@zcloak/ai-agent 1.0.0

package/dist/idl.js

@@ -0,0 +1,213 @@
+"use strict";
+/**
+ * zCloak.ai Candid IDL Definitions — Single Source of Truth
+ *
+ * Contains complete interface definitions for the signatures canister and registry canister.
+ * TypeScript type interfaces in types/sign-event.ts and types/registry.ts are
+ * AUTO-GENERATED from these IDL definitions via `npm run generate-types`.
+ *
+ * When the canister API changes:
+ *   1. Update the IDL definitions in this file
+ *   2. Run `npm run generate-types` to regenerate TS types
+ *   3. Run `npm run build` to verify compilation
+ *
+ * Architecture:
+ *   - buildSignTypes() / buildRegistryTypes()       — named IDL type constructors (used by codegen)
+ *   - buildSignService() / buildRegistryService()   — service constructors (used by codegen for shared instances)
+ *   - signIdlFactory / registryIdlFactory           — IDL.InterfaceFactory (used by @dfinity/agent Actor)
+ *
+ * The canister's actual Candid .did schema is the upstream source; this file is derived from
+ * skill.md documentation and verified against actual canister responses.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registryIdlFactory = exports.signIdlFactory = void 0;
+exports.buildSignTypes = buildSignTypes;
+exports.buildSignService = buildSignService;
+exports.buildRegistryTypes = buildRegistryTypes;
+exports.buildRegistryService = buildRegistryService;
+const candid_1 = require("@dfinity/candid");
+// ========== Signatures Canister ==========
+/**
+ * Build named IDL types for the signatures canister.
+ * Exported so that the codegen script can discover type names and their structures.
+ *
+ * @param I - The IDL module (passed through to allow use in both factory and codegen contexts)
+ */
+function buildSignTypes(I) {
+    /** SignEvent record — sign event returned by canister */
+    const SignEvent = I.Record({
+        counter: I.Opt(I.Nat32), // Global auto-increment counter
+        id: I.Text, // Event unique ID (sha256 hash)
+        kind: I.Nat32, // Event type (1-15)
+        ai_id: I.Text, // Signer principal ID
+        created_at: I.Nat64, // Creation timestamp (nanoseconds)
+        tags: I.Opt(I.Vec(I.Vec(I.Text))), // Tags array
+        content: I.Opt(I.Text), // Content (optional)
+        content_hash: I.Text, // Content SHA256 hash
+    });
+    /** SignParm variant — 15 signing parameter types */
+    const SignParm = I.Variant({
+        Kind1IdentityProfile: I.Record({ content: I.Text }),
+        Kind2IdentityVerification: I.Record({ content: I.Text, tags: I.Opt(I.Vec(I.Vec(I.Text))) }),
+        Kind3SimpleAgreement: I.Record({ content: I.Text, tags: I.Opt(I.Vec(I.Vec(I.Text))) }),
+        Kind4PublicPost: I.Record({ content: I.Text, tags: I.Opt(I.Vec(I.Vec(I.Text))) }),
+        // Kind5 uses VetKey IBE encryption: encrypted_content (bytes) + ibe_identity
+        Kind5PrivatePost: I.Record({
+            encrypted_content: I.Vec(I.Nat8),
+            ibe_identity: I.Text,
+            tags: I.Opt(I.Vec(I.Vec(I.Text))),
+        }),
+        Kind6Interaction: I.Record({ content: I.Text, tags: I.Opt(I.Vec(I.Vec(I.Text))) }),
+        Kind7ContactList: I.Record({ tags: I.Opt(I.Vec(I.Vec(I.Text))) }),
+        Kind8MediaAsset: I.Record({ content: I.Text, tags: I.Opt(I.Vec(I.Vec(I.Text))) }),
+        Kind9ServiceListing: I.Record({ content: I.Text, tags: I.Opt(I.Vec(I.Vec(I.Text))) }),
+        Kind10JobRequest: I.Record({ content: I.Text, tags: I.Opt(I.Vec(I.Vec(I.Text))) }),
+        Kind11DocumentSignature: I.Record({ content: I.Text, tags: I.Opt(I.Vec(I.Vec(I.Text))) }),
+        Kind12PublicContract: I.Record({ content: I.Text, tags: I.Opt(I.Vec(I.Vec(I.Text))) }),
+        Kind13PrivateContract: I.Record({ content: I.Text, tags: I.Opt(I.Vec(I.Vec(I.Text))) }),
+        Kind14Review: I.Record({ content: I.Text, tags: I.Opt(I.Vec(I.Vec(I.Text))) }),
+        Kind15GeneralAttestation: I.Record({ content: I.Text, tags: I.Opt(I.Vec(I.Vec(I.Text))) }),
+    });
+    /** DecryptionPackage record — returned by get_kind5_decryption_key */
+    const DecryptionPackage = I.Record({
+        encrypted_key: I.Vec(I.Nat8), // Transport-encrypted VetKey (192 bytes)
+        ciphertext: I.Vec(I.Nat8), // IBE ciphertext
+        ibe_identity: I.Text, // IBE identity string
+    });
+    return { SignEvent, SignParm, DecryptionPackage };
+}
+/**
+ * Build the signatures canister service, reusing pre-built named types.
+ * Exported for codegen to share type instances with the name registry.
+ *
+ * @param I     - The IDL module
+ * @param types - Named types from buildSignTypes() (same instances used in the registry)
+ */
+function buildSignService(I, types) {
+    const { SignEvent, SignParm, DecryptionPackage } = types;
+    return I.Service({
+        // ===== Signing operations (update call, requires identity) =====
+        // agent_sign: Signing with PoW (2 params: SignParm + nonce text)
+        agent_sign: I.Func([SignParm, I.Text], [I.Variant({ Ok: SignEvent, Err: I.Text })], []),
+        // sign: Direct signing (no PoW, requires canister permission)
+        sign: I.Func([SignParm], [SignEvent], []),
+        // mcp_sign: MCP proxy signing
+        mcp_sign: I.Func([I.Principal, SignParm], [SignEvent], []),
+        // ===== VetKey operations (update call, requires identity) =====
+        // Get IBE derived public key (96 bytes, compressed G2 point)
+        get_ibe_public_key: I.Func([], [I.Vec(I.Nat8)], []),
+        // Get Kind5 decryption package (encrypted VetKey + ciphertext + identity)
+        get_kind5_decryption_key: I.Func([I.Text, I.Vec(I.Nat8)], [DecryptionPackage], []),
+        // Derive VetKey for daemon mode AES-256 key derivation
+        derive_vetkey: I.Func([I.Text, I.Vec(I.Nat8)], [I.Vec(I.Nat8)], []),
+        // ===== Query operations (query, can be anonymous) =====
+        // Get global counter
+        get_counter: I.Func([], [I.Nat32], ['query']),
+        // Fetch events by counter range
+        fetch_events_by_counter: I.Func([I.Nat32, I.Nat32], [I.Vec(SignEvent)], ['query']),
+        // Get all sign events
+        get_all_sign_events: I.Func([], [I.Vec(SignEvent)], ['query']),
+        // Get user sign history (paginated)
+        fetch_user_sign: I.Func([I.Principal, I.Nat32, I.Nat32], [I.Nat32, I.Vec(SignEvent)], ['query']),
+        // Get user's latest sign event ID (PoW base)
+        get_user_latest_sign_event_id: I.Func([I.Principal], [I.Text], ['query']),
+        // Verify signature by message content
+        verify_message: I.Func([I.Text], [I.Vec(SignEvent)], ['query']),
+        // Verify signature by message hash
+        verify_msg_hash: I.Func([I.Text], [I.Vec(SignEvent)], ['query']),
+        // Verify signature by file hash
+        verify_file_hash: I.Func([I.Text], [I.Vec(SignEvent)], ['query']),
+        // Get sign event by ID
+        get_sign_event_by_id: I.Func([I.Text], [I.Opt(SignEvent)], ['query']),
+        // Get Kind 1 identity profile
+        get_kind1_event_by_principal: I.Func([I.Text], [I.Opt(SignEvent)], ['query']),
+        // Connection test
+        greet: I.Func([I.Text], [I.Text], ['query']),
+    });
+}
+/**
+ * Signatures canister IDL factory (standard @dfinity/agent interface)
+ * Canister ID: zpbbm-piaaa-aaaaj-a3dsq-cai
+ */
+const signIdlFactory = () => {
+    return buildSignService(candid_1.IDL, buildSignTypes(candid_1.IDL));
+};
+exports.signIdlFactory = signIdlFactory;
+// ========== Registry Canister ==========
+/**
+ * Build named IDL types for the registry canister.
+ * Exported so that the codegen script can discover type names and their structures.
+ *
+ * @param I - The IDL module
+ */
+function buildRegistryTypes(I) {
+    /** Position record — position information in the registry */
+    const Position = I.Record({
+        is_human: I.Bool,
+        connection_list: I.Vec(I.Principal),
+    });
+    /** AI profile record */
+    const AiProfile = I.Record({
+        position: I.Opt(Position),
+    });
+    /** User profile record */
+    const UserProfile = I.Record({
+        username: I.Text,
+        ai_profile: I.Opt(AiProfile),
+        principal_id: I.Opt(I.Text),
+        passkey_name: I.Vec(I.Text), // Passkey names registered by the user
+    });
+    /** Registration success result record */
+    const RegisterResult = I.Record({
+        username: I.Text,
+    });
+    /** 2FA verification record — tracks a pending or completed 2FA request */
+    const TwoFARecord = I.Record({
+        caller: I.Text, // Agent principal that initiated the 2FA request
+        owner_list: I.Vec(I.Text), // List of owner principals authorized to confirm
+        confirm_owner: I.Opt(I.Text), // Owner principal that confirmed (null if pending)
+        content: I.Text, // JSON content describing the operation
+        request_timestamp: I.Nat64, // When the 2FA request was created
+        confirm_timestamp: I.Opt(I.Nat64), // When the 2FA was confirmed (null if pending)
+    });
+    return { Position, AiProfile, UserProfile, RegisterResult, TwoFARecord };
+}
+/**
+ * Build the registry canister service, reusing pre-built named types.
+ * Exported for codegen to share type instances with the name registry.
+ *
+ * @param I     - The IDL module
+ * @param types - Named types from buildRegistryTypes() (same instances used in the registry)
+ */
+function buildRegistryService(I, types) {
+    const { UserProfile, RegisterResult, TwoFARecord } = types;
+    return I.Service({
+        // ===== Query operations (query) =====
+        // Get username by principal
+        get_username_by_principal: I.Func([I.Text], [I.Opt(I.Text)], ['query']),
+        // Get principal by username
+        get_user_principal: I.Func([I.Text], [I.Opt(I.Principal)], ['query']),
+        // Get UserProfile by username
+        user_profile_get: I.Func([I.Text], [I.Opt(UserProfile)], ['query']),
+        // Get UserProfile by principal
+        user_profile_get_by_principal: I.Func([I.Text], [I.Opt(UserProfile)], ['query']),
+        // ===== Update operations (update call, requires identity) =====
+        // Register new agent name
+        register_agent: I.Func([I.Text], [I.Variant({ Ok: RegisterResult, Err: I.Text })], []),
+        // Prepare agent-owner binding (WebAuthn challenge)
+        agent_prepare_bond: I.Func([I.Text], [I.Variant({ Ok: I.Text, Err: I.Text })], []),
+        // Prepare 2FA verification request (returns WebAuthn challenge JSON)
+        prepare_2fa_info: I.Func([I.Text], [I.Variant({ Ok: I.Text, Err: I.Text })], []),
+        // Query 2FA verification result by challenge string
+        query_2fa_result_by_challenge: I.Func([I.Text], [I.Opt(TwoFARecord)], ['query']),
+    });
+}
+/**
+ * Registry canister IDL factory (standard @dfinity/agent interface)
+ * Canister ID: 3spie-caaaa-aaaam-ae3sa-cai
+ */
+const registryIdlFactory = () => {
+    return buildRegistryService(candid_1.IDL, buildRegistryTypes(candid_1.IDL));
+};
+exports.registryIdlFactory = registryIdlFactory;
+//# sourceMappingURL=idl.js.map

package/dist/idl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idl.js","sourceRoot":"","sources":["../src/idl.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;AAYH,wCA6CC;AASD,4CAgGC;AAkBD,gDAoCC;AASD,oDAmEC;AAlSD,4CAAsC;AAEtC,4CAA4C;AAE5C;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,CAAa;IAC1C,yDAAyD;IACzD,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;QACzB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAW,gCAAgC;QAClE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAyB,gCAAgC;QACnE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAsB,oBAAoB;QACvD,KAAK,EAAE,CAAC,CAAC,IAAI,EAAsB,sBAAsB;QACzD,UAAU,EAAE,CAAC,CAAC,KAAK,EAAgB,mCAAmC;QACtE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa;QAChD,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAa,qBAAqB;QACxD,YAAY,EAAE,CAAC,CAAC,IAAI,EAAe,sBAAsB;KAC1D,CAAC,CAAC;IAEH,oDAAoD;IACpD,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC;QACzB,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,yBAAyB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,6EAA6E;QAC7E,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;YACzB,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAChC,YAAY,EAAE,CAAC,CAAC,IAAI;YACpB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;SAClC,CAAC;QACF,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3F,CAAC,CAAC;IAEH,sEAAsE;IACtE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;QACjC,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAK,yCAAyC;QAC1E,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAQ,iBAAiB;QAClD,YAAY,EAAE,CAAC,CAAC,IAAI,EAAa,sBAAsB;KACxD,CAAC,CAAC;IAEH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAC9B,CAAa,EACb,KAAwC;IAExC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC;IAEzD,OAAO,CAAC,CAAC,OAAO,CAAC;QACf,kEAAkE;QAElE,iEAAiE;QACjE,UAAU,EAAE,CAAC,CAAC,IAAI,CAChB,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,EAClB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAC3C,EAAE,CACH;QAED,8DAA8D;QAC9D,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAEzC,8BAA8B;QAC9B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAE1D,iEAAiE;QAEjE,6DAA6D;QAC7D,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;QAEnD,0EAA0E;QAC1E,wBAAwB,EAAE,CAAC,CAAC,IAAI,CAC9B,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EACvB,CAAC,iBAAiB,CAAC,EACnB,EAAE,CACH;QAED,uDAAuD;QACvD,aAAa,EAAE,CAAC,CAAC,IAAI,CACnB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EACvB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EACf,EAAE,CACH;QAED,yDAAyD;QAEzD,qBAAqB;QACrB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAE7C,gCAAgC;QAChC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAC7B,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,EAClB,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAClB,CAAC,OAAO,CAAC,CACV;QAED,sBAAsB;QACtB,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAE9D,oCAAoC;QACpC,eAAe,EAAE,CAAC,CAAC,IAAI,CACrB,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,EAC/B,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAC3B,CAAC,OAAO,CAAC,CACV;QAED,6CAA6C;QAC7C,6BAA6B,EAAE,CAAC,CAAC,IAAI,CACnC,CAAC,CAAC,CAAC,SAAS,CAAC,EACb,CAAC,CAAC,CAAC,IAAI,CAAC,EACR,CAAC,OAAO,CAAC,CACV;QAED,sCAAsC;QACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAE/D,mCAAmC;QACnC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAEhE,gCAAgC;QAChC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAEjE,uBAAuB;QACvB,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAC1B,CAAC,CAAC,CAAC,IAAI,CAAC,EACR,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAClB,CAAC,OAAO,CAAC,CACV;QAED,8BAA8B;QAC9B,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAClC,CAAC,CAAC,CAAC,IAAI,CAAC,EACR,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAClB,CAAC,OAAO,CAAC,CACV;QAED,kBAAkB;QAClB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;KAC7C,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,MAAM,cAAc,GAAyB,GAAG,EAAE;IACvD,OAAO,gBAAgB,CAAC,YAAG,EAAE,cAAc,CAAC,YAAG,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC;AAFW,QAAA,cAAc,kBAEzB;AAEF,0CAA0C;AAE1C;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,CAAa;IAC9C,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;QACxB,QAAQ,EAAE,CAAC,CAAC,IAAI;QAChB,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;KACpC,CAAC,CAAC;IAEH,wBAAwB;IACxB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;KAC1B,CAAC,CAAC;IAEH,0BAA0B;IAC1B,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,IAAI;QAChB,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;QAC5B,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3B,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAG,uCAAuC;KACtE,CAAC,CAAC;IAEH,yCAAyC;IACzC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,IAAI;KACjB,CAAC,CAAC;IAEH,0EAA0E;IAC1E,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,MAAM,EAAE,CAAC,CAAC,IAAI,EAAwB,iDAAiD;QACvF,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAa,iDAAiD;QACvF,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAU,mDAAmD;QACzF,OAAO,EAAE,CAAC,CAAC,IAAI,EAAuB,wCAAwC;QAC9E,iBAAiB,EAAE,CAAC,CAAC,KAAK,EAAY,mCAAmC;QACzE,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAK,+CAA+C;KACtF,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAClC,CAAa,EACb,KAA4C;IAE5C,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAE3D,OAAO,CAAC,CAAC,OAAO,CAAC;QACf,uCAAuC;QAEvC,4BAA4B;QAC5B,yBAAyB,EAAE,CAAC,CAAC,IAAI,CAC/B,CAAC,CAAC,CAAC,IAAI,CAAC,EACR,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EACf,CAAC,OAAO,CAAC,CACV;QAED,4BAA4B;QAC5B,kBAAkB,EAAE,CAAC,CAAC,IAAI,CACxB,CAAC,CAAC,CAAC,IAAI,CAAC,EACR,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EACpB,CAAC,OAAO,CAAC,CACV;QAED,8BAA8B;QAC9B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CACtB,CAAC,CAAC,CAAC,IAAI,CAAC,EACR,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EACpB,CAAC,OAAO,CAAC,CACV;QAED,+BAA+B;QAC/B,6BAA6B,EAAE,CAAC,CAAC,IAAI,CACnC,CAAC,CAAC,CAAC,IAAI,CAAC,EACR,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EACpB,CAAC,OAAO,CAAC,CACV;QAED,iEAAiE;QAEjE,0BAA0B;QAC1B,cAAc,EAAE,CAAC,CAAC,IAAI,CACpB,CAAC,CAAC,CAAC,IAAI,CAAC,EACR,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAChD,EAAE,CACH;QAED,mDAAmD;QACnD,kBAAkB,EAAE,CAAC,CAAC,IAAI,CACxB,CAAC,CAAC,CAAC,IAAI,CAAC,EACR,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EACxC,EAAE,CACH;QAED,qEAAqE;QACrE,gBAAgB,EAAE,CAAC,CAAC,IAAI,CACtB,CAAC,CAAC,CAAC,IAAI,CAAC,EACR,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EACxC,EAAE,CACH;QAED,oDAAoD;QACpD,6BAA6B,EAAE,CAAC,CAAC,IAAI,CACnC,CAAC,CAAC,CAAC,IAAI,CAAC,EACR,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EACpB,CAAC,OAAO,CAAC,CACV;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,MAAM,kBAAkB,GAAyB,GAAG,EAAE;IAC3D,OAAO,oBAAoB,CAAC,YAAG,EAAE,kBAAkB,CAAC,YAAG,CAAC,CAAC,CAAC;AAC5D,CAAC,CAAC;AAFW,QAAA,kBAAkB,sBAE7B"}

package/dist/key-store.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Key Store — In-memory AES-256 key management for daemon mode
+ *
+ * Responsible for securely holding the AES-256 key during daemon runtime.
+ * The key is derived from a VetKey obtained from the trust canister at startup.
+ *
+ * Key derivation flow:
+ *   1. Generate ephemeral transport key pair
+ *   2. Call actor.derive_vetkey(derivationId, transportPublicKey)
+ *   3. Decrypt EncryptedVetKey with transport secret → VetKey (G1 point, 48B)
+ *   4. HKDF(vetkey_bytes, "vetkey-aes256-file-encryption") → AES-256 key (32B)
+ *
+ * Memory safety note:
+ *   JavaScript does not have Rust's ZeroizeOnDrop equivalent. We use
+ *   Buffer.fill(0) to manually clear the key when destroy() is called.
+ *   This is best-effort — the GC may have created copies we can't reach.
+ *   For production use, the key exists only in a single Buffer that we
+ *   can explicitly zero.
+ */
+import type { ActorSubclass } from '@dfinity/agent';
+/**
+ * In-memory AES-256 key holder for daemon mode.
+ *
+ * The AES key is derived from VetKey at startup and held in a Buffer.
+ * Call destroy() when done to zero the key bytes.
+ */
+export declare class KeyStore {
+    /** AES-256 key (32 bytes), derived from VetKey via HKDF */
+    private aesKey;
+    /** Derivation ID used for this key (format: "{principal}:{key_name}") */
+    private _derivationId;
+    /** Whether the key has been destroyed */
+    private destroyed;
+    private constructor();
+    /**
+     * Derive a VetKey from the canister via the sign actor and create a KeyStore.
+     *
+     * Complete flow:
+     *   1. Fetch IBE public key from canister (needed for BLS signature verification)
+     *   2. Generate random transport key pair
+     *   3. Call actor.derive_vetkey(derivationId, transportPublicKey)
+     *   4. Transport-decrypt EncryptedVetKey → VetKey (48 bytes)
+     *   5. HKDF(vetkey_bytes, domain_sep) → AES-256 key (32 bytes)
+     *
+     * Uses the same sign actor (signIdlFactory) from the existing Session pattern,
+     * which now includes VetKey methods on the same canister.
+     *
+     * @param actor - Signatures canister actor (with VetKey methods)
+     * @param derivationId - Derivation ID (format: "{principal}:{key_name}")
+     * @returns Initialized KeyStore
+     */
+    static deriveFromActor(actor: ActorSubclass<any>, derivationId: string): Promise<KeyStore>;
+    /**
+     * Create a KeyStore with a known test key (for unit/integration testing only).
+     *
+     * @internal
+     */
+    static createForTest(derivationId: string, key?: Buffer): KeyStore;
+    /**
+     * Encrypt plaintext using the held AES-256 key.
+     *
+     * Output format: [magic:4B "VKDA"][version:1B][nonce:12B][ciphertext+GCM_tag]
+     *
+     * @param plaintext - Data to encrypt
+     * @returns VKDA-formatted ciphertext
+     */
+    encrypt(plaintext: Uint8Array): Buffer;
+    /**
+     * Decrypt VKDA-formatted ciphertext using the held AES-256 key.
+     *
+     * @param ciphertext - VKDA-formatted ciphertext
+     * @returns Decrypted plaintext
+     */
+    decrypt(ciphertext: Uint8Array): Buffer;
+    /** Get the derivation ID (for status reporting, not sensitive) */
+    get derivationId(): string;
+    /**
+     * Destroy the key store by zeroing the AES key bytes.
+     *
+     * After calling destroy(), encrypt() and decrypt() will throw.
+     * This is best-effort memory cleanup — JavaScript GC may have
+     * created copies we cannot reach.
+     */
+    destroy(): void;
+    /** Throw if the KeyStore has been destroyed */
+    private checkNotDestroyed;
+}
+//# sourceMappingURL=key-store.d.ts.map

package/dist/key-store.js

@@ -0,0 +1,171 @@
+"use strict";
+/**
+ * Key Store — In-memory AES-256 key management for daemon mode
+ *
+ * Responsible for securely holding the AES-256 key during daemon runtime.
+ * The key is derived from a VetKey obtained from the trust canister at startup.
+ *
+ * Key derivation flow:
+ *   1. Generate ephemeral transport key pair
+ *   2. Call actor.derive_vetkey(derivationId, transportPublicKey)
+ *   3. Decrypt EncryptedVetKey with transport secret → VetKey (G1 point, 48B)
+ *   4. HKDF(vetkey_bytes, "vetkey-aes256-file-encryption") → AES-256 key (32B)
+ *
+ * Memory safety note:
+ *   JavaScript does not have Rust's ZeroizeOnDrop equivalent. We use
+ *   Buffer.fill(0) to manually clear the key when destroy() is called.
+ *   This is best-effort — the GC may have created copies we can't reach.
+ *   For production use, the key exists only in a single Buffer that we
+ *   can explicitly zero.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyStore = void 0;
+const cryptoOps = __importStar(require("./crypto"));
+const error_1 = require("./error");
+/**
+ * In-memory AES-256 key holder for daemon mode.
+ *
+ * The AES key is derived from VetKey at startup and held in a Buffer.
+ * Call destroy() when done to zero the key bytes.
+ */
+class KeyStore {
+    constructor(aesKey, derivationId) {
+        /** Whether the key has been destroyed */
+        this.destroyed = false;
+        this.aesKey = aesKey;
+        this._derivationId = derivationId;
+    }
+    /**
+     * Derive a VetKey from the canister via the sign actor and create a KeyStore.
+     *
+     * Complete flow:
+     *   1. Fetch IBE public key from canister (needed for BLS signature verification)
+     *   2. Generate random transport key pair
+     *   3. Call actor.derive_vetkey(derivationId, transportPublicKey)
+     *   4. Transport-decrypt EncryptedVetKey → VetKey (48 bytes)
+     *   5. HKDF(vetkey_bytes, domain_sep) → AES-256 key (32 bytes)
+     *
+     * Uses the same sign actor (signIdlFactory) from the existing Session pattern,
+     * which now includes VetKey methods on the same canister.
+     *
+     * @param actor - Signatures canister actor (with VetKey methods)
+     * @param derivationId - Derivation ID (format: "{principal}:{key_name}")
+     * @returns Initialized KeyStore
+     */
+    static async deriveFromActor(actor, derivationId) {
+        // Step 1: Get IBE public key (needed for EncryptedVetKey BLS signature verification)
+        let dpkBytes;
+        try {
+            const result = await actor.get_ibe_public_key();
+            dpkBytes = new Uint8Array(result);
+        }
+        catch (e) {
+            throw (0, error_1.canisterCallError)(`get_ibe_public_key failed: ${e instanceof Error ? e.message : String(e)}`, e);
+        }
+        // Step 2: Generate ephemeral transport key pair
+        const [transportSecret, transportPublic] = cryptoOps.generateTransportKeypair();
+        // Step 3: Call canister to derive encrypted VetKey
+        let encryptedVetkeyBytes;
+        try {
+            const result = await actor.derive_vetkey(derivationId, Array.from(transportPublic));
+            encryptedVetkeyBytes = new Uint8Array(result);
+        }
+        catch (e) {
+            throw (0, error_1.canisterCallError)(`derive_vetkey failed: ${e instanceof Error ? e.message : String(e)}`, e);
+        }
+        // Step 4: Transport-decrypt and verify the VetKey
+        const vetkeyBytes = cryptoOps.decryptVetkey(encryptedVetkeyBytes, dpkBytes, derivationId, transportSecret);
+        // Step 5: HKDF derive AES-256 key from VetKey bytes
+        const aesKey = cryptoOps.vetkeyToAes256(vetkeyBytes);
+        return new KeyStore(aesKey, derivationId);
+    }
+    /**
+     * Create a KeyStore with a known test key (for unit/integration testing only).
+     *
+     * @internal
+     */
+    static createForTest(derivationId, key) {
+        const aesKey = key ?? Buffer.alloc(32, 0x42); // Fixed test key
+        return new KeyStore(aesKey, derivationId);
+    }
+    /**
+     * Encrypt plaintext using the held AES-256 key.
+     *
+     * Output format: [magic:4B "VKDA"][version:1B][nonce:12B][ciphertext+GCM_tag]
+     *
+     * @param plaintext - Data to encrypt
+     * @returns VKDA-formatted ciphertext
+     */
+    encrypt(plaintext) {
+        this.checkNotDestroyed();
+        return cryptoOps.aes256Encrypt(this.aesKey, plaintext);
+    }
+    /**
+     * Decrypt VKDA-formatted ciphertext using the held AES-256 key.
+     *
+     * @param ciphertext - VKDA-formatted ciphertext
+     * @returns Decrypted plaintext
+     */
+    decrypt(ciphertext) {
+        this.checkNotDestroyed();
+        return cryptoOps.aes256Decrypt(this.aesKey, ciphertext);
+    }
+    /** Get the derivation ID (for status reporting, not sensitive) */
+    get derivationId() {
+        return this._derivationId;
+    }
+    /**
+     * Destroy the key store by zeroing the AES key bytes.
+     *
+     * After calling destroy(), encrypt() and decrypt() will throw.
+     * This is best-effort memory cleanup — JavaScript GC may have
+     * created copies we cannot reach.
+     */
+    destroy() {
+        if (!this.destroyed) {
+            this.aesKey.fill(0);
+            this.destroyed = true;
+        }
+    }
+    /** Throw if the KeyStore has been destroyed */
+    checkNotDestroyed() {
+        if (this.destroyed) {
+            throw (0, error_1.encryptionError)("KeyStore has been destroyed (key zeroized)");
+        }
+    }
+}
+exports.KeyStore = KeyStore;
+//# sourceMappingURL=key-store.js.map

package/dist/key-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.js","sourceRoot":"","sources":["../src/key-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGH,oDAAsC;AACtC,mCAA6D;AAE7D;;;;;GAKG;AACH,MAAa,QAAQ;IAQnB,YAAoB,MAAc,EAAE,YAAoB;QAHxD,yCAAyC;QACjC,cAAS,GAAG,KAAK,CAAC;QAGxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IACpC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,KAAK,CAAC,eAAe,CAC1B,KAAyB,EACzB,YAAoB;QAEpB,qFAAqF;QACrF,IAAI,QAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,EAAgB,CAAC;YAC9D,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAA,yBAAiB,EACrB,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAC1E,CAAC,CACF,CAAC;QACJ,CAAC;QAED,gDAAgD;QAChD,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GAAG,SAAS,CAAC,wBAAwB,EAAE,CAAC;QAEhF,mDAAmD;QACnD,IAAI,oBAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,CACtC,YAAY,EACZ,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CACd,CAAC;YAChB,oBAAoB,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAA,yBAAiB,EACrB,yBAAyB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EACrE,CAAC,CACF,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,WAAW,GAAG,SAAS,CAAC,aAAa,CACzC,oBAAoB,EACpB,QAAQ,EACR,YAAY,EACZ,eAAe,CAChB,CAAC;QAEF,oDAAoD;QACpD,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QAErD,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,aAAa,CAAC,YAAoB,EAAE,GAAY;QACrD,MAAM,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,iBAAiB;QAC/D,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,SAAqB;QAC3B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,UAAsB;QAC5B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED,kEAAkE;IAClE,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IAED,+CAA+C;IACvC,iBAAiB;QACvB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAA,uBAAe,EAAC,4CAA4C,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;CACF;AAzID,4BAyIC"}

package/dist/pow.d.ts

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+/**
+ * zCloak.ai PoW Computation Tool
+ *
+ * Finds a nonce such that sha256(base + nonce) starts with a specified number of leading zeros.
+ * Can be used as a standalone script, or called internally by Session.autoPoW() via utils.ts computePow.
+ *
+ * Usage:
+ *   zcloak-ai pow <base_string> <zeros>
+ *
+ * Examples:
+ *   zcloak-ai pow 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969 5
+ */
+import { Session } from './session';
+/**
+ * Entry point when invoked via cli.ts.
+ * Receives a Session instance with pre-parsed arguments.
+ *
+ * Arguments are read from session.args._args:
+ *   _args[0] = base_string
+ *   _args[1] = zeros (default: 5)
+ */
+export declare function run(session: Session): void;
+//# sourceMappingURL=pow.d.ts.map

package/dist/pow.js

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * zCloak.ai PoW Computation Tool
+ *
+ * Finds a nonce such that sha256(base + nonce) starts with a specified number of leading zeros.
+ * Can be used as a standalone script, or called internally by Session.autoPoW() via utils.ts computePow.
+ *
+ * Usage:
+ *   zcloak-ai pow <base_string> <zeros>
+ *
+ * Examples:
+ *   zcloak-ai pow 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969 5
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run = run;
+const crypto_1 = __importDefault(require("crypto"));
+// ========== Exported run() — called by cli.ts ==========
+/**
+ * Entry point when invoked via cli.ts.
+ * Receives a Session instance with pre-parsed arguments.
+ *
+ * Arguments are read from session.args._args:
+ *   _args[0] = base_string
+ *   _args[1] = zeros (default: 5)
+ */
+function run(session) {
+    const base = session.args._args[0];
+    const zeros = parseInt(session.args._args[1] || '5', 10);
+    if (!base) {
+        console.log('zCloak.ai PoW Computation Tool');
+        console.log('');
+        console.log('Usage: zcloak-ai pow <base_string> <zeros>');
+        console.log('');
+        console.log('Arguments:');
+        console.log('  base_string  PoW base string (usually the return value of get_user_latest_sign_event_id)');
+        console.log('  zeros        Number of required leading zeros (default: 5)');
+        console.log('');
+        console.log('Examples:');
+        console.log('  zcloak-ai pow 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969 5');
+        process.exit(0);
+    }
+    if (!Number.isFinite(zeros) || zeros < 1) {
+        console.error('Error: zeros must be a positive integer');
+        process.exit(1);
+    }
+    /** PoW timeout in milliseconds (5 minutes) — same limit as utils.ts computePow */
+    const POW_TIMEOUT_MS = 5 * 60 * 1000;
+    const prefix = '0'.repeat(zeros);
+    const start = Date.now();
+    let nonce = 0;
+    for (;;) {
+        const candidate = base + nonce.toString();
+        const hash = crypto_1.default.createHash('sha256').update(candidate).digest('hex');
+        if (hash.startsWith(prefix)) {
+            const ms = Date.now() - start;
+            const hashesTried = nonce + 1;
+            const rate = hashesTried / (ms / 1000 || 1);
+            console.log('Found solution!');
+            console.log('base =', base);
+            console.log('zeros =', zeros);
+            console.log('nonce =', nonce);
+            console.log('hash  =', hash);
+            console.log('candidate =', JSON.stringify(candidate));
+            console.log('time_ms =', ms);
+            console.log('hashes_tried =', hashesTried);
+            console.log('hashes_per_second ~= ', rate.toFixed(2));
+            break;
+        }
+        nonce++;
+        // Check timeout every 10000 iterations to avoid excessive Date.now() calls
+        if (nonce % 10000 === 0) {
+            const elapsed = Date.now() - start;
+            if (elapsed > POW_TIMEOUT_MS) {
+                console.error(`PoW computation timed out after ${Math.round(elapsed / 1000)}s ` +
+                    `(${nonce} hashes tried, zeros=${zeros}). ` +
+                    `Consider reducing the zeros parameter.`);
+                process.exit(1);
+            }
+        }
+    }
+}
+//# sourceMappingURL=pow.js.map

package/dist/pow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pow.js","sourceRoot":"","sources":["../src/pow.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;GAWG;;;;;AAeH,kBAgEC;AA7ED,oDAA4B;AAG5B,0DAA0D;AAE1D;;;;;;;GAOG;AACH,SAAgB,GAAG,CAAC,OAAgB;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IAEzD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,4FAA4F,CAAC,CAAC;QAC1G,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;QAClG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,kFAAkF;IAClF,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAErC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,gBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YAC9B,MAAM,WAAW,GAAG,KAAK,GAAG,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,WAAW,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;YAE5C,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,MAAM;QACR,CAAC;QACD,KAAK,EAAE,CAAC;QAER,2EAA2E;QAC3E,IAAI,KAAK,GAAG,KAAK,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACnC,IAAI,OAAO,GAAG,cAAc,EAAE,CAAC;gBAC7B,OAAO,CAAC,KAAK,CACX,mCAAmC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI;oBACjE,IAAI,KAAK,wBAAwB,KAAK,KAAK;oBAC3C,wCAAwC,CACzC,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/register.d.ts

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+/**
+ * zCloak.ai Agent Registration Management Script
+ *
+ * Provides agent name query, registration, and owner relationship query functions.
+ * Uses @dfinity JS SDK to interact directly with ICP canister, no dfx required.
+ *
+ * Usage:
+ *   zcloak-ai register get-principal                         Get current identity's principal ID
+ *   zcloak-ai register lookup                                Query current principal's agent name
+ *   zcloak-ai register lookup-by-name <agent_name>           Look up principal by agent name
+ *   zcloak-ai register lookup-by-principal <principal>        Look up agent name by principal
+ *   zcloak-ai register register <base_name>                  Register new agent name
+ *   zcloak-ai register get-owner <principal>                  Query agent's owner (binding relationship)
+ *
+ * All commands support --identity=<pem_path> to specify identity file.
+ */
+import { Session } from './session';
+/**
+ * Entry point when invoked via cli.ts.
+ * Receives a Session instance with pre-parsed arguments.
+ */
+export declare function run(session: Session): Promise<void>;
+//# sourceMappingURL=register.d.ts.map