@smartledger/keys 3.1.1 → 4.0.0

package/dist/cjs/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":";AAAA;;;;;GAKG","sourcesContent":["/**\n * @smartledger/keys - Key Management SDK\n * \n * Single source of truth for cryptographic key operations.\n * Provides a clean API that hides complexity and ensures consistency.\n */\n\nimport { KeyMeta, CryptoProfile, DerivationContext } from '@smartledger/crypto';\n\n/**\n * Public key record (safe to expose, no private key).\n */\nexport interface KeyRecord {\n  meta: KeyMeta;\n  publicKey: Uint8Array;\n}\n\n/**\n * Key creation options.\n */\nexport interface CreateKeyOptions {\n  /** Optional expiration date (ISO 8601) */\n  expiresAt?: string;\n  \n  /** Key usage (default: ['signing']) */\n  usage?: Array<'signing' | 'encryption' | 'both'>;\n  \n  /** Crypto profile version (default: '1.0.0') */\n  cryptoProfileVersion?: string;\n  \n  /** Optional derivation context for deterministic key generation */\n  derivationContext?: DerivationContext;\n}\n\n/**\n * Signature generated by a specific suite/key combination.\n */\nexport interface SuiteSignature {\n  suiteId: string;\n  keyId: string;\n  signature: Uint8Array;\n}\n\n/** Result of signing with one or more suites. */\nexport interface MultiSignatureResult {\n  signatures: SuiteSignature[];\n}\n\n/** Per-suite verification outcome. */\nexport interface SuiteVerificationResult {\n  suiteId: string;\n  keyId: string;\n  valid: boolean;\n  error?: string;\n}\n\n/** Aggregate verification outcome across suites. */\nexport interface MultiVerificationResult {\n  results: SuiteVerificationResult[];\n  /**\n   * True only if at least one signature was supplied, EVERY supplied\n   * signature is valid, and EVERY required suite has a valid signature by a\n   * key of the named agent. Never true for an empty or incomplete set.\n   */\n  allValid: boolean;\n  /** The suites this verification required. */\n  requiredSuites: string[];\n  /** Required suites for which no valid signature was supplied. */\n  missingSuites: string[];\n  /** Set when the set was refused for a reason no single signature explains. */\n  error?: string;\n}\n\n/**\n * Which key states a verification accepts.\n * - `'any'`: the signature is checked cryptographically and nothing else.\n *   Right for historical signatures; says nothing about the key today.\n * - `'not-revoked'`: additionally refuse keys whose status is `revoked`.\n * - `'usable'`: additionally require the key to be active and unexpired now.\n */\nexport type KeyStatusPolicy = 'any' | 'not-revoked' | 'usable';\n\n/** Options for {@link KeySDK.verifySignature}. */\nexport interface VerifySignatureOptions {\n  /** Default: `'any'`. */\n  keyStatus?: KeyStatusPolicy;\n}\n\n/** Options for {@link KeySDK.verifyWithSuites}. */\nexport interface VerifyWithSuitesOptions {\n  /**\n   * Suites that must each have a valid signature. This is the VERIFIER's\n   * policy and must come from the verifier's own configuration, never from\n   * the signature bundle being checked.\n   *\n   * Default: the suites of the agent's currently usable keys in this SDK's\n   * registry, so an agent holding ML-DSA and ECDSA keys requires both.\n   */\n  requiredSuites?: string[];\n  /** Default: `'not-revoked'`. */\n  keyStatus?: KeyStatusPolicy;\n}\n\n/** Options for {@link KeySDK.rotateAgentKeys}. */\nexport interface RotateAgentKeysOptions {\n  /**\n   * What to do with a key that was derived from a seed. Its replacement can\n   * only be generated at random here, because the SDK does not keep seeds, so\n   * the new key would NOT be recoverable from the mnemonic.\n   * - `'error'` (default): refuse, and rotate nothing.\n   * - `'skip'`: leave derived keys as they are and rotate the rest.\n   * - `'randomize'`: replace them with random keys anyway.\n   */\n  derivedKeys?: 'error' | 'skip' | 'randomize';\n  /**\n   * Expiry for the new keys. Omitted: each new key gets its predecessor's\n   * lifetime again, counted from now. `null`: no expiry.\n   */\n  expiresAt?: string | null;\n}\n\n/** Where in a BIP44 tree a wallet key lives. */\nexport interface WalletKeyPath {\n  /**\n   * SLIP-44 coin type. Required, with no default, because it decides which\n   * wallets will find the key again: Bitcoin (BTC) is 0, Bitcoin SV is 236.\n   */\n  coinType: number;\n  /** Account index (default: 0) */\n  account?: number;\n  /** Address index (default: 0) */\n  index?: number;\n  /** Use the internal/change chain (default: false) */\n  change?: boolean;\n  /** Optional BIP39 passphrase */\n  passphrase?: string;\n}\n\n/**\n * Key SDK - Single interface for all key operations.\n * \n * Design principles:\n * - Hide private keys from most callers\n * - Single source of truth for suite selection\n * - Crypto-agnostic API (suite is config, not code)\n * - Easy to audit (all key operations go through this)\n */\nexport interface KeySDK {\n  /**\n   * Create a new key for an agent/module.\n   * \n   * @param agentId Agent identifier (e.g. 'agent-resonance')\n   * @param profile Crypto configuration (which suites to use)\n   * @param options Optional expiration, usage, etc.\n   * @returns KeyRecord with metadata and public key\n   */\n  createKey(\n    agentId: string,\n    profile: CryptoProfile,\n    options?: CreateKeyOptions\n  ): Promise<KeyRecord>;\n  \n  /**\n   * Get an existing key by ID.\n   * \n   * @param keyId Key identifier\n   * @returns KeyRecord or null if not found\n   */\n  getKey(keyId: string): Promise<KeyRecord | null>;\n  \n  /**\n   * Sign a message with a key.\n   * \n   * Private key never leaves the SDK.\n   * \n   * @param keyId Which key to sign with\n   * @param message Message to sign (will be hashed internally)\n   * @returns Signature bytes\n   */\n  signWithKey(\n    keyId: string,\n    message: Uint8Array\n  ): Promise<Uint8Array>;\n  \n  /**\n   * Verify a signature against a public key.\n   * \n   * @param keyId Which key to verify with\n   * @param message Original message\n   * @param signature Signature to verify\n   * @param options `keyStatus` decides whether a revoked or expired key is\n   *   refused. By default only the cryptographic check is made, so a\n   *   signature by a since-revoked key still returns true.\n   * @returns true if valid\n   */\n  verifySignature(\n    keyId: string,\n    message: Uint8Array,\n    signature: Uint8Array,\n    options?: VerifySignatureOptions\n  ): Promise<boolean>;\n  \n  /**\n   * List all keys for an agent.\n   * \n   * @param agentId Agent identifier\n   * @param activeOnly If true, only return active keys (default: true)\n   * @returns Array of KeyRecords\n   */\n  listKeysForAgent(\n    agentId: string,\n    activeOnly?: boolean\n  ): Promise<KeyRecord[]>;\n  \n  /**\n   * Get the active crypto profile for an agent.\n   * \n   * Looks up the most recent active keys and infers the profile.\n   * \n   * @param agentId Agent identifier\n   * @returns CryptoProfile or null if no keys found\n   */\n  getActiveCryptoProfile(agentId: string): Promise<CryptoProfile | null>;\n  \n  /**\n   * Rotate an agent's keys.\n   * \n   * Generates new keypairs for all active keys, marks old ones as rotated.\n   * \n   * @param agentId Agent identifier\n   * @param options How to treat seed-derived keys, and the new keys' expiry\n   * @returns Array of new KeyRecords\n   */\n  rotateAgentKeys(agentId: string, options?: RotateAgentKeysOptions): Promise<KeyRecord[]>;\n  \n  /**\n   * Create key if it doesn't exist, otherwise return existing.\n   * \n   * Idempotent key creation for agent setup.\n   * \n   * @param agentId Agent identifier\n   * @param profile Crypto configuration\n   * @param options Creation options\n   * @returns KeyRecord (new or existing)\n   */\n  getOrCreateKey(\n    agentId: string,\n    profile: CryptoProfile,\n    options?: CreateKeyOptions\n  ): Promise<KeyRecord>;\n\n  /**\n   * Create both primary and secondary keys in a single call.\n   * Requires profile.secondarySignatureSuite to be set.\n   */\n  createDualSignatureKeys(\n    agentId: string,\n    profile: CryptoProfile,\n    options?: CreateKeyOptions\n  ): Promise<{ primaryKey: KeyRecord; secondaryKey: KeyRecord }>;\n\n  /**\n   * Idempotent dual-key creation; returns existing active keys when present.\n   */\n  getOrCreateDualSignatureKeys(\n    agentId: string,\n    profile: CryptoProfile,\n    options?: CreateKeyOptions\n  ): Promise<{ primaryKey: KeyRecord; secondaryKey: KeyRecord }>;\n\n  /**\n   * Sign with one or more suites. If suites not provided, uses active profile.\n   */\n  signWithSuites(\n    agentId: string,\n    message: Uint8Array,\n    suites?: string[]\n  ): Promise<MultiSignatureResult>;\n\n  /**\n   * Verify multiple signatures for an agent.\n   */\n  verifyWithSuites(\n    agentId: string,\n    message: Uint8Array,\n    signatures: SuiteSignature[],\n    options?: VerifyWithSuitesOptions\n  ): Promise<MultiVerificationResult>;\n  \n  /**\n   * Generate a new BIP39 mnemonic phrase.\n   * \n   * @param strength 128 (12 words) or 256 (24 words)\n   * @returns Mnemonic phrase\n   */\n  generateMnemonic(strength?: 128 | 256): string;\n  \n  /**\n   * Create a key from a BIP39 mnemonic using HD derivation.\n   * \n   * @param agentId Agent identifier\n   * @param profile Crypto profile (must use derivation-capable suite)\n   * @param mnemonic BIP39 mnemonic phrase\n   * @param path BIP32 derivation path\n   * @param passphrase Optional BIP39 passphrase\n   * @param options Additional key creation options\n   * @returns KeyRecord with derived key\n   */\n  createKeyFromMnemonic(\n    agentId: string,\n    profile: CryptoProfile,\n    mnemonic: string,\n    path?: string,\n    passphrase?: string,\n    options?: CreateKeyOptions\n  ): Promise<KeyRecord>;\n  \n  /**\n   * Get available capabilities for a specific suite.\n   * \n   * @param suiteId Suite identifier\n   * @returns Array of capability names\n   */\n  getCapabilities(suiteId: string): string[];\n  \n  /**\n   * Find suites that support a specific capability.\n   * \n   * @param capability Capability name\n   * @returns Array of suite IDs\n   */\n  getSuitesWithCapability(capability: 'derivation' | 'encryption' | 'threshold'): string[];\n}\n\n/**\n * Agent metadata with crypto configuration.\n */\nexport interface AgentKeyConfig {\n  agentId: string;\n  version: string;\n  cryptoProfile: CryptoProfile;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":";AAAA;;;;;GAKG","sourcesContent":["/**\n * @smartledger/keys - Key Management SDK\n * \n * Single source of truth for cryptographic key operations.\n * Provides a clean API that hides complexity and ensures consistency.\n */\n\nimport { KeyMeta, CryptoProfile, DerivationContext } from '@smartledger/crypto';\n\n/**\n * Public key record (safe to expose, no private key).\n */\nexport interface KeyRecord {\n  meta: KeyMeta;\n  publicKey: Uint8Array;\n}\n\n/**\n * Key creation options.\n */\nexport interface CreateKeyOptions {\n  /** Optional expiration date (ISO 8601) */\n  expiresAt?: string;\n  \n  /** Key usage (default: ['signing']) */\n  usage?: Array<'signing' | 'encryption' | 'both'>;\n  \n  /** Crypto profile version (default: '1.0.0') */\n  cryptoProfileVersion?: string;\n  \n  /** Optional derivation context for deterministic key generation */\n  derivationContext?: DerivationContext;\n}\n\n/**\n * Signature generated by a specific suite/key combination.\n */\nexport interface SuiteSignature {\n  suiteId: string;\n  keyId: string;\n  signature: Uint8Array;\n}\n\n/** Result of signing with one or more suites. */\nexport interface MultiSignatureResult {\n  signatures: SuiteSignature[];\n}\n\n/** Per-suite verification outcome. */\nexport interface SuiteVerificationResult {\n  suiteId: string;\n  keyId: string;\n  valid: boolean;\n  error?: string;\n}\n\n/** Aggregate verification outcome across suites. */\nexport interface MultiVerificationResult {\n  results: SuiteVerificationResult[];\n  /**\n   * True only if at least one signature was supplied, EVERY supplied\n   * signature is valid, and EVERY required suite has a valid signature by a\n   * key of the named agent. Never true for an empty or incomplete set.\n   */\n  allValid: boolean;\n  /** The suites this verification required. */\n  requiredSuites: string[];\n  /** Required suites for which no valid signature was supplied. */\n  missingSuites: string[];\n  /** Set when the set was refused for a reason no single signature explains. */\n  error?: string;\n}\n\n/**\n * Which key states a verification accepts.\n * - `'any'`: the signature is checked cryptographically and nothing else.\n *   Right for historical signatures; says nothing about the key today.\n * - `'not-revoked'`: additionally refuse keys whose status is `revoked`.\n * - `'usable'`: additionally require the key to be active and unexpired now.\n */\nexport type KeyStatusPolicy = 'any' | 'not-revoked' | 'usable';\n\n/**\n * How a message becomes what a key signs.\n * - `'v4'` (default, and the only scheme this version signs with): ML-DSA\n *   signs the message itself, FIPS 204 pure mode, with the SDK's context\n *   string; ECDSA signs `SHA-256(message)`.\n * - `'v3-digest'`: what 3.x did — ML-DSA over `SHA3-256(message)` with the\n *   empty context. For verifying signatures made by 3.x only.\n */\nexport type SignatureScheme = 'v4' | 'v3-digest';\n\n/** Options for {@link KeySDK.verifySignature}. */\nexport interface VerifySignatureOptions {\n  /** Default: `'any'`. */\n  keyStatus?: KeyStatusPolicy;\n  /** Default: `'v4'`. Pass `'v3-digest'` to verify a signature made by 3.x. */\n  scheme?: SignatureScheme;\n}\n\n/** Options for {@link KeySDK.verifyWithSuites}. */\nexport interface VerifyWithSuitesOptions {\n  /**\n   * Suites that must each have a valid signature. This is the VERIFIER's\n   * policy and must come from the verifier's own configuration, never from\n   * the signature bundle being checked.\n   *\n   * Default: the suites of the agent's currently usable keys in this SDK's\n   * registry, so an agent holding ML-DSA and ECDSA keys requires both.\n   */\n  requiredSuites?: string[];\n  /** Default: `'not-revoked'`. */\n  keyStatus?: KeyStatusPolicy;\n  /** Default: `'v4'`. Applies to every signature in the set. */\n  scheme?: SignatureScheme;\n}\n\n/** Options for {@link KeySDK.rotateAgentKeys}. */\nexport interface RotateAgentKeysOptions {\n  /**\n   * What to do with a key that was derived from a seed. Its replacement can\n   * only be generated at random here, because the SDK does not keep seeds, so\n   * the new key would NOT be recoverable from the mnemonic.\n   * - `'error'` (default): refuse, and rotate nothing.\n   * - `'skip'`: leave derived keys as they are and rotate the rest.\n   * - `'randomize'`: replace them with random keys anyway.\n   */\n  derivedKeys?: 'error' | 'skip' | 'randomize';\n  /**\n   * Expiry for the new keys. Omitted: each new key gets its predecessor's\n   * lifetime again, counted from now. `null`: no expiry.\n   */\n  expiresAt?: string | null;\n}\n\n/** Where in a BIP44 tree a wallet key lives. */\nexport interface WalletKeyPath {\n  /**\n   * SLIP-44 coin type. Required, with no default, because it decides which\n   * wallets will find the key again: Bitcoin (BTC) is 0, Bitcoin SV is 236.\n   */\n  coinType: number;\n  /** Account index (default: 0) */\n  account?: number;\n  /** Address index (default: 0) */\n  index?: number;\n  /** Use the internal/change chain (default: false) */\n  change?: boolean;\n  /** Optional BIP39 passphrase */\n  passphrase?: string;\n}\n\n/**\n * Key SDK - Single interface for all key operations.\n * \n * Design principles:\n * - Hide private keys from most callers\n * - Single source of truth for suite selection\n * - Crypto-agnostic API (suite is config, not code)\n * - Easy to audit (all key operations go through this)\n */\nexport interface KeySDK {\n  /**\n   * Create a new key for an agent/module.\n   * \n   * @param agentId Agent identifier (e.g. 'agent-resonance')\n   * @param profile Crypto configuration (which suites to use)\n   * @param options Optional expiration, usage, etc.\n   * @returns KeyRecord with metadata and public key\n   */\n  createKey(\n    agentId: string,\n    profile: CryptoProfile,\n    options?: CreateKeyOptions\n  ): Promise<KeyRecord>;\n  \n  /**\n   * Get an existing key by ID.\n   * \n   * @param keyId Key identifier\n   * @returns KeyRecord or null if not found\n   */\n  getKey(keyId: string): Promise<KeyRecord | null>;\n  \n  /**\n   * Sign a message with a key.\n   * \n   * Private key never leaves the SDK.\n   * \n   * @param keyId Which key to sign with\n   * @param message Message to sign (will be hashed internally)\n   * @returns Signature bytes\n   */\n  signWithKey(\n    keyId: string,\n    message: Uint8Array\n  ): Promise<Uint8Array>;\n  \n  /**\n   * Verify a signature against a public key.\n   * \n   * @param keyId Which key to verify with\n   * @param message Original message\n   * @param signature Signature to verify\n   * @param options `keyStatus` decides whether a revoked or expired key is\n   *   refused. By default only the cryptographic check is made, so a\n   *   signature by a since-revoked key still returns true.\n   * @returns true if valid\n   */\n  verifySignature(\n    keyId: string,\n    message: Uint8Array,\n    signature: Uint8Array,\n    options?: VerifySignatureOptions\n  ): Promise<boolean>;\n  \n  /**\n   * List all keys for an agent.\n   * \n   * @param agentId Agent identifier\n   * @param activeOnly If true, only return active keys (default: true)\n   * @returns Array of KeyRecords\n   */\n  listKeysForAgent(\n    agentId: string,\n    activeOnly?: boolean\n  ): Promise<KeyRecord[]>;\n  \n  /**\n   * Get the active crypto profile for an agent.\n   * \n   * Looks up the most recent active keys and infers the profile.\n   * \n   * @param agentId Agent identifier\n   * @returns CryptoProfile or null if no keys found\n   */\n  getActiveCryptoProfile(agentId: string): Promise<CryptoProfile | null>;\n  \n  /**\n   * Rotate an agent's keys.\n   * \n   * Generates new keypairs for all active keys, marks old ones as rotated.\n   * \n   * @param agentId Agent identifier\n   * @param options How to treat seed-derived keys, and the new keys' expiry\n   * @returns Array of new KeyRecords\n   */\n  rotateAgentKeys(agentId: string, options?: RotateAgentKeysOptions): Promise<KeyRecord[]>;\n  \n  /**\n   * Create key if it doesn't exist, otherwise return existing.\n   * \n   * Idempotent key creation for agent setup.\n   * \n   * @param agentId Agent identifier\n   * @param profile Crypto configuration\n   * @param options Creation options\n   * @returns KeyRecord (new or existing)\n   */\n  getOrCreateKey(\n    agentId: string,\n    profile: CryptoProfile,\n    options?: CreateKeyOptions\n  ): Promise<KeyRecord>;\n\n  /**\n   * Create both primary and secondary keys in a single call.\n   * Requires profile.secondarySignatureSuite to be set.\n   */\n  createDualSignatureKeys(\n    agentId: string,\n    profile: CryptoProfile,\n    options?: CreateKeyOptions\n  ): Promise<{ primaryKey: KeyRecord; secondaryKey: KeyRecord }>;\n\n  /**\n   * Idempotent dual-key creation; returns existing active keys when present.\n   */\n  getOrCreateDualSignatureKeys(\n    agentId: string,\n    profile: CryptoProfile,\n    options?: CreateKeyOptions\n  ): Promise<{ primaryKey: KeyRecord; secondaryKey: KeyRecord }>;\n\n  /**\n   * Sign with one or more suites. If suites not provided, uses active profile.\n   */\n  signWithSuites(\n    agentId: string,\n    message: Uint8Array,\n    suites?: string[]\n  ): Promise<MultiSignatureResult>;\n\n  /**\n   * Verify multiple signatures for an agent.\n   */\n  verifyWithSuites(\n    agentId: string,\n    message: Uint8Array,\n    signatures: SuiteSignature[],\n    options?: VerifyWithSuitesOptions\n  ): Promise<MultiVerificationResult>;\n  \n  /**\n   * Generate a new BIP39 mnemonic phrase.\n   * \n   * @param strength 128 (12 words) or 256 (24 words)\n   * @returns Mnemonic phrase\n   */\n  generateMnemonic(strength?: 128 | 256): string;\n  \n  /**\n   * Create a key from a BIP39 mnemonic using HD derivation.\n   * \n   * @param agentId Agent identifier\n   * @param profile Crypto profile (must use derivation-capable suite)\n   * @param mnemonic BIP39 mnemonic phrase\n   * @param path BIP32 derivation path\n   * @param passphrase Optional BIP39 passphrase\n   * @param options Additional key creation options\n   * @returns KeyRecord with derived key\n   */\n  createKeyFromMnemonic(\n    agentId: string,\n    profile: CryptoProfile,\n    mnemonic: string,\n    path?: string,\n    passphrase?: string,\n    options?: CreateKeyOptions\n  ): Promise<KeyRecord>;\n  \n  /**\n   * Get available capabilities for a specific suite.\n   * \n   * @param suiteId Suite identifier\n   * @returns Array of capability names\n   */\n  getCapabilities(suiteId: string): string[];\n  \n  /**\n   * Find suites that support a specific capability.\n   * \n   * @param capability Capability name\n   * @returns Array of suite IDs\n   */\n  getSuitesWithCapability(capability: 'derivation' | 'encryption' | 'threshold'): string[];\n}\n\n/**\n * Agent metadata with crypto configuration.\n */\nexport interface AgentKeyConfig {\n  agentId: string;\n  version: string;\n  cryptoProfile: CryptoProfile;\n}\n"]}

package/dist/esm/sdk.d.ts

@@ -14,7 +14,18 @@ export interface KeySDKConfig {
     keyRegistry: KeyRegistry;
     /** Signature suite registry instance */
     suiteRegistry: SignatureSuiteRegistry;
+    /**
+     * Context string for ML-DSA signatures (FIPS 204), 1 to 255 bytes. An
+     * ML-DSA signature verifies only under the context it was made with, so
+     * two deployments with different contexts cannot have ML-DSA signatures
+     * replayed between them. It does NOT enter an ECDSA signature: ECDSA has
+     * no context, and the same ECDSA key and message verify in any deployment.
+     * Default: `@smartledger/keys/4`.
+     */
+    signingContext?: string | Uint8Array;
 }
+/** The default ML-DSA context string of this major version. */
+export declare const DEFAULT_SIGNING_CONTEXT = "@smartledger/keys/4";
 export { agentIdOfKey };
 /**
  * Default KeySDK implementation.
@@ -28,6 +39,7 @@ export declare class DefaultKeySDK implements KeySDK {
     private counterInitialized;
     private counterInitPromises;
     private getOrCreateInFlight;
+    private signingContext;
     constructor(config: KeySDKConfig);
     /**
      * Create a new key for an agent.
@@ -44,6 +56,19 @@ export declare class DefaultKeySDK implements KeySDK {
      *   registered for signing
      */
     signWithKey(keyId: string, message: Uint8Array): Promise<Uint8Array>;
+    /**
+     * What a key of `suiteId` signs for `message` under a scheme.
+     *
+     * v4: ML-DSA signs the message itself in FIPS 204 pure mode with this SDK's
+     * context string, so a standard verifier needs only the message and the
+     * context, and the signature is not limited by an outside digest. ECDSA
+     * signs SHA-256(message): ECDSA signs a digest by definition and has no
+     * context, so callers who need domain separation for it put the purpose in
+     * the message.
+     *
+     * v3-digest: what 3.x signed — SHA3-256(message) for ML-DSA, empty context.
+     */
+    private signingInput;
     /**
      * Verify a signature.
      *
@@ -194,10 +219,6 @@ export declare class DefaultKeySDK implements KeySDK {
      * @returns KeyRecord with Bitcoin-compatible key
      */
     createBitcoinWalletKey(agentId: string, mnemonic: string, accountIndex?: number, addressIndex?: number, isChange?: boolean, options?: CreateKeyOptions): Promise<KeyRecord>;
-    /**
-     * Helper: Get hash algorithm for a suite.
-     */
-    private getHashAlgorithm;
     /**
      * Helper: register a key under the agent's next free key ID.
      *

package/dist/esm/sdk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../src/sdk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,WAAW,EACX,sBAAsB,EAGtB,aAAa,EAKb,YAAY,EAQb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,MAAM,EACN,SAAS,EACT,gBAAgB,EAEhB,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EAGd,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACd,MAAM,YAAY,CAAC;AAEpB;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,4BAA4B;IAC5B,WAAW,EAAE,WAAW,CAAC;IAEzB,wCAAwC;IACxC,aAAa,EAAE,sBAAsB,CAAC;CACvC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC;AAuBxB;;;;GAIG;AACH,qBAAa,aAAc,YAAW,MAAM;IAC1C,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,aAAa,CAAyB;IAC9C,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,OAAO,CAAC,mBAAmB,CAAoC;IAC/D,OAAO,CAAC,mBAAmB,CAAyC;gBAExD,MAAM,EAAE,YAAY;IAKhC;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,SAAS,CAAC;IA4CrB;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAUtD;;;;;OAKG;IACG,WAAW,CACf,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,UAAU,CAAC;IA+BtB;;;;;;;OAOG;IACG,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,UAAU,EACrB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,OAAO,CAAC;IAcnB,gFAAgF;YAClE,aAAa;IAgB3B;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,UAAU,GAAE,OAAc,GACzB,OAAO,CAAC,SAAS,EAAE,CAAC;IAuBvB;;OAEG;IACG,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAmB5E;;;;;;;;;;OAUG;IACG,eAAe,CACnB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,SAAS,EAAE,CAAC;IAmDvB;;;;;;OAMG;IACG,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,SAAS,CAAC;IAiCrB;;OAEG;IACG,uBAAuB,CAC3B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC;QAAE,UAAU,EAAE,SAAS,CAAC;QAAC,YAAY,EAAE,SAAS,CAAA;KAAE,CAAC;IAiB9D;;OAEG;IACG,4BAA4B,CAChC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC;QAAE,UAAU,EAAE,SAAS,CAAC;QAAC,YAAY,EAAE,SAAS,CAAA;KAAE,CAAC;IAiB9D;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAUzB;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,oBAAoB,CAAC;IAyBhC;;;;;;;;;;;;;;;OAeG;IACG,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,cAAc,EAAE,EAC5B,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,uBAAuB,CAAC;IA0FnC;;;;;OAKG;IACH,gBAAgB,CAAC,QAAQ,GAAE,GAAG,GAAG,GAAS,GAAG,MAAM;IAKnD;;;;;;;;;;;;;OAaG;IACG,qBAAqB,CACzB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,MAA6C,EACnD,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,SAAS,CAAC;IAkBrB;;;;;OAKG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE;IAW1C;;;;;OAKG;IACH,uBAAuB,CAAC,UAAU,EAAE,YAAY,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,EAAE;IAOxF;;;;;;;;;;;;OAYG;IACG,eAAe,CACnB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,aAAa,EACnB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,SAAS,CAAC;IAsBrB;;;;;;;;;;;;;;;;;;OAkBG;IACG,sBAAsB,CAC1B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,MAAU,EACxB,YAAY,GAAE,MAAU,EACxB,QAAQ,GAAE,OAAe,EACzB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,SAAS,CAAC;IAarB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;OAQG;YACW,oBAAoB;IAyBlC;;OAEG;YACW,cAAc;IAoC5B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAW3B,OAAO,CAAC,gBAAgB;CAKzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,MAAM,CAsBnE"}
+{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../src/sdk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,WAAW,EACX,sBAAsB,EAGtB,aAAa,EAKb,YAAY,EAQb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,MAAM,EACN,SAAS,EACT,gBAAgB,EAEhB,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EAGd,sBAAsB,EACtB,uBAAuB,EAEvB,sBAAsB,EACtB,aAAa,EACd,MAAM,YAAY,CAAC;AAEpB;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,4BAA4B;IAC5B,WAAW,EAAE,WAAW,CAAC;IAEzB,wCAAwC;IACxC,aAAa,EAAE,sBAAsB,CAAC;IAEtC;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;CACtC;AAED,+DAA+D;AAC/D,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,CAAC;AAuBxB;;;;GAIG;AACH,qBAAa,aAAc,YAAW,MAAM;IAC1C,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,aAAa,CAAyB;IAC9C,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,OAAO,CAAC,mBAAmB,CAAoC;IAC/D,OAAO,CAAC,mBAAmB,CAAyC;IAEpE,OAAO,CAAC,cAAc,CAAa;gBAEvB,MAAM,EAAE,YAAY;IAWhC;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,SAAS,CAAC;IA4CrB;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAUtD;;;;;OAKG;IACG,WAAW,CACf,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,UAAU,CAAC;IA2BtB;;;;;;;;;;;OAWG;YACW,YAAY;IAgB1B;;;;;;;OAOG;IACG,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,UAAU,EACrB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,OAAO,CAAC;IAcnB,gFAAgF;YAClE,aAAa;IAgB3B;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,UAAU,GAAE,OAAc,GACzB,OAAO,CAAC,SAAS,EAAE,CAAC;IAuBvB;;OAEG;IACG,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAmB5E;;;;;;;;;;OAUG;IACG,eAAe,CACnB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,SAAS,EAAE,CAAC;IAmDvB;;;;;;OAMG;IACG,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,SAAS,CAAC;IAiCrB;;OAEG;IACG,uBAAuB,CAC3B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC;QAAE,UAAU,EAAE,SAAS,CAAC;QAAC,YAAY,EAAE,SAAS,CAAA;KAAE,CAAC;IAiB9D;;OAEG;IACG,4BAA4B,CAChC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC;QAAE,UAAU,EAAE,SAAS,CAAC;QAAC,YAAY,EAAE,SAAS,CAAA;KAAE,CAAC;IAiB9D;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAUzB;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,oBAAoB,CAAC;IAyBhC;;;;;;;;;;;;;;;OAeG;IACG,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,cAAc,EAAE,EAC5B,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,uBAAuB,CAAC;IA0FnC;;;;;OAKG;IACH,gBAAgB,CAAC,QAAQ,GAAE,GAAG,GAAG,GAAS,GAAG,MAAM;IAKnD;;;;;;;;;;;;;OAaG;IACG,qBAAqB,CACzB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,MAA6C,EACnD,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,SAAS,CAAC;IAkBrB;;;;;OAKG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE;IAW1C;;;;;OAKG;IACH,uBAAuB,CAAC,UAAU,EAAE,YAAY,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,EAAE;IAOxF;;;;;;;;;;;;OAYG;IACG,eAAe,CACnB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,aAAa,EACnB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,SAAS,CAAC;IAsBrB;;;;;;;;;;;;;;;;;;OAkBG;IACG,sBAAsB,CAC1B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,MAAU,EACxB,YAAY,GAAE,MAAU,EACxB,QAAQ,GAAE,OAAe,EACzB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,SAAS,CAAC;IAarB;;;;;;;;OAQG;YACW,oBAAoB;IAyBlC;;OAEG;YACW,cAAc;IAoC5B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAW3B,OAAO,CAAC,gBAAgB;CAKzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,MAAM,CAuBnE"}

package/dist/esm/sdk.js

@@ -5,6 +5,8 @@
  * a clean, high-level API for key operations.
  */
 import { KeyRegistry, SignatureSuiteRegistry, hashBytes, assertKeyUsable, isKeyUsable, cloneKeyMeta, agentIdOfKey, KeyAlreadyExistsError, BIP32Derivation, InMemoryKeyStorage, BsvEcdsaSuite, MlDsa44Suite, MlDsa65Suite, MlDsa87Suite, } from '@smartledger/crypto';
+/** The default ML-DSA context string of this major version. */
+export const DEFAULT_SIGNING_CONTEXT = '@smartledger/keys/4';
 export { agentIdOfKey };
 const COUNTER_SUFFIX = /^pk-[^:-]+-(\d+)$/;
 const MAX_KEY_ID_ATTEMPTS = 8;
@@ -38,6 +40,12 @@ export class DefaultKeySDK {
         this.getOrCreateInFlight = new Map();
         this.keyRegistry = config.keyRegistry;
         this.suiteRegistry = config.suiteRegistry;
+        const context = config.signingContext ?? DEFAULT_SIGNING_CONTEXT;
+        const bytes = typeof context === 'string' ? new TextEncoder().encode(context) : Uint8Array.from(context);
+        if (bytes.length < 1 || bytes.length > 255) {
+            throw new Error('signingContext must be 1 to 255 bytes');
+        }
+        this.signingContext = bytes;
     }
     /**
      * Create a new key for an agent.
@@ -109,10 +117,31 @@ export class DefaultKeySDK {
         }
         // Get suite and sign
         const suite = this.suiteRegistry.getSuite(result.meta.suiteId);
-        // Hash the message (consistent with signAgentResponse)
-        const hashAlg = this.getHashAlgorithm(result.meta.suiteId);
-        const messageHash = await hashBytes(message, hashAlg);
-        return await suite.sign(result.keypair.privateKey, messageHash);
+        const { input, options } = await this.signingInput(result.meta.suiteId, message, 'v4');
+        return await suite.sign(result.keypair.privateKey, input, options);
+    }
+    /**
+     * What a key of `suiteId` signs for `message` under a scheme.
+     *
+     * v4: ML-DSA signs the message itself in FIPS 204 pure mode with this SDK's
+     * context string, so a standard verifier needs only the message and the
+     * context, and the signature is not limited by an outside digest. ECDSA
+     * signs SHA-256(message): ECDSA signs a digest by definition and has no
+     * context, so callers who need domain separation for it put the purpose in
+     * the message.
+     *
+     * v3-digest: what 3.x signed — SHA3-256(message) for ML-DSA, empty context.
+     */
+    async signingInput(suiteId, message, scheme) {
+        if (scheme !== 'v4' && scheme !== 'v3-digest') {
+            throw new Error(`Unknown signature scheme: ${String(scheme)}`);
+        }
+        if (suiteId.startsWith('ml-dsa')) {
+            return scheme === 'v4'
+                ? { input: message, options: { context: this.signingContext } }
+                : { input: await hashBytes(message, 'sha3-256') };
+        }
+        return { input: await hashBytes(message, 'sha256') };
     }
     /**
      * Verify a signature.
@@ -130,15 +159,14 @@ export class DefaultKeySDK {
         if (!statusAllows(result.meta, options.keyStatus ?? 'any')) {
             return false;
         }
-        return this.verifyAgainst(result.meta, result.publicKey, message, signature);
+        return this.verifyAgainst(result.meta, result.publicKey, message, signature, options.scheme ?? 'v4');
     }
     /** The cryptographic check alone. Anything but a strict `true` is a failure. */
-    async verifyAgainst(meta, publicKey, message, signature) {
+    async verifyAgainst(meta, publicKey, message, signature, scheme = 'v4') {
         try {
             const suite = this.suiteRegistry.getSuite(meta.suiteId);
-            const hashAlg = this.getHashAlgorithm(meta.suiteId);
-            const messageHash = await hashBytes(message, hashAlg);
-            return (await suite.verify(publicKey, messageHash, signature)) === true;
+            const { input, options } = await this.signingInput(meta.suiteId, message, scheme);
+            return (await suite.verify(publicKey, input, signature, options)) === true;
         }
         catch {
             return false;
@@ -388,7 +416,7 @@ export class DefaultKeySDK {
                     fail('Signature must be a Uint8Array');
                     continue;
                 }
-                const valid = await this.verifyAgainst(key.meta, key.publicKey, message, entry.signature);
+                const valid = await this.verifyAgainst(key.meta, key.publicKey, message, entry.signature, options.scheme ?? 'v4');
                 if (valid) {
                     results.push({ suiteId, keyId, valid: true });
                 }
@@ -532,15 +560,6 @@ export class DefaultKeySDK {
         const path = BIP32Derivation.bitcoinPath(accountIndex, isChange ? 1 : 0, addressIndex);
         return this.createKeyFromMnemonic(agentId, { primarySignatureSuite: 'bsv-ecdsa-secp256k1' }, mnemonic, path, undefined, options);
     }
-    /**
-     * Helper: Get hash algorithm for a suite.
-     */
-    getHashAlgorithm(suiteId) {
-        if (suiteId.startsWith('ml-dsa')) {
-            return 'sha3-256';
-        }
-        return 'sha256';
-    }
     /**
      * Helper: register a key under the agent's next free key ID.
      *
@@ -664,6 +683,7 @@ export function createKeySDK(config) {
     return new DefaultKeySDK({
         keyRegistry,
         suiteRegistry,
+        signingContext: config?.signingContext,
     });
 }
 //# sourceMappingURL=sdk.js.map

package/dist/esm/sdk.js.map

@@ -1 +1 @@
-{"version":3,"file":"sdk.js","sourceRoot":"","sources":["../../src/sdk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,WAAW,EACX,sBAAsB,EAItB,SAAS,EACT,eAAe,EACf,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,YAAY,GACb,MAAM,qBAAqB,CAAC;AA4B7B,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAC3C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B,SAAS,aAAa,CAAC,OAAgB;IACrC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa,EAAE,SAAqB;IACpD,2EAA2E;IAC3E,2DAA2D;IAC3D,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAuB;IAC1D,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;IAC/D,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,aAAa;IAQxB,YAAY,MAAoB;QALxB,eAAU,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,qBAAqB;QAC7D,uBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,wBAAmB,GAAG,IAAI,GAAG,EAAyB,CAAC;QACvD,wBAAmB,GAAG,IAAI,GAAG,EAA8B,CAAC;QAGlE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,OAAe,EACf,OAAsB,EACtB,UAA4B,EAAE;QAE9B,aAAa,CAAC,OAAO,CAAC,CAAC;QAEvB,YAAY;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAEzE,8CAA8C;QAC9C,IAAI,OAAO,CAAC;QAEZ,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC9B,qCAAqC;YACrC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC;gBACpC,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;gBAC7D,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,CAAC,OAAO,sCAAsC;oBAC7D,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;wBACnB,CAAC,CAAC,sCAAsC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;4BAC9D,4EAA4E;wBAC9E,CAAC,CAAC,8EAA8E,CAAC,CACpF,CAAC;YACJ,CAAC;YAED,4BAA4B;YAC5B,OAAO,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,iCAAiC;YACjC,OAAO,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,qBAAqB,EAAE,KAAK,CAAC,EAAE,CAC3F,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,qBAAqB,EAAE;YAC1E,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC;YACnC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,IAAI,OAAO;YAC7D,+DAA+D;YAC/D,UAAU,EAAE,OAAO,CAAC,iBAAiB;gBACnC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,iBAAiB,CAAC,IAAI,IAAI,EAAE,EAAE;gBAChD,CAAC,CAAC,SAAS;SACd,CAAC,CACH,CAAC;QAEF,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CACf,KAAa,EACb,OAAmB;QAEnB,oCAAoC;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,aAAa,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACjF,CAAC;QACD,yEAAyE;QACzE,qEAAqE;QACrE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAE7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,sCAAsC,KAAK,YAAY,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvF,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE/D,uDAAuD;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEtD,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CACnB,KAAa,EACb,OAAmB,EACnB,SAAqB,EACrB,UAAkC,EAAE;QAEpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/E,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,aAAa,CACzB,IAAa,EACb,SAAqB,EACrB,OAAmB,EACnB,SAAqB;QAErB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,KAAK,IAAI,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAe,EACf,aAAsB,IAAI;QAE1B,aAAa,CAAC,OAAO,CAAC,CAAC;QAEvB,MAAM,IAAI,GAAG,UAAU;YACrB,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE;YACzC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QAEtC,yDAAyD;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,CAAC;QAE5E,wBAAwB;QACxB,MAAM,OAAO,GAAgB,EAAE,CAAC;QAEhC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/D,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAAC,OAAe;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAExD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,iBAAiB;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEtC,+CAA+C;QAC/C,OAAO;YACL,qBAAqB,EAAE,UAAU,CAAC,CAAC,CAAC;YACpC,uBAAuB,EAAE,UAAU,CAAC,CAAC,CAAC;SACvC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,eAAe,CACnB,OAAe,EACf,UAAkC,EAAE;QAEpC,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAE9D,8CAA8C;QAC9C,MAAM,QAAQ,GAAgB,EAAE,CAAC;QACjC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,yEAAyE;YACzE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC9B,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;oBAC9B,MAAM,IAAI,KAAK,CACb,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,2BAA2B;wBACpD,SAAS,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,SAAS,4BAA4B;wBAChF,4EAA4E;wBAC5E,uEAAuE;wBACvE,gFAAgF,CACnF,CAAC;gBACJ,CAAC;gBACD,IAAI,aAAa,KAAK,MAAM;oBAAE,SAAS;YACzC,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,oEAAoE;QACpE,MAAM,YAAY,GAAc,EAAE,CAAC;QACnC,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClE,YAAY,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,OAAO,GAAgB,EAAE,CAAC;QAEhC,KAAK,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAEnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAC1F,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE;gBACrE,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CACH,CAAC;YAEF,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAClB,OAAe,EACf,OAAsB,EACtB,UAA4B,EAAE;QAE9B,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAEtE,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE;YACvB,sBAAsB;YACtB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAChE,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,qBAAqB,CACtD,CAAC;YAEF,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,UAAU,CAAC;YACpB,CAAC;YAED,iBAAiB;YACjB,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACzD,CAAC,CAAC,EAAE,CAAC;QAEL,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB,CAC3B,OAAe,EACf,OAAsB,EACtB,UAA4B,EAAE;QAE9B,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEhC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE;YAC/C,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;SACrD,EAAE,OAAO,CAAC,CAAC;QAEZ,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE;YACjD,qBAAqB,EAAE,OAAO,CAAC,uBAAuB;SACvD,EAAE,OAAO,CAAC,CAAC;QAEZ,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,4BAA4B,CAChC,OAAe,EACf,OAAsB,EACtB,UAA4B,EAAE;QAE9B,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEhC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;YACpD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;SACrD,EAAE,OAAO,CAAC,CAAC;QAEZ,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;YACtD,qBAAqB,EAAE,OAAO,CAAC,uBAAuB;SACvD,EAAE,OAAO,CAAC,CAAC;QAEZ,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACK,iBAAiB,CAAC,OAAsB;QAC9C,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC3D,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,uBAAwB,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,qBAAqB,KAAK,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,2DAA2D,OAAO,CAAC,qBAAqB,EAAE,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAe,EACf,OAAmB,EACnB,MAAiB;QAEjB,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAExF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC5B,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CACvE,CAAC;QACF,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;YAC7D,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,gBAAgB,OAAO,GAAG,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAClE,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAe,EACf,OAAmB,EACnB,UAA4B,EAC5B,UAAmC,EAAE;QAErC,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC;QAErD,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAC/B,IAAI,GAAG,CACL,OAAO,CAAC,cAAc;YACpB,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CACxE,CACF,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,UAAqC,EAAE,EAA2B,EAAE,CAAC,CAAC;YACnG,OAAO;YACP,QAAQ,EAAE,KAAK;YACf,cAAc;YACd,aAAa,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC;YACzF,KAAK;SACN,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,OAAO,GAA8B,EAAE,CAAC;QAE9C,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAEtF,IAAI,CAAC;gBACH,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC;oBACpC,IAAI,CAAC,iCAAiC,OAAO,GAAG,CAAC,CAAC;oBAClD,SAAS;gBACX,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACvD,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,IAAI,CAAC,eAAe,CAAC,CAAC;oBACtB,SAAS;gBACX,CAAC;gBACD,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;oBACjC,IAAI,CAAC,0BAA0B,GAAG,CAAC,IAAI,CAAC,OAAO,sBAAsB,OAAO,EAAE,CAAC,CAAC;oBAChF,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;oBACvC,IAAI,CAAC,oCAAoC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,aAAa,SAAS,GAAG,CAAC,CAAC;oBAC/F,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,YAAY,UAAU,CAAC,EAAE,CAAC;oBAC7C,IAAI,CAAC,gCAAgC,CAAC,CAAC;oBACvC,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC1F,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,+BAA+B,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,MAAM,CACX,8BAA8B,OAAO,+DAA+D,EACpG,OAAO,CACR,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QAED,wEAAwE;QACxE,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CACzC,QAAQ,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAClE,CAAC;QACF,MAAM,kBAAkB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;QAEhE,OAAO;YACL,OAAO;YACP,QAAQ,EAAE,kBAAkB,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAC1D,cAAc;YACd,aAAa;YACb,GAAG,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;gBAC1B,CAAC,CAAC,EAAE,KAAK,EAAE,6CAA6C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;gBACpF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,WAAsB,GAAG;QACxC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,qBAAqB,CACzB,OAAe,EACf,OAAsB,EACtB,QAAgB,EAChB,OAAe,eAAe,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EACnD,UAAmB,EACnB,UAA4B,EAAE;QAE9B,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAExD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE;gBAC5C,GAAG,OAAO;gBACV,iBAAiB,EAAE;oBACjB,IAAI;oBACJ,IAAI;iBACL;aACF,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,2EAA2E;YAC3E,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,OAAe;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,IAAI,GAAa,EAAE,CAAC;QAE1B,IAAI,KAAK,CAAC,YAAY,EAAE,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5D,IAAK,KAAK,CAAC,YAAoB,EAAE,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrE,IAAK,KAAK,CAAC,YAAoB,EAAE,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAEnE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,uBAAuB,CAAC,UAAqD;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;QACpD,OAAO,SAAS;aACb,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAE,KAAK,CAAC,YAAoB,EAAE,CAAC,UAAU,CAAC,CAAC;aAC5D,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,eAAe,CACnB,OAAe,EACf,QAAgB,EAChB,IAAmB,EACnB,UAA4B,EAAE;QAE9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAAG,eAAe,CAAC,SAAS,CAC9C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,OAAO,IAAI,CAAC,EACjB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACnB,IAAI,CAAC,KAAK,IAAI,CAAC,CAChB,CAAC;QACF,OAAO,IAAI,CAAC,qBAAqB,CAC/B,OAAO,EACP,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,EAChD,QAAQ,EACR,cAAc,EACd,IAAI,CAAC,UAAU,EACf,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAAe,EACf,QAAgB,EAChB,eAAuB,CAAC,EACxB,eAAuB,CAAC,EACxB,WAAoB,KAAK,EACzB,UAA4B,EAAE;QAE9B,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAEvF,OAAO,IAAI,CAAC,qBAAqB,CAC/B,OAAO,EACP,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,EAChD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,OAAe;QACtC,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,oBAAoB,CAChC,OAAe,EACf,OAAe,EACf,QAA6C;QAE7C,6DAA6D;QAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC;QAE9E,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,mBAAmB,EAAE,OAAO,EAAE,EAAE,CAAC;YAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,GAAG,OAAO,OAAO,SAAS,IAAI,OAAO,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,qBAAqB,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC3D,qEAAqE;gBACrE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACxC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,WAAW,mBAAmB,WAAW,CAC3F,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc,CAAC,OAAe;QAC1C,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,MAAM,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;oBAC9B,IAAI,CAAC;wBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;wBACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;4BACxC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,OAAO;gCAAE,OAAO,GAAG,CAAC;4BACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;4BACnD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;4BACzC,IAAI,CAAC,KAAK;gCAAE,OAAO,GAAG,CAAC;4BACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;4BACnC,OAAO,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;wBAC9D,CAAC,EAAE,CAAC,CAAC,CAAC;wBACN,+DAA+D;wBAC/D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;wBAC/E,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACvC,CAAC;4BAAS,CAAC;wBACT,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBAC3C,CAAC;gBACH,CAAC,CAAC,EAAE,CAAC;gBACL,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1D,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,WAAW,CAAC;YACpB,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,IAAiB;QAC3C,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACnD,IAAI,KAAK,KAAK,KAAK;gBAAE,OAAO,KAAK,GAAG,KAAK,CAAC;YAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnG,IAAI,YAAY,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;YAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,OAAe;QACtC,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC;QACxC,OAAO,CAAC,CAAC;IACX,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,MAA8B;IACzD,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,IAAI,WAAW,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAC;IACrF,MAAM,aAAa,GAAG,MAAM,EAAE,aAAa,IAAI,IAAI,sBAAsB,EAAE,CAAC;IAE5E,2CAA2C;IAC3C,EAAE;IACF,4EAA4E;IAC5E,qEAAqE;IACrE,sEAAsE;IACtE,2EAA2E;IAC3E,kEAAkE;IAClE,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;QAC3B,aAAa,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;QAC5C,aAAa,CAAC,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC;QAC3C,aAAa,CAAC,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC;QAC3C,aAAa,CAAC,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,IAAI,aAAa,CAAC;QACvB,WAAW;QACX,aAAa;KACd,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Default implementation of KeySDK.\n * \n * Integrates KeyRegistry and SignatureSuiteRegistry to provide\n * a clean, high-level API for key operations.\n */\n\nimport {\n  KeyRegistry,\n  SignatureSuiteRegistry,\n  KeyMeta,\n  Keypair,\n  CryptoProfile,\n  hashBytes,\n  assertKeyUsable,\n  isKeyUsable,\n  cloneKeyMeta,\n  agentIdOfKey,\n  KeyAlreadyExistsError,\n  BIP32Derivation,\n  InMemoryKeyStorage,\n  BsvEcdsaSuite,\n  MlDsa44Suite,\n  MlDsa65Suite,\n  MlDsa87Suite,\n} from '@smartledger/crypto';\nimport {\n  KeySDK,\n  KeyRecord,\n  CreateKeyOptions,\n  AgentKeyConfig,\n  MultiSignatureResult,\n  MultiVerificationResult,\n  SuiteSignature,\n  SuiteVerificationResult,\n  KeyStatusPolicy,\n  VerifySignatureOptions,\n  VerifyWithSuitesOptions,\n  RotateAgentKeysOptions,\n  WalletKeyPath,\n} from './types.js';\n\n/**\n * Configuration for DefaultKeySDK.\n */\nexport interface KeySDKConfig {\n  /** Key registry instance */\n  keyRegistry: KeyRegistry;\n  \n  /** Signature suite registry instance */\n  suiteRegistry: SignatureSuiteRegistry;\n}\n\nexport { agentIdOfKey };\n\nconst COUNTER_SUFFIX = /^pk-[^:-]+-(\\d+)$/;\nconst MAX_KEY_ID_ATTEMPTS = 8;\n\nfunction assertAgentId(agentId: unknown): asserts agentId is string {\n  if (typeof agentId !== 'string' || agentId.length === 0) {\n    throw new Error('agentId must be a non-empty string');\n  }\n}\n\nfunction toRecord(meta: KeyMeta, publicKey: Uint8Array): KeyRecord {\n  // Copies, so a caller cannot reach registry state through a KeyRecord even\n  // when a custom storage backend hands out its own objects.\n  return { meta: cloneKeyMeta(meta), publicKey: Uint8Array.from(publicKey) };\n}\n\nfunction statusAllows(meta: KeyMeta, policy: KeyStatusPolicy): boolean {\n  if (policy === 'any') return true;\n  if (policy === 'not-revoked') return meta.status !== 'revoked';\n  return isKeyUsable(meta);\n}\n\n/**\n * Default KeySDK implementation.\n * \n * Provides a simple, safe API for key operations while hiding complexity.\n */\nexport class DefaultKeySDK implements KeySDK {\n  private keyRegistry: KeyRegistry;\n  private suiteRegistry: SignatureSuiteRegistry;\n  private keyCounter = new Map<string, number>(); // agentId -> counter\n  private counterInitialized = new Set<string>();\n  private counterInitPromises = new Map<string, Promise<void>>();\n  private getOrCreateInFlight = new Map<string, Promise<KeyRecord>>();\n  \n  constructor(config: KeySDKConfig) {\n    this.keyRegistry = config.keyRegistry;\n    this.suiteRegistry = config.suiteRegistry;\n  }\n  \n  /**\n   * Create a new key for an agent.\n   */\n  async createKey(\n    agentId: string,\n    profile: CryptoProfile,\n    options: CreateKeyOptions = {}\n  ): Promise<KeyRecord> {\n    assertAgentId(agentId);\n\n    // Get suite\n    const suite = this.suiteRegistry.getSuite(profile.primarySignatureSuite);\n    \n    // Generate keypair (with optional derivation)\n    let keypair;\n    \n    if (options.derivationContext) {\n      // Check if suite supports derivation\n      if (!suite.capabilities?.derivation) {\n        const available = this.getSuitesWithCapability('derivation');\n        throw new Error(\n          `Suite '${suite.suiteId}' does not support key derivation.\\n` +\n          (available.length > 0\n            ? `Suites with derivation capability: ${available.join(', ')}\\n` +\n              `Consider using one of these suites or remove the derivationContext option.`\n            : `No suites currently support derivation. Remove the derivationContext option.`)\n        );\n      }\n      \n      // Use derivation capability\n      keypair = await suite.capabilities.derivation.deriveKeypair(options.derivationContext);\n    } else {\n      // Standard random key generation\n      keypair = await suite.generateKeypair();\n    }\n    \n    const meta = await this.registerUnderFreshId(agentId, profile.primarySignatureSuite, keyId =>\n      this.keyRegistry.registerKey(keyId, keypair, profile.primarySignatureSuite, {\n        expiresAt: options.expiresAt,\n        usage: options.usage || ['signing'],\n        cryptoProfileVersion: options.cryptoProfileVersion || '1.0.0',\n        // Record that (and where) the key was derived. Never the seed.\n        derivation: options.derivationContext\n          ? { path: options.derivationContext.path ?? '' }\n          : undefined,\n      })\n    );\n    \n    return toRecord(meta, keypair.publicKey);\n  }\n  \n  /**\n   * Get an existing key.\n   */\n  async getKey(keyId: string): Promise<KeyRecord | null> {\n    const result = await this.keyRegistry.getPublicKey(keyId);\n    \n    if (!result) {\n      return null;\n    }\n    \n    return toRecord(result.meta, result.publicKey);\n  }\n  \n  /**\n   * Sign with a key (private key never exposed).\n   *\n   * @throws if the key is unknown, not active, past its `expiresAt`, or not\n   *   registered for signing\n   */\n  async signWithKey(\n    keyId: string,\n    message: Uint8Array\n  ): Promise<Uint8Array> {\n    // Get full keypair (private access)\n    const result = await this.keyRegistry.getKey(keyId);\n    \n    if (!result) {\n      throw new Error(`Key not found: ${keyId}`);\n    }\n    \n    if (result.meta.status && result.meta.status !== 'active') {\n      throw new Error(`Key is not active: ${keyId} (status: ${result.meta.status})`);\n    }\n    // Status alone is not enough: an expired key keeps status 'active' until\n    // markExpiredKeys() runs, and used to go on signing in the meantime.\n    assertKeyUsable(result.meta);\n\n    if (!result.meta.usage.some(u => u === 'signing' || u === 'both')) {\n      throw new Error(\n        `Key is not registered for signing: ${keyId} (usage: ${result.meta.usage.join(', ')})`\n      );\n    }\n    \n    // Get suite and sign\n    const suite = this.suiteRegistry.getSuite(result.meta.suiteId);\n    \n    // Hash the message (consistent with signAgentResponse)\n    const hashAlg = this.getHashAlgorithm(result.meta.suiteId);\n    const messageHash = await hashBytes(message, hashAlg);\n    \n    return await suite.sign(result.keypair.privateKey, messageHash);\n  }\n  \n  /**\n   * Verify a signature.\n   *\n   * By default this is the cryptographic check only: a signature made by a\n   * key that has since been rotated, expired or revoked still verifies, which\n   * is what verifying a historical signature needs. Pass `keyStatus` to also\n   * require something of the key's state now.\n   */\n  async verifySignature(\n    keyId: string,\n    message: Uint8Array,\n    signature: Uint8Array,\n    options: VerifySignatureOptions = {}\n  ): Promise<boolean> {\n    const result = await this.keyRegistry.getPublicKey(keyId);\n    \n    if (!result) {\n      return false;\n    }\n\n    if (!statusAllows(result.meta, options.keyStatus ?? 'any')) {\n      return false;\n    }\n    \n    return this.verifyAgainst(result.meta, result.publicKey, message, signature);\n  }\n\n  /** The cryptographic check alone. Anything but a strict `true` is a failure. */\n  private async verifyAgainst(\n    meta: KeyMeta,\n    publicKey: Uint8Array,\n    message: Uint8Array,\n    signature: Uint8Array\n  ): Promise<boolean> {\n    try {\n      const suite = this.suiteRegistry.getSuite(meta.suiteId);\n      const hashAlg = this.getHashAlgorithm(meta.suiteId);\n      const messageHash = await hashBytes(message, hashAlg);\n      return (await suite.verify(publicKey, messageHash, signature)) === true;\n    } catch {\n      return false;\n    }\n  }\n  \n  /**\n   * List keys for an agent.\n   */\n  async listKeysForAgent(\n    agentId: string,\n    activeOnly: boolean = true\n  ): Promise<KeyRecord[]> {\n    assertAgentId(agentId);\n\n    const keys = activeOnly\n      ? await this.keyRegistry.listActiveKeys()\n      : await this.keyRegistry.listKeys();\n    \n    // Exact ownership, not a prefix match (see agentIdOfKey)\n    const agentKeys = keys.filter(meta => agentIdOfKey(meta.keyId) === agentId);\n    \n    // Convert to KeyRecords\n    const records: KeyRecord[] = [];\n    \n    for (const meta of agentKeys) {\n      const result = await this.keyRegistry.getPublicKey(meta.keyId);\n      if (result) {\n        records.push(toRecord(result.meta, result.publicKey));\n      }\n    }\n    \n    return records;\n  }\n  \n  /**\n   * Get active crypto profile for an agent.\n   */\n  async getActiveCryptoProfile(agentId: string): Promise<CryptoProfile | null> {\n    const keys = await this.listKeysForAgent(agentId, true);\n    \n    if (keys.length === 0) {\n      return null;\n    }\n    \n    // Group by suite\n    const sorted = this.sortKeysByCreatedAt(keys);\n    const suites = new Set(sorted.map(k => k.meta.suiteId));\n    const suiteArray = Array.from(suites);\n    \n    // Assume first is primary, second is secondary\n    return {\n      primarySignatureSuite: suiteArray[0],\n      secondarySignatureSuite: suiteArray[1],\n    };\n  }\n  \n  /**\n   * Rotate all keys for an agent.\n   *\n   * Each replacement gets its predecessor's lifetime again, counted from now\n   * (or `options.expiresAt`); it does not inherit the old expiry instant.\n   *\n   * A key derived from a seed cannot be re-derived here, because the SDK does\n   * not keep seeds. By default the call refuses, before changing anything,\n   * rather than silently swapping a recoverable key for a random one. See\n   * {@link RotateAgentKeysOptions.derivedKeys}.\n   */\n  async rotateAgentKeys(\n    agentId: string,\n    options: RotateAgentKeysOptions = {}\n  ): Promise<KeyRecord[]> {\n    const derivedPolicy = options.derivedKeys ?? 'error';\n    const activeKeys = await this.listKeysForAgent(agentId, true);\n\n    // Decide everything before changing anything.\n    const toRotate: KeyRecord[] = [];\n    for (const keyRecord of activeKeys) {\n      // Resolves the suite now, so an unknown suite fails before any rotation.\n      this.suiteRegistry.getSuite(keyRecord.meta.suiteId);\n      if (keyRecord.meta.derivation) {\n        if (derivedPolicy === 'error') {\n          throw new Error(\n            `Key ${keyRecord.meta.keyId} was derived from a seed ` +\n              `(path ${keyRecord.meta.derivation.path || 'unknown'}). Rotating it here would ` +\n              `replace it with a random key that the mnemonic cannot recover. Derive the ` +\n              `successor yourself with createKeyFromMnemonic at a new path, or pass ` +\n              `{ derivedKeys: 'skip' } or { derivedKeys: 'randomize' }. No keys were rotated.`\n          );\n        }\n        if (derivedPolicy === 'skip') continue;\n      }\n      toRotate.push(keyRecord);\n    }\n\n    // Generate every replacement before committing any, so a failing suite\n    // cannot leave the agent half rotated. The commits below are then one\n    // registry rotation per key; they are not a single transaction, so a\n    // storage failure part-way through leaves the earlier keys rotated.\n    const replacements: Keypair[] = [];\n    for (const keyRecord of toRotate) {\n      const suite = this.suiteRegistry.getSuite(keyRecord.meta.suiteId);\n      replacements.push(await suite.generateKeypair());\n    }\n\n    const newKeys: KeyRecord[] = [];\n    \n    for (const [i, keyRecord] of toRotate.entries()) {\n      const newKeypair = replacements[i];\n      \n      const newMeta = await this.registerUnderFreshId(agentId, keyRecord.meta.suiteId, newKeyId =>\n        this.keyRegistry.rotateKey(keyRecord.meta.keyId, newKeyId, newKeypair, {\n          expiresAt: options.expiresAt,\n        })\n      );\n      \n      newKeys.push(toRecord(newMeta, newKeypair.publicKey));\n    }\n    \n    return newKeys;\n  }\n  \n  /**\n   * Get or create key (idempotent).\n   *\n   * Concurrent calls on this SDK instance for the same agent and suite share\n   * one creation. Two SDK instances (or processes) on one storage backend can\n   * still each create a key; that needs a lock in the backend.\n   */\n  async getOrCreateKey(\n    agentId: string,\n    profile: CryptoProfile,\n    options: CreateKeyOptions = {}\n  ): Promise<KeyRecord> {\n    assertAgentId(agentId);\n    const slot = JSON.stringify([agentId, profile.primarySignatureSuite]);\n\n    const pending = this.getOrCreateInFlight.get(slot);\n    if (pending) {\n      const record = await pending;\n      return toRecord(record.meta, record.publicKey);\n    }\n\n    const work = (async () => {\n      // Check if key exists\n      const existingKeys = await this.listKeysForAgent(agentId, true);\n      const primaryKey = existingKeys.find(\n        k => k.meta.suiteId === profile.primarySignatureSuite\n      );\n      \n      if (primaryKey) {\n        return primaryKey;\n      }\n      \n      // Create new key\n      return await this.createKey(agentId, profile, options);\n    })();\n\n    this.getOrCreateInFlight.set(slot, work);\n    try {\n      return await work;\n    } finally {\n      this.getOrCreateInFlight.delete(slot);\n    }\n  }\n\n  /**\n   * Create both primary and secondary keys for an agent.\n   */\n  async createDualSignatureKeys(\n    agentId: string,\n    profile: CryptoProfile,\n    options: CreateKeyOptions = {}\n  ): Promise<{ primaryKey: KeyRecord; secondaryKey: KeyRecord }> {\n    if (!profile.secondarySignatureSuite) {\n      throw new Error('secondarySignatureSuite is required to create dual signature keys');\n    }\n    this.assertDualProfile(profile);\n\n    const primaryKey = await this.createKey(agentId, {\n      primarySignatureSuite: profile.primarySignatureSuite,\n    }, options);\n\n    const secondaryKey = await this.createKey(agentId, {\n      primarySignatureSuite: profile.secondarySignatureSuite,\n    }, options);\n\n    return { primaryKey, secondaryKey };\n  }\n\n  /**\n   * Idempotent creation of both primary and secondary keys.\n   */\n  async getOrCreateDualSignatureKeys(\n    agentId: string,\n    profile: CryptoProfile,\n    options: CreateKeyOptions = {}\n  ): Promise<{ primaryKey: KeyRecord; secondaryKey: KeyRecord }> {\n    if (!profile.secondarySignatureSuite) {\n      throw new Error('secondarySignatureSuite is required to create dual signature keys');\n    }\n    this.assertDualProfile(profile);\n\n    const primaryKey = await this.getOrCreateKey(agentId, {\n      primarySignatureSuite: profile.primarySignatureSuite,\n    }, options);\n\n    const secondaryKey = await this.getOrCreateKey(agentId, {\n      primarySignatureSuite: profile.secondarySignatureSuite,\n    }, options);\n\n    return { primaryKey, secondaryKey };\n  }\n\n  /**\n   * Fail before creating either key if the pair could not be a hybrid pair:\n   * an unknown suite, or the same suite twice (two ECDSA keys are not a\n   * classical + post-quantum pair, whatever the profile calls them).\n   */\n  private assertDualProfile(profile: CryptoProfile): void {\n    this.suiteRegistry.getSuite(profile.primarySignatureSuite);\n    this.suiteRegistry.getSuite(profile.secondarySignatureSuite!);\n    if (profile.primarySignatureSuite === profile.secondarySignatureSuite) {\n      throw new Error(\n        `Dual signature keys need two different suites; both are ${profile.primarySignatureSuite}`\n      );\n    }\n  }\n\n  /**\n   * Sign with one or more suites for an agent.\n   */\n  async signWithSuites(\n    agentId: string,\n    message: Uint8Array,\n    suites?: string[]\n  ): Promise<MultiSignatureResult> {\n    const activeKeys = this.sortKeysByCreatedAt(await this.listKeysForAgent(agentId, true));\n\n    if (activeKeys.length === 0) {\n      throw new Error(`No active keys found for agent: ${agentId}`);\n    }\n\n    const suitesToUse = Array.from(\n      new Set(suites?.length ? suites : activeKeys.map(k => k.meta.suiteId))\n    );\n    const signatures: SuiteSignature[] = [];\n\n    for (const suiteId of suitesToUse) {\n      const key = activeKeys.find(k => k.meta.suiteId === suiteId);\n      if (!key) {\n        throw new Error(`No active key for suite '${suiteId}' and agent '${agentId}'`);\n      }\n\n      const signature = await this.signWithKey(key.meta.keyId, message);\n      signatures.push({ suiteId, keyId: key.meta.keyId, signature });\n    }\n\n    return { signatures };\n  }\n\n  /**\n   * Verify a set of signatures as a hybrid (multi-suite) signature by `agentId`.\n   *\n   * `allValid` is true only when ALL of these hold:\n   * - at least one signature was supplied;\n   * - every supplied signature is by a key that belongs to `agentId`, names\n   *   that key's real suite, passes the key-status policy, and verifies;\n   * - every REQUIRED suite has such a signature.\n   *\n   * The required suites come from the verifier: `options.requiredSuites`, or\n   * by default the suites of the agent's currently usable keys in this SDK's\n   * registry. They are never read from `signatures`. The check walks the\n   * required suites and looks each one up among the valid signatures, so an\n   * empty list, or one that merely omits the post-quantum signature, is\n   * refused instead of passing because everything in it happens to be valid.\n   */\n  async verifyWithSuites(\n    agentId: string,\n    message: Uint8Array,\n    signatures: SuiteSignature[],\n    options: VerifyWithSuitesOptions = {}\n  ): Promise<MultiVerificationResult> {\n    assertAgentId(agentId);\n    const keyStatus = options.keyStatus ?? 'not-revoked';\n\n    const requiredSuites = Array.from(\n      new Set(\n        options.requiredSuites ??\n          (await this.listKeysForAgent(agentId, true)).map(k => k.meta.suiteId)\n      )\n    );\n\n    const refuse = (error: string, results: SuiteVerificationResult[] = []): MultiVerificationResult => ({\n      results,\n      allValid: false,\n      requiredSuites,\n      missingSuites: requiredSuites.filter(s => !results.some(r => r.valid && r.suiteId === s)),\n      error,\n    });\n\n    if (!Array.isArray(signatures)) {\n      return refuse('signatures must be an array');\n    }\n\n    const results: SuiteVerificationResult[] = [];\n\n    for (const entry of signatures) {\n      const suiteId = String(entry?.suiteId);\n      const keyId = String(entry?.keyId);\n      const fail = (error: string) => results.push({ suiteId, keyId, valid: false, error });\n\n      try {\n        if (agentIdOfKey(keyId) !== agentId) {\n          fail(`Key does not belong to agent '${agentId}'`);\n          continue;\n        }\n        const key = await this.keyRegistry.getPublicKey(keyId);\n        if (!key) {\n          fail('Key not found');\n          continue;\n        }\n        if (key.meta.suiteId !== suiteId) {\n          fail(`Suite mismatch: key is ${key.meta.suiteId}, signature claims ${suiteId}`);\n          continue;\n        }\n        if (!statusAllows(key.meta, keyStatus)) {\n          fail(`Key status not accepted (status: ${key.meta.status ?? 'active'}, policy: ${keyStatus})`);\n          continue;\n        }\n        if (!(entry.signature instanceof Uint8Array)) {\n          fail('Signature must be a Uint8Array');\n          continue;\n        }\n        const valid = await this.verifyAgainst(key.meta, key.publicKey, message, entry.signature);\n        if (valid) {\n          results.push({ suiteId, keyId, valid: true });\n        } else {\n          fail('Signature verification failed');\n        }\n      } catch (error) {\n        fail(error instanceof Error ? error.message : String(error));\n      }\n    }\n\n    if (requiredSuites.length === 0) {\n      return refuse(\n        `No required suites: agent '${agentId}' has no usable keys and options.requiredSuites was not given`,\n        results\n      );\n    }\n    if (results.length === 0) {\n      return refuse('No signatures supplied', results);\n    }\n\n    // Walk the REQUIRED suites and look each up among the valid signatures.\n    const missingSuites = requiredSuites.filter(\n      required => !results.some(r => r.valid && r.suiteId === required)\n    );\n    const everySuppliedValid = results.every(r => r.valid === true);\n\n    return {\n      results,\n      allValid: everySuppliedValid && missingSuites.length === 0,\n      requiredSuites,\n      missingSuites,\n      ...(missingSuites.length > 0\n        ? { error: `No valid signature for required suite(s): ${missingSuites.join(', ')}` }\n        : {}),\n    };\n  }\n  \n  /**\n   * Generate a new BIP39 mnemonic phrase.\n   * \n   * @param strength 128 (12 words) or 256 (24 words)\n   * @returns Mnemonic phrase\n   */\n  generateMnemonic(strength: 128 | 256 = 256): string {\n    const bip32 = new BIP32Derivation();\n    return bip32.generateMnemonic(strength);\n  }\n  \n  /**\n   * Create a key from a BIP39 mnemonic using HD derivation.\n   * \n   * Only works with suites that support BIP32 derivation (e.g., bsv-ecdsa-secp256k1).\n   * \n   * @param agentId Agent identifier\n   * @param profile Crypto profile (must use derivation-capable suite)\n   * @param mnemonic BIP39 mnemonic phrase (words and checksum are validated)\n   * @param path BIP32 derivation path (default: \"m/44'/0'/0'/0/0\")\n   * @param passphrase Optional BIP39 passphrase\n   * @param options Additional key creation options\n   * @returns KeyRecord with derived key\n   * @throws if the mnemonic has an unknown word, a wrong word count or a bad checksum\n   */\n  async createKeyFromMnemonic(\n    agentId: string,\n    profile: CryptoProfile,\n    mnemonic: string,\n    path: string = BIP32Derivation.bitcoinPath(0, 0, 0),\n    passphrase?: string,\n    options: CreateKeyOptions = {}\n  ): Promise<KeyRecord> {\n    const bip32 = new BIP32Derivation();\n    const seed = bip32.mnemonicToSeed(mnemonic, passphrase);\n    \n    try {\n      return await this.createKey(agentId, profile, {\n        ...options,\n        derivationContext: {\n          seed,\n          path,\n        },\n      });\n    } finally {\n      // The seed is the root of every key in the wallet; do not leave it behind.\n      seed.fill(0);\n    }\n  }\n  \n  /**\n   * Get available capabilities for a specific suite.\n   * \n   * @param suiteId Suite identifier\n   * @returns Array of capability names\n   */\n  getCapabilities(suiteId: string): string[] {\n    const suite = this.suiteRegistry.getSuite(suiteId);\n    const caps: string[] = [];\n    \n    if (suite.capabilities?.derivation) caps.push('derivation');\n    if ((suite.capabilities as any)?.encryption) caps.push('encryption');\n    if ((suite.capabilities as any)?.threshold) caps.push('threshold');\n    \n    return caps;\n  }\n  \n  /**\n   * Get all suite IDs that support a specific capability.\n   * \n   * @param capability Capability name\n   * @returns Array of suite IDs\n   */\n  getSuitesWithCapability(capability: 'derivation' | 'encryption' | 'threshold'): string[] {\n    const allSuites = this.suiteRegistry.getAllSuites();\n    return allSuites\n      .filter(suite => !!(suite.capabilities as any)?.[capability])\n      .map(suite => suite.suiteId);\n  }\n\n  /**\n   * Create a wallet key from a mnemonic at an explicit BIP44 coin type:\n   * `m/44'/coinType'/account'/change/index`.\n   *\n   * The coin type is required and has no default. It decides which wallets\n   * will find the key again: Bitcoin (BTC) is 0, Bitcoin SV is 236.\n   *\n   * @param agentId Agent identifier\n   * @param mnemonic BIP39 mnemonic phrase (words and checksum are validated)\n   * @param path Coin type and position in the BIP44 tree\n   * @param options Additional key creation options\n   * @returns KeyRecord with the derived secp256k1 key\n   */\n  async createWalletKey(\n    agentId: string,\n    mnemonic: string,\n    path: WalletKeyPath,\n    options: CreateKeyOptions = {}\n  ): Promise<KeyRecord> {\n    if (!path || typeof path.coinType !== 'number') {\n      throw new Error(\n        'createWalletKey requires path.coinType (SLIP-44: Bitcoin is 0, Bitcoin SV is 236)'\n      );\n    }\n    const derivationPath = BIP32Derivation.bip44Path(\n      path.coinType,\n      path.account ?? 0,\n      path.change ? 1 : 0,\n      path.index ?? 0\n    );\n    return this.createKeyFromMnemonic(\n      agentId,\n      { primarySignatureSuite: 'bsv-ecdsa-secp256k1' },\n      mnemonic,\n      derivationPath,\n      path.passphrase,\n      options\n    );\n  }\n  \n  /**\n   * Create a wallet key from mnemonic at the Bitcoin (BTC) BIP44 path:\n   * m/44'/0'/account'/change/addressIndex\n   *\n   * NOTE: coin type 0 is BTC. A Bitcoin SV wallet restoring the same mnemonic\n   * looks under coin type 236 and will not find this key. The path is left\n   * as it is because changing it would move every key already created with\n   * this method. For new code use {@link createWalletKey}, which makes the\n   * coin type explicit.\n   * \n   * @deprecated Use createWalletKey(agentId, mnemonic, { coinType, ... }).\n   * @param agentId Agent identifier\n   * @param mnemonic BIP39 mnemonic phrase\n   * @param accountIndex Account index (default: 0)\n   * @param addressIndex Address index (default: 0)\n   * @param isChange Use change address path (default: false)\n   * @param options Additional key creation options\n   * @returns KeyRecord with Bitcoin-compatible key\n   */\n  async createBitcoinWalletKey(\n    agentId: string,\n    mnemonic: string,\n    accountIndex: number = 0,\n    addressIndex: number = 0,\n    isChange: boolean = false,\n    options: CreateKeyOptions = {}\n  ): Promise<KeyRecord> {\n    const path = BIP32Derivation.bitcoinPath(accountIndex, isChange ? 1 : 0, addressIndex);\n    \n    return this.createKeyFromMnemonic(\n      agentId,\n      { primarySignatureSuite: 'bsv-ecdsa-secp256k1' },\n      mnemonic,\n      path,\n      undefined,\n      options\n    );\n  }\n  \n  /**\n   * Helper: Get hash algorithm for a suite.\n   */\n  private getHashAlgorithm(suiteId: string): 'sha256' | 'sha3-256' | 'sha512' {\n    if (suiteId.startsWith('ml-dsa')) {\n      return 'sha3-256';\n    }\n    return 'sha256';\n  }\n\n  /**\n   * Helper: register a key under the agent's next free key ID.\n   *\n   * The counter is cached per SDK instance, so another instance (or process)\n   * on the same storage can have taken the ID already. The registry refuses\n   * to overwrite; on that refusal the counter is re-read from storage and the\n   * next ID is tried. Before, the second writer silently replaced the first\n   * writer's private key.\n   */\n  private async registerUnderFreshId(\n    agentId: string,\n    suiteId: string,\n    register: (keyId: string) => Promise<KeyMeta>\n  ): Promise<KeyMeta> {\n    // 'ml' for every ml-dsa suite, 'bsv' for bsv-ecdsa-secp256k1\n    const suiteName = suiteId.split('-')[0].replace(/[^A-Za-z0-9]/g, '') || 'key';\n\n    for (let attempt = 0; attempt < MAX_KEY_ID_ATTEMPTS; attempt++) {\n      const counter = await this.getNextCounter(agentId);\n      const keyId = `${agentId}:pk-${suiteName}-${counter}`;\n      try {\n        return await register(keyId);\n      } catch (error) {\n        if (!(error instanceof KeyAlreadyExistsError)) throw error;\n        // Someone else holds that ID: forget the cached counter and re-read.\n        this.counterInitialized.delete(agentId);\n        this.keyCounter.delete(agentId);\n      }\n    }\n    throw new Error(\n      `Could not allocate a key ID for agent '${agentId}' after ${MAX_KEY_ID_ATTEMPTS} attempts`\n    );\n  }\n  \n  /**\n   * Helper: Get next counter for an agent.\n   */\n  private async getNextCounter(agentId: string): Promise<number> {\n    if (!this.counterInitialized.has(agentId)) {\n      if (!this.counterInitPromises.has(agentId)) {\n        const initPromise = (async () => {\n          try {\n            const existing = await this.keyRegistry.listKeys();\n            const max = existing.reduce((acc, meta) => {\n              if (agentIdOfKey(meta.keyId) !== agentId) return acc;\n              const local = meta.keyId.slice(agentId.length + 1);\n              const match = COUNTER_SUFFIX.exec(local);\n              if (!match) return acc;\n              const num = parseInt(match[1], 10);\n              return Number.isSafeInteger(num) ? Math.max(acc, num) : acc;\n            }, 0);\n            // A counter handed out while this scan ran must not be reused.\n            this.keyCounter.set(agentId, Math.max(max, this.keyCounter.get(agentId) || 0));\n            this.counterInitialized.add(agentId);\n          } finally {\n            this.counterInitPromises.delete(agentId);\n          }\n        })();\n        this.counterInitPromises.set(agentId, initPromise);\n      }\n\n      const pendingInit = this.counterInitPromises.get(agentId);\n      if (pendingInit) {\n        await pendingInit;\n      }\n    }\n\n    const current = this.keyCounter.get(agentId) || 0;\n    const next = current + 1;\n    this.keyCounter.set(agentId, next);\n    return next;\n  }\n\n  /**\n   * Helper: sort keys deterministically by createdAt then keyId.\n   */\n  private sortKeysByCreatedAt(keys: KeyRecord[]): KeyRecord[] {\n    return [...keys].sort((a, b) => {\n      const aTime = new Date(a.meta.createdAt).getTime();\n      const bTime = new Date(b.meta.createdAt).getTime();\n      if (aTime !== bTime) return aTime - bTime;\n      const priorityDiff = this.getSuitePriority(a.meta.suiteId) - this.getSuitePriority(b.meta.suiteId);\n      if (priorityDiff !== 0) return priorityDiff;\n      return a.meta.keyId.localeCompare(b.meta.keyId);\n    });\n  }\n\n  private getSuitePriority(suiteId: string): number {\n    if (suiteId.startsWith('ml-dsa')) return 0;\n    if (suiteId.includes('ecdsa')) return 1;\n    return 2;\n  }\n}\n\n/**\n * Create a KeySDK instance with default configuration\n * \n * Uses in-memory storage and registers both ECDSA and ML-DSA suites.\n * For custom storage or different suites, instantiate DefaultKeySDK directly.\n * \n * @example\n * ```typescript\n * import { createKeySDK } from '@smartledger/keys';\n * \n * const sdk = createKeySDK();\n * const key = await sdk.createKey('my-agent', { primarySignatureSuite: 'ml-dsa-87' });\n * ```\n */\nexport function createKeySDK(config?: Partial<KeySDKConfig>): KeySDK {\n  const keyRegistry = config?.keyRegistry || new KeyRegistry(new InMemoryKeyStorage());\n  const suiteRegistry = config?.suiteRegistry || new SignatureSuiteRegistry();\n  \n  // Register default suites if not provided.\n  //\n  // All three ML-DSA levels are registered, not just 87. The README documents\n  // ml-dsa-65 as the recommended default and ml-dsa-44 for constrained\n  // devices; registering only 87 made every one of those examples throw\n  // `Unknown signature suite` at runtime, with no way for a caller to fix it\n  // -- SignatureSuiteRegistry is not re-exported from this package.\n  if (!config?.suiteRegistry) {\n    suiteRegistry.register(new BsvEcdsaSuite());\n    suiteRegistry.register(new MlDsa44Suite());\n    suiteRegistry.register(new MlDsa65Suite());\n    suiteRegistry.register(new MlDsa87Suite());\n  }\n  \n  return new DefaultKeySDK({\n    keyRegistry,\n    suiteRegistry,\n  });\n}\n"]}
+{"version":3,"file":"sdk.js","sourceRoot":"","sources":["../../src/sdk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,WAAW,EACX,sBAAsB,EAItB,SAAS,EACT,eAAe,EACf,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,YAAY,GACb,MAAM,qBAAqB,CAAC;AAuC7B,+DAA+D;AAC/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAC3C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B,SAAS,aAAa,CAAC,OAAgB;IACrC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa,EAAE,SAAqB;IACpD,2EAA2E;IAC3E,2DAA2D;IAC3D,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAuB;IAC1D,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;IAC/D,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,aAAa;IAUxB,YAAY,MAAoB;QAPxB,eAAU,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,qBAAqB;QAC7D,uBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,wBAAmB,GAAG,IAAI,GAAG,EAAyB,CAAC;QACvD,wBAAmB,GAAG,IAAI,GAAG,EAA8B,CAAC;QAKlE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,IAAI,uBAAuB,CAAC;QACjE,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,OAAe,EACf,OAAsB,EACtB,UAA4B,EAAE;QAE9B,aAAa,CAAC,OAAO,CAAC,CAAC;QAEvB,YAAY;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAEzE,8CAA8C;QAC9C,IAAI,OAAO,CAAC;QAEZ,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC9B,qCAAqC;YACrC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC;gBACpC,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;gBAC7D,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,CAAC,OAAO,sCAAsC;oBAC7D,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;wBACnB,CAAC,CAAC,sCAAsC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;4BAC9D,4EAA4E;wBAC9E,CAAC,CAAC,8EAA8E,CAAC,CACpF,CAAC;YACJ,CAAC;YAED,4BAA4B;YAC5B,OAAO,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,iCAAiC;YACjC,OAAO,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,qBAAqB,EAAE,KAAK,CAAC,EAAE,CAC3F,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,qBAAqB,EAAE;YAC1E,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC;YACnC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,IAAI,OAAO;YAC7D,+DAA+D;YAC/D,UAAU,EAAE,OAAO,CAAC,iBAAiB;gBACnC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,iBAAiB,CAAC,IAAI,IAAI,EAAE,EAAE;gBAChD,CAAC,CAAC,SAAS;SACd,CAAC,CACH,CAAC;QAEF,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CACf,KAAa,EACb,OAAmB;QAEnB,oCAAoC;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,aAAa,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACjF,CAAC;QACD,yEAAyE;QACzE,qEAAqE;QACrE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAE7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,sCAAsC,KAAK,YAAY,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvF,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACvF,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,YAAY,CACxB,OAAe,EACf,OAAmB,EACnB,MAAuB;QAEvB,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,OAAO,MAAM,KAAK,IAAI;gBACpB,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE;gBAC/D,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;IACvD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CACnB,KAAa,EACb,OAAmB,EACnB,SAAqB,EACrB,UAAkC,EAAE;QAEpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IACvG,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,aAAa,CACzB,IAAa,EACb,SAAqB,EACrB,OAAmB,EACnB,SAAqB,EACrB,SAA0B,IAAI;QAE9B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAClF,OAAO,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAe,EACf,aAAsB,IAAI;QAE1B,aAAa,CAAC,OAAO,CAAC,CAAC;QAEvB,MAAM,IAAI,GAAG,UAAU;YACrB,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE;YACzC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QAEtC,yDAAyD;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,CAAC;QAE5E,wBAAwB;QACxB,MAAM,OAAO,GAAgB,EAAE,CAAC;QAEhC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/D,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAAC,OAAe;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAExD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,iBAAiB;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEtC,+CAA+C;QAC/C,OAAO;YACL,qBAAqB,EAAE,UAAU,CAAC,CAAC,CAAC;YACpC,uBAAuB,EAAE,UAAU,CAAC,CAAC,CAAC;SACvC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,eAAe,CACnB,OAAe,EACf,UAAkC,EAAE;QAEpC,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAE9D,8CAA8C;QAC9C,MAAM,QAAQ,GAAgB,EAAE,CAAC;QACjC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,yEAAyE;YACzE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC9B,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;oBAC9B,MAAM,IAAI,KAAK,CACb,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,2BAA2B;wBACpD,SAAS,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,SAAS,4BAA4B;wBAChF,4EAA4E;wBAC5E,uEAAuE;wBACvE,gFAAgF,CACnF,CAAC;gBACJ,CAAC;gBACD,IAAI,aAAa,KAAK,MAAM;oBAAE,SAAS;YACzC,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,oEAAoE;QACpE,MAAM,YAAY,GAAc,EAAE,CAAC;QACnC,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClE,YAAY,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,OAAO,GAAgB,EAAE,CAAC;QAEhC,KAAK,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAEnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAC1F,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE;gBACrE,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CACH,CAAC;YAEF,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAClB,OAAe,EACf,OAAsB,EACtB,UAA4B,EAAE;QAE9B,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAEtE,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE;YACvB,sBAAsB;YACtB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAChE,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,qBAAqB,CACtD,CAAC;YAEF,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,UAAU,CAAC;YACpB,CAAC;YAED,iBAAiB;YACjB,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACzD,CAAC,CAAC,EAAE,CAAC;QAEL,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB,CAC3B,OAAe,EACf,OAAsB,EACtB,UAA4B,EAAE;QAE9B,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEhC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE;YAC/C,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;SACrD,EAAE,OAAO,CAAC,CAAC;QAEZ,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE;YACjD,qBAAqB,EAAE,OAAO,CAAC,uBAAuB;SACvD,EAAE,OAAO,CAAC,CAAC;QAEZ,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,4BAA4B,CAChC,OAAe,EACf,OAAsB,EACtB,UAA4B,EAAE;QAE9B,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEhC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;YACpD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;SACrD,EAAE,OAAO,CAAC,CAAC;QAEZ,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;YACtD,qBAAqB,EAAE,OAAO,CAAC,uBAAuB;SACvD,EAAE,OAAO,CAAC,CAAC;QAEZ,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACK,iBAAiB,CAAC,OAAsB;QAC9C,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC3D,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,uBAAwB,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,qBAAqB,KAAK,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,2DAA2D,OAAO,CAAC,qBAAqB,EAAE,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAe,EACf,OAAmB,EACnB,MAAiB;QAEjB,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAExF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC5B,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CACvE,CAAC;QACF,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;YAC7D,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,gBAAgB,OAAO,GAAG,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAClE,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAe,EACf,OAAmB,EACnB,UAA4B,EAC5B,UAAmC,EAAE;QAErC,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC;QAErD,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAC/B,IAAI,GAAG,CACL,OAAO,CAAC,cAAc;YACpB,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CACxE,CACF,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,UAAqC,EAAE,EAA2B,EAAE,CAAC,CAAC;YACnG,OAAO;YACP,QAAQ,EAAE,KAAK;YACf,cAAc;YACd,aAAa,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC;YACzF,KAAK;SACN,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,OAAO,GAA8B,EAAE,CAAC;QAE9C,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAEtF,IAAI,CAAC;gBACH,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC;oBACpC,IAAI,CAAC,iCAAiC,OAAO,GAAG,CAAC,CAAC;oBAClD,SAAS;gBACX,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACvD,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,IAAI,CAAC,eAAe,CAAC,CAAC;oBACtB,SAAS;gBACX,CAAC;gBACD,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;oBACjC,IAAI,CAAC,0BAA0B,GAAG,CAAC,IAAI,CAAC,OAAO,sBAAsB,OAAO,EAAE,CAAC,CAAC;oBAChF,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;oBACvC,IAAI,CAAC,oCAAoC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,aAAa,SAAS,GAAG,CAAC,CAAC;oBAC/F,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,YAAY,UAAU,CAAC,EAAE,CAAC;oBAC7C,IAAI,CAAC,gCAAgC,CAAC,CAAC;oBACvC,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;gBAClH,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,+BAA+B,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,MAAM,CACX,8BAA8B,OAAO,+DAA+D,EACpG,OAAO,CACR,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QAED,wEAAwE;QACxE,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CACzC,QAAQ,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAClE,CAAC;QACF,MAAM,kBAAkB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;QAEhE,OAAO;YACL,OAAO;YACP,QAAQ,EAAE,kBAAkB,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAC1D,cAAc;YACd,aAAa;YACb,GAAG,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;gBAC1B,CAAC,CAAC,EAAE,KAAK,EAAE,6CAA6C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;gBACpF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,WAAsB,GAAG;QACxC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,qBAAqB,CACzB,OAAe,EACf,OAAsB,EACtB,QAAgB,EAChB,OAAe,eAAe,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EACnD,UAAmB,EACnB,UAA4B,EAAE;QAE9B,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAExD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE;gBAC5C,GAAG,OAAO;gBACV,iBAAiB,EAAE;oBACjB,IAAI;oBACJ,IAAI;iBACL;aACF,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,2EAA2E;YAC3E,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,OAAe;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,IAAI,GAAa,EAAE,CAAC;QAE1B,IAAI,KAAK,CAAC,YAAY,EAAE,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5D,IAAK,KAAK,CAAC,YAAoB,EAAE,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrE,IAAK,KAAK,CAAC,YAAoB,EAAE,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAEnE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,uBAAuB,CAAC,UAAqD;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;QACpD,OAAO,SAAS;aACb,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAE,KAAK,CAAC,YAAoB,EAAE,CAAC,UAAU,CAAC,CAAC;aAC5D,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,eAAe,CACnB,OAAe,EACf,QAAgB,EAChB,IAAmB,EACnB,UAA4B,EAAE;QAE9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAAG,eAAe,CAAC,SAAS,CAC9C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,OAAO,IAAI,CAAC,EACjB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACnB,IAAI,CAAC,KAAK,IAAI,CAAC,CAChB,CAAC;QACF,OAAO,IAAI,CAAC,qBAAqB,CAC/B,OAAO,EACP,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,EAChD,QAAQ,EACR,cAAc,EACd,IAAI,CAAC,UAAU,EACf,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAAe,EACf,QAAgB,EAChB,eAAuB,CAAC,EACxB,eAAuB,CAAC,EACxB,WAAoB,KAAK,EACzB,UAA4B,EAAE;QAE9B,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAEvF,OAAO,IAAI,CAAC,qBAAqB,CAC/B,OAAO,EACP,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,EAChD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,oBAAoB,CAChC,OAAe,EACf,OAAe,EACf,QAA6C;QAE7C,6DAA6D;QAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC;QAE9E,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,mBAAmB,EAAE,OAAO,EAAE,EAAE,CAAC;YAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,GAAG,OAAO,OAAO,SAAS,IAAI,OAAO,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,qBAAqB,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC3D,qEAAqE;gBACrE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACxC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,WAAW,mBAAmB,WAAW,CAC3F,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc,CAAC,OAAe;QAC1C,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,MAAM,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;oBAC9B,IAAI,CAAC;wBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;wBACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;4BACxC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,OAAO;gCAAE,OAAO,GAAG,CAAC;4BACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;4BACnD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;4BACzC,IAAI,CAAC,KAAK;gCAAE,OAAO,GAAG,CAAC;4BACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;4BACnC,OAAO,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;wBAC9D,CAAC,EAAE,CAAC,CAAC,CAAC;wBACN,+DAA+D;wBAC/D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;wBAC/E,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACvC,CAAC;4BAAS,CAAC;wBACT,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBAC3C,CAAC;gBACH,CAAC,CAAC,EAAE,CAAC;gBACL,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1D,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,WAAW,CAAC;YACpB,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,IAAiB;QAC3C,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACnD,IAAI,KAAK,KAAK,KAAK;gBAAE,OAAO,KAAK,GAAG,KAAK,CAAC;YAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnG,IAAI,YAAY,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;YAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,OAAe;QACtC,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC;QACxC,OAAO,CAAC,CAAC;IACX,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,MAA8B;IACzD,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,IAAI,WAAW,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAC;IACrF,MAAM,aAAa,GAAG,MAAM,EAAE,aAAa,IAAI,IAAI,sBAAsB,EAAE,CAAC;IAE5E,2CAA2C;IAC3C,EAAE;IACF,4EAA4E;IAC5E,qEAAqE;IACrE,sEAAsE;IACtE,2EAA2E;IAC3E,kEAAkE;IAClE,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;QAC3B,aAAa,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;QAC5C,aAAa,CAAC,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC;QAC3C,aAAa,CAAC,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC;QAC3C,aAAa,CAAC,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,IAAI,aAAa,CAAC;QACvB,WAAW;QACX,aAAa;QACb,cAAc,EAAE,MAAM,EAAE,cAAc;KACvC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Default implementation of KeySDK.\n * \n * Integrates KeyRegistry and SignatureSuiteRegistry to provide\n * a clean, high-level API for key operations.\n */\n\nimport {\n  KeyRegistry,\n  SignatureSuiteRegistry,\n  KeyMeta,\n  Keypair,\n  CryptoProfile,\n  hashBytes,\n  assertKeyUsable,\n  isKeyUsable,\n  cloneKeyMeta,\n  agentIdOfKey,\n  KeyAlreadyExistsError,\n  BIP32Derivation,\n  InMemoryKeyStorage,\n  BsvEcdsaSuite,\n  MlDsa44Suite,\n  MlDsa65Suite,\n  MlDsa87Suite,\n} from '@smartledger/crypto';\nimport {\n  KeySDK,\n  KeyRecord,\n  CreateKeyOptions,\n  AgentKeyConfig,\n  MultiSignatureResult,\n  MultiVerificationResult,\n  SuiteSignature,\n  SuiteVerificationResult,\n  KeyStatusPolicy,\n  VerifySignatureOptions,\n  VerifyWithSuitesOptions,\n  SignatureScheme,\n  RotateAgentKeysOptions,\n  WalletKeyPath,\n} from './types.js';\n\n/**\n * Configuration for DefaultKeySDK.\n */\nexport interface KeySDKConfig {\n  /** Key registry instance */\n  keyRegistry: KeyRegistry;\n  \n  /** Signature suite registry instance */\n  suiteRegistry: SignatureSuiteRegistry;\n\n  /**\n   * Context string for ML-DSA signatures (FIPS 204), 1 to 255 bytes. An\n   * ML-DSA signature verifies only under the context it was made with, so\n   * two deployments with different contexts cannot have ML-DSA signatures\n   * replayed between them. It does NOT enter an ECDSA signature: ECDSA has\n   * no context, and the same ECDSA key and message verify in any deployment.\n   * Default: `@smartledger/keys/4`.\n   */\n  signingContext?: string | Uint8Array;\n}\n\n/** The default ML-DSA context string of this major version. */\nexport const DEFAULT_SIGNING_CONTEXT = '@smartledger/keys/4';\n\nexport { agentIdOfKey };\n\nconst COUNTER_SUFFIX = /^pk-[^:-]+-(\\d+)$/;\nconst MAX_KEY_ID_ATTEMPTS = 8;\n\nfunction assertAgentId(agentId: unknown): asserts agentId is string {\n  if (typeof agentId !== 'string' || agentId.length === 0) {\n    throw new Error('agentId must be a non-empty string');\n  }\n}\n\nfunction toRecord(meta: KeyMeta, publicKey: Uint8Array): KeyRecord {\n  // Copies, so a caller cannot reach registry state through a KeyRecord even\n  // when a custom storage backend hands out its own objects.\n  return { meta: cloneKeyMeta(meta), publicKey: Uint8Array.from(publicKey) };\n}\n\nfunction statusAllows(meta: KeyMeta, policy: KeyStatusPolicy): boolean {\n  if (policy === 'any') return true;\n  if (policy === 'not-revoked') return meta.status !== 'revoked';\n  return isKeyUsable(meta);\n}\n\n/**\n * Default KeySDK implementation.\n * \n * Provides a simple, safe API for key operations while hiding complexity.\n */\nexport class DefaultKeySDK implements KeySDK {\n  private keyRegistry: KeyRegistry;\n  private suiteRegistry: SignatureSuiteRegistry;\n  private keyCounter = new Map<string, number>(); // agentId -> counter\n  private counterInitialized = new Set<string>();\n  private counterInitPromises = new Map<string, Promise<void>>();\n  private getOrCreateInFlight = new Map<string, Promise<KeyRecord>>();\n  \n  private signingContext: Uint8Array;\n\n  constructor(config: KeySDKConfig) {\n    this.keyRegistry = config.keyRegistry;\n    this.suiteRegistry = config.suiteRegistry;\n    const context = config.signingContext ?? DEFAULT_SIGNING_CONTEXT;\n    const bytes = typeof context === 'string' ? new TextEncoder().encode(context) : Uint8Array.from(context);\n    if (bytes.length < 1 || bytes.length > 255) {\n      throw new Error('signingContext must be 1 to 255 bytes');\n    }\n    this.signingContext = bytes;\n  }\n  \n  /**\n   * Create a new key for an agent.\n   */\n  async createKey(\n    agentId: string,\n    profile: CryptoProfile,\n    options: CreateKeyOptions = {}\n  ): Promise<KeyRecord> {\n    assertAgentId(agentId);\n\n    // Get suite\n    const suite = this.suiteRegistry.getSuite(profile.primarySignatureSuite);\n    \n    // Generate keypair (with optional derivation)\n    let keypair;\n    \n    if (options.derivationContext) {\n      // Check if suite supports derivation\n      if (!suite.capabilities?.derivation) {\n        const available = this.getSuitesWithCapability('derivation');\n        throw new Error(\n          `Suite '${suite.suiteId}' does not support key derivation.\\n` +\n          (available.length > 0\n            ? `Suites with derivation capability: ${available.join(', ')}\\n` +\n              `Consider using one of these suites or remove the derivationContext option.`\n            : `No suites currently support derivation. Remove the derivationContext option.`)\n        );\n      }\n      \n      // Use derivation capability\n      keypair = await suite.capabilities.derivation.deriveKeypair(options.derivationContext);\n    } else {\n      // Standard random key generation\n      keypair = await suite.generateKeypair();\n    }\n    \n    const meta = await this.registerUnderFreshId(agentId, profile.primarySignatureSuite, keyId =>\n      this.keyRegistry.registerKey(keyId, keypair, profile.primarySignatureSuite, {\n        expiresAt: options.expiresAt,\n        usage: options.usage || ['signing'],\n        cryptoProfileVersion: options.cryptoProfileVersion || '1.0.0',\n        // Record that (and where) the key was derived. Never the seed.\n        derivation: options.derivationContext\n          ? { path: options.derivationContext.path ?? '' }\n          : undefined,\n      })\n    );\n    \n    return toRecord(meta, keypair.publicKey);\n  }\n  \n  /**\n   * Get an existing key.\n   */\n  async getKey(keyId: string): Promise<KeyRecord | null> {\n    const result = await this.keyRegistry.getPublicKey(keyId);\n    \n    if (!result) {\n      return null;\n    }\n    \n    return toRecord(result.meta, result.publicKey);\n  }\n  \n  /**\n   * Sign with a key (private key never exposed).\n   *\n   * @throws if the key is unknown, not active, past its `expiresAt`, or not\n   *   registered for signing\n   */\n  async signWithKey(\n    keyId: string,\n    message: Uint8Array\n  ): Promise<Uint8Array> {\n    // Get full keypair (private access)\n    const result = await this.keyRegistry.getKey(keyId);\n    \n    if (!result) {\n      throw new Error(`Key not found: ${keyId}`);\n    }\n    \n    if (result.meta.status && result.meta.status !== 'active') {\n      throw new Error(`Key is not active: ${keyId} (status: ${result.meta.status})`);\n    }\n    // Status alone is not enough: an expired key keeps status 'active' until\n    // markExpiredKeys() runs, and used to go on signing in the meantime.\n    assertKeyUsable(result.meta);\n\n    if (!result.meta.usage.some(u => u === 'signing' || u === 'both')) {\n      throw new Error(\n        `Key is not registered for signing: ${keyId} (usage: ${result.meta.usage.join(', ')})`\n      );\n    }\n    \n    // Get suite and sign\n    const suite = this.suiteRegistry.getSuite(result.meta.suiteId);\n    const { input, options } = await this.signingInput(result.meta.suiteId, message, 'v4');\n    return await suite.sign(result.keypair.privateKey, input, options);\n  }\n\n  /**\n   * What a key of `suiteId` signs for `message` under a scheme.\n   *\n   * v4: ML-DSA signs the message itself in FIPS 204 pure mode with this SDK's\n   * context string, so a standard verifier needs only the message and the\n   * context, and the signature is not limited by an outside digest. ECDSA\n   * signs SHA-256(message): ECDSA signs a digest by definition and has no\n   * context, so callers who need domain separation for it put the purpose in\n   * the message.\n   *\n   * v3-digest: what 3.x signed — SHA3-256(message) for ML-DSA, empty context.\n   */\n  private async signingInput(\n    suiteId: string,\n    message: Uint8Array,\n    scheme: SignatureScheme\n  ): Promise<{ input: Uint8Array; options?: { context: Uint8Array } }> {\n    if (scheme !== 'v4' && scheme !== 'v3-digest') {\n      throw new Error(`Unknown signature scheme: ${String(scheme)}`);\n    }\n    if (suiteId.startsWith('ml-dsa')) {\n      return scheme === 'v4'\n        ? { input: message, options: { context: this.signingContext } }\n        : { input: await hashBytes(message, 'sha3-256') };\n    }\n    return { input: await hashBytes(message, 'sha256') };\n  }\n  \n  /**\n   * Verify a signature.\n   *\n   * By default this is the cryptographic check only: a signature made by a\n   * key that has since been rotated, expired or revoked still verifies, which\n   * is what verifying a historical signature needs. Pass `keyStatus` to also\n   * require something of the key's state now.\n   */\n  async verifySignature(\n    keyId: string,\n    message: Uint8Array,\n    signature: Uint8Array,\n    options: VerifySignatureOptions = {}\n  ): Promise<boolean> {\n    const result = await this.keyRegistry.getPublicKey(keyId);\n    \n    if (!result) {\n      return false;\n    }\n\n    if (!statusAllows(result.meta, options.keyStatus ?? 'any')) {\n      return false;\n    }\n\n    return this.verifyAgainst(result.meta, result.publicKey, message, signature, options.scheme ?? 'v4');\n  }\n\n  /** The cryptographic check alone. Anything but a strict `true` is a failure. */\n  private async verifyAgainst(\n    meta: KeyMeta,\n    publicKey: Uint8Array,\n    message: Uint8Array,\n    signature: Uint8Array,\n    scheme: SignatureScheme = 'v4'\n  ): Promise<boolean> {\n    try {\n      const suite = this.suiteRegistry.getSuite(meta.suiteId);\n      const { input, options } = await this.signingInput(meta.suiteId, message, scheme);\n      return (await suite.verify(publicKey, input, signature, options)) === true;\n    } catch {\n      return false;\n    }\n  }\n  \n  /**\n   * List keys for an agent.\n   */\n  async listKeysForAgent(\n    agentId: string,\n    activeOnly: boolean = true\n  ): Promise<KeyRecord[]> {\n    assertAgentId(agentId);\n\n    const keys = activeOnly\n      ? await this.keyRegistry.listActiveKeys()\n      : await this.keyRegistry.listKeys();\n    \n    // Exact ownership, not a prefix match (see agentIdOfKey)\n    const agentKeys = keys.filter(meta => agentIdOfKey(meta.keyId) === agentId);\n    \n    // Convert to KeyRecords\n    const records: KeyRecord[] = [];\n    \n    for (const meta of agentKeys) {\n      const result = await this.keyRegistry.getPublicKey(meta.keyId);\n      if (result) {\n        records.push(toRecord(result.meta, result.publicKey));\n      }\n    }\n    \n    return records;\n  }\n  \n  /**\n   * Get active crypto profile for an agent.\n   */\n  async getActiveCryptoProfile(agentId: string): Promise<CryptoProfile | null> {\n    const keys = await this.listKeysForAgent(agentId, true);\n    \n    if (keys.length === 0) {\n      return null;\n    }\n    \n    // Group by suite\n    const sorted = this.sortKeysByCreatedAt(keys);\n    const suites = new Set(sorted.map(k => k.meta.suiteId));\n    const suiteArray = Array.from(suites);\n    \n    // Assume first is primary, second is secondary\n    return {\n      primarySignatureSuite: suiteArray[0],\n      secondarySignatureSuite: suiteArray[1],\n    };\n  }\n  \n  /**\n   * Rotate all keys for an agent.\n   *\n   * Each replacement gets its predecessor's lifetime again, counted from now\n   * (or `options.expiresAt`); it does not inherit the old expiry instant.\n   *\n   * A key derived from a seed cannot be re-derived here, because the SDK does\n   * not keep seeds. By default the call refuses, before changing anything,\n   * rather than silently swapping a recoverable key for a random one. See\n   * {@link RotateAgentKeysOptions.derivedKeys}.\n   */\n  async rotateAgentKeys(\n    agentId: string,\n    options: RotateAgentKeysOptions = {}\n  ): Promise<KeyRecord[]> {\n    const derivedPolicy = options.derivedKeys ?? 'error';\n    const activeKeys = await this.listKeysForAgent(agentId, true);\n\n    // Decide everything before changing anything.\n    const toRotate: KeyRecord[] = [];\n    for (const keyRecord of activeKeys) {\n      // Resolves the suite now, so an unknown suite fails before any rotation.\n      this.suiteRegistry.getSuite(keyRecord.meta.suiteId);\n      if (keyRecord.meta.derivation) {\n        if (derivedPolicy === 'error') {\n          throw new Error(\n            `Key ${keyRecord.meta.keyId} was derived from a seed ` +\n              `(path ${keyRecord.meta.derivation.path || 'unknown'}). Rotating it here would ` +\n              `replace it with a random key that the mnemonic cannot recover. Derive the ` +\n              `successor yourself with createKeyFromMnemonic at a new path, or pass ` +\n              `{ derivedKeys: 'skip' } or { derivedKeys: 'randomize' }. No keys were rotated.`\n          );\n        }\n        if (derivedPolicy === 'skip') continue;\n      }\n      toRotate.push(keyRecord);\n    }\n\n    // Generate every replacement before committing any, so a failing suite\n    // cannot leave the agent half rotated. The commits below are then one\n    // registry rotation per key; they are not a single transaction, so a\n    // storage failure part-way through leaves the earlier keys rotated.\n    const replacements: Keypair[] = [];\n    for (const keyRecord of toRotate) {\n      const suite = this.suiteRegistry.getSuite(keyRecord.meta.suiteId);\n      replacements.push(await suite.generateKeypair());\n    }\n\n    const newKeys: KeyRecord[] = [];\n    \n    for (const [i, keyRecord] of toRotate.entries()) {\n      const newKeypair = replacements[i];\n      \n      const newMeta = await this.registerUnderFreshId(agentId, keyRecord.meta.suiteId, newKeyId =>\n        this.keyRegistry.rotateKey(keyRecord.meta.keyId, newKeyId, newKeypair, {\n          expiresAt: options.expiresAt,\n        })\n      );\n      \n      newKeys.push(toRecord(newMeta, newKeypair.publicKey));\n    }\n    \n    return newKeys;\n  }\n  \n  /**\n   * Get or create key (idempotent).\n   *\n   * Concurrent calls on this SDK instance for the same agent and suite share\n   * one creation. Two SDK instances (or processes) on one storage backend can\n   * still each create a key; that needs a lock in the backend.\n   */\n  async getOrCreateKey(\n    agentId: string,\n    profile: CryptoProfile,\n    options: CreateKeyOptions = {}\n  ): Promise<KeyRecord> {\n    assertAgentId(agentId);\n    const slot = JSON.stringify([agentId, profile.primarySignatureSuite]);\n\n    const pending = this.getOrCreateInFlight.get(slot);\n    if (pending) {\n      const record = await pending;\n      return toRecord(record.meta, record.publicKey);\n    }\n\n    const work = (async () => {\n      // Check if key exists\n      const existingKeys = await this.listKeysForAgent(agentId, true);\n      const primaryKey = existingKeys.find(\n        k => k.meta.suiteId === profile.primarySignatureSuite\n      );\n      \n      if (primaryKey) {\n        return primaryKey;\n      }\n      \n      // Create new key\n      return await this.createKey(agentId, profile, options);\n    })();\n\n    this.getOrCreateInFlight.set(slot, work);\n    try {\n      return await work;\n    } finally {\n      this.getOrCreateInFlight.delete(slot);\n    }\n  }\n\n  /**\n   * Create both primary and secondary keys for an agent.\n   */\n  async createDualSignatureKeys(\n    agentId: string,\n    profile: CryptoProfile,\n    options: CreateKeyOptions = {}\n  ): Promise<{ primaryKey: KeyRecord; secondaryKey: KeyRecord }> {\n    if (!profile.secondarySignatureSuite) {\n      throw new Error('secondarySignatureSuite is required to create dual signature keys');\n    }\n    this.assertDualProfile(profile);\n\n    const primaryKey = await this.createKey(agentId, {\n      primarySignatureSuite: profile.primarySignatureSuite,\n    }, options);\n\n    const secondaryKey = await this.createKey(agentId, {\n      primarySignatureSuite: profile.secondarySignatureSuite,\n    }, options);\n\n    return { primaryKey, secondaryKey };\n  }\n\n  /**\n   * Idempotent creation of both primary and secondary keys.\n   */\n  async getOrCreateDualSignatureKeys(\n    agentId: string,\n    profile: CryptoProfile,\n    options: CreateKeyOptions = {}\n  ): Promise<{ primaryKey: KeyRecord; secondaryKey: KeyRecord }> {\n    if (!profile.secondarySignatureSuite) {\n      throw new Error('secondarySignatureSuite is required to create dual signature keys');\n    }\n    this.assertDualProfile(profile);\n\n    const primaryKey = await this.getOrCreateKey(agentId, {\n      primarySignatureSuite: profile.primarySignatureSuite,\n    }, options);\n\n    const secondaryKey = await this.getOrCreateKey(agentId, {\n      primarySignatureSuite: profile.secondarySignatureSuite,\n    }, options);\n\n    return { primaryKey, secondaryKey };\n  }\n\n  /**\n   * Fail before creating either key if the pair could not be a hybrid pair:\n   * an unknown suite, or the same suite twice (two ECDSA keys are not a\n   * classical + post-quantum pair, whatever the profile calls them).\n   */\n  private assertDualProfile(profile: CryptoProfile): void {\n    this.suiteRegistry.getSuite(profile.primarySignatureSuite);\n    this.suiteRegistry.getSuite(profile.secondarySignatureSuite!);\n    if (profile.primarySignatureSuite === profile.secondarySignatureSuite) {\n      throw new Error(\n        `Dual signature keys need two different suites; both are ${profile.primarySignatureSuite}`\n      );\n    }\n  }\n\n  /**\n   * Sign with one or more suites for an agent.\n   */\n  async signWithSuites(\n    agentId: string,\n    message: Uint8Array,\n    suites?: string[]\n  ): Promise<MultiSignatureResult> {\n    const activeKeys = this.sortKeysByCreatedAt(await this.listKeysForAgent(agentId, true));\n\n    if (activeKeys.length === 0) {\n      throw new Error(`No active keys found for agent: ${agentId}`);\n    }\n\n    const suitesToUse = Array.from(\n      new Set(suites?.length ? suites : activeKeys.map(k => k.meta.suiteId))\n    );\n    const signatures: SuiteSignature[] = [];\n\n    for (const suiteId of suitesToUse) {\n      const key = activeKeys.find(k => k.meta.suiteId === suiteId);\n      if (!key) {\n        throw new Error(`No active key for suite '${suiteId}' and agent '${agentId}'`);\n      }\n\n      const signature = await this.signWithKey(key.meta.keyId, message);\n      signatures.push({ suiteId, keyId: key.meta.keyId, signature });\n    }\n\n    return { signatures };\n  }\n\n  /**\n   * Verify a set of signatures as a hybrid (multi-suite) signature by `agentId`.\n   *\n   * `allValid` is true only when ALL of these hold:\n   * - at least one signature was supplied;\n   * - every supplied signature is by a key that belongs to `agentId`, names\n   *   that key's real suite, passes the key-status policy, and verifies;\n   * - every REQUIRED suite has such a signature.\n   *\n   * The required suites come from the verifier: `options.requiredSuites`, or\n   * by default the suites of the agent's currently usable keys in this SDK's\n   * registry. They are never read from `signatures`. The check walks the\n   * required suites and looks each one up among the valid signatures, so an\n   * empty list, or one that merely omits the post-quantum signature, is\n   * refused instead of passing because everything in it happens to be valid.\n   */\n  async verifyWithSuites(\n    agentId: string,\n    message: Uint8Array,\n    signatures: SuiteSignature[],\n    options: VerifyWithSuitesOptions = {}\n  ): Promise<MultiVerificationResult> {\n    assertAgentId(agentId);\n    const keyStatus = options.keyStatus ?? 'not-revoked';\n\n    const requiredSuites = Array.from(\n      new Set(\n        options.requiredSuites ??\n          (await this.listKeysForAgent(agentId, true)).map(k => k.meta.suiteId)\n      )\n    );\n\n    const refuse = (error: string, results: SuiteVerificationResult[] = []): MultiVerificationResult => ({\n      results,\n      allValid: false,\n      requiredSuites,\n      missingSuites: requiredSuites.filter(s => !results.some(r => r.valid && r.suiteId === s)),\n      error,\n    });\n\n    if (!Array.isArray(signatures)) {\n      return refuse('signatures must be an array');\n    }\n\n    const results: SuiteVerificationResult[] = [];\n\n    for (const entry of signatures) {\n      const suiteId = String(entry?.suiteId);\n      const keyId = String(entry?.keyId);\n      const fail = (error: string) => results.push({ suiteId, keyId, valid: false, error });\n\n      try {\n        if (agentIdOfKey(keyId) !== agentId) {\n          fail(`Key does not belong to agent '${agentId}'`);\n          continue;\n        }\n        const key = await this.keyRegistry.getPublicKey(keyId);\n        if (!key) {\n          fail('Key not found');\n          continue;\n        }\n        if (key.meta.suiteId !== suiteId) {\n          fail(`Suite mismatch: key is ${key.meta.suiteId}, signature claims ${suiteId}`);\n          continue;\n        }\n        if (!statusAllows(key.meta, keyStatus)) {\n          fail(`Key status not accepted (status: ${key.meta.status ?? 'active'}, policy: ${keyStatus})`);\n          continue;\n        }\n        if (!(entry.signature instanceof Uint8Array)) {\n          fail('Signature must be a Uint8Array');\n          continue;\n        }\n        const valid = await this.verifyAgainst(key.meta, key.publicKey, message, entry.signature, options.scheme ?? 'v4');\n        if (valid) {\n          results.push({ suiteId, keyId, valid: true });\n        } else {\n          fail('Signature verification failed');\n        }\n      } catch (error) {\n        fail(error instanceof Error ? error.message : String(error));\n      }\n    }\n\n    if (requiredSuites.length === 0) {\n      return refuse(\n        `No required suites: agent '${agentId}' has no usable keys and options.requiredSuites was not given`,\n        results\n      );\n    }\n    if (results.length === 0) {\n      return refuse('No signatures supplied', results);\n    }\n\n    // Walk the REQUIRED suites and look each up among the valid signatures.\n    const missingSuites = requiredSuites.filter(\n      required => !results.some(r => r.valid && r.suiteId === required)\n    );\n    const everySuppliedValid = results.every(r => r.valid === true);\n\n    return {\n      results,\n      allValid: everySuppliedValid && missingSuites.length === 0,\n      requiredSuites,\n      missingSuites,\n      ...(missingSuites.length > 0\n        ? { error: `No valid signature for required suite(s): ${missingSuites.join(', ')}` }\n        : {}),\n    };\n  }\n  \n  /**\n   * Generate a new BIP39 mnemonic phrase.\n   * \n   * @param strength 128 (12 words) or 256 (24 words)\n   * @returns Mnemonic phrase\n   */\n  generateMnemonic(strength: 128 | 256 = 256): string {\n    const bip32 = new BIP32Derivation();\n    return bip32.generateMnemonic(strength);\n  }\n  \n  /**\n   * Create a key from a BIP39 mnemonic using HD derivation.\n   * \n   * Only works with suites that support BIP32 derivation (e.g., bsv-ecdsa-secp256k1).\n   * \n   * @param agentId Agent identifier\n   * @param profile Crypto profile (must use derivation-capable suite)\n   * @param mnemonic BIP39 mnemonic phrase (words and checksum are validated)\n   * @param path BIP32 derivation path (default: \"m/44'/0'/0'/0/0\")\n   * @param passphrase Optional BIP39 passphrase\n   * @param options Additional key creation options\n   * @returns KeyRecord with derived key\n   * @throws if the mnemonic has an unknown word, a wrong word count or a bad checksum\n   */\n  async createKeyFromMnemonic(\n    agentId: string,\n    profile: CryptoProfile,\n    mnemonic: string,\n    path: string = BIP32Derivation.bitcoinPath(0, 0, 0),\n    passphrase?: string,\n    options: CreateKeyOptions = {}\n  ): Promise<KeyRecord> {\n    const bip32 = new BIP32Derivation();\n    const seed = bip32.mnemonicToSeed(mnemonic, passphrase);\n    \n    try {\n      return await this.createKey(agentId, profile, {\n        ...options,\n        derivationContext: {\n          seed,\n          path,\n        },\n      });\n    } finally {\n      // The seed is the root of every key in the wallet; do not leave it behind.\n      seed.fill(0);\n    }\n  }\n  \n  /**\n   * Get available capabilities for a specific suite.\n   * \n   * @param suiteId Suite identifier\n   * @returns Array of capability names\n   */\n  getCapabilities(suiteId: string): string[] {\n    const suite = this.suiteRegistry.getSuite(suiteId);\n    const caps: string[] = [];\n    \n    if (suite.capabilities?.derivation) caps.push('derivation');\n    if ((suite.capabilities as any)?.encryption) caps.push('encryption');\n    if ((suite.capabilities as any)?.threshold) caps.push('threshold');\n    \n    return caps;\n  }\n  \n  /**\n   * Get all suite IDs that support a specific capability.\n   * \n   * @param capability Capability name\n   * @returns Array of suite IDs\n   */\n  getSuitesWithCapability(capability: 'derivation' | 'encryption' | 'threshold'): string[] {\n    const allSuites = this.suiteRegistry.getAllSuites();\n    return allSuites\n      .filter(suite => !!(suite.capabilities as any)?.[capability])\n      .map(suite => suite.suiteId);\n  }\n\n  /**\n   * Create a wallet key from a mnemonic at an explicit BIP44 coin type:\n   * `m/44'/coinType'/account'/change/index`.\n   *\n   * The coin type is required and has no default. It decides which wallets\n   * will find the key again: Bitcoin (BTC) is 0, Bitcoin SV is 236.\n   *\n   * @param agentId Agent identifier\n   * @param mnemonic BIP39 mnemonic phrase (words and checksum are validated)\n   * @param path Coin type and position in the BIP44 tree\n   * @param options Additional key creation options\n   * @returns KeyRecord with the derived secp256k1 key\n   */\n  async createWalletKey(\n    agentId: string,\n    mnemonic: string,\n    path: WalletKeyPath,\n    options: CreateKeyOptions = {}\n  ): Promise<KeyRecord> {\n    if (!path || typeof path.coinType !== 'number') {\n      throw new Error(\n        'createWalletKey requires path.coinType (SLIP-44: Bitcoin is 0, Bitcoin SV is 236)'\n      );\n    }\n    const derivationPath = BIP32Derivation.bip44Path(\n      path.coinType,\n      path.account ?? 0,\n      path.change ? 1 : 0,\n      path.index ?? 0\n    );\n    return this.createKeyFromMnemonic(\n      agentId,\n      { primarySignatureSuite: 'bsv-ecdsa-secp256k1' },\n      mnemonic,\n      derivationPath,\n      path.passphrase,\n      options\n    );\n  }\n  \n  /**\n   * Create a wallet key from mnemonic at the Bitcoin (BTC) BIP44 path:\n   * m/44'/0'/account'/change/addressIndex\n   *\n   * NOTE: coin type 0 is BTC. A Bitcoin SV wallet restoring the same mnemonic\n   * looks under coin type 236 and will not find this key. The path is left\n   * as it is because changing it would move every key already created with\n   * this method. For new code use {@link createWalletKey}, which makes the\n   * coin type explicit.\n   * \n   * @deprecated Use createWalletKey(agentId, mnemonic, { coinType, ... }).\n   * @param agentId Agent identifier\n   * @param mnemonic BIP39 mnemonic phrase\n   * @param accountIndex Account index (default: 0)\n   * @param addressIndex Address index (default: 0)\n   * @param isChange Use change address path (default: false)\n   * @param options Additional key creation options\n   * @returns KeyRecord with Bitcoin-compatible key\n   */\n  async createBitcoinWalletKey(\n    agentId: string,\n    mnemonic: string,\n    accountIndex: number = 0,\n    addressIndex: number = 0,\n    isChange: boolean = false,\n    options: CreateKeyOptions = {}\n  ): Promise<KeyRecord> {\n    const path = BIP32Derivation.bitcoinPath(accountIndex, isChange ? 1 : 0, addressIndex);\n    \n    return this.createKeyFromMnemonic(\n      agentId,\n      { primarySignatureSuite: 'bsv-ecdsa-secp256k1' },\n      mnemonic,\n      path,\n      undefined,\n      options\n    );\n  }\n  \n  /**\n   * Helper: register a key under the agent's next free key ID.\n   *\n   * The counter is cached per SDK instance, so another instance (or process)\n   * on the same storage can have taken the ID already. The registry refuses\n   * to overwrite; on that refusal the counter is re-read from storage and the\n   * next ID is tried. Before, the second writer silently replaced the first\n   * writer's private key.\n   */\n  private async registerUnderFreshId(\n    agentId: string,\n    suiteId: string,\n    register: (keyId: string) => Promise<KeyMeta>\n  ): Promise<KeyMeta> {\n    // 'ml' for every ml-dsa suite, 'bsv' for bsv-ecdsa-secp256k1\n    const suiteName = suiteId.split('-')[0].replace(/[^A-Za-z0-9]/g, '') || 'key';\n\n    for (let attempt = 0; attempt < MAX_KEY_ID_ATTEMPTS; attempt++) {\n      const counter = await this.getNextCounter(agentId);\n      const keyId = `${agentId}:pk-${suiteName}-${counter}`;\n      try {\n        return await register(keyId);\n      } catch (error) {\n        if (!(error instanceof KeyAlreadyExistsError)) throw error;\n        // Someone else holds that ID: forget the cached counter and re-read.\n        this.counterInitialized.delete(agentId);\n        this.keyCounter.delete(agentId);\n      }\n    }\n    throw new Error(\n      `Could not allocate a key ID for agent '${agentId}' after ${MAX_KEY_ID_ATTEMPTS} attempts`\n    );\n  }\n  \n  /**\n   * Helper: Get next counter for an agent.\n   */\n  private async getNextCounter(agentId: string): Promise<number> {\n    if (!this.counterInitialized.has(agentId)) {\n      if (!this.counterInitPromises.has(agentId)) {\n        const initPromise = (async () => {\n          try {\n            const existing = await this.keyRegistry.listKeys();\n            const max = existing.reduce((acc, meta) => {\n              if (agentIdOfKey(meta.keyId) !== agentId) return acc;\n              const local = meta.keyId.slice(agentId.length + 1);\n              const match = COUNTER_SUFFIX.exec(local);\n              if (!match) return acc;\n              const num = parseInt(match[1], 10);\n              return Number.isSafeInteger(num) ? Math.max(acc, num) : acc;\n            }, 0);\n            // A counter handed out while this scan ran must not be reused.\n            this.keyCounter.set(agentId, Math.max(max, this.keyCounter.get(agentId) || 0));\n            this.counterInitialized.add(agentId);\n          } finally {\n            this.counterInitPromises.delete(agentId);\n          }\n        })();\n        this.counterInitPromises.set(agentId, initPromise);\n      }\n\n      const pendingInit = this.counterInitPromises.get(agentId);\n      if (pendingInit) {\n        await pendingInit;\n      }\n    }\n\n    const current = this.keyCounter.get(agentId) || 0;\n    const next = current + 1;\n    this.keyCounter.set(agentId, next);\n    return next;\n  }\n\n  /**\n   * Helper: sort keys deterministically by createdAt then keyId.\n   */\n  private sortKeysByCreatedAt(keys: KeyRecord[]): KeyRecord[] {\n    return [...keys].sort((a, b) => {\n      const aTime = new Date(a.meta.createdAt).getTime();\n      const bTime = new Date(b.meta.createdAt).getTime();\n      if (aTime !== bTime) return aTime - bTime;\n      const priorityDiff = this.getSuitePriority(a.meta.suiteId) - this.getSuitePriority(b.meta.suiteId);\n      if (priorityDiff !== 0) return priorityDiff;\n      return a.meta.keyId.localeCompare(b.meta.keyId);\n    });\n  }\n\n  private getSuitePriority(suiteId: string): number {\n    if (suiteId.startsWith('ml-dsa')) return 0;\n    if (suiteId.includes('ecdsa')) return 1;\n    return 2;\n  }\n}\n\n/**\n * Create a KeySDK instance with default configuration\n * \n * Uses in-memory storage and registers both ECDSA and ML-DSA suites.\n * For custom storage or different suites, instantiate DefaultKeySDK directly.\n * \n * @example\n * ```typescript\n * import { createKeySDK } from '@smartledger/keys';\n * \n * const sdk = createKeySDK();\n * const key = await sdk.createKey('my-agent', { primarySignatureSuite: 'ml-dsa-87' });\n * ```\n */\nexport function createKeySDK(config?: Partial<KeySDKConfig>): KeySDK {\n  const keyRegistry = config?.keyRegistry || new KeyRegistry(new InMemoryKeyStorage());\n  const suiteRegistry = config?.suiteRegistry || new SignatureSuiteRegistry();\n  \n  // Register default suites if not provided.\n  //\n  // All three ML-DSA levels are registered, not just 87. The README documents\n  // ml-dsa-65 as the recommended default and ml-dsa-44 for constrained\n  // devices; registering only 87 made every one of those examples throw\n  // `Unknown signature suite` at runtime, with no way for a caller to fix it\n  // -- SignatureSuiteRegistry is not re-exported from this package.\n  if (!config?.suiteRegistry) {\n    suiteRegistry.register(new BsvEcdsaSuite());\n    suiteRegistry.register(new MlDsa44Suite());\n    suiteRegistry.register(new MlDsa65Suite());\n    suiteRegistry.register(new MlDsa87Suite());\n  }\n  \n  return new DefaultKeySDK({\n    keyRegistry,\n    suiteRegistry,\n    signingContext: config?.signingContext,\n  });\n}\n"]}

package/dist/esm/types.d.ts

@@ -68,10 +68,21 @@ export interface MultiVerificationResult {
  * - `'usable'`: additionally require the key to be active and unexpired now.
  */
 export type KeyStatusPolicy = 'any' | 'not-revoked' | 'usable';
+/**
+ * How a message becomes what a key signs.
+ * - `'v4'` (default, and the only scheme this version signs with): ML-DSA
+ *   signs the message itself, FIPS 204 pure mode, with the SDK's context
+ *   string; ECDSA signs `SHA-256(message)`.
+ * - `'v3-digest'`: what 3.x did — ML-DSA over `SHA3-256(message)` with the
+ *   empty context. For verifying signatures made by 3.x only.
+ */
+export type SignatureScheme = 'v4' | 'v3-digest';
 /** Options for {@link KeySDK.verifySignature}. */
 export interface VerifySignatureOptions {
     /** Default: `'any'`. */
     keyStatus?: KeyStatusPolicy;
+    /** Default: `'v4'`. Pass `'v3-digest'` to verify a signature made by 3.x. */
+    scheme?: SignatureScheme;
 }
 /** Options for {@link KeySDK.verifyWithSuites}. */
 export interface VerifyWithSuitesOptions {
@@ -86,6 +97,8 @@ export interface VerifyWithSuitesOptions {
     requiredSuites?: string[];
     /** Default: `'not-revoked'`. */
     keyStatus?: KeyStatusPolicy;
+    /** Default: `'v4'`. Applies to every signature in the set. */
+    scheme?: SignatureScheme;
 }
 /** Options for {@link KeySDK.rotateAgentKeys}. */
 export interface RotateAgentKeysOptions {

package/dist/esm/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,UAAU,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,uCAAuC;IACvC,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,YAAY,GAAG,MAAM,CAAC,CAAC;IAEjD,gDAAgD;IAChD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,UAAU,CAAC;CACvB;AAED,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,sCAAsC;AACtC,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACnC;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,6CAA6C;IAC7C,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iEAAiE;IACjE,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,aAAa,GAAG,QAAQ,CAAC;AAE/D,kDAAkD;AAClD,MAAM,WAAW,sBAAsB;IACrC,wBAAwB;IACxB,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED,mDAAmD;AACnD,MAAM,WAAW,uBAAuB;IACtC;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,gCAAgC;IAChC,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED,kDAAkD;AAClD,MAAM,WAAW,sBAAsB;IACrC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC;IAC7C;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,MAAM;IACrB;;;;;;;OAOG;IACH,SAAS,CACP,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAEjD;;;;;;;;OAQG;IACH,WAAW,CACT,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,UAAU,CAAC,CAAC;IAEvB;;;;;;;;;;OAUG;IACH,eAAe,CACb,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;OAMG;IACH,gBAAgB,CACd,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,OAAO,GACnB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAExB;;;;;;;OAOG;IACH,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAEvE;;;;;;;;OAQG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAEzF;;;;;;;;;OASG;IACH,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB;;;OAGG;IACH,uBAAuB,CACrB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC;QAAE,UAAU,EAAE,SAAS,CAAC;QAAC,YAAY,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC;IAE/D;;OAEG;IACH,4BAA4B,CAC1B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC;QAAE,UAAU,EAAE,SAAS,CAAC;QAAC,YAAY,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC;IAE/D;;OAEG;IACH,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEjC;;OAEG;IACH,gBAAgB,CACd,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,cAAc,EAAE,EAC5B,OAAO,CAAC,EAAE,uBAAuB,GAChC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEpC;;;;;OAKG;IACH,gBAAgB,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC;IAE/C;;;;;;;;;;OAUG;IACH,qBAAqB,CACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB;;;;;OAKG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE3C;;;;;OAKG;IACH,uBAAuB,CAAC,UAAU,EAAE,YAAY,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,EAAE,CAAC;CAC1F;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,aAAa,CAAC;CAC9B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,UAAU,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,uCAAuC;IACvC,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,YAAY,GAAG,MAAM,CAAC,CAAC;IAEjD,gDAAgD;IAChD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,UAAU,CAAC;CACvB;AAED,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,sCAAsC;AACtC,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACnC;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,6CAA6C;IAC7C,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iEAAiE;IACjE,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,aAAa,GAAG,QAAQ,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,IAAI,GAAG,WAAW,CAAC;AAEjD,kDAAkD;AAClD,MAAM,WAAW,sBAAsB;IACrC,wBAAwB;IACxB,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,6EAA6E;IAC7E,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED,mDAAmD;AACnD,MAAM,WAAW,uBAAuB;IACtC;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,gCAAgC;IAChC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,8DAA8D;IAC9D,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED,kDAAkD;AAClD,MAAM,WAAW,sBAAsB;IACrC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC;IAC7C;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,MAAM;IACrB;;;;;;;OAOG;IACH,SAAS,CACP,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAEjD;;;;;;;;OAQG;IACH,WAAW,CACT,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,UAAU,CAAC,CAAC;IAEvB;;;;;;;;;;OAUG;IACH,eAAe,CACb,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;OAMG;IACH,gBAAgB,CACd,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,OAAO,GACnB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAExB;;;;;;;OAOG;IACH,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAEvE;;;;;;;;OAQG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAEzF;;;;;;;;;OASG;IACH,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB;;;OAGG;IACH,uBAAuB,CACrB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC;QAAE,UAAU,EAAE,SAAS,CAAC;QAAC,YAAY,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC;IAE/D;;OAEG;IACH,4BAA4B,CAC1B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC;QAAE,UAAU,EAAE,SAAS,CAAC;QAAC,YAAY,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC;IAE/D;;OAEG;IACH,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEjC;;OAEG;IACH,gBAAgB,CACd,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,cAAc,EAAE,EAC5B,OAAO,CAAC,EAAE,uBAAuB,GAChC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEpC;;;;;OAKG;IACH,gBAAgB,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC;IAE/C;;;;;;;;;;OAUG;IACH,qBAAqB,CACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB;;;;;OAKG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE3C;;;;;OAKG;IACH,uBAAuB,CAAC,UAAU,EAAE,YAAY,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,EAAE,CAAC;CAC1F;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,aAAa,CAAC;CAC9B"}

package/dist/esm/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG","sourcesContent":["/**\n * @smartledger/keys - Key Management SDK\n * \n * Single source of truth for cryptographic key operations.\n * Provides a clean API that hides complexity and ensures consistency.\n */\n\nimport { KeyMeta, CryptoProfile, DerivationContext } from '@smartledger/crypto';\n\n/**\n * Public key record (safe to expose, no private key).\n */\nexport interface KeyRecord {\n  meta: KeyMeta;\n  publicKey: Uint8Array;\n}\n\n/**\n * Key creation options.\n */\nexport interface CreateKeyOptions {\n  /** Optional expiration date (ISO 8601) */\n  expiresAt?: string;\n  \n  /** Key usage (default: ['signing']) */\n  usage?: Array<'signing' | 'encryption' | 'both'>;\n  \n  /** Crypto profile version (default: '1.0.0') */\n  cryptoProfileVersion?: string;\n  \n  /** Optional derivation context for deterministic key generation */\n  derivationContext?: DerivationContext;\n}\n\n/**\n * Signature generated by a specific suite/key combination.\n */\nexport interface SuiteSignature {\n  suiteId: string;\n  keyId: string;\n  signature: Uint8Array;\n}\n\n/** Result of signing with one or more suites. */\nexport interface MultiSignatureResult {\n  signatures: SuiteSignature[];\n}\n\n/** Per-suite verification outcome. */\nexport interface SuiteVerificationResult {\n  suiteId: string;\n  keyId: string;\n  valid: boolean;\n  error?: string;\n}\n\n/** Aggregate verification outcome across suites. */\nexport interface MultiVerificationResult {\n  results: SuiteVerificationResult[];\n  /**\n   * True only if at least one signature was supplied, EVERY supplied\n   * signature is valid, and EVERY required suite has a valid signature by a\n   * key of the named agent. Never true for an empty or incomplete set.\n   */\n  allValid: boolean;\n  /** The suites this verification required. */\n  requiredSuites: string[];\n  /** Required suites for which no valid signature was supplied. */\n  missingSuites: string[];\n  /** Set when the set was refused for a reason no single signature explains. */\n  error?: string;\n}\n\n/**\n * Which key states a verification accepts.\n * - `'any'`: the signature is checked cryptographically and nothing else.\n *   Right for historical signatures; says nothing about the key today.\n * - `'not-revoked'`: additionally refuse keys whose status is `revoked`.\n * - `'usable'`: additionally require the key to be active and unexpired now.\n */\nexport type KeyStatusPolicy = 'any' | 'not-revoked' | 'usable';\n\n/** Options for {@link KeySDK.verifySignature}. */\nexport interface VerifySignatureOptions {\n  /** Default: `'any'`. */\n  keyStatus?: KeyStatusPolicy;\n}\n\n/** Options for {@link KeySDK.verifyWithSuites}. */\nexport interface VerifyWithSuitesOptions {\n  /**\n   * Suites that must each have a valid signature. This is the VERIFIER's\n   * policy and must come from the verifier's own configuration, never from\n   * the signature bundle being checked.\n   *\n   * Default: the suites of the agent's currently usable keys in this SDK's\n   * registry, so an agent holding ML-DSA and ECDSA keys requires both.\n   */\n  requiredSuites?: string[];\n  /** Default: `'not-revoked'`. */\n  keyStatus?: KeyStatusPolicy;\n}\n\n/** Options for {@link KeySDK.rotateAgentKeys}. */\nexport interface RotateAgentKeysOptions {\n  /**\n   * What to do with a key that was derived from a seed. Its replacement can\n   * only be generated at random here, because the SDK does not keep seeds, so\n   * the new key would NOT be recoverable from the mnemonic.\n   * - `'error'` (default): refuse, and rotate nothing.\n   * - `'skip'`: leave derived keys as they are and rotate the rest.\n   * - `'randomize'`: replace them with random keys anyway.\n   */\n  derivedKeys?: 'error' | 'skip' | 'randomize';\n  /**\n   * Expiry for the new keys. Omitted: each new key gets its predecessor's\n   * lifetime again, counted from now. `null`: no expiry.\n   */\n  expiresAt?: string | null;\n}\n\n/** Where in a BIP44 tree a wallet key lives. */\nexport interface WalletKeyPath {\n  /**\n   * SLIP-44 coin type. Required, with no default, because it decides which\n   * wallets will find the key again: Bitcoin (BTC) is 0, Bitcoin SV is 236.\n   */\n  coinType: number;\n  /** Account index (default: 0) */\n  account?: number;\n  /** Address index (default: 0) */\n  index?: number;\n  /** Use the internal/change chain (default: false) */\n  change?: boolean;\n  /** Optional BIP39 passphrase */\n  passphrase?: string;\n}\n\n/**\n * Key SDK - Single interface for all key operations.\n * \n * Design principles:\n * - Hide private keys from most callers\n * - Single source of truth for suite selection\n * - Crypto-agnostic API (suite is config, not code)\n * - Easy to audit (all key operations go through this)\n */\nexport interface KeySDK {\n  /**\n   * Create a new key for an agent/module.\n   * \n   * @param agentId Agent identifier (e.g. 'agent-resonance')\n   * @param profile Crypto configuration (which suites to use)\n   * @param options Optional expiration, usage, etc.\n   * @returns KeyRecord with metadata and public key\n   */\n  createKey(\n    agentId: string,\n    profile: CryptoProfile,\n    options?: CreateKeyOptions\n  ): Promise<KeyRecord>;\n  \n  /**\n   * Get an existing key by ID.\n   * \n   * @param keyId Key identifier\n   * @returns KeyRecord or null if not found\n   */\n  getKey(keyId: string): Promise<KeyRecord | null>;\n  \n  /**\n   * Sign a message with a key.\n   * \n   * Private key never leaves the SDK.\n   * \n   * @param keyId Which key to sign with\n   * @param message Message to sign (will be hashed internally)\n   * @returns Signature bytes\n   */\n  signWithKey(\n    keyId: string,\n    message: Uint8Array\n  ): Promise<Uint8Array>;\n  \n  /**\n   * Verify a signature against a public key.\n   * \n   * @param keyId Which key to verify with\n   * @param message Original message\n   * @param signature Signature to verify\n   * @param options `keyStatus` decides whether a revoked or expired key is\n   *   refused. By default only the cryptographic check is made, so a\n   *   signature by a since-revoked key still returns true.\n   * @returns true if valid\n   */\n  verifySignature(\n    keyId: string,\n    message: Uint8Array,\n    signature: Uint8Array,\n    options?: VerifySignatureOptions\n  ): Promise<boolean>;\n  \n  /**\n   * List all keys for an agent.\n   * \n   * @param agentId Agent identifier\n   * @param activeOnly If true, only return active keys (default: true)\n   * @returns Array of KeyRecords\n   */\n  listKeysForAgent(\n    agentId: string,\n    activeOnly?: boolean\n  ): Promise<KeyRecord[]>;\n  \n  /**\n   * Get the active crypto profile for an agent.\n   * \n   * Looks up the most recent active keys and infers the profile.\n   * \n   * @param agentId Agent identifier\n   * @returns CryptoProfile or null if no keys found\n   */\n  getActiveCryptoProfile(agentId: string): Promise<CryptoProfile | null>;\n  \n  /**\n   * Rotate an agent's keys.\n   * \n   * Generates new keypairs for all active keys, marks old ones as rotated.\n   * \n   * @param agentId Agent identifier\n   * @param options How to treat seed-derived keys, and the new keys' expiry\n   * @returns Array of new KeyRecords\n   */\n  rotateAgentKeys(agentId: string, options?: RotateAgentKeysOptions): Promise<KeyRecord[]>;\n  \n  /**\n   * Create key if it doesn't exist, otherwise return existing.\n   * \n   * Idempotent key creation for agent setup.\n   * \n   * @param agentId Agent identifier\n   * @param profile Crypto configuration\n   * @param options Creation options\n   * @returns KeyRecord (new or existing)\n   */\n  getOrCreateKey(\n    agentId: string,\n    profile: CryptoProfile,\n    options?: CreateKeyOptions\n  ): Promise<KeyRecord>;\n\n  /**\n   * Create both primary and secondary keys in a single call.\n   * Requires profile.secondarySignatureSuite to be set.\n   */\n  createDualSignatureKeys(\n    agentId: string,\n    profile: CryptoProfile,\n    options?: CreateKeyOptions\n  ): Promise<{ primaryKey: KeyRecord; secondaryKey: KeyRecord }>;\n\n  /**\n   * Idempotent dual-key creation; returns existing active keys when present.\n   */\n  getOrCreateDualSignatureKeys(\n    agentId: string,\n    profile: CryptoProfile,\n    options?: CreateKeyOptions\n  ): Promise<{ primaryKey: KeyRecord; secondaryKey: KeyRecord }>;\n\n  /**\n   * Sign with one or more suites. If suites not provided, uses active profile.\n   */\n  signWithSuites(\n    agentId: string,\n    message: Uint8Array,\n    suites?: string[]\n  ): Promise<MultiSignatureResult>;\n\n  /**\n   * Verify multiple signatures for an agent.\n   */\n  verifyWithSuites(\n    agentId: string,\n    message: Uint8Array,\n    signatures: SuiteSignature[],\n    options?: VerifyWithSuitesOptions\n  ): Promise<MultiVerificationResult>;\n  \n  /**\n   * Generate a new BIP39 mnemonic phrase.\n   * \n   * @param strength 128 (12 words) or 256 (24 words)\n   * @returns Mnemonic phrase\n   */\n  generateMnemonic(strength?: 128 | 256): string;\n  \n  /**\n   * Create a key from a BIP39 mnemonic using HD derivation.\n   * \n   * @param agentId Agent identifier\n   * @param profile Crypto profile (must use derivation-capable suite)\n   * @param mnemonic BIP39 mnemonic phrase\n   * @param path BIP32 derivation path\n   * @param passphrase Optional BIP39 passphrase\n   * @param options Additional key creation options\n   * @returns KeyRecord with derived key\n   */\n  createKeyFromMnemonic(\n    agentId: string,\n    profile: CryptoProfile,\n    mnemonic: string,\n    path?: string,\n    passphrase?: string,\n    options?: CreateKeyOptions\n  ): Promise<KeyRecord>;\n  \n  /**\n   * Get available capabilities for a specific suite.\n   * \n   * @param suiteId Suite identifier\n   * @returns Array of capability names\n   */\n  getCapabilities(suiteId: string): string[];\n  \n  /**\n   * Find suites that support a specific capability.\n   * \n   * @param capability Capability name\n   * @returns Array of suite IDs\n   */\n  getSuitesWithCapability(capability: 'derivation' | 'encryption' | 'threshold'): string[];\n}\n\n/**\n * Agent metadata with crypto configuration.\n */\nexport interface AgentKeyConfig {\n  agentId: string;\n  version: string;\n  cryptoProfile: CryptoProfile;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG","sourcesContent":["/**\n * @smartledger/keys - Key Management SDK\n * \n * Single source of truth for cryptographic key operations.\n * Provides a clean API that hides complexity and ensures consistency.\n */\n\nimport { KeyMeta, CryptoProfile, DerivationContext } from '@smartledger/crypto';\n\n/**\n * Public key record (safe to expose, no private key).\n */\nexport interface KeyRecord {\n  meta: KeyMeta;\n  publicKey: Uint8Array;\n}\n\n/**\n * Key creation options.\n */\nexport interface CreateKeyOptions {\n  /** Optional expiration date (ISO 8601) */\n  expiresAt?: string;\n  \n  /** Key usage (default: ['signing']) */\n  usage?: Array<'signing' | 'encryption' | 'both'>;\n  \n  /** Crypto profile version (default: '1.0.0') */\n  cryptoProfileVersion?: string;\n  \n  /** Optional derivation context for deterministic key generation */\n  derivationContext?: DerivationContext;\n}\n\n/**\n * Signature generated by a specific suite/key combination.\n */\nexport interface SuiteSignature {\n  suiteId: string;\n  keyId: string;\n  signature: Uint8Array;\n}\n\n/** Result of signing with one or more suites. */\nexport interface MultiSignatureResult {\n  signatures: SuiteSignature[];\n}\n\n/** Per-suite verification outcome. */\nexport interface SuiteVerificationResult {\n  suiteId: string;\n  keyId: string;\n  valid: boolean;\n  error?: string;\n}\n\n/** Aggregate verification outcome across suites. */\nexport interface MultiVerificationResult {\n  results: SuiteVerificationResult[];\n  /**\n   * True only if at least one signature was supplied, EVERY supplied\n   * signature is valid, and EVERY required suite has a valid signature by a\n   * key of the named agent. Never true for an empty or incomplete set.\n   */\n  allValid: boolean;\n  /** The suites this verification required. */\n  requiredSuites: string[];\n  /** Required suites for which no valid signature was supplied. */\n  missingSuites: string[];\n  /** Set when the set was refused for a reason no single signature explains. */\n  error?: string;\n}\n\n/**\n * Which key states a verification accepts.\n * - `'any'`: the signature is checked cryptographically and nothing else.\n *   Right for historical signatures; says nothing about the key today.\n * - `'not-revoked'`: additionally refuse keys whose status is `revoked`.\n * - `'usable'`: additionally require the key to be active and unexpired now.\n */\nexport type KeyStatusPolicy = 'any' | 'not-revoked' | 'usable';\n\n/**\n * How a message becomes what a key signs.\n * - `'v4'` (default, and the only scheme this version signs with): ML-DSA\n *   signs the message itself, FIPS 204 pure mode, with the SDK's context\n *   string; ECDSA signs `SHA-256(message)`.\n * - `'v3-digest'`: what 3.x did — ML-DSA over `SHA3-256(message)` with the\n *   empty context. For verifying signatures made by 3.x only.\n */\nexport type SignatureScheme = 'v4' | 'v3-digest';\n\n/** Options for {@link KeySDK.verifySignature}. */\nexport interface VerifySignatureOptions {\n  /** Default: `'any'`. */\n  keyStatus?: KeyStatusPolicy;\n  /** Default: `'v4'`. Pass `'v3-digest'` to verify a signature made by 3.x. */\n  scheme?: SignatureScheme;\n}\n\n/** Options for {@link KeySDK.verifyWithSuites}. */\nexport interface VerifyWithSuitesOptions {\n  /**\n   * Suites that must each have a valid signature. This is the VERIFIER's\n   * policy and must come from the verifier's own configuration, never from\n   * the signature bundle being checked.\n   *\n   * Default: the suites of the agent's currently usable keys in this SDK's\n   * registry, so an agent holding ML-DSA and ECDSA keys requires both.\n   */\n  requiredSuites?: string[];\n  /** Default: `'not-revoked'`. */\n  keyStatus?: KeyStatusPolicy;\n  /** Default: `'v4'`. Applies to every signature in the set. */\n  scheme?: SignatureScheme;\n}\n\n/** Options for {@link KeySDK.rotateAgentKeys}. */\nexport interface RotateAgentKeysOptions {\n  /**\n   * What to do with a key that was derived from a seed. Its replacement can\n   * only be generated at random here, because the SDK does not keep seeds, so\n   * the new key would NOT be recoverable from the mnemonic.\n   * - `'error'` (default): refuse, and rotate nothing.\n   * - `'skip'`: leave derived keys as they are and rotate the rest.\n   * - `'randomize'`: replace them with random keys anyway.\n   */\n  derivedKeys?: 'error' | 'skip' | 'randomize';\n  /**\n   * Expiry for the new keys. Omitted: each new key gets its predecessor's\n   * lifetime again, counted from now. `null`: no expiry.\n   */\n  expiresAt?: string | null;\n}\n\n/** Where in a BIP44 tree a wallet key lives. */\nexport interface WalletKeyPath {\n  /**\n   * SLIP-44 coin type. Required, with no default, because it decides which\n   * wallets will find the key again: Bitcoin (BTC) is 0, Bitcoin SV is 236.\n   */\n  coinType: number;\n  /** Account index (default: 0) */\n  account?: number;\n  /** Address index (default: 0) */\n  index?: number;\n  /** Use the internal/change chain (default: false) */\n  change?: boolean;\n  /** Optional BIP39 passphrase */\n  passphrase?: string;\n}\n\n/**\n * Key SDK - Single interface for all key operations.\n * \n * Design principles:\n * - Hide private keys from most callers\n * - Single source of truth for suite selection\n * - Crypto-agnostic API (suite is config, not code)\n * - Easy to audit (all key operations go through this)\n */\nexport interface KeySDK {\n  /**\n   * Create a new key for an agent/module.\n   * \n   * @param agentId Agent identifier (e.g. 'agent-resonance')\n   * @param profile Crypto configuration (which suites to use)\n   * @param options Optional expiration, usage, etc.\n   * @returns KeyRecord with metadata and public key\n   */\n  createKey(\n    agentId: string,\n    profile: CryptoProfile,\n    options?: CreateKeyOptions\n  ): Promise<KeyRecord>;\n  \n  /**\n   * Get an existing key by ID.\n   * \n   * @param keyId Key identifier\n   * @returns KeyRecord or null if not found\n   */\n  getKey(keyId: string): Promise<KeyRecord | null>;\n  \n  /**\n   * Sign a message with a key.\n   * \n   * Private key never leaves the SDK.\n   * \n   * @param keyId Which key to sign with\n   * @param message Message to sign (will be hashed internally)\n   * @returns Signature bytes\n   */\n  signWithKey(\n    keyId: string,\n    message: Uint8Array\n  ): Promise<Uint8Array>;\n  \n  /**\n   * Verify a signature against a public key.\n   * \n   * @param keyId Which key to verify with\n   * @param message Original message\n   * @param signature Signature to verify\n   * @param options `keyStatus` decides whether a revoked or expired key is\n   *   refused. By default only the cryptographic check is made, so a\n   *   signature by a since-revoked key still returns true.\n   * @returns true if valid\n   */\n  verifySignature(\n    keyId: string,\n    message: Uint8Array,\n    signature: Uint8Array,\n    options?: VerifySignatureOptions\n  ): Promise<boolean>;\n  \n  /**\n   * List all keys for an agent.\n   * \n   * @param agentId Agent identifier\n   * @param activeOnly If true, only return active keys (default: true)\n   * @returns Array of KeyRecords\n   */\n  listKeysForAgent(\n    agentId: string,\n    activeOnly?: boolean\n  ): Promise<KeyRecord[]>;\n  \n  /**\n   * Get the active crypto profile for an agent.\n   * \n   * Looks up the most recent active keys and infers the profile.\n   * \n   * @param agentId Agent identifier\n   * @returns CryptoProfile or null if no keys found\n   */\n  getActiveCryptoProfile(agentId: string): Promise<CryptoProfile | null>;\n  \n  /**\n   * Rotate an agent's keys.\n   * \n   * Generates new keypairs for all active keys, marks old ones as rotated.\n   * \n   * @param agentId Agent identifier\n   * @param options How to treat seed-derived keys, and the new keys' expiry\n   * @returns Array of new KeyRecords\n   */\n  rotateAgentKeys(agentId: string, options?: RotateAgentKeysOptions): Promise<KeyRecord[]>;\n  \n  /**\n   * Create key if it doesn't exist, otherwise return existing.\n   * \n   * Idempotent key creation for agent setup.\n   * \n   * @param agentId Agent identifier\n   * @param profile Crypto configuration\n   * @param options Creation options\n   * @returns KeyRecord (new or existing)\n   */\n  getOrCreateKey(\n    agentId: string,\n    profile: CryptoProfile,\n    options?: CreateKeyOptions\n  ): Promise<KeyRecord>;\n\n  /**\n   * Create both primary and secondary keys in a single call.\n   * Requires profile.secondarySignatureSuite to be set.\n   */\n  createDualSignatureKeys(\n    agentId: string,\n    profile: CryptoProfile,\n    options?: CreateKeyOptions\n  ): Promise<{ primaryKey: KeyRecord; secondaryKey: KeyRecord }>;\n\n  /**\n   * Idempotent dual-key creation; returns existing active keys when present.\n   */\n  getOrCreateDualSignatureKeys(\n    agentId: string,\n    profile: CryptoProfile,\n    options?: CreateKeyOptions\n  ): Promise<{ primaryKey: KeyRecord; secondaryKey: KeyRecord }>;\n\n  /**\n   * Sign with one or more suites. If suites not provided, uses active profile.\n   */\n  signWithSuites(\n    agentId: string,\n    message: Uint8Array,\n    suites?: string[]\n  ): Promise<MultiSignatureResult>;\n\n  /**\n   * Verify multiple signatures for an agent.\n   */\n  verifyWithSuites(\n    agentId: string,\n    message: Uint8Array,\n    signatures: SuiteSignature[],\n    options?: VerifyWithSuitesOptions\n  ): Promise<MultiVerificationResult>;\n  \n  /**\n   * Generate a new BIP39 mnemonic phrase.\n   * \n   * @param strength 128 (12 words) or 256 (24 words)\n   * @returns Mnemonic phrase\n   */\n  generateMnemonic(strength?: 128 | 256): string;\n  \n  /**\n   * Create a key from a BIP39 mnemonic using HD derivation.\n   * \n   * @param agentId Agent identifier\n   * @param profile Crypto profile (must use derivation-capable suite)\n   * @param mnemonic BIP39 mnemonic phrase\n   * @param path BIP32 derivation path\n   * @param passphrase Optional BIP39 passphrase\n   * @param options Additional key creation options\n   * @returns KeyRecord with derived key\n   */\n  createKeyFromMnemonic(\n    agentId: string,\n    profile: CryptoProfile,\n    mnemonic: string,\n    path?: string,\n    passphrase?: string,\n    options?: CreateKeyOptions\n  ): Promise<KeyRecord>;\n  \n  /**\n   * Get available capabilities for a specific suite.\n   * \n   * @param suiteId Suite identifier\n   * @returns Array of capability names\n   */\n  getCapabilities(suiteId: string): string[];\n  \n  /**\n   * Find suites that support a specific capability.\n   * \n   * @param capability Capability name\n   * @returns Array of suite IDs\n   */\n  getSuitesWithCapability(capability: 'derivation' | 'encryption' | 'threshold'): string[];\n}\n\n/**\n * Agent metadata with crypto configuration.\n */\nexport interface AgentKeyConfig {\n  agentId: string;\n  version: string;\n  cryptoProfile: CryptoProfile;\n}\n"]}