agentvault 1.0.1 → 1.0.5

package/dist/src/wallet/hsm/types.d.ts

@@ -0,0 +1,134 @@
+/**
+ * HSM / TEE Keygen Types
+ *
+ * Defines the common interface for hardware-backed key generation providers:
+ *   - Ledger hardware wallets (secp256k1 / Ed25519 via APDU over USB HID)
+ *   - Intel SGX Trusted Execution Environments (sealed enclave key storage)
+ *
+ * The central contract is that a private key NEVER leaves the secure boundary.
+ * The host process only ever receives public keys and signatures.
+ */
+/** Identifies the underlying secure element / TEE backend. */
+export type HsmBackend = 'ledger' | 'sgx';
+/** Curve used for the derived key-pair. */
+export type HsmCurve = 'secp256k1' | 'ed25519';
+/**
+ * Result of a public-key derivation performed entirely inside the secure
+ * boundary.  No private key material is included.
+ */
+export interface HsmPublicKeyResult {
+    /** Hex-encoded compressed public key (secp256k1: 33 bytes, ed25519: 32 bytes). */
+    publicKeyHex: string;
+    /** Chain-native address derived from the public key on the device. */
+    address: string;
+    /** BIP32 / SLIP10 derivation path used. */
+    derivationPath: string;
+    /** Curve the key uses. */
+    curve: HsmCurve;
+}
+/**
+ * Result of an in-device signing operation.
+ * Only the signature is returned to the host – the private key stays sealed.
+ */
+export interface HsmSignatureResult {
+    /** DER-encoded or raw signature, hex-encoded. */
+    signatureHex: string;
+    /** Recovery byte (secp256k1 only; undefined for Ed25519). */
+    recovery?: number;
+}
+/**
+ * Minimum interface that every HSM / TEE backend must implement.
+ *
+ * Implementations may support only a subset of curves; callers should check
+ * `supportedCurves` before invoking curve-specific methods.
+ */
+export interface HsmProvider {
+    /** Human-readable name, e.g. "Ledger Nano X", "Intel SGX enclave v2". */
+    readonly name: string;
+    /** Backend type tag for serialization / display. */
+    readonly backend: HsmBackend;
+    /** Which curves are supported by this backend. */
+    readonly supportedCurves: ReadonlyArray<HsmCurve>;
+    /**
+     * Open a channel to the secure element / TEE.
+     * Must be called before any other method.
+     *
+     * @throws {HsmNotAvailableError} when device / daemon is unreachable.
+     */
+    open(): Promise<void>;
+    /**
+     * Close the channel gracefully.
+     * Safe to call even if open() was never called (no-op).
+     */
+    close(): Promise<void>;
+    /**
+     * Derive a key-pair inside the device and return ONLY the public key.
+     * The private key is generated and stored entirely within the secure boundary.
+     *
+     * @param derivationPath - BIP32 (m/purpose'/coin'/acc'/change/index) or
+     *                         SLIP10 path for Ed25519 chains.
+     * @param curve          - Which curve to use.
+     * @returns Public key + address.  Private key is NEVER included.
+     *
+     * @throws {HsmCurveUnsupportedError} when `curve` is not in supportedCurves.
+     * @throws {HsmOperationError} on device / enclave errors.
+     */
+    getPublicKey(derivationPath: string, curve: HsmCurve): Promise<HsmPublicKeyResult>;
+    /**
+     * Sign a 32-byte digest inside the device.
+     * The host provides only the digest; the private key never crosses the boundary.
+     *
+     * @param derivationPath - Same path used when generating the key.
+     * @param digestHex      - 32-byte Keccak / SHA-256 / Blake2 digest, hex-encoded.
+     * @param curve          - Curve the key was generated on.
+     * @returns Signature bytes.  Private key is NEVER included.
+     */
+    signDigest(derivationPath: string, digestHex: string, curve: HsmCurve): Promise<HsmSignatureResult>;
+    /**
+     * Returns a stable identifier for this specific device / enclave instance.
+     * Used to record which hardware produced a given wallet.
+     */
+    deviceId(): Promise<string>;
+}
+/** Base class for all HSM-related errors. */
+export declare class HsmError extends Error {
+    readonly backend: HsmBackend;
+    constructor(message: string, backend: HsmBackend);
+}
+/** Thrown when the hardware / daemon is not found or cannot be opened. */
+export declare class HsmNotAvailableError extends HsmError {
+    constructor(backend: HsmBackend, detail?: string);
+}
+/** Thrown when the requested curve is not supported by the backend. */
+export declare class HsmCurveUnsupportedError extends HsmError {
+    constructor(backend: HsmBackend, curve: HsmCurve);
+}
+/** Thrown on device / enclave operation failures. */
+export declare class HsmOperationError extends HsmError {
+    constructor(backend: HsmBackend, operation: string, cause?: unknown);
+}
+/**
+ * Serialisable metadata stored in `WalletData.chainMetadata.hsm` for wallets
+ * whose keys were generated by an HSM / TEE.
+ *
+ * This is the only artefact of the keygen that is saved locally.
+ * No private key or seed phrase is ever present.
+ */
+export interface HsmWalletMetadata {
+    /** Which backend generated this key. */
+    backend: HsmBackend;
+    /** Stable device identifier captured at creation time. */
+    deviceId: string;
+    /** BIP32 / SLIP10 derivation path used inside the device. */
+    derivationPath: string;
+    /** Curve the key was generated on. */
+    curve: HsmCurve;
+    /** ISO-8601 timestamp of key creation. */
+    createdAt: string;
+    /**
+     * Compressed public key, hex-encoded.
+     * Stored so callers can re-derive the address without querying the device.
+     */
+    publicKeyHex: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/wallet/hsm/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/wallet/hsm/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,8DAA8D;AAC9D,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE1C,2CAA2C;AAC3C,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AAM/C;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,kFAAkF;IAClF,YAAY,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,0BAA0B;IAC1B,KAAK,EAAE,QAAQ,CAAC;CACjB;AAMD;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,kDAAkD;IAClD,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IAElD;;;;;OAKG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtB;;;OAGG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEnF;;;;;;;;OAQG;IACH,UAAU,CACR,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE/B;;;OAGG;IACH,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7B;AAMD,6CAA6C;AAC7C,qBAAa,QAAS,SAAQ,KAAK;aACY,OAAO,EAAE,UAAU;gBAApD,OAAO,EAAE,MAAM,EAAkB,OAAO,EAAE,UAAU;CAIjE;AAED,0EAA0E;AAC1E,qBAAa,oBAAqB,SAAQ,QAAQ;gBACpC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,MAAM;CAQjD;AAED,uEAAuE;AACvE,qBAAa,wBAAyB,SAAQ,QAAQ;gBACxC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ;CAIjD;AAED,qDAAqD;AACrD,qBAAa,iBAAkB,SAAQ,QAAQ;gBACjC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAKpE;AAMD;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,OAAO,EAAE,UAAU,CAAC;IACpB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,cAAc,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,KAAK,EAAE,QAAQ,CAAC;IAChB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB"}

package/dist/src/wallet/hsm/types.js

@@ -0,0 +1,46 @@
+/**
+ * HSM / TEE Keygen Types
+ *
+ * Defines the common interface for hardware-backed key generation providers:
+ *   - Ledger hardware wallets (secp256k1 / Ed25519 via APDU over USB HID)
+ *   - Intel SGX Trusted Execution Environments (sealed enclave key storage)
+ *
+ * The central contract is that a private key NEVER leaves the secure boundary.
+ * The host process only ever receives public keys and signatures.
+ */
+// ---------------------------------------------------------------------------
+// Error hierarchy
+// ---------------------------------------------------------------------------
+/** Base class for all HSM-related errors. */
+export class HsmError extends Error {
+    backend;
+    constructor(message, backend) {
+        super(message);
+        this.backend = backend;
+        this.name = 'HsmError';
+    }
+}
+/** Thrown when the hardware / daemon is not found or cannot be opened. */
+export class HsmNotAvailableError extends HsmError {
+    constructor(backend, detail) {
+        super(`HSM backend "${backend}" is not available${detail ? ': ' + detail : ''}.` +
+            ' Is the device connected / daemon running?', backend);
+        this.name = 'HsmNotAvailableError';
+    }
+}
+/** Thrown when the requested curve is not supported by the backend. */
+export class HsmCurveUnsupportedError extends HsmError {
+    constructor(backend, curve) {
+        super(`Backend "${backend}" does not support curve "${curve}".`, backend);
+        this.name = 'HsmCurveUnsupportedError';
+    }
+}
+/** Thrown on device / enclave operation failures. */
+export class HsmOperationError extends HsmError {
+    constructor(backend, operation, cause) {
+        const detail = cause instanceof Error ? cause.message : String(cause ?? 'unknown');
+        super(`HSM operation "${operation}" failed on "${backend}": ${detail}`, backend);
+        this.name = 'HsmOperationError';
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/src/wallet/hsm/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/wallet/hsm/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAkHH,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,6CAA6C;AAC7C,MAAM,OAAO,QAAS,SAAQ,KAAK;IACY;IAA7C,YAAY,OAAe,EAAkB,OAAmB;QAC9D,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,YAAO,GAAP,OAAO,CAAY;QAE9D,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAmB,EAAE,MAAe;QAC9C,KAAK,CACH,gBAAgB,OAAO,qBAAqB,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG;YACxE,4CAA4C,EAC9C,OAAO,CACR,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,OAAO,wBAAyB,SAAQ,QAAQ;IACpD,YAAY,OAAmB,EAAE,KAAe;QAC9C,KAAK,CAAC,YAAY,OAAO,6BAA6B,KAAK,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,qDAAqD;AACrD,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IAC7C,YAAY,OAAmB,EAAE,SAAiB,EAAE,KAAe;QACjE,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;QACnF,KAAK,CAAC,kBAAkB,SAAS,gBAAgB,OAAO,MAAM,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF"}

package/dist/src/wallet/index.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Wallet Module
+ *
+ * Complete wallet management system for ckETH, Polkadot, Solana, ICP, and Arweave.
+ * Provides per-agent wallet isolation, encryption, and CBOR serialization.
+ */
+export * from './types.js';
+export { serializeWallet, deserializeWallet, serializeTransaction, deserializeTransaction, serializeTransactionRequest, deserializeTransactionRequest, serializeSignedTransaction, deserializeSignedTransaction, validateCborData, } from './cbor-serializer.js';
+export { getWalletBaseDir, getAgentWalletDir, getWalletFilePath, ensureWalletDirectories, saveWallet, loadWallet, deleteWallet, listWallets, listAgents, walletExists, getWalletStats, backupWallets, restoreWallets, clearWallets, getWalletStorageSize, } from './wallet-storage.js';
+export { parseDerivationPath, buildDerivationPath, validateSeedPhrase, generateSeedFromMnemonic, generateMnemonic, getDefaultDerivationPath, deriveWalletKey, } from './key-derivation.js';
+export { secp256k1KeypairFromSeed, ed25519KeypairFromSeed, deriveStorageKey, encryptSecret, decryptSecret, encryptWalletSecrets, decryptWalletSecrets, } from './wallet-crypto.js';
+export { createWallet, importWalletFromPrivateKey, importWalletFromSeed, importWalletFromMnemonic, generateWallet, createWalletWithHsm, getWallet, listAgentWallets, hasWallet, removeWallet, clearAgentWallets, cacheWalletConnection, getCachedConnection, clearCachedConnection, validateSeedPhraseWrapper, } from './wallet-manager.js';
+export { LedgerHsmProvider, SgxHsmProvider, isLedgerAvailable, isSgxAvailable, isHsmAvailable, createHsmProvider, HsmError, HsmNotAvailableError, HsmCurveUnsupportedError, HsmOperationError, } from './hsm/index.js';
+export type { HsmBackend, HsmCurve, HsmProvider, HsmPublicKeyResult, HsmSignatureResult, HsmWalletMetadata, } from './hsm/index.js';
+export { BaseWalletProvider } from './providers/base-provider.js';
+export { CkEthProvider } from './providers/cketh-provider.js';
+export { PolkadotProvider } from './providers/polkadot-provider.js';
+export { SolanaProvider } from './providers/solana-provider.js';
+export { IcpProvider } from './providers/icp-provider.js';
+export { ArweaveProvider } from './providers/arweave-provider.js';
+export { createWalletProvider, normalizeWalletChain } from './providers/provider-factory.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/wallet/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/wallet/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,YAAY,CAAC;AAG3B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,UAAU,EACV,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,YAAY,EACZ,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,EACxB,cAAc,EACd,mBAAmB,EACnB,SAAS,EACT,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,QAAQ,EACR,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,UAAU,EACV,QAAQ,EACR,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/src/wallet/index.js

@@ -0,0 +1,29 @@
+/**
+ * Wallet Module
+ *
+ * Complete wallet management system for ckETH, Polkadot, Solana, ICP, and Arweave.
+ * Provides per-agent wallet isolation, encryption, and CBOR serialization.
+ */
+// Types
+export * from './types.js';
+// CBOR Serialization
+export { serializeWallet, deserializeWallet, serializeTransaction, deserializeTransaction, serializeTransactionRequest, deserializeTransactionRequest, serializeSignedTransaction, deserializeSignedTransaction, validateCborData, } from './cbor-serializer.js';
+// Wallet Storage
+export { getWalletBaseDir, getAgentWalletDir, getWalletFilePath, ensureWalletDirectories, saveWallet, loadWallet, deleteWallet, listWallets, listAgents, walletExists, getWalletStats, backupWallets, restoreWallets, clearWallets, getWalletStorageSize, } from './wallet-storage.js';
+// Key Derivation
+export { parseDerivationPath, buildDerivationPath, validateSeedPhrase, generateSeedFromMnemonic, generateMnemonic, getDefaultDerivationPath, deriveWalletKey, } from './key-derivation.js';
+// Wallet Crypto (key generation + at-rest encryption)
+export { secp256k1KeypairFromSeed, ed25519KeypairFromSeed, deriveStorageKey, encryptSecret, decryptSecret, encryptWalletSecrets, decryptWalletSecrets, } from './wallet-crypto.js';
+// Wallet Manager
+export { createWallet, importWalletFromPrivateKey, importWalletFromSeed, importWalletFromMnemonic, generateWallet, createWalletWithHsm, getWallet, listAgentWallets, hasWallet, removeWallet, clearAgentWallets, cacheWalletConnection, getCachedConnection, clearCachedConnection, validateSeedPhraseWrapper, } from './wallet-manager.js';
+// HSM / TEE keygen
+export { LedgerHsmProvider, SgxHsmProvider, isLedgerAvailable, isSgxAvailable, isHsmAvailable, createHsmProvider, HsmError, HsmNotAvailableError, HsmCurveUnsupportedError, HsmOperationError, } from './hsm/index.js';
+// Providers
+export { BaseWalletProvider } from './providers/base-provider.js';
+export { CkEthProvider } from './providers/cketh-provider.js';
+export { PolkadotProvider } from './providers/polkadot-provider.js';
+export { SolanaProvider } from './providers/solana-provider.js';
+export { IcpProvider } from './providers/icp-provider.js';
+export { ArweaveProvider } from './providers/arweave-provider.js';
+export { createWalletProvider, normalizeWalletChain } from './providers/provider-factory.js';
+//# sourceMappingURL=index.js.map

package/dist/src/wallet/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/wallet/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,QAAQ;AACR,cAAc,YAAY,CAAC;AAE3B,qBAAqB;AACrB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAE9B,iBAAiB;AACjB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,UAAU,EACV,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,YAAY,EACZ,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,iBAAiB;AACjB,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAE7B,sDAAsD;AACtD,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,iBAAiB;AACjB,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,EACxB,cAAc,EACd,mBAAmB,EACnB,SAAS,EACT,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,QAAQ,EACR,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAUxB,YAAY;AACZ,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/src/wallet/key-derivation.d.ts

@@ -0,0 +1,145 @@
+/**
+ * Key Derivation Module
+ *
+ * Implements BIP39 seed phrase derivation for wallet keys.
+ * Supports multiple derivation paths for different blockchains.
+ *
+ * Curve usage:
+ *   secp256k1 – Ethereum / ckETH / Polkadot  (@noble/curves/secp256k1)
+ *   Ed25519   – ICP / Arweave                (@noble/curves/ed25519)
+ *   Ed25519   – Solana                       (@solana/web3.js Keypair for base58)
+ */
+import type { WalletCreationMethod } from './types.js';
+/**
+ * Derivation path components
+ */
+export interface DerivationPathComponents {
+    /** Purpose (e.g., 44' for BIP44) */
+    purpose: number;
+    /** Coin type (e.g., 60' for ETH, 0' for BTC) */
+    coinType: number;
+    /** Account index */
+    account: number;
+    /** Change index (0 for external, 1 for internal) */
+    change: number;
+    /** Address index */
+    index: number;
+}
+/**
+ * Derived key information
+ */
+export interface DerivedKey {
+    /** Private key (hex) */
+    privateKey: string;
+    /** Public key (hex) */
+    publicKey: string;
+    /** Address (chain-specific format) */
+    address: string;
+    /** Derivation path used */
+    derivationPath: string;
+}
+/**
+ * Parse derivation path string
+ *
+ * @param path - Derivation path string (e.g., "m/44'/60'/0'/0/0")
+ * @returns Parsed path components
+ */
+export declare function parseDerivationPath(path: string): DerivationPathComponents;
+/**
+ * Build derivation path from components
+ *
+ * @param components - Path components
+ * @returns Derivation path string
+ */
+export declare function buildDerivationPath(components: DerivationPathComponents): string;
+/**
+ * Validate seed phrase (BIP39)
+ *
+ * @param seedPhrase - Seed phrase to validate
+ * @returns True if valid BIP39 phrase
+ */
+export declare function validateSeedPhrase(seedPhrase: string): boolean;
+/**
+ * Generate seed from seed phrase
+ *
+ * @param seedPhrase - BIP39 seed phrase
+ * @param passphrase - Optional passphrase (default empty)
+ * @returns Seed bytes
+ */
+export declare function generateSeedFromMnemonic(seedPhrase: string, passphrase?: string): Buffer;
+/**
+ * Generate mnemonic from entropy
+ *
+ * @param strength - Entropy strength in bits (128, 160, 192, 224, 256)
+ * @param rng - Optional RNG function
+ * @returns BIP39 mnemonic phrase
+ */
+export declare function generateMnemonic(strength?: number, rng?: (size: number) => Buffer): string;
+/**
+ * Derive Ethereum-compatible key
+ *
+ * @param seed - Seed bytes
+ * @param derivationPath - Derivation path (default: "m/44'/60'/0'/0/0")
+ * @returns Derived key with ETH address
+ */
+export declare function deriveEthKey(seed: Buffer, derivationPath?: string): DerivedKey;
+/**
+ * Derive Polkadot-compatible key
+ *
+ * Uses secp256k1 (via @noble/curves) for key derivation and SS58 for address
+ * encoding.
+ *
+ * @param seed - Seed bytes
+ * @param derivationPath - Derivation path (default: "//hard//stash")
+ * @returns Derived key with Polkadot address
+ */
+export declare function derivePolkadotKey(seed: Buffer, derivationPath?: string): DerivedKey;
+/**
+ * Derive Solana-compatible key
+ *
+ * @param seed - Seed bytes
+ * @param derivationPath - Derivation path (default: "m/44'/501'/0'/0'/0'")
+ * @returns Derived key with Solana address
+ */
+export declare function deriveSolanaKey(seed: Buffer, derivationPath?: string): DerivedKey;
+/**
+ * Derive ICP-compatible key
+ *
+ * Uses Ed25519 via @noble/curves to match the ICP identity standard.
+ * Private key stored as 32 bytes (raw scalar); public key 32 bytes.
+ *
+ * @param seed - Seed bytes
+ * @param derivationPath - Derivation path (default: "m/44'/223'/0'/0/0")
+ * @returns Derived key with ICP principal address
+ */
+export declare function deriveIcpKey(seed: Buffer, derivationPath?: string): DerivedKey;
+/**
+ * Derive Arweave-compatible key
+ *
+ * Uses Ed25519 via @noble/curves for key generation; the address is
+ * SHA-256(publicKey) encoded as base64url (43 chars).
+ *
+ * @param seed - Seed bytes
+ * @param derivationPath - Derivation path (default: "m/44'/472'/0'/0/0")
+ * @returns Derived key with Arweave address
+ */
+export declare function deriveArweaveKey(seed: Buffer, derivationPath?: string): DerivedKey;
+/**
+ * Get default derivation path for chain
+ *
+ * @param chain - Blockchain type
+ * @returns Default derivation path
+ */
+export declare function getDefaultDerivationPath(chain: string): string;
+/**
+ * Derive wallet key based on creation method
+ *
+ * @param method - Wallet creation method
+ * @param seedPhrase - Seed phrase (for 'seed' and 'mnemonic' methods)
+ * @param privateKey - Private key (for 'private-key' method)
+ * @param derivationPath - Custom derivation path
+ * @param chain - Blockchain type
+ * @returns Derived key information
+ */
+export declare function deriveWalletKey(method: WalletCreationMethod, seedPhrase?: string, privateKey?: string, derivationPath?: string, chain?: string): DerivedKey;
+//# sourceMappingURL=key-derivation.d.ts.map

package/dist/src/wallet/key-derivation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-derivation.d.ts","sourceRoot":"","sources":["../../../src/wallet/key-derivation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAOvD;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,wBAAwB;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,cAAc,EAAE,MAAM,CAAC;CACxB;AAoBD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,CAuC1E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,wBAAwB,GACnC,MAAM,CAUR;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,UAAU,GAAE,MAAW,GACtB,MAAM,CAER;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,GAAE,MAAY,EACtB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAC7B,MAAM,CAER;AAwCD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,MAAsC,GACrD,UAAU,CAcZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,MAA2C,GAC1D,UAAU,CAaZ;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,MAAyC,GACxD,UAAU,CAiBZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,MAAsC,GACrD,UAAU,CAWZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,MAA0C,GACzD,UAAU,CAWZ;AAgCD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAoB9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,oBAAoB,EAC5B,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,cAAc,CAAC,EAAE,MAAM,EACvB,KAAK,GAAE,MAAgB,GACtB,UAAU,CA0EZ"}