@opendatalabs/vana-sdk 2.3.0 → 3.0.1

package/dist/config/default-services.cjs

@@ -18,22 +18,17 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var default_services_exports = {};
 __export(default_services_exports, {
-  getDefaultPersonalServerUrl: () => getDefaultPersonalServerUrl,
   getServiceEndpoints: () => getServiceEndpoints,
   mainnetServices: () => mainnetServices,
   mokshaServices: () => mokshaServices
 });
 module.exports = __toCommonJS(default_services_exports);
 const mainnetServices = {
-  subgraphUrl: "https://vanagraph.io/v7",
   blockExplorerUrl: "https://vanascan.io",
-  personalServerUrl: "https://server.vana.com",
   rpcUrl: "https://rpc.vana.org"
 };
 const mokshaServices = {
-  subgraphUrl: "https://moksha.vanagraph.io/v7",
   blockExplorerUrl: "https://moksha.vanascan.io",
-  personalServerUrl: "https://test.server.vana.com",
   rpcUrl: "https://rpc.moksha.vana.org"
 };
 function getServiceEndpoints(chainId) {
@@ -46,13 +41,8 @@ function getServiceEndpoints(chainId) {
       return void 0;
   }
 }
-function getDefaultPersonalServerUrl(chainId) {
-  const services = getServiceEndpoints(chainId);
-  return services?.personalServerUrl;
-}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  getDefaultPersonalServerUrl,
   getServiceEndpoints,
   mainnetServices,
   mokshaServices

package/dist/config/default-services.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/config/default-services.ts"],"sourcesContent":["/**\n * Default service endpoints for Vana networks\n *\n * Centralizes all default service URLs for different Vana networks.\n * These can be overridden during SDK initialization.\n */\n\nexport interface ServiceEndpoints {\n  /** Subgraph API endpoint for querying on-chain data */\n  subgraphUrl: string;\n  /** Block explorer URL for viewing transactions and addresses */\n  blockExplorerUrl: string;\n  /** Personal server URL for computation operations */\n  personalServerUrl: string;\n  /** RPC URL for blockchain interactions */\n  rpcUrl: string;\n}\n\n/**\n * Default service endpoints for Vana Mainnet (chain ID: 1480)\n */\nexport const mainnetServices: ServiceEndpoints = {\n  subgraphUrl: \"https://vanagraph.io/v7\",\n  blockExplorerUrl: \"https://vanascan.io\",\n  personalServerUrl: \"https://server.vana.com\",\n  rpcUrl: \"https://rpc.vana.org\",\n} as const;\n\n/**\n * Default service endpoints for Moksha Testnet (chain ID: 14800)\n */\nexport const mokshaServices: ServiceEndpoints = {\n  subgraphUrl: \"https://moksha.vanagraph.io/v7\",\n  blockExplorerUrl: \"https://moksha.vanascan.io\",\n  personalServerUrl: \"https://test.server.vana.com\",\n  rpcUrl: \"https://rpc.moksha.vana.org\",\n} as const;\n\n/**\n * Retrieves the default service endpoints for a given chain ID\n *\n * @param chainId - The numeric chain ID\n * @returns Service endpoints for the chain, or undefined if not supported\n * @example\n * ```typescript\n * const services = getServiceEndpoints(1480);\n * if (services) {\n *   console.log('Personal server:', services.personalServerUrl);\n *   console.log('Subgraph:', services.subgraphUrl);\n * }\n * ```\n */\nexport function getServiceEndpoints(\n  chainId: number,\n): ServiceEndpoints | undefined {\n  switch (chainId) {\n    case 1480:\n      return mainnetServices;\n    case 14800:\n      return mokshaServices;\n    default:\n      return undefined;\n  }\n}\n\n/**\n * Gets the default personal server URL for a given chain ID\n *\n * @param chainId - The numeric chain ID\n * @returns The personal server URL for the chain, or undefined if not supported\n */\nexport function getDefaultPersonalServerUrl(\n  chainId: number,\n): string | undefined {\n  const services = getServiceEndpoints(chainId);\n  return services?.personalServerUrl;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqBO,MAAM,kBAAoC;AAAA,EAC/C,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,QAAQ;AACV;AAKO,MAAM,iBAAmC;AAAA,EAC9C,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,QAAQ;AACV;AAgBO,SAAS,oBACd,SAC8B;AAC9B,UAAQ,SAAS;AAAA,IACf,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAQO,SAAS,4BACd,SACoB;AACpB,QAAM,WAAW,oBAAoB,OAAO;AAC5C,SAAO,UAAU;AACnB;","names":[]}
+{"version":3,"sources":["../../src/config/default-services.ts"],"sourcesContent":["/**\n * Default service endpoints for Vana networks\n *\n * Centralizes default service URLs for different Vana networks.\n * These can be overridden during SDK initialization.\n */\n\nexport interface ServiceEndpoints {\n  /** Block explorer URL for viewing transactions and addresses */\n  blockExplorerUrl: string;\n  /** RPC URL for blockchain interactions */\n  rpcUrl: string;\n}\n\n/**\n * Default service endpoints for Vana Mainnet (chain ID: 1480)\n */\nexport const mainnetServices: ServiceEndpoints = {\n  blockExplorerUrl: \"https://vanascan.io\",\n  rpcUrl: \"https://rpc.vana.org\",\n} as const;\n\n/**\n * Default service endpoints for Moksha Testnet (chain ID: 14800)\n */\nexport const mokshaServices: ServiceEndpoints = {\n  blockExplorerUrl: \"https://moksha.vanascan.io\",\n  rpcUrl: \"https://rpc.moksha.vana.org\",\n} as const;\n\n/**\n * Retrieves the default service endpoints for a given chain ID\n *\n * @param chainId - The numeric chain ID\n * @returns Service endpoints for the chain, or undefined if not supported\n */\nexport function getServiceEndpoints(\n  chainId: number,\n): ServiceEndpoints | undefined {\n  switch (chainId) {\n    case 1480:\n      return mainnetServices;\n    case 14800:\n      return mokshaServices;\n    default:\n      return undefined;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBO,MAAM,kBAAoC;AAAA,EAC/C,kBAAkB;AAAA,EAClB,QAAQ;AACV;AAKO,MAAM,iBAAmC;AAAA,EAC9C,kBAAkB;AAAA,EAClB,QAAQ;AACV;AAQO,SAAS,oBACd,SAC8B;AAC9B,UAAQ,SAAS;AAAA,IACf,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;","names":[]}

package/dist/config/default-services.d.ts

@@ -1,16 +1,12 @@
 /**
  * Default service endpoints for Vana networks
  *
- * Centralizes all default service URLs for different Vana networks.
+ * Centralizes default service URLs for different Vana networks.
  * These can be overridden during SDK initialization.
  */
 export interface ServiceEndpoints {
-    /** Subgraph API endpoint for querying on-chain data */
-    subgraphUrl: string;
     /** Block explorer URL for viewing transactions and addresses */
     blockExplorerUrl: string;
-    /** Personal server URL for computation operations */
-    personalServerUrl: string;
     /** RPC URL for blockchain interactions */
     rpcUrl: string;
 }
@@ -27,20 +23,5 @@ export declare const mokshaServices: ServiceEndpoints;
  *
  * @param chainId - The numeric chain ID
  * @returns Service endpoints for the chain, or undefined if not supported
- * @example
- * ```typescript
- * const services = getServiceEndpoints(1480);
- * if (services) {
- *   console.log('Personal server:', services.personalServerUrl);
- *   console.log('Subgraph:', services.subgraphUrl);
- * }
- * ```
  */
 export declare function getServiceEndpoints(chainId: number): ServiceEndpoints | undefined;
-/**
- * Gets the default personal server URL for a given chain ID
- *
- * @param chainId - The numeric chain ID
- * @returns The personal server URL for the chain, or undefined if not supported
- */
-export declare function getDefaultPersonalServerUrl(chainId: number): string | undefined;

package/dist/config/default-services.js

@@ -1,13 +1,9 @@
 const mainnetServices = {
-  subgraphUrl: "https://vanagraph.io/v7",
   blockExplorerUrl: "https://vanascan.io",
-  personalServerUrl: "https://server.vana.com",
   rpcUrl: "https://rpc.vana.org"
 };
 const mokshaServices = {
-  subgraphUrl: "https://moksha.vanagraph.io/v7",
   blockExplorerUrl: "https://moksha.vanascan.io",
-  personalServerUrl: "https://test.server.vana.com",
   rpcUrl: "https://rpc.moksha.vana.org"
 };
 function getServiceEndpoints(chainId) {
@@ -20,12 +16,7 @@ function getServiceEndpoints(chainId) {
       return void 0;
   }
 }
-function getDefaultPersonalServerUrl(chainId) {
-  const services = getServiceEndpoints(chainId);
-  return services?.personalServerUrl;
-}
 export {
-  getDefaultPersonalServerUrl,
   getServiceEndpoints,
   mainnetServices,
   mokshaServices

package/dist/config/default-services.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/config/default-services.ts"],"sourcesContent":["/**\n * Default service endpoints for Vana networks\n *\n * Centralizes all default service URLs for different Vana networks.\n * These can be overridden during SDK initialization.\n */\n\nexport interface ServiceEndpoints {\n  /** Subgraph API endpoint for querying on-chain data */\n  subgraphUrl: string;\n  /** Block explorer URL for viewing transactions and addresses */\n  blockExplorerUrl: string;\n  /** Personal server URL for computation operations */\n  personalServerUrl: string;\n  /** RPC URL for blockchain interactions */\n  rpcUrl: string;\n}\n\n/**\n * Default service endpoints for Vana Mainnet (chain ID: 1480)\n */\nexport const mainnetServices: ServiceEndpoints = {\n  subgraphUrl: \"https://vanagraph.io/v7\",\n  blockExplorerUrl: \"https://vanascan.io\",\n  personalServerUrl: \"https://server.vana.com\",\n  rpcUrl: \"https://rpc.vana.org\",\n} as const;\n\n/**\n * Default service endpoints for Moksha Testnet (chain ID: 14800)\n */\nexport const mokshaServices: ServiceEndpoints = {\n  subgraphUrl: \"https://moksha.vanagraph.io/v7\",\n  blockExplorerUrl: \"https://moksha.vanascan.io\",\n  personalServerUrl: \"https://test.server.vana.com\",\n  rpcUrl: \"https://rpc.moksha.vana.org\",\n} as const;\n\n/**\n * Retrieves the default service endpoints for a given chain ID\n *\n * @param chainId - The numeric chain ID\n * @returns Service endpoints for the chain, or undefined if not supported\n * @example\n * ```typescript\n * const services = getServiceEndpoints(1480);\n * if (services) {\n *   console.log('Personal server:', services.personalServerUrl);\n *   console.log('Subgraph:', services.subgraphUrl);\n * }\n * ```\n */\nexport function getServiceEndpoints(\n  chainId: number,\n): ServiceEndpoints | undefined {\n  switch (chainId) {\n    case 1480:\n      return mainnetServices;\n    case 14800:\n      return mokshaServices;\n    default:\n      return undefined;\n  }\n}\n\n/**\n * Gets the default personal server URL for a given chain ID\n *\n * @param chainId - The numeric chain ID\n * @returns The personal server URL for the chain, or undefined if not supported\n */\nexport function getDefaultPersonalServerUrl(\n  chainId: number,\n): string | undefined {\n  const services = getServiceEndpoints(chainId);\n  return services?.personalServerUrl;\n}\n"],"mappings":"AAqBO,MAAM,kBAAoC;AAAA,EAC/C,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,QAAQ;AACV;AAKO,MAAM,iBAAmC;AAAA,EAC9C,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,QAAQ;AACV;AAgBO,SAAS,oBACd,SAC8B;AAC9B,UAAQ,SAAS;AAAA,IACf,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAQO,SAAS,4BACd,SACoB;AACpB,QAAM,WAAW,oBAAoB,OAAO;AAC5C,SAAO,UAAU;AACnB;","names":[]}
+{"version":3,"sources":["../../src/config/default-services.ts"],"sourcesContent":["/**\n * Default service endpoints for Vana networks\n *\n * Centralizes default service URLs for different Vana networks.\n * These can be overridden during SDK initialization.\n */\n\nexport interface ServiceEndpoints {\n  /** Block explorer URL for viewing transactions and addresses */\n  blockExplorerUrl: string;\n  /** RPC URL for blockchain interactions */\n  rpcUrl: string;\n}\n\n/**\n * Default service endpoints for Vana Mainnet (chain ID: 1480)\n */\nexport const mainnetServices: ServiceEndpoints = {\n  blockExplorerUrl: \"https://vanascan.io\",\n  rpcUrl: \"https://rpc.vana.org\",\n} as const;\n\n/**\n * Default service endpoints for Moksha Testnet (chain ID: 14800)\n */\nexport const mokshaServices: ServiceEndpoints = {\n  blockExplorerUrl: \"https://moksha.vanascan.io\",\n  rpcUrl: \"https://rpc.moksha.vana.org\",\n} as const;\n\n/**\n * Retrieves the default service endpoints for a given chain ID\n *\n * @param chainId - The numeric chain ID\n * @returns Service endpoints for the chain, or undefined if not supported\n */\nexport function getServiceEndpoints(\n  chainId: number,\n): ServiceEndpoints | undefined {\n  switch (chainId) {\n    case 1480:\n      return mainnetServices;\n    case 14800:\n      return mokshaServices;\n    default:\n      return undefined;\n  }\n}\n"],"mappings":"AAiBO,MAAM,kBAAoC;AAAA,EAC/C,kBAAkB;AAAA,EAClB,QAAQ;AACV;AAKO,MAAM,iBAAmC;AAAA,EAC9C,kBAAkB;AAAA,EAClB,QAAQ;AACV;AAQO,SAAS,oBACd,SAC8B;AAC9B,UAAQ,SAAS;AAAA,IACf,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;","names":[]}

package/dist/crypto/ecies/interface.cjs

@@ -33,6 +33,8 @@ class ECIESError extends Error {
     this.cause = cause;
     this.name = "ECIESError";
   }
+  code;
+  cause;
 }
 function isECIESEncrypted(obj) {
   if (!obj || typeof obj !== "object") return false;

package/dist/crypto/ecies/interface.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/crypto/ecies/interface.ts"],"sourcesContent":["/**\n * ECIES (Elliptic Curve Integrated Encryption Scheme) Interface\n *\n * @remarks\n * Defines the contract for platform-specific ECIES implementations.\n * All implementations maintain compatibility with the eccrypto format to ensure\n * backward compatibility with existing encrypted data.\n *\n * **Format specification:**\n * `[iv (16 bytes)][ephemPublicKey (65 bytes)][ciphertext (variable)][mac (32 bytes)]`\n *\n * @category Cryptography\n */\n\nimport { CIPHER, CURVE, MAC, FORMAT } from \"./constants\";\nimport { fromHex, toHex } from \"viem\";\n\n/**\n * Represents ECIES encrypted data in eccrypto-compatible format.\n *\n * @remarks\n * This structure maintains backward compatibility with data encrypted using\n * the legacy eccrypto library.\n */\nexport interface ECIESEncrypted {\n  /** Initialization vector (16 bytes) */\n  iv: Uint8Array;\n  /** Ephemeral public key (65 bytes uncompressed) */\n  ephemPublicKey: Uint8Array;\n  /** Encrypted data */\n  ciphertext: Uint8Array;\n  /** Message authentication code (32 bytes) */\n  mac: Uint8Array;\n}\n\n/**\n * Provides ECIES encryption and decryption operations.\n *\n * @remarks\n * Platform-specific implementations handle the underlying cryptographic primitives\n * while maintaining consistent data format across environments.\n *\n * @category Cryptography\n */\nexport interface ECIESProvider {\n  /**\n   * Encrypts data using ECIES with secp256k1.\n   *\n   * @param publicKey - Recipient's public key (65 bytes uncompressed or 33 bytes compressed).\n   *   Obtain via `vana.server.getIdentity(userAddress).public_key`.\n   * @param message - Data to encrypt.\n   * @returns Encrypted data structure compatible with eccrypto format.\n   * @throws {ECIESError} When public key is invalid.\n   *   Verify key format matches secp256k1 requirements.\n   *\n   * @example\n   * ```typescript\n   * const encrypted = await provider.encrypt(\n   *   fromHex(publicKey, 'bytes'),\n   *   new TextEncoder().encode('sensitive data')\n   * );\n   * ```\n   */\n  encrypt(publicKey: Uint8Array, message: Uint8Array): Promise<ECIESEncrypted>;\n\n  /**\n   * Decrypts ECIES encrypted data.\n   *\n   * @param privateKey - Recipient's private key (32 bytes).\n   * @param encrypted - Encrypted data structure from `encrypt()` or legacy eccrypto.\n   * @returns Decrypted message as Uint8Array.\n   * @throws {ECIESError} When MAC verification fails.\n   *   Ensure the private key matches the public key used for encryption.\n   *\n   * @example\n   * ```typescript\n   * const decrypted = await provider.decrypt(\n   *   fromHex(privateKey, 'bytes'),\n   *   encrypted\n   * );\n   * const message = new TextDecoder().decode(decrypted);\n   * ```\n   */\n  decrypt(\n    privateKey: Uint8Array,\n    encrypted: ECIESEncrypted,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Normalizes a public key to uncompressed format (65 bytes with 0x04 prefix).\n   *\n   * @remarks\n   * Strict policy: Only accepts properly formatted compressed (33 bytes) or\n   * uncompressed (65 bytes) public keys. Does not accept 64-byte raw coordinates\n   * to ensure data integrity and prevent masking of malformed inputs.\n   *\n   * @param publicKey - Public key in compressed or uncompressed format\n   * @returns Normalized uncompressed public key (65 bytes with 0x04 prefix)\n   * @throws {Error} When public key format is invalid, including raw coordinates (64 bytes)\n   * @throws {Error} When decompression of compressed key fails\n   *\n   * @example\n   * ```typescript\n   * // Compressed key (33 bytes)\n   * const compressed = new Uint8Array(33);\n   * compressed[0] = 0x02;\n   * const uncompressed = provider.normalizeToUncompressed(compressed);\n   * console.log(uncompressed.length); // 65\n   * console.log(uncompressed[0]); // 0x04\n   *\n   * // Already uncompressed (65 bytes)\n   * const already = provider.normalizeToUncompressed(uncompressedKey);\n   * console.log(already === uncompressedKey); // true (returns same reference)\n   *\n   * // Raw coordinates rejected (64 bytes)\n   * const raw = new Uint8Array(64);\n   * provider.normalizeToUncompressed(raw); // Throws error\n   * ```\n   */\n  normalizeToUncompressed(publicKey: Uint8Array): Uint8Array;\n}\n\n/**\n * Configures ECIES operation behavior.\n */\nexport interface ECIESOptions {\n  /** Use compressed public keys (33 bytes) instead of uncompressed (65 bytes) */\n  useCompressed?: boolean;\n}\n\n/**\n * Represents failures in ECIES cryptographic operations.\n *\n * @remarks\n * Provides specific error codes to help identify and recover from\n * different failure scenarios.\n *\n * @category Errors\n */\nexport class ECIESError extends Error {\n  constructor(\n    message: string,\n    public readonly code:\n      | \"INVALID_KEY\"\n      | \"ENCRYPTION_FAILED\"\n      | \"DECRYPTION_FAILED\"\n      | \"MAC_MISMATCH\"\n      | \"ECDH_FAILED\",\n    public override readonly cause?: Error,\n  ) {\n    super(message);\n    this.name = \"ECIESError\";\n  }\n}\n\n/**\n * Validates if an object conforms to the ECIESEncrypted structure.\n *\n * @param obj - Object to validate.\n * @returns `true` if object is a valid ECIESEncrypted structure.\n *\n * @example\n * ```typescript\n * if (isECIESEncrypted(data)) {\n *   const decrypted = await provider.decrypt(privateKey, data);\n * }\n * ```\n */\nexport function isECIESEncrypted(obj: unknown): obj is ECIESEncrypted {\n  if (!obj || typeof obj !== \"object\") return false;\n  const enc = obj as Record<string, unknown>;\n\n  const isUint8Array = (value: unknown): value is Uint8Array => {\n    return (\n      value instanceof Uint8Array ||\n      (typeof Buffer !== \"undefined\" && Buffer.isBuffer(value))\n    );\n  };\n\n  return (\n    isUint8Array(enc.iv) &&\n    enc.iv.length === CIPHER.IV_LENGTH &&\n    isUint8Array(enc.ephemPublicKey) &&\n    (enc.ephemPublicKey.length === CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH ||\n      enc.ephemPublicKey.length === CURVE.COMPRESSED_PUBLIC_KEY_LENGTH) &&\n    isUint8Array(enc.ciphertext) &&\n    enc.ciphertext.length > 0 &&\n    isUint8Array(enc.mac) &&\n    enc.mac.length === MAC.LENGTH\n  );\n}\n\n/**\n * Serializes ECIESEncrypted to hex string for storage or transmission.\n *\n * @param encrypted - Encrypted data structure from `encrypt()`.\n * @returns Hex string representation.\n *\n * @example\n * ```typescript\n * const hexString = serializeECIES(encrypted);\n * // Store hexString in database or send over network\n * ```\n */\nexport function serializeECIES(encrypted: ECIESEncrypted): string {\n  const combined = new Uint8Array(\n    encrypted.iv.length +\n      encrypted.ephemPublicKey.length +\n      encrypted.ciphertext.length +\n      encrypted.mac.length,\n  );\n\n  let offset = 0;\n  combined.set(encrypted.iv, offset);\n  offset += encrypted.iv.length;\n  combined.set(encrypted.ephemPublicKey, offset);\n  offset += encrypted.ephemPublicKey.length;\n  combined.set(encrypted.ciphertext, offset);\n  offset += encrypted.ciphertext.length;\n  combined.set(encrypted.mac, offset);\n\n  return toHex(combined).slice(2);\n}\n\n/**\n * Deserializes hex string to ECIESEncrypted structure.\n *\n * @param hex - Hex string from `serializeECIES()` or storage.\n * @returns ECIESEncrypted structure ready for decryption.\n * @throws {ECIESError} When hex string format is invalid.\n *   Verify the hex string is complete and uncorrupted.\n *\n * @example\n * ```typescript\n * const encrypted = deserializeECIES(hexString);\n * const decrypted = await provider.decrypt(privateKey, encrypted);\n * ```\n */\nexport function deserializeECIES(hex: string): ECIESEncrypted {\n  const hexWithPrefix = hex.startsWith(\"0x\") ? hex : `0x${hex}`;\n  const bytes = fromHex(hexWithPrefix as `0x${string}`, \"bytes\");\n\n  // Check minimum length before accessing prefix byte\n  // Need at least: IV (16 bytes) + 1 byte for prefix check + MAC (32 bytes) + 1 byte ciphertext\n  const absoluteMinLength = FORMAT.IV_LENGTH + 1 + MAC.LENGTH + 1;\n  if (bytes.length < absoluteMinLength) {\n    throw new ECIESError(\n      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${absoluteMinLength} bytes required)`,\n      \"DECRYPTION_FAILED\",\n    );\n  }\n\n  // Validate ephemeral public key prefix (must be uncompressed for eccrypto compatibility)\n  const prefix = bytes[FORMAT.EPHEMERAL_KEY_OFFSET];\n\n  if (prefix !== CURVE.PREFIX.UNCOMPRESSED) {\n    throw new ECIESError(\n      `Invalid ephemeral public key: must be uncompressed format (0x04 prefix), got 0x${prefix.toString(16).padStart(2, \"0\")}`,\n      \"DECRYPTION_FAILED\",\n    );\n  }\n\n  const ephemKeySize = CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH;\n\n  const minLength = FORMAT.IV_LENGTH + ephemKeySize + MAC.LENGTH + 1; // +1 for at least 1 byte of ciphertext\n  if (bytes.length < minLength) {\n    throw new ECIESError(\n      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${minLength} bytes required)`,\n      \"DECRYPTION_FAILED\",\n    );\n  }\n\n  return {\n    iv: bytes.subarray(FORMAT.IV_OFFSET, FORMAT.IV_OFFSET + FORMAT.IV_LENGTH),\n    ephemPublicKey: bytes.subarray(\n      FORMAT.EPHEMERAL_KEY_OFFSET,\n      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize,\n    ),\n    ciphertext: bytes.subarray(\n      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize,\n      bytes.length - MAC.LENGTH,\n    ),\n    mac: bytes.subarray(bytes.length - MAC.LENGTH),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcA,uBAA2C;AAC3C,kBAA+B;AA4HxB,MAAM,mBAAmB,MAAM;AAAA,EACpC,YACE,SACgB,MAMS,OACzB;AACA,UAAM,OAAO;AARG;AAMS;AAGzB,SAAK,OAAO;AAAA,EACd;AACF;AAeO,SAAS,iBAAiB,KAAqC;AACpE,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,MAAM;AAEZ,QAAM,eAAe,CAAC,UAAwC;AAC5D,WACE,iBAAiB,cAChB,OAAO,WAAW,eAAe,OAAO,SAAS,KAAK;AAAA,EAE3D;AAEA,SACE,aAAa,IAAI,EAAE,KACnB,IAAI,GAAG,WAAW,wBAAO,aACzB,aAAa,IAAI,cAAc,MAC9B,IAAI,eAAe,WAAW,uBAAM,kCACnC,IAAI,eAAe,WAAW,uBAAM,iCACtC,aAAa,IAAI,UAAU,KAC3B,IAAI,WAAW,SAAS,KACxB,aAAa,IAAI,GAAG,KACpB,IAAI,IAAI,WAAW,qBAAI;AAE3B;AAcO,SAAS,eAAe,WAAmC;AAChE,QAAM,WAAW,IAAI;AAAA,IACnB,UAAU,GAAG,SACX,UAAU,eAAe,SACzB,UAAU,WAAW,SACrB,UAAU,IAAI;AAAA,EAClB;AAEA,MAAI,SAAS;AACb,WAAS,IAAI,UAAU,IAAI,MAAM;AACjC,YAAU,UAAU,GAAG;AACvB,WAAS,IAAI,UAAU,gBAAgB,MAAM;AAC7C,YAAU,UAAU,eAAe;AACnC,WAAS,IAAI,UAAU,YAAY,MAAM;AACzC,YAAU,UAAU,WAAW;AAC/B,WAAS,IAAI,UAAU,KAAK,MAAM;AAElC,aAAO,mBAAM,QAAQ,EAAE,MAAM,CAAC;AAChC;AAgBO,SAAS,iBAAiB,KAA6B;AAC5D,QAAM,gBAAgB,IAAI,WAAW,IAAI,IAAI,MAAM,KAAK,GAAG;AAC3D,QAAM,YAAQ,qBAAQ,eAAgC,OAAO;AAI7D,QAAM,oBAAoB,wBAAO,YAAY,IAAI,qBAAI,SAAS;AAC9D,MAAI,MAAM,SAAS,mBAAmB;AACpC,UAAM,IAAI;AAAA,MACR,kCAAkC,MAAM,MAAM,mBAAmB,iBAAiB;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AAGA,QAAM,SAAS,MAAM,wBAAO,oBAAoB;AAEhD,MAAI,WAAW,uBAAM,OAAO,cAAc;AACxC,UAAM,IAAI;AAAA,MACR,kFAAkF,OAAO,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,MACtH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,eAAe,uBAAM;AAE3B,QAAM,YAAY,wBAAO,YAAY,eAAe,qBAAI,SAAS;AACjE,MAAI,MAAM,SAAS,WAAW;AAC5B,UAAM,IAAI;AAAA,MACR,kCAAkC,MAAM,MAAM,mBAAmB,SAAS;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI,MAAM,SAAS,wBAAO,WAAW,wBAAO,YAAY,wBAAO,SAAS;AAAA,IACxE,gBAAgB,MAAM;AAAA,MACpB,wBAAO;AAAA,MACP,wBAAO,uBAAuB;AAAA,IAChC;AAAA,IACA,YAAY,MAAM;AAAA,MAChB,wBAAO,uBAAuB;AAAA,MAC9B,MAAM,SAAS,qBAAI;AAAA,IACrB;AAAA,IACA,KAAK,MAAM,SAAS,MAAM,SAAS,qBAAI,MAAM;AAAA,EAC/C;AACF;","names":[]}
+{"version":3,"sources":["../../../src/crypto/ecies/interface.ts"],"sourcesContent":["/**\n * ECIES (Elliptic Curve Integrated Encryption Scheme) Interface\n *\n * @remarks\n * Defines the contract for platform-specific ECIES implementations.\n * All implementations maintain compatibility with the eccrypto format to ensure\n * backward compatibility with existing encrypted data.\n *\n * **Format specification:**\n * `[iv (16 bytes)][ephemPublicKey (65 bytes)][ciphertext (variable)][mac (32 bytes)]`\n *\n * @category Cryptography\n */\n\nimport { CIPHER, CURVE, MAC, FORMAT } from \"./constants\";\nimport { fromHex, toHex } from \"viem\";\n\n/**\n * Represents ECIES encrypted data in eccrypto-compatible format.\n *\n * @remarks\n * This structure maintains backward compatibility with data encrypted using\n * the legacy eccrypto library.\n */\nexport interface ECIESEncrypted {\n  /** Initialization vector (16 bytes) */\n  iv: Uint8Array;\n  /** Ephemeral public key (65 bytes uncompressed) */\n  ephemPublicKey: Uint8Array;\n  /** Encrypted data */\n  ciphertext: Uint8Array;\n  /** Message authentication code (32 bytes) */\n  mac: Uint8Array;\n}\n\n/**\n * Provides ECIES encryption and decryption operations.\n *\n * @remarks\n * Platform-specific implementations handle the underlying cryptographic primitives\n * while maintaining consistent data format across environments.\n *\n * @category Cryptography\n */\nexport interface ECIESProvider {\n  /**\n   * Encrypts data using ECIES with secp256k1.\n   *\n   * @param publicKey - Recipient's public key (65 bytes uncompressed or 33 bytes compressed).\n   *   Obtain via `vana.server.getIdentity(userAddress).public_key`.\n   * @param message - Data to encrypt.\n   * @returns Encrypted data structure compatible with eccrypto format.\n   * @throws {ECIESError} When public key is invalid.\n   *   Verify key format matches secp256k1 requirements.\n   *\n   * @example\n   * ```typescript\n   * const encrypted = await provider.encrypt(\n   *   fromHex(publicKey, 'bytes'),\n   *   new TextEncoder().encode('sensitive data')\n   * );\n   * ```\n   */\n  encrypt(publicKey: Uint8Array, message: Uint8Array): Promise<ECIESEncrypted>;\n\n  /**\n   * Decrypts ECIES encrypted data.\n   *\n   * @param privateKey - Recipient's private key (32 bytes).\n   * @param encrypted - Encrypted data structure from `encrypt()` or legacy eccrypto.\n   * @returns Decrypted message as Uint8Array.\n   * @throws {ECIESError} When MAC verification fails.\n   *   Ensure the private key matches the public key used for encryption.\n   *\n   * @example\n   * ```typescript\n   * const decrypted = await provider.decrypt(\n   *   fromHex(privateKey, 'bytes'),\n   *   encrypted\n   * );\n   * const message = new TextDecoder().decode(decrypted);\n   * ```\n   */\n  decrypt(\n    privateKey: Uint8Array,\n    encrypted: ECIESEncrypted,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Normalizes a public key to uncompressed format (65 bytes with 0x04 prefix).\n   *\n   * @remarks\n   * Strict policy: Only accepts properly formatted compressed (33 bytes) or\n   * uncompressed (65 bytes) public keys. Does not accept 64-byte raw coordinates\n   * to ensure data integrity and prevent masking of malformed inputs.\n   *\n   * @param publicKey - Public key in compressed or uncompressed format\n   * @returns Normalized uncompressed public key (65 bytes with 0x04 prefix)\n   * @throws {Error} When public key format is invalid, including raw coordinates (64 bytes)\n   * @throws {Error} When decompression of compressed key fails\n   *\n   * @example\n   * ```typescript\n   * // Compressed key (33 bytes)\n   * const compressed = new Uint8Array(33);\n   * compressed[0] = 0x02;\n   * const uncompressed = provider.normalizeToUncompressed(compressed);\n   * console.log(uncompressed.length); // 65\n   * console.log(uncompressed[0]); // 0x04\n   *\n   * // Already uncompressed (65 bytes)\n   * const already = provider.normalizeToUncompressed(uncompressedKey);\n   * console.log(already === uncompressedKey); // true (returns same reference)\n   *\n   * // Raw coordinates rejected (64 bytes)\n   * const raw = new Uint8Array(64);\n   * provider.normalizeToUncompressed(raw); // Throws error\n   * ```\n   */\n  normalizeToUncompressed(publicKey: Uint8Array): Uint8Array;\n}\n\n/**\n * Configures ECIES operation behavior.\n */\nexport interface ECIESOptions {\n  /** Use compressed public keys (33 bytes) instead of uncompressed (65 bytes) */\n  useCompressed?: boolean;\n}\n\n/**\n * Represents failures in ECIES cryptographic operations.\n *\n * @remarks\n * Provides specific error codes to help identify and recover from\n * different failure scenarios.\n *\n * @category Errors\n */\nexport class ECIESError extends Error {\n  constructor(\n    message: string,\n    public readonly code:\n      | \"INVALID_KEY\"\n      | \"ENCRYPTION_FAILED\"\n      | \"DECRYPTION_FAILED\"\n      | \"MAC_MISMATCH\"\n      | \"ECDH_FAILED\",\n    public override readonly cause?: Error,\n  ) {\n    super(message);\n    this.name = \"ECIESError\";\n  }\n}\n\n/**\n * Validates if an object conforms to the ECIESEncrypted structure.\n *\n * @param obj - Object to validate.\n * @returns `true` if object is a valid ECIESEncrypted structure.\n *\n * @example\n * ```typescript\n * if (isECIESEncrypted(data)) {\n *   const decrypted = await provider.decrypt(privateKey, data);\n * }\n * ```\n */\nexport function isECIESEncrypted(obj: unknown): obj is ECIESEncrypted {\n  if (!obj || typeof obj !== \"object\") return false;\n  const enc = obj as Record<string, unknown>;\n\n  const isUint8Array = (value: unknown): value is Uint8Array => {\n    return (\n      value instanceof Uint8Array ||\n      (typeof Buffer !== \"undefined\" && Buffer.isBuffer(value))\n    );\n  };\n\n  return (\n    isUint8Array(enc.iv) &&\n    enc.iv.length === CIPHER.IV_LENGTH &&\n    isUint8Array(enc.ephemPublicKey) &&\n    (enc.ephemPublicKey.length === CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH ||\n      enc.ephemPublicKey.length === CURVE.COMPRESSED_PUBLIC_KEY_LENGTH) &&\n    isUint8Array(enc.ciphertext) &&\n    enc.ciphertext.length > 0 &&\n    isUint8Array(enc.mac) &&\n    enc.mac.length === MAC.LENGTH\n  );\n}\n\n/**\n * Serializes ECIESEncrypted to hex string for storage or transmission.\n *\n * @param encrypted - Encrypted data structure from `encrypt()`.\n * @returns Hex string representation.\n *\n * @example\n * ```typescript\n * const hexString = serializeECIES(encrypted);\n * // Store hexString in database or send over network\n * ```\n */\nexport function serializeECIES(encrypted: ECIESEncrypted): string {\n  const combined = new Uint8Array(\n    encrypted.iv.length +\n      encrypted.ephemPublicKey.length +\n      encrypted.ciphertext.length +\n      encrypted.mac.length,\n  );\n\n  let offset = 0;\n  combined.set(encrypted.iv, offset);\n  offset += encrypted.iv.length;\n  combined.set(encrypted.ephemPublicKey, offset);\n  offset += encrypted.ephemPublicKey.length;\n  combined.set(encrypted.ciphertext, offset);\n  offset += encrypted.ciphertext.length;\n  combined.set(encrypted.mac, offset);\n\n  return toHex(combined).slice(2);\n}\n\n/**\n * Deserializes hex string to ECIESEncrypted structure.\n *\n * @param hex - Hex string from `serializeECIES()` or storage.\n * @returns ECIESEncrypted structure ready for decryption.\n * @throws {ECIESError} When hex string format is invalid.\n *   Verify the hex string is complete and uncorrupted.\n *\n * @example\n * ```typescript\n * const encrypted = deserializeECIES(hexString);\n * const decrypted = await provider.decrypt(privateKey, encrypted);\n * ```\n */\nexport function deserializeECIES(hex: string): ECIESEncrypted {\n  const hexWithPrefix = hex.startsWith(\"0x\") ? hex : `0x${hex}`;\n  const bytes = fromHex(hexWithPrefix as `0x${string}`, \"bytes\");\n\n  // Check minimum length before accessing prefix byte\n  // Need at least: IV (16 bytes) + 1 byte for prefix check + MAC (32 bytes) + 1 byte ciphertext\n  const absoluteMinLength = FORMAT.IV_LENGTH + 1 + MAC.LENGTH + 1;\n  if (bytes.length < absoluteMinLength) {\n    throw new ECIESError(\n      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${absoluteMinLength} bytes required)`,\n      \"DECRYPTION_FAILED\",\n    );\n  }\n\n  // Validate ephemeral public key prefix (must be uncompressed for eccrypto compatibility)\n  const prefix = bytes[FORMAT.EPHEMERAL_KEY_OFFSET];\n\n  if (prefix !== CURVE.PREFIX.UNCOMPRESSED) {\n    throw new ECIESError(\n      `Invalid ephemeral public key: must be uncompressed format (0x04 prefix), got 0x${prefix.toString(16).padStart(2, \"0\")}`,\n      \"DECRYPTION_FAILED\",\n    );\n  }\n\n  const ephemKeySize = CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH;\n\n  const minLength = FORMAT.IV_LENGTH + ephemKeySize + MAC.LENGTH + 1; // +1 for at least 1 byte of ciphertext\n  if (bytes.length < minLength) {\n    throw new ECIESError(\n      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${minLength} bytes required)`,\n      \"DECRYPTION_FAILED\",\n    );\n  }\n\n  return {\n    iv: bytes.subarray(FORMAT.IV_OFFSET, FORMAT.IV_OFFSET + FORMAT.IV_LENGTH),\n    ephemPublicKey: bytes.subarray(\n      FORMAT.EPHEMERAL_KEY_OFFSET,\n      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize,\n    ),\n    ciphertext: bytes.subarray(\n      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize,\n      bytes.length - MAC.LENGTH,\n    ),\n    mac: bytes.subarray(bytes.length - MAC.LENGTH),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcA,uBAA2C;AAC3C,kBAA+B;AA4HxB,MAAM,mBAAmB,MAAM;AAAA,EACpC,YACE,SACgB,MAMS,OACzB;AACA,UAAM,OAAO;AARG;AAMS;AAGzB,SAAK,OAAO;AAAA,EACd;AAAA,EAVkB;AAAA,EAMS;AAK7B;AAeO,SAAS,iBAAiB,KAAqC;AACpE,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,MAAM;AAEZ,QAAM,eAAe,CAAC,UAAwC;AAC5D,WACE,iBAAiB,cAChB,OAAO,WAAW,eAAe,OAAO,SAAS,KAAK;AAAA,EAE3D;AAEA,SACE,aAAa,IAAI,EAAE,KACnB,IAAI,GAAG,WAAW,wBAAO,aACzB,aAAa,IAAI,cAAc,MAC9B,IAAI,eAAe,WAAW,uBAAM,kCACnC,IAAI,eAAe,WAAW,uBAAM,iCACtC,aAAa,IAAI,UAAU,KAC3B,IAAI,WAAW,SAAS,KACxB,aAAa,IAAI,GAAG,KACpB,IAAI,IAAI,WAAW,qBAAI;AAE3B;AAcO,SAAS,eAAe,WAAmC;AAChE,QAAM,WAAW,IAAI;AAAA,IACnB,UAAU,GAAG,SACX,UAAU,eAAe,SACzB,UAAU,WAAW,SACrB,UAAU,IAAI;AAAA,EAClB;AAEA,MAAI,SAAS;AACb,WAAS,IAAI,UAAU,IAAI,MAAM;AACjC,YAAU,UAAU,GAAG;AACvB,WAAS,IAAI,UAAU,gBAAgB,MAAM;AAC7C,YAAU,UAAU,eAAe;AACnC,WAAS,IAAI,UAAU,YAAY,MAAM;AACzC,YAAU,UAAU,WAAW;AAC/B,WAAS,IAAI,UAAU,KAAK,MAAM;AAElC,aAAO,mBAAM,QAAQ,EAAE,MAAM,CAAC;AAChC;AAgBO,SAAS,iBAAiB,KAA6B;AAC5D,QAAM,gBAAgB,IAAI,WAAW,IAAI,IAAI,MAAM,KAAK,GAAG;AAC3D,QAAM,YAAQ,qBAAQ,eAAgC,OAAO;AAI7D,QAAM,oBAAoB,wBAAO,YAAY,IAAI,qBAAI,SAAS;AAC9D,MAAI,MAAM,SAAS,mBAAmB;AACpC,UAAM,IAAI;AAAA,MACR,kCAAkC,MAAM,MAAM,mBAAmB,iBAAiB;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AAGA,QAAM,SAAS,MAAM,wBAAO,oBAAoB;AAEhD,MAAI,WAAW,uBAAM,OAAO,cAAc;AACxC,UAAM,IAAI;AAAA,MACR,kFAAkF,OAAO,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,MACtH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,eAAe,uBAAM;AAE3B,QAAM,YAAY,wBAAO,YAAY,eAAe,qBAAI,SAAS;AACjE,MAAI,MAAM,SAAS,WAAW;AAC5B,UAAM,IAAI;AAAA,MACR,kCAAkC,MAAM,MAAM,mBAAmB,SAAS;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI,MAAM,SAAS,wBAAO,WAAW,wBAAO,YAAY,wBAAO,SAAS;AAAA,IACxE,gBAAgB,MAAM;AAAA,MACpB,wBAAO;AAAA,MACP,wBAAO,uBAAuB;AAAA,IAChC;AAAA,IACA,YAAY,MAAM;AAAA,MAChB,wBAAO,uBAAuB;AAAA,MAC9B,MAAM,SAAS,qBAAI;AAAA,IACrB;AAAA,IACA,KAAK,MAAM,SAAS,MAAM,SAAS,qBAAI,MAAM;AAAA,EAC/C;AACF;","names":[]}

package/dist/crypto/ecies/interface.js

@@ -7,6 +7,8 @@ class ECIESError extends Error {
     this.cause = cause;
     this.name = "ECIESError";
   }
+  code;
+  cause;
 }
 function isECIESEncrypted(obj) {
   if (!obj || typeof obj !== "object") return false;

package/dist/crypto/ecies/interface.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/crypto/ecies/interface.ts"],"sourcesContent":["/**\n * ECIES (Elliptic Curve Integrated Encryption Scheme) Interface\n *\n * @remarks\n * Defines the contract for platform-specific ECIES implementations.\n * All implementations maintain compatibility with the eccrypto format to ensure\n * backward compatibility with existing encrypted data.\n *\n * **Format specification:**\n * `[iv (16 bytes)][ephemPublicKey (65 bytes)][ciphertext (variable)][mac (32 bytes)]`\n *\n * @category Cryptography\n */\n\nimport { CIPHER, CURVE, MAC, FORMAT } from \"./constants\";\nimport { fromHex, toHex } from \"viem\";\n\n/**\n * Represents ECIES encrypted data in eccrypto-compatible format.\n *\n * @remarks\n * This structure maintains backward compatibility with data encrypted using\n * the legacy eccrypto library.\n */\nexport interface ECIESEncrypted {\n  /** Initialization vector (16 bytes) */\n  iv: Uint8Array;\n  /** Ephemeral public key (65 bytes uncompressed) */\n  ephemPublicKey: Uint8Array;\n  /** Encrypted data */\n  ciphertext: Uint8Array;\n  /** Message authentication code (32 bytes) */\n  mac: Uint8Array;\n}\n\n/**\n * Provides ECIES encryption and decryption operations.\n *\n * @remarks\n * Platform-specific implementations handle the underlying cryptographic primitives\n * while maintaining consistent data format across environments.\n *\n * @category Cryptography\n */\nexport interface ECIESProvider {\n  /**\n   * Encrypts data using ECIES with secp256k1.\n   *\n   * @param publicKey - Recipient's public key (65 bytes uncompressed or 33 bytes compressed).\n   *   Obtain via `vana.server.getIdentity(userAddress).public_key`.\n   * @param message - Data to encrypt.\n   * @returns Encrypted data structure compatible with eccrypto format.\n   * @throws {ECIESError} When public key is invalid.\n   *   Verify key format matches secp256k1 requirements.\n   *\n   * @example\n   * ```typescript\n   * const encrypted = await provider.encrypt(\n   *   fromHex(publicKey, 'bytes'),\n   *   new TextEncoder().encode('sensitive data')\n   * );\n   * ```\n   */\n  encrypt(publicKey: Uint8Array, message: Uint8Array): Promise<ECIESEncrypted>;\n\n  /**\n   * Decrypts ECIES encrypted data.\n   *\n   * @param privateKey - Recipient's private key (32 bytes).\n   * @param encrypted - Encrypted data structure from `encrypt()` or legacy eccrypto.\n   * @returns Decrypted message as Uint8Array.\n   * @throws {ECIESError} When MAC verification fails.\n   *   Ensure the private key matches the public key used for encryption.\n   *\n   * @example\n   * ```typescript\n   * const decrypted = await provider.decrypt(\n   *   fromHex(privateKey, 'bytes'),\n   *   encrypted\n   * );\n   * const message = new TextDecoder().decode(decrypted);\n   * ```\n   */\n  decrypt(\n    privateKey: Uint8Array,\n    encrypted: ECIESEncrypted,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Normalizes a public key to uncompressed format (65 bytes with 0x04 prefix).\n   *\n   * @remarks\n   * Strict policy: Only accepts properly formatted compressed (33 bytes) or\n   * uncompressed (65 bytes) public keys. Does not accept 64-byte raw coordinates\n   * to ensure data integrity and prevent masking of malformed inputs.\n   *\n   * @param publicKey - Public key in compressed or uncompressed format\n   * @returns Normalized uncompressed public key (65 bytes with 0x04 prefix)\n   * @throws {Error} When public key format is invalid, including raw coordinates (64 bytes)\n   * @throws {Error} When decompression of compressed key fails\n   *\n   * @example\n   * ```typescript\n   * // Compressed key (33 bytes)\n   * const compressed = new Uint8Array(33);\n   * compressed[0] = 0x02;\n   * const uncompressed = provider.normalizeToUncompressed(compressed);\n   * console.log(uncompressed.length); // 65\n   * console.log(uncompressed[0]); // 0x04\n   *\n   * // Already uncompressed (65 bytes)\n   * const already = provider.normalizeToUncompressed(uncompressedKey);\n   * console.log(already === uncompressedKey); // true (returns same reference)\n   *\n   * // Raw coordinates rejected (64 bytes)\n   * const raw = new Uint8Array(64);\n   * provider.normalizeToUncompressed(raw); // Throws error\n   * ```\n   */\n  normalizeToUncompressed(publicKey: Uint8Array): Uint8Array;\n}\n\n/**\n * Configures ECIES operation behavior.\n */\nexport interface ECIESOptions {\n  /** Use compressed public keys (33 bytes) instead of uncompressed (65 bytes) */\n  useCompressed?: boolean;\n}\n\n/**\n * Represents failures in ECIES cryptographic operations.\n *\n * @remarks\n * Provides specific error codes to help identify and recover from\n * different failure scenarios.\n *\n * @category Errors\n */\nexport class ECIESError extends Error {\n  constructor(\n    message: string,\n    public readonly code:\n      | \"INVALID_KEY\"\n      | \"ENCRYPTION_FAILED\"\n      | \"DECRYPTION_FAILED\"\n      | \"MAC_MISMATCH\"\n      | \"ECDH_FAILED\",\n    public override readonly cause?: Error,\n  ) {\n    super(message);\n    this.name = \"ECIESError\";\n  }\n}\n\n/**\n * Validates if an object conforms to the ECIESEncrypted structure.\n *\n * @param obj - Object to validate.\n * @returns `true` if object is a valid ECIESEncrypted structure.\n *\n * @example\n * ```typescript\n * if (isECIESEncrypted(data)) {\n *   const decrypted = await provider.decrypt(privateKey, data);\n * }\n * ```\n */\nexport function isECIESEncrypted(obj: unknown): obj is ECIESEncrypted {\n  if (!obj || typeof obj !== \"object\") return false;\n  const enc = obj as Record<string, unknown>;\n\n  const isUint8Array = (value: unknown): value is Uint8Array => {\n    return (\n      value instanceof Uint8Array ||\n      (typeof Buffer !== \"undefined\" && Buffer.isBuffer(value))\n    );\n  };\n\n  return (\n    isUint8Array(enc.iv) &&\n    enc.iv.length === CIPHER.IV_LENGTH &&\n    isUint8Array(enc.ephemPublicKey) &&\n    (enc.ephemPublicKey.length === CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH ||\n      enc.ephemPublicKey.length === CURVE.COMPRESSED_PUBLIC_KEY_LENGTH) &&\n    isUint8Array(enc.ciphertext) &&\n    enc.ciphertext.length > 0 &&\n    isUint8Array(enc.mac) &&\n    enc.mac.length === MAC.LENGTH\n  );\n}\n\n/**\n * Serializes ECIESEncrypted to hex string for storage or transmission.\n *\n * @param encrypted - Encrypted data structure from `encrypt()`.\n * @returns Hex string representation.\n *\n * @example\n * ```typescript\n * const hexString = serializeECIES(encrypted);\n * // Store hexString in database or send over network\n * ```\n */\nexport function serializeECIES(encrypted: ECIESEncrypted): string {\n  const combined = new Uint8Array(\n    encrypted.iv.length +\n      encrypted.ephemPublicKey.length +\n      encrypted.ciphertext.length +\n      encrypted.mac.length,\n  );\n\n  let offset = 0;\n  combined.set(encrypted.iv, offset);\n  offset += encrypted.iv.length;\n  combined.set(encrypted.ephemPublicKey, offset);\n  offset += encrypted.ephemPublicKey.length;\n  combined.set(encrypted.ciphertext, offset);\n  offset += encrypted.ciphertext.length;\n  combined.set(encrypted.mac, offset);\n\n  return toHex(combined).slice(2);\n}\n\n/**\n * Deserializes hex string to ECIESEncrypted structure.\n *\n * @param hex - Hex string from `serializeECIES()` or storage.\n * @returns ECIESEncrypted structure ready for decryption.\n * @throws {ECIESError} When hex string format is invalid.\n *   Verify the hex string is complete and uncorrupted.\n *\n * @example\n * ```typescript\n * const encrypted = deserializeECIES(hexString);\n * const decrypted = await provider.decrypt(privateKey, encrypted);\n * ```\n */\nexport function deserializeECIES(hex: string): ECIESEncrypted {\n  const hexWithPrefix = hex.startsWith(\"0x\") ? hex : `0x${hex}`;\n  const bytes = fromHex(hexWithPrefix as `0x${string}`, \"bytes\");\n\n  // Check minimum length before accessing prefix byte\n  // Need at least: IV (16 bytes) + 1 byte for prefix check + MAC (32 bytes) + 1 byte ciphertext\n  const absoluteMinLength = FORMAT.IV_LENGTH + 1 + MAC.LENGTH + 1;\n  if (bytes.length < absoluteMinLength) {\n    throw new ECIESError(\n      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${absoluteMinLength} bytes required)`,\n      \"DECRYPTION_FAILED\",\n    );\n  }\n\n  // Validate ephemeral public key prefix (must be uncompressed for eccrypto compatibility)\n  const prefix = bytes[FORMAT.EPHEMERAL_KEY_OFFSET];\n\n  if (prefix !== CURVE.PREFIX.UNCOMPRESSED) {\n    throw new ECIESError(\n      `Invalid ephemeral public key: must be uncompressed format (0x04 prefix), got 0x${prefix.toString(16).padStart(2, \"0\")}`,\n      \"DECRYPTION_FAILED\",\n    );\n  }\n\n  const ephemKeySize = CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH;\n\n  const minLength = FORMAT.IV_LENGTH + ephemKeySize + MAC.LENGTH + 1; // +1 for at least 1 byte of ciphertext\n  if (bytes.length < minLength) {\n    throw new ECIESError(\n      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${minLength} bytes required)`,\n      \"DECRYPTION_FAILED\",\n    );\n  }\n\n  return {\n    iv: bytes.subarray(FORMAT.IV_OFFSET, FORMAT.IV_OFFSET + FORMAT.IV_LENGTH),\n    ephemPublicKey: bytes.subarray(\n      FORMAT.EPHEMERAL_KEY_OFFSET,\n      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize,\n    ),\n    ciphertext: bytes.subarray(\n      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize,\n      bytes.length - MAC.LENGTH,\n    ),\n    mac: bytes.subarray(bytes.length - MAC.LENGTH),\n  };\n}\n"],"mappings":"AAcA,SAAS,QAAQ,OAAO,KAAK,cAAc;AAC3C,SAAS,SAAS,aAAa;AA4HxB,MAAM,mBAAmB,MAAM;AAAA,EACpC,YACE,SACgB,MAMS,OACzB;AACA,UAAM,OAAO;AARG;AAMS;AAGzB,SAAK,OAAO;AAAA,EACd;AACF;AAeO,SAAS,iBAAiB,KAAqC;AACpE,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,MAAM;AAEZ,QAAM,eAAe,CAAC,UAAwC;AAC5D,WACE,iBAAiB,cAChB,OAAO,WAAW,eAAe,OAAO,SAAS,KAAK;AAAA,EAE3D;AAEA,SACE,aAAa,IAAI,EAAE,KACnB,IAAI,GAAG,WAAW,OAAO,aACzB,aAAa,IAAI,cAAc,MAC9B,IAAI,eAAe,WAAW,MAAM,kCACnC,IAAI,eAAe,WAAW,MAAM,iCACtC,aAAa,IAAI,UAAU,KAC3B,IAAI,WAAW,SAAS,KACxB,aAAa,IAAI,GAAG,KACpB,IAAI,IAAI,WAAW,IAAI;AAE3B;AAcO,SAAS,eAAe,WAAmC;AAChE,QAAM,WAAW,IAAI;AAAA,IACnB,UAAU,GAAG,SACX,UAAU,eAAe,SACzB,UAAU,WAAW,SACrB,UAAU,IAAI;AAAA,EAClB;AAEA,MAAI,SAAS;AACb,WAAS,IAAI,UAAU,IAAI,MAAM;AACjC,YAAU,UAAU,GAAG;AACvB,WAAS,IAAI,UAAU,gBAAgB,MAAM;AAC7C,YAAU,UAAU,eAAe;AACnC,WAAS,IAAI,UAAU,YAAY,MAAM;AACzC,YAAU,UAAU,WAAW;AAC/B,WAAS,IAAI,UAAU,KAAK,MAAM;AAElC,SAAO,MAAM,QAAQ,EAAE,MAAM,CAAC;AAChC;AAgBO,SAAS,iBAAiB,KAA6B;AAC5D,QAAM,gBAAgB,IAAI,WAAW,IAAI,IAAI,MAAM,KAAK,GAAG;AAC3D,QAAM,QAAQ,QAAQ,eAAgC,OAAO;AAI7D,QAAM,oBAAoB,OAAO,YAAY,IAAI,IAAI,SAAS;AAC9D,MAAI,MAAM,SAAS,mBAAmB;AACpC,UAAM,IAAI;AAAA,MACR,kCAAkC,MAAM,MAAM,mBAAmB,iBAAiB;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AAGA,QAAM,SAAS,MAAM,OAAO,oBAAoB;AAEhD,MAAI,WAAW,MAAM,OAAO,cAAc;AACxC,UAAM,IAAI;AAAA,MACR,kFAAkF,OAAO,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,MACtH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,eAAe,MAAM;AAE3B,QAAM,YAAY,OAAO,YAAY,eAAe,IAAI,SAAS;AACjE,MAAI,MAAM,SAAS,WAAW;AAC5B,UAAM,IAAI;AAAA,MACR,kCAAkC,MAAM,MAAM,mBAAmB,SAAS;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI,MAAM,SAAS,OAAO,WAAW,OAAO,YAAY,OAAO,SAAS;AAAA,IACxE,gBAAgB,MAAM;AAAA,MACpB,OAAO;AAAA,MACP,OAAO,uBAAuB;AAAA,IAChC;AAAA,IACA,YAAY,MAAM;AAAA,MAChB,OAAO,uBAAuB;AAAA,MAC9B,MAAM,SAAS,IAAI;AAAA,IACrB;AAAA,IACA,KAAK,MAAM,SAAS,MAAM,SAAS,IAAI,MAAM;AAAA,EAC/C;AACF;","names":[]}
+{"version":3,"sources":["../../../src/crypto/ecies/interface.ts"],"sourcesContent":["/**\n * ECIES (Elliptic Curve Integrated Encryption Scheme) Interface\n *\n * @remarks\n * Defines the contract for platform-specific ECIES implementations.\n * All implementations maintain compatibility with the eccrypto format to ensure\n * backward compatibility with existing encrypted data.\n *\n * **Format specification:**\n * `[iv (16 bytes)][ephemPublicKey (65 bytes)][ciphertext (variable)][mac (32 bytes)]`\n *\n * @category Cryptography\n */\n\nimport { CIPHER, CURVE, MAC, FORMAT } from \"./constants\";\nimport { fromHex, toHex } from \"viem\";\n\n/**\n * Represents ECIES encrypted data in eccrypto-compatible format.\n *\n * @remarks\n * This structure maintains backward compatibility with data encrypted using\n * the legacy eccrypto library.\n */\nexport interface ECIESEncrypted {\n  /** Initialization vector (16 bytes) */\n  iv: Uint8Array;\n  /** Ephemeral public key (65 bytes uncompressed) */\n  ephemPublicKey: Uint8Array;\n  /** Encrypted data */\n  ciphertext: Uint8Array;\n  /** Message authentication code (32 bytes) */\n  mac: Uint8Array;\n}\n\n/**\n * Provides ECIES encryption and decryption operations.\n *\n * @remarks\n * Platform-specific implementations handle the underlying cryptographic primitives\n * while maintaining consistent data format across environments.\n *\n * @category Cryptography\n */\nexport interface ECIESProvider {\n  /**\n   * Encrypts data using ECIES with secp256k1.\n   *\n   * @param publicKey - Recipient's public key (65 bytes uncompressed or 33 bytes compressed).\n   *   Obtain via `vana.server.getIdentity(userAddress).public_key`.\n   * @param message - Data to encrypt.\n   * @returns Encrypted data structure compatible with eccrypto format.\n   * @throws {ECIESError} When public key is invalid.\n   *   Verify key format matches secp256k1 requirements.\n   *\n   * @example\n   * ```typescript\n   * const encrypted = await provider.encrypt(\n   *   fromHex(publicKey, 'bytes'),\n   *   new TextEncoder().encode('sensitive data')\n   * );\n   * ```\n   */\n  encrypt(publicKey: Uint8Array, message: Uint8Array): Promise<ECIESEncrypted>;\n\n  /**\n   * Decrypts ECIES encrypted data.\n   *\n   * @param privateKey - Recipient's private key (32 bytes).\n   * @param encrypted - Encrypted data structure from `encrypt()` or legacy eccrypto.\n   * @returns Decrypted message as Uint8Array.\n   * @throws {ECIESError} When MAC verification fails.\n   *   Ensure the private key matches the public key used for encryption.\n   *\n   * @example\n   * ```typescript\n   * const decrypted = await provider.decrypt(\n   *   fromHex(privateKey, 'bytes'),\n   *   encrypted\n   * );\n   * const message = new TextDecoder().decode(decrypted);\n   * ```\n   */\n  decrypt(\n    privateKey: Uint8Array,\n    encrypted: ECIESEncrypted,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Normalizes a public key to uncompressed format (65 bytes with 0x04 prefix).\n   *\n   * @remarks\n   * Strict policy: Only accepts properly formatted compressed (33 bytes) or\n   * uncompressed (65 bytes) public keys. Does not accept 64-byte raw coordinates\n   * to ensure data integrity and prevent masking of malformed inputs.\n   *\n   * @param publicKey - Public key in compressed or uncompressed format\n   * @returns Normalized uncompressed public key (65 bytes with 0x04 prefix)\n   * @throws {Error} When public key format is invalid, including raw coordinates (64 bytes)\n   * @throws {Error} When decompression of compressed key fails\n   *\n   * @example\n   * ```typescript\n   * // Compressed key (33 bytes)\n   * const compressed = new Uint8Array(33);\n   * compressed[0] = 0x02;\n   * const uncompressed = provider.normalizeToUncompressed(compressed);\n   * console.log(uncompressed.length); // 65\n   * console.log(uncompressed[0]); // 0x04\n   *\n   * // Already uncompressed (65 bytes)\n   * const already = provider.normalizeToUncompressed(uncompressedKey);\n   * console.log(already === uncompressedKey); // true (returns same reference)\n   *\n   * // Raw coordinates rejected (64 bytes)\n   * const raw = new Uint8Array(64);\n   * provider.normalizeToUncompressed(raw); // Throws error\n   * ```\n   */\n  normalizeToUncompressed(publicKey: Uint8Array): Uint8Array;\n}\n\n/**\n * Configures ECIES operation behavior.\n */\nexport interface ECIESOptions {\n  /** Use compressed public keys (33 bytes) instead of uncompressed (65 bytes) */\n  useCompressed?: boolean;\n}\n\n/**\n * Represents failures in ECIES cryptographic operations.\n *\n * @remarks\n * Provides specific error codes to help identify and recover from\n * different failure scenarios.\n *\n * @category Errors\n */\nexport class ECIESError extends Error {\n  constructor(\n    message: string,\n    public readonly code:\n      | \"INVALID_KEY\"\n      | \"ENCRYPTION_FAILED\"\n      | \"DECRYPTION_FAILED\"\n      | \"MAC_MISMATCH\"\n      | \"ECDH_FAILED\",\n    public override readonly cause?: Error,\n  ) {\n    super(message);\n    this.name = \"ECIESError\";\n  }\n}\n\n/**\n * Validates if an object conforms to the ECIESEncrypted structure.\n *\n * @param obj - Object to validate.\n * @returns `true` if object is a valid ECIESEncrypted structure.\n *\n * @example\n * ```typescript\n * if (isECIESEncrypted(data)) {\n *   const decrypted = await provider.decrypt(privateKey, data);\n * }\n * ```\n */\nexport function isECIESEncrypted(obj: unknown): obj is ECIESEncrypted {\n  if (!obj || typeof obj !== \"object\") return false;\n  const enc = obj as Record<string, unknown>;\n\n  const isUint8Array = (value: unknown): value is Uint8Array => {\n    return (\n      value instanceof Uint8Array ||\n      (typeof Buffer !== \"undefined\" && Buffer.isBuffer(value))\n    );\n  };\n\n  return (\n    isUint8Array(enc.iv) &&\n    enc.iv.length === CIPHER.IV_LENGTH &&\n    isUint8Array(enc.ephemPublicKey) &&\n    (enc.ephemPublicKey.length === CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH ||\n      enc.ephemPublicKey.length === CURVE.COMPRESSED_PUBLIC_KEY_LENGTH) &&\n    isUint8Array(enc.ciphertext) &&\n    enc.ciphertext.length > 0 &&\n    isUint8Array(enc.mac) &&\n    enc.mac.length === MAC.LENGTH\n  );\n}\n\n/**\n * Serializes ECIESEncrypted to hex string for storage or transmission.\n *\n * @param encrypted - Encrypted data structure from `encrypt()`.\n * @returns Hex string representation.\n *\n * @example\n * ```typescript\n * const hexString = serializeECIES(encrypted);\n * // Store hexString in database or send over network\n * ```\n */\nexport function serializeECIES(encrypted: ECIESEncrypted): string {\n  const combined = new Uint8Array(\n    encrypted.iv.length +\n      encrypted.ephemPublicKey.length +\n      encrypted.ciphertext.length +\n      encrypted.mac.length,\n  );\n\n  let offset = 0;\n  combined.set(encrypted.iv, offset);\n  offset += encrypted.iv.length;\n  combined.set(encrypted.ephemPublicKey, offset);\n  offset += encrypted.ephemPublicKey.length;\n  combined.set(encrypted.ciphertext, offset);\n  offset += encrypted.ciphertext.length;\n  combined.set(encrypted.mac, offset);\n\n  return toHex(combined).slice(2);\n}\n\n/**\n * Deserializes hex string to ECIESEncrypted structure.\n *\n * @param hex - Hex string from `serializeECIES()` or storage.\n * @returns ECIESEncrypted structure ready for decryption.\n * @throws {ECIESError} When hex string format is invalid.\n *   Verify the hex string is complete and uncorrupted.\n *\n * @example\n * ```typescript\n * const encrypted = deserializeECIES(hexString);\n * const decrypted = await provider.decrypt(privateKey, encrypted);\n * ```\n */\nexport function deserializeECIES(hex: string): ECIESEncrypted {\n  const hexWithPrefix = hex.startsWith(\"0x\") ? hex : `0x${hex}`;\n  const bytes = fromHex(hexWithPrefix as `0x${string}`, \"bytes\");\n\n  // Check minimum length before accessing prefix byte\n  // Need at least: IV (16 bytes) + 1 byte for prefix check + MAC (32 bytes) + 1 byte ciphertext\n  const absoluteMinLength = FORMAT.IV_LENGTH + 1 + MAC.LENGTH + 1;\n  if (bytes.length < absoluteMinLength) {\n    throw new ECIESError(\n      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${absoluteMinLength} bytes required)`,\n      \"DECRYPTION_FAILED\",\n    );\n  }\n\n  // Validate ephemeral public key prefix (must be uncompressed for eccrypto compatibility)\n  const prefix = bytes[FORMAT.EPHEMERAL_KEY_OFFSET];\n\n  if (prefix !== CURVE.PREFIX.UNCOMPRESSED) {\n    throw new ECIESError(\n      `Invalid ephemeral public key: must be uncompressed format (0x04 prefix), got 0x${prefix.toString(16).padStart(2, \"0\")}`,\n      \"DECRYPTION_FAILED\",\n    );\n  }\n\n  const ephemKeySize = CURVE.UNCOMPRESSED_PUBLIC_KEY_LENGTH;\n\n  const minLength = FORMAT.IV_LENGTH + ephemKeySize + MAC.LENGTH + 1; // +1 for at least 1 byte of ciphertext\n  if (bytes.length < minLength) {\n    throw new ECIESError(\n      `Invalid ECIES data: too short (${bytes.length} bytes, minimum ${minLength} bytes required)`,\n      \"DECRYPTION_FAILED\",\n    );\n  }\n\n  return {\n    iv: bytes.subarray(FORMAT.IV_OFFSET, FORMAT.IV_OFFSET + FORMAT.IV_LENGTH),\n    ephemPublicKey: bytes.subarray(\n      FORMAT.EPHEMERAL_KEY_OFFSET,\n      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize,\n    ),\n    ciphertext: bytes.subarray(\n      FORMAT.EPHEMERAL_KEY_OFFSET + ephemKeySize,\n      bytes.length - MAC.LENGTH,\n    ),\n    mac: bytes.subarray(bytes.length - MAC.LENGTH),\n  };\n}\n"],"mappings":"AAcA,SAAS,QAAQ,OAAO,KAAK,cAAc;AAC3C,SAAS,SAAS,aAAa;AA4HxB,MAAM,mBAAmB,MAAM;AAAA,EACpC,YACE,SACgB,MAMS,OACzB;AACA,UAAM,OAAO;AARG;AAMS;AAGzB,SAAK,OAAO;AAAA,EACd;AAAA,EAVkB;AAAA,EAMS;AAK7B;AAeO,SAAS,iBAAiB,KAAqC;AACpE,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,MAAM;AAEZ,QAAM,eAAe,CAAC,UAAwC;AAC5D,WACE,iBAAiB,cAChB,OAAO,WAAW,eAAe,OAAO,SAAS,KAAK;AAAA,EAE3D;AAEA,SACE,aAAa,IAAI,EAAE,KACnB,IAAI,GAAG,WAAW,OAAO,aACzB,aAAa,IAAI,cAAc,MAC9B,IAAI,eAAe,WAAW,MAAM,kCACnC,IAAI,eAAe,WAAW,MAAM,iCACtC,aAAa,IAAI,UAAU,KAC3B,IAAI,WAAW,SAAS,KACxB,aAAa,IAAI,GAAG,KACpB,IAAI,IAAI,WAAW,IAAI;AAE3B;AAcO,SAAS,eAAe,WAAmC;AAChE,QAAM,WAAW,IAAI;AAAA,IACnB,UAAU,GAAG,SACX,UAAU,eAAe,SACzB,UAAU,WAAW,SACrB,UAAU,IAAI;AAAA,EAClB;AAEA,MAAI,SAAS;AACb,WAAS,IAAI,UAAU,IAAI,MAAM;AACjC,YAAU,UAAU,GAAG;AACvB,WAAS,IAAI,UAAU,gBAAgB,MAAM;AAC7C,YAAU,UAAU,eAAe;AACnC,WAAS,IAAI,UAAU,YAAY,MAAM;AACzC,YAAU,UAAU,WAAW;AAC/B,WAAS,IAAI,UAAU,KAAK,MAAM;AAElC,SAAO,MAAM,QAAQ,EAAE,MAAM,CAAC;AAChC;AAgBO,SAAS,iBAAiB,KAA6B;AAC5D,QAAM,gBAAgB,IAAI,WAAW,IAAI,IAAI,MAAM,KAAK,GAAG;AAC3D,QAAM,QAAQ,QAAQ,eAAgC,OAAO;AAI7D,QAAM,oBAAoB,OAAO,YAAY,IAAI,IAAI,SAAS;AAC9D,MAAI,MAAM,SAAS,mBAAmB;AACpC,UAAM,IAAI;AAAA,MACR,kCAAkC,MAAM,MAAM,mBAAmB,iBAAiB;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AAGA,QAAM,SAAS,MAAM,OAAO,oBAAoB;AAEhD,MAAI,WAAW,MAAM,OAAO,cAAc;AACxC,UAAM,IAAI;AAAA,MACR,kFAAkF,OAAO,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,MACtH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,eAAe,MAAM;AAE3B,QAAM,YAAY,OAAO,YAAY,eAAe,IAAI,SAAS;AACjE,MAAI,MAAM,SAAS,WAAW;AAC5B,UAAM,IAAI;AAAA,MACR,kCAAkC,MAAM,MAAM,mBAAmB,SAAS;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI,MAAM,SAAS,OAAO,WAAW,OAAO,YAAY,OAAO,SAAS;AAAA,IACxE,gBAAgB,MAAM;AAAA,MACpB,OAAO;AAAA,MACP,OAAO,uBAAuB;AAAA,IAChC;AAAA,IACA,YAAY,MAAM;AAAA,MAChB,OAAO,uBAAuB;AAAA,MAC9B,MAAM,SAAS,IAAI;AAAA,IACrB;AAAA,IACA,KAAK,MAAM,SAAS,MAAM,SAAS,IAAI,MAAM;AAAA,EAC/C;AACF;","names":[]}

package/dist/crypto/envelope/openpgp.cjs

@@ -0,0 +1,59 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var openpgp_exports = {};
+__export(openpgp_exports, {
+  decryptWithPassword: () => decryptWithPassword,
+  encryptWithPassword: () => encryptWithPassword
+});
+module.exports = __toCommonJS(openpgp_exports);
+var openpgp = __toESM(require("openpgp"), 1);
+async function encryptWithPassword(plaintext, password) {
+  const message = await openpgp.createMessage({ binary: plaintext });
+  const encrypted = await openpgp.encrypt({
+    message,
+    passwords: [password],
+    format: "binary"
+  });
+  return encrypted;
+}
+async function decryptWithPassword(encrypted, password) {
+  const message = await openpgp.readMessage({ binaryMessage: encrypted });
+  const { data } = await openpgp.decrypt({
+    message,
+    passwords: [password],
+    format: "binary"
+  });
+  return data;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  decryptWithPassword,
+  encryptWithPassword
+});
+//# sourceMappingURL=openpgp.cjs.map

package/dist/crypto/envelope/openpgp.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/crypto/envelope/openpgp.ts"],"sourcesContent":["/**\n * Password-based file encryption using OpenPGP, the locked DPv1 envelope.\n *\n * @remarks\n * Ported from `personal-server-ts`\n * (`packages/core/src/storage/encryption/{encrypt,decrypt}.ts`).\n * The binary format must remain byte-compatible with PS — a vana-sdk encrypt +\n * a personal-server-ts decrypt (and vice versa) must round-trip cleanly.\n *\n * @category Cryptography\n */\n\nimport * as openpgp from \"openpgp\";\n\n/**\n * Encrypt plaintext using OpenPGP password-based encryption.\n *\n * @param plaintext - Bytes to encrypt (e.g. `JSON.stringify` of an envelope).\n * @param password - Hex-encoded scope key (typically from `deriveScopeKey`).\n * @returns OpenPGP-encrypted binary data.\n */\nexport async function encryptWithPassword(\n  plaintext: Uint8Array,\n  password: string,\n): Promise<Uint8Array> {\n  const message = await openpgp.createMessage({ binary: plaintext });\n  const encrypted = await openpgp.encrypt({\n    message,\n    passwords: [password],\n    format: \"binary\",\n  });\n  return encrypted as Uint8Array;\n}\n\n/**\n * Decrypt an OpenPGP password-encrypted binary.\n *\n * @param encrypted - OpenPGP-encrypted binary data.\n * @param password - Hex-encoded scope key.\n * @returns Decrypted plaintext bytes.\n * @throws If the password is wrong or the data is corrupted.\n */\nexport async function decryptWithPassword(\n  encrypted: Uint8Array,\n  password: string,\n): Promise<Uint8Array> {\n  const message = await openpgp.readMessage({ binaryMessage: encrypted });\n  const { data } = await openpgp.decrypt({\n    message,\n    passwords: [password],\n    format: \"binary\",\n  });\n  return data as Uint8Array;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAYA,cAAyB;AASzB,eAAsB,oBACpB,WACA,UACqB;AACrB,QAAM,UAAU,MAAM,QAAQ,cAAc,EAAE,QAAQ,UAAU,CAAC;AACjE,QAAM,YAAY,MAAM,QAAQ,QAAQ;AAAA,IACtC;AAAA,IACA,WAAW,CAAC,QAAQ;AAAA,IACpB,QAAQ;AAAA,EACV,CAAC;AACD,SAAO;AACT;AAUA,eAAsB,oBACpB,WACA,UACqB;AACrB,QAAM,UAAU,MAAM,QAAQ,YAAY,EAAE,eAAe,UAAU,CAAC;AACtE,QAAM,EAAE,KAAK,IAAI,MAAM,QAAQ,QAAQ;AAAA,IACrC;AAAA,IACA,WAAW,CAAC,QAAQ;AAAA,IACpB,QAAQ;AAAA,EACV,CAAC;AACD,SAAO;AACT;","names":[]}

package/dist/crypto/envelope/openpgp.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Password-based file encryption using OpenPGP, the locked DPv1 envelope.
+ *
+ * @remarks
+ * Ported from `personal-server-ts`
+ * (`packages/core/src/storage/encryption/{encrypt,decrypt}.ts`).
+ * The binary format must remain byte-compatible with PS — a vana-sdk encrypt +
+ * a personal-server-ts decrypt (and vice versa) must round-trip cleanly.
+ *
+ * @category Cryptography
+ */
+/**
+ * Encrypt plaintext using OpenPGP password-based encryption.
+ *
+ * @param plaintext - Bytes to encrypt (e.g. `JSON.stringify` of an envelope).
+ * @param password - Hex-encoded scope key (typically from `deriveScopeKey`).
+ * @returns OpenPGP-encrypted binary data.
+ */
+export declare function encryptWithPassword(plaintext: Uint8Array, password: string): Promise<Uint8Array>;
+/**
+ * Decrypt an OpenPGP password-encrypted binary.
+ *
+ * @param encrypted - OpenPGP-encrypted binary data.
+ * @param password - Hex-encoded scope key.
+ * @returns Decrypted plaintext bytes.
+ * @throws If the password is wrong or the data is corrupted.
+ */
+export declare function decryptWithPassword(encrypted: Uint8Array, password: string): Promise<Uint8Array>;

package/dist/crypto/envelope/openpgp.js

@@ -0,0 +1,24 @@
+import * as openpgp from "openpgp";
+async function encryptWithPassword(plaintext, password) {
+  const message = await openpgp.createMessage({ binary: plaintext });
+  const encrypted = await openpgp.encrypt({
+    message,
+    passwords: [password],
+    format: "binary"
+  });
+  return encrypted;
+}
+async function decryptWithPassword(encrypted, password) {
+  const message = await openpgp.readMessage({ binaryMessage: encrypted });
+  const { data } = await openpgp.decrypt({
+    message,
+    passwords: [password],
+    format: "binary"
+  });
+  return data;
+}
+export {
+  decryptWithPassword,
+  encryptWithPassword
+};
+//# sourceMappingURL=openpgp.js.map

package/dist/crypto/envelope/openpgp.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/crypto/envelope/openpgp.ts"],"sourcesContent":["/**\n * Password-based file encryption using OpenPGP, the locked DPv1 envelope.\n *\n * @remarks\n * Ported from `personal-server-ts`\n * (`packages/core/src/storage/encryption/{encrypt,decrypt}.ts`).\n * The binary format must remain byte-compatible with PS — a vana-sdk encrypt +\n * a personal-server-ts decrypt (and vice versa) must round-trip cleanly.\n *\n * @category Cryptography\n */\n\nimport * as openpgp from \"openpgp\";\n\n/**\n * Encrypt plaintext using OpenPGP password-based encryption.\n *\n * @param plaintext - Bytes to encrypt (e.g. `JSON.stringify` of an envelope).\n * @param password - Hex-encoded scope key (typically from `deriveScopeKey`).\n * @returns OpenPGP-encrypted binary data.\n */\nexport async function encryptWithPassword(\n  plaintext: Uint8Array,\n  password: string,\n): Promise<Uint8Array> {\n  const message = await openpgp.createMessage({ binary: plaintext });\n  const encrypted = await openpgp.encrypt({\n    message,\n    passwords: [password],\n    format: \"binary\",\n  });\n  return encrypted as Uint8Array;\n}\n\n/**\n * Decrypt an OpenPGP password-encrypted binary.\n *\n * @param encrypted - OpenPGP-encrypted binary data.\n * @param password - Hex-encoded scope key.\n * @returns Decrypted plaintext bytes.\n * @throws If the password is wrong or the data is corrupted.\n */\nexport async function decryptWithPassword(\n  encrypted: Uint8Array,\n  password: string,\n): Promise<Uint8Array> {\n  const message = await openpgp.readMessage({ binaryMessage: encrypted });\n  const { data } = await openpgp.decrypt({\n    message,\n    passwords: [password],\n    format: \"binary\",\n  });\n  return data as Uint8Array;\n}\n"],"mappings":"AAYA,YAAY,aAAa;AASzB,eAAsB,oBACpB,WACA,UACqB;AACrB,QAAM,UAAU,MAAM,QAAQ,cAAc,EAAE,QAAQ,UAAU,CAAC;AACjE,QAAM,YAAY,MAAM,QAAQ,QAAQ;AAAA,IACtC;AAAA,IACA,WAAW,CAAC,QAAQ;AAAA,IACpB,QAAQ;AAAA,EACV,CAAC;AACD,SAAO;AACT;AAUA,eAAsB,oBACpB,WACA,UACqB;AACrB,QAAM,UAAU,MAAM,QAAQ,YAAY,EAAE,eAAe,UAAU,CAAC;AACtE,QAAM,EAAE,KAAK,IAAI,MAAM,QAAQ,QAAQ;AAAA,IACrC;AAAA,IACA,WAAW,CAAC,QAAQ;AAAA,IACpB,QAAQ;AAAA,EACV,CAAC;AACD,SAAO;AACT;","names":[]}

package/dist/crypto/keys/derive.cjs

@@ -0,0 +1,65 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var derive_exports = {};
+__export(derive_exports, {
+  MASTER_KEY_MESSAGE: () => MASTER_KEY_MESSAGE,
+  deriveMasterKey: () => deriveMasterKey,
+  deriveScopeKey: () => deriveScopeKey,
+  recoverServerOwner: () => recoverServerOwner
+});
+module.exports = __toCommonJS(derive_exports);
+var import_hkdf = require("@noble/hashes/hkdf");
+var import_sha2 = require("@noble/hashes/sha2");
+var import_viem = require("viem");
+const MASTER_KEY_MESSAGE = "vana-master-key-v1";
+function deriveMasterKey(signature) {
+  const hex = signature.slice(2);
+  if (hex.length !== 130) {
+    throw new Error(
+      `Invalid signature length: expected 130 hex chars (65 bytes), got ${hex.length}`
+    );
+  }
+  if (!/^[0-9a-fA-F]+$/.test(hex)) {
+    throw new Error("Invalid signature: contains non-hex characters");
+  }
+  const bytes = new Uint8Array(65);
+  for (let i = 0; i < 65; i++) {
+    bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+async function recoverServerOwner(masterKeySignature) {
+  return (0, import_viem.recoverMessageAddress)({
+    message: MASTER_KEY_MESSAGE,
+    signature: masterKeySignature
+  });
+}
+function deriveScopeKey(masterKey, scope) {
+  const salt = new TextEncoder().encode("vana");
+  const info = new TextEncoder().encode(`scope:${scope}`);
+  return (0, import_hkdf.hkdf)(import_sha2.sha256, masterKey, salt, info, 32);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MASTER_KEY_MESSAGE,
+  deriveMasterKey,
+  deriveScopeKey,
+  recoverServerOwner
+});
+//# sourceMappingURL=derive.cjs.map

package/dist/crypto/keys/derive.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/crypto/keys/derive.ts"],"sourcesContent":["/**\n * HKDF-based key derivation for the Vana Data Portability Protocol.\n *\n * @remarks\n * Ported verbatim from `personal-server-ts` (`packages/core/src/keys/derive.ts`)\n * to keep wire compatibility with the locked DPv1 encryption scheme. The wallet\n * signature over `\"vana-master-key-v1\"` IS the master key material (spec §2.3),\n * and per-scope keys are derived via HKDF-SHA256 with `salt=\"vana\"` and\n * `info=\"scope:{scope}\"`.\n *\n * @category Cryptography\n */\n\nimport { hkdf } from \"@noble/hashes/hkdf\";\nimport { sha256 } from \"@noble/hashes/sha2\";\nimport { recoverMessageAddress } from \"viem\";\n\n/**\n * Canonical message signed by the user's wallet to derive the master key.\n *\n * @remarks\n * NOTE: kept in sync with personal-server-ts. The Vana team's encryption design\n * doc references `\"vana-master-encryption-v1\"`; this implementation uses the\n * shipping value to preserve wire compatibility.\n */\nexport const MASTER_KEY_MESSAGE = \"vana-master-key-v1\";\n\n/**\n * Extracts master key material from an EIP-191 signature over the master key\n * message. The raw 65 signature bytes ARE the master key material.\n *\n * @param signature - 0x-prefixed hex string (65 bytes = 130 hex chars + 0x).\n * @returns 65-byte Uint8Array containing the raw signature bytes.\n */\nexport function deriveMasterKey(signature: `0x${string}`): Uint8Array {\n  const hex = signature.slice(2);\n\n  if (hex.length !== 130) {\n    throw new Error(\n      `Invalid signature length: expected 130 hex chars (65 bytes), got ${hex.length}`,\n    );\n  }\n\n  if (!/^[0-9a-fA-F]+$/.test(hex)) {\n    throw new Error(\"Invalid signature: contains non-hex characters\");\n  }\n\n  const bytes = new Uint8Array(65);\n  for (let i = 0; i < 65; i++) {\n    bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n  }\n  return bytes;\n}\n\n/**\n * Recovers the server owner address from a master key signature using EIP-191\n * recovery over {@link MASTER_KEY_MESSAGE}.\n */\nexport async function recoverServerOwner(\n  masterKeySignature: `0x${string}`,\n): Promise<`0x${string}`> {\n  return recoverMessageAddress({\n    message: MASTER_KEY_MESSAGE,\n    signature: masterKeySignature,\n  });\n}\n\n/**\n * Derives a scope-specific 32-byte key via HKDF-SHA256.\n *\n * @remarks\n * Uses `salt=\"vana\"` and `info=\"scope:{scope}\"` per spec §2.3.\n *\n * @param masterKey - 65-byte master key material from {@link deriveMasterKey}.\n * @param scope - Scope identifier (e.g. `\"instagram.profile\"`).\n * @returns 32-byte derived key suitable for symmetric encryption.\n */\nexport function deriveScopeKey(\n  masterKey: Uint8Array,\n  scope: string,\n): Uint8Array {\n  const salt = new TextEncoder().encode(\"vana\");\n  const info = new TextEncoder().encode(`scope:${scope}`);\n  return hkdf(sha256, masterKey, salt, info, 32);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAaA,kBAAqB;AACrB,kBAAuB;AACvB,kBAAsC;AAU/B,MAAM,qBAAqB;AAS3B,SAAS,gBAAgB,WAAsC;AACpE,QAAM,MAAM,UAAU,MAAM,CAAC;AAE7B,MAAI,IAAI,WAAW,KAAK;AACtB,UAAM,IAAI;AAAA,MACR,oEAAoE,IAAI,MAAM;AAAA,IAChF;AAAA,EACF;AAEA,MAAI,CAAC,iBAAiB,KAAK,GAAG,GAAG;AAC/B,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AAEA,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,UAAM,CAAC,IAAI,SAAS,IAAI,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;AAAA,EACrD;AACA,SAAO;AACT;AAMA,eAAsB,mBACpB,oBACwB;AACxB,aAAO,mCAAsB;AAAA,IAC3B,SAAS;AAAA,IACT,WAAW;AAAA,EACb,CAAC;AACH;AAYO,SAAS,eACd,WACA,OACY;AACZ,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,MAAM;AAC5C,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,SAAS,KAAK,EAAE;AACtD,aAAO,kBAAK,oBAAQ,WAAW,MAAM,MAAM,EAAE;AAC/C;","names":[]}

package/dist/crypto/keys/derive.d.ts

@@ -0,0 +1,45 @@
+/**
+ * HKDF-based key derivation for the Vana Data Portability Protocol.
+ *
+ * @remarks
+ * Ported verbatim from `personal-server-ts` (`packages/core/src/keys/derive.ts`)
+ * to keep wire compatibility with the locked DPv1 encryption scheme. The wallet
+ * signature over `"vana-master-key-v1"` IS the master key material (spec §2.3),
+ * and per-scope keys are derived via HKDF-SHA256 with `salt="vana"` and
+ * `info="scope:{scope}"`.
+ *
+ * @category Cryptography
+ */
+/**
+ * Canonical message signed by the user's wallet to derive the master key.
+ *
+ * @remarks
+ * NOTE: kept in sync with personal-server-ts. The Vana team's encryption design
+ * doc references `"vana-master-encryption-v1"`; this implementation uses the
+ * shipping value to preserve wire compatibility.
+ */
+export declare const MASTER_KEY_MESSAGE = "vana-master-key-v1";
+/**
+ * Extracts master key material from an EIP-191 signature over the master key
+ * message. The raw 65 signature bytes ARE the master key material.
+ *
+ * @param signature - 0x-prefixed hex string (65 bytes = 130 hex chars + 0x).
+ * @returns 65-byte Uint8Array containing the raw signature bytes.
+ */
+export declare function deriveMasterKey(signature: `0x${string}`): Uint8Array;
+/**
+ * Recovers the server owner address from a master key signature using EIP-191
+ * recovery over {@link MASTER_KEY_MESSAGE}.
+ */
+export declare function recoverServerOwner(masterKeySignature: `0x${string}`): Promise<`0x${string}`>;
+/**
+ * Derives a scope-specific 32-byte key via HKDF-SHA256.
+ *
+ * @remarks
+ * Uses `salt="vana"` and `info="scope:{scope}"` per spec §2.3.
+ *
+ * @param masterKey - 65-byte master key material from {@link deriveMasterKey}.
+ * @param scope - Scope identifier (e.g. `"instagram.profile"`).
+ * @returns 32-byte derived key suitable for symmetric encryption.
+ */
+export declare function deriveScopeKey(masterKey: Uint8Array, scope: string): Uint8Array;

package/dist/crypto/keys/derive.js

@@ -0,0 +1,38 @@
+import { hkdf } from "@noble/hashes/hkdf";
+import { sha256 } from "@noble/hashes/sha2";
+import { recoverMessageAddress } from "viem";
+const MASTER_KEY_MESSAGE = "vana-master-key-v1";
+function deriveMasterKey(signature) {
+  const hex = signature.slice(2);
+  if (hex.length !== 130) {
+    throw new Error(
+      `Invalid signature length: expected 130 hex chars (65 bytes), got ${hex.length}`
+    );
+  }
+  if (!/^[0-9a-fA-F]+$/.test(hex)) {
+    throw new Error("Invalid signature: contains non-hex characters");
+  }
+  const bytes = new Uint8Array(65);
+  for (let i = 0; i < 65; i++) {
+    bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+async function recoverServerOwner(masterKeySignature) {
+  return recoverMessageAddress({
+    message: MASTER_KEY_MESSAGE,
+    signature: masterKeySignature
+  });
+}
+function deriveScopeKey(masterKey, scope) {
+  const salt = new TextEncoder().encode("vana");
+  const info = new TextEncoder().encode(`scope:${scope}`);
+  return hkdf(sha256, masterKey, salt, info, 32);
+}
+export {
+  MASTER_KEY_MESSAGE,
+  deriveMasterKey,
+  deriveScopeKey,
+  recoverServerOwner
+};
+//# sourceMappingURL=derive.js.map

package/dist/crypto/keys/derive.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/crypto/keys/derive.ts"],"sourcesContent":["/**\n * HKDF-based key derivation for the Vana Data Portability Protocol.\n *\n * @remarks\n * Ported verbatim from `personal-server-ts` (`packages/core/src/keys/derive.ts`)\n * to keep wire compatibility with the locked DPv1 encryption scheme. The wallet\n * signature over `\"vana-master-key-v1\"` IS the master key material (spec §2.3),\n * and per-scope keys are derived via HKDF-SHA256 with `salt=\"vana\"` and\n * `info=\"scope:{scope}\"`.\n *\n * @category Cryptography\n */\n\nimport { hkdf } from \"@noble/hashes/hkdf\";\nimport { sha256 } from \"@noble/hashes/sha2\";\nimport { recoverMessageAddress } from \"viem\";\n\n/**\n * Canonical message signed by the user's wallet to derive the master key.\n *\n * @remarks\n * NOTE: kept in sync with personal-server-ts. The Vana team's encryption design\n * doc references `\"vana-master-encryption-v1\"`; this implementation uses the\n * shipping value to preserve wire compatibility.\n */\nexport const MASTER_KEY_MESSAGE = \"vana-master-key-v1\";\n\n/**\n * Extracts master key material from an EIP-191 signature over the master key\n * message. The raw 65 signature bytes ARE the master key material.\n *\n * @param signature - 0x-prefixed hex string (65 bytes = 130 hex chars + 0x).\n * @returns 65-byte Uint8Array containing the raw signature bytes.\n */\nexport function deriveMasterKey(signature: `0x${string}`): Uint8Array {\n  const hex = signature.slice(2);\n\n  if (hex.length !== 130) {\n    throw new Error(\n      `Invalid signature length: expected 130 hex chars (65 bytes), got ${hex.length}`,\n    );\n  }\n\n  if (!/^[0-9a-fA-F]+$/.test(hex)) {\n    throw new Error(\"Invalid signature: contains non-hex characters\");\n  }\n\n  const bytes = new Uint8Array(65);\n  for (let i = 0; i < 65; i++) {\n    bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n  }\n  return bytes;\n}\n\n/**\n * Recovers the server owner address from a master key signature using EIP-191\n * recovery over {@link MASTER_KEY_MESSAGE}.\n */\nexport async function recoverServerOwner(\n  masterKeySignature: `0x${string}`,\n): Promise<`0x${string}`> {\n  return recoverMessageAddress({\n    message: MASTER_KEY_MESSAGE,\n    signature: masterKeySignature,\n  });\n}\n\n/**\n * Derives a scope-specific 32-byte key via HKDF-SHA256.\n *\n * @remarks\n * Uses `salt=\"vana\"` and `info=\"scope:{scope}\"` per spec §2.3.\n *\n * @param masterKey - 65-byte master key material from {@link deriveMasterKey}.\n * @param scope - Scope identifier (e.g. `\"instagram.profile\"`).\n * @returns 32-byte derived key suitable for symmetric encryption.\n */\nexport function deriveScopeKey(\n  masterKey: Uint8Array,\n  scope: string,\n): Uint8Array {\n  const salt = new TextEncoder().encode(\"vana\");\n  const info = new TextEncoder().encode(`scope:${scope}`);\n  return hkdf(sha256, masterKey, salt, info, 32);\n}\n"],"mappings":"AAaA,SAAS,YAAY;AACrB,SAAS,cAAc;AACvB,SAAS,6BAA6B;AAU/B,MAAM,qBAAqB;AAS3B,SAAS,gBAAgB,WAAsC;AACpE,QAAM,MAAM,UAAU,MAAM,CAAC;AAE7B,MAAI,IAAI,WAAW,KAAK;AACtB,UAAM,IAAI;AAAA,MACR,oEAAoE,IAAI,MAAM;AAAA,IAChF;AAAA,EACF;AAEA,MAAI,CAAC,iBAAiB,KAAK,GAAG,GAAG;AAC/B,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AAEA,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,UAAM,CAAC,IAAI,SAAS,IAAI,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;AAAA,EACrD;AACA,SAAO;AACT;AAMA,eAAsB,mBACpB,oBACwB;AACxB,SAAO,sBAAsB;AAAA,IAC3B,SAAS;AAAA,IACT,WAAW;AAAA,EACb,CAAC;AACH;AAYO,SAAS,eACd,WACA,OACY;AACZ,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,MAAM;AAC5C,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,SAAS,KAAK,EAAE;AACtD,SAAO,KAAK,QAAQ,WAAW,MAAM,MAAM,EAAE;AAC/C;","names":[]}

package/dist/errors.cjs

@@ -44,6 +44,7 @@ class VanaError extends Error {
       Error.captureStackTrace(this, this.constructor);
     }
   }
+  code;
 }
 class RelayerError extends VanaError {
   constructor(message, statusCode, response) {
@@ -51,6 +52,8 @@ class RelayerError extends VanaError {
     this.statusCode = statusCode;
     this.response = response;
   }
+  statusCode;
+  response;
 }
 class UserRejectedRequestError extends VanaError {
   constructor(message = "User rejected the signature request") {
@@ -75,6 +78,7 @@ class BlockchainError extends VanaError {
     super(message, "BLOCKCHAIN_ERROR");
     this.originalError = originalError;
   }
+  originalError;
 }
 class SerializationError extends VanaError {
   constructor(message) {
@@ -86,12 +90,14 @@ class SignatureError extends VanaError {
     super(message, "SIGNATURE_ERROR");
     this.originalError = originalError;
   }
+  originalError;
 }
 class NetworkError extends VanaError {
   constructor(message, originalError) {
     super(message, "NETWORK_ERROR");
     this.originalError = originalError;
   }
+  originalError;
 }
 class NonceError extends VanaError {
   constructor(message) {
@@ -103,6 +109,7 @@ class PersonalServerError extends VanaError {
     super(message, "PERSONAL_SERVER_ERROR");
     this.originalError = originalError;
   }
+  originalError;
 }
 class ServerUrlMismatchError extends VanaError {
   constructor(existingUrl, providedUrl, serverId) {
@@ -123,6 +130,7 @@ class PermissionError extends VanaError {
     super(message, "PERMISSION_ERROR");
     this.originalError = originalError;
   }
+  originalError;
 }
 class ReadOnlyError extends VanaError {
   constructor(operation, suggestion = "Initialize the SDK with a walletClient to perform this operation") {
@@ -147,6 +155,8 @@ class TransactionPendingError extends VanaError {
     this.operationId = operationId;
     this.lastKnownStatus = lastKnownStatus;
   }
+  operationId;
+  lastKnownStatus;
   /**
    * Converts the error to a JSON-serializable format.
    *