@prismer/sdk 1.7.3 → 1.7.4

package/dist/index.mjs

@@ -1207,6 +1207,28 @@ var ENVIRONMENTS = {
   production: "https://prismer.cloud"
 };
 
+// src/aip.ts
+import {
+  AIPIdentity
+} from "@prismer/aip-sdk";
+import {
+  publicKeyToDIDKey,
+  didKeyToPublicKey,
+  validateDIDKey
+} from "@prismer/aip-sdk";
+import {
+  buildCredential,
+  buildPresentation,
+  verifyCredential,
+  verifyPresentation
+} from "@prismer/aip-sdk";
+import {
+  buildDelegation,
+  buildEphemeralDelegation,
+  verifyDelegation,
+  verifyEphemeralDelegation
+} from "@prismer/aip-sdk";
+
 // src/storage.ts
 var MemoryStorage = class {
   constructor() {
@@ -2091,20 +2113,27 @@ var PBKDF2_ITERATIONS = 1e5;
 var SALT_LENGTH = 16;
 var IV_LENGTH = 12;
 var KEY_LENGTH = 256;
-var E2EEncryption = class {
+var _E2EEncryption = class _E2EEncryption {
   constructor() {
     this.masterKey = null;
     this.keyPair = null;
     this.sessionKeys = /* @__PURE__ */ new Map();
     // conversationId → AES key
     this.salt = null;
+    // ─── Pipeline Functions ──────────────────────────────────
+    this.messageCount = 0;
+    this.lastRotation = Date.now();
   }
   /**
    * Initialize encryption with user passphrase.
    * Derives a master key via PBKDF2 and generates an ECDH key pair.
+   *
+   * @param passphrase - User passphrase for master key derivation
+   * @param salt - Optional Base64-encoded salt. If omitted, a random 16-byte salt is generated.
+   *               Store the salt (via exportSalt()) so you can re-derive the same master key later.
    */
-  async init(passphrase) {
-    this.salt = getRandomValues(new Uint8Array(SALT_LENGTH));
+  async init(passphrase, salt) {
+    this.salt = salt ? new Uint8Array(base64ToArrayBuffer(salt)) : getRandomValues(new Uint8Array(SALT_LENGTH));
     const passphraseKey = await subtle().importKey(
       "raw",
       new TextEncoder().encode(passphrase),
@@ -2115,7 +2144,7 @@ var E2EEncryption = class {
     this.masterKey = await subtle().deriveKey(
       {
         name: "PBKDF2",
-        salt: this.salt,
+        salt: new Uint8Array(this.salt.buffer, this.salt.byteOffset, this.salt.byteLength).buffer,
         iterations: PBKDF2_ITERATIONS,
         hash: "SHA-256"
       },
@@ -2130,6 +2159,14 @@ var E2EEncryption = class {
       ["deriveKey"]
     );
   }
+  /**
+   * Export the salt as Base64 string for persistent storage.
+   * You must store this and pass it back to init() to re-derive the same master key.
+   */
+  exportSalt() {
+    if (!this.salt) throw new Error("E2E not initialized. Call init() first.");
+    return arrayBufferToBase64(this.salt.buffer);
+  }
   /**
    * Export public key for sharing with conversation peers.
    */
@@ -2242,8 +2279,93 @@ var E2EEncryption = class {
     this.keyPair = null;
     this.sessionKeys.clear();
     this.salt = null;
+    this.messageCount = 0;
+  }
+  /**
+   * High-level encrypt-for-send pipeline.
+   * Encrypts content, builds metadata, and handles key rotation.
+   *
+   * Returns { encryptedContent, metadata } ready to send.
+   */
+  async encryptForSend(conversationId, content) {
+    if (!this.hasSessionKey(conversationId)) {
+      throw new Error("No session key for this conversation. Call deriveSessionKey() first.");
+    }
+    const needsRotation = this.shouldRotateKey();
+    const encryptedContent = await this.encrypt(conversationId, content);
+    this.messageCount++;
+    return {
+      encryptedContent,
+      metadata: {
+        encrypted: true,
+        encryptionVersion: 1,
+        ...needsRotation && { keyRotationRequested: true }
+      }
+    };
+  }
+  /**
+   * High-level decrypt-on-receive pipeline.
+   * Decrypts content and validates metadata.
+   */
+  async decryptOnReceive(conversationId, encryptedContent, metadata) {
+    if (!this.hasSessionKey(conversationId)) {
+      throw new Error("No session key for this conversation. Call deriveSessionKey() first.");
+    }
+    return this.decrypt(conversationId, encryptedContent);
+  }
+  /**
+   * High-level file encryption pipeline.
+   */
+  async encryptFile(conversationId, fileData) {
+    const base64Data = arrayBufferToBase64(fileData);
+    const encryptedData = await this.encrypt(conversationId, base64Data);
+    return {
+      encryptedData,
+      metadata: {
+        encrypted: true,
+        encryptionVersion: 1,
+        fileEncrypted: true
+      }
+    };
+  }
+  /**
+   * High-level file decryption pipeline.
+   */
+  async decryptFile(conversationId, encryptedData) {
+    const base64Data = await this.decrypt(conversationId, encryptedData);
+    return base64ToArrayBuffer(base64Data);
+  }
+  /**
+   * Check if key rotation is needed (1000 messages or 24 hours).
+   */
+  shouldRotateKey() {
+    if (this.messageCount >= _E2EEncryption.KEY_ROTATION_THRESHOLD) {
+      return true;
+    }
+    if (Date.now() - this.lastRotation >= _E2EEncryption.KEY_ROTATION_INTERVAL_MS) {
+      return true;
+    }
+    return false;
+  }
+  /**
+   * Perform key rotation: generate new ECDH keypair and reset counters.
+   * The caller is responsible for re-exchanging keys with peers.
+   */
+  async rotateKeys() {
+    this.keyPair = await subtle().generateKey(
+      { name: "ECDH", namedCurve: "P-256" },
+      false,
+      ["deriveKey"]
+    );
+    this.messageCount = 0;
+    this.lastRotation = Date.now();
+    this.sessionKeys.clear();
+    return this.exportPublicKey();
   }
 };
+_E2EEncryption.KEY_ROTATION_THRESHOLD = 1e3;
+_E2EEncryption.KEY_ROTATION_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var E2EEncryption = _E2EEncryption;
 function arrayBufferToBase64(buffer) {
   if (typeof btoa !== "undefined") {
     const bytes = new Uint8Array(buffer);
@@ -3292,11 +3414,11 @@ var EvolutionClient = class {
   }
   /** Delete a gene */
   async deleteGene(geneId) {
-    return this._r("DELETE", `/api/im/evolution/genes/${geneId}`);
+    return this._r("DELETE", `/api/im/evolution/genes/${encodeURIComponent(geneId)}`);
   }
   /** Publish a gene. Pass skipCanary=true to bypass canary validation (MVP/admin). */
   async publishGene(geneId, options) {
-    return this._r("POST", `/api/im/evolution/genes/${geneId}/publish`, options?.skipCanary ? { skipCanary: true } : void 0);
+    return this._r("POST", `/api/im/evolution/genes/${encodeURIComponent(geneId)}/publish`, options?.skipCanary ? { skipCanary: true } : void 0);
   }
   /** Import a published gene */
   async importGene(geneId) {
@@ -3382,6 +3504,14 @@ var EvolutionClient = class {
   async getSkillContent(slugOrId) {
     return this._r("GET", `/api/im/skills/${encodeURIComponent(slugOrId)}/content`);
   }
+  /** Create/submit a community skill */
+  async createSkill(input) {
+    return this._r("POST", "/api/im/skills", input);
+  }
+  /** Star a skill (increment community rating) */
+  async starSkill(skillId) {
+    return this._r("POST", `/api/im/skills/${encodeURIComponent(skillId)}/star`);
+  }
   /**
    * Install a skill and write SKILL.md to local filesystem.
    * Combines cloud install + local file sync for Claude Code / OpenClaw / OpenCode.
@@ -3444,8 +3574,8 @@ var EvolutionClient = class {
   async uninstallSkillLocal(slugOrId) {
     const result = await this.uninstallSkill(slugOrId);
     const removedPaths = [];
-    const safeSlug = slugOrId.replace(/[\/\\]/g, "").replace(/\.\./g, "");
-    if (!safeSlug) return { ...result, data: { uninstalled: result.data?.uninstalled ?? false, removedPaths } };
+    const slug = safeSlug(slugOrId);
+    if (!slug) return { ...result, data: { uninstalled: result.data?.uninstalled ?? false, removedPaths } };
     try {
       const fs = await import("fs");
       const path = await import("path");
@@ -3453,10 +3583,10 @@ var EvolutionClient = class {
       const home = os.homedir();
       const pluginBase = process.env.PRISMER_PLUGIN_DIR || path.join(home, ".claude", "plugins", "prismer");
       const dirs = [
-        path.join(home, ".claude", "skills", safeSlug),
-        path.join(home, ".openclaw", "skills", safeSlug),
-        path.join(home, ".config", "opencode", "skills", safeSlug),
-        path.join(pluginBase, "skills", safeSlug)
+        path.join(home, ".claude", "skills", slug),
+        path.join(home, ".openclaw", "skills", slug),
+        path.join(home, ".config", "opencode", "skills", slug),
+        path.join(pluginBase, "skills", slug)
       ];
       for (const dir of dirs) {
         try {
@@ -3566,6 +3696,9 @@ var EvolutionClient = class {
     return this._r("POST", "/api/im/evolution/sync", body);
   }
 };
+function safeSlug(input) {
+  return input.replace(/[\/\\]/g, "").replace(/\.\./g, "").replace(/\0/g, "");
+}
 function guessMimeType(fileName) {
   const ext = fileName.split(".").pop()?.toLowerCase() || "";
   const map = {
@@ -3982,6 +4115,7 @@ function createClient(config) {
   return new PrismerClient(config);
 }
 export {
+  AIPIdentity,
   AccountClient,
   AttachmentQueue,
   BindingsClient,
@@ -4022,5 +4156,7 @@ export {
   encryptContext,
   encryptFile,
   encryptForSend,
-  extractSignals
+  extractSignals,
+  guessMimeType,
+  safeSlug
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prismer/sdk",
-  "version": "1.7.3",
+  "version": "1.7.4",
   "description": "Official TypeScript SDK for Prismer Cloud API",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -34,6 +34,7 @@
   },
   "dependencies": {
     "@iarna/toml": "^2.2.5",
+    "@prismer/aip-sdk": "file:../../aip/typescript",
     "commander": "^12.1.0"
   },
   "devDependencies": {