agentvault 1.0.1 → 1.0.5

package/dist/src/pilot/proxy-config.js

@@ -0,0 +1,96 @@
+/**
+ * Proxy Configuration for External Services
+ *
+ * Manages optional proxy settings for Anthropic, Arweave, and Bittensor
+ * so that companies can route all external traffic through internal gateways.
+ *
+ * Supports PRD-004: All external calls optional and proxy-able.
+ */
+/**
+ * Build a ProxyConfig from user-provided options.
+ */
+export function buildProxyConfig(options) {
+    return {
+        anthropicProxy: options.anthropicProxy,
+        arweaveProxy: options.arweaveProxy,
+        bittensorProxy: options.bittensorProxy,
+        binanceProxy: options.binanceProxy,
+        extraEnv: options.extraEnv,
+    };
+}
+/**
+ * Convert a ProxyConfig into environment variables.
+ *
+ * These are injected into spawned processes (dfx, CLI, etc.) so the
+ * underlying SDKs pick up the proxy settings automatically.
+ */
+export function proxyConfigToEnv(config) {
+    const env = {};
+    if (config.anthropicProxy) {
+        // Anthropic SDK respects ANTHROPIC_BASE_URL
+        env['ANTHROPIC_BASE_URL'] = config.anthropicProxy;
+        // Also set generic HTTP_PROXY for lower-level libraries
+        env['ANTHROPIC_PROXY'] = config.anthropicProxy;
+    }
+    if (config.arweaveProxy) {
+        env['ARWEAVE_GATEWAY'] = config.arweaveProxy;
+        env['AGENTVAULT_ARWEAVE_PROXY'] = config.arweaveProxy;
+    }
+    if (config.bittensorProxy) {
+        env['BITTENSOR_ENDPOINT'] = config.bittensorProxy;
+        env['AGENTVAULT_BITTENSOR_PROXY'] = config.bittensorProxy;
+    }
+    if (config.binanceProxy) {
+        // BINANCE_PROXY_URL is read by the trading module to route all Binance
+        // REST and WebSocket calls through the VPS firewall proxy.
+        env['BINANCE_PROXY_URL'] = config.binanceProxy;
+        env['AGENTVAULT_BINANCE_PROXY'] = config.binanceProxy;
+    }
+    if (config.extraEnv) {
+        Object.assign(env, config.extraEnv);
+    }
+    return env;
+}
+/**
+ * Validate proxy configuration.
+ * Returns a list of warnings.
+ */
+export function validateProxyConfig(config) {
+    const warnings = [];
+    const validateUrl = (label, url) => {
+        if (!url)
+            return;
+        try {
+            const parsed = new URL(url);
+            if (!['http:', 'https:'].includes(parsed.protocol)) {
+                warnings.push(`${label} proxy URL must use http:// or https:// (got: ${url})`);
+            }
+        }
+        catch {
+            warnings.push(`${label} proxy URL is not a valid URL: ${url}`);
+        }
+    };
+    validateUrl('Anthropic', config.anthropicProxy);
+    validateUrl('Arweave', config.arweaveProxy);
+    validateUrl('Bittensor', config.bittensorProxy);
+    validateUrl('Binance', config.binanceProxy);
+    return warnings;
+}
+/**
+ * Human-readable summary of the proxy configuration.
+ */
+export function describeProxyConfig(config) {
+    const lines = [];
+    if (config.anthropicProxy)
+        lines.push(`Anthropic → ${config.anthropicProxy}`);
+    if (config.arweaveProxy)
+        lines.push(`Arweave   → ${config.arweaveProxy}`);
+    if (config.bittensorProxy)
+        lines.push(`Bittensor → ${config.bittensorProxy}`);
+    if (config.binanceProxy)
+        lines.push(`Binance   → ${config.binanceProxy}`);
+    if (lines.length === 0)
+        lines.push('None (using default endpoints)');
+    return lines;
+}
+//# sourceMappingURL=proxy-config.js.map

package/dist/src/pilot/proxy-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-config.js","sourceRoot":"","sources":["../../../src/pilot/proxy-config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAMhC;IACC,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAmB;IAClD,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,4CAA4C;QAC5C,GAAG,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC;QAClD,wDAAwD;QACxD,GAAG,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC;IACjD,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,GAAG,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;QAC7C,GAAG,CAAC,0BAA0B,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;IACxD,CAAC;IAED,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,GAAG,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC;QAClD,GAAG,CAAC,4BAA4B,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC;IAC5D,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,uEAAuE;QACvE,2DAA2D;QAC3D,GAAG,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;QAC/C,GAAG,CAAC,0BAA0B,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;IACxD,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAmB;IACrD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,GAAuB,EAAE,EAAE;QAC7D,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnD,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,iDAAiD,GAAG,GAAG,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,kCAAkC,GAAG,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC;IAEF,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAChD,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5C,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAChD,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAE5C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAmB;IACrD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/src/pilot/types.d.ts

@@ -0,0 +1,181 @@
+/**
+ * Types for the AgentVault Private ICP Replica (Pilot) module
+ *
+ * Supports PRD-004: Internal Pilot – Private ICP Replica for Company Guild
+ */
+/** Replica backend type */
+export type ReplicaType = 'local' | 'kubernetes' | 'docker';
+/** Deployment target for the full stack */
+export type StackTarget = 'cli' | 'canisters' | 'webapp' | 'macos' | 'full';
+/** Air-gap mode configuration */
+export interface AirGapConfig {
+    /** Whether air-gap mode is enabled */
+    enabled: boolean;
+    /** Allowed inference endpoints (bypassed from air-gap) */
+    allowedEndpoints: string[];
+    /** Whether to block Arweave */
+    blockArweave: boolean;
+    /** Whether to block Bittensor */
+    blockBittensor: boolean;
+}
+/** Proxy configuration for external services */
+export interface ProxyConfig {
+    /** Anthropic API proxy endpoint (empty = use official) */
+    anthropicProxy?: string;
+    /** Arweave gateway proxy (empty = disabled in air-gap) */
+    arweaveProxy?: string;
+    /** Bittensor endpoint proxy (empty = disabled in air-gap) */
+    bittensorProxy?: string;
+    /**
+     * VPS proxy endpoint through which all Binance API calls are routed.
+     * The VPS must sit behind a firewall that enforces the IP whitelist and
+     * rate-limits outbound connections to api.binance.com.
+     * Example: "https://trade-proxy.internal:8443"
+     */
+    binanceProxy?: string;
+    /** Custom environment variables to inject */
+    extraEnv?: Record<string, string>;
+}
+/** Private replica network configuration */
+export interface PrivateReplicaConfig {
+    /** Company/org identifier */
+    company: string;
+    /** Replica backend */
+    replicaType: ReplicaType;
+    /** Local port for replica API */
+    port: number;
+    /** Replica bind address */
+    bindAddress: string;
+    /** Whether to enable mDNS announcement */
+    mdnsEnabled: boolean;
+    /** mDNS service name */
+    mdnsServiceName: string;
+    /** Initial cycles for canisters */
+    initialCycles: string;
+    /** Air-gap configuration */
+    airGap: AirGapConfig;
+    /** Proxy configuration for external calls */
+    proxy: ProxyConfig;
+    /** Path to dfx identity PEM file */
+    identityPath?: string;
+    /** Canister IDs after deployment (populated post-init) */
+    canisterIds?: Record<string, string>;
+    /** Replica state directory */
+    stateDir: string;
+    /** Config file path */
+    configPath: string;
+    /** When this config was created */
+    createdAt: string;
+    /** Last known status */
+    status: 'stopped' | 'running' | 'error';
+}
+/** Result from pilot init */
+export interface PilotInitResult {
+    /** Whether init succeeded */
+    success: boolean;
+    /** Config written to disk */
+    config: PrivateReplicaConfig;
+    /** Replica URL */
+    replicaUrl: string;
+    /** Canister IDs deployed */
+    canisterIds: Record<string, string>;
+    /** Steps completed */
+    steps: PilotStep[];
+    /** Warnings */
+    warnings: string[];
+}
+/** Result from full-stack deploy */
+export interface PilotDeployResult {
+    /** Whether deploy succeeded */
+    success: boolean;
+    /** Replica URL */
+    replicaUrl: string;
+    /** Deployed canister IDs */
+    canisterIds: Record<string, string>;
+    /** Steps completed */
+    steps: PilotStep[];
+    /** Warnings */
+    warnings: string[];
+}
+/** Status of a pilot replica */
+export interface PilotStatus {
+    /** Whether the replica is running */
+    running: boolean;
+    /** Company identifier */
+    company: string;
+    /** Replica URL */
+    replicaUrl: string;
+    /** Replica type */
+    replicaType: ReplicaType;
+    /** Air-gap enabled */
+    airGapEnabled: boolean;
+    /** Deployed canister IDs */
+    canisterIds: Record<string, string>;
+    /** Detected via mDNS */
+    mdnsDetected?: boolean;
+}
+/** A single step in the pilot workflow */
+export interface PilotStep {
+    /** Step name */
+    name: string;
+    /** Whether the step succeeded */
+    success: boolean;
+    /** Duration in milliseconds */
+    durationMs: number;
+    /** Error message if failed */
+    error?: string;
+    /** Output from step */
+    output?: string;
+}
+/** Options for pilot init command */
+export interface PilotInitOptions {
+    company: string;
+    replica: ReplicaType;
+    port?: number;
+    cycles?: string;
+    identity?: string;
+    yes?: boolean;
+    airGap?: boolean;
+    anthropicProxy?: string;
+    arweaveProxy?: string;
+    bittensorProxy?: string;
+    mdns?: boolean;
+}
+/** Options for pilot deploy command */
+export interface PilotDeployOptions {
+    stack: StackTarget;
+    yes?: boolean;
+    dryRun?: boolean;
+}
+/** mDNS service record for private replica discovery */
+export interface MdnsReplicaRecord {
+    /** Service hostname */
+    hostname: string;
+    /** Port */
+    port: number;
+    /** Company identifier */
+    company: string;
+    /** Replica URL */
+    replicaUrl: string;
+}
+/** The on-disk structure of a .agentvault/pilot.json config */
+export interface PilotConfigFile {
+    version: '1';
+    company: string;
+    replicaType: ReplicaType;
+    port: number;
+    bindAddress: string;
+    mdns: {
+        enabled: boolean;
+        serviceName: string;
+    };
+    initialCycles: string;
+    airGap: AirGapConfig;
+    proxy: ProxyConfig;
+    identityPath?: string;
+    canisterIds: Record<string, string>;
+    stateDir: string;
+    createdAt: string;
+    status: 'stopped' | 'running' | 'error';
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/pilot/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/pilot/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,2BAA2B;AAC3B,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,YAAY,GAAG,QAAQ,CAAC;AAE5D,2CAA2C;AAC3C,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAE5E,iCAAiC;AACjC,MAAM,WAAW,YAAY;IAC3B,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,+BAA+B;IAC/B,YAAY,EAAE,OAAO,CAAC;IACtB,iCAAiC;IACjC,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,gDAAgD;AAChD,MAAM,WAAW,WAAW;IAC1B,0DAA0D;IAC1D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,WAAW,EAAE,WAAW,CAAC;IACzB,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,WAAW,EAAE,OAAO,CAAC;IACrB,wBAAwB;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,4BAA4B;IAC5B,MAAM,EAAE,YAAY,CAAC;IACrB,6CAA6C;IAC7C,KAAK,EAAE,WAAW,CAAC;IACnB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB;IACxB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;CACzC;AAED,6BAA6B;AAC7B,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,6BAA6B;IAC7B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,kBAAkB;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,sBAAsB;IACtB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,eAAe;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,+BAA+B;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,sBAAsB;IACtB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,eAAe;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,gCAAgC;AAChC,MAAM,WAAW,WAAW;IAC1B,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,WAAW,EAAE,WAAW,CAAC;IACzB,sBAAsB;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,wBAAwB;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,0CAA0C;AAC1C,MAAM,WAAW,SAAS;IACxB,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,WAAW,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,uBAAuB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW;IACX,IAAI,EAAE,MAAM,CAAC;IACb,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,GAAG,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QACJ,OAAO,EAAE,OAAO,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,WAAW,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;CACzC"}

package/dist/src/pilot/types.js

@@ -0,0 +1,7 @@
+/**
+ * Types for the AgentVault Private ICP Replica (Pilot) module
+ *
+ * Supports PRD-004: Internal Pilot – Private ICP Replica for Company Guild
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/pilot/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/pilot/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/src/security/icp-audit.d.ts

@@ -0,0 +1,63 @@
+/**
+ * ICP On-Chain Audit Log — AgentVault MFA Layer 5
+ *
+ * Writes every MFA approval event to ICP stable memory so the audit trail
+ * is tamper-evident, globally verifiable, and independent of the local filesystem.
+ *
+ * Design
+ * ──────
+ *  • Each audit entry is serialised to JSON and submitted via an update call to
+ *    the AgentVault canister's `storeMfaAuditEntry` method.
+ *  • The canister appends entries to a stable Vec (survives upgrades) and enforces:
+ *      – Append-only: no deletions, no overwrites.
+ *      – Caller-checked: only authorised principals can write.
+ *      – nonce-ordered: entries with nonce N+1 must arrive after N.
+ *  • Reads use `getMfaAuditLog(branchId)` — a query call, free and fast.
+ *  • If the ICP node is unreachable, entries are buffered in a local YAML queue
+ *    and replayed the next time `flushIcpAuditQueue()` is called.
+ *
+ * Canister interface (Candid excerpt — see canister/agent.mo)
+ * ────────────────────────────────────────────────────────────
+ *   storeMfaAuditEntry : (MfaAuditEntryInput) -> (variant { ok : nat; err : text })
+ *   getMfaAuditLog     : (branchId : text)    -> (vec MfaAuditEntry)          query
+ *
+ * Setup
+ * ──────
+ *  Set AGENTVAULT_CANISTER_ID and AGENTVAULT_IC_HOST in environment or icp.yaml.
+ *  If neither is set the module operates in local-only mode (no ICP calls).
+ */
+import type { MfaAuditEntry } from './mfa-approval.js';
+/**
+ * Submit an MFA audit entry to the ICP canister.
+ *
+ * If ICP is unreachable or not configured:
+ *   – The entry is added to the local retry queue (`~/.agentvault/mfa/icp-audit-queue.yaml`).
+ *   – Returns { ok: false, queued: true } — the entry is NOT lost.
+ *
+ * @param entry - Audit entry to persist on-chain
+ */
+export declare function submitIcpAuditEntry(entry: MfaAuditEntry): Promise<{
+    ok: true;
+    index: bigint;
+} | {
+    ok: false;
+    queued: boolean;
+    reason: string;
+}>;
+/**
+ * Query the ICP canister for the full audit log of a branch.
+ *
+ * Falls back to an empty array if ICP is not configured or unreachable.
+ * The caller should merge the result with the local YAML audit log.
+ */
+export declare function queryIcpAuditLog(branchId: string): Promise<MfaAuditEntry[]>;
+/**
+ * Retry queued audit entries that previously failed to reach ICP.
+ *
+ * Call this periodically (e.g. on CLI startup or via `agentvault repo audit --flush`).
+ * Returns the number of entries successfully flushed.
+ */
+export declare function flushIcpAuditQueue(): Promise<number>;
+/** Return the number of entries currently in the local retry queue. */
+export declare function getIcpQueueDepth(): number;
+//# sourceMappingURL=icp-audit.d.ts.map

package/dist/src/security/icp-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"icp-audit.d.ts","sourceRoot":"","sources":["../../../src/security/icp-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAuHvD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA2BvF;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAiCjF;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAyB1D;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC"}

package/dist/src/security/icp-audit.js

@@ -0,0 +1,234 @@
+/**
+ * ICP On-Chain Audit Log — AgentVault MFA Layer 5
+ *
+ * Writes every MFA approval event to ICP stable memory so the audit trail
+ * is tamper-evident, globally verifiable, and independent of the local filesystem.
+ *
+ * Design
+ * ──────
+ *  • Each audit entry is serialised to JSON and submitted via an update call to
+ *    the AgentVault canister's `storeMfaAuditEntry` method.
+ *  • The canister appends entries to a stable Vec (survives upgrades) and enforces:
+ *      – Append-only: no deletions, no overwrites.
+ *      – Caller-checked: only authorised principals can write.
+ *      – nonce-ordered: entries with nonce N+1 must arrive after N.
+ *  • Reads use `getMfaAuditLog(branchId)` — a query call, free and fast.
+ *  • If the ICP node is unreachable, entries are buffered in a local YAML queue
+ *    and replayed the next time `flushIcpAuditQueue()` is called.
+ *
+ * Canister interface (Candid excerpt — see canister/agent.mo)
+ * ────────────────────────────────────────────────────────────
+ *   storeMfaAuditEntry : (MfaAuditEntryInput) -> (variant { ok : nat; err : text })
+ *   getMfaAuditLog     : (branchId : text)    -> (vec MfaAuditEntry)          query
+ *
+ * Setup
+ * ──────
+ *  Set AGENTVAULT_CANISTER_ID and AGENTVAULT_IC_HOST in environment or icp.yaml.
+ *  If neither is set the module operates in local-only mode (no ICP calls).
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { parse, stringify } from 'yaml';
+// ─── Config ──────────────────────────────────────────────────────────────────
+const MFA_DIR = path.join(os.homedir(), '.agentvault', 'mfa');
+const ICP_QUEUE_FILE = path.join(MFA_DIR, 'icp-audit-queue.yaml');
+function ensureMfaDir() {
+    fs.mkdirSync(MFA_DIR, { recursive: true });
+}
+/** ICP configuration — reads from env or falls back to local-only mode. */
+function getIcpConfig() {
+    const canisterId = process.env['AGENTVAULT_CANISTER_ID'] ??
+        process.env['CANISTER_ID_AGENT'] ??
+        null;
+    const host = process.env['AGENTVAULT_IC_HOST'] ?? 'https://ic0.app';
+    if (!canisterId)
+        return null;
+    return { canisterId, host };
+}
+function loadQueue() {
+    if (!fs.existsSync(ICP_QUEUE_FILE))
+        return [];
+    return parse(fs.readFileSync(ICP_QUEUE_FILE, 'utf8'));
+}
+function saveQueue(q) {
+    ensureMfaDir();
+    fs.writeFileSync(ICP_QUEUE_FILE, stringify(q), 'utf8');
+}
+// ─── ICP canister actor (lazy import to avoid hard dep when ICP not configured) ─
+async function buildActor(canisterId, host) {
+    // Dynamic import keeps startup fast when ICP is not configured
+    const { HttpAgent, Actor } = await import('@dfinity/agent');
+    const icpAuditIdl = ({ IDL }) => IDL.Service({
+        storeMfaAuditEntry: IDL.Func([
+            IDL.Record({
+                id: IDL.Text,
+                requestId: IDL.Text,
+                branchId: IDL.Text,
+                event: IDL.Text,
+                nonce: IDL.Opt(IDL.Nat),
+                challengeHash: IDL.Opt(IDL.Text),
+                auditToken: IDL.Opt(IDL.Text),
+                deviceFingerprint: IDL.Opt(IDL.Text),
+                timestamp: IDL.Text,
+                detail: IDL.Opt(IDL.Text),
+            }),
+        ], [IDL.Variant({ ok: IDL.Nat, err: IDL.Text })], []),
+        getMfaAuditLog: IDL.Func([IDL.Text], [
+            IDL.Vec(IDL.Record({
+                id: IDL.Text,
+                requestId: IDL.Text,
+                branchId: IDL.Text,
+                event: IDL.Text,
+                nonce: IDL.Opt(IDL.Nat),
+                challengeHash: IDL.Opt(IDL.Text),
+                auditToken: IDL.Opt(IDL.Text),
+                deviceFingerprint: IDL.Opt(IDL.Text),
+                timestamp: IDL.Text,
+                detail: IDL.Opt(IDL.Text),
+            })),
+        ], ['query']),
+    });
+    const agent = await HttpAgent.create({ host });
+    // Fetch root key on non-mainnet hosts (local replica)
+    if (!host.includes('ic0.app')) {
+        await agent.fetchRootKey().catch(() => {
+            // Non-fatal — local replica may not be running
+        });
+    }
+    return Actor.createActor(icpAuditIdl, { agent, canisterId });
+}
+// ─── Candid helpers ───────────────────────────────────────────────────────────
+/** Convert an MfaAuditEntry to the Candid record expected by storeMfaAuditEntry. */
+function toCanisterRecord(e) {
+    return {
+        id: e.id,
+        requestId: e.requestId,
+        branchId: e.branchId,
+        event: e.event,
+        nonce: e.nonce !== undefined ? [BigInt(e.nonce)] : [],
+        challengeHash: e.challengeHash ? [e.challengeHash] : [],
+        auditToken: e.auditToken ? [e.auditToken] : [],
+        deviceFingerprint: e.deviceFingerprint ? [e.deviceFingerprint] : [],
+        timestamp: e.timestamp,
+        detail: e.detail ? [e.detail] : [],
+    };
+}
+// ─── Public API ───────────────────────────────────────────────────────────────
+/**
+ * Submit an MFA audit entry to the ICP canister.
+ *
+ * If ICP is unreachable or not configured:
+ *   – The entry is added to the local retry queue (`~/.agentvault/mfa/icp-audit-queue.yaml`).
+ *   – Returns { ok: false, queued: true } — the entry is NOT lost.
+ *
+ * @param entry - Audit entry to persist on-chain
+ */
+export async function submitIcpAuditEntry(entry) {
+    const config = getIcpConfig();
+    if (!config) {
+        // No canister configured — queue locally and return
+        enqueueLocally(entry);
+        return { ok: false, queued: true, reason: 'icp-not-configured' };
+    }
+    try {
+        const actor = await buildActor(config.canisterId, config.host);
+        const rec = toCanisterRecord(entry);
+        const result = (await actor.storeMfaAuditEntry(rec));
+        if ('ok' in result) {
+            return { ok: true, index: result.ok };
+        }
+        else {
+            enqueueLocally(entry);
+            return { ok: false, queued: true, reason: result.err };
+        }
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        enqueueLocally(entry);
+        return { ok: false, queued: true, reason };
+    }
+}
+/**
+ * Query the ICP canister for the full audit log of a branch.
+ *
+ * Falls back to an empty array if ICP is not configured or unreachable.
+ * The caller should merge the result with the local YAML audit log.
+ */
+export async function queryIcpAuditLog(branchId) {
+    const config = getIcpConfig();
+    if (!config)
+        return [];
+    try {
+        const actor = await buildActor(config.canisterId, config.host);
+        const raw = (await actor.getMfaAuditLog(branchId));
+        return raw.map((r) => ({
+            id: r['id'],
+            requestId: r['requestId'],
+            branchId: r['branchId'],
+            event: r['event'],
+            nonce: Array.isArray(r['nonce']) && r['nonce'].length > 0
+                ? Number(r['nonce'][0])
+                : undefined,
+            challengeHash: Array.isArray(r['challengeHash']) && r['challengeHash'].length > 0
+                ? r['challengeHash'][0]
+                : undefined,
+            auditToken: Array.isArray(r['auditToken']) && r['auditToken'].length > 0
+                ? r['auditToken'][0]
+                : undefined,
+            deviceFingerprint: Array.isArray(r['deviceFingerprint']) && r['deviceFingerprint'].length > 0
+                ? r['deviceFingerprint'][0]
+                : undefined,
+            timestamp: r['timestamp'],
+            detail: Array.isArray(r['detail']) && r['detail'].length > 0
+                ? r['detail'][0]
+                : undefined,
+        }));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Retry queued audit entries that previously failed to reach ICP.
+ *
+ * Call this periodically (e.g. on CLI startup or via `agentvault repo audit --flush`).
+ * Returns the number of entries successfully flushed.
+ */
+export async function flushIcpAuditQueue() {
+    const queue = loadQueue();
+    if (queue.length === 0)
+        return 0;
+    const config = getIcpConfig();
+    if (!config)
+        return 0;
+    let flushed = 0;
+    const remaining = [];
+    for (const item of queue) {
+        item.attempts += 1;
+        const result = await submitIcpAuditEntry(item.entry);
+        if (result.ok) {
+            flushed += 1;
+        }
+        else {
+            // Keep in queue; cap at 10 attempts to avoid infinite retry
+            if (item.attempts < 10) {
+                remaining.push(item);
+            }
+        }
+    }
+    saveQueue(remaining);
+    return flushed;
+}
+/** Return the number of entries currently in the local retry queue. */
+export function getIcpQueueDepth() {
+    return loadQueue().length;
+}
+// ─── Internal ─────────────────────────────────────────────────────────────────
+function enqueueLocally(entry) {
+    ensureMfaDir();
+    const queue = loadQueue();
+    queue.push({ entry, queuedAt: new Date().toISOString(), attempts: 0 });
+    saveQueue(queue);
+}
+//# sourceMappingURL=icp-audit.js.map

package/dist/src/security/icp-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"icp-audit.js","sourceRoot":"","sources":["../../../src/security/icp-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAGxC,gFAAgF;AAEhF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;AAC9D,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;AAElE,SAAS,YAAY;IACnB,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,2EAA2E;AAC3E,SAAS,YAAY;IACnB,MAAM,UAAU,GACd,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAChC,IAAI,CAAC;IACP,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,iBAAiB,CAAC;IACpE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAC9B,CAAC;AAUD,SAAS,SAAS;IAChB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9C,OAAO,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAkB,CAAC;AACzE,CAAC;AAED,SAAS,SAAS,CAAC,CAAgB;IACjC,YAAY,EAAE,CAAC;IACf,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACzD,CAAC;AAED,mFAAmF;AAEnF,KAAK,UAAU,UAAU,CAAC,UAAkB,EAAE,IAAY;IACxD,+DAA+D;IAC/D,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAE5D,MAAM,WAAW,GAAG,CAAC,EAAE,GAAG,EAAgB,EAAE,EAAE,CAC5C,GAAG,CAAC,OAAO,CAAC;QACV,kBAAkB,EAAE,GAAG,CAAC,IAAI,CAC1B;YACE,GAAG,CAAC,MAAM,CAAC;gBACT,EAAE,EAAE,GAAG,CAAC,IAAI;gBACZ,SAAS,EAAE,GAAG,CAAC,IAAI;gBACnB,QAAQ,EAAE,GAAG,CAAC,IAAI;gBAClB,KAAK,EAAE,GAAG,CAAC,IAAI;gBACf,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;gBACvB,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAChC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC7B,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBACpC,SAAS,EAAE,GAAG,CAAC,IAAI;gBACnB,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;aAC1B,CAAC;SACH,EACD,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,EAC7C,EAAE,CACH;QACD,cAAc,EAAE,GAAG,CAAC,IAAI,CACtB,CAAC,GAAG,CAAC,IAAI,CAAC,EACV;YACE,GAAG,CAAC,GAAG,CACL,GAAG,CAAC,MAAM,CAAC;gBACT,EAAE,EAAE,GAAG,CAAC,IAAI;gBACZ,SAAS,EAAE,GAAG,CAAC,IAAI;gBACnB,QAAQ,EAAE,GAAG,CAAC,IAAI;gBAClB,KAAK,EAAE,GAAG,CAAC,IAAI;gBACf,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;gBACvB,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAChC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC7B,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBACpC,SAAS,EAAE,GAAG,CAAC,IAAI;gBACnB,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;aAC1B,CAAC,CACH;SACF,EACD,CAAC,OAAO,CAAC,CACV;KACF,CAAC,CAAC;IAEL,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,sDAAsD;IACtD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACpC,+CAA+C;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,iFAAiF;AAEjF,oFAAoF;AACpF,SAAS,gBAAgB,CAAC,CAAgB;IACxC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACrD,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE;QACvD,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE;QAC9C,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE;QACnE,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAoB;IAEpB,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,oDAAoD;QACpD,cAAc,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,CAAC,MAAO,KAAa,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAEzC,CAAC;QAEpB,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACnB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,KAAK,CAAC,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,cAAc,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACrD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,CAAC,MAAO,KAAa,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAmC,CAAC;QAE9F,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAW;YACrB,SAAS,EAAE,CAAC,CAAC,WAAW,CAAW;YACnC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAW;YACjC,KAAK,EAAE,CAAC,CAAC,OAAO,CAA2B;YAC3C,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;gBACvD,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvB,CAAC,CAAC,SAAS;YACb,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC;gBAC/E,CAAC,CAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAY;gBACnC,CAAC,CAAC,SAAS;YACb,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;gBACtE,CAAC,CAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAY;gBAChC,CAAC,CAAC,SAAS;YACb,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC;gBAC3F,CAAC,CAAE,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAY;gBACvC,CAAC,CAAC,SAAS;YACb,SAAS,EAAE,CAAC,CAAC,WAAW,CAAW;YACnC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;gBAC1D,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAY;gBAC5B,CAAC,CAAC,SAAS;SACd,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAEjC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAEtB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,SAAS,GAAkB,EAAE,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,4DAA4D;YAC5D,IAAI,IAAI,CAAC,QAAQ,GAAG,EAAE,EAAE,CAAC;gBACvB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,CAAC,SAAS,CAAC,CAAC;IACrB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB;IAC9B,OAAO,SAAS,EAAE,CAAC,MAAM,CAAC;AAC5B,CAAC;AAED,iFAAiF;AAEjF,SAAS,cAAc,CAAC,KAAoB;IAC1C,YAAY,EAAE,CAAC;IACf,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACvE,SAAS,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC"}

package/dist/src/security/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Security module for AgentVault
+ *
+ * This module provides encryption, decryption, and key management
+ * using VetKeys for threshold key derivation.
+ */
+export * from './types.js';
+export { VetKeysClient } from './types.js';
+export { decryptJSON, encryptBundleWithVetKeys, decryptBundle, isVetKeysEncryptedBundle, } from './vetkeys.js';
+export * from './multisig.js';
+export * from './totp.js';
+export * from './mfa-approval.js';
+export * from './webauthn.js';
+export * from './icp-audit.js';
+export { VaultClient } from '../vault/client.js';
+export type { VaultConfig, VaultSecret, VaultSecretMetadata, VaultOperationResult, VaultHealthStatus, AgentVaultPolicy, AgentVaultInitOptions, } from '../vault/types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,YAAY,CAAC;AAG3B,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAG3C,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,aAAa,EACb,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,cAAc,eAAe,CAAC;AAG9B,cAAc,WAAW,CAAC;AAG1B,cAAc,mBAAmB,CAAC;AAGlC,cAAc,eAAe,CAAC;AAG9B,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,YAAY,EACV,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC"}

package/dist/src/security/index.js

@@ -0,0 +1,24 @@
+/**
+ * Security module for AgentVault
+ *
+ * This module provides encryption, decryption, and key management
+ * using VetKeys for threshold key derivation.
+ */
+export * from './types.js';
+// VetKeysClient is exported from types.js, avoid re-exporting from vetkeys.js
+export { VetKeysClient } from './types.js';
+// Re-export decryptJSON and bundle encryption from vetkeys.js
+export { decryptJSON, encryptBundleWithVetKeys, decryptBundle, isVetKeysEncryptedBundle, } from './vetkeys.js';
+// Multi-sig approval workflows
+export * from './multisig.js';
+// TOTP (RFC 6238) — pure-Node implementation for Authy / Google Authenticator
+export * from './totp.js';
+// Multi-Factor Agent Approval — TOTP + nonce + one-time link + rate-limit + anomaly
+export * from './mfa-approval.js';
+// WebAuthn / Biometric fallback — P-256 device keys, Secure Enclave simulation
+export * from './webauthn.js';
+// ICP On-Chain Audit Log — tamper-evident on-chain event storage
+export * from './icp-audit.js';
+// HashiCorp Vault integration
+export { VaultClient } from '../vault/client.js';
+//# sourceMappingURL=index.js.map