@opendatalabs/vana-sdk 0.1.0-alpha.9b6ddbc → 0.1.0-alpha.9bbda27

package/dist/core.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core.ts"],"sourcesContent":["import type {\n  VanaConfig,\n  VanaConfigWithStorage,\n  RuntimeConfig,\n  VanaChainId,\n  StorageRequiredMarker,\n} from \"./types\";\nimport {\n  isWalletConfig,\n  isChainConfig,\n  isReadOnlyConfig,\n  isAddressOnlyConfig,\n  isVanaChainId,\n  hasStorageConfig,\n} from \"./types\";\nimport type { DownloadRelayerCallbacks } from \"./types/config\";\nimport type {\n  RelayerConfig,\n  UnifiedRelayerRequest,\n  UnifiedRelayerResponse,\n} from \"./types/relayer\";\nimport { InvalidConfigurationError } from \"./errors\";\nimport type { ControllerContext } from \"./controllers/permissions\";\nimport { PermissionsController } from \"./controllers/permissions\";\nimport { DataController } from \"./controllers/data\";\nimport { SchemaController } from \"./controllers/schemas\";\nimport { ServerController } from \"./controllers/server\";\nimport { ProtocolController } from \"./controllers/protocol\";\nimport { StorageManager } from \"./storage\";\nimport { createWalletClient, createPublicClient, http } from \"viem\";\nimport type {\n  PublicClient,\n  WalletClient,\n  Address,\n  Hash,\n  TransactionReceipt,\n  Chain,\n} from \"viem\";\nimport { extractAddress } from \"./utils/wallet\";\nimport type {\n  Operation,\n  PollingOptions,\n  TransactionResult,\n  TransactionWaitOptions,\n} from \"./types/operations\";\nimport type {\n  Contract,\n  Fn,\n  TypedTransactionResult,\n} from \"./generated/event-types\";\nimport { chains } from \"./config/chains\";\nimport { getChainConfig, vanaMainnet } from \"./chains\";\nimport type { VanaPlatformAdapter } from \"./platform/interface\";\nimport {\n  encryptBlobWithSignedKey,\n  decryptBlobWithSignedKey,\n} from \"./utils/encryption\";\n\n/**\n * Factory functions for creating VanaCore instances with proper type safety\n */\nexport class VanaCoreFactory {\n  /**\n   * Creates a VanaCore instance that enforces storage requirements at compile time.\n   * Use this factory when you know you'll need storage-dependent operations.\n   *\n   * @param platform - The platform adapter for environment-specific operations\n   * @param config - Configuration that includes required storage providers\n   * @returns VanaCore instance with storage validation\n   * @example\n   * ```typescript\n   * const vanaCore = VanaCoreFactory.createWithStorage(platformAdapter, {\n   *   walletClient: myWalletClient,\n   *   storage: {\n   *     providers: { ipfs: new IPFSStorage() },\n   *     defaultProvider: 'ipfs'\n   *   }\n   * });\n   * ```\n   */\n  static createWithStorage(\n    platform: VanaPlatformAdapter,\n    config: VanaConfigWithStorage,\n  ): VanaCore & StorageRequiredMarker {\n    const core = new VanaCore(platform, config);\n    return core as VanaCore & StorageRequiredMarker;\n  }\n\n  /**\n   * Creates a VanaCore instance without storage requirements.\n   * Storage-dependent operations will fail at runtime if not configured.\n   *\n   * @param platform - The platform adapter for environment-specific operations\n   * @param config - Basic configuration without required storage\n   * @returns VanaCore instance\n   * @example\n   * ```typescript\n   * const vanaCore = VanaCoreFactory.create(platformAdapter, {\n   *   walletClient: myWalletClient\n   * });\n   * ```\n   */\n  static create(platform: VanaPlatformAdapter, config: VanaConfig): VanaCore {\n    return new VanaCore(platform, config);\n  }\n}\n\n/**\n * Provides the core SDK functionality for interacting with the Vana network.\n *\n * @remarks\n * This environment-agnostic class contains all SDK logic and accepts a platform\n * adapter to handle environment-specific operations. It initializes all controllers\n * and manages shared context between them, providing a unified interface for\n * data management, permissions, smart contracts, and storage operations.\n *\n * The class uses TypeScript overloading to enforce storage requirements at compile time.\n * Methods that require storage will throw `InvalidConfigurationError` at runtime if\n * storage providers are not configured, implementing a fail-fast approach to prevent\n * errors during expensive operations.\n *\n * **Core Architecture:**\n * - **Controllers**: Specialized modules for different Vana features (data, permissions, etc.)\n * - **Platform Adapters**: Environment-specific implementations (browser vs Node.js)\n * - **Storage Managers**: Abstraction layer for multiple storage providers\n * - **Context Sharing**: Unified configuration and services across all controllers\n *\n * For public usage, use the platform-specific factory functions:\n * - Browser: `import { Vana } from '@opendatalabs/vana-sdk/browser'`\n * - Node.js: `import { Vana } from '@opendatalabs/vana-sdk/node'`\n *\n * @example\n * ```typescript\n * // Direct instantiation (advanced usage)\n * import { VanaCore, BrowserPlatformAdapter } from '@opendatalabs/vana-sdk/browser';\n *\n * const core = new VanaCore(new BrowserPlatformAdapter(), {\n *   walletClient: myWalletClient,\n *   storage: {\n *     providers: { ipfs: new IPFSStorage() },\n *     defaultProvider: 'ipfs'\n *   }\n * });\n *\n * // Access all controllers\n * const files = await core.data.getUserFiles();\n * const permissions = await core.permissions.grant({\n *   grantee: '0x742d35...',\n *   operation: 'read'\n * });\n * ```\n * @category Core SDK\n */\nexport class VanaCore {\n  /** Manages gasless data access permissions and trusted server registry. */\n  public readonly permissions: PermissionsController;\n\n  /** Handles user data file operations. */\n  public readonly data: DataController;\n\n  /** Manages data schemas and refiners. */\n  public readonly schemas: SchemaController;\n\n  /** Provides personal server setup and trusted server interactions. */\n  public readonly server: ServerController;\n\n  /** Offers low-level access to Vana protocol smart contracts. */\n  public readonly protocol: ProtocolController;\n\n  /** Handles environment-specific operations like encryption and file systems. */\n  protected platform: VanaPlatformAdapter;\n\n  private readonly relayerConfig?: RelayerConfig;\n  private readonly relayerCallback?: (\n    request: UnifiedRelayerRequest,\n  ) => Promise<UnifiedRelayerResponse>;\n  private readonly downloadRelayer?: DownloadRelayerCallbacks;\n  private readonly storageManager?: StorageManager;\n  private readonly hasRequiredStorage: boolean;\n  private readonly ipfsGateways?: string[];\n  private readonly publicClient: PublicClient;\n  private readonly walletClient?: WalletClient;\n  private readonly _staticUserAddress?: Address; // For read-only mode\n\n  /**\n   * Initializes a new VanaCore client instance with the provided configuration.\n   *\n   * @remarks\n   * The constructor validates the configuration, initializes storage providers if configured,\n   * creates wallet and public clients, and sets up all SDK controllers with shared context.\n   *\n   * IMPORTANT: This constructor will validate storage requirements at runtime to fail fast.\n   * Methods that require storage will throw runtime errors if storage is not configured.\n   *\n   * @param platform - The platform adapter for environment-specific operations\n   * @param config - The configuration object specifying wallet or chain settings\n   * @throws {InvalidConfigurationError} When the configuration is invalid or incomplete\n   * @example\n   * ```typescript\n   * // Direct instantiation (consider using factory methods instead)\n   * const vanaCore = new VanaCore(platformAdapter, {\n   *   walletClient: myWalletClient,\n   * });\n   * ```\n   */\n  constructor(platform: VanaPlatformAdapter, config: VanaConfig) {\n    // Store the platform adapter\n    this.platform = platform;\n\n    // Validate configuration\n    this.validateConfig(config);\n\n    // Store relayer config and set up callback\n    this.relayerConfig = config.relayer;\n    if (config.relayer) {\n      // Validate relayer type\n      if (\n        typeof config.relayer !== \"string\" &&\n        typeof config.relayer !== \"function\"\n      ) {\n        throw new InvalidConfigurationError(\n          \"Relayer must be either a URL string or a callback function\",\n        );\n      }\n\n      if (typeof config.relayer === \"string\") {\n        // Convenience: URL string - create HTTP transport\n        const url = config.relayer;\n        this.relayerCallback = async (request: UnifiedRelayerRequest) => {\n          const response = await fetch(url, {\n            method: \"POST\",\n            headers: { \"Content-Type\": \"application/json\" },\n            body: JSON.stringify(request),\n          });\n          if (!response.ok) {\n            throw new Error(`Relayer request failed: ${response.statusText}`);\n          }\n          return response.json();\n        };\n      } else {\n        // Direct callback function\n        this.relayerCallback = config.relayer;\n      }\n    }\n\n    // Store download relayer if provided\n    this.downloadRelayer = config.downloadRelayer;\n\n    // Store IPFS gateways if provided\n    this.ipfsGateways = config.ipfsGateways;\n\n    // Check if storage is properly configured\n    this.hasRequiredStorage = hasStorageConfig(config);\n\n    // Initialize storage manager if storage providers are provided\n    if (config.storage?.providers) {\n      this.storageManager = new StorageManager();\n\n      // Register all provided storage providers\n      for (const [name, provider] of Object.entries(config.storage.providers)) {\n        const isDefault = name === config.storage.defaultProvider;\n        this.storageManager.register(name, provider, isDefault);\n      }\n\n      // If no default was explicitly set but providers exist, use the first one\n      if (\n        !config.storage.defaultProvider &&\n        Object.keys(config.storage.providers).length > 0\n      ) {\n        const firstProviderName = Object.keys(config.storage.providers)[0];\n        this.storageManager.setDefaultProvider(firstProviderName);\n      }\n    }\n\n    // Initialize clients based on configuration type\n    let walletClient: WalletClient | undefined;\n    let publicClient: PublicClient;\n    let staticUserAddress: Address | undefined; // Only for read-only mode\n    let chainToUse: Chain;\n\n    if (isWalletConfig(config)) {\n      // Full mode with wallet client\n      walletClient = config.walletClient;\n      chainToUse = (walletClient.chain as Chain) ?? vanaMainnet;\n\n      // In wallet mode, address is dynamic (not stored)\n      staticUserAddress = undefined;\n\n      // Use provided publicClient or create one\n      if (\"publicClient\" in config && config.publicClient) {\n        publicClient = config.publicClient;\n      } else {\n        publicClient = createPublicClient({\n          chain: chainToUse,\n          transport: http(),\n        });\n      }\n    } else if (isReadOnlyConfig(config)) {\n      // Read-only mode with public client and address\n      walletClient = undefined;\n      publicClient = config.publicClient;\n      staticUserAddress = config.address;\n      chainToUse = config.publicClient.chain ?? vanaMainnet;\n    } else if (isAddressOnlyConfig(config)) {\n      // Read-only mode with just address (create public client)\n      walletClient = undefined;\n      staticUserAddress = config.address;\n      chainToUse = config.chain ?? vanaMainnet;\n\n      publicClient = createPublicClient({\n        chain: chainToUse,\n        transport: http(),\n      });\n    } else if (isChainConfig(config)) {\n      // Legacy chain configuration - create wallet client\n      if (!config.account) {\n        throw new InvalidConfigurationError(\n          \"Account is required when using ChainConfig\",\n        );\n      }\n\n      const chain = chains[config.chainId];\n      if (!chain) {\n        throw new InvalidConfigurationError(\n          `Unsupported chain ID: ${config.chainId}`,\n        );\n      }\n\n      chainToUse = chain;\n      walletClient = createWalletClient({\n        chain,\n        transport: http(config.rpcUrl ?? chain.rpcUrls.default.http[0]),\n        account: config.account,\n      });\n      // In wallet mode, address is dynamic (not stored)\n      staticUserAddress = undefined;\n      publicClient = createPublicClient({\n        chain,\n        transport: http(),\n      });\n    } else {\n      throw new InvalidConfigurationError(\n        \"Invalid configuration: must provide either walletClient, publicClient + address, or address alone\",\n      );\n    }\n\n    // Store the clients and static address for later use\n    this.publicClient = publicClient;\n    this.walletClient = walletClient;\n    this._staticUserAddress = staticUserAddress;\n\n    // Get default service URLs from chain config if not provided\n    const chainConfig = getChainConfig(chainToUse.id);\n    const subgraphUrl = config.subgraphUrl ?? chainConfig?.subgraphUrl;\n    const personalServerUrl =\n      config.defaultPersonalServerUrl ?? chainConfig?.personalServerUrl;\n\n    // Create shared context for all controllers with dynamic userAddress getter\n    const self = this; // Capture VanaCore instance for getter delegation\n    const sharedContext: ControllerContext = {\n      walletClient,\n      publicClient,\n      get userAddress() {\n        // Delegate to VanaCore's getter for dynamic resolution\n        return self.userAddress;\n      },\n      applicationClient: walletClient, // Using same wallet for now\n      relayer: this.relayerCallback,\n      downloadRelayer: this.downloadRelayer,\n      storageManager: this.storageManager,\n      subgraphUrl,\n      platform: this.platform, // Pass the platform adapter to controllers\n      validateStorageRequired: this.validateStorageRequired.bind(this),\n      hasStorage: this.hasStorage.bind(this),\n      ipfsGateways: this.ipfsGateways,\n      defaultPersonalServerUrl: personalServerUrl,\n      waitForTransactionEvents: this.waitForTransactionEvents.bind(this),\n      waitForOperation: this.waitForOperation.bind(this),\n    };\n\n    // Initialize controllers\n    this.permissions = new PermissionsController(sharedContext);\n    this.data = new DataController(sharedContext);\n    this.schemas = new SchemaController(sharedContext);\n    this.server = new ServerController(sharedContext);\n    this.protocol = new ProtocolController(sharedContext);\n  }\n\n  /**\n   * Validates that storage is available for storage-dependent operations.\n   * This method enforces the fail-fast principle by checking storage availability\n   * at method call time rather than during expensive operations.\n   *\n   * @throws {InvalidConfigurationError} When storage is required but not configured\n   * @example\n   * ```typescript\n   * // This will throw if storage is not configured\n   * vana.validateStorageRequired();\n   * await vana.data.uploadFile(file); // Safe to proceed\n   * ```\n   */\n  public validateStorageRequired(): void {\n    if (!this.hasRequiredStorage) {\n      throw new InvalidConfigurationError(\n        \"Storage configuration is required for this operation. \" +\n          \"Please configure storage providers in VanaConfig.storage, \" +\n          \"provide a relayer configuration, \" +\n          \"or pass pre-stored URLs to avoid this dependency. \" +\n          \"\\n\\nFor better type safety, consider using VanaCoreFactory.createWithStorage() \" +\n          \"with VanaConfigWithStorage to catch this error at compile time.\",\n      );\n    }\n  }\n\n  /**\n   * Checks whether storage is configured without throwing an error.\n   *\n   * @returns True if storage is properly configured\n   * @example\n   * ```typescript\n   * if (vana.hasStorage()) {\n   *   await vana.data.uploadFile(file);\n   * } else {\n   *   console.warn('Storage not configured - using pre-stored URLs only');\n   * }\n   * ```\n   */\n  public hasStorage(): boolean {\n    return this.hasRequiredStorage;\n  }\n\n  /**\n   * Type guard to check if this instance has storage enabled at compile time.\n   * Use this when you need TypeScript to understand that storage is available.\n   *\n   * @returns True if storage is configured, with type narrowing\n   * @example\n   * ```typescript\n   * if (vana.isStorageEnabled()) {\n   *   // TypeScript knows storage is available here\n   *   await vana.data.uploadFile(file);\n   * }\n   * ```\n   */\n  public isStorageEnabled(): this is VanaCore & StorageRequiredMarker {\n    return this.hasRequiredStorage;\n  }\n\n  /**\n   * Validates the provided configuration object against all requirements.\n   *\n   * @remarks\n   * This method performs comprehensive validation of wallet client configuration,\n   * chain configuration, storage providers, and relayer callbacks.\n   * @param config - The configuration object to validate\n   * @throws {InvalidConfigurationError} When any configuration parameter is invalid\n   */\n  private validateConfig(config: VanaConfig): void {\n    if (!config) {\n      throw new InvalidConfigurationError(\"Configuration object is required\");\n    }\n\n    // Validate storage configuration if provided\n    if (config.storage?.providers) {\n      if (typeof config.storage.providers !== \"object\") {\n        throw new InvalidConfigurationError(\n          \"storage.providers must be an object\",\n        );\n      }\n\n      // Validate that all providers have required methods\n      for (const [name, provider] of Object.entries(config.storage.providers)) {\n        if (!provider || typeof provider !== \"object\") {\n          throw new InvalidConfigurationError(\n            `Storage provider '${name}' must be a valid StorageProvider object`,\n          );\n        }\n      }\n\n      // Validate default provider if specified\n      if (config.storage.defaultProvider) {\n        if (!(config.storage.defaultProvider in config.storage.providers)) {\n          throw new InvalidConfigurationError(\n            `Default storage provider '${config.storage.defaultProvider}' not found in providers`,\n          );\n        }\n      }\n    }\n\n    if (isWalletConfig(config)) {\n      // Validate WalletConfig\n      if (!config.walletClient) {\n        throw new InvalidConfigurationError(\"walletClient is required\");\n      }\n\n      // Validate that walletClient is actually a WalletClient\n      if (\n        typeof config.walletClient !== \"object\" ||\n        !config.walletClient.signTypedData\n      ) {\n        throw new InvalidConfigurationError(\n          \"walletClient must be a valid viem WalletClient\",\n        );\n      }\n\n      // Validate that wallet client has a chain\n      if (!config.walletClient.chain) {\n        throw new InvalidConfigurationError(\n          \"walletClient must have a chain configured\",\n        );\n      }\n\n      // Validate that the chain is supported\n      if (!isVanaChainId(config.walletClient.chain.id)) {\n        throw new InvalidConfigurationError(\n          `Unsupported chain ID: ${String(config.walletClient.chain.id)}. Supported chains: 14800 (Moksha testnet), 1480 (Vana mainnet)`,\n        );\n      }\n    } else if (isChainConfig(config)) {\n      // Validate ChainConfig\n      if (!isVanaChainId(config.chainId)) {\n        throw new InvalidConfigurationError(\n          `Unsupported chain ID: ${String(config.chainId)}. Supported chains: 14800 (Moksha testnet), 1480 (Vana mainnet)`,\n        );\n      }\n\n      // Validate rpcUrl if provided\n      if (config.rpcUrl) {\n        if (typeof config.rpcUrl !== \"string\") {\n          throw new InvalidConfigurationError(\"rpcUrl must be a string\");\n        }\n\n        if (config.rpcUrl.trim() === \"\") {\n          throw new InvalidConfigurationError(\"rpcUrl cannot be empty\");\n        }\n\n        // Basic URL validation for RPC URL\n        try {\n          new URL(config.rpcUrl);\n        } catch {\n          throw new InvalidConfigurationError(\"rpcUrl must be a valid URL\");\n        }\n      }\n\n      // Account is optional for ChainConfig, but if provided, validate it\n      if (config.account) {\n        if (typeof config.account !== \"object\" || !config.account.address) {\n          throw new InvalidConfigurationError(\n            \"account must be a valid viem Account object\",\n          );\n        }\n      }\n    } else if (isReadOnlyConfig(config)) {\n      // Validate read-only config with publicClient and address\n      if (!config.publicClient) {\n        throw new InvalidConfigurationError(\n          \"publicClient is required for read-only configuration\",\n        );\n      }\n      if (!config.address) {\n        throw new InvalidConfigurationError(\n          \"address is required for read-only configuration\",\n        );\n      }\n    } else if (isAddressOnlyConfig(config)) {\n      // Validate address-only config\n      if (!config.address) {\n        throw new InvalidConfigurationError(\n          \"address is required for address-only configuration\",\n        );\n      }\n      // chain is optional, will use default\n    } else {\n      throw new InvalidConfigurationError(\n        \"Invalid configuration: must provide either walletClient, publicClient + address, or address alone\",\n      );\n    }\n  }\n\n  /**\n   * Gets the current chain ID from the wallet client.\n   *\n   * @returns The numeric chain ID of the connected network\n   * @example\n   * ```typescript\n   * const chainId = vana.chainId;\n   * console.log(`Connected to chain: ${chainId}`); // e.g., \"Connected to chain: 14800\"\n   * ```\n   */\n  get chainId(): number {\n    return this.protocol.getChainId();\n  }\n\n  /**\n   * Gets the current chain name from the wallet client.\n   *\n   * @returns The human-readable name of the connected network\n   * @example\n   * ```typescript\n   * const chainName = vana.chainName;\n   * console.log(`Connected to: ${chainName}`); // e.g., \"Connected to: Moksha Testnet\"\n   * ```\n   */\n  get chainName(): string {\n    return this.protocol.getChainName();\n  }\n\n  /**\n   * The user's wallet address.\n   * In wallet mode, this always returns the current wallet account address.\n   * In read-only mode, this returns the static address provided during initialization.\n   *\n   * @example\n   * ```typescript\n   * const address = vana.userAddress;\n   * console.log(`User address: ${address}`); // e.g., \"User address: 0x742d35...\"\n   * ```\n   */\n  get userAddress(): Address {\n    // In wallet mode: dynamically read from wallet\n    if (this.walletClient?.account) {\n      return extractAddress(this.walletClient.account);\n    }\n\n    // In read-only mode: use static address\n    if (this._staticUserAddress) {\n      return this._staticUserAddress;\n    }\n\n    throw new Error(\"No user address available\");\n  }\n\n  /**\n   * Retrieves comprehensive runtime configuration information.\n   *\n   * @returns The current runtime configuration including chain, storage, and relayer settings\n   * @example\n   * ```typescript\n   * const config = vana.getConfig();\n   * console.log(`Chain: ${config.chainName} (${config.chainId})`);\n   * console.log(`Storage providers: ${config.storageProviders.join(\", \")}`);\n   * ```\n   */\n  getConfig(): RuntimeConfig {\n    return {\n      chainId: this.chainId as VanaChainId,\n      chainName: this.chainName,\n      relayerConfig: this.relayerConfig,\n      storageProviders: this.storageManager?.getStorageProviders() ?? [],\n      defaultStorageProvider: this.storageManager?.getDefaultStorageProvider(),\n    };\n  }\n\n  /**\n   * Sets the platform adapter for environment-specific operations.\n   * This is useful for testing and advanced use cases where you need\n   * to override the default platform detection.\n   *\n   * @param adapter - The platform adapter to use\n   * @example\n   * ```typescript\n   * // For testing with a mock adapter\n   * const mockAdapter = new MockPlatformAdapter();\n   * vana.setPlatformAdapter(mockAdapter);\n   *\n   * // For advanced use cases with custom adapters\n   * const customAdapter = new CustomPlatformAdapter();\n   * vana.setPlatformAdapter(customAdapter);\n   * ```\n   */\n  setPlatformAdapter(adapter: VanaPlatformAdapter): void {\n    this.platform = adapter;\n\n    // Note: Controllers will use the new platform adapter on their next operation\n    // since they access this.platform from the shared context\n  }\n\n  /**\n   * Gets the current platform adapter.\n   * This is useful for advanced use cases where you need to access\n   * the platform adapter directly.\n   *\n   * @returns The current platform adapter\n   * @example\n   * ```typescript\n   * const adapter = vana.getPlatformAdapter();\n   * const encrypted = await adapter.encrypt(data, key);\n   * ```\n   */\n  getPlatformAdapter(): VanaPlatformAdapter {\n    return this.platform;\n  }\n\n  /**\n   * Encrypts data using the Vana protocol standard encryption.\n   *\n   * @remarks\n   * This method implements the Vana network's standard encryption protocol using\n   * platform-appropriate cryptographic libraries. It automatically handles different\n   * input types (string or Blob) and produces encrypted output suitable for secure\n   * storage or transmission. The encryption is compatible with the network's\n   * decryption protocols and can be decrypted by authorized parties.\n   *\n   * @param data - The data to encrypt (string or Blob)\n   * @param key - The encryption key (typically generated via `generateEncryptionKey`)\n   * @returns The encrypted data as a Blob\n   * @throws {Error} When encryption fails due to invalid key or data format\n   * @example\n   * ```typescript\n   * import { generateEncryptionKey } from '@opendatalabs/vana-sdk/node';\n   *\n   * // Generate encryption key from wallet signature\n   * const encryptionKey = await generateEncryptionKey(vana.walletClient);\n   *\n   * // Encrypt string data\n   * const sensitiveData = \"User's private information\";\n   * const encrypted = await vana.encryptBlob(sensitiveData, encryptionKey);\n   *\n   * // Encrypt file data\n   * const fileBlob = new Blob([fileContent], { type: 'application/json' });\n   * const encryptedFile = await vana.encryptBlob(fileBlob, encryptionKey);\n   *\n   * // Store encrypted data safely\n   * await storageProvider.upload(encrypted, 'encrypted-data.bin');\n   * ```\n   */\n  public async encryptBlob(data: string | Blob, key: string): Promise<Blob> {\n    return encryptBlobWithSignedKey(data, key, this.platform);\n  }\n\n  /**\n   * Decrypts data that was encrypted using the Vana protocol.\n   *\n   * @remarks\n   * This method decrypts data that was previously encrypted using the Vana network's\n   * standard encryption protocol. It requires the same wallet signature that was used\n   * for encryption and automatically uses the appropriate platform adapter for\n   * cryptographic operations. The decrypted output maintains the original data format.\n   *\n   * @param encryptedData - The encrypted data (string or Blob)\n   * @param walletSignature - The wallet signature used as decryption key\n   * @returns The decrypted data as a Blob\n   * @throws {Error} When decryption fails due to invalid signature or corrupted data\n   * @example\n   * ```typescript\n   * import { generateEncryptionKey } from '@opendatalabs/vana-sdk/node';\n   *\n   * // Retrieve encrypted data from storage\n   * const encryptedBlob = await storageProvider.download('encrypted-data.bin');\n   *\n   * // Generate the same key used for encryption\n   * const decryptionKey = await generateEncryptionKey(vana.walletClient);\n   *\n   * // Decrypt the data\n   * const decrypted = await vana.decryptBlob(encryptedBlob, decryptionKey);\n   *\n   * // Convert back to original format\n   * const originalText = await decrypted.text();\n   * const originalJson = JSON.parse(originalText);\n   *\n   * console.log('Decrypted data:', originalJson);\n   * ```\n   *\n   * @example\n   * ```typescript\n   * // Decrypt file downloaded from Vana network\n   * const userFiles = await vana.data.getUserFiles();\n   * const file = userFiles[0];\n   *\n   * // Download encrypted content\n   * const encrypted = await fetch(file.url).then(r => r.blob());\n   *\n   * // Decrypt with user's key\n   * const decryptionKey = await generateEncryptionKey(vana.walletClient);\n   * const decrypted = await vana.decryptBlob(encrypted, decryptionKey);\n   *\n   * // Process original data\n   * const fileContent = await decrypted.arrayBuffer();\n   * ```\n   */\n  public async decryptBlob(\n    encryptedData: string | Blob,\n    walletSignature: string,\n  ): Promise<Blob> {\n    return decryptBlobWithSignedKey(\n      encryptedData,\n      walletSignature,\n      this.platform,\n    );\n  }\n\n  /**\n   * Waits for an operation to complete and returns the final result.\n   *\n   * @remarks\n   * This method polls the operation status at regular intervals until it\n   * reaches a terminal state (succeeded, failed, or canceled). Supports\n   * ergonomic overloads to accept either an Operation object or just the ID.\n   *\n   * @param opOrId - Either an Operation object or operation ID string\n   * @param options - Optional polling configuration\n   * @returns The completed operation with result or error\n   * @throws {PersonalServerError} When the operation fails or times out\n   * @example\n   * ```typescript\n   * // Using operation object\n   * const operation = await vana.server.createOperation({ permissionId: 123 });\n   * const completed = await vana.waitForOperation(operation);\n   *\n   * // Using just the ID\n   * const completed = await vana.waitForOperation(\"op_abc123\");\n   *\n   * // With custom timeout\n   * const completed = await vana.waitForOperation(operation, {\n   *   timeout: 60000,\n   *   pollingInterval: 1000\n   * });\n   * ```\n   */\n  public async waitForOperation<T = unknown>(\n    opOrId: Operation<T> | string,\n    options?: PollingOptions,\n  ): Promise<Operation<T>> {\n    return this.server.waitForOperation(opOrId, options);\n  }\n\n  /**\n   * Waits for a transaction to be confirmed and returns the receipt.\n   *\n   * @remarks\n   * This method polls for transaction confirmation on the blockchain.\n   * Supports ergonomic overloads to accept either a transaction result\n   * object or just the hash string.\n   *\n   * @param hashOrObj - Either a TransactionResult object or hash string\n   * @param options - Optional wait configuration\n   * @returns The transaction receipt with logs and status\n   * @example\n   * ```typescript\n   * // Using transaction result object\n   * const tx = await vana.permissions.grant(params);\n   * const receipt = await vana.waitForTransactionReceipt(tx);\n   *\n   * // Using just the hash\n   * const receipt = await vana.waitForTransactionReceipt(\"0x123...\");\n   *\n   * // With custom confirmations\n   * const receipt = await vana.waitForTransactionReceipt(tx, {\n   *   confirmations: 3,\n   *   timeout: 60000\n   * });\n   * ```\n   */\n  public async waitForTransactionReceipt(\n    hashOrObj: TransactionResult | { hash: Hash } | Hash,\n    options?: TransactionWaitOptions,\n  ): Promise<TransactionReceipt> {\n    const hash = typeof hashOrObj === \"string\" ? hashOrObj : hashOrObj.hash;\n\n    return this.publicClient.waitForTransactionReceipt({\n      hash,\n      confirmations: options?.confirmations,\n      pollingInterval: options?.pollingInterval,\n      timeout: options?.timeout,\n    });\n  }\n\n  /**\n   * Waits for transaction confirmation and extracts blockchain event data.\n   *\n   * @remarks\n   * This method leverages the context-carrying POJO architecture. When passed a\n   * `TransactionResult` with an `operation` field, it automatically parses the\n   * correct events from the transaction logs. For legacy compatibility, it accepts\n   * raw hashes but will not parse events without operation context.\n   *\n   * @param transaction - Transaction result with operation context\n   * @param options - Optional confirmation and timeout settings\n   * @returns Parsed event data specific to the transaction's operation type\n   * @throws {NetworkError} When transaction confirmation times out\n   * @throws {BlockchainError} When expected events are not found in the transaction\n   *\n   * @example\n   * ```typescript\n   * // Recommended: Pass the transaction result for automatic event parsing\n   * const tx = await vana.permissions.submitAddServerFilesAndPermissions(params);\n   * const events = await vana.waitForTransactionEvents<{ permissionId: bigint }>(tx);\n   * console.log(`Permission ID: ${events.permissionId}`);\n   *\n   * // Legacy: Raw hash without event parsing (returns receipt)\n   * const receipt = await vana.waitForTransactionEvents(\"0x123...\");\n   * ```\n   *\n   * @see For understanding transaction flows, visit https://docs.vana.org/docs/transactions\n   */\n  public async waitForTransactionEvents<C extends Contract, F extends Fn<C>>(\n    transaction: TransactionResult<C, F>,\n    options?: TransactionWaitOptions,\n  ): Promise<TypedTransactionResult<C, F>> {\n    // Import the POJO-based parser\n    const { parseTransaction } = await import(\"./utils/parseTransactionPojo\");\n\n    // Wait for the transaction to be mined\n    const receipt = await this.waitForTransactionReceipt(\n      transaction.hash,\n      options,\n    );\n\n    // Parse events using our heuristic-free POJO system\n    const result = parseTransaction(transaction, receipt);\n\n    // Return the strongly-typed result\n    // TypeScript knows exactly what events are possible!\n    return result;\n  }\n}\n"],"mappings":"AAOA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP,SAAS,iCAAiC;AAE1C,SAAS,6BAA6B;AACtC,SAAS,sBAAsB;AAC/B,SAAS,wBAAwB;AACjC,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AACnC,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB,oBAAoB,YAAY;AAS7D,SAAS,sBAAsB;AAY/B,SAAS,cAAc;AACvB,SAAS,gBAAgB,mBAAmB;AAE5C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAKA,MAAM,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmB3B,OAAO,kBACL,UACA,QACkC;AAClC,UAAM,OAAO,IAAI,SAAS,UAAU,MAAM;AAC1C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,OAAO,OAAO,UAA+B,QAA8B;AACzE,WAAO,IAAI,SAAS,UAAU,MAAM;AAAA,EACtC;AACF;AAgDO,MAAM,SAAS;AAAA;AAAA,EAEJ;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGN;AAAA,EAEO;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBjB,YAAY,UAA+B,QAAoB;AAE7D,SAAK,WAAW;AAGhB,SAAK,eAAe,MAAM;AAG1B,SAAK,gBAAgB,OAAO;AAC5B,QAAI,OAAO,SAAS;AAElB,UACE,OAAO,OAAO,YAAY,YAC1B,OAAO,OAAO,YAAY,YAC1B;AACA,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAEA,UAAI,OAAO,OAAO,YAAY,UAAU;AAEtC,cAAM,MAAM,OAAO;AACnB,aAAK,kBAAkB,OAAO,YAAmC;AAC/D,gBAAM,WAAW,MAAM,MAAM,KAAK;AAAA,YAChC,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,YAC9C,MAAM,KAAK,UAAU,OAAO;AAAA,UAC9B,CAAC;AACD,cAAI,CAAC,SAAS,IAAI;AAChB,kBAAM,IAAI,MAAM,2BAA2B,SAAS,UAAU,EAAE;AAAA,UAClE;AACA,iBAAO,SAAS,KAAK;AAAA,QACvB;AAAA,MACF,OAAO;AAEL,aAAK,kBAAkB,OAAO;AAAA,MAChC;AAAA,IACF;AAGA,SAAK,kBAAkB,OAAO;AAG9B,SAAK,eAAe,OAAO;AAG3B,SAAK,qBAAqB,iBAAiB,MAAM;AAGjD,QAAI,OAAO,SAAS,WAAW;AAC7B,WAAK,iBAAiB,IAAI,eAAe;AAGzC,iBAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,OAAO,QAAQ,SAAS,GAAG;AACvE,cAAM,YAAY,SAAS,OAAO,QAAQ;AAC1C,aAAK,eAAe,SAAS,MAAM,UAAU,SAAS;AAAA,MACxD;AAGA,UACE,CAAC,OAAO,QAAQ,mBAChB,OAAO,KAAK,OAAO,QAAQ,SAAS,EAAE,SAAS,GAC/C;AACA,cAAM,oBAAoB,OAAO,KAAK,OAAO,QAAQ,SAAS,EAAE,CAAC;AACjE,aAAK,eAAe,mBAAmB,iBAAiB;AAAA,MAC1D;AAAA,IACF;AAGA,QAAI;AACJ,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI,eAAe,MAAM,GAAG;AAE1B,qBAAe,OAAO;AACtB,mBAAc,aAAa,SAAmB;AAG9C,0BAAoB;AAGpB,UAAI,kBAAkB,UAAU,OAAO,cAAc;AACnD,uBAAe,OAAO;AAAA,MACxB,OAAO;AACL,uBAAe,mBAAmB;AAAA,UAChC,OAAO;AAAA,UACP,WAAW,KAAK;AAAA,QAClB,CAAC;AAAA,MACH;AAAA,IACF,WAAW,iBAAiB,MAAM,GAAG;AAEnC,qBAAe;AACf,qBAAe,OAAO;AACtB,0BAAoB,OAAO;AAC3B,mBAAa,OAAO,aAAa,SAAS;AAAA,IAC5C,WAAW,oBAAoB,MAAM,GAAG;AAEtC,qBAAe;AACf,0BAAoB,OAAO;AAC3B,mBAAa,OAAO,SAAS;AAE7B,qBAAe,mBAAmB;AAAA,QAChC,OAAO;AAAA,QACP,WAAW,KAAK;AAAA,MAClB,CAAC;AAAA,IACH,WAAW,cAAc,MAAM,GAAG;AAEhC,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAEA,YAAM,QAAQ,OAAO,OAAO,OAAO;AACnC,UAAI,CAAC,OAAO;AACV,cAAM,IAAI;AAAA,UACR,yBAAyB,OAAO,OAAO;AAAA,QACzC;AAAA,MACF;AAEA,mBAAa;AACb,qBAAe,mBAAmB;AAAA,QAChC;AAAA,QACA,WAAW,KAAK,OAAO,UAAU,MAAM,QAAQ,QAAQ,KAAK,CAAC,CAAC;AAAA,QAC9D,SAAS,OAAO;AAAA,MAClB,CAAC;AAED,0BAAoB;AACpB,qBAAe,mBAAmB;AAAA,QAChC;AAAA,QACA,WAAW,KAAK;AAAA,MAClB,CAAC;AAAA,IACH,OAAO;AACL,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAGA,SAAK,eAAe;AACpB,SAAK,eAAe;AACpB,SAAK,qBAAqB;AAG1B,UAAM,cAAc,eAAe,WAAW,EAAE;AAChD,UAAM,cAAc,OAAO,eAAe,aAAa;AACvD,UAAM,oBACJ,OAAO,4BAA4B,aAAa;AAGlD,UAAM,OAAO;AACb,UAAM,gBAAmC;AAAA,MACvC;AAAA,MACA;AAAA,MACA,IAAI,cAAc;AAEhB,eAAO,KAAK;AAAA,MACd;AAAA,MACA,mBAAmB;AAAA;AAAA,MACnB,SAAS,KAAK;AAAA,MACd,iBAAiB,KAAK;AAAA,MACtB,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA,UAAU,KAAK;AAAA;AAAA,MACf,yBAAyB,KAAK,wBAAwB,KAAK,IAAI;AAAA,MAC/D,YAAY,KAAK,WAAW,KAAK,IAAI;AAAA,MACrC,cAAc,KAAK;AAAA,MACnB,0BAA0B;AAAA,MAC1B,0BAA0B,KAAK,yBAAyB,KAAK,IAAI;AAAA,MACjE,kBAAkB,KAAK,iBAAiB,KAAK,IAAI;AAAA,IACnD;AAGA,SAAK,cAAc,IAAI,sBAAsB,aAAa;AAC1D,SAAK,OAAO,IAAI,eAAe,aAAa;AAC5C,SAAK,UAAU,IAAI,iBAAiB,aAAa;AACjD,SAAK,SAAS,IAAI,iBAAiB,aAAa;AAChD,SAAK,WAAW,IAAI,mBAAmB,aAAa;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeO,0BAAgC;AACrC,QAAI,CAAC,KAAK,oBAAoB;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MAMF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeO,aAAsB;AAC3B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeO,mBAA6D;AAClE,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,eAAe,QAA0B;AAC/C,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,0BAA0B,kCAAkC;AAAA,IACxE;AAGA,QAAI,OAAO,SAAS,WAAW;AAC7B,UAAI,OAAO,OAAO,QAAQ,cAAc,UAAU;AAChD,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAGA,iBAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,OAAO,QAAQ,SAAS,GAAG;AACvE,YAAI,CAAC,YAAY,OAAO,aAAa,UAAU;AAC7C,gBAAM,IAAI;AAAA,YACR,qBAAqB,IAAI;AAAA,UAC3B;AAAA,QACF;AAAA,MACF;AAGA,UAAI,OAAO,QAAQ,iBAAiB;AAClC,YAAI,EAAE,OAAO,QAAQ,mBAAmB,OAAO,QAAQ,YAAY;AACjE,gBAAM,IAAI;AAAA,YACR,6BAA6B,OAAO,QAAQ,eAAe;AAAA,UAC7D;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,eAAe,MAAM,GAAG;AAE1B,UAAI,CAAC,OAAO,cAAc;AACxB,cAAM,IAAI,0BAA0B,0BAA0B;AAAA,MAChE;AAGA,UACE,OAAO,OAAO,iBAAiB,YAC/B,CAAC,OAAO,aAAa,eACrB;AACA,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAGA,UAAI,CAAC,OAAO,aAAa,OAAO;AAC9B,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAGA,UAAI,CAAC,cAAc,OAAO,aAAa,MAAM,EAAE,GAAG;AAChD,cAAM,IAAI;AAAA,UACR,yBAAyB,OAAO,OAAO,aAAa,MAAM,EAAE,CAAC;AAAA,QAC/D;AAAA,MACF;AAAA,IACF,WAAW,cAAc,MAAM,GAAG;AAEhC,UAAI,CAAC,cAAc,OAAO,OAAO,GAAG;AAClC,cAAM,IAAI;AAAA,UACR,yBAAyB,OAAO,OAAO,OAAO,CAAC;AAAA,QACjD;AAAA,MACF;AAGA,UAAI,OAAO,QAAQ;AACjB,YAAI,OAAO,OAAO,WAAW,UAAU;AACrC,gBAAM,IAAI,0BAA0B,yBAAyB;AAAA,QAC/D;AAEA,YAAI,OAAO,OAAO,KAAK,MAAM,IAAI;AAC/B,gBAAM,IAAI,0BAA0B,wBAAwB;AAAA,QAC9D;AAGA,YAAI;AACF,cAAI,IAAI,OAAO,MAAM;AAAA,QACvB,QAAQ;AACN,gBAAM,IAAI,0BAA0B,4BAA4B;AAAA,QAClE;AAAA,MACF;AAGA,UAAI,OAAO,SAAS;AAClB,YAAI,OAAO,OAAO,YAAY,YAAY,CAAC,OAAO,QAAQ,SAAS;AACjE,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,WAAW,iBAAiB,MAAM,GAAG;AAEnC,UAAI,CAAC,OAAO,cAAc;AACxB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,WAAW,oBAAoB,MAAM,GAAG;AAEtC,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IAEF,OAAO;AACL,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,IAAI,UAAkB;AACpB,WAAO,KAAK,SAAS,WAAW;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,IAAI,YAAoB;AACtB,WAAO,KAAK,SAAS,aAAa;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,IAAI,cAAuB;AAEzB,QAAI,KAAK,cAAc,SAAS;AAC9B,aAAO,eAAe,KAAK,aAAa,OAAO;AAAA,IACjD;AAGA,QAAI,KAAK,oBAAoB;AAC3B,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,IAAI,MAAM,2BAA2B;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,YAA2B;AACzB,WAAO;AAAA,MACL,SAAS,KAAK;AAAA,MACd,WAAW,KAAK;AAAA,MAChB,eAAe,KAAK;AAAA,MACpB,kBAAkB,KAAK,gBAAgB,oBAAoB,KAAK,CAAC;AAAA,MACjE,wBAAwB,KAAK,gBAAgB,0BAA0B;AAAA,IACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,mBAAmB,SAAoC;AACrD,SAAK,WAAW;AAAA,EAIlB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,qBAA0C;AACxC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmCA,MAAa,YAAY,MAAqB,KAA4B;AACxE,WAAO,yBAAyB,MAAM,KAAK,KAAK,QAAQ;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoDA,MAAa,YACX,eACA,iBACe;AACf,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,MAAa,iBACX,QACA,SACuB;AACvB,WAAO,KAAK,OAAO,iBAAiB,QAAQ,OAAO;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6BA,MAAa,0BACX,WACA,SAC6B;AAC7B,UAAM,OAAO,OAAO,cAAc,WAAW,YAAY,UAAU;AAEnE,WAAO,KAAK,aAAa,0BAA0B;AAAA,MACjD;AAAA,MACA,eAAe,SAAS;AAAA,MACxB,iBAAiB,SAAS;AAAA,MAC1B,SAAS,SAAS;AAAA,IACpB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,MAAa,yBACX,aACA,SACuC;AAEvC,UAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,8BAA8B;AAGxE,UAAM,UAAU,MAAM,KAAK;AAAA,MACzB,YAAY;AAAA,MACZ;AAAA,IACF;AAGA,UAAM,SAAS,iBAAiB,aAAa,OAAO;AAIpD,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../src/core.ts"],"sourcesContent":["import type {\n  VanaConfig,\n  VanaConfigWithStorage,\n  RuntimeConfig,\n  VanaChainId,\n  StorageRequiredMarker,\n} from \"./types\";\nimport {\n  isWalletConfig,\n  isChainConfig,\n  isReadOnlyConfig,\n  isAddressOnlyConfig,\n  isVanaChainId,\n  hasStorageConfig,\n} from \"./types\";\nimport type { DownloadRelayerCallbacks } from \"./types/config\";\nimport type {\n  RelayerConfig,\n  UnifiedRelayerRequest,\n  UnifiedRelayerResponse,\n} from \"./types/relayer\";\nimport { InvalidConfigurationError } from \"./errors\";\nimport type { ControllerContext } from \"./controllers/permissions\";\nimport { PermissionsController } from \"./controllers/permissions\";\nimport { RuntimePermissionsController } from \"./controllers/runtimePermissions\";\nimport { AccessSettlementController } from \"./controllers/accessSettlement\";\nimport { DataController } from \"./controllers/data\";\nimport { DatasetController } from \"./controllers/dataset\";\nimport { SchemaController } from \"./controllers/schemas\";\nimport { ServerController } from \"./controllers/server\";\nimport { ProtocolController } from \"./controllers/protocol\";\nimport { OperationsController } from \"./controllers/operations\";\nimport { StorageManager } from \"./storage\";\nimport { createWalletClient, createPublicClient, http } from \"viem\";\nimport type {\n  PublicClient,\n  WalletClient,\n  Address,\n  Hash,\n  TransactionReceipt,\n  Chain,\n} from \"viem\";\nimport { extractAddress } from \"./utils/wallet\";\nimport type {\n  Operation,\n  PollingOptions,\n  TransactionResult,\n  TransactionWaitOptions,\n} from \"./types/operations\";\nimport type {\n  IOperationStore,\n  IRelayerStateStore,\n} from \"./types/operationStore\";\nimport type { IAtomicStore } from \"./types/atomicStore\";\nimport type {\n  Contract,\n  Fn,\n  TypedTransactionResult,\n} from \"./generated/event-types\";\nimport { chains } from \"./config/chains\";\nimport { getChainConfig, vanaMainnet } from \"./chains\";\nimport type { VanaPlatformAdapter } from \"./platform/interface\";\nimport {\n  encryptBlobWithSignedKey,\n  decryptBlobWithSignedKey,\n} from \"./utils/encryption\";\n\n/**\n * Factory functions for creating VanaCore instances with proper type safety\n */\nexport class VanaCoreFactory {\n  /**\n   * Creates a VanaCore instance that enforces storage requirements at compile time.\n   * Use this factory when you know you'll need storage-dependent operations.\n   *\n   * @param platform - The platform adapter for environment-specific operations\n   * @param config - Configuration that includes required storage providers\n   * @returns VanaCore instance with storage validation\n   * @example\n   * ```typescript\n   * const vanaCore = VanaCoreFactory.createWithStorage(platformAdapter, {\n   *   walletClient: myWalletClient,\n   *   storage: {\n   *     providers: { ipfs: new IPFSStorage() },\n   *     defaultProvider: 'ipfs'\n   *   }\n   * });\n   * ```\n   */\n  static createWithStorage(\n    platform: VanaPlatformAdapter,\n    config: VanaConfigWithStorage,\n  ): VanaCore & StorageRequiredMarker {\n    const core = new VanaCore(platform, config);\n    return core as VanaCore & StorageRequiredMarker;\n  }\n\n  /**\n   * Creates a VanaCore instance without storage requirements.\n   * Storage-dependent operations will fail at runtime if not configured.\n   *\n   * @param platform - The platform adapter for environment-specific operations\n   * @param config - Basic configuration without required storage\n   * @returns VanaCore instance\n   * @example\n   * ```typescript\n   * const vanaCore = VanaCoreFactory.create(platformAdapter, {\n   *   walletClient: myWalletClient\n   * });\n   * ```\n   */\n  static create(platform: VanaPlatformAdapter, config: VanaConfig): VanaCore {\n    return new VanaCore(platform, config);\n  }\n}\n\n/**\n * Provides the core SDK functionality for interacting with the Vana network.\n *\n * @remarks\n * This environment-agnostic class contains all SDK logic and accepts a platform\n * adapter to handle environment-specific operations. It initializes all controllers\n * and manages shared context between them, providing a unified interface for\n * data management, permissions, smart contracts, and storage operations.\n *\n * The class uses TypeScript overloading to enforce storage requirements at compile time.\n * Methods that require storage will throw `InvalidConfigurationError` at runtime if\n * storage providers are not configured, implementing a fail-fast approach to prevent\n * errors during expensive operations.\n *\n * **Core Architecture:**\n * - **Controllers**: Specialized modules for different Vana features (data, permissions, etc.)\n * - **Platform Adapters**: Environment-specific implementations (browser vs Node.js)\n * - **Storage Managers**: Abstraction layer for multiple storage providers\n * - **Context Sharing**: Unified configuration and services across all controllers\n *\n * For public usage, use the platform-specific factory functions:\n * - Browser: `import { Vana } from '@opendatalabs/vana-sdk/browser'`\n * - Node.js: `import { Vana } from '@opendatalabs/vana-sdk/node'`\n *\n * @example\n * ```typescript\n * // Direct instantiation (advanced usage)\n * import { VanaCore, BrowserPlatformAdapter } from '@opendatalabs/vana-sdk/browser';\n *\n * const core = new VanaCore(new BrowserPlatformAdapter(), {\n *   walletClient: myWalletClient,\n *   storage: {\n *     providers: { ipfs: new IPFSStorage() },\n *     defaultProvider: 'ipfs'\n *   }\n * });\n *\n * // Access all controllers\n * const files = await core.data.getUserFiles();\n * const permissions = await core.permissions.grant({\n *   grantee: '0x742d35...',\n *   operation: 'read'\n * });\n * ```\n * @category Core SDK\n */\nexport class VanaCore {\n  /** Manages gasless data access permissions and trusted server registry. */\n  public readonly permissions: PermissionsController;\n\n  /** Manages runtime permissions for dataset monetization via Vana Runtime. */\n  public readonly runtimePermissions: RuntimePermissionsController;\n\n  /** Manages payment settlement for runtime operations. */\n  public readonly accessSettlement: AccessSettlementController;\n\n  /** Handles user data file operations. */\n  public readonly data: DataController;\n\n  /** Manages dataset creation and contributor workflows. */\n  public readonly dataset: DatasetController;\n\n  /** Manages data schemas and refiners. */\n  public readonly schemas: SchemaController;\n\n  /** Manages asynchronous operation recovery and status checking. */\n  public readonly operations: OperationsController;\n\n  /** Provides personal server setup and trusted server interactions. */\n  public readonly server: ServerController;\n\n  /** Offers low-level access to Vana protocol smart contracts. */\n  public readonly protocol: ProtocolController;\n\n  /** Handles environment-specific operations like encryption and file systems. */\n  protected platform: VanaPlatformAdapter;\n\n  private readonly relayerConfig?: RelayerConfig;\n  private readonly relayerCallback?: (\n    request: UnifiedRelayerRequest,\n  ) => Promise<UnifiedRelayerResponse>;\n  private readonly downloadRelayer?: DownloadRelayerCallbacks;\n  private readonly storageManager?: StorageManager;\n  private readonly hasRequiredStorage: boolean;\n  private readonly ipfsGateways?: string[];\n  public readonly publicClient: PublicClient;\n  private readonly walletClient?: WalletClient;\n  private readonly _staticUserAddress?: Address; // For read-only mode\n  protected readonly operationStore?: IOperationStore | IRelayerStateStore;\n  protected readonly atomicStore?: IAtomicStore;\n\n  /**\n   * Initializes a new VanaCore client instance with the provided configuration.\n   *\n   * @remarks\n   * The constructor validates the configuration, initializes storage providers if configured,\n   * creates wallet and public clients, and sets up all SDK controllers with shared context.\n   *\n   * IMPORTANT: This constructor will validate storage requirements at runtime to fail fast.\n   * Methods that require storage will throw runtime errors if storage is not configured.\n   *\n   * @param platform - The platform adapter for environment-specific operations\n   * @param config - The configuration object specifying wallet or chain settings\n   * @throws {InvalidConfigurationError} When the configuration is invalid or incomplete\n   * @example\n   * ```typescript\n   * // Direct instantiation (consider using factory methods instead)\n   * const vanaCore = new VanaCore(platformAdapter, {\n   *   walletClient: myWalletClient,\n   * });\n   * ```\n   */\n  constructor(platform: VanaPlatformAdapter, config: VanaConfig) {\n    // Store the platform adapter\n    this.platform = platform;\n\n    // Validate configuration\n    this.validateConfig(config);\n\n    // Store operation store if provided\n    this.operationStore = config?.operationStore;\n\n    // Store relayer config and set up callback\n    this.relayerConfig = config.relayer;\n    if (config.relayer) {\n      // Validate relayer type\n      if (\n        typeof config.relayer !== \"string\" &&\n        typeof config.relayer !== \"function\"\n      ) {\n        throw new InvalidConfigurationError(\n          \"Relayer must be either a URL string or a callback function\",\n        );\n      }\n\n      if (typeof config.relayer === \"string\") {\n        // Convenience: URL string - create HTTP transport\n        const url = config.relayer;\n        this.relayerCallback = async (request: UnifiedRelayerRequest) => {\n          const response = await fetch(url, {\n            method: \"POST\",\n            headers: { \"Content-Type\": \"application/json\" },\n            body: JSON.stringify(request),\n          });\n          if (!response.ok) {\n            throw new Error(`Relayer request failed: ${response.statusText}`);\n          }\n          return response.json();\n        };\n      } else {\n        // Direct callback function\n        this.relayerCallback = config.relayer;\n      }\n    }\n\n    // Store download relayer if provided\n    this.downloadRelayer = config.downloadRelayer;\n\n    // Store IPFS gateways if provided\n    this.ipfsGateways = config.ipfsGateways;\n\n    // Check if storage is properly configured\n    this.hasRequiredStorage = hasStorageConfig(config);\n\n    // Initialize storage manager if storage providers are provided\n    if (config.storage?.providers) {\n      this.storageManager = new StorageManager();\n\n      // Register all provided storage providers\n      for (const [name, provider] of Object.entries(config.storage.providers)) {\n        const isDefault = name === config.storage.defaultProvider;\n        this.storageManager.register(name, provider, isDefault);\n      }\n\n      // If no default was explicitly set but providers exist, use the first one\n      if (\n        !config.storage.defaultProvider &&\n        Object.keys(config.storage.providers).length > 0\n      ) {\n        const firstProviderName = Object.keys(config.storage.providers)[0];\n        this.storageManager.setDefaultProvider(firstProviderName);\n      }\n    }\n\n    // Initialize clients based on configuration type\n    let walletClient: WalletClient | undefined;\n    let publicClient: PublicClient;\n    let staticUserAddress: Address | undefined; // Only for read-only mode\n    let chainToUse: Chain;\n\n    if (isWalletConfig(config)) {\n      // Full mode with wallet client\n      walletClient = config.walletClient;\n      chainToUse = (walletClient.chain as Chain) ?? vanaMainnet;\n\n      // In wallet mode, address is dynamic (not stored)\n      staticUserAddress = undefined;\n\n      // Use provided publicClient or create one\n      if (\"publicClient\" in config && config.publicClient) {\n        publicClient = config.publicClient;\n      } else {\n        publicClient = createPublicClient({\n          chain: chainToUse,\n          transport: http(),\n        });\n      }\n    } else if (isReadOnlyConfig(config)) {\n      // Read-only mode with public client and address\n      walletClient = undefined;\n      publicClient = config.publicClient;\n      staticUserAddress = config.address;\n      chainToUse = config.publicClient.chain ?? vanaMainnet;\n    } else if (isAddressOnlyConfig(config)) {\n      // Read-only mode with just address (create public client)\n      walletClient = undefined;\n      staticUserAddress = config.address;\n      chainToUse = config.chain ?? vanaMainnet;\n\n      publicClient = createPublicClient({\n        chain: chainToUse,\n        transport: http(),\n      });\n    } else if (isChainConfig(config)) {\n      // Legacy chain configuration - create wallet client\n      if (!config.account) {\n        throw new InvalidConfigurationError(\n          \"Account is required when using ChainConfig\",\n        );\n      }\n\n      const chain = chains[config.chainId];\n      if (!chain) {\n        throw new InvalidConfigurationError(\n          `Unsupported chain ID: ${config.chainId}`,\n        );\n      }\n\n      chainToUse = chain;\n      walletClient = createWalletClient({\n        chain,\n        transport: http(config.rpcUrl ?? chain.rpcUrls.default.http[0]),\n        account: config.account,\n      });\n      // In wallet mode, address is dynamic (not stored)\n      staticUserAddress = undefined;\n      publicClient = createPublicClient({\n        chain,\n        transport: http(),\n      });\n    } else {\n      throw new InvalidConfigurationError(\n        \"Invalid configuration: must provide either walletClient, publicClient + address, or address alone\",\n      );\n    }\n\n    // Store the clients and static address for later use\n    this.publicClient = publicClient;\n    this.walletClient = walletClient;\n    this._staticUserAddress = staticUserAddress;\n\n    // Get default service URLs from chain config if not provided\n    const chainConfig = getChainConfig(chainToUse.id);\n    const subgraphUrl = config.subgraphUrl ?? chainConfig?.subgraphUrl;\n    const personalServerUrl =\n      config.defaultPersonalServerUrl ?? chainConfig?.personalServerUrl;\n\n    // Create shared context for all controllers with dynamic userAddress getter\n    const self = this; // Capture VanaCore instance for getter delegation\n    const sharedContext: ControllerContext = {\n      walletClient,\n      publicClient,\n      get userAddress() {\n        // Delegate to VanaCore's getter for dynamic resolution\n        return self.userAddress;\n      },\n      applicationClient: walletClient, // Using same wallet for now\n      relayer: this.relayerCallback,\n      downloadRelayer: this.downloadRelayer,\n      storageManager: this.storageManager,\n      subgraphUrl,\n      platform: this.platform, // Pass the platform adapter to controllers\n      validateStorageRequired: this.validateStorageRequired.bind(this),\n      hasStorage: this.hasStorage.bind(this),\n      ipfsGateways: this.ipfsGateways,\n      defaultPersonalServerUrl: personalServerUrl,\n      waitForTransactionEvents: this.waitForTransactionEvents.bind(this),\n      waitForOperation: this.waitForOperation.bind(this),\n      operationStore: this.operationStore,\n    };\n\n    // Initialize controllers\n    this.permissions = new PermissionsController(sharedContext);\n    this.runtimePermissions = new RuntimePermissionsController(sharedContext);\n    this.accessSettlement = new AccessSettlementController(sharedContext);\n    this.data = new DataController(sharedContext);\n    this.dataset = new DatasetController(sharedContext);\n    this.schemas = new SchemaController(sharedContext);\n    this.operations = new OperationsController(sharedContext);\n    this.server = new ServerController(sharedContext);\n    this.protocol = new ProtocolController(sharedContext);\n  }\n\n  /**\n   * Validates that storage is available for storage-dependent operations.\n   * This method enforces the fail-fast principle by checking storage availability\n   * at method call time rather than during expensive operations.\n   *\n   * @throws {InvalidConfigurationError} When storage is required but not configured\n   * @example\n   * ```typescript\n   * // This will throw if storage is not configured\n   * vana.validateStorageRequired();\n   * await vana.data.uploadFile(file); // Safe to proceed\n   * ```\n   */\n  public validateStorageRequired(): void {\n    if (!this.hasRequiredStorage) {\n      throw new InvalidConfigurationError(\n        \"Storage configuration is required for this operation. \" +\n          \"Please configure storage providers in VanaConfig.storage, \" +\n          \"provide a relayer configuration, \" +\n          \"or pass pre-stored URLs to avoid this dependency. \" +\n          \"\\n\\nFor better type safety, consider using VanaCoreFactory.createWithStorage() \" +\n          \"with VanaConfigWithStorage to catch this error at compile time.\",\n      );\n    }\n  }\n\n  /**\n   * Checks whether storage is configured without throwing an error.\n   *\n   * @returns True if storage is properly configured\n   * @example\n   * ```typescript\n   * if (vana.hasStorage()) {\n   *   await vana.data.uploadFile(file);\n   * } else {\n   *   console.warn('Storage not configured - using pre-stored URLs only');\n   * }\n   * ```\n   */\n  public hasStorage(): boolean {\n    return this.hasRequiredStorage;\n  }\n\n  /**\n   * Type guard to check if this instance has storage enabled at compile time.\n   * Use this when you need TypeScript to understand that storage is available.\n   *\n   * @returns True if storage is configured, with type narrowing\n   * @example\n   * ```typescript\n   * if (vana.isStorageEnabled()) {\n   *   // TypeScript knows storage is available here\n   *   await vana.data.uploadFile(file);\n   * }\n   * ```\n   */\n  public isStorageEnabled(): this is VanaCore & StorageRequiredMarker {\n    return this.hasRequiredStorage;\n  }\n\n  /**\n   * Validates the provided configuration object against all requirements.\n   *\n   * @remarks\n   * This method performs comprehensive validation of wallet client configuration,\n   * chain configuration, storage providers, and relayer callbacks.\n   * @param config - The configuration object to validate\n   * @throws {InvalidConfigurationError} When any configuration parameter is invalid\n   */\n  private validateConfig(config: VanaConfig): void {\n    if (!config) {\n      throw new InvalidConfigurationError(\"Configuration object is required\");\n    }\n\n    // Validate storage configuration if provided\n    if (config.storage?.providers) {\n      if (typeof config.storage.providers !== \"object\") {\n        throw new InvalidConfigurationError(\n          \"storage.providers must be an object\",\n        );\n      }\n\n      // Validate that all providers have required methods\n      for (const [name, provider] of Object.entries(config.storage.providers)) {\n        if (!provider || typeof provider !== \"object\") {\n          throw new InvalidConfigurationError(\n            `Storage provider '${name}' must be a valid StorageProvider object`,\n          );\n        }\n      }\n\n      // Validate default provider if specified\n      if (config.storage.defaultProvider) {\n        if (!(config.storage.defaultProvider in config.storage.providers)) {\n          throw new InvalidConfigurationError(\n            `Default storage provider '${config.storage.defaultProvider}' not found in providers`,\n          );\n        }\n      }\n    }\n\n    if (isWalletConfig(config)) {\n      // Validate WalletConfig\n      if (!config.walletClient) {\n        throw new InvalidConfigurationError(\"walletClient is required\");\n      }\n\n      // Validate that walletClient is actually a WalletClient\n      if (\n        typeof config.walletClient !== \"object\" ||\n        !config.walletClient.signTypedData\n      ) {\n        throw new InvalidConfigurationError(\n          \"walletClient must be a valid viem WalletClient\",\n        );\n      }\n\n      // Validate that wallet client has a chain\n      if (!config.walletClient.chain) {\n        throw new InvalidConfigurationError(\n          \"walletClient must have a chain configured\",\n        );\n      }\n\n      // Validate that the chain is supported\n      if (!isVanaChainId(config.walletClient.chain.id)) {\n        throw new InvalidConfigurationError(\n          `Unsupported chain ID: ${String(config.walletClient.chain.id)}. Supported chains: 14800 (Moksha testnet), 1480 (Vana mainnet)`,\n        );\n      }\n    } else if (isChainConfig(config)) {\n      // Validate ChainConfig\n      if (!isVanaChainId(config.chainId)) {\n        throw new InvalidConfigurationError(\n          `Unsupported chain ID: ${String(config.chainId)}. Supported chains: 14800 (Moksha testnet), 1480 (Vana mainnet)`,\n        );\n      }\n\n      // Validate rpcUrl if provided\n      if (config.rpcUrl) {\n        if (typeof config.rpcUrl !== \"string\") {\n          throw new InvalidConfigurationError(\"rpcUrl must be a string\");\n        }\n\n        if (config.rpcUrl.trim() === \"\") {\n          throw new InvalidConfigurationError(\"rpcUrl cannot be empty\");\n        }\n\n        // Basic URL validation for RPC URL\n        try {\n          new URL(config.rpcUrl);\n        } catch {\n          throw new InvalidConfigurationError(\"rpcUrl must be a valid URL\");\n        }\n      }\n\n      // Account is optional for ChainConfig, but if provided, validate it\n      if (config.account) {\n        if (typeof config.account !== \"object\" || !config.account.address) {\n          throw new InvalidConfigurationError(\n            \"account must be a valid viem Account object\",\n          );\n        }\n      }\n    } else if (isReadOnlyConfig(config)) {\n      // Validate read-only config with publicClient and address\n      if (!config.publicClient) {\n        throw new InvalidConfigurationError(\n          \"publicClient is required for read-only configuration\",\n        );\n      }\n      if (!config.address) {\n        throw new InvalidConfigurationError(\n          \"address is required for read-only configuration\",\n        );\n      }\n    } else if (isAddressOnlyConfig(config)) {\n      // Validate address-only config\n      if (!config.address) {\n        throw new InvalidConfigurationError(\n          \"address is required for address-only configuration\",\n        );\n      }\n      // chain is optional, will use default\n    } else {\n      throw new InvalidConfigurationError(\n        \"Invalid configuration: must provide either walletClient, publicClient + address, or address alone\",\n      );\n    }\n  }\n\n  /**\n   * Gets the current chain ID from the wallet client.\n   *\n   * @returns The numeric chain ID of the connected network\n   * @example\n   * ```typescript\n   * const chainId = vana.chainId;\n   * console.log(`Connected to chain: ${chainId}`); // e.g., \"Connected to chain: 14800\"\n   * ```\n   */\n  get chainId(): number {\n    return this.protocol.getChainId();\n  }\n\n  /**\n   * Gets the current chain name from the wallet client.\n   *\n   * @returns The human-readable name of the connected network\n   * @example\n   * ```typescript\n   * const chainName = vana.chainName;\n   * console.log(`Connected to: ${chainName}`); // e.g., \"Connected to: Moksha Testnet\"\n   * ```\n   */\n  get chainName(): string {\n    return this.protocol.getChainName();\n  }\n\n  /**\n   * The user's wallet address.\n   * In wallet mode, this always returns the current wallet account address.\n   * In read-only mode, this returns the static address provided during initialization.\n   *\n   * @example\n   * ```typescript\n   * const address = vana.userAddress;\n   * console.log(`User address: ${address}`); // e.g., \"User address: 0x742d35...\"\n   * ```\n   */\n  get userAddress(): Address {\n    // In wallet mode: dynamically read from wallet\n    if (this.walletClient?.account) {\n      return extractAddress(this.walletClient.account);\n    }\n\n    // In read-only mode: use static address\n    if (this._staticUserAddress) {\n      return this._staticUserAddress;\n    }\n\n    throw new Error(\"No user address available\");\n  }\n\n  /**\n   * Retrieves comprehensive runtime configuration information.\n   *\n   * @returns The current runtime configuration including chain, storage, and relayer settings\n   * @example\n   * ```typescript\n   * const config = vana.getConfig();\n   * console.log(`Chain: ${config.chainName} (${config.chainId})`);\n   * console.log(`Storage providers: ${config.storageProviders.join(\", \")}`);\n   * ```\n   */\n  getConfig(): RuntimeConfig {\n    return {\n      chainId: this.chainId as VanaChainId,\n      chainName: this.chainName,\n      relayerConfig: this.relayerConfig,\n      storageProviders: this.storageManager?.getStorageProviders() ?? [],\n      defaultStorageProvider: this.storageManager?.getDefaultStorageProvider(),\n    };\n  }\n\n  /**\n   * Sets the platform adapter for environment-specific operations.\n   * This is useful for testing and advanced use cases where you need\n   * to override the default platform detection.\n   *\n   * @param adapter - The platform adapter to use\n   * @example\n   * ```typescript\n   * // For testing with a mock adapter\n   * const mockAdapter = new MockPlatformAdapter();\n   * vana.setPlatformAdapter(mockAdapter);\n   *\n   * // For advanced use cases with custom adapters\n   * const customAdapter = new CustomPlatformAdapter();\n   * vana.setPlatformAdapter(customAdapter);\n   * ```\n   */\n  setPlatformAdapter(adapter: VanaPlatformAdapter): void {\n    this.platform = adapter;\n\n    // Note: Controllers will use the new platform adapter on their next operation\n    // since they access this.platform from the shared context\n  }\n\n  /**\n   * Gets the current platform adapter.\n   * This is useful for advanced use cases where you need to access\n   * the platform adapter directly.\n   *\n   * @returns The current platform adapter\n   * @example\n   * ```typescript\n   * const adapter = vana.getPlatformAdapter();\n   * const encrypted = await adapter.encrypt(data, key);\n   * ```\n   */\n  getPlatformAdapter(): VanaPlatformAdapter {\n    return this.platform;\n  }\n\n  /**\n   * Encrypts data using the Vana protocol standard encryption.\n   *\n   * @remarks\n   * This method implements the Vana network's standard encryption protocol using\n   * platform-appropriate cryptographic libraries. It automatically handles different\n   * input types (string or Blob) and produces encrypted output suitable for secure\n   * storage or transmission. The encryption is compatible with the network's\n   * decryption protocols and can be decrypted by authorized parties.\n   *\n   * @param data - The data to encrypt (string or Blob)\n   * @param key - The encryption key (typically generated via `generateEncryptionKey`)\n   * @returns The encrypted data as a Blob\n   * @throws {Error} When encryption fails due to invalid key or data format\n   * @example\n   * ```typescript\n   * import { generateEncryptionKey } from '@opendatalabs/vana-sdk/node';\n   *\n   * // Generate encryption key from wallet signature\n   * const encryptionKey = await generateEncryptionKey(vana.walletClient);\n   *\n   * // Encrypt string data\n   * const sensitiveData = \"User's private information\";\n   * const encrypted = await vana.encryptBlob(sensitiveData, encryptionKey);\n   *\n   * // Encrypt file data\n   * const fileBlob = new Blob([fileContent], { type: 'application/json' });\n   * const encryptedFile = await vana.encryptBlob(fileBlob, encryptionKey);\n   *\n   * // Store encrypted data safely\n   * await storageProvider.upload(encrypted, 'encrypted-data.bin');\n   * ```\n   */\n  public async encryptBlob(data: string | Blob, key: string): Promise<Blob> {\n    return encryptBlobWithSignedKey(data, key, this.platform);\n  }\n\n  /**\n   * Decrypts data that was encrypted using the Vana protocol.\n   *\n   * @remarks\n   * This method decrypts data that was previously encrypted using the Vana network's\n   * standard encryption protocol. It requires the same wallet signature that was used\n   * for encryption and automatically uses the appropriate platform adapter for\n   * cryptographic operations. The decrypted output maintains the original data format.\n   *\n   * @param encryptedData - The encrypted data (string or Blob)\n   * @param walletSignature - The wallet signature used as decryption key\n   * @returns The decrypted data as a Blob\n   * @throws {Error} When decryption fails due to invalid signature or corrupted data\n   * @example\n   * ```typescript\n   * import { generateEncryptionKey } from '@opendatalabs/vana-sdk/node';\n   *\n   * // Retrieve encrypted data from storage\n   * const encryptedBlob = await storageProvider.download('encrypted-data.bin');\n   *\n   * // Generate the same key used for encryption\n   * const decryptionKey = await generateEncryptionKey(vana.walletClient);\n   *\n   * // Decrypt the data\n   * const decrypted = await vana.decryptBlob(encryptedBlob, decryptionKey);\n   *\n   * // Convert back to original format\n   * const originalText = await decrypted.text();\n   * const originalJson = JSON.parse(originalText);\n   *\n   * console.log('Decrypted data:', originalJson);\n   * ```\n   *\n   * @example\n   * ```typescript\n   * // Decrypt file downloaded from Vana network\n   * const userFiles = await vana.data.getUserFiles();\n   * const file = userFiles[0];\n   *\n   * // Download encrypted content\n   * const encrypted = await fetch(file.url).then(r => r.blob());\n   *\n   * // Decrypt with user's key\n   * const decryptionKey = await generateEncryptionKey(vana.walletClient);\n   * const decrypted = await vana.decryptBlob(encrypted, decryptionKey);\n   *\n   * // Process original data\n   * const fileContent = await decrypted.arrayBuffer();\n   * ```\n   */\n  public async decryptBlob(\n    encryptedData: string | Blob,\n    walletSignature: string,\n  ): Promise<Blob> {\n    return decryptBlobWithSignedKey(\n      encryptedData,\n      walletSignature,\n      this.platform,\n    );\n  }\n\n  /**\n   * Waits for an operation to complete and returns the final result.\n   *\n   * @remarks\n   * This method polls the operation status at regular intervals until it\n   * reaches a terminal state (succeeded, failed, or canceled). Supports\n   * ergonomic overloads to accept either an Operation object or just the ID.\n   *\n   * @param opOrId - Either an Operation object or operation ID string\n   * @param options - Optional polling configuration\n   * @returns The completed operation with result or error\n   * @throws {PersonalServerError} When the operation fails or times out\n   * @example\n   * ```typescript\n   * // Using operation object\n   * const operation = await vana.server.createOperation({ permissionId: 123 });\n   * const completed = await vana.waitForOperation(operation);\n   *\n   * // Using just the ID\n   * const completed = await vana.waitForOperation(\"op_abc123\");\n   *\n   * // With custom timeout\n   * const completed = await vana.waitForOperation(operation, {\n   *   timeout: 60000,\n   *   pollingInterval: 1000\n   * });\n   * ```\n   */\n  public async waitForOperation(\n    opOrId: Operation | string,\n    options?: PollingOptions,\n  ): Promise<Operation> {\n    return this.server.waitForOperation(opOrId, options);\n  }\n\n  /**\n   * Waits for a transaction to be confirmed and returns the receipt.\n   *\n   * @remarks\n   * This method polls for transaction confirmation on the blockchain.\n   * Supports ergonomic overloads to accept either a transaction result\n   * object or just the hash string.\n   *\n   * @param hashOrObj - Either a TransactionResult object or hash string\n   * @param options - Optional wait configuration\n   * @returns The transaction receipt with logs and status\n   * @example\n   * ```typescript\n   * // Using transaction result object\n   * const tx = await vana.permissions.grant(params);\n   * const receipt = await vana.waitForTransactionReceipt(tx);\n   *\n   * // Using just the hash\n   * const receipt = await vana.waitForTransactionReceipt(\"0x123...\");\n   *\n   * // With custom confirmations\n   * const receipt = await vana.waitForTransactionReceipt(tx, {\n   *   confirmations: 3,\n   *   timeout: 60000\n   * });\n   * ```\n   */\n  public async waitForTransactionReceipt(\n    hashOrObj: TransactionResult | { hash: Hash } | Hash,\n    options?: TransactionWaitOptions,\n  ): Promise<TransactionReceipt> {\n    const hash = typeof hashOrObj === \"string\" ? hashOrObj : hashOrObj.hash;\n\n    return this.publicClient.waitForTransactionReceipt({\n      hash,\n      confirmations: options?.confirmations,\n      pollingInterval: options?.pollingInterval,\n      timeout: options?.timeout,\n    });\n  }\n\n  /**\n   * Waits for transaction confirmation and extracts blockchain event data.\n   *\n   * @remarks\n   * This method leverages the context-carrying POJO architecture. When passed a\n   * `TransactionResult` with an `operation` field, it automatically parses the\n   * correct events from the transaction logs. For legacy compatibility, it accepts\n   * raw hashes but will not parse events without operation context.\n   *\n   * @param transaction - Transaction result with operation context\n   * @param options - Optional confirmation and timeout settings\n   * @returns Parsed event data specific to the transaction's operation type\n   * @throws {NetworkError} When transaction confirmation times out\n   * @throws {BlockchainError} When expected events are not found in the transaction\n   *\n   * @example\n   * ```typescript\n   * // Recommended: Pass the transaction result for automatic event parsing\n   * const tx = await vana.permissions.submitAddServerFilesAndPermissions(params);\n   * const events = await vana.waitForTransactionEvents<{ permissionId: bigint }>(tx);\n   * console.log(`Permission ID: ${events.permissionId}`);\n   *\n   * // Legacy: Raw hash without event parsing (returns receipt)\n   * const receipt = await vana.waitForTransactionEvents(\"0x123...\");\n   * ```\n   *\n   * @see For understanding transaction flows, visit https://docs.vana.org/docs/transactions\n   */\n  public async waitForTransactionEvents<C extends Contract, F extends Fn<C>>(\n    transaction: TransactionResult<C, F>,\n    options?: TransactionWaitOptions,\n  ): Promise<TypedTransactionResult<C, F>> {\n    // Import the POJO-based parser\n    const { parseTransaction } = await import(\"./utils/parseTransactionPojo\");\n\n    // Wait for the transaction to be mined\n    const receipt = await this.waitForTransactionReceipt(\n      transaction.hash,\n      options,\n    );\n\n    // Parse events using our heuristic-free POJO system\n    const result = parseTransaction(transaction, receipt);\n\n    // Return the strongly-typed result\n    // TypeScript knows exactly what events are possible!\n    return result;\n  }\n\n  /**\n   * Enhances a unified relayer response with client-side behavior.\n   *\n   * @remarks\n   * This method wraps a relayer response in an enhanced object that provides\n   * a fluent `.wait()` method for handling asynchronous operations. The enhanced\n   * response intelligently handles both submitted transactions (via hash) and\n   * pending operations (via operationId).\n   *\n   * @param response - The unified relayer response to enhance\n   * @returns EnhancedTransactionResponse if the response can be enhanced, null otherwise\n   *\n   * @example\n   * ```typescript\n   * // Enhance a relayer response for fluent waiting\n   * const response = await handleRelayerOperation(vana, request);\n   * const enhanced = vana.enhanceRelayerResponse(response);\n   * if (enhanced) {\n   *   const result = await enhanced.wait();\n   *   if (result.expectedEvents?.FileAdded) {\n   *     console.log('File ID:', result.expectedEvents.FileAdded.fileId);\n   *   }\n   * }\n   * ```\n   *\n   * @example\n   * ```typescript\n   * // With status updates for pending operations\n   * const enhanced = vana.enhanceRelayerResponse(response);\n   * if (enhanced) {\n   *   const result = await enhanced.wait({\n   *     onStatusUpdate: (status) => {\n   *       console.log('Operation status:', status.type);\n   *     },\n   *     timeout: 60000 // 1 minute timeout\n   *   });\n   * }\n   * ```\n   *\n   * @category Relayer\n   * @since 0.2.0\n   */\n  public async enhanceRelayerResponse(\n    response: UnifiedRelayerResponse,\n  ): Promise<any> {\n    const { enhanceResponse } = await import(\"./client/enhancedResponse\");\n    return enhanceResponse(response, this);\n  }\n}\n"],"mappings":"AAOA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP,SAAS,iCAAiC;AAE1C,SAAS,6BAA6B;AACtC,SAAS,oCAAoC;AAC7C,SAAS,kCAAkC;AAC3C,SAAS,sBAAsB;AAC/B,SAAS,yBAAyB;AAClC,SAAS,wBAAwB;AACjC,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AACnC,SAAS,4BAA4B;AACrC,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB,oBAAoB,YAAY;AAS7D,SAAS,sBAAsB;AAiB/B,SAAS,cAAc;AACvB,SAAS,gBAAgB,mBAAmB;AAE5C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAKA,MAAM,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmB3B,OAAO,kBACL,UACA,QACkC;AAClC,UAAM,OAAO,IAAI,SAAS,UAAU,MAAM;AAC1C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,OAAO,OAAO,UAA+B,QAA8B;AACzE,WAAO,IAAI,SAAS,UAAU,MAAM;AAAA,EACtC;AACF;AAgDO,MAAM,SAAS;AAAA;AAAA,EAEJ;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGN;AAAA,EAEO;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACD;AAAA,EACC;AAAA,EACA;AAAA;AAAA,EACE;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBnB,YAAY,UAA+B,QAAoB;AAE7D,SAAK,WAAW;AAGhB,SAAK,eAAe,MAAM;AAG1B,SAAK,iBAAiB,QAAQ;AAG9B,SAAK,gBAAgB,OAAO;AAC5B,QAAI,OAAO,SAAS;AAElB,UACE,OAAO,OAAO,YAAY,YAC1B,OAAO,OAAO,YAAY,YAC1B;AACA,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAEA,UAAI,OAAO,OAAO,YAAY,UAAU;AAEtC,cAAM,MAAM,OAAO;AACnB,aAAK,kBAAkB,OAAO,YAAmC;AAC/D,gBAAM,WAAW,MAAM,MAAM,KAAK;AAAA,YAChC,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,YAC9C,MAAM,KAAK,UAAU,OAAO;AAAA,UAC9B,CAAC;AACD,cAAI,CAAC,SAAS,IAAI;AAChB,kBAAM,IAAI,MAAM,2BAA2B,SAAS,UAAU,EAAE;AAAA,UAClE;AACA,iBAAO,SAAS,KAAK;AAAA,QACvB;AAAA,MACF,OAAO;AAEL,aAAK,kBAAkB,OAAO;AAAA,MAChC;AAAA,IACF;AAGA,SAAK,kBAAkB,OAAO;AAG9B,SAAK,eAAe,OAAO;AAG3B,SAAK,qBAAqB,iBAAiB,MAAM;AAGjD,QAAI,OAAO,SAAS,WAAW;AAC7B,WAAK,iBAAiB,IAAI,eAAe;AAGzC,iBAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,OAAO,QAAQ,SAAS,GAAG;AACvE,cAAM,YAAY,SAAS,OAAO,QAAQ;AAC1C,aAAK,eAAe,SAAS,MAAM,UAAU,SAAS;AAAA,MACxD;AAGA,UACE,CAAC,OAAO,QAAQ,mBAChB,OAAO,KAAK,OAAO,QAAQ,SAAS,EAAE,SAAS,GAC/C;AACA,cAAM,oBAAoB,OAAO,KAAK,OAAO,QAAQ,SAAS,EAAE,CAAC;AACjE,aAAK,eAAe,mBAAmB,iBAAiB;AAAA,MAC1D;AAAA,IACF;AAGA,QAAI;AACJ,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI,eAAe,MAAM,GAAG;AAE1B,qBAAe,OAAO;AACtB,mBAAc,aAAa,SAAmB;AAG9C,0BAAoB;AAGpB,UAAI,kBAAkB,UAAU,OAAO,cAAc;AACnD,uBAAe,OAAO;AAAA,MACxB,OAAO;AACL,uBAAe,mBAAmB;AAAA,UAChC,OAAO;AAAA,UACP,WAAW,KAAK;AAAA,QAClB,CAAC;AAAA,MACH;AAAA,IACF,WAAW,iBAAiB,MAAM,GAAG;AAEnC,qBAAe;AACf,qBAAe,OAAO;AACtB,0BAAoB,OAAO;AAC3B,mBAAa,OAAO,aAAa,SAAS;AAAA,IAC5C,WAAW,oBAAoB,MAAM,GAAG;AAEtC,qBAAe;AACf,0BAAoB,OAAO;AAC3B,mBAAa,OAAO,SAAS;AAE7B,qBAAe,mBAAmB;AAAA,QAChC,OAAO;AAAA,QACP,WAAW,KAAK;AAAA,MAClB,CAAC;AAAA,IACH,WAAW,cAAc,MAAM,GAAG;AAEhC,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAEA,YAAM,QAAQ,OAAO,OAAO,OAAO;AACnC,UAAI,CAAC,OAAO;AACV,cAAM,IAAI;AAAA,UACR,yBAAyB,OAAO,OAAO;AAAA,QACzC;AAAA,MACF;AAEA,mBAAa;AACb,qBAAe,mBAAmB;AAAA,QAChC;AAAA,QACA,WAAW,KAAK,OAAO,UAAU,MAAM,QAAQ,QAAQ,KAAK,CAAC,CAAC;AAAA,QAC9D,SAAS,OAAO;AAAA,MAClB,CAAC;AAED,0BAAoB;AACpB,qBAAe,mBAAmB;AAAA,QAChC;AAAA,QACA,WAAW,KAAK;AAAA,MAClB,CAAC;AAAA,IACH,OAAO;AACL,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAGA,SAAK,eAAe;AACpB,SAAK,eAAe;AACpB,SAAK,qBAAqB;AAG1B,UAAM,cAAc,eAAe,WAAW,EAAE;AAChD,UAAM,cAAc,OAAO,eAAe,aAAa;AACvD,UAAM,oBACJ,OAAO,4BAA4B,aAAa;AAGlD,UAAM,OAAO;AACb,UAAM,gBAAmC;AAAA,MACvC;AAAA,MACA;AAAA,MACA,IAAI,cAAc;AAEhB,eAAO,KAAK;AAAA,MACd;AAAA,MACA,mBAAmB;AAAA;AAAA,MACnB,SAAS,KAAK;AAAA,MACd,iBAAiB,KAAK;AAAA,MACtB,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA,UAAU,KAAK;AAAA;AAAA,MACf,yBAAyB,KAAK,wBAAwB,KAAK,IAAI;AAAA,MAC/D,YAAY,KAAK,WAAW,KAAK,IAAI;AAAA,MACrC,cAAc,KAAK;AAAA,MACnB,0BAA0B;AAAA,MAC1B,0BAA0B,KAAK,yBAAyB,KAAK,IAAI;AAAA,MACjE,kBAAkB,KAAK,iBAAiB,KAAK,IAAI;AAAA,MACjD,gBAAgB,KAAK;AAAA,IACvB;AAGA,SAAK,cAAc,IAAI,sBAAsB,aAAa;AAC1D,SAAK,qBAAqB,IAAI,6BAA6B,aAAa;AACxE,SAAK,mBAAmB,IAAI,2BAA2B,aAAa;AACpE,SAAK,OAAO,IAAI,eAAe,aAAa;AAC5C,SAAK,UAAU,IAAI,kBAAkB,aAAa;AAClD,SAAK,UAAU,IAAI,iBAAiB,aAAa;AACjD,SAAK,aAAa,IAAI,qBAAqB,aAAa;AACxD,SAAK,SAAS,IAAI,iBAAiB,aAAa;AAChD,SAAK,WAAW,IAAI,mBAAmB,aAAa;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeO,0BAAgC;AACrC,QAAI,CAAC,KAAK,oBAAoB;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MAMF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeO,aAAsB;AAC3B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeO,mBAA6D;AAClE,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,eAAe,QAA0B;AAC/C,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,0BAA0B,kCAAkC;AAAA,IACxE;AAGA,QAAI,OAAO,SAAS,WAAW;AAC7B,UAAI,OAAO,OAAO,QAAQ,cAAc,UAAU;AAChD,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAGA,iBAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,OAAO,QAAQ,SAAS,GAAG;AACvE,YAAI,CAAC,YAAY,OAAO,aAAa,UAAU;AAC7C,gBAAM,IAAI;AAAA,YACR,qBAAqB,IAAI;AAAA,UAC3B;AAAA,QACF;AAAA,MACF;AAGA,UAAI,OAAO,QAAQ,iBAAiB;AAClC,YAAI,EAAE,OAAO,QAAQ,mBAAmB,OAAO,QAAQ,YAAY;AACjE,gBAAM,IAAI;AAAA,YACR,6BAA6B,OAAO,QAAQ,eAAe;AAAA,UAC7D;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,eAAe,MAAM,GAAG;AAE1B,UAAI,CAAC,OAAO,cAAc;AACxB,cAAM,IAAI,0BAA0B,0BAA0B;AAAA,MAChE;AAGA,UACE,OAAO,OAAO,iBAAiB,YAC/B,CAAC,OAAO,aAAa,eACrB;AACA,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAGA,UAAI,CAAC,OAAO,aAAa,OAAO;AAC9B,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAGA,UAAI,CAAC,cAAc,OAAO,aAAa,MAAM,EAAE,GAAG;AAChD,cAAM,IAAI;AAAA,UACR,yBAAyB,OAAO,OAAO,aAAa,MAAM,EAAE,CAAC;AAAA,QAC/D;AAAA,MACF;AAAA,IACF,WAAW,cAAc,MAAM,GAAG;AAEhC,UAAI,CAAC,cAAc,OAAO,OAAO,GAAG;AAClC,cAAM,IAAI;AAAA,UACR,yBAAyB,OAAO,OAAO,OAAO,CAAC;AAAA,QACjD;AAAA,MACF;AAGA,UAAI,OAAO,QAAQ;AACjB,YAAI,OAAO,OAAO,WAAW,UAAU;AACrC,gBAAM,IAAI,0BAA0B,yBAAyB;AAAA,QAC/D;AAEA,YAAI,OAAO,OAAO,KAAK,MAAM,IAAI;AAC/B,gBAAM,IAAI,0BAA0B,wBAAwB;AAAA,QAC9D;AAGA,YAAI;AACF,cAAI,IAAI,OAAO,MAAM;AAAA,QACvB,QAAQ;AACN,gBAAM,IAAI,0BAA0B,4BAA4B;AAAA,QAClE;AAAA,MACF;AAGA,UAAI,OAAO,SAAS;AAClB,YAAI,OAAO,OAAO,YAAY,YAAY,CAAC,OAAO,QAAQ,SAAS;AACjE,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,WAAW,iBAAiB,MAAM,GAAG;AAEnC,UAAI,CAAC,OAAO,cAAc;AACxB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,WAAW,oBAAoB,MAAM,GAAG;AAEtC,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IAEF,OAAO;AACL,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,IAAI,UAAkB;AACpB,WAAO,KAAK,SAAS,WAAW;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,IAAI,YAAoB;AACtB,WAAO,KAAK,SAAS,aAAa;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,IAAI,cAAuB;AAEzB,QAAI,KAAK,cAAc,SAAS;AAC9B,aAAO,eAAe,KAAK,aAAa,OAAO;AAAA,IACjD;AAGA,QAAI,KAAK,oBAAoB;AAC3B,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,IAAI,MAAM,2BAA2B;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,YAA2B;AACzB,WAAO;AAAA,MACL,SAAS,KAAK;AAAA,MACd,WAAW,KAAK;AAAA,MAChB,eAAe,KAAK;AAAA,MACpB,kBAAkB,KAAK,gBAAgB,oBAAoB,KAAK,CAAC;AAAA,MACjE,wBAAwB,KAAK,gBAAgB,0BAA0B;AAAA,IACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,mBAAmB,SAAoC;AACrD,SAAK,WAAW;AAAA,EAIlB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,qBAA0C;AACxC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmCA,MAAa,YAAY,MAAqB,KAA4B;AACxE,WAAO,yBAAyB,MAAM,KAAK,KAAK,QAAQ;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoDA,MAAa,YACX,eACA,iBACe;AACf,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,MAAa,iBACX,QACA,SACoB;AACpB,WAAO,KAAK,OAAO,iBAAiB,QAAQ,OAAO;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6BA,MAAa,0BACX,WACA,SAC6B;AAC7B,UAAM,OAAO,OAAO,cAAc,WAAW,YAAY,UAAU;AAEnE,WAAO,KAAK,aAAa,0BAA0B;AAAA,MACjD;AAAA,MACA,eAAe,SAAS;AAAA,MACxB,iBAAiB,SAAS;AAAA,MAC1B,SAAS,SAAS;AAAA,IACpB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,MAAa,yBACX,aACA,SACuC;AAEvC,UAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,8BAA8B;AAGxE,UAAM,UAAU,MAAM,KAAK;AAAA,MACzB,YAAY;AAAA,MACZ;AAAA,IACF;AAGA,UAAM,SAAS,iBAAiB,aAAa,OAAO;AAIpD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4CA,MAAa,uBACX,UACc;AACd,UAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,2BAA2B;AACpE,WAAO,gBAAgB,UAAU,IAAI;AAAA,EACvC;AACF;","names":[]}

package/dist/crypto/ecies/__tests__/constants.test.d.ts

@@ -1,4 +1,4 @@
 /**
- * Tests for ECIES constants and validation helpers
+ * Tests for ECIES constants
  */
 export {};

package/dist/crypto/ecies/__tests__/interface.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/crypto/ecies/__tests__/serialization.test.d.ts

@@ -0,0 +1,8 @@
+/**
+ * ECIES Serialization Test Suite
+ *
+ * Tests for serializeECIES and deserializeECIES functions to ensure
+ * proper validation and error handling, especially for security-critical
+ * prefix validation and truncated data handling.
+ */
+export {};

package/dist/crypto/ecies/__tests__/utils.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/crypto/ecies/base.cjs

@@ -36,7 +36,7 @@ class BaseECIESUint8 {
    * @throws {ECIESError} If key format is invalid.
    */
   normalizePublicKey(publicKey) {
-    if (BaseECIESUint8.validatedKeys.has(publicKey)) {
+    if (BaseECIESUint8.validatedKeys.get(publicKey)) {
       return publicKey;
     }
     if (publicKey.length === import_constants.CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH) {
@@ -53,12 +53,21 @@ class BaseECIESUint8 {
       return publicKey;
     }
     if (publicKey.length === import_constants.CURVE.COMPRESSED_PUBLIC_KEY_LENGTH) {
-      const decompressed = this.decompressPublicKey(publicKey);
-      if (!decompressed) {
-        throw new import_interface.ECIESError("Failed to decompress public key", "INVALID_KEY");
+      if (publicKey[0] === import_constants.CURVE.PREFIX.COMPRESSED_EVEN || publicKey[0] === import_constants.CURVE.PREFIX.COMPRESSED_ODD) {
+        const decompressed = this.decompressPublicKey(publicKey);
+        if (!decompressed) {
+          throw new import_interface.ECIESError(
+            "Failed to decompress public key",
+            "INVALID_KEY"
+          );
+        }
+        BaseECIESUint8.validatedKeys.set(decompressed, true);
+        return decompressed;
       }
-      BaseECIESUint8.validatedKeys.set(decompressed, true);
-      return decompressed;
+      throw new import_interface.ECIESError(
+        `Invalid compressed public key prefix: expected 0x02 or 0x03, got 0x${publicKey[0].toString(16).padStart(2, "0")}`,
+        "INVALID_KEY"
+      );
     }
     throw new import_interface.ECIESError(
       `Invalid public key length: ${publicKey.length}`,
@@ -73,6 +82,11 @@ class BaseECIESUint8 {
    * @returns Promise resolving to encrypted data structure
    */
   async encrypt(publicKey, message) {
+    let ephemeralPrivateKey;
+    let sharedSecret;
+    let kdf;
+    let encryptionKey;
+    let macKey;
     try {
       if (!(publicKey instanceof Uint8Array)) {
         throw new import_interface.ECIESError("Public key must be a Uint8Array", "INVALID_KEY");
@@ -87,7 +101,6 @@ class BaseECIESUint8 {
         throw new import_interface.ECIESError("Public key cannot be empty", "INVALID_KEY");
       }
       const pubKey = this.normalizePublicKey(publicKey);
-      let ephemeralPrivateKey;
       do {
         ephemeralPrivateKey = this.generateRandomBytes(
           import_constants.CURVE.PRIVATE_KEY_LENGTH
@@ -103,13 +116,13 @@ class BaseECIESUint8 {
           "ENCRYPTION_FAILED"
         );
       }
-      const sharedSecret = this.performECDH(pubKey, ephemeralPrivateKey);
-      const kdf = this.sha512(sharedSecret);
-      const encryptionKey = kdf.slice(
+      sharedSecret = this.performECDH(pubKey, ephemeralPrivateKey);
+      kdf = this.sha512(sharedSecret);
+      encryptionKey = kdf.slice(
         import_constants.KDF.ENCRYPTION_KEY_OFFSET,
         import_constants.KDF.ENCRYPTION_KEY_OFFSET + import_constants.KDF.ENCRYPTION_KEY_LENGTH
       );
-      const macKey = kdf.slice(
+      macKey = kdf.slice(
         import_constants.KDF.MAC_KEY_OFFSET,
         import_constants.KDF.MAC_KEY_OFFSET + import_constants.KDF.MAC_KEY_LENGTH
       );
@@ -117,9 +130,6 @@ class BaseECIESUint8 {
       const ciphertext = await this.aesEncrypt(encryptionKey, iv, message);
       const macData = (0, import_viem.concat)([iv, ephemeralPublicKey, ciphertext]);
       const mac = this.hmacSha256(macKey, macData);
-      this.clearBuffer(ephemeralPrivateKey);
-      this.clearBuffer(sharedSecret);
-      this.clearBuffer(kdf);
       return {
         iv,
         ephemPublicKey: ephemeralPublicKey,
@@ -133,6 +143,12 @@ class BaseECIESUint8 {
         "ENCRYPTION_FAILED",
         error instanceof Error ? error : void 0
       );
+    } finally {
+      if (ephemeralPrivateKey) this.clearBuffer(ephemeralPrivateKey);
+      if (sharedSecret) this.clearBuffer(sharedSecret);
+      if (kdf) this.clearBuffer(kdf);
+      if (encryptionKey) this.clearBuffer(encryptionKey);
+      if (macKey) this.clearBuffer(macKey);
     }
   }
   /**
@@ -143,6 +159,10 @@ class BaseECIESUint8 {
    * @returns Promise resolving to the original plaintext
    */
   async decrypt(privateKey, encrypted) {
+    let sharedSecret;
+    let kdf;
+    let encryptionKey;
+    let macKey;
     try {
       if (!(privateKey instanceof Uint8Array)) {
         throw new import_interface.ECIESError("Private key must be a Uint8Array", "INVALID_KEY");
@@ -162,16 +182,29 @@ class BaseECIESUint8 {
       if (!this.verifyPrivateKey(privateKey)) {
         throw new import_interface.ECIESError("Invalid private key", "INVALID_KEY");
       }
-      const ephemeralPublicKey = this.normalizePublicKey(
-        encrypted.ephemPublicKey
-      );
-      const sharedSecret = this.performECDH(ephemeralPublicKey, privateKey);
-      const kdf = this.sha512(sharedSecret);
-      const encryptionKey = kdf.slice(
+      if (encrypted.ephemPublicKey.length !== import_constants.CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH) {
+        throw new import_interface.ECIESError(
+          `Invalid ephemeral public key: expected ${import_constants.CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH} bytes (uncompressed), got ${encrypted.ephemPublicKey.length} bytes`,
+          "INVALID_KEY"
+        );
+      }
+      if (encrypted.ephemPublicKey[0] !== import_constants.CURVE.PREFIX.UNCOMPRESSED) {
+        throw new import_interface.ECIESError(
+          "Invalid ephemeral public key: must be uncompressed format with 0x04 prefix (eccrypto standard)",
+          "INVALID_KEY"
+        );
+      }
+      if (!this.validatePublicKey(encrypted.ephemPublicKey)) {
+        throw new import_interface.ECIESError("Invalid ephemeral public key", "INVALID_KEY");
+      }
+      const ephemeralPublicKey = encrypted.ephemPublicKey;
+      sharedSecret = this.performECDH(ephemeralPublicKey, privateKey);
+      kdf = this.sha512(sharedSecret);
+      encryptionKey = kdf.slice(
         import_constants.KDF.ENCRYPTION_KEY_OFFSET,
         import_constants.KDF.ENCRYPTION_KEY_OFFSET + import_constants.KDF.ENCRYPTION_KEY_LENGTH
       );
-      const macKey = kdf.slice(
+      macKey = kdf.slice(
         import_constants.KDF.MAC_KEY_OFFSET,
         import_constants.KDF.MAC_KEY_OFFSET + import_constants.KDF.MAC_KEY_LENGTH
       );
@@ -189,8 +222,6 @@ class BaseECIESUint8 {
         encrypted.iv,
         encrypted.ciphertext
       );
-      this.clearBuffer(sharedSecret);
-      this.clearBuffer(kdf);
       return decrypted;
     } catch (error) {
       if (error instanceof import_interface.ECIESError) throw error;
@@ -199,6 +230,11 @@ class BaseECIESUint8 {
         "DECRYPTION_FAILED",
         error instanceof Error ? error : void 0
       );
+    } finally {
+      if (sharedSecret) this.clearBuffer(sharedSecret);
+      if (kdf) this.clearBuffer(kdf);
+      if (encryptionKey) this.clearBuffer(encryptionKey);
+      if (macKey) this.clearBuffer(macKey);
     }
   }
   /**

package/dist/crypto/ecies/base.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/crypto/ecies/base.ts"],"sourcesContent":["import type { ECIESProvider, ECIESEncrypted } from \"./interface\";\nimport { ECIESError, isECIESEncrypted } from \"./interface\";\nimport { CURVE, CIPHER, KDF } from \"./constants\";\nimport { constantTimeEqual } from \"./utils\";\nimport { concat } from \"viem\";\n\n/**\n * Provides shared ECIES encryption logic across platforms using Uint8Array.\n *\n * @remarks\n * Platform implementations extend this class and provide crypto primitives.\n * The base class handles the ECIES protocol flow while maintaining\n * compatibility with the eccrypto data format.\n *\n * **Implementation details:**\n * - KDF: SHA-512(shared_secret) → encKey (32B) || macKey (32B)\n * - Cipher: AES-256-CBC with random 16-byte IV\n * - MAC: HMAC-SHA256(macKey, iv || ephemPublicKey || ciphertext)\n *\n * @category Cryptography\n */\nexport abstract class BaseECIESUint8 implements ECIESProvider {\n  // Cache for validated public keys to avoid repeated validation\n  private static readonly validatedKeys = new WeakMap<Uint8Array, boolean>();\n\n  /**\n   * Generates cryptographically secure random bytes.\n   *\n   * @param length - Number of random bytes to generate.\n   * @returns Random bytes array.\n   */\n  protected abstract generateRandomBytes(length: number): Uint8Array;\n\n  /**\n   * Verifies a private key is valid for secp256k1.\n   *\n   * @param privateKey - Private key to verify (32 bytes).\n   * @returns `true` if valid private key.\n   */\n  protected abstract verifyPrivateKey(privateKey: Uint8Array): boolean;\n\n  /**\n   * Creates a public key from a private key.\n   *\n   * @param privateKey - Source private key (32 bytes).\n   * @param compressed - Generate compressed (33B) or uncompressed (65B) format.\n   * @returns Public key or `null` if creation failed.\n   */\n  protected abstract createPublicKey(\n    privateKey: Uint8Array,\n    compressed: boolean,\n  ): Uint8Array | null;\n\n  /**\n   * Validates a public key on the secp256k1 curve.\n   *\n   * @param publicKey - Public key to validate.\n   * @returns `true` if valid public key.\n   */\n  protected abstract validatePublicKey(publicKey: Uint8Array): boolean;\n\n  /**\n   * Decompresses a compressed public key.\n   *\n   * @param publicKey - Compressed public key (33 bytes).\n   * @returns Uncompressed public key (65 bytes) or `null` if decompression failed.\n   */\n  protected abstract decompressPublicKey(\n    publicKey: Uint8Array,\n  ): Uint8Array | null;\n\n  /**\n   * Performs ECDH key agreement.\n   *\n   * @param publicKey - Other party's public key.\n   * @param privateKey - Your private key.\n   * @returns Raw X coordinate of shared point (32 bytes).\n   */\n  protected abstract performECDH(\n    publicKey: Uint8Array,\n    privateKey: Uint8Array,\n  ): Uint8Array;\n\n  /**\n   * Computes SHA-512 hash.\n   *\n   * @param data - Data to hash.\n   * @returns SHA-512 hash (64 bytes).\n   */\n  protected abstract sha512(data: Uint8Array): Uint8Array;\n\n  /**\n   * Computes HMAC-SHA256 authentication tag.\n   *\n   * @param key - HMAC key.\n   * @param data - Data to authenticate.\n   * @returns HMAC-SHA256 (32 bytes).\n   */\n  protected abstract hmacSha256(key: Uint8Array, data: Uint8Array): Uint8Array;\n\n  /**\n   * Encrypts data using AES-256-CBC.\n   *\n   * @param key - Encryption key (32 bytes).\n   * @param iv - Initialization vector (16 bytes).\n   * @param plaintext - Data to encrypt.\n   * @returns Ciphertext with PKCS#7 padding.\n   */\n  protected abstract aesEncrypt(\n    key: Uint8Array,\n    iv: Uint8Array,\n    plaintext: Uint8Array,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Decrypts data using AES-256-CBC.\n   *\n   * @param key - Decryption key (32 bytes).\n   * @param iv - Initialization vector (16 bytes).\n   * @param ciphertext - Data to decrypt.\n   * @returns Plaintext with padding removed.\n   */\n  protected abstract aesDecrypt(\n    key: Uint8Array,\n    iv: Uint8Array,\n    ciphertext: Uint8Array,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Normalizes a public key to uncompressed format.\n   *\n   * @param publicKey - Public key in any format.\n   * @returns Uncompressed public key (65 bytes).\n   * @throws {ECIESError} If key format is invalid.\n   */\n  protected normalizePublicKey(publicKey: Uint8Array): Uint8Array {\n    // Check cache first\n    if (BaseECIESUint8.validatedKeys.has(publicKey)) {\n      return publicKey;\n    }\n\n    if (publicKey.length === CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH) {\n      if (publicKey[0] !== CURVE.PREFIX.UNCOMPRESSED) {\n        throw new ECIESError(\n          \"Invalid uncompressed public key prefix\",\n          \"INVALID_KEY\",\n        );\n      }\n      // Validate and cache\n      if (!this.validatePublicKey(publicKey)) {\n        throw new ECIESError(\"Invalid public key\", \"INVALID_KEY\");\n      }\n      BaseECIESUint8.validatedKeys.set(publicKey, true);\n      return publicKey;\n    }\n\n    if (publicKey.length === CURVE.COMPRESSED_PUBLIC_KEY_LENGTH) {\n      const decompressed = this.decompressPublicKey(publicKey);\n      if (!decompressed) {\n        throw new ECIESError(\"Failed to decompress public key\", \"INVALID_KEY\");\n      }\n      // Cache the decompressed key\n      BaseECIESUint8.validatedKeys.set(decompressed, true);\n      return decompressed;\n    }\n\n    throw new ECIESError(\n      `Invalid public key length: ${publicKey.length}`,\n      \"INVALID_KEY\",\n    );\n  }\n\n  /**\n   * Normalizes a public key to uncompressed format (65 bytes with 0x04 prefix).\n   * Must be implemented by derived classes to handle platform-specific operations.\n   *\n   * @param publicKey - The public key to normalize\n   * @returns The normalized uncompressed public key\n   */\n  public abstract normalizeToUncompressed(publicKey: Uint8Array): Uint8Array;\n\n  /**\n   * Encrypts data using ECIES.\n   *\n   * @param publicKey - The recipient's public key (compressed or uncompressed)\n   * @param message - The data to encrypt\n   * @returns Promise resolving to encrypted data structure\n   */\n  async encrypt(\n    publicKey: Uint8Array,\n    message: Uint8Array,\n  ): Promise<ECIESEncrypted> {\n    try {\n      // Validate inputs\n      if (!(publicKey instanceof Uint8Array)) {\n        throw new ECIESError(\"Public key must be a Uint8Array\", \"INVALID_KEY\");\n      }\n      if (!(message instanceof Uint8Array)) {\n        throw new ECIESError(\n          \"Message must be a Uint8Array\",\n          \"ENCRYPTION_FAILED\",\n        );\n      }\n      if (publicKey.length === 0) {\n        throw new ECIESError(\"Public key cannot be empty\", \"INVALID_KEY\");\n      }\n\n      // Normalize public key to uncompressed format\n      const pubKey = this.normalizePublicKey(publicKey);\n\n      // Generate ephemeral key pair\n      let ephemeralPrivateKey: Uint8Array;\n      do {\n        ephemeralPrivateKey = this.generateRandomBytes(\n          CURVE.PRIVATE_KEY_LENGTH,\n        );\n      } while (!this.verifyPrivateKey(ephemeralPrivateKey));\n\n      const ephemeralPublicKey = this.createPublicKey(\n        ephemeralPrivateKey,\n        false,\n      );\n      if (!ephemeralPublicKey) {\n        throw new ECIESError(\n          \"Failed to generate ephemeral public key\",\n          \"ENCRYPTION_FAILED\",\n        );\n      }\n\n      // Perform ECDH to get shared secret (raw X coordinate)\n      const sharedSecret = this.performECDH(pubKey, ephemeralPrivateKey);\n\n      // Derive keys using SHA-512 (eccrypto-compatible KDF)\n      const kdf = this.sha512(sharedSecret);\n      const encryptionKey = kdf.slice(\n        KDF.ENCRYPTION_KEY_OFFSET,\n        KDF.ENCRYPTION_KEY_OFFSET + KDF.ENCRYPTION_KEY_LENGTH,\n      );\n      const macKey = kdf.slice(\n        KDF.MAC_KEY_OFFSET,\n        KDF.MAC_KEY_OFFSET + KDF.MAC_KEY_LENGTH,\n      );\n\n      // Generate random IV and encrypt\n      const iv = this.generateRandomBytes(CIPHER.IV_LENGTH);\n      const ciphertext = await this.aesEncrypt(encryptionKey, iv, message);\n\n      // Calculate MAC (Encrypt-then-MAC)\n      const macData = concat([iv, ephemeralPublicKey, ciphertext]);\n      const mac = this.hmacSha256(macKey, macData);\n\n      // Clear sensitive data\n      this.clearBuffer(ephemeralPrivateKey);\n      this.clearBuffer(sharedSecret);\n      this.clearBuffer(kdf);\n\n      return {\n        iv,\n        ephemPublicKey: ephemeralPublicKey,\n        ciphertext,\n        mac,\n      };\n    } catch (error) {\n      if (error instanceof ECIESError) throw error;\n      throw new ECIESError(\n        `Encryption failed: ${error instanceof Error ? error.message : \"Unknown error\"}`,\n        \"ENCRYPTION_FAILED\",\n        error instanceof Error ? error : undefined,\n      );\n    }\n  }\n\n  /**\n   * Decrypts ECIES encrypted data.\n   *\n   * @param privateKey - The recipient's private key (32 bytes)\n   * @param encrypted - The encrypted data structure from encrypt()\n   * @returns Promise resolving to the original plaintext\n   */\n  async decrypt(\n    privateKey: Uint8Array,\n    encrypted: ECIESEncrypted,\n  ): Promise<Uint8Array> {\n    try {\n      // Validate inputs\n      if (!(privateKey instanceof Uint8Array)) {\n        throw new ECIESError(\"Private key must be a Uint8Array\", \"INVALID_KEY\");\n      }\n      if (!isECIESEncrypted(encrypted)) {\n        throw new ECIESError(\n          \"Invalid encrypted data structure\",\n          \"DECRYPTION_FAILED\",\n        );\n      }\n      if (privateKey.length !== CURVE.PRIVATE_KEY_LENGTH) {\n        throw new ECIESError(\n          `Invalid private key length: ${privateKey.length}`,\n          \"INVALID_KEY\",\n        );\n      }\n      if (!this.verifyPrivateKey(privateKey)) {\n        throw new ECIESError(\"Invalid private key\", \"INVALID_KEY\");\n      }\n\n      // Normalize ephemeral public key to uncompressed format\n      const ephemeralPublicKey = this.normalizePublicKey(\n        encrypted.ephemPublicKey,\n      );\n\n      // Perform ECDH to recover shared secret\n      const sharedSecret = this.performECDH(ephemeralPublicKey, privateKey);\n\n      // Derive keys using SHA-512 (eccrypto-compatible KDF)\n      const kdf = this.sha512(sharedSecret);\n      const encryptionKey = kdf.slice(\n        KDF.ENCRYPTION_KEY_OFFSET,\n        KDF.ENCRYPTION_KEY_OFFSET + KDF.ENCRYPTION_KEY_LENGTH,\n      );\n      const macKey = kdf.slice(\n        KDF.MAC_KEY_OFFSET,\n        KDF.MAC_KEY_OFFSET + KDF.MAC_KEY_LENGTH,\n      );\n\n      // Verify MAC before decryption (Encrypt-then-MAC)\n      const macData = concat([\n        encrypted.iv,\n        encrypted.ephemPublicKey,\n        encrypted.ciphertext,\n      ]);\n      const expectedMac = this.hmacSha256(macKey, macData);\n\n      if (!constantTimeEqual(encrypted.mac, expectedMac)) {\n        throw new ECIESError(\"MAC verification failed\", \"MAC_MISMATCH\");\n      }\n\n      // Decrypt the ciphertext\n      const decrypted = await this.aesDecrypt(\n        encryptionKey,\n        encrypted.iv,\n        encrypted.ciphertext,\n      );\n\n      // Clear sensitive data\n      this.clearBuffer(sharedSecret);\n      this.clearBuffer(kdf);\n\n      return decrypted;\n    } catch (error) {\n      if (error instanceof ECIESError) throw error;\n      throw new ECIESError(\n        `Decryption failed: ${error instanceof Error ? error.message : \"Unknown error\"}`,\n        \"DECRYPTION_FAILED\",\n        error instanceof Error ? error : undefined,\n      );\n    }\n  }\n\n  /**\n   * Clears sensitive data from memory using multi-pass overwrite.\n   *\n   * @remarks\n   * Uses multiple passes with different patterns to make it harder\n   * for JIT compilers to optimize away the operation. While not\n   * guaranteed in JavaScript, this is a best-effort approach to\n   * clear sensitive data from memory.\n   *\n   * @param buffer - The buffer to clear\n   */\n  protected clearBuffer(buffer: Uint8Array): void {\n    if (buffer && buffer.length > 0) {\n      // Multi-pass overwrite to resist compiler optimization\n      buffer.fill(0x00); // Fill with zeros\n      buffer.fill(0xff); // Fill with ones\n      buffer.fill(0xaa); // Fill with alternating pattern\n      buffer.fill(0x00); // Final zero fill\n\n      // Additional pattern write to further discourage optimization\n      for (let i = 0; i < buffer.length; i++) {\n        buffer[i] = (i & 0xff) ^ 0x5a; // XOR with pattern\n      }\n      buffer.fill(0x00); // Final clear\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,uBAA6C;AAC7C,uBAAmC;AACnC,mBAAkC;AAClC,kBAAuB;AAiBhB,MAAe,eAAwC;AAAA;AAAA,EAE5D,OAAwB,gBAAgB,oBAAI,QAA6B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgH/D,mBAAmB,WAAmC;AAE9D,QAAI,eAAe,cAAc,IAAI,SAAS,GAAG;AAC/C,aAAO;AAAA,IACT;AAEA,QAAI,UAAU,WAAW,uBAAM,gCAAgC;AAC7D,UAAI,UAAU,CAAC,MAAM,uBAAM,OAAO,cAAc;AAC9C,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,UAAI,CAAC,KAAK,kBAAkB,SAAS,GAAG;AACtC,cAAM,IAAI,4BAAW,sBAAsB,aAAa;AAAA,MAC1D;AACA,qBAAe,cAAc,IAAI,WAAW,IAAI;AAChD,aAAO;AAAA,IACT;AAEA,QAAI,UAAU,WAAW,uBAAM,8BAA8B;AAC3D,YAAM,eAAe,KAAK,oBAAoB,SAAS;AACvD,UAAI,CAAC,cAAc;AACjB,cAAM,IAAI,4BAAW,mCAAmC,aAAa;AAAA,MACvE;AAEA,qBAAe,cAAc,IAAI,cAAc,IAAI;AACnD,aAAO;AAAA,IACT;AAEA,UAAM,IAAI;AAAA,MACR,8BAA8B,UAAU,MAAM;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAM,QACJ,WACA,SACyB;AACzB,QAAI;AAEF,UAAI,EAAE,qBAAqB,aAAa;AACtC,cAAM,IAAI,4BAAW,mCAAmC,aAAa;AAAA,MACvE;AACA,UAAI,EAAE,mBAAmB,aAAa;AACpC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,UAAU,WAAW,GAAG;AAC1B,cAAM,IAAI,4BAAW,8BAA8B,aAAa;AAAA,MAClE;AAGA,YAAM,SAAS,KAAK,mBAAmB,SAAS;AAGhD,UAAI;AACJ,SAAG;AACD,8BAAsB,KAAK;AAAA,UACzB,uBAAM;AAAA,QACR;AAAA,MACF,SAAS,CAAC,KAAK,iBAAiB,mBAAmB;AAEnD,YAAM,qBAAqB,KAAK;AAAA,QAC9B;AAAA,QACA;AAAA,MACF;AACA,UAAI,CAAC,oBAAoB;AACvB,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAGA,YAAM,eAAe,KAAK,YAAY,QAAQ,mBAAmB;AAGjE,YAAM,MAAM,KAAK,OAAO,YAAY;AACpC,YAAM,gBAAgB,IAAI;AAAA,QACxB,qBAAI;AAAA,QACJ,qBAAI,wBAAwB,qBAAI;AAAA,MAClC;AACA,YAAM,SAAS,IAAI;AAAA,QACjB,qBAAI;AAAA,QACJ,qBAAI,iBAAiB,qBAAI;AAAA,MAC3B;AAGA,YAAM,KAAK,KAAK,oBAAoB,wBAAO,SAAS;AACpD,YAAM,aAAa,MAAM,KAAK,WAAW,eAAe,IAAI,OAAO;AAGnE,YAAM,cAAU,oBAAO,CAAC,IAAI,oBAAoB,UAAU,CAAC;AAC3D,YAAM,MAAM,KAAK,WAAW,QAAQ,OAAO;AAG3C,WAAK,YAAY,mBAAmB;AACpC,WAAK,YAAY,YAAY;AAC7B,WAAK,YAAY,GAAG;AAEpB,aAAO;AAAA,QACL;AAAA,QACA,gBAAgB;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,4BAAY,OAAM;AACvC,YAAM,IAAI;AAAA,QACR,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,QAC9E;AAAA,QACA,iBAAiB,QAAQ,QAAQ;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,QACJ,YACA,WACqB;AACrB,QAAI;AAEF,UAAI,EAAE,sBAAsB,aAAa;AACvC,cAAM,IAAI,4BAAW,oCAAoC,aAAa;AAAA,MACxE;AACA,UAAI,KAAC,mCAAiB,SAAS,GAAG;AAChC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,WAAW,WAAW,uBAAM,oBAAoB;AAClD,cAAM,IAAI;AAAA,UACR,+BAA+B,WAAW,MAAM;AAAA,UAChD;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,KAAK,iBAAiB,UAAU,GAAG;AACtC,cAAM,IAAI,4BAAW,uBAAuB,aAAa;AAAA,MAC3D;AAGA,YAAM,qBAAqB,KAAK;AAAA,QAC9B,UAAU;AAAA,MACZ;AAGA,YAAM,eAAe,KAAK,YAAY,oBAAoB,UAAU;AAGpE,YAAM,MAAM,KAAK,OAAO,YAAY;AACpC,YAAM,gBAAgB,IAAI;AAAA,QACxB,qBAAI;AAAA,QACJ,qBAAI,wBAAwB,qBAAI;AAAA,MAClC;AACA,YAAM,SAAS,IAAI;AAAA,QACjB,qBAAI;AAAA,QACJ,qBAAI,iBAAiB,qBAAI;AAAA,MAC3B;AAGA,YAAM,cAAU,oBAAO;AAAA,QACrB,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,MACZ,CAAC;AACD,YAAM,cAAc,KAAK,WAAW,QAAQ,OAAO;AAEnD,UAAI,KAAC,gCAAkB,UAAU,KAAK,WAAW,GAAG;AAClD,cAAM,IAAI,4BAAW,2BAA2B,cAAc;AAAA,MAChE;AAGA,YAAM,YAAY,MAAM,KAAK;AAAA,QAC3B;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,MACZ;AAGA,WAAK,YAAY,YAAY;AAC7B,WAAK,YAAY,GAAG;AAEpB,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,iBAAiB,4BAAY,OAAM;AACvC,YAAM,IAAI;AAAA,QACR,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,QAC9E;AAAA,QACA,iBAAiB,QAAQ,QAAQ;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaU,YAAY,QAA0B;AAC9C,QAAI,UAAU,OAAO,SAAS,GAAG;AAE/B,aAAO,KAAK,CAAI;AAChB,aAAO,KAAK,GAAI;AAChB,aAAO,KAAK,GAAI;AAChB,aAAO,KAAK,CAAI;AAGhB,eAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,eAAO,CAAC,IAAK,IAAI,MAAQ;AAAA,MAC3B;AACA,aAAO,KAAK,CAAI;AAAA,IAClB;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/crypto/ecies/base.ts"],"sourcesContent":["import type { ECIESProvider, ECIESEncrypted } from \"./interface\";\nimport { ECIESError, isECIESEncrypted } from \"./interface\";\nimport { CURVE, CIPHER, KDF } from \"./constants\";\nimport { constantTimeEqual } from \"./utils\";\nimport { concat } from \"viem\";\n\n/**\n * Provides shared ECIES encryption logic across platforms using Uint8Array.\n *\n * @remarks\n * Platform implementations extend this class and provide crypto primitives.\n * The base class handles the ECIES protocol flow while maintaining\n * compatibility with the eccrypto data format.\n *\n * **Implementation details:**\n * - KDF: SHA-512(shared_secret) → encKey (32B) || macKey (32B)\n * - Cipher: AES-256-CBC with random 16-byte IV\n * - MAC: HMAC-SHA256(macKey, iv || ephemPublicKey || ciphertext)\n *\n * @category Cryptography\n */\nexport abstract class BaseECIESUint8 implements ECIESProvider {\n  // Cache for validated public keys to avoid repeated validation\n  private static readonly validatedKeys = new WeakMap<Uint8Array, boolean>();\n\n  /**\n   * Generates cryptographically secure random bytes.\n   *\n   * @param length - Number of random bytes to generate.\n   * @returns Random bytes array.\n   */\n  protected abstract generateRandomBytes(length: number): Uint8Array;\n\n  /**\n   * Verifies a private key is valid for secp256k1.\n   *\n   * @param privateKey - Private key to verify (32 bytes).\n   * @returns `true` if valid private key.\n   */\n  protected abstract verifyPrivateKey(privateKey: Uint8Array): boolean;\n\n  /**\n   * Creates a public key from a private key.\n   *\n   * @param privateKey - Source private key (32 bytes).\n   * @param compressed - Generate compressed (33B) or uncompressed (65B) format.\n   * @returns Public key or `null` if creation failed.\n   */\n  protected abstract createPublicKey(\n    privateKey: Uint8Array,\n    compressed: boolean,\n  ): Uint8Array | null;\n\n  /**\n   * Validates a public key on the secp256k1 curve.\n   *\n   * @param publicKey - Public key to validate.\n   * @returns `true` if valid public key.\n   */\n  protected abstract validatePublicKey(publicKey: Uint8Array): boolean;\n\n  /**\n   * Decompresses a compressed public key.\n   *\n   * @param publicKey - Compressed public key (33 bytes).\n   * @returns Uncompressed public key (65 bytes) or `null` if decompression failed.\n   */\n  protected abstract decompressPublicKey(\n    publicKey: Uint8Array,\n  ): Uint8Array | null;\n\n  /**\n   * Performs ECDH key agreement.\n   *\n   * @param publicKey - Other party's public key.\n   * @param privateKey - Your private key.\n   * @returns Raw X coordinate of shared point (32 bytes).\n   */\n  protected abstract performECDH(\n    publicKey: Uint8Array,\n    privateKey: Uint8Array,\n  ): Uint8Array;\n\n  /**\n   * Computes SHA-512 hash.\n   *\n   * @param data - Data to hash.\n   * @returns SHA-512 hash (64 bytes).\n   */\n  protected abstract sha512(data: Uint8Array): Uint8Array;\n\n  /**\n   * Computes HMAC-SHA256 authentication tag.\n   *\n   * @param key - HMAC key.\n   * @param data - Data to authenticate.\n   * @returns HMAC-SHA256 (32 bytes).\n   */\n  protected abstract hmacSha256(key: Uint8Array, data: Uint8Array): Uint8Array;\n\n  /**\n   * Encrypts data using AES-256-CBC.\n   *\n   * @param key - Encryption key (32 bytes).\n   * @param iv - Initialization vector (16 bytes).\n   * @param plaintext - Data to encrypt.\n   * @returns Ciphertext with PKCS#7 padding.\n   */\n  protected abstract aesEncrypt(\n    key: Uint8Array,\n    iv: Uint8Array,\n    plaintext: Uint8Array,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Decrypts data using AES-256-CBC.\n   *\n   * @param key - Decryption key (32 bytes).\n   * @param iv - Initialization vector (16 bytes).\n   * @param ciphertext - Data to decrypt.\n   * @returns Plaintext with padding removed.\n   */\n  protected abstract aesDecrypt(\n    key: Uint8Array,\n    iv: Uint8Array,\n    ciphertext: Uint8Array,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Normalizes a public key to uncompressed format.\n   *\n   * @param publicKey - Public key in any format.\n   * @returns Uncompressed public key (65 bytes).\n   * @throws {ECIESError} If key format is invalid.\n   */\n  protected normalizePublicKey(publicKey: Uint8Array): Uint8Array {\n    // Check cache first\n    if (BaseECIESUint8.validatedKeys.get(publicKey)) {\n      return publicKey;\n    }\n\n    if (publicKey.length === CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH) {\n      if (publicKey[0] !== CURVE.PREFIX.UNCOMPRESSED) {\n        throw new ECIESError(\n          \"Invalid uncompressed public key prefix\",\n          \"INVALID_KEY\",\n        );\n      }\n      // Validate and cache\n      if (!this.validatePublicKey(publicKey)) {\n        throw new ECIESError(\"Invalid public key\", \"INVALID_KEY\");\n      }\n      BaseECIESUint8.validatedKeys.set(publicKey, true);\n      return publicKey;\n    }\n\n    if (publicKey.length === CURVE.COMPRESSED_PUBLIC_KEY_LENGTH) {\n      if (\n        publicKey[0] === CURVE.PREFIX.COMPRESSED_EVEN ||\n        publicKey[0] === CURVE.PREFIX.COMPRESSED_ODD\n      ) {\n        const decompressed = this.decompressPublicKey(publicKey);\n        if (!decompressed) {\n          throw new ECIESError(\n            \"Failed to decompress public key\",\n            \"INVALID_KEY\",\n          );\n        }\n        // Cache the decompressed key\n        BaseECIESUint8.validatedKeys.set(decompressed, true);\n        return decompressed;\n      }\n      throw new ECIESError(\n        `Invalid compressed public key prefix: expected 0x02 or 0x03, got 0x${publicKey[0].toString(16).padStart(2, \"0\")}`,\n        \"INVALID_KEY\",\n      );\n    }\n\n    throw new ECIESError(\n      `Invalid public key length: ${publicKey.length}`,\n      \"INVALID_KEY\",\n    );\n  }\n\n  /**\n   * Normalizes a public key to uncompressed format (65 bytes with 0x04 prefix).\n   * Must be implemented by derived classes to handle platform-specific operations.\n   *\n   * @param publicKey - The public key to normalize\n   * @returns The normalized uncompressed public key\n   */\n  public abstract normalizeToUncompressed(publicKey: Uint8Array): Uint8Array;\n\n  /**\n   * Encrypts data using ECIES.\n   *\n   * @param publicKey - The recipient's public key (compressed or uncompressed)\n   * @param message - The data to encrypt\n   * @returns Promise resolving to encrypted data structure\n   */\n  async encrypt(\n    publicKey: Uint8Array,\n    message: Uint8Array,\n  ): Promise<ECIESEncrypted> {\n    // Declare sensitive variables outside try so finally can access them\n    let ephemeralPrivateKey: Uint8Array | undefined;\n    let sharedSecret: Uint8Array | undefined;\n    let kdf: Uint8Array | undefined;\n    let encryptionKey: Uint8Array | undefined;\n    let macKey: Uint8Array | undefined;\n\n    try {\n      // Validate inputs\n      if (!(publicKey instanceof Uint8Array)) {\n        throw new ECIESError(\"Public key must be a Uint8Array\", \"INVALID_KEY\");\n      }\n      if (!(message instanceof Uint8Array)) {\n        throw new ECIESError(\n          \"Message must be a Uint8Array\",\n          \"ENCRYPTION_FAILED\",\n        );\n      }\n      if (publicKey.length === 0) {\n        throw new ECIESError(\"Public key cannot be empty\", \"INVALID_KEY\");\n      }\n\n      // Normalize public key to uncompressed format\n      const pubKey = this.normalizePublicKey(publicKey);\n\n      // Generate ephemeral key pair\n      do {\n        ephemeralPrivateKey = this.generateRandomBytes(\n          CURVE.PRIVATE_KEY_LENGTH,\n        );\n      } while (!this.verifyPrivateKey(ephemeralPrivateKey));\n\n      const ephemeralPublicKey = this.createPublicKey(\n        ephemeralPrivateKey,\n        false,\n      );\n      if (!ephemeralPublicKey) {\n        throw new ECIESError(\n          \"Failed to generate ephemeral public key\",\n          \"ENCRYPTION_FAILED\",\n        );\n      }\n\n      // Perform ECDH to get shared secret (raw X coordinate)\n      sharedSecret = this.performECDH(pubKey, ephemeralPrivateKey);\n\n      // Derive keys using SHA-512 (eccrypto-compatible KDF)\n      kdf = this.sha512(sharedSecret);\n      encryptionKey = kdf.slice(\n        KDF.ENCRYPTION_KEY_OFFSET,\n        KDF.ENCRYPTION_KEY_OFFSET + KDF.ENCRYPTION_KEY_LENGTH,\n      );\n      macKey = kdf.slice(\n        KDF.MAC_KEY_OFFSET,\n        KDF.MAC_KEY_OFFSET + KDF.MAC_KEY_LENGTH,\n      );\n\n      // Generate random IV and encrypt\n      const iv = this.generateRandomBytes(CIPHER.IV_LENGTH);\n      const ciphertext = await this.aesEncrypt(encryptionKey, iv, message);\n\n      // Calculate MAC (Encrypt-then-MAC)\n      const macData = concat([iv, ephemeralPublicKey, ciphertext]);\n      const mac = this.hmacSha256(macKey, macData);\n\n      return {\n        iv,\n        ephemPublicKey: ephemeralPublicKey,\n        ciphertext,\n        mac,\n      };\n    } catch (error) {\n      if (error instanceof ECIESError) throw error;\n      throw new ECIESError(\n        `Encryption failed: ${error instanceof Error ? error.message : \"Unknown error\"}`,\n        \"ENCRYPTION_FAILED\",\n        error instanceof Error ? error : undefined,\n      );\n    } finally {\n      // Clear sensitive data on all code paths (success, error, throw)\n      if (ephemeralPrivateKey) this.clearBuffer(ephemeralPrivateKey);\n      if (sharedSecret) this.clearBuffer(sharedSecret);\n      if (kdf) this.clearBuffer(kdf);\n      if (encryptionKey) this.clearBuffer(encryptionKey);\n      if (macKey) this.clearBuffer(macKey);\n    }\n  }\n\n  /**\n   * Decrypts ECIES encrypted data.\n   *\n   * @param privateKey - The recipient's private key (32 bytes)\n   * @param encrypted - The encrypted data structure from encrypt()\n   * @returns Promise resolving to the original plaintext\n   */\n  async decrypt(\n    privateKey: Uint8Array,\n    encrypted: ECIESEncrypted,\n  ): Promise<Uint8Array> {\n    // Declare sensitive variables outside try so finally can access them\n    let sharedSecret: Uint8Array | undefined;\n    let kdf: Uint8Array | undefined;\n    let encryptionKey: Uint8Array | undefined;\n    let macKey: Uint8Array | undefined;\n\n    try {\n      // Validate inputs\n      if (!(privateKey instanceof Uint8Array)) {\n        throw new ECIESError(\"Private key must be a Uint8Array\", \"INVALID_KEY\");\n      }\n      if (!isECIESEncrypted(encrypted)) {\n        throw new ECIESError(\n          \"Invalid encrypted data structure\",\n          \"DECRYPTION_FAILED\",\n        );\n      }\n      if (privateKey.length !== CURVE.PRIVATE_KEY_LENGTH) {\n        throw new ECIESError(\n          `Invalid private key length: ${privateKey.length}`,\n          \"INVALID_KEY\",\n        );\n      }\n      if (!this.verifyPrivateKey(privateKey)) {\n        throw new ECIESError(\"Invalid private key\", \"INVALID_KEY\");\n      }\n\n      // Strict validation: ephemeral keys must be 65-byte uncompressed (eccrypto standard)\n      if (\n        encrypted.ephemPublicKey.length !== CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH\n      ) {\n        throw new ECIESError(\n          `Invalid ephemeral public key: expected ${CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH} bytes (uncompressed), got ${encrypted.ephemPublicKey.length} bytes`,\n          \"INVALID_KEY\",\n        );\n      }\n      if (encrypted.ephemPublicKey[0] !== CURVE.PREFIX.UNCOMPRESSED) {\n        throw new ECIESError(\n          \"Invalid ephemeral public key: must be uncompressed format with 0x04 prefix (eccrypto standard)\",\n          \"INVALID_KEY\",\n        );\n      }\n      if (!this.validatePublicKey(encrypted.ephemPublicKey)) {\n        throw new ECIESError(\"Invalid ephemeral public key\", \"INVALID_KEY\");\n      }\n      const ephemeralPublicKey = encrypted.ephemPublicKey;\n\n      // Perform ECDH to recover shared secret\n      sharedSecret = this.performECDH(ephemeralPublicKey, privateKey);\n\n      // Derive keys using SHA-512 (eccrypto-compatible KDF)\n      kdf = this.sha512(sharedSecret);\n      encryptionKey = kdf.slice(\n        KDF.ENCRYPTION_KEY_OFFSET,\n        KDF.ENCRYPTION_KEY_OFFSET + KDF.ENCRYPTION_KEY_LENGTH,\n      );\n      macKey = kdf.slice(\n        KDF.MAC_KEY_OFFSET,\n        KDF.MAC_KEY_OFFSET + KDF.MAC_KEY_LENGTH,\n      );\n\n      // Verify MAC before decryption (Encrypt-then-MAC)\n      const macData = concat([\n        encrypted.iv,\n        encrypted.ephemPublicKey,\n        encrypted.ciphertext,\n      ]);\n      const expectedMac = this.hmacSha256(macKey, macData);\n\n      if (!constantTimeEqual(encrypted.mac, expectedMac)) {\n        throw new ECIESError(\"MAC verification failed\", \"MAC_MISMATCH\");\n      }\n\n      // Decrypt the ciphertext\n      const decrypted = await this.aesDecrypt(\n        encryptionKey,\n        encrypted.iv,\n        encrypted.ciphertext,\n      );\n\n      return decrypted;\n    } catch (error) {\n      if (error instanceof ECIESError) throw error;\n      throw new ECIESError(\n        `Decryption failed: ${error instanceof Error ? error.message : \"Unknown error\"}`,\n        \"DECRYPTION_FAILED\",\n        error instanceof Error ? error : undefined,\n      );\n    } finally {\n      // Clear sensitive data on all code paths (success, error, throw)\n      if (sharedSecret) this.clearBuffer(sharedSecret);\n      if (kdf) this.clearBuffer(kdf);\n      if (encryptionKey) this.clearBuffer(encryptionKey);\n      if (macKey) this.clearBuffer(macKey);\n    }\n  }\n\n  /**\n   * Clears sensitive data from memory using multi-pass overwrite.\n   *\n   * @remarks\n   * Uses multiple passes with different patterns to make it harder\n   * for JIT compilers to optimize away the operation. While not\n   * guaranteed in JavaScript, this is a best-effort approach to\n   * clear sensitive data from memory.\n   *\n   * @param buffer - The buffer to clear\n   */\n  protected clearBuffer(buffer: Uint8Array): void {\n    if (buffer && buffer.length > 0) {\n      // Multi-pass overwrite to resist compiler optimization\n      buffer.fill(0x00); // Fill with zeros\n      buffer.fill(0xff); // Fill with ones\n      buffer.fill(0xaa); // Fill with alternating pattern\n      buffer.fill(0x00); // Final zero fill\n\n      // Additional pattern write to further discourage optimization\n      for (let i = 0; i < buffer.length; i++) {\n        buffer[i] = (i & 0xff) ^ 0x5a; // XOR with pattern\n      }\n      buffer.fill(0x00); // Final clear\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,uBAA6C;AAC7C,uBAAmC;AACnC,mBAAkC;AAClC,kBAAuB;AAiBhB,MAAe,eAAwC;AAAA;AAAA,EAE5D,OAAwB,gBAAgB,oBAAI,QAA6B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgH/D,mBAAmB,WAAmC;AAE9D,QAAI,eAAe,cAAc,IAAI,SAAS,GAAG;AAC/C,aAAO;AAAA,IACT;AAEA,QAAI,UAAU,WAAW,uBAAM,gCAAgC;AAC7D,UAAI,UAAU,CAAC,MAAM,uBAAM,OAAO,cAAc;AAC9C,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,UAAI,CAAC,KAAK,kBAAkB,SAAS,GAAG;AACtC,cAAM,IAAI,4BAAW,sBAAsB,aAAa;AAAA,MAC1D;AACA,qBAAe,cAAc,IAAI,WAAW,IAAI;AAChD,aAAO;AAAA,IACT;AAEA,QAAI,UAAU,WAAW,uBAAM,8BAA8B;AAC3D,UACE,UAAU,CAAC,MAAM,uBAAM,OAAO,mBAC9B,UAAU,CAAC,MAAM,uBAAM,OAAO,gBAC9B;AACA,cAAM,eAAe,KAAK,oBAAoB,SAAS;AACvD,YAAI,CAAC,cAAc;AACjB,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAEA,uBAAe,cAAc,IAAI,cAAc,IAAI;AACnD,eAAO;AAAA,MACT;AACA,YAAM,IAAI;AAAA,QACR,sEAAsE,UAAU,CAAC,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,QAChH;AAAA,MACF;AAAA,IACF;AAEA,UAAM,IAAI;AAAA,MACR,8BAA8B,UAAU,MAAM;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAM,QACJ,WACA,SACyB;AAEzB,QAAI;AACJ,QAAI;AACJ,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI;AAEF,UAAI,EAAE,qBAAqB,aAAa;AACtC,cAAM,IAAI,4BAAW,mCAAmC,aAAa;AAAA,MACvE;AACA,UAAI,EAAE,mBAAmB,aAAa;AACpC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,UAAU,WAAW,GAAG;AAC1B,cAAM,IAAI,4BAAW,8BAA8B,aAAa;AAAA,MAClE;AAGA,YAAM,SAAS,KAAK,mBAAmB,SAAS;AAGhD,SAAG;AACD,8BAAsB,KAAK;AAAA,UACzB,uBAAM;AAAA,QACR;AAAA,MACF,SAAS,CAAC,KAAK,iBAAiB,mBAAmB;AAEnD,YAAM,qBAAqB,KAAK;AAAA,QAC9B;AAAA,QACA;AAAA,MACF;AACA,UAAI,CAAC,oBAAoB;AACvB,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAGA,qBAAe,KAAK,YAAY,QAAQ,mBAAmB;AAG3D,YAAM,KAAK,OAAO,YAAY;AAC9B,sBAAgB,IAAI;AAAA,QAClB,qBAAI;AAAA,QACJ,qBAAI,wBAAwB,qBAAI;AAAA,MAClC;AACA,eAAS,IAAI;AAAA,QACX,qBAAI;AAAA,QACJ,qBAAI,iBAAiB,qBAAI;AAAA,MAC3B;AAGA,YAAM,KAAK,KAAK,oBAAoB,wBAAO,SAAS;AACpD,YAAM,aAAa,MAAM,KAAK,WAAW,eAAe,IAAI,OAAO;AAGnE,YAAM,cAAU,oBAAO,CAAC,IAAI,oBAAoB,UAAU,CAAC;AAC3D,YAAM,MAAM,KAAK,WAAW,QAAQ,OAAO;AAE3C,aAAO;AAAA,QACL;AAAA,QACA,gBAAgB;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,4BAAY,OAAM;AACvC,YAAM,IAAI;AAAA,QACR,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,QAC9E;AAAA,QACA,iBAAiB,QAAQ,QAAQ;AAAA,MACnC;AAAA,IACF,UAAE;AAEA,UAAI,oBAAqB,MAAK,YAAY,mBAAmB;AAC7D,UAAI,aAAc,MAAK,YAAY,YAAY;AAC/C,UAAI,IAAK,MAAK,YAAY,GAAG;AAC7B,UAAI,cAAe,MAAK,YAAY,aAAa;AACjD,UAAI,OAAQ,MAAK,YAAY,MAAM;AAAA,IACrC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,QACJ,YACA,WACqB;AAErB,QAAI;AACJ,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI;AAEF,UAAI,EAAE,sBAAsB,aAAa;AACvC,cAAM,IAAI,4BAAW,oCAAoC,aAAa;AAAA,MACxE;AACA,UAAI,KAAC,mCAAiB,SAAS,GAAG;AAChC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,WAAW,WAAW,uBAAM,oBAAoB;AAClD,cAAM,IAAI;AAAA,UACR,+BAA+B,WAAW,MAAM;AAAA,UAChD;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,KAAK,iBAAiB,UAAU,GAAG;AACtC,cAAM,IAAI,4BAAW,uBAAuB,aAAa;AAAA,MAC3D;AAGA,UACE,UAAU,eAAe,WAAW,uBAAM,gCAC1C;AACA,cAAM,IAAI;AAAA,UACR,0CAA0C,uBAAM,8BAA8B,8BAA8B,UAAU,eAAe,MAAM;AAAA,UAC3I;AAAA,QACF;AAAA,MACF;AACA,UAAI,UAAU,eAAe,CAAC,MAAM,uBAAM,OAAO,cAAc;AAC7D,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,KAAK,kBAAkB,UAAU,cAAc,GAAG;AACrD,cAAM,IAAI,4BAAW,gCAAgC,aAAa;AAAA,MACpE;AACA,YAAM,qBAAqB,UAAU;AAGrC,qBAAe,KAAK,YAAY,oBAAoB,UAAU;AAG9D,YAAM,KAAK,OAAO,YAAY;AAC9B,sBAAgB,IAAI;AAAA,QAClB,qBAAI;AAAA,QACJ,qBAAI,wBAAwB,qBAAI;AAAA,MAClC;AACA,eAAS,IAAI;AAAA,QACX,qBAAI;AAAA,QACJ,qBAAI,iBAAiB,qBAAI;AAAA,MAC3B;AAGA,YAAM,cAAU,oBAAO;AAAA,QACrB,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,MACZ,CAAC;AACD,YAAM,cAAc,KAAK,WAAW,QAAQ,OAAO;AAEnD,UAAI,KAAC,gCAAkB,UAAU,KAAK,WAAW,GAAG;AAClD,cAAM,IAAI,4BAAW,2BAA2B,cAAc;AAAA,MAChE;AAGA,YAAM,YAAY,MAAM,KAAK;AAAA,QAC3B;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,MACZ;AAEA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,iBAAiB,4BAAY,OAAM;AACvC,YAAM,IAAI;AAAA,QACR,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,QAC9E;AAAA,QACA,iBAAiB,QAAQ,QAAQ;AAAA,MACnC;AAAA,IACF,UAAE;AAEA,UAAI,aAAc,MAAK,YAAY,YAAY;AAC/C,UAAI,IAAK,MAAK,YAAY,GAAG;AAC7B,UAAI,cAAe,MAAK,YAAY,aAAa;AACjD,UAAI,OAAQ,MAAK,YAAY,MAAM;AAAA,IACrC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaU,YAAY,QAA0B;AAC9C,QAAI,UAAU,OAAO,SAAS,GAAG;AAE/B,aAAO,KAAK,CAAI;AAChB,aAAO,KAAK,GAAI;AAChB,aAAO,KAAK,GAAI;AAChB,aAAO,KAAK,CAAI;AAGhB,eAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,eAAO,CAAC,IAAK,IAAI,MAAQ;AAAA,MAC3B;AACA,aAAO,KAAK,CAAI;AAAA,IAClB;AAAA,EACF;AACF;","names":[]}