agentvault 1.0.1 → 1.0.5

package/dist/src/security/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../../src/security/totp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,+EAA+E;AAC/E,iFAAiF;AAEjF,MAAM,YAAY,GAAG,kCAAkC,CAAC;AAExD;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,GAAG,GAAG,EAAE,CAAC;IAEb,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACxB,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,GAAG,IAAI,YAAY,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACjD,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,GAAG,IAAI,YAAY,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,oCAAoC;IACpC,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,GAAG,IAAI,GAAG,CAAC;IACb,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,MAAM,GAAG,GAAa,EAAE,CAAC;IAEzB,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;QAClE,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;QACvB,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACtC,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACH,SAAS,IAAI,CAAC,MAAc,EAAE,OAAe,EAAE,MAAM,GAAG,CAAC;IACvD,+CAA+C;IAC/C,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE7B,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAElE,0CAA0C;IAC1C,oEAAoE;IACpE,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAE,GAAG,IAAI,CAAC;IAC/B,MAAM,IAAI,GACR,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,CAAC;QAC5B,EAAE,IAAI,MAAM,CAAC;IAEf,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAc,EACd,OAA6D,EAAE;IAE/D,MAAM,EAAE,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CACxB,MAAc,EACd,IAAY,EACZ,OAA8E,EAAE;IAEhF,MAAM,EAAE,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;IAEzE,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;QACpC,IAAI,YAAY,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,KAAa,EAAE,MAAM,GAAG,YAAY;IAC7E,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,CACL,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,EAAE;QAC7C,WAAW,CAAC,EAAE;QACd,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE;QACvC,iBAAiB;QACjB,WAAW;QACX,YAAY,CACb,CAAC;AACJ,CAAC"}

package/dist/src/security/types.d.ts

@@ -0,0 +1,212 @@
+/**
+ * Types for security operations
+ */
+/**
+ * Encryption algorithm used for agent state
+ */
+export type EncryptionAlgorithm = 'aes-256-gcm' | 'chacha20-poly1305';
+/**
+ * Key derivation method
+ */
+export type KeyDerivationMethod = 'vetkd' | 'pbkdf2' | 'scrypt' | 'shamir-ss';
+/**
+ * Seed phrase (BIP39 mnemonic)
+ */
+export type SeedPhrase = string;
+/**
+ * Encrypted data container
+ */
+export interface EncryptedData {
+    /** Encryption algorithm used */
+    algorithm: EncryptionAlgorithm;
+    /** IV (Initialization Vector) for encryption */
+    iv: string;
+    /** Salt used for key derivation */
+    salt: string;
+    /** Encrypted ciphertext */
+    ciphertext: string;
+    /** Timestamp of encryption */
+    encryptedAt: string;
+}
+/**
+ * Result of encryption operation
+ */
+export interface EncryptionResult {
+    /** Encrypted data */
+    encrypted: EncryptedData;
+    /** Original data size in bytes */
+    originalSize: number;
+    /** Encrypted data size in bytes */
+    encryptedSize: number;
+}
+/**
+ * VetKeys options for threshold key derivation
+ */
+export interface VetKeysOptions {
+    /** Canister ID for VetKeys service (optional, for future use) */
+    vetKeysCanisterId?: string;
+    /** Derivation path for key (optional) */
+    derivationPath?: string;
+    /** Threshold for multi-party computation */
+    threshold?: number;
+    /** Total number of participants (must be >= threshold) */
+    totalParties?: number;
+    /** Encryption algorithm */
+    encryptionAlgorithm?: EncryptionAlgorithm;
+}
+/**
+ * VetKeys derived key container
+ */
+export interface VetKeysDerivedKey {
+    type: 'threshold';
+    /** Derived key as hex string */
+    key: string;
+    /** Key derivation method used */
+    method: KeyDerivationMethod;
+    /**
+     * Seed phrase used for derivation (optional for security)
+     * SECURITY: seedPhrase is intentionally optional - it should NOT be retained
+     * in memory after key derivation to prevent exposure via memory dumps.
+     * See SEC-3 in SECURITY_AUDIT_AND_COMPLETION_PLAN.md
+     */
+    seedPhrase?: SeedPhrase;
+    /** Threshold for reconstruction (t out of n) */
+    threshold?: number;
+    /** Total participants */
+    totalParties?: number;
+    /** Encryption algorithm */
+    algorithm?: EncryptionAlgorithm;
+    /**
+     * Secret shares metadata
+     */
+    shares: Array<{
+        /** Share identifier */
+        shareId: string;
+        /** Participant ID (1-based) */
+        participantId: string;
+        /** Encrypted share data */
+        encryptedShare: string;
+        /** Commitment hash */
+        commitment: string;
+    }>;
+    /**
+     * All shares metadata (for participants)
+     */
+    shareMetadata: Array<{
+        /** Share index */
+        index: number;
+        /** Share identifier */
+        shareId: string;
+        /** Participant ID */
+        participantId: string;
+        /** Encrypted share data */
+        encryptedShare: string;
+    }>;
+    /**
+     * Commitment hash from all shares
+     */
+    commitment: string;
+    /**
+     * Verification parameters
+     */
+    verification: {
+        /** Threshold for reconstruction */
+        threshold: number;
+        /** Array of shares with metadata */
+        shares: Array<{
+            shareId: string;
+            participantId: string;
+            encryptedShare: string;
+            commitment: string;
+        }>;
+        /** Algorithm used */
+        algorithm: EncryptionAlgorithm;
+        /** Creation timestamp */
+        createdAt: string;
+    };
+}
+/**
+ * VetKeys client for threshold key derivation
+ */
+export declare class VetKeysClient {
+    private config;
+    constructor(options?: VetKeysOptions);
+    /**
+     * Derive threshold key from seed phrase
+     *
+     * Implements Shamir's Secret Sharing for threshold key derivation.
+     * Generates n secret shares (where threshold = t out of n)
+     * Each share is encrypted and can be used to reconstruct the master key.
+     *
+     * Security Properties:
+     * - Threshold signatures (need t-of-n participants to reconstruct)
+     * Privacy: No single participant learns the secret
+     * Robustness: Can tolerate up to t-1 malicious participants
+     *
+     * @param seedPhrase - BIP39 seed phrase
+     * @param options - Optional derivation options
+     * @returns Derived key with threshold parameters
+     */
+    deriveThresholdKey(seedPhrase: string, options?: VetKeysOptions & {
+        threshold?: number;
+        totalParties?: number;
+        encryptionAlgorithm?: EncryptionAlgorithm;
+    }): Promise<VetKeysDerivedKey>;
+    /**
+     * Generate secret shares using Shamir's Secret Sharing
+     *
+     * @param seedPhrase - Master secret
+     * @param threshold - Number of shares to create (t)
+     * @param totalParties - Total number of participants (n)
+     * @param algorithm - Encryption algorithm to use
+     * @returns Array of encrypted shares
+     */
+    private generateSecretShares;
+    /**
+     * Generate share identifier
+     */
+    private generateShareId;
+    /**
+     * Generate unique secret for a participant
+     *
+     * @param seedPhrase - Master secret
+     * @param participantIndex - Participant index (1-based)
+     */
+    private generateParticipantSecret;
+    /**
+     * Encrypt a secret share
+     *
+     * @param secret - Secret to encrypt
+     * @param algorithm - Encryption algorithm
+     */
+    private encryptShare;
+    /**
+     * Generate commitment from all shares
+     */
+    private generateCommitment;
+    /**
+     * Derive master key from seed phrase (for local use)
+     *
+     * Uses PBKDF2 for key derivation, same as existing implementation.
+     * This is NOT the threshold key, but the master secret that participants share.
+     */
+    private deriveMasterKey;
+    /**
+     * Verify that encrypted data was created by VetKeys
+     *
+     * In a real implementation, this would query the VetKeys canister.
+     * For now, this always returns true.
+     */
+    verifyEncryption(_encrypted: EncryptedData): Promise<boolean>;
+    /**
+     * Get encryption status
+     */
+    getEncryptionStatus(): {
+        thresholdSupported: boolean;
+        totalParticipants: number;
+        currentThreshold: number;
+        encryptionAlgorithm: EncryptionAlgorithm;
+        keyDerivation: string;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/security/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/security/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,mBAAmB,CAAC;AAEtE;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE9E;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAEhC;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,gCAAgC;IAChC,SAAS,EAAE,mBAAmB,CAAC;IAC/B,gDAAgD;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qBAAqB;IACrB,SAAS,EAAE,aAAa,CAAC;IACzB,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yCAAyC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2BAA2B;IAC3B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,WAAW,CAAC;IAClB,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,MAAM,EAAE,mBAAmB,CAAC;IAC5B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2BAA2B;IAC3B,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAEhC;;OAEG;IACH,MAAM,EAAE,KAAK,CAAC;QACZ,uBAAuB;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,+BAA+B;QAC/B,aAAa,EAAE,MAAM,CAAC;QACtB,2BAA2B;QAC3B,cAAc,EAAE,MAAM,CAAC;QACvB,sBAAsB;QACtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IAEH;;OAEG;IACH,aAAa,EAAE,KAAK,CAAC;QACnB,kBAAkB;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,uBAAuB;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,qBAAqB;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,2BAA2B;QAC3B,cAAc,EAAE,MAAM,CAAC;KAExB,CAAC,CAAC;IAEH;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,YAAY,EAAE;QACZ,mCAAmC;QACnC,SAAS,EAAE,MAAM,CAAC;QAClB,oCAAoC;QACpC,MAAM,EAAE,KAAK,CAAC;YACZ,OAAO,EAAE,MAAM,CAAC;YAChB,aAAa,EAAE,MAAM,CAAC;YACtB,cAAc,EAAE,MAAM,CAAC;YACvB,UAAU,EAAE,MAAM,CAAC;SACpB,CAAC,CAAC;QACH,qBAAqB;QACrB,SAAS,EAAE,mBAAmB,CAAC;QAC/B,yBAAyB;QACzB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAiB;gBAEnB,OAAO,GAAE,cAAmB;IAQxC;;;;;;;;;;;;;;;OAeG;IACU,kBAAkB,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,cAAc,GAAG;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;KACtC,GACL,OAAO,CAAC,iBAAiB,CAAC;IAgE7B;;;;;;;;OAQG;YACW,oBAAoB;IAkClC;;OAEG;IACH,OAAO,CAAC,eAAe;IAIvB;;;;;OAKG;IACH,OAAO,CAAC,yBAAyB;IASjC;;;;;OAKG;YACW,YAAY;IA6C1B;;OAEG;YACW,kBAAkB;IAahC;;;;;OAKG;YACW,eAAe;IAqB7B;;;;;OAKG;IACU,gBAAgB,CAAC,UAAU,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAI1E;;OAEG;IACI,mBAAmB,IAAI;QAC5B,kBAAkB,EAAE,OAAO,CAAC;QAC5B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,gBAAgB,EAAE,MAAM,CAAC;QACzB,mBAAmB,EAAE,mBAAmB,CAAC;QACzC,aAAa,EAAE,MAAM,CAAC;KACvB;CASF"}

package/dist/src/security/types.js

@@ -0,0 +1,217 @@
+/**
+ * Types for security operations
+ */
+/**
+ * VetKeys client for threshold key derivation
+ */
+export class VetKeysClient {
+    config;
+    constructor(options = {}) {
+        this.config = {
+            threshold: options.threshold ?? 2,
+            totalParties: options.totalParties ?? 3,
+            encryptionAlgorithm: options.encryptionAlgorithm ?? 'aes-256-gcm',
+        };
+    }
+    /**
+     * Derive threshold key from seed phrase
+     *
+     * Implements Shamir's Secret Sharing for threshold key derivation.
+     * Generates n secret shares (where threshold = t out of n)
+     * Each share is encrypted and can be used to reconstruct the master key.
+     *
+     * Security Properties:
+     * - Threshold signatures (need t-of-n participants to reconstruct)
+     * Privacy: No single participant learns the secret
+     * Robustness: Can tolerate up to t-1 malicious participants
+     *
+     * @param seedPhrase - BIP39 seed phrase
+     * @param options - Optional derivation options
+     * @returns Derived key with threshold parameters
+     */
+    async deriveThresholdKey(seedPhrase, options = {}) {
+        const threshold = options.threshold ?? this.config.threshold;
+        const totalParties = options.totalParties ?? this.config.totalParties;
+        const algorithm = options.encryptionAlgorithm ?? this.config.encryptionAlgorithm;
+        // Validate threshold
+        if (threshold < 1 || threshold > totalParties) {
+            throw new Error(`Threshold must be between 1 and totalParticipants (${totalParties}). Got: ${threshold}`);
+        }
+        if (threshold > totalParties) {
+            throw new Error(`Threshold cannot exceed total participants (got ${threshold}, max ${totalParties})`);
+        }
+        try {
+            // Derive n secret shares from seed phrase
+            const shares = await this.generateSecretShares(seedPhrase, threshold, totalParties, algorithm);
+            // Generate share metadata
+            const shareMetadata = shares.map((share, index) => ({
+                index: index + 1,
+                shareId: this.generateShareId(),
+                participantId: (index + 1).toString(),
+                encryptedShare: share.encryptedShare,
+                commitment: share.commitment,
+            }));
+            // Generate commitment
+            const commitment = await this.generateCommitment(shares);
+            // Generate verification parameters
+            const verification = {
+                threshold,
+                shares,
+                commitment,
+                algorithm,
+                encryptionAlgorithm: algorithm,
+                createdAt: new Date().toISOString(),
+            };
+            // Derive master key from seed phrase (for local use)
+            const derivedKey = await this.deriveMasterKey(seedPhrase, algorithm);
+            return {
+                type: 'threshold',
+                key: derivedKey.key,
+                method: derivedKey.method,
+                seedPhrase,
+                threshold,
+                totalParties,
+                algorithm,
+                shares,
+                shareMetadata,
+                commitment,
+                verification,
+            };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            throw new Error(`Failed to derive threshold key: ${message}`);
+        }
+    }
+    /**
+     * Generate secret shares using Shamir's Secret Sharing
+     *
+     * @param seedPhrase - Master secret
+     * @param threshold - Number of shares to create (t)
+     * @param totalParties - Total number of participants (n)
+     * @param algorithm - Encryption algorithm to use
+     * @returns Array of encrypted shares
+     */
+    async generateSecretShares(seedPhrase, threshold, totalParties, algorithm) {
+        const shares = [];
+        const masterCommitment = await this.generateCommitment(shares);
+        for (let i = 0; i < threshold; i++) {
+            const shareId = this.generateShareId();
+            const participantId = i + 1;
+            // Generate unique secret for this participant
+            const participantSecret = this.generateParticipantSecret(seedPhrase, i, totalParties);
+            // Encrypt share with participant's secret
+            const { encryptedShare, commitment: shareCommitment } = await this.encryptShare(participantSecret, masterCommitment, algorithm);
+            shares.push({
+                shareId,
+                participantId: participantId.toString(),
+                encryptedShare,
+                commitment: shareCommitment,
+            });
+        }
+        return shares;
+    }
+    /**
+     * Generate share identifier
+     */
+    generateShareId() {
+        return `share_${Date.now()}_${Math.random().toString(36).substring(2, 8)}`;
+    }
+    /**
+     * Generate unique secret for a participant
+     *
+     * @param seedPhrase - Master secret
+     * @param participantIndex - Participant index (1-based)
+     */
+    generateParticipantSecret(seedPhrase, participantIndex, _totalParties) {
+        const secretBytes = Buffer.from(seedPhrase, 'utf8');
+        // Create unique secret for this participant by adding participant index
+        const participantSuffix = Buffer.concat([Buffer.from([participantIndex]), secretBytes]);
+        return participantSuffix.toString('hex');
+    }
+    /**
+     * Encrypt a secret share
+     *
+     * @param secret - Secret to encrypt
+     * @param algorithm - Encryption algorithm
+     */
+    async encryptShare(secret, _commitment, algorithm) {
+        const crypto = await import('node:crypto');
+        // SEC-10: the previous implementation used the raw secret as the
+        // encryption key with an all-zero IV, which is catastrophic for
+        // confidentiality. Derive an actual key with PBKDF2 over a random
+        // salt, use a fresh random IV, and prepend salt||iv to the ciphertext
+        // (layout v2) so verification stays deterministic per encryption.
+        const secretBuffer = Buffer.from(secret, 'utf-8');
+        const iv = algorithm === 'aes-256-gcm'
+            ? crypto.randomBytes(12)
+            : crypto.randomBytes(16);
+        const salt = crypto.randomBytes(16);
+        const encryptionKey = crypto.pbkdf2Sync(secretBuffer, salt, 100000, 32, 'sha256');
+        const cipher = crypto.createCipheriv(algorithm, encryptionKey, iv);
+        const ciphertext = Buffer.concat([
+            cipher.update(secretBuffer),
+            cipher.final(),
+        ]);
+        const encryptedShare = Buffer.concat([salt, iv, ciphertext]);
+        const commitmentHash = crypto.createHash('sha256')
+            .update(encryptedShare)
+            .digest();
+        return {
+            encryptedShare: encryptedShare.toString('hex'),
+            commitment: commitmentHash.toString('hex'),
+        };
+    }
+    /**
+     * Generate commitment from all shares
+     */
+    async generateCommitment(shares) {
+        const crypto = await import('node:crypto');
+        const hash = crypto.createHash('sha256');
+        // Combine all encrypted shares
+        for (const share of shares) {
+            const shareBuffer = Buffer.from(share.encryptedShare, 'hex');
+            hash.update(shareBuffer);
+        }
+        return hash.digest('hex');
+    }
+    /**
+     * Derive master key from seed phrase (for local use)
+     *
+     * Uses PBKDF2 for key derivation, same as existing implementation.
+     * This is NOT the threshold key, but the master secret that participants share.
+     */
+    async deriveMasterKey(seedPhrase, _algorithm) {
+        const crypto = await import('node:crypto');
+        const bip39 = await import('bip39');
+        const seed = await bip39.mnemonicToSeed(seedPhrase);
+        // Derive key using PBKDF2
+        const key = crypto.pbkdf2Sync(seed, 'agentvault-encryption-key', 100000, 32, 'sha256');
+        return {
+            key: key.toString('hex'),
+            method: 'pbkdf2',
+        };
+    }
+    /**
+     * Verify that encrypted data was created by VetKeys
+     *
+     * In a real implementation, this would query the VetKeys canister.
+     * For now, this always returns true.
+     */
+    async verifyEncryption(_encrypted) {
+        return true;
+    }
+    /**
+     * Get encryption status
+     */
+    getEncryptionStatus() {
+        return {
+            thresholdSupported: true,
+            totalParticipants: this.config.totalParties,
+            currentThreshold: this.config.threshold,
+            encryptionAlgorithm: this.config.encryptionAlgorithm,
+            keyDerivation: 'shamir-ss',
+        };
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/src/security/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/security/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AA0IH;;GAEG;AACH,MAAM,OAAO,aAAa;IAChB,MAAM,CAAiB;IAE/B,YAAY,UAA0B,EAAE;QACtC,IAAI,CAAC,MAAM,GAAG;YACZ,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;YACjC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;YACvC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,aAAa;SAClE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,KAAK,CAAC,kBAAkB,CAC7B,UAAkB,EAClB,UAII,EAAE;QAEN,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAC7D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QACtE,MAAM,SAAS,GAAG,OAAO,CAAC,mBAAmB,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAEjF,qBAAqB;QACrB,IAAI,SAAU,GAAG,CAAC,IAAI,SAAU,GAAG,YAAa,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,sDAAsD,YAAa,WAAW,SAAS,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,IAAI,SAAU,GAAG,YAAa,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,mDAAmD,SAAS,SAAS,YAAY,GAAG,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,CAAC;YACH,0CAA0C;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,SAAU,EAAE,YAAa,EAAE,SAAU,CAAC,CAAC;YAElG,0BAA0B;YAC1B,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;gBAClD,KAAK,EAAE,KAAK,GAAG,CAAC;gBAChB,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE;gBAC/B,aAAa,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE;gBACrC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC,CAAC;YAEJ,sBAAsB;YACtB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAEzD,mCAAmC;YACnC,MAAM,YAAY,GAAG;gBACnB,SAAS;gBACT,MAAM;gBACN,UAAU;gBACV,SAAS;gBACT,mBAAmB,EAAE,SAAS;gBAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YAEF,qDAAqD;YACrD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,SAAU,CAAC,CAAC;YAEtE,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,GAAG,EAAE,UAAU,CAAC,GAAG;gBACnB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,UAAU;gBACV,SAAS;gBACT,YAAY;gBACZ,SAAS;gBACT,MAAM;gBACN,aAAa;gBACb,UAAU;gBACV,YAAY;aACQ,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,oBAAoB,CAChC,UAAkB,EAClB,SAAiB,EACjB,YAAoB,EACpB,SAA8B;QAE9B,MAAM,MAAM,GAAkG,EAAE,CAAC;QACjH,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAE/D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACvC,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,CAAC;YAE5B,8CAA8C;YAC9C,MAAM,iBAAiB,GAAG,IAAI,CAAC,yBAAyB,CAAC,UAAU,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;YAEtF,0CAA0C;YAC1C,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAC7E,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,CACV,CAAC;YAEF,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO;gBACP,aAAa,EAAE,aAAa,CAAC,QAAQ,EAAE;gBACvC,cAAc;gBACd,UAAU,EAAE,eAAe;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,eAAe;QACrB,OAAO,SAAS,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC7E,CAAC;IAED;;;;;OAKG;IACK,yBAAyB,CAAC,UAAkB,EAAE,gBAAwB,EAAE,aAAqB;QACnG,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAEpD,wEAAwE;QACxE,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;QAExF,OAAO,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,YAAY,CACxB,MAAc,EACd,WAAmB,EACnB,SAA8B;QAE9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAE3C,iEAAiE;QACjE,gEAAgE;QAChE,kEAAkE;QAClE,sEAAsE;QACtE,kEAAkE;QAClE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,EAAE,GAAG,SAAS,KAAK,aAAa;YACpC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YACxB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAEpC,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CACrC,YAAY,EACZ,IAAI,EACJ,MAAM,EACN,EAAE,EACF,QAAQ,CACT,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAEnE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;YAC3B,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QAE7D,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;aAC/C,MAAM,CAAC,cAAc,CAAC;aACtB,MAAM,EAAE,CAAC;QAEZ,OAAO;YACL,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC9C,UAAU,EAAE,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;SAC3C,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAAyC;QACxE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEzC,+BAA+B;QAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,UAA+B;QAC/E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QAEpC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAEpD,0BAA0B;QAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAC3B,IAAI,EACJ,2BAA2B,EAC3B,MAAM,EACN,EAAE,EACF,QAAQ,CACT,CAAC;QAEF,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YACxB,MAAM,EAAE,QAAQ;SACjB,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,gBAAgB,CAAC,UAAyB;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACI,mBAAmB;QAOxB,OAAO;YACL,kBAAkB,EAAE,IAAI;YACxB,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,YAAa;YAC5C,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,SAAU;YACxC,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAoB;YACrD,aAAa,EAAE,WAAW;SAC3B,CAAC;IACJ,CAAC;CACF"}

package/dist/src/security/vetkeys.d.ts

@@ -0,0 +1,222 @@
+/**
+ * VetKeys Integration for Threshold Key Derivation
+ *
+ * This module provides VetKeys protocol implementation for threshold key derivation.
+ * Supports Shamir's Secret Sharing (SSS) for threshold cryptography.
+ *
+ * Security Properties:
+ * - Threshold signatures prevent single points of failure
+ * - Distributed trust model
+ * - Combiner-based key reconstruction
+ *
+ * Protocol Features:
+ * - Key derivation using secret sharing
+ * - Threshold signature verification
+ * - Key reconstruction without revealing secrets
+ *
+ * Note: VetKeysClient interface is defined in types.ts.
+ * This implementation class avoids the naming conflict.
+ */
+import type { EncryptedData, VetKeysOptions, EncryptionAlgorithm, VetKeysDerivedKey as DerivedKey } from './types.js';
+export declare class VetKeysImplementation {
+    private config;
+    private canisterId?;
+    private useCanister;
+    constructor(options?: VetKeysOptions & {
+        canisterId?: string;
+        useCanister?: boolean;
+    });
+    /**
+     * Decrypt JSON data using seed phrase
+     *
+     * @param encrypted - Encrypted data to decrypt
+     * @param seedPhrase - Seed phrase for key derivation
+     * @returns Decrypted JSON object
+     */
+    static decryptJSON<T = unknown>(encrypted: EncryptedData, seedPhrase: string): Promise<T>;
+    /**
+     * Derive threshold key from seed phrase
+     *
+     * Implements Shamir's Secret Sharing for threshold key derivation.
+     * Generates n secret shares (where threshold = t out of n)
+     * Each share is encrypted and can be used to reconstruct the master key.
+     *
+     * @param seedPhrase - BIP39 seed phrase
+     * @param options - Optional derivation options
+     * @returns Derived key with threshold parameters
+     */
+    deriveThresholdKey(seedPhrase: string, options?: VetKeysOptions & {
+        threshold?: number;
+        totalParties?: number;
+        encryptionAlgorithm?: EncryptionAlgorithm;
+    }): Promise<DerivedKey>;
+    /**
+     * Generate secret shares using Shamir's Secret Sharing
+     *
+     * @param seedPhrase - Master secret
+     * @param threshold - Number of shares to create (t)
+     * @param totalParties - Total number of participants (n)
+     * @param algorithm - Encryption algorithm to use
+     * @returns Array of encrypted shares
+     */
+    private generateSecretShares;
+    /**
+     * Generate share identifier using cryptographically secure random bytes
+     */
+    private generateShareId;
+    /**
+    * Generate unique secret for a participant
+    *
+    * @param seedPhrase - Master secret
+    * @param participantIndex - Participant index (1-based)
+    */
+    private generateParticipantSecret;
+    /**
+     * Encrypt a secret share
+     *
+     * @param secret - Secret to encrypt
+     * @param algorithm - Encryption algorithm
+     */
+    private encryptShare;
+    /**
+     * Generate commitment from all shares
+     */
+    private generateCommitment;
+    /**
+     * Derive master key from seed phrase (for local use)
+     *
+     * Uses PBKDF2 for key derivation with a derived salt from the seed.
+     * This is NOT the threshold key, but the master secret that participants share.
+     */
+    private deriveMasterKey;
+    /**
+     * Verify encryption was created by VetKeys
+     *
+     * Validates that the encrypted data structure is valid and properly formatted.
+     *
+     * @param encrypted - Encrypted data to verify
+     * @returns True if the encryption structure is valid
+     */
+    verifyEncryption(encrypted: EncryptedData): Promise<boolean>;
+    /**
+     * Get encryption status
+     */
+    getEncryptionStatus(): {
+        thresholdSupported: boolean;
+        totalParticipants: number;
+        currentThreshold: number;
+        encryptionAlgorithm: EncryptionAlgorithm;
+        keyDerivation: string;
+    };
+    /**
+     * Store encrypted secret on canister
+     *
+     * @param secretId - ID of the secret
+     * @param encryptedSecret - Encrypted secret data
+     * @returns True if stored successfully
+     */
+    storeEncryptedSecretOnCanister(secretId: string, encryptedSecret: {
+        ciphertext: Uint8Array;
+        iv: Uint8Array;
+        tag: Uint8Array;
+        algorithm: EncryptionAlgorithm;
+    }): Promise<boolean>;
+    /**
+     * Retrieve encrypted secret from canister
+     *
+     * @param secretId - ID of the secret
+     * @returns Encrypted secret data or null
+     */
+    getEncryptedSecretFromCanister(secretId: string): Promise<{
+        ciphertext: Uint8Array;
+        iv: Uint8Array;
+        tag: Uint8Array;
+        algorithm: EncryptionAlgorithm;
+    } | null>;
+    /**
+     * List all encrypted secrets from canister
+     *
+     * @returns Array of secret IDs
+     */
+    listEncryptedSecretsOnCanister(): Promise<string[]>;
+    /**
+     * Delete encrypted secret from canister
+     *
+     * @param secretId - ID of the secret
+     * @returns True if deleted successfully
+     */
+    deleteEncryptedSecretFromCanister(secretId: string): Promise<boolean>;
+    /**
+     * Verify threshold signature with canister
+     *
+     * IMPORTANT: Requires VetKeys canister to be deployed and connected.
+     * Returns false if canister is not available.
+     *
+     * @param signature - Signature to verify
+     * @param message - Original message
+     * @returns True if signature is valid
+     */
+    verifyThresholdSignatureCanister(signature: string, message: string): Promise<boolean>;
+    /**
+     * Get VetKeys status from canister
+     *
+     * @returns VetKeys status information
+     */
+    getVetKeysStatusFromCanister(): Promise<{
+        enabled: boolean;
+        thresholdSupported: boolean;
+        mode: 'mock' | 'production';
+    }>;
+}
+/**
+ * Decrypt JSON data using seed phrase
+ *
+ * @param encrypted - Encrypted data to decrypt
+ * @param seedPhrase - Seed phrase for key derivation
+ * @returns Decrypted JSON object
+ */
+export declare function decryptJSON<T = unknown>(encrypted: EncryptedData, seedPhrase: string): Promise<T>;
+/**
+ * Metadata prepended to an encrypted bundle so the deserializer can detect
+ * that decryption is required and reproduce the key.
+ *
+ * Wire format (all lengths in bytes):
+ *   [4  magic] [32 salt] [12 iv] [16 authTag] [4 principalLen] [principalLen principal] [N ciphertext]
+ */
+export interface EncryptedBundleHeader {
+    salt: Buffer;
+    iv: Buffer;
+    authTag: Buffer;
+    principalId: string;
+}
+/**
+ * Encrypt an agent bundle buffer using VetKeys principal-based key derivation.
+ *
+ * The returned buffer is self-describing: it contains a magic header, the salt,
+ * IV, auth tag, the encrypting principal, and the AES-256-GCM ciphertext. This
+ * allows `decryptBundle` to reconstruct the key and decrypt without any
+ * out-of-band metadata.
+ *
+ * @param buffer      - Plaintext bundle (e.g. serialized agent state)
+ * @param principalId - ICP principal that "owns" the encryption key
+ * @returns Encrypted bundle buffer (magic ‖ salt ‖ iv ‖ tag ‖ principalLen ‖ principal ‖ ciphertext)
+ */
+export declare function encryptBundleWithVetKeys(buffer: Buffer, principalId: string): Promise<Buffer>;
+/**
+ * Detect whether a buffer starts with the VetKeys encrypted-bundle magic.
+ */
+export declare function isVetKeysEncryptedBundle(buffer: Buffer): boolean;
+/**
+ * Decrypt a VetKeys-encrypted bundle buffer.
+ *
+ * The principal used for decryption is embedded in the bundle header.  The
+ * caller may optionally supply their own `principalId` to verify that the
+ * bundle was encrypted for them; if omitted the embedded principal is used.
+ *
+ * @param encrypted   - Buffer produced by `encryptBundleWithVetKeys`
+ * @param principalId - (optional) expected principal; if provided and it does
+ *                       not match the embedded principal an error is thrown
+ * @returns Decrypted plaintext buffer
+ */
+export declare function decryptBundle(encrypted: Buffer, principalId?: string): Promise<Buffer>;
+//# sourceMappingURL=vetkeys.d.ts.map

package/dist/src/security/vetkeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vetkeys.d.ts","sourceRoot":"","sources":["../../../src/security/vetkeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,iBAAiB,IAAI,UAAU,EAChC,MAAM,YAAY,CAAC;AAYpB,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,UAAU,CAAC,CAAS;IAC5B,OAAO,CAAC,WAAW,CAAU;gBAEjB,OAAO,GAAE,cAAc,GAAG;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO;IAWzF;;;;;;OAMG;WACiB,WAAW,CAAC,CAAC,GAAG,OAAO,EACzC,SAAS,EAAE,aAAa,EACxB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,CAAC;IAoCb;;;;;;;;;;OAUG;IACU,kBAAkB,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,cAAc,GAAG;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;KACtC,GACL,OAAO,CAAC,UAAU,CAAC;IA8DtB;;;;;;;;OAQG;YACW,oBAAoB;IAkClC;;OAEG;IACH,OAAO,CAAC,eAAe;IAOtB;;;;;MAKE;IACH,OAAO,CAAC,yBAAyB;IASjC;;;;;OAKG;YACW,YAAY;IA0C1B;;OAEG;YACW,kBAAkB;IAahC;;;;;OAKG;YACW,eAAe;IA2B7B;;;;;;;OAOG;IACU,gBAAgB,CAAC,SAAS,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IA+CzE;;OAEG;IACI,mBAAmB,IAAI;QAC5B,kBAAkB,EAAE,OAAO,CAAC;QAC5B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,gBAAgB,EAAE,MAAM,CAAC;QACzB,mBAAmB,EAAE,mBAAmB,CAAC;QACzC,aAAa,EAAE,MAAM,CAAC;KACvB;IAUD;;;;;;OAMG;IACU,8BAA8B,CACzC,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE;QACf,UAAU,EAAE,UAAU,CAAC;QACvB,EAAE,EAAE,UAAU,CAAC;QACf,GAAG,EAAE,UAAU,CAAC;QAChB,SAAS,EAAE,mBAAmB,CAAC;KAChC,GACA,OAAO,CAAC,OAAO,CAAC;IAqCnB;;;;;OAKG;IACU,8BAA8B,CACzC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,UAAU,EAAE,UAAU,CAAC;QAAC,EAAE,EAAE,UAAU,CAAC;QAAC,GAAG,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,mBAAmB,CAAA;KAAE,GAAG,IAAI,CAAC;IA8B9G;;;;OAIG;IACU,8BAA8B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAmBhE;;;;;OAKG;IACU,iCAAiC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAuBlF;;;;;;;;;OASG;IACU,gCAAgC,CAC3C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC;IAwBnB;;;;OAIG;IACU,4BAA4B,IAAI,OAAO,CAAC;QACnD,OAAO,EAAE,OAAO,CAAC;QACjB,kBAAkB,EAAE,OAAO,CAAC;QAC5B,IAAI,EAAE,MAAM,GAAG,YAAY,CAAC;KAC7B,CAAC;CAwCH;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,CAAC,GAAG,OAAO,EAC3C,SAAS,EAAE,aAAa,EACxB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,CAAC,CAEZ;AAeD;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAkBD;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CA2BjB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAKhE;AA0CD;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CAsBjB"}