FAA6F,GAAG;AAAA,IAClG;AAAA,EACF;AACF;","names":["nobleSha512"]}