@vapi-network/core 0.3.0 → 0.7.0

package/dist/secrets.js

@@ -2212,7 +2212,7 @@ function weierstrass(curveDef) {
   function prepSig(msgHash, privateKey, opts = defaultSigOpts) {
     if (["recovered", "canonical"].some((k) => k in opts))
       throw new Error("sign() legacy options not supported");
-    const { hash: hash2, randomBytes: randomBytes3 } = CURVE;
+    const { hash: hash2, randomBytes: randomBytes4 } = CURVE;
     let { lowS, prehash, extraEntropy: ent } = opts;
     if (lowS == null)
       lowS = true;
@@ -2224,7 +2224,7 @@ function weierstrass(curveDef) {
     const d = normPrivateKeyToScalar(privateKey);
     const seedArgs = [int2octets(d), int2octets(h1int)];
     if (ent != null && ent !== false) {
-      const e2 = ent === true ? randomBytes3(Fp.BYTES) : ent;
+      const e2 = ent === true ? randomBytes4(Fp.BYTES) : ent;
       seedArgs.push(ensureBytes("extraEntropy", e2));
     }
     const seed = concatBytes2(...seedArgs);
@@ -46551,6 +46551,7 @@ init_getAddress();
 
 // src/x402-networks.ts
 var BASE_MAINNET_CAIP2 = "eip155:8453";
+var ARC_MAINNET_CAIP2 = "eip155:5042";
 var ARC_TESTNET_CAIP2 = "eip155:5042002";
 var SOLANA_MAINNET_CAIP2 = "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpKuc147dw2N9d";
 var X402_SOLANA_MAINNET_CAIP2 = "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp";
@@ -46569,8 +46570,13 @@ var arcTestnetUsdc = canonicalIdentity("0x36000000000000000000000000000000000000
   name: "USDC",
   version: "2"
 });
+var arcMainnetUsdc = canonicalIdentity("0x3600000000000000000000000000000000000000", {
+  name: "USDC",
+  version: "2"
+});
 var CANONICAL_X402_USDC_NETWORKS = Object.freeze({
   [BASE_MAINNET_CAIP2]: baseMainnetUsdc,
+  [ARC_MAINNET_CAIP2]: arcMainnetUsdc,
   [ARC_TESTNET_CAIP2]: arcTestnetUsdc
 });
 function browserNetwork(identity) {
@@ -46582,6 +46588,7 @@ function browserNetwork(identity) {
 }
 var BROWSER_ENABLED_X402_NETWORK_CONFIG = Object.freeze({
   [BASE_MAINNET_CAIP2]: browserNetwork(baseMainnetUsdc),
+  [ARC_MAINNET_CAIP2]: browserNetwork(arcMainnetUsdc),
   [ARC_TESTNET_CAIP2]: browserNetwork(arcTestnetUsdc)
 });
 
@@ -46594,7 +46601,18 @@ var NETWORKS = {
     usdc: CANONICAL_X402_USDC_NETWORKS[BASE_MAINNET_CAIP2].usdc,
     gasToken: "ETH",
     rpcEnv: "BASE_RPC_URL",
-    publicRpcUrl: "https://mainnet.base.org"
+    publicRpcUrl: "https://mainnet.base.org",
+    explorerUrl: "https://basescan.org"
+  },
+  [ARC_MAINNET_CAIP2]: {
+    family: "evm",
+    chainId: 5042,
+    name: "Arc mainnet",
+    usdc: CANONICAL_X402_USDC_NETWORKS[ARC_MAINNET_CAIP2].usdc,
+    gasToken: "USDC",
+    rpcEnv: "ARC_RPC_URL",
+    publicRpcUrl: "https://rpc.mainnet.arc.io",
+    explorerUrl: "https://explorer.arc.io"
   },
   [ARC_TESTNET_CAIP2]: {
     family: "evm",
@@ -46679,7 +46697,8 @@ var configSchema = external_exports.object({
       }).optional()
     })
   ),
-  spendCaps: spendCapsSchema
+  spendCaps: spendCapsSchema,
+  device: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,31}$/).optional()
 }).superRefine((config2, context) => {
   for (const [network, configured] of Object.entries(config2.networks)) {
     if (isSolanaNetwork(network)) {
@@ -46693,7 +46712,14 @@ var configSchema = external_exports.object({
       continue;
     }
     try {
-      getAddress(configured.usdc);
+      const usdc = getAddress(configured.usdc);
+      if ((network === ARC_MAINNET_CAIP2 || network === ARC_TESTNET_CAIP2) && usdc !== getAddress(NETWORKS[network].usdc)) {
+        context.addIssue({
+          code: "custom",
+          path: ["networks", network, "usdc"],
+          message: "Expected the canonical Arc USDC predeploy."
+        });
+      }
     } catch {
       context.addIssue({
         code: "custom",
@@ -46706,6 +46732,7 @@ var configSchema = external_exports.object({
 function getVapiPaths(directory = process.env.VAPI_HOME?.trim() || join2(homedir(), ".vapi")) {
   return {
     directory,
+    agentsDir: join2(directory, "agents"),
     config: join2(directory, "config.json"),
     keystore: join2(directory, "keystore.json"),
     receipts: join2(directory, "receipts.jsonl"),
@@ -46912,7 +46939,34 @@ var KeystoreError = class extends Error {
     this.name = "KeystoreError";
   }
 };
-async function deriveKey(passphrase, salt) {
+function encryptWithKey(key, plaintext) {
+  if (key.byteLength !== KEY_LENGTH) {
+    throw new Error(`Expected a ${KEY_LENGTH}-byte AES-256-GCM key.`);
+  }
+  const nonce = randomBytes2(12);
+  const cipher = createCipheriv("aes-256-gcm", key, nonce, {
+    authTagLength: AUTH_TAG_LENGTH
+  });
+  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  return { nonce, ciphertext, tag: cipher.getAuthTag() };
+}
+function decryptWithKey(key, sealed) {
+  if (key.byteLength !== KEY_LENGTH) {
+    throw new Error(`Expected a ${KEY_LENGTH}-byte AES-256-GCM key.`);
+  }
+  if (sealed.nonce.byteLength !== 12) {
+    throw new Error("Expected a 12-byte AES-GCM nonce.");
+  }
+  if (sealed.tag.byteLength !== AUTH_TAG_LENGTH) {
+    throw new Error(`Expected a ${AUTH_TAG_LENGTH}-byte AES-GCM authentication tag.`);
+  }
+  const decipher = createDecipheriv("aes-256-gcm", key, sealed.nonce, {
+    authTagLength: AUTH_TAG_LENGTH
+  });
+  decipher.setAuthTag(sealed.tag);
+  return Buffer.concat([decipher.update(sealed.ciphertext), decipher.final()]);
+}
+async function deriveScryptKey(passphrase, salt) {
   return await new Promise((resolve, reject) => {
     scrypt(
       passphrase,
@@ -46974,16 +47028,14 @@ async function sealPlaintext(plaintext, passphrase) {
     throw new KeystoreError("Keystore passphrase cannot be empty.");
   }
   const salt = randomBytes2(32);
-  const iv = randomBytes2(12);
-  const key = await deriveKey(passphrase, salt);
+  const key = await deriveScryptKey(passphrase, salt);
   try {
-    const cipher = createCipheriv("aes-256-gcm", key, iv, { authTagLength: AUTH_TAG_LENGTH });
-    const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    const sealed = encryptWithKey(key, Buffer.from(plaintext, "utf8"));
     return {
       cipher: "aes-256-gcm",
-      ciphertext: ciphertext.toString("base64"),
-      iv: iv.toString("base64"),
-      authTag: cipher.getAuthTag().toString("base64"),
+      ciphertext: sealed.ciphertext.toString("base64"),
+      iv: sealed.nonce.toString("base64"),
+      authTag: sealed.tag.toString("base64"),
       kdf: "scrypt",
       salt: salt.toString("base64"),
       kdfParams: {
@@ -47011,19 +47063,14 @@ async function decryptSecret(keystore, passphrase) {
   const iv = Buffer.from(parsed.crypto.iv, "base64");
   const authTag = Buffer.from(parsed.crypto.authTag, "base64");
   const ciphertext = Buffer.from(parsed.crypto.ciphertext, "base64");
-  const key = await deriveKey(passphrase, salt);
+  const key = await deriveScryptKey(passphrase, salt);
   let unlocked;
   try {
-    if (authTag.length !== AUTH_TAG_LENGTH) {
-      throw new Error(`Expected a ${AUTH_TAG_LENGTH}-byte AES-GCM authentication tag.`);
-    }
-    const decipher = createDecipheriv("aes-256-gcm", key, iv, {
-      authTagLength: AUTH_TAG_LENGTH
-    });
-    decipher.setAuthTag(authTag);
-    const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString(
-      "utf8"
-    );
+    const plaintext = decryptWithKey(key, {
+      nonce: iv,
+      ciphertext,
+      tag: authTag
+    }).toString("utf8");
     unlocked = parsed.version === 3 ? keysFromEntropy(parsed, plaintext) : {
       keys: parsed.version === 1 ? { evm: `0x${plaintext}` } : encryptedKeysSchema.parse(JSON.parse(plaintext)).keys
     };
@@ -47108,6 +47155,15 @@ async function refuseExistingKeystore(path) {
     }
   }
 }
+function validatePrivateKey(value) {
+  const normalized = value.trim().toLowerCase();
+  if (!/^0x[0-9a-f]{64}$/u.test(normalized)) {
+    throw new KeystoreError(
+      "A private key is 0x followed by 64 hexadecimal characters. Check for a missing character."
+    );
+  }
+  return normalized;
+}
 async function readStoredKeystore(path) {
   let raw;
   try {
@@ -47204,10 +47260,526 @@ async function writeKeystore(path, keystore, exclusive) {
   }
   await rename2(temporaryPath, path);
 }
+
+// src/vault.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+import { mkdir as mkdir3, open as open2, readFile as readFile3, rename as rename3, rm, stat as stat3, unlink, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname as dirname3 } from "node:path";
+
+// src/wallet-name.ts
+var WALLET_NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,31}$/;
+var walletNameSchema = external_exports.string().regex(
+  WALLET_NAME_PATTERN,
+  "A wallet name is 1 to 32 characters of lowercase letters, digits and dashes, starting with a letter or digit."
+);
+
+// src/vault.ts
+var VaultError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "VaultError";
+    this.code = code;
+  }
+};
+var SEALED_FIELD_PATTERN = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u;
+var WRAPPED_KEY_PATTERN = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u;
+var ADDRESS_PATTERN = /^0x[0-9a-fA-F]{40}$/u;
+var VAULT_LOCK_TIMEOUT_MS = 2e3;
+var STALE_VAULT_LOCK_MS = 3e4;
+var sealedFieldSchema = external_exports.string().regex(SEALED_FIELD_PATTERN);
+var addressSchema = external_exports.string().regex(ADDRESS_PATTERN);
+var accountFields = {
+  name: walletNameSchema,
+  address: addressSchema,
+  createdAt: external_exports.string()
+};
+var storedAccountSchema = external_exports.discriminatedUnion("kind", [
+  external_exports.object({
+    ...accountFields,
+    kind: external_exports.literal("derived"),
+    index: external_exports.number().int().nonnegative().refine(Number.isSafeInteger, "Derived account index must be a safe integer.")
+  }).strict(),
+  external_exports.object({
+    ...accountFields,
+    kind: external_exports.literal("imported"),
+    key: sealedFieldSchema
+  }).strict()
+]);
+var vaultFileSchema = external_exports.object({
+  version: external_exports.literal(2),
+  kdf: external_exports.literal("device-key"),
+  cipher: external_exports.literal("aes-256-gcm"),
+  phrase: sealedFieldSchema,
+  accounts: external_exports.array(storedAccountSchema),
+  nextDerivedIndex: external_exports.number().int().nonnegative().refine(Number.isSafeInteger, "Next derived account index must be a safe integer.").optional(),
+  protected: external_exports.boolean(),
+  wrappedKey: external_exports.string().regex(WRAPPED_KEY_PATTERN).optional()
+}).strict();
+var DeviceVault = class {
+  file;
+  path;
+  key;
+  balanceOf;
+  now;
+  constructor(options, file2) {
+    this.path = options.path;
+    this.key = options.key;
+    this.balanceOf = options.balanceOf;
+    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+    this.file = file2;
+  }
+  accounts() {
+    return this.file.accounts.map(copyAccount);
+  }
+  async deriveAccount(name) {
+    try {
+      return await this.update(async (file2) => {
+        assertAvailableName(file2, name);
+        const index = nextDerivedIndex(file2);
+        const plaintext = decryptField(this.key, file2.phrase);
+        let seed;
+        let address;
+        try {
+          seed = phraseToSeed(plaintext.toString("utf8"));
+          address = privateKeyToAccount(
+            deriveEvmPrivateKey(seed, `m/44'/60'/0'/0/${index}`)
+          ).address;
+        } finally {
+          seed?.fill(0);
+          plaintext.fill(0);
+        }
+        const account = {
+          name,
+          kind: "derived",
+          index,
+          address,
+          createdAt: this.now().toISOString()
+        };
+        file2.accounts.push(account);
+        file2.nextDerivedIndex = index + 1;
+        return copyAccount(account);
+      });
+    } catch (error61) {
+      throw asVaultError(error61, "corrupt", "Unable to derive a vault account.");
+    }
+  }
+  async importAccount(name, privateKey) {
+    try {
+      return await this.update(async (file2) => {
+        assertAvailableName(file2, name);
+        let validated;
+        let address;
+        try {
+          validated = validatePrivateKey(privateKey);
+          address = privateKeyToAccount(validated).address;
+        } catch (error61) {
+          throw new VaultError("bad_key", "The imported private key is not valid.", {
+            cause: error61
+          });
+        }
+        const plaintext = Buffer.from(validated.slice(2), "hex");
+        let account;
+        try {
+          account = {
+            name,
+            kind: "imported",
+            address,
+            key: sealField(this.key, plaintext),
+            createdAt: this.now().toISOString()
+          };
+        } finally {
+          plaintext.fill(0);
+        }
+        file2.accounts.push(account);
+        return copyAccount(account);
+      });
+    } catch (error61) {
+      throw asVaultError(error61, "corrupt", "Unable to import a vault account.");
+    }
+  }
+  async removeAccount(name) {
+    try {
+      await this.update(async (file2) => {
+        const account = file2.accounts.find((candidate) => candidate.name === name);
+        if (!account) {
+          throw new VaultError("not_found", "No vault account has that name.");
+        }
+        if (!this.balanceOf) {
+          throw new VaultError(
+            "has_balance",
+            "The account balance could not be verified, so the key was not removed."
+          );
+        }
+        if (await this.balanceOf(account.address) > 0n) {
+          throw new VaultError(
+            "has_balance",
+            "This account still has a balance. Run vapi sweep before removing it."
+          );
+        }
+        file2.nextDerivedIndex = nextDerivedIndex(file2);
+        const currentIndex = file2.accounts.findIndex((candidate) => candidate.name === name);
+        if (currentIndex === -1) {
+          throw new VaultError("not_found", "No vault account has that name.");
+        }
+        file2.accounts.splice(currentIndex, 1);
+      });
+    } catch (error61) {
+      throw asVaultError(error61, "corrupt", "Unable to remove the vault account.");
+    }
+  }
+  async rename(from, to) {
+    try {
+      await this.update(async (file2) => {
+        const account = file2.accounts.find((candidate) => candidate.name === from);
+        if (!account) {
+          throw new VaultError("not_found", "No vault account has that name.");
+        }
+        if (from === to) return;
+        assertAccountName(to);
+        if (file2.accounts.some((candidate) => candidate.name === to)) {
+          throw new VaultError("name_taken", "A vault account already has that name.");
+        }
+        account.name = to;
+      });
+    } catch (error61) {
+      throw asVaultError(error61, "corrupt", "Unable to rename the vault account.");
+    }
+  }
+  async signer(name) {
+    try {
+      const latest = await readVaultFile(this.path, this.key);
+      this.file = latest;
+      const stored = latest.accounts.find((account2) => account2.name === name);
+      if (!stored) {
+        throw new VaultError("not_found", "No vault account has that name.");
+      }
+      let account;
+      if (stored.kind === "derived") {
+        const plaintext = decryptField(this.key, latest.phrase);
+        let seed;
+        try {
+          seed = phraseToSeed(plaintext.toString("utf8"));
+          account = privateKeyToAccount(
+            deriveEvmPrivateKey(seed, `m/44'/60'/0'/0/${stored.index}`)
+          );
+        } finally {
+          seed?.fill(0);
+          plaintext.fill(0);
+        }
+      } else {
+        const plaintext = decryptField(this.key, stored.key);
+        try {
+          if (plaintext.byteLength !== 32) {
+            throw new VaultError("corrupt", "An imported vault key has the wrong length.");
+          }
+          const privateKey = `0x${plaintext.toString("hex")}`;
+          account = privateKeyToAccount(privateKey);
+        } finally {
+          plaintext.fill(0);
+        }
+      }
+      if (account.address.toLowerCase() !== stored.address.toLowerCase()) {
+        throw new VaultError("corrupt", "A vault key does not match its stored address.");
+      }
+      return account;
+    } catch (error61) {
+      throw asVaultError(error61, "corrupt", "Unable to open the vault account signer.");
+    }
+  }
+  async phrase() {
+    const latest = await readVaultFile(this.path, this.key);
+    this.file = latest;
+    const plaintext = decryptField(this.key, latest.phrase);
+    try {
+      try {
+        return validateRecoveryPhrase(plaintext.toString("utf8"));
+      } catch (error61) {
+        throw new VaultError("corrupt", "The vault recovery phrase is not valid.", {
+          cause: error61
+        });
+      }
+    } finally {
+      plaintext.fill(0);
+    }
+  }
+  async save() {
+    try {
+      await this.update(async () => void 0);
+    } catch (error61) {
+      throw asVaultError(error61, "corrupt", "Unable to save the vault.");
+    }
+  }
+  resealSecrets(file2) {
+    const phrase = decryptField(this.key, file2.phrase);
+    try {
+      const accounts = file2.accounts.map((account) => {
+        if (account.kind === "derived") return { ...account };
+        const privateKey = decryptField(this.key, account.key);
+        try {
+          if (privateKey.byteLength !== 32) {
+            throw new VaultError("corrupt", "An imported vault key has the wrong length.");
+          }
+          return { ...account, key: sealField(this.key, privateKey) };
+        } finally {
+          privateKey.fill(0);
+        }
+      });
+      return {
+        ...file2,
+        phrase: sealField(this.key, phrase),
+        accounts
+      };
+    } finally {
+      phrase.fill(0);
+    }
+  }
+  async update(operation) {
+    return await withVaultLock(this.path, async () => {
+      const latest = await readVaultFile(this.path, this.key);
+      const result = await operation(latest);
+      const rewritten = this.resealSecrets(latest);
+      await writeVaultFile(this.path, rewritten);
+      this.file = rewritten;
+      return result;
+    });
+  }
+};
+async function openVault(args) {
+  assertVaultKey(args.key);
+  return new DeviceVault(args, await readVaultFile(args.path, args.key));
+}
+async function exportVaultPhrase(args) {
+  return await (await openVault(args)).phrase();
+}
+async function exportVaultAccountKey(args) {
+  assertVaultKey(args.key);
+  try {
+    const file2 = await readVaultFile(args.path, args.key);
+    const account = file2.accounts.find((candidate) => candidate.name === args.name);
+    if (!account) {
+      throw new VaultError("not_found", "No vault account has that name.");
+    }
+    let privateKey;
+    if (account.kind === "derived") {
+      const plaintext = decryptField(args.key, file2.phrase);
+      let seed;
+      try {
+        seed = phraseToSeed(plaintext.toString("utf8"));
+        privateKey = deriveEvmPrivateKey(seed, `m/44'/60'/0'/0/${account.index}`);
+      } finally {
+        seed?.fill(0);
+        plaintext.fill(0);
+      }
+    } else {
+      const plaintext = decryptField(args.key, account.key);
+      try {
+        if (plaintext.byteLength !== 32) {
+          throw new VaultError("corrupt", "An imported vault key has the wrong length.");
+        }
+        privateKey = `0x${plaintext.toString("hex")}`;
+      } finally {
+        plaintext.fill(0);
+      }
+    }
+    if (privateKeyToAccount(privateKey).address.toLowerCase() !== account.address.toLowerCase()) {
+      throw new VaultError("corrupt", "A vault key does not match its stored address.");
+    }
+    return privateKey;
+  } catch (error61) {
+    throw asVaultError(error61, "corrupt", "Unable to export the vault account key.");
+  }
+}
+function assertVaultKey(key) {
+  if (key.byteLength !== 32) {
+    throw new VaultError("bad_key", "A device vault key must contain exactly 32 bytes.");
+  }
+}
+function assertAccountName(name) {
+  const parsed = walletNameSchema.safeParse(name);
+  if (!parsed.success) {
+    throw new VaultError("name_taken", "The vault account name is not valid.", {
+      cause: parsed.error
+    });
+  }
+}
+function assertAvailableName(file2, name) {
+  assertAccountName(name);
+  if (file2.accounts.some((account) => account.name === name)) {
+    throw new VaultError("name_taken", "A vault account already has that name.");
+  }
+}
+function nextDerivedIndex(file2) {
+  let next = file2.nextDerivedIndex ?? 0;
+  for (const account of file2.accounts) {
+    if (account.kind === "derived") next = Math.max(next, account.index + 1);
+  }
+  return next;
+}
+function copyAccount(account) {
+  if (account.kind === "derived") return { ...account };
+  return {
+    name: account.name,
+    kind: account.kind,
+    address: account.address,
+    createdAt: account.createdAt
+  };
+}
+function sealField(key, plaintext) {
+  const { nonce, ciphertext, tag } = encryptWithKey(key, plaintext);
+  return [nonce, ciphertext, tag].map((part) => part.toString("base64url")).join(".");
+}
+function openField(key, value) {
+  const [nonce = "", ciphertext = "", tag = ""] = value.split(".");
+  return decryptWithKey(key, {
+    nonce: Buffer.from(nonce, "base64url"),
+    ciphertext: Buffer.from(ciphertext, "base64url"),
+    tag: Buffer.from(tag, "base64url")
+  });
+}
+function decryptField(key, value) {
+  try {
+    return openField(key, value);
+  } catch (error61) {
+    throw new VaultError("bad_key", "Unable to decrypt the vault with this device key.", {
+      cause: error61
+    });
+  }
+}
+function decryptPhraseForOpen(key, phrase) {
+  try {
+    return openField(key, phrase);
+  } catch (error61) {
+    throw new VaultError("bad_key", "Unable to decrypt the vault with this device key.", {
+      cause: error61
+    });
+  }
+}
+function parseVaultFile(raw) {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch (error61) {
+    throw new VaultError("corrupt", "The vault file is not valid JSON.", { cause: error61 });
+  }
+  const parsed = vaultFileSchema.safeParse(value);
+  if (!parsed.success) {
+    throw new VaultError("corrupt", "The vault file has an invalid structure.", {
+      cause: parsed.error
+    });
+  }
+  if (parsed.data.protected !== (parsed.data.wrappedKey !== void 0)) {
+    throw new VaultError("corrupt", "The vault protection metadata is inconsistent.");
+  }
+  const names = /* @__PURE__ */ new Set();
+  const indexes = /* @__PURE__ */ new Set();
+  for (const account of parsed.data.accounts) {
+    if (names.has(account.name)) {
+      throw new VaultError("corrupt", "The vault file contains duplicate account names.");
+    }
+    names.add(account.name);
+    if (account.kind === "derived") {
+      if (indexes.has(account.index)) {
+        throw new VaultError("corrupt", "The vault file contains duplicate derived indexes.");
+      }
+      indexes.add(account.index);
+    }
+  }
+  return parsed.data;
+}
+async function readVaultFile(path, key) {
+  const file2 = await readVaultFileUnlocked(path);
+  const plaintext = decryptPhraseForOpen(key, file2.phrase);
+  try {
+    try {
+      validateRecoveryPhrase(plaintext.toString("utf8"));
+    } catch (error61) {
+      throw new VaultError("corrupt", "The vault recovery phrase is not valid.", {
+        cause: error61
+      });
+    }
+  } finally {
+    plaintext.fill(0);
+  }
+  return file2;
+}
+async function readVaultFileUnlocked(path) {
+  let raw;
+  try {
+    raw = await readFile3(path, "utf8");
+  } catch (error61) {
+    if (isMissingFile2(error61)) {
+      throw new VaultError("not_found", "No vault file was found at the requested path.", {
+        cause: error61
+      });
+    }
+    throw new VaultError("corrupt", "Unable to read the vault file.", { cause: error61 });
+  }
+  return parseVaultFile(raw);
+}
+async function writeVaultFile(path, file2) {
+  await mkdir3(dirname3(path), { recursive: true, mode: 448 });
+  const temporaryPath = `${path}.${process.pid}.${randomBytes3(6).toString("hex")}.tmp`;
+  try {
+    await writeFile3(temporaryPath, `${JSON.stringify(file2, null, 2)}
+`, {
+      encoding: "utf8",
+      mode: 384,
+      flag: "wx"
+    });
+    await rename3(temporaryPath, path);
+  } catch (error61) {
+    await rm(temporaryPath, { force: true }).catch(() => void 0);
+    throw error61;
+  }
+}
+async function withVaultLock(path, operation) {
+  await mkdir3(dirname3(path), { recursive: true, mode: 448 });
+  const lockPath = `${path}.lock`;
+  const deadline = Date.now() + VAULT_LOCK_TIMEOUT_MS;
+  let handle;
+  while (!handle) {
+    try {
+      handle = await open2(lockPath, "wx", 384);
+    } catch (error61) {
+      if (!isExistingFile(error61)) throw error61;
+      await removeStaleVaultLock(lockPath);
+      if (Date.now() >= deadline) {
+        throw new VaultError("corrupt", "Timed out waiting for the vault lock.");
+      }
+      await new Promise((resolve) => setTimeout(resolve, 20));
+    }
+  }
+  try {
+    return await operation();
+  } finally {
+    await handle.close();
+    await unlink(lockPath).catch(() => void 0);
+  }
+}
+async function removeStaleVaultLock(path) {
+  try {
+    const metadata = await stat3(path);
+    if (Date.now() - metadata.mtimeMs > STALE_VAULT_LOCK_MS) await unlink(path);
+  } catch (error61) {
+    if (!isMissingFile2(error61)) throw error61;
+  }
+}
+function isMissingFile2(error61) {
+  return typeof error61 === "object" && error61 !== null && "code" in error61 && Reflect.get(error61, "code") === "ENOENT";
+}
+function isExistingFile(error61) {
+  return typeof error61 === "object" && error61 !== null && "code" in error61 && Reflect.get(error61, "code") === "EEXIST";
+}
+function asVaultError(error61, code, message) {
+  return error61 instanceof VaultError ? error61 : new VaultError(code, message, { cause: error61 });
+}
 export {
   createKeystoreWithPhrase,
   decryptPrivateKey,
   exportKeystoreKeys,
-  exportRecoveryPhrase
+  exportRecoveryPhrase,
+  exportVaultAccountKey,
+  exportVaultPhrase
 };
 //# sourceMappingURL=secrets.js.map