@rialo/ts-cdk 0.4.0-alpha.1 → 0.5.0-alpha.0

package/dist/index.d.mts

@@ -1707,6 +1707,65 @@ interface RexInfoAndDuties {
     /** List of duties expecting updates or commitment. */
     duties: RexDuty[];
 }
+/**
+ * Keypair metadata — public information about a derived keypair.
+ * Does NOT contain secret material. Safe to pass around freely.
+ */
+interface DerivedKeypairInfo {
+    /** Keypair index within the keyring. */
+    index: number;
+    /** Public key (32 bytes Ed25519). */
+    pubkey: PublicKey;
+    /** Base58-encoded public key string. */
+    pubkeyString: string;
+    /** HD derivation path, if available. */
+    derivationPath?: string;
+}
+/**
+ * Program loader type.
+ */
+type LoaderType = "riscv" | "loaderV4";
+/**
+ * Configuration for chunked program deployment.
+ * retry delays are u64 to match the native Rust DeploymentConfig timers.
+ * chunk-size and confirmation-batch-size are intentionally u32 (not usize)
+ * because chunk sizes and batch counts never exceed 32-bit range in practice,
+ * and u32 is the widest portable integer in WIT without crossing into u64.
+ */
+interface DeploymentConfig$1 {
+    /** Size of each data chunk in bytes. */
+    chunkSize?: number;
+    /** Maximum number of retry attempts per chunk. */
+    maxRetries?: number;
+    /** Initial retry delay in milliseconds. */
+    retryBaseDelayMs?: bigint;
+    /** Maximum retry delay in milliseconds. */
+    retryMaxDelayMs?: bigint;
+    /** Number of confirmations to batch. */
+    confirmationBatchSize?: number;
+}
+/**
+ * Account metadata for a program invocation instruction.
+ */
+interface InvocationAccountMeta {
+    /** Account public key. */
+    pubkey: PublicKey;
+    /** Whether this account is a signer. */
+    isSigner: boolean;
+    /** Whether this account is writable. */
+    isWritable: boolean;
+}
+/**
+ * A fully assembled program instruction.
+ */
+interface ProgramInstruction {
+    /** Program ID to invoke. */
+    programId: PublicKey;
+    /** Accounts required by the instruction. */
+    accounts: InvocationAccountMeta[];
+    /** Instruction data payload. */
+    data: Uint8Array;
+}
 
 /**
  * Base client with JSON-RPC protocol handling.
@@ -4505,6 +4564,212 @@ declare function getMainnetUrl(): string;
  */
 declare function getLocalnetUrl(): string;
 
+/**
+ * A keyring managing one or more derived keypairs.
+ * Secret material stays inside the keyring — callers interact via
+ * indices and public metadata. No freely-passed keypair resources.
+ *
+ * No direct constructor — keyrings are created via KeyringProvider
+ * (create, create-with-mnemonic, recover-from-mnemonic, load).
+ * Active keypair contract: the active keypair is always index 0 at
+ * creation time. Active-keypair switching is a facade operation not
+ * in the generated contract.
+ */
+/**
+ * Resource `keyring` — generated from spec.wit.
+ *
+ * Extend this class to provide a concrete `Keyring` implementation.
+ * Instance methods are abstract; static methods throw by default (override in subclass).
+ */
+declare abstract class Keyring {
+    /**
+     * Sign a message with the active keypair.
+     * Returns 64-byte Ed25519 signature.
+     */
+    abstract sign(message: Uint8Array): Uint8Array;
+    /**
+     * Verify a signature with the active keypair.
+     */
+    abstract verify(message: Uint8Array, sig: Uint8Array): boolean;
+    /**
+     * Active keypair's public key as base58 string.
+     */
+    abstract pubkeyString(): string;
+    /**
+     * Active keypair's public key (32 bytes).
+     */
+    abstract pubkey(): PublicKey;
+    /**
+     * Get public metadata for a keypair by index.
+     */
+    abstract getKeypairInfo(index: number): DerivedKeypairInfo | undefined;
+    /**
+     * List all keypair indices, sorted ascending.
+     */
+    abstract listKeypairs(): number[];
+    /**
+     * Get public metadata for all keypairs, sorted by ascending index.
+     */
+    abstract getKeypairsInfo(): DerivedKeypairInfo[];
+    /**
+     * Sign with a specific keypair by index.
+     */
+    abstract signWithKeypair(message: Uint8Array, index: number): Uint8Array;
+}
+
+/**
+ * Concrete keyring implementation backed by an in-memory map of derived keypairs.
+ *
+ * Keyrings are created via {@link InMemoryKeyringProvider}, not directly.
+ * The active keypair defaults to index 0. Use {@link setActiveKeypair} to change it.
+ * Secret material stays inside the keyring — callers interact via indices and public metadata.
+ */
+declare class RialoKeyring extends Keyring {
+    private readonly keypairs;
+    private readonly derivationPaths;
+    private activeIndex;
+    constructor(keypairs: Map<number, Keypair>, derivationPaths: Map<number, string | undefined>);
+    /**
+     * Sets the active keypair index (facade operation, not in WIT contract).
+     *
+     * @param index - The keypair index to make active
+     * @throws {RialoError} If the index does not exist in this keyring
+     */
+    setActiveKeypair(index: number): void;
+    private activeKeypair;
+    sign(message: Uint8Array): Uint8Array;
+    verify(message: Uint8Array, sig: Uint8Array): boolean;
+    pubkeyString(): string;
+    pubkey(): PublicKey;
+    getKeypairInfo(index: number): DerivedKeypairInfo | undefined;
+    listKeypairs(): number[];
+    getKeypairsInfo(): DerivedKeypairInfo[];
+    signWithKeypair(message: Uint8Array, index: number): Uint8Array;
+    /**
+     * Securely erases all secret key material from this keyring snapshot.
+     *
+     * Calls {@link Keypair.dispose} on every keypair, zeroing private key bytes.
+     * After disposal, signing and secret-key export will throw. Verification
+     * still works (uses only the public key). Does not affect provider-stored
+     * state or other snapshots.
+     */
+    dispose(): void;
+}
+
+/**
+ * Storage and lifecycle management for keyrings. All methods async (I/O).
+ * No WIT constructor — concrete providers are language-specific
+ * (e.g., InMemoryKeyringProvider::new(), new InMemoryKeyringProvider()).
+ */
+/**
+ * Resource `keyring-provider` — generated from spec.wit.
+ *
+ * Extend this class to provide a concrete `KeyringProvider` implementation.
+ * Instance methods are abstract; static methods throw by default (override in subclass).
+ */
+declare abstract class KeyringProvider {
+    /**
+     * Create a new keyring with a random keypair at index 0.
+     */
+    abstract create(name: string, password: string): Promise<Keyring>;
+    /**
+     * Create a keyring with a generated BIP39 mnemonic.
+     * strength-bits: 128 (12 words) or 256 (24 words).
+     * Initializes exactly one keypair at index 0 derived from the mnemonic.
+     * Returns (keyring, mnemonic_phrase). The mnemonic is returned ONCE
+     * for backup — it is NOT stored on the keyring contract.
+     */
+    abstract createWithMnemonic(name: string, strengthBits: number, password: string): Promise<[Keyring, string]>;
+    /**
+     * Recover a keyring from an existing BIP39 mnemonic phrase.
+     * Initializes one keypair at index 0 derived from the mnemonic.
+     */
+    abstract recoverFromMnemonic(name: string, mnemonic: string, password: string): Promise<Keyring>;
+    /**
+     * Load an existing keyring by name. Active keypair defaults to index 0.
+     */
+    abstract load(name: string, password: string): Promise<Keyring>;
+    /**
+     * List all keyring names, sorted alphabetically.
+     */
+    abstract list(): Promise<string[]>;
+    /**
+     * Check if a keyring exists by name.
+     */
+    abstract exists(name: string): Promise<boolean>;
+    /**
+     * Get the active keypair's public key for a keyring (without loading).
+     */
+    abstract getPublicKey(name: string): Promise<PublicKey>;
+    /**
+     * List all keyrings with their active keypair's public info,
+     * sorted alphabetically by keyring name.
+     */
+    abstract listPublicKeys(): Promise<[string, DerivedKeypairInfo][]>;
+    /**
+     * List keypair metadata for a specific keyring, sorted by ascending index.
+     */
+    abstract listKeypairs(keyringName: string): Promise<DerivedKeypairInfo[]>;
+    /**
+     * Derive a new keypair at the specified index.
+     * Errors with DUPLICATE_KEYPAIR_INDEX if the index already exists.
+     */
+    abstract deriveKeypair(keyringName: string, keypairIndex: number, password: string): Promise<DerivedKeypairInfo>;
+    /**
+     * Import an existing 32-byte Ed25519 secret key into a keyring.
+     * Assigns the next available index (max(existing) + 1).
+     */
+    abstract importSecretKey(keyringName: string, secretKey: Uint8Array, derivationPath: string | undefined, password: string): Promise<DerivedKeypairInfo>;
+    /**
+     * Get metadata for all keypairs in a keyring, sorted by ascending index.
+     */
+    abstract getKeypairsInfo(name: string): Promise<DerivedKeypairInfo[]>;
+    /**
+     * Get metadata for a specific keypair by index.
+     */
+    abstract getKeypairInfo(name: string, keypairIndex: number): Promise<DerivedKeypairInfo>;
+    /**
+     * Returns max(existing indices) + 1, or 0 if empty.
+     * With sparse indices (e.g., 0 and 5 exist), returns 6, not 2.
+     */
+    abstract nextKeypairIndex(name: string): Promise<number>;
+}
+
+/**
+ * In-memory keyring provider for testing and ephemeral use.
+ *
+ * **Security note:** This provider stores keyrings, passwords, and mnemonic
+ * phrases in plaintext memory. It is designed for development, testing, and
+ * ephemeral use cases — NOT for production secret storage. Key material
+ * persists in the JS heap until garbage collected. For production use,
+ * implement a provider backed by encrypted storage or a hardware security module.
+ *
+ * Keyrings are stored in memory only — not persisted between restarts.
+ * Implements the full keyring-provider contract from the WIT spec.
+ */
+declare class InMemoryKeyringProvider extends KeyringProvider {
+    private readonly keyrings;
+    private getStored;
+    private checkPassword;
+    private buildKeyring;
+    private toInfo;
+    private nextIndex;
+    create(name: string, password: string): Promise<Keyring>;
+    createWithMnemonic(name: string, strengthBits: number, password: string): Promise<[Keyring, string]>;
+    recoverFromMnemonic(name: string, mnemonicPhrase: string, password: string): Promise<Keyring>;
+    load(name: string, password: string): Promise<Keyring>;
+    list(): Promise<string[]>;
+    exists(name: string): Promise<boolean>;
+    getPublicKey(name: string): Promise<PublicKey>;
+    listPublicKeys(): Promise<[string, DerivedKeypairInfo][]>;
+    listKeypairs(keyringName: string): Promise<DerivedKeypairInfo[]>;
+    deriveKeypair(keyringName: string, keypairIndex: number, password: string): Promise<DerivedKeypairInfo>;
+    importSecretKey(keyringName: string, secretKey: Uint8Array, derivationPath: string | undefined, password: string): Promise<DerivedKeypairInfo>;
+    getKeypairsInfo(name: string): Promise<DerivedKeypairInfo[]>;
+    getKeypairInfo(name: string, keypairIndex: number): Promise<DerivedKeypairInfo>;
+    nextKeypairIndex(name: string): Promise<number>;
+}
+
 /** RISC-V loader program ID (PolkaVM bytecode). */
 declare const RISCV_LOADER_PROGRAM_ID = "RiscVLoader11111111111111111111111111111111";
 /** LoaderV4 program ID (eBPF programs). */
@@ -4635,4 +4900,4 @@ declare function deployInstruction(programAddress: PublicKey, authority: PublicK
  */
 declare function retractInstruction(programAddress: PublicKey, authority: PublicKey): Instruction;
 
-export { type AccountFilter, type AccountFilterParam, type AccountInfo, type AccountMeta, AccountMetaTable, type AllAccountsEntry, BASE_DERIVATION_PATH, BUFFER_BALANCE_FACTOR, BaseRpcClient, BincodeReader, type BincodeSchema, BincodeWriter, type BlockInfo, type Bump, CHACHA20_POLY1305_TAG_LENGTH, type ChainDefinition, type ClusterNodeInfo, type CompiledInstruction, type ConfigHashPrefix, type ConfirmTransactionOptions, type ConfirmedTransaction, type ConnectedNode, CryptoError, CryptoErrorCode, DEFAULT_CHUNK_SIZE, DEFAULT_CONFIRMATION_BATCH_SIZE, DEFAULT_MAX_RETRIES, DEFAULT_NUM_ACCOUNTS, DEFAULT_RETRY_BASE_DELAY_MS, DEFAULT_RETRY_MAX_DELAY_MS, type DeploymentConfig, DeploymentError, DeploymentErrorCode, ED25519_PUBLIC_KEY_LENGTH, type EnumVariant, type EpochConsensusConfigRequest, type EpochInfo, type EventData, type FeeResponse, type GetAccountsByOwnerConfig, type GetAllAccountsConfig, type GetBlockConfig, type GetSignaturesForAddressConfig, type GetTransactionsConfig, type GetValidatorAccountsRequest, type GetWorkflowLineageRequest, type GetWorkflowLineageResponse, HPKE_ENC_LENGTH, HPKE_OVERHEAD_LENGTH, HpkeError, HpkeErrorCode, HttpTransport, type HttpTransportConfig, type IdentifierString, type InferSchema, type Instruction, type IsBlockhashValidResponse, KELVIN_PER_RLO, type Kelvin, Keypair, KeypairSigner, LOADER_V4_PROGRAM_ID, Message, type MessageHeader, Mnemonic, type MnemonicStrength, type OptionalAccountInfo, type OwnerAccount, type PDA, PROGRAM_DATA_OFFSET, PUBLIC_KEY_LENGTH, type PaginationInfo, ProgramDeployment, type ProgramDeploymentOptions, PublicKey, QueryRpcClient, RIALO_DEVNET_CHAIN, RIALO_LOCALNET_CHAIN, RIALO_MAINNET_CHAIN, RIALO_TESTNET_CHAIN, RISCV_LOADER_PROGRAM_ID, type RexDuty, type RexInfoAndDuties, RexValue, RexValueVariant, RialoClient, type RialoClientConfig, RialoError, RialoErrorType, type RialoNetwork, RiscVLoaderInstruction, RpcError, RpcErrorCode, type RpcErrorDetails$1 as RpcErrorDetails, SECRET_KEY_LENGTH, SECRET_SHARING_HPKE_INFO, SIGNATURE_LENGTH, SYSTEM_PROGRAM_ID, Schema, type SecretSharingPubkey, type Seed, type SendAndConfirmOptions, type SendTransactionOptions, Signature$1 as Signature, type SignatureInfo, type SignatureStatus, type Signer, type StakeAccountInfo, type StakeState, type StructField, type SubmitEpochChangeRequest, type SubmitEpochChangeResponse, type Subscription, type SubscriptionAccountMeta, type SubscriptionInstruction, type SubscriptionKind, SystemInstruction, type TimestampRange, type TokenBalance, Transaction, TransactionBuilder, type TransactionData, TransactionError, TransactionErrorCode, type TransactionInfo, type TransactionMessage, type TransactionNodeData, type TransactionResponse, TransactionRpcClient, type TransactionStatusMetadata, type TransactionWithMeta, type TriggerInfo, type TriggeredTransaction, type TruncationReason, URL_DEVNET, URL_LOCALNET, URL_MAINNET, URL_TESTNET, USER_SECRET_AAD, type ValidatorAccountInfo, type ValidatorHealth, type ValidatorInfoRequest, type WorkflowLineage, type WorkflowNode, X25519_PUBLIC_KEY_LENGTH, allocateInstruction, assignInstruction, calculateBackoff, concatBytes, createAccount, createBorshInstruction, createRialoClient, deployInstruction, deserialize, deserializeBorsh, deserializeCompactU16, deserializeStrict, encodeBorshData, encryptForRex, fromBase64, getCiphertextLength, getDefaultRialoClientConfig, getDevnetUrl, getLocalnetUrl, getMainnetUrl, getTestnetUrl, hpkeEncrypt, isOnCurve, isValidCiphertextLength, retractInstruction, seedToBytes, serialize, serializeBorsh, serializeCompactU16, setProgramLengthInstruction, sleep, toBase64, transferInstruction, writeCompactU16, writeInstruction };
+export { type AccountFilter, type AccountFilterParam, type AccountInfo, type AccountMeta, AccountMetaTable, type AllAccountsEntry, BASE_DERIVATION_PATH, BUFFER_BALANCE_FACTOR, BaseRpcClient, BincodeReader, type BincodeSchema, BincodeWriter, type BlockInfo, type Bump, CHACHA20_POLY1305_TAG_LENGTH, type ChainDefinition, type ClusterNodeInfo, type CompiledInstruction, type ConfigHashPrefix, type ConfirmTransactionOptions, type ConfirmedTransaction, type ConnectedNode, CryptoError, CryptoErrorCode, DEFAULT_CHUNK_SIZE, DEFAULT_CONFIRMATION_BATCH_SIZE, DEFAULT_MAX_RETRIES, DEFAULT_NUM_ACCOUNTS, DEFAULT_RETRY_BASE_DELAY_MS, DEFAULT_RETRY_MAX_DELAY_MS, type DeploymentConfig, DeploymentError, DeploymentErrorCode, type DerivedKeypairInfo, ED25519_PUBLIC_KEY_LENGTH, type EnumVariant, type EpochConsensusConfigRequest, type EpochInfo, type EventData, type FeeResponse, type DeploymentConfig$1 as GeneratedDeploymentConfig, type GetAccountsByOwnerConfig, type GetAllAccountsConfig, type GetBlockConfig, type GetSignaturesForAddressConfig, type GetTransactionsConfig, type GetValidatorAccountsRequest, type GetWorkflowLineageRequest, type GetWorkflowLineageResponse, HPKE_ENC_LENGTH, HPKE_OVERHEAD_LENGTH, HpkeError, HpkeErrorCode, HttpTransport, type HttpTransportConfig, type IdentifierString, InMemoryKeyringProvider, type InferSchema, type Instruction, type InvocationAccountMeta, type IsBlockhashValidResponse, KELVIN_PER_RLO, type Kelvin, Keypair, KeypairSigner, Keyring, KeyringProvider, LOADER_V4_PROGRAM_ID, type LoaderType, Message, type MessageHeader, Mnemonic, type MnemonicStrength, type OptionalAccountInfo, type OwnerAccount, type PDA, PROGRAM_DATA_OFFSET, PUBLIC_KEY_LENGTH, type PaginationInfo, ProgramDeployment, type ProgramDeploymentOptions, type ProgramInstruction, PublicKey, QueryRpcClient, RIALO_DEVNET_CHAIN, RIALO_LOCALNET_CHAIN, RIALO_MAINNET_CHAIN, RIALO_TESTNET_CHAIN, RISCV_LOADER_PROGRAM_ID, type RexDuty, type RexInfoAndDuties, RexValue, RexValueVariant, RialoClient, type RialoClientConfig, RialoError, RialoErrorType, RialoKeyring, type RialoNetwork, RiscVLoaderInstruction, RpcError, RpcErrorCode, type RpcErrorDetails$1 as RpcErrorDetails, SECRET_KEY_LENGTH, SECRET_SHARING_HPKE_INFO, SIGNATURE_LENGTH, SYSTEM_PROGRAM_ID, Schema, type SecretSharingPubkey, type Seed, type SendAndConfirmOptions, type SendTransactionOptions, Signature$1 as Signature, type SignatureInfo, type SignatureStatus, type Signer, type StakeAccountInfo, type StakeState, type StructField, type SubmitEpochChangeRequest, type SubmitEpochChangeResponse, type Subscription, type SubscriptionAccountMeta, type SubscriptionInstruction, type SubscriptionKind, SystemInstruction, type TimestampRange, type TokenBalance, Transaction, TransactionBuilder, type TransactionData, TransactionError, TransactionErrorCode, type TransactionInfo, type TransactionMessage, type TransactionNodeData, type TransactionResponse, TransactionRpcClient, type TransactionStatusMetadata, type TransactionWithMeta, type TriggerInfo, type TriggeredTransaction, type TruncationReason, URL_DEVNET, URL_LOCALNET, URL_MAINNET, URL_TESTNET, USER_SECRET_AAD, type ValidatorAccountInfo, type ValidatorHealth, type ValidatorInfoRequest, type WorkflowLineage, type WorkflowNode, X25519_PUBLIC_KEY_LENGTH, allocateInstruction, assignInstruction, calculateBackoff, concatBytes, createAccount, createBorshInstruction, createRialoClient, deployInstruction, deserialize, deserializeBorsh, deserializeCompactU16, deserializeStrict, encodeBorshData, encryptForRex, fromBase64, getCiphertextLength, getDefaultRialoClientConfig, getDevnetUrl, getLocalnetUrl, getMainnetUrl, getTestnetUrl, hpkeEncrypt, isOnCurve, isValidCiphertextLength, retractInstruction, seedToBytes, serialize, serializeBorsh, serializeCompactU16, setProgramLengthInstruction, sleep, toBase64, transferInstruction, writeCompactU16, writeInstruction };

package/dist/index.d.ts

@@ -1707,6 +1707,65 @@ interface RexInfoAndDuties {
     /** List of duties expecting updates or commitment. */
     duties: RexDuty[];
 }
+/**
+ * Keypair metadata — public information about a derived keypair.
+ * Does NOT contain secret material. Safe to pass around freely.
+ */
+interface DerivedKeypairInfo {
+    /** Keypair index within the keyring. */
+    index: number;
+    /** Public key (32 bytes Ed25519). */
+    pubkey: PublicKey;
+    /** Base58-encoded public key string. */
+    pubkeyString: string;
+    /** HD derivation path, if available. */
+    derivationPath?: string;
+}
+/**
+ * Program loader type.
+ */
+type LoaderType = "riscv" | "loaderV4";
+/**
+ * Configuration for chunked program deployment.
+ * retry delays are u64 to match the native Rust DeploymentConfig timers.
+ * chunk-size and confirmation-batch-size are intentionally u32 (not usize)
+ * because chunk sizes and batch counts never exceed 32-bit range in practice,
+ * and u32 is the widest portable integer in WIT without crossing into u64.
+ */
+interface DeploymentConfig$1 {
+    /** Size of each data chunk in bytes. */
+    chunkSize?: number;
+    /** Maximum number of retry attempts per chunk. */
+    maxRetries?: number;
+    /** Initial retry delay in milliseconds. */
+    retryBaseDelayMs?: bigint;
+    /** Maximum retry delay in milliseconds. */
+    retryMaxDelayMs?: bigint;
+    /** Number of confirmations to batch. */
+    confirmationBatchSize?: number;
+}
+/**
+ * Account metadata for a program invocation instruction.
+ */
+interface InvocationAccountMeta {
+    /** Account public key. */
+    pubkey: PublicKey;
+    /** Whether this account is a signer. */
+    isSigner: boolean;
+    /** Whether this account is writable. */
+    isWritable: boolean;
+}
+/**
+ * A fully assembled program instruction.
+ */
+interface ProgramInstruction {
+    /** Program ID to invoke. */
+    programId: PublicKey;
+    /** Accounts required by the instruction. */
+    accounts: InvocationAccountMeta[];
+    /** Instruction data payload. */
+    data: Uint8Array;
+}
 
 /**
  * Base client with JSON-RPC protocol handling.
@@ -4505,6 +4564,212 @@ declare function getMainnetUrl(): string;
  */
 declare function getLocalnetUrl(): string;
 
+/**
+ * A keyring managing one or more derived keypairs.
+ * Secret material stays inside the keyring — callers interact via
+ * indices and public metadata. No freely-passed keypair resources.
+ *
+ * No direct constructor — keyrings are created via KeyringProvider
+ * (create, create-with-mnemonic, recover-from-mnemonic, load).
+ * Active keypair contract: the active keypair is always index 0 at
+ * creation time. Active-keypair switching is a facade operation not
+ * in the generated contract.
+ */
+/**
+ * Resource `keyring` — generated from spec.wit.
+ *
+ * Extend this class to provide a concrete `Keyring` implementation.
+ * Instance methods are abstract; static methods throw by default (override in subclass).
+ */
+declare abstract class Keyring {
+    /**
+     * Sign a message with the active keypair.
+     * Returns 64-byte Ed25519 signature.
+     */
+    abstract sign(message: Uint8Array): Uint8Array;
+    /**
+     * Verify a signature with the active keypair.
+     */
+    abstract verify(message: Uint8Array, sig: Uint8Array): boolean;
+    /**
+     * Active keypair's public key as base58 string.
+     */
+    abstract pubkeyString(): string;
+    /**
+     * Active keypair's public key (32 bytes).
+     */
+    abstract pubkey(): PublicKey;
+    /**
+     * Get public metadata for a keypair by index.
+     */
+    abstract getKeypairInfo(index: number): DerivedKeypairInfo | undefined;
+    /**
+     * List all keypair indices, sorted ascending.
+     */
+    abstract listKeypairs(): number[];
+    /**
+     * Get public metadata for all keypairs, sorted by ascending index.
+     */
+    abstract getKeypairsInfo(): DerivedKeypairInfo[];
+    /**
+     * Sign with a specific keypair by index.
+     */
+    abstract signWithKeypair(message: Uint8Array, index: number): Uint8Array;
+}
+
+/**
+ * Concrete keyring implementation backed by an in-memory map of derived keypairs.
+ *
+ * Keyrings are created via {@link InMemoryKeyringProvider}, not directly.
+ * The active keypair defaults to index 0. Use {@link setActiveKeypair} to change it.
+ * Secret material stays inside the keyring — callers interact via indices and public metadata.
+ */
+declare class RialoKeyring extends Keyring {
+    private readonly keypairs;
+    private readonly derivationPaths;
+    private activeIndex;
+    constructor(keypairs: Map<number, Keypair>, derivationPaths: Map<number, string | undefined>);
+    /**
+     * Sets the active keypair index (facade operation, not in WIT contract).
+     *
+     * @param index - The keypair index to make active
+     * @throws {RialoError} If the index does not exist in this keyring
+     */
+    setActiveKeypair(index: number): void;
+    private activeKeypair;
+    sign(message: Uint8Array): Uint8Array;
+    verify(message: Uint8Array, sig: Uint8Array): boolean;
+    pubkeyString(): string;
+    pubkey(): PublicKey;
+    getKeypairInfo(index: number): DerivedKeypairInfo | undefined;
+    listKeypairs(): number[];
+    getKeypairsInfo(): DerivedKeypairInfo[];
+    signWithKeypair(message: Uint8Array, index: number): Uint8Array;
+    /**
+     * Securely erases all secret key material from this keyring snapshot.
+     *
+     * Calls {@link Keypair.dispose} on every keypair, zeroing private key bytes.
+     * After disposal, signing and secret-key export will throw. Verification
+     * still works (uses only the public key). Does not affect provider-stored
+     * state or other snapshots.
+     */
+    dispose(): void;
+}
+
+/**
+ * Storage and lifecycle management for keyrings. All methods async (I/O).
+ * No WIT constructor — concrete providers are language-specific
+ * (e.g., InMemoryKeyringProvider::new(), new InMemoryKeyringProvider()).
+ */
+/**
+ * Resource `keyring-provider` — generated from spec.wit.
+ *
+ * Extend this class to provide a concrete `KeyringProvider` implementation.
+ * Instance methods are abstract; static methods throw by default (override in subclass).
+ */
+declare abstract class KeyringProvider {
+    /**
+     * Create a new keyring with a random keypair at index 0.
+     */
+    abstract create(name: string, password: string): Promise<Keyring>;
+    /**
+     * Create a keyring with a generated BIP39 mnemonic.
+     * strength-bits: 128 (12 words) or 256 (24 words).
+     * Initializes exactly one keypair at index 0 derived from the mnemonic.
+     * Returns (keyring, mnemonic_phrase). The mnemonic is returned ONCE
+     * for backup — it is NOT stored on the keyring contract.
+     */
+    abstract createWithMnemonic(name: string, strengthBits: number, password: string): Promise<[Keyring, string]>;
+    /**
+     * Recover a keyring from an existing BIP39 mnemonic phrase.
+     * Initializes one keypair at index 0 derived from the mnemonic.
+     */
+    abstract recoverFromMnemonic(name: string, mnemonic: string, password: string): Promise<Keyring>;
+    /**
+     * Load an existing keyring by name. Active keypair defaults to index 0.
+     */
+    abstract load(name: string, password: string): Promise<Keyring>;
+    /**
+     * List all keyring names, sorted alphabetically.
+     */
+    abstract list(): Promise<string[]>;
+    /**
+     * Check if a keyring exists by name.
+     */
+    abstract exists(name: string): Promise<boolean>;
+    /**
+     * Get the active keypair's public key for a keyring (without loading).
+     */
+    abstract getPublicKey(name: string): Promise<PublicKey>;
+    /**
+     * List all keyrings with their active keypair's public info,
+     * sorted alphabetically by keyring name.
+     */
+    abstract listPublicKeys(): Promise<[string, DerivedKeypairInfo][]>;
+    /**
+     * List keypair metadata for a specific keyring, sorted by ascending index.
+     */
+    abstract listKeypairs(keyringName: string): Promise<DerivedKeypairInfo[]>;
+    /**
+     * Derive a new keypair at the specified index.
+     * Errors with DUPLICATE_KEYPAIR_INDEX if the index already exists.
+     */
+    abstract deriveKeypair(keyringName: string, keypairIndex: number, password: string): Promise<DerivedKeypairInfo>;
+    /**
+     * Import an existing 32-byte Ed25519 secret key into a keyring.
+     * Assigns the next available index (max(existing) + 1).
+     */
+    abstract importSecretKey(keyringName: string, secretKey: Uint8Array, derivationPath: string | undefined, password: string): Promise<DerivedKeypairInfo>;
+    /**
+     * Get metadata for all keypairs in a keyring, sorted by ascending index.
+     */
+    abstract getKeypairsInfo(name: string): Promise<DerivedKeypairInfo[]>;
+    /**
+     * Get metadata for a specific keypair by index.
+     */
+    abstract getKeypairInfo(name: string, keypairIndex: number): Promise<DerivedKeypairInfo>;
+    /**
+     * Returns max(existing indices) + 1, or 0 if empty.
+     * With sparse indices (e.g., 0 and 5 exist), returns 6, not 2.
+     */
+    abstract nextKeypairIndex(name: string): Promise<number>;
+}
+
+/**
+ * In-memory keyring provider for testing and ephemeral use.
+ *
+ * **Security note:** This provider stores keyrings, passwords, and mnemonic
+ * phrases in plaintext memory. It is designed for development, testing, and
+ * ephemeral use cases — NOT for production secret storage. Key material
+ * persists in the JS heap until garbage collected. For production use,
+ * implement a provider backed by encrypted storage or a hardware security module.
+ *
+ * Keyrings are stored in memory only — not persisted between restarts.
+ * Implements the full keyring-provider contract from the WIT spec.
+ */
+declare class InMemoryKeyringProvider extends KeyringProvider {
+    private readonly keyrings;
+    private getStored;
+    private checkPassword;
+    private buildKeyring;
+    private toInfo;
+    private nextIndex;
+    create(name: string, password: string): Promise<Keyring>;
+    createWithMnemonic(name: string, strengthBits: number, password: string): Promise<[Keyring, string]>;
+    recoverFromMnemonic(name: string, mnemonicPhrase: string, password: string): Promise<Keyring>;
+    load(name: string, password: string): Promise<Keyring>;
+    list(): Promise<string[]>;
+    exists(name: string): Promise<boolean>;
+    getPublicKey(name: string): Promise<PublicKey>;
+    listPublicKeys(): Promise<[string, DerivedKeypairInfo][]>;
+    listKeypairs(keyringName: string): Promise<DerivedKeypairInfo[]>;
+    deriveKeypair(keyringName: string, keypairIndex: number, password: string): Promise<DerivedKeypairInfo>;
+    importSecretKey(keyringName: string, secretKey: Uint8Array, derivationPath: string | undefined, password: string): Promise<DerivedKeypairInfo>;
+    getKeypairsInfo(name: string): Promise<DerivedKeypairInfo[]>;
+    getKeypairInfo(name: string, keypairIndex: number): Promise<DerivedKeypairInfo>;
+    nextKeypairIndex(name: string): Promise<number>;
+}
+
 /** RISC-V loader program ID (PolkaVM bytecode). */
 declare const RISCV_LOADER_PROGRAM_ID = "RiscVLoader11111111111111111111111111111111";
 /** LoaderV4 program ID (eBPF programs). */
@@ -4635,4 +4900,4 @@ declare function deployInstruction(programAddress: PublicKey, authority: PublicK
  */
 declare function retractInstruction(programAddress: PublicKey, authority: PublicKey): Instruction;
 
-export { type AccountFilter, type AccountFilterParam, type AccountInfo, type AccountMeta, AccountMetaTable, type AllAccountsEntry, BASE_DERIVATION_PATH, BUFFER_BALANCE_FACTOR, BaseRpcClient, BincodeReader, type BincodeSchema, BincodeWriter, type BlockInfo, type Bump, CHACHA20_POLY1305_TAG_LENGTH, type ChainDefinition, type ClusterNodeInfo, type CompiledInstruction, type ConfigHashPrefix, type ConfirmTransactionOptions, type ConfirmedTransaction, type ConnectedNode, CryptoError, CryptoErrorCode, DEFAULT_CHUNK_SIZE, DEFAULT_CONFIRMATION_BATCH_SIZE, DEFAULT_MAX_RETRIES, DEFAULT_NUM_ACCOUNTS, DEFAULT_RETRY_BASE_DELAY_MS, DEFAULT_RETRY_MAX_DELAY_MS, type DeploymentConfig, DeploymentError, DeploymentErrorCode, ED25519_PUBLIC_KEY_LENGTH, type EnumVariant, type EpochConsensusConfigRequest, type EpochInfo, type EventData, type FeeResponse, type GetAccountsByOwnerConfig, type GetAllAccountsConfig, type GetBlockConfig, type GetSignaturesForAddressConfig, type GetTransactionsConfig, type GetValidatorAccountsRequest, type GetWorkflowLineageRequest, type GetWorkflowLineageResponse, HPKE_ENC_LENGTH, HPKE_OVERHEAD_LENGTH, HpkeError, HpkeErrorCode, HttpTransport, type HttpTransportConfig, type IdentifierString, type InferSchema, type Instruction, type IsBlockhashValidResponse, KELVIN_PER_RLO, type Kelvin, Keypair, KeypairSigner, LOADER_V4_PROGRAM_ID, Message, type MessageHeader, Mnemonic, type MnemonicStrength, type OptionalAccountInfo, type OwnerAccount, type PDA, PROGRAM_DATA_OFFSET, PUBLIC_KEY_LENGTH, type PaginationInfo, ProgramDeployment, type ProgramDeploymentOptions, PublicKey, QueryRpcClient, RIALO_DEVNET_CHAIN, RIALO_LOCALNET_CHAIN, RIALO_MAINNET_CHAIN, RIALO_TESTNET_CHAIN, RISCV_LOADER_PROGRAM_ID, type RexDuty, type RexInfoAndDuties, RexValue, RexValueVariant, RialoClient, type RialoClientConfig, RialoError, RialoErrorType, type RialoNetwork, RiscVLoaderInstruction, RpcError, RpcErrorCode, type RpcErrorDetails$1 as RpcErrorDetails, SECRET_KEY_LENGTH, SECRET_SHARING_HPKE_INFO, SIGNATURE_LENGTH, SYSTEM_PROGRAM_ID, Schema, type SecretSharingPubkey, type Seed, type SendAndConfirmOptions, type SendTransactionOptions, Signature$1 as Signature, type SignatureInfo, type SignatureStatus, type Signer, type StakeAccountInfo, type StakeState, type StructField, type SubmitEpochChangeRequest, type SubmitEpochChangeResponse, type Subscription, type SubscriptionAccountMeta, type SubscriptionInstruction, type SubscriptionKind, SystemInstruction, type TimestampRange, type TokenBalance, Transaction, TransactionBuilder, type TransactionData, TransactionError, TransactionErrorCode, type TransactionInfo, type TransactionMessage, type TransactionNodeData, type TransactionResponse, TransactionRpcClient, type TransactionStatusMetadata, type TransactionWithMeta, type TriggerInfo, type TriggeredTransaction, type TruncationReason, URL_DEVNET, URL_LOCALNET, URL_MAINNET, URL_TESTNET, USER_SECRET_AAD, type ValidatorAccountInfo, type ValidatorHealth, type ValidatorInfoRequest, type WorkflowLineage, type WorkflowNode, X25519_PUBLIC_KEY_LENGTH, allocateInstruction, assignInstruction, calculateBackoff, concatBytes, createAccount, createBorshInstruction, createRialoClient, deployInstruction, deserialize, deserializeBorsh, deserializeCompactU16, deserializeStrict, encodeBorshData, encryptForRex, fromBase64, getCiphertextLength, getDefaultRialoClientConfig, getDevnetUrl, getLocalnetUrl, getMainnetUrl, getTestnetUrl, hpkeEncrypt, isOnCurve, isValidCiphertextLength, retractInstruction, seedToBytes, serialize, serializeBorsh, serializeCompactU16, setProgramLengthInstruction, sleep, toBase64, transferInstruction, writeCompactU16, writeInstruction };
+export { type AccountFilter, type AccountFilterParam, type AccountInfo, type AccountMeta, AccountMetaTable, type AllAccountsEntry, BASE_DERIVATION_PATH, BUFFER_BALANCE_FACTOR, BaseRpcClient, BincodeReader, type BincodeSchema, BincodeWriter, type BlockInfo, type Bump, CHACHA20_POLY1305_TAG_LENGTH, type ChainDefinition, type ClusterNodeInfo, type CompiledInstruction, type ConfigHashPrefix, type ConfirmTransactionOptions, type ConfirmedTransaction, type ConnectedNode, CryptoError, CryptoErrorCode, DEFAULT_CHUNK_SIZE, DEFAULT_CONFIRMATION_BATCH_SIZE, DEFAULT_MAX_RETRIES, DEFAULT_NUM_ACCOUNTS, DEFAULT_RETRY_BASE_DELAY_MS, DEFAULT_RETRY_MAX_DELAY_MS, type DeploymentConfig, DeploymentError, DeploymentErrorCode, type DerivedKeypairInfo, ED25519_PUBLIC_KEY_LENGTH, type EnumVariant, type EpochConsensusConfigRequest, type EpochInfo, type EventData, type FeeResponse, type DeploymentConfig$1 as GeneratedDeploymentConfig, type GetAccountsByOwnerConfig, type GetAllAccountsConfig, type GetBlockConfig, type GetSignaturesForAddressConfig, type GetTransactionsConfig, type GetValidatorAccountsRequest, type GetWorkflowLineageRequest, type GetWorkflowLineageResponse, HPKE_ENC_LENGTH, HPKE_OVERHEAD_LENGTH, HpkeError, HpkeErrorCode, HttpTransport, type HttpTransportConfig, type IdentifierString, InMemoryKeyringProvider, type InferSchema, type Instruction, type InvocationAccountMeta, type IsBlockhashValidResponse, KELVIN_PER_RLO, type Kelvin, Keypair, KeypairSigner, Keyring, KeyringProvider, LOADER_V4_PROGRAM_ID, type LoaderType, Message, type MessageHeader, Mnemonic, type MnemonicStrength, type OptionalAccountInfo, type OwnerAccount, type PDA, PROGRAM_DATA_OFFSET, PUBLIC_KEY_LENGTH, type PaginationInfo, ProgramDeployment, type ProgramDeploymentOptions, type ProgramInstruction, PublicKey, QueryRpcClient, RIALO_DEVNET_CHAIN, RIALO_LOCALNET_CHAIN, RIALO_MAINNET_CHAIN, RIALO_TESTNET_CHAIN, RISCV_LOADER_PROGRAM_ID, type RexDuty, type RexInfoAndDuties, RexValue, RexValueVariant, RialoClient, type RialoClientConfig, RialoError, RialoErrorType, RialoKeyring, type RialoNetwork, RiscVLoaderInstruction, RpcError, RpcErrorCode, type RpcErrorDetails$1 as RpcErrorDetails, SECRET_KEY_LENGTH, SECRET_SHARING_HPKE_INFO, SIGNATURE_LENGTH, SYSTEM_PROGRAM_ID, Schema, type SecretSharingPubkey, type Seed, type SendAndConfirmOptions, type SendTransactionOptions, Signature$1 as Signature, type SignatureInfo, type SignatureStatus, type Signer, type StakeAccountInfo, type StakeState, type StructField, type SubmitEpochChangeRequest, type SubmitEpochChangeResponse, type Subscription, type SubscriptionAccountMeta, type SubscriptionInstruction, type SubscriptionKind, SystemInstruction, type TimestampRange, type TokenBalance, Transaction, TransactionBuilder, type TransactionData, TransactionError, TransactionErrorCode, type TransactionInfo, type TransactionMessage, type TransactionNodeData, type TransactionResponse, TransactionRpcClient, type TransactionStatusMetadata, type TransactionWithMeta, type TriggerInfo, type TriggeredTransaction, type TruncationReason, URL_DEVNET, URL_LOCALNET, URL_MAINNET, URL_TESTNET, USER_SECRET_AAD, type ValidatorAccountInfo, type ValidatorHealth, type ValidatorInfoRequest, type WorkflowLineage, type WorkflowNode, X25519_PUBLIC_KEY_LENGTH, allocateInstruction, assignInstruction, calculateBackoff, concatBytes, createAccount, createBorshInstruction, createRialoClient, deployInstruction, deserialize, deserializeBorsh, deserializeCompactU16, deserializeStrict, encodeBorshData, encryptForRex, fromBase64, getCiphertextLength, getDefaultRialoClientConfig, getDevnetUrl, getLocalnetUrl, getMainnetUrl, getTestnetUrl, hpkeEncrypt, isOnCurve, isValidCiphertextLength, retractInstruction, seedToBytes, serialize, serializeBorsh, serializeCompactU16, setProgramLengthInstruction, sleep, toBase64, transferInstruction, writeCompactU16, writeInstruction };