agentvault 1.0.1 → 1.0.5

package/dist/src/wallet/secure-wallet.d.ts

@@ -0,0 +1,132 @@
+/**
+ * SecureWallet – deploy-time wallet with real cryptography
+ *
+ * Implements the three BDD scenarios:
+ *
+ *  1. Wallet creation on deploy
+ *     • Keys generated with @noble/curves (secp256k1 or Ed25519)
+ *     • Private key is IMMEDIATELY encrypted with AES-256-GCM
+ *     • Encrypted bundle stored in stable memory (encryptedState field)
+ *
+ *  2. Message signing
+ *     • Decrypts private key ephemerally, signs, zeroes memory
+ *     • Produces signatures that validate against RFC 8032 / NIST test vectors
+ *
+ *  3. Key rotation
+ *     • Old private key is zeroed from memory before new keys are generated
+ *     • New keys are encrypted and replace the previous stable-memory entry
+ */
+import type { EncryptedKeyBundle } from './types.js';
+export type CurveType = 'secp256k1' | 'ed25519';
+/**
+ * The on-chain / stable-memory representation of a secure wallet.
+ * Private key material is NEVER present; only the encrypted bundle is stored.
+ */
+export interface SecureWalletState {
+    /** Curve used for key generation */
+    curve: CurveType;
+    /** Raw public key bytes (hex) – safe to store in plaintext */
+    publicKey: string;
+    /** AES-256-GCM encrypted private key bundle */
+    encryptedBundle: EncryptedKeyBundle;
+    /** Unix ms timestamp of initial creation */
+    createdAt: number;
+    /** Unix ms timestamp of last key rotation (undefined before first rotation) */
+    rotatedAt?: number;
+}
+/**
+ * In-memory wallet handle returned after initialisation.
+ * Callers must retain the `encryptionKey` (passphrase) to perform signing or
+ * rotation; it is never stored inside SecureWallet.
+ */
+export interface WalletHandle {
+    state: SecureWalletState;
+}
+/**
+ * SecureWallet manages an asymmetric keypair whose private key is always
+ * stored encrypted with AES-256-GCM and never persisted in plaintext.
+ *
+ * All operations that require the private key (sign, rotateKeys) accept the
+ * caller-supplied passphrase, decrypt ephemerally, operate, then zero the
+ * ephemeral buffer.
+ */
+export declare class SecureWallet {
+    /** Stable-memory / on-chain state – safe to serialise and store */
+    private _state;
+    /**
+     * Initialise the wallet: generate a keypair with @noble/curves and
+     * immediately encrypt the private key with AES-256-GCM.
+     *
+     * The plaintext private key exists in memory only for the duration of this
+     * call and is zeroed before the method returns.
+     *
+     * @param passphrase  - Secret used as AES key material (e.g. BIP39 mnemonic
+     *                      or randomly generated deployment secret).
+     * @param curve       - 'secp256k1' (Ethereum/Polkadot) or 'ed25519'
+     *                      (Solana/ICP/Arweave). Defaults to 'ed25519'.
+     */
+    initialize(passphrase: string, curve?: CurveType): WalletHandle;
+    /**
+     * Sign an arbitrary message.
+     *
+     * The private key is decrypted ephemerally for the duration of the signing
+     * operation and zeroed before this method returns.
+     *
+     * For Ed25519:  returns a 64-byte raw signature.
+     * For secp256k1: returns a 64-byte compact (r || s) DER-free signature.
+     *
+     * @param message     - Raw message bytes to sign.
+     * @param passphrase  - Passphrase used during `initialize()`.
+     */
+    sign(message: Uint8Array, passphrase: string): Uint8Array;
+    /**
+     * Sign a pre-hashed digest directly (useful for secp256k1 ECDSA where the
+     * caller controls hashing, e.g. for NIST test-vector validation).
+     *
+     * Only supported on secp256k1 wallets.
+     */
+    signDigest(digest: Uint8Array, passphrase: string): Uint8Array;
+    /**
+     * Verify a signature against the wallet's current public key.
+     *
+     * For Ed25519 and secp256k1 this is a pure-public-key operation – no
+     * passphrase required.
+     *
+     * @param message   - Original raw message bytes.
+     * @param signature - Signature bytes returned by `sign()`.
+     */
+    verify(message: Uint8Array, signature: Uint8Array): boolean;
+    /**
+     * Verify a secp256k1 signature against a pre-hashed digest.
+     */
+    verifyDigest(digest: Uint8Array, signature: Uint8Array): boolean;
+    /**
+     * Rotate keys: decrypt the old private key, zero it, generate new keys, and
+     * encrypt the new private key with AES-256-GCM.
+     *
+     * After this call the wallet's `publicKey` and `encryptedBundle` are updated
+     * atomically; the old key material is zeroed.
+     *
+     * @param currentPassphrase - Passphrase used to decrypt the current key.
+     * @param newPassphrase     - Passphrase to encrypt the new key.  May be the
+     *                            same as `currentPassphrase`.
+     */
+    rotateKeys(currentPassphrase: string, newPassphrase: string): WalletHandle;
+    /** Returns the current stable-memory state (safe to serialise). */
+    get state(): SecureWalletState;
+    /** True once `initialize()` has been called. */
+    get isInitialized(): boolean;
+    private _requireState;
+    private _decryptPrivateKey;
+}
+/**
+ * Create and immediately initialise a SecureWallet in one call.
+ *
+ * @param passphrase - Passphrase for AES-256-GCM key derivation.
+ * @param curve      - Key curve ('secp256k1' | 'ed25519', default 'ed25519').
+ */
+export declare function createSecureWallet(passphrase: string, curve?: CurveType): {
+    wallet: SecureWallet;
+    handle: WalletHandle;
+};
+//# sourceMappingURL=secure-wallet.d.ts.map

package/dist/src/wallet/secure-wallet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-wallet.d.ts","sourceRoot":"","sources":["../../../src/wallet/secure-wallet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAMrD,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAEhD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,oCAAoC;IACpC,KAAK,EAAE,SAAS,CAAC;IACjB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,eAAe,EAAE,kBAAkB,CAAC;IACpC,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,iBAAiB,CAAC;CAC1B;AA6BD;;;;;;;GAOG;AACH,qBAAa,YAAY;IACvB,mEAAmE;IACnE,OAAO,CAAC,MAAM,CAAkC;IAMhD;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,SAAqB,GAAG,YAAY;IAoD1E;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU;IA6BzD;;;;;OAKG;IACH,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU;IAwB9D;;;;;;;;OAQG;IACH,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO;IAY3D;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO;IAahE;;;;;;;;;;OAUG;IACH,UAAU,CAAC,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,YAAY;IAyD1E,mEAAmE;IACnE,IAAI,KAAK,IAAI,iBAAiB,CAE7B;IAED,gDAAgD;IAChD,IAAI,aAAa,IAAI,OAAO,CAE3B;IAMD,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,kBAAkB;CAY3B;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,SAAqB,GAC3B;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAIhD"}

package/dist/src/wallet/secure-wallet.js

@@ -0,0 +1,298 @@
+/**
+ * SecureWallet – deploy-time wallet with real cryptography
+ *
+ * Implements the three BDD scenarios:
+ *
+ *  1. Wallet creation on deploy
+ *     • Keys generated with @noble/curves (secp256k1 or Ed25519)
+ *     • Private key is IMMEDIATELY encrypted with AES-256-GCM
+ *     • Encrypted bundle stored in stable memory (encryptedState field)
+ *
+ *  2. Message signing
+ *     • Decrypts private key ephemerally, signs, zeroes memory
+ *     • Produces signatures that validate against RFC 8032 / NIST test vectors
+ *
+ *  3. Key rotation
+ *     • Old private key is zeroed from memory before new keys are generated
+ *     • New keys are encrypted and replace the previous stable-memory entry
+ */
+import * as crypto from 'node:crypto';
+import { secp256k1 } from '@noble/curves/secp256k1';
+import { ed25519 } from '@noble/curves/ed25519';
+import { encryptSecret, decryptSecret, deriveStorageKey } from './wallet-crypto.js';
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+const SALT_BYTES = 32;
+/** Generate a fresh per-wallet salt and derive a 32-byte AES key */
+function freshKey(passphrase) {
+    const salt = crypto.randomBytes(SALT_BYTES);
+    const aesKey = deriveStorageKey(passphrase, salt);
+    return { salt, aesKey };
+}
+/** Overwrite a Buffer's contents with zeros to wipe sensitive data */
+function zeroBuffer(buf) {
+    buf.fill(0);
+}
+/** Overwrite a Uint8Array's contents with zeros */
+function zeroBytes(arr) {
+    arr.fill(0);
+}
+// ---------------------------------------------------------------------------
+// SecureWallet
+// ---------------------------------------------------------------------------
+/**
+ * SecureWallet manages an asymmetric keypair whose private key is always
+ * stored encrypted with AES-256-GCM and never persisted in plaintext.
+ *
+ * All operations that require the private key (sign, rotateKeys) accept the
+ * caller-supplied passphrase, decrypt ephemerally, operate, then zero the
+ * ephemeral buffer.
+ */
+export class SecureWallet {
+    /** Stable-memory / on-chain state – safe to serialise and store */
+    _state = null;
+    // -------------------------------------------------------------------------
+    // Scenario 1: Wallet creation on deploy
+    // -------------------------------------------------------------------------
+    /**
+     * Initialise the wallet: generate a keypair with @noble/curves and
+     * immediately encrypt the private key with AES-256-GCM.
+     *
+     * The plaintext private key exists in memory only for the duration of this
+     * call and is zeroed before the method returns.
+     *
+     * @param passphrase  - Secret used as AES key material (e.g. BIP39 mnemonic
+     *                      or randomly generated deployment secret).
+     * @param curve       - 'secp256k1' (Ethereum/Polkadot) or 'ed25519'
+     *                      (Solana/ICP/Arweave). Defaults to 'ed25519'.
+     */
+    initialize(passphrase, curve = 'ed25519') {
+        // 1. Generate raw entropy
+        const entropy = crypto.randomBytes(32);
+        // 2. Derive keypair via @noble/curves
+        let privateKeyBytes;
+        let publicKeyBytes;
+        if (curve === 'secp256k1') {
+            privateKeyBytes = secp256k1.utils.randomPrivateKey();
+            // Use our generated entropy as the private key
+            privateKeyBytes = entropy;
+            publicKeyBytes = secp256k1.getPublicKey(privateKeyBytes, true); // compressed
+        }
+        else {
+            // ed25519
+            privateKeyBytes = entropy;
+            publicKeyBytes = ed25519.getPublicKey(privateKeyBytes);
+        }
+        // 3. Encrypt the private key with AES-256-GCM immediately
+        const { salt, aesKey } = freshKey(passphrase);
+        const encryptedPrivateKey = encryptSecret(Buffer.from(privateKeyBytes).toString('hex'), aesKey);
+        // 4. Zero the plaintext private key and AES key from memory
+        zeroBytes(privateKeyBytes);
+        zeroBuffer(aesKey);
+        // 5. Build the encrypted bundle (stable-memory representation)
+        const bundle = {
+            version: 1,
+            salt: salt.toString('hex'),
+            privateKey: encryptedPrivateKey,
+        };
+        const state = {
+            curve,
+            publicKey: Buffer.from(publicKeyBytes).toString('hex'),
+            encryptedBundle: bundle,
+            createdAt: Date.now(),
+        };
+        this._state = state;
+        return { state };
+    }
+    // -------------------------------------------------------------------------
+    // Scenario 2: Message signing
+    // -------------------------------------------------------------------------
+    /**
+     * Sign an arbitrary message.
+     *
+     * The private key is decrypted ephemerally for the duration of the signing
+     * operation and zeroed before this method returns.
+     *
+     * For Ed25519:  returns a 64-byte raw signature.
+     * For secp256k1: returns a 64-byte compact (r || s) DER-free signature.
+     *
+     * @param message     - Raw message bytes to sign.
+     * @param passphrase  - Passphrase used during `initialize()`.
+     */
+    sign(message, passphrase) {
+        const state = this._requireState();
+        const { privateKeyHex, aesKey } = this._decryptPrivateKey(state.encryptedBundle, passphrase);
+        let signature;
+        try {
+            const privateKeyBytes = Buffer.from(privateKeyHex, 'hex');
+            if (state.curve === 'ed25519') {
+                signature = ed25519.sign(message, privateKeyBytes);
+            }
+            else {
+                // secp256k1 – SHA-256 the message first (standard practice)
+                const digest = crypto.createHash('sha256').update(message).digest();
+                const sig = secp256k1.sign(digest, privateKeyBytes);
+                signature = sig.toCompactRawBytes();
+            }
+            // Zero ephemeral key material
+            zeroBuffer(Buffer.from(privateKeyBytes));
+        }
+        finally {
+            zeroBuffer(aesKey);
+        }
+        return signature;
+    }
+    /**
+     * Sign a pre-hashed digest directly (useful for secp256k1 ECDSA where the
+     * caller controls hashing, e.g. for NIST test-vector validation).
+     *
+     * Only supported on secp256k1 wallets.
+     */
+    signDigest(digest, passphrase) {
+        const state = this._requireState();
+        if (state.curve !== 'secp256k1') {
+            throw new Error('signDigest is only supported for secp256k1 wallets');
+        }
+        const { privateKeyHex, aesKey } = this._decryptPrivateKey(state.encryptedBundle, passphrase);
+        let signature;
+        try {
+            const privateKeyBytes = Buffer.from(privateKeyHex, 'hex');
+            const sig = secp256k1.sign(digest, privateKeyBytes);
+            signature = sig.toCompactRawBytes();
+            zeroBuffer(Buffer.from(privateKeyBytes));
+        }
+        finally {
+            zeroBuffer(aesKey);
+        }
+        return signature;
+    }
+    /**
+     * Verify a signature against the wallet's current public key.
+     *
+     * For Ed25519 and secp256k1 this is a pure-public-key operation – no
+     * passphrase required.
+     *
+     * @param message   - Original raw message bytes.
+     * @param signature - Signature bytes returned by `sign()`.
+     */
+    verify(message, signature) {
+        const state = this._requireState();
+        const publicKeyBytes = Buffer.from(state.publicKey, 'hex');
+        if (state.curve === 'ed25519') {
+            return ed25519.verify(signature, message, publicKeyBytes);
+        }
+        else {
+            const digest = crypto.createHash('sha256').update(message).digest();
+            return secp256k1.verify(signature, digest, publicKeyBytes);
+        }
+    }
+    /**
+     * Verify a secp256k1 signature against a pre-hashed digest.
+     */
+    verifyDigest(digest, signature) {
+        const state = this._requireState();
+        if (state.curve !== 'secp256k1') {
+            throw new Error('verifyDigest is only supported for secp256k1 wallets');
+        }
+        const publicKeyBytes = Buffer.from(state.publicKey, 'hex');
+        return secp256k1.verify(signature, digest, publicKeyBytes);
+    }
+    // -------------------------------------------------------------------------
+    // Scenario 3: Key rotation
+    // -------------------------------------------------------------------------
+    /**
+     * Rotate keys: decrypt the old private key, zero it, generate new keys, and
+     * encrypt the new private key with AES-256-GCM.
+     *
+     * After this call the wallet's `publicKey` and `encryptedBundle` are updated
+     * atomically; the old key material is zeroed.
+     *
+     * @param currentPassphrase - Passphrase used to decrypt the current key.
+     * @param newPassphrase     - Passphrase to encrypt the new key.  May be the
+     *                            same as `currentPassphrase`.
+     */
+    rotateKeys(currentPassphrase, newPassphrase) {
+        const state = this._requireState();
+        // 1. Decrypt and zero the old private key
+        const { privateKeyHex, aesKey: oldAesKey } = this._decryptPrivateKey(state.encryptedBundle, currentPassphrase);
+        const oldPrivateKeyBuf = Buffer.from(privateKeyHex, 'hex');
+        zeroBuffer(oldPrivateKeyBuf);
+        zeroBuffer(oldAesKey);
+        // 2. Generate fresh key material
+        const newEntropy = crypto.randomBytes(32);
+        const newPrivateKeyBytes = newEntropy;
+        let newPublicKeyBytes;
+        if (state.curve === 'secp256k1') {
+            newPublicKeyBytes = secp256k1.getPublicKey(newPrivateKeyBytes, true);
+        }
+        else {
+            newPublicKeyBytes = ed25519.getPublicKey(newPrivateKeyBytes);
+        }
+        // 3. Encrypt new private key with AES-256-GCM using the new passphrase
+        const { salt: newSalt, aesKey: newAesKey } = freshKey(newPassphrase);
+        const encryptedNewKey = encryptSecret(Buffer.from(newPrivateKeyBytes).toString('hex'), newAesKey);
+        // 4. Zero new plaintext key material
+        zeroBytes(newPrivateKeyBytes);
+        zeroBuffer(newAesKey);
+        // 5. Atomically replace stable-memory state
+        const newBundle = {
+            version: 1,
+            salt: newSalt.toString('hex'),
+            privateKey: encryptedNewKey,
+        };
+        const newState = {
+            curve: state.curve,
+            publicKey: Buffer.from(newPublicKeyBytes).toString('hex'),
+            encryptedBundle: newBundle,
+            createdAt: state.createdAt,
+            rotatedAt: Date.now(),
+        };
+        this._state = newState;
+        return { state: newState };
+    }
+    // -------------------------------------------------------------------------
+    // Accessors
+    // -------------------------------------------------------------------------
+    /** Returns the current stable-memory state (safe to serialise). */
+    get state() {
+        return this._requireState();
+    }
+    /** True once `initialize()` has been called. */
+    get isInitialized() {
+        return this._state !== null;
+    }
+    // -------------------------------------------------------------------------
+    // Private helpers
+    // -------------------------------------------------------------------------
+    _requireState() {
+        if (!this._state) {
+            throw new Error('SecureWallet has not been initialized – call initialize() first');
+        }
+        return this._state;
+    }
+    _decryptPrivateKey(bundle, passphrase) {
+        if (!bundle.privateKey) {
+            throw new Error('No encrypted private key found in bundle');
+        }
+        const salt = Buffer.from(bundle.salt, 'hex');
+        const aesKey = deriveStorageKey(passphrase, salt);
+        const privateKeyHex = decryptSecret(bundle.privateKey, aesKey);
+        return { salt, privateKeyHex, aesKey };
+    }
+}
+// ---------------------------------------------------------------------------
+// Convenience factory
+// ---------------------------------------------------------------------------
+/**
+ * Create and immediately initialise a SecureWallet in one call.
+ *
+ * @param passphrase - Passphrase for AES-256-GCM key derivation.
+ * @param curve      - Key curve ('secp256k1' | 'ed25519', default 'ed25519').
+ */
+export function createSecureWallet(passphrase, curve = 'ed25519') {
+    const wallet = new SecureWallet();
+    const handle = wallet.initialize(passphrase, curve);
+    return { wallet, handle };
+}
+//# sourceMappingURL=secure-wallet.js.map

package/dist/src/wallet/secure-wallet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-wallet.js","sourceRoot":"","sources":["../../../src/wallet/secure-wallet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAmCpF,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,oEAAoE;AACpE,SAAS,QAAQ,CAAC,UAAkB;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,sEAAsE;AACtE,SAAS,UAAU,CAAC,GAAW;IAC7B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACd,CAAC;AAED,mDAAmD;AACnD,SAAS,SAAS,CAAC,GAAe;IAChC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,OAAO,YAAY;IACvB,mEAAmE;IAC3D,MAAM,GAA6B,IAAI,CAAC;IAEhD,4EAA4E;IAC5E,wCAAwC;IACxC,4EAA4E;IAE5E;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,UAAkB,EAAE,QAAmB,SAAS;QACzD,0BAA0B;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAEvC,sCAAsC;QACtC,IAAI,eAA2B,CAAC;QAChC,IAAI,cAA0B,CAAC;QAE/B,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC1B,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;YACrD,+CAA+C;YAC/C,eAAe,GAAG,OAAO,CAAC;YAC1B,cAAc,GAAG,SAAS,CAAC,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa;QAC/E,CAAC;aAAM,CAAC;YACN,UAAU;YACV,eAAe,GAAG,OAAO,CAAC;YAC1B,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;QACzD,CAAC;QAED,0DAA0D;QAC1D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,mBAAmB,GAAG,aAAa,CACvC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC5C,MAAM,CACP,CAAC;QAEF,4DAA4D;QAC5D,SAAS,CAAC,eAAe,CAAC,CAAC;QAC3B,UAAU,CAAC,MAAM,CAAC,CAAC;QAEnB,+DAA+D;QAC/D,MAAM,MAAM,GAAuB;YACjC,OAAO,EAAE,CAAC;YACV,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC1B,UAAU,EAAE,mBAAmB;SAChC,CAAC;QAEF,MAAM,KAAK,GAAsB;YAC/B,KAAK;YACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtD,eAAe,EAAE,MAAM;YACvB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,4EAA4E;IAC5E,8BAA8B;IAC9B,4EAA4E;IAE5E;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,OAAmB,EAAE,UAAkB;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,kBAAkB,CACvD,KAAK,CAAC,eAAe,EACrB,UAAU,CACX,CAAC;QAEF,IAAI,SAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YAE1D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC9B,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,4DAA4D;gBAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;gBACpE,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;gBACpD,SAAS,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC;YACtC,CAAC;YAED,8BAA8B;YAC9B,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;QAC3C,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,MAAkB,EAAE,UAAkB;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,kBAAkB,CACvD,KAAK,CAAC,eAAe,EACrB,UAAU,CACX,CAAC;QAEF,IAAI,SAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YACpD,SAAS,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC;YACpC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;QAC3C,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,OAAmB,EAAE,SAAqB;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAE3D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;YACpE,OAAO,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAkB,EAAE,SAAqB;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC3D,OAAO,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IAC7D,CAAC;IAED,4EAA4E;IAC5E,2BAA2B;IAC3B,4EAA4E;IAE5E;;;;;;;;;;OAUG;IACH,UAAU,CAAC,iBAAyB,EAAE,aAAqB;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAEnC,0CAA0C;QAC1C,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAClE,KAAK,CAAC,eAAe,EACrB,iBAAiB,CAClB,CAAC;QACF,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAC3D,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC7B,UAAU,CAAC,SAAS,CAAC,CAAC;QAEtB,iCAAiC;QACjC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,kBAAkB,GAAe,UAAU,CAAC;QAClD,IAAI,iBAA6B,CAAC;QAElC,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAChC,iBAAiB,GAAG,SAAS,CAAC,YAAY,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;QAC/D,CAAC;QAED,uEAAuE;QACvE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;QACrE,MAAM,eAAe,GAAG,aAAa,CACnC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC/C,SAAS,CACV,CAAC;QAEF,qCAAqC;QACrC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC9B,UAAU,CAAC,SAAS,CAAC,CAAC;QAEtB,4CAA4C;QAC5C,MAAM,SAAS,GAAuB;YACpC,OAAO,EAAE,CAAC;YACV,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC7B,UAAU,EAAE,eAAe;SAC5B,CAAC;QAEF,MAAM,QAAQ,GAAsB;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACzD,eAAe,EAAE,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED,4EAA4E;IAC5E,YAAY;IACZ,4EAA4E;IAE5E,mEAAmE;IACnE,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC;IAC9B,CAAC;IAED,gDAAgD;IAChD,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;IAC9B,CAAC;IAED,4EAA4E;IAC5E,kBAAkB;IAClB,4EAA4E;IAEpE,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,kBAAkB,CACxB,MAA0B,EAC1B,UAAkB;QAElB,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC;CACF;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAAkB,EAClB,QAAmB,SAAS;IAE5B,MAAM,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACpD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC"}

package/dist/src/wallet/transaction-queue.d.ts

@@ -0,0 +1,133 @@
+/**
+ * Transaction Queue Processor (Phase 5B)
+ *
+ * Advanced transaction queue with priority, retries, and scheduling.
+ * Handles agent-initiated transactions queued in canister.
+ */
+import type { WalletData, TransactionRequest, SignedTransaction } from './types.js';
+/**
+ * Transaction action type
+ */
+export type TransactionAction = 'send_funds' | 'sign_message' | 'deploy_contract';
+/**
+ * Transaction priority
+ */
+export type TransactionPriority = 'low' | 'normal' | 'high';
+/**
+ * Transaction status
+ */
+export type TransactionStatus = 'pending' | 'queued' | 'signed' | 'completed' | 'failed';
+/**
+ * Queued transaction from canister
+ */
+export interface QueuedTransaction {
+    id: string;
+    action: {
+        walletId: string;
+        action: TransactionAction;
+        parameters: [string, string][];
+        priority: TransactionPriority;
+        threshold?: number;
+    };
+    status: TransactionStatus;
+    result?: string;
+    retryCount: number;
+    scheduledAt?: number;
+    createdAt: number;
+    signedAt?: number;
+    completedAt?: number;
+    errorMessage?: string;
+}
+/**
+ * Queue statistics
+ */
+export interface QueueStats {
+    total: number;
+    pending: number;
+    queued: number;
+    signed: number;
+    completed: number;
+    failed: number;
+}
+/**
+ * Process result
+ */
+export interface ProcessResult {
+    transactionId: string;
+    success: boolean;
+    txHash?: string;
+    error?: string;
+    processedAt: number;
+}
+/**
+ * Transaction queue processor
+ */
+export declare class TransactionQueueProcessor {
+    private actor;
+    private maxRetries;
+    constructor(_canisterId: string, actor: any, options?: {
+        maxRetries?: number;
+        retryDelay?: number;
+    });
+    /**
+     * Fetch pending transactions from canister
+     */
+    fetchPendingTransactions(): Promise<QueuedTransaction[]>;
+    /**
+     * Process all pending transactions
+     *
+     * @param signCallback - Callback to sign transactions
+     * @returns Processing results
+     */
+    processPendingTransactions(signCallback: (wallet: WalletData, action: TransactionRequest) => Promise<SignedTransaction | null>): Promise<ProcessResult[]>;
+    /**
+     * Process a single transaction
+     */
+    private processTransaction;
+    /**
+     * Map canister action to transaction request
+     */
+    private mapActionToRequest;
+    /**
+     * Mark transaction as signed in canister
+     */
+    private markSigned;
+    /**
+     * Mark transaction as failed in canister
+     */
+    private markFailed;
+    /**
+     * Mark transaction as completed in canister
+     */
+    markCompleted(txId: string, txHash: string): Promise<void>;
+    /**
+     * Get queue statistics
+     */
+    getStats(): Promise<QueueStats | null>;
+    /**
+     * Schedule transaction for future execution
+     */
+    scheduleTransaction(txId: string, scheduledAt: Date): Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+    /**
+     * Clear completed transactions
+     */
+    clearCompleted(): Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+}
+/**
+ * Create transaction queue processor
+ *
+ * @param canisterId - Canister ID
+ * @param actor - Canister actor instance
+ * @returns Queue processor instance
+ */
+export declare function createQueueProcessor(canisterId: string, actor: any, options?: {
+    maxRetries?: number;
+    retryDelay?: number;
+}): TransactionQueueProcessor;
+//# sourceMappingURL=transaction-queue.d.ts.map

package/dist/src/wallet/transaction-queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction-queue.d.ts","sourceRoot":"","sources":["../../../src/wallet/transaction-queue.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAEpB;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,cAAc,GAAG,iBAAiB,CAAC;AAElF;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE5D;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEzF;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,iBAAiB,CAAC;QAC1B,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAC/B,QAAQ,EAAE,mBAAmB,CAAC;QAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,MAAM,EAAE,iBAAiB,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,KAAK,CAAM;IACnB,OAAO,CAAC,UAAU,CAAS;gBAEf,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;IAKnG;;OAEG;IACG,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAS9D;;;;;OAKG;IACG,0BAA0B,CAC9B,YAAY,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAClG,OAAO,CAAC,aAAa,EAAE,CAAC;IAY3B;;OAEG;YACW,kBAAkB;IA0DhC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAa1B;;OAEG;YACW,UAAU;IAQxB;;OAEG;YACW,UAAU;IAQxB;;OAEG;IACG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhE;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAS5C;;OAEG;IACG,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAYzG;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAWtE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,GAAG,EACV,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACrD,yBAAyB,CAE3B"}