agentvault 1.0.1 → 1.0.5

package/dist/src/wallet/vetkeys-adapter.js

@@ -0,0 +1,304 @@
+/**
+ * VetKeys Adapter (Phase 5D)
+ *
+ * Mock VetKeys canister integration for threshold signatures.
+ * Uses local-only implementation until VetKeys canister is deployed.
+ */
+import { debugLog } from '../debugging/debug-logger.js';
+/**
+ * VetKeys adapter
+ *
+ * VetKeys integration with optional canister support.
+ * Real VetKeys canister integration requires canisterId to be set.
+ */
+export class VetKeysAdapter {
+    options;
+    canisterId;
+    constructor(options = {}) {
+        this.options = {
+            threshold: options.threshold ?? 2,
+            totalParties: options.totalParties ?? 3,
+            encryptionAlgorithm: options.encryptionAlgorithm ?? 'aes-256-gcm',
+            canisterId: options.canisterId,
+        };
+        this.canisterId = options.canisterId;
+    }
+    /**
+     * Encrypt secret for canister storage
+     *
+     * @param secret - Secret data to encrypt
+     * @param transactionId - Transaction ID for reference
+     * @returns Encrypted secret
+     */
+    async encryptSecret(secret, transactionId) {
+        const crypto = await import('node:crypto');
+        const key = crypto.randomBytes(32);
+        const iv = crypto.randomBytes(12);
+        const cipher = crypto.createCipheriv(this.options.encryptionAlgorithm === 'aes-256-gcm' ? 'aes-256-gcm' : 'chacha20-poly1305', key, iv);
+        let encrypted;
+        let tag;
+        if (this.options.encryptionAlgorithm === 'aes-256-gcm') {
+            const enc = cipher;
+            encrypted = Buffer.concat([
+                enc.update(secret, 'utf8'),
+                enc.final(),
+            ]);
+            tag = enc.getAuthTag();
+        }
+        else {
+            encrypted = Buffer.concat([
+                cipher.update(secret, 'utf8'),
+                cipher.final(),
+            ]);
+            tag = Buffer.alloc(0);
+        }
+        return {
+            id: transactionId || `secret_${Date.now()}`,
+            ciphertext: new Uint8Array(encrypted),
+            iv: new Uint8Array(iv),
+            tag: new Uint8Array(tag),
+            createdAt: Date.now(),
+        };
+    }
+    /**
+     * Decrypt secret from canister
+     *
+     * @param encrypted - Encrypted secret data
+     * @param key - Decryption key
+     * @returns Decrypted secret
+     */
+    async decryptSecret(encrypted, key) {
+        const crypto = await import('node:crypto');
+        const decipher = crypto.createDecipheriv(this.options.encryptionAlgorithm === 'aes-256-gcm' ? 'aes-256-gcm' : 'chacha20-poly1305', key, encrypted.iv);
+        if (this.options.encryptionAlgorithm === 'aes-256-gcm') {
+            decipher.setAuthTag(encrypted.tag);
+        }
+        const decrypted = Buffer.concat([
+            decipher.update(Buffer.from(encrypted.ciphertext)),
+            decipher.final(),
+        ]);
+        return decrypted.toString('utf8');
+    }
+    /**
+     * Initiate threshold signature (mock)
+     *
+     * @param transactionId - Transaction ID
+     * @param wallet - Wallet to use
+     * @param request - Transaction request
+     * @returns Threshold signature result
+     */
+    async initiateThresholdSignature(transactionId, wallet, request) {
+        debugLog(`Initiating threshold signature for ${transactionId}...`);
+        if (this.options.threshold && this.options.threshold > 1) {
+            const { VetKeysImplementation } = await import('../security/vetkeys.js');
+            const client = new VetKeysImplementation({
+                threshold: this.options.threshold,
+                totalParties: this.options.totalParties,
+                encryptionAlgorithm: this.options.encryptionAlgorithm,
+            });
+            const mnemonic = wallet.mnemonic;
+            if (!mnemonic) {
+                throw new Error('Wallet mnemonic not available for threshold signing');
+            }
+            try {
+                const derived = await client.deriveThresholdKey(mnemonic);
+                debugLog('Threshold key derived successfully');
+                return {
+                    transactionId,
+                    success: true,
+                    partialSignatures: derived.shareMetadata.map((s) => s.encryptedShare),
+                    thresholdMet: (derived.threshold ?? 0) > 1,
+                };
+            }
+            catch (error) {
+                return {
+                    transactionId,
+                    success: false,
+                    error: error instanceof Error ? error.message : 'Unknown error',
+                    thresholdMet: false,
+                };
+            }
+        }
+        else {
+            debugLog('Threshold is 1, using direct signing');
+            const { createWalletProvider } = await import('./index.js');
+            const provider = createWalletProvider(wallet.chain, { isTestnet: false });
+            await provider.connect();
+            if (!wallet.privateKey) {
+                throw new Error('Wallet private key not available for signing');
+            }
+            const signed = await provider.signTransaction(request, wallet.privateKey);
+            return {
+                transactionId,
+                success: true,
+                signature: signed.signature,
+                thresholdMet: true,
+            };
+        }
+    }
+    /**
+     * Combine partial signatures
+     *
+     * IMPORTANT: This requires a deployed VetKeys canister for proper threshold
+     * signature combination. Without the canister, this implementation validates
+     * signature format but cannot perform cryptographic combination.
+     *
+     * @param partialSignatures - Array of partial signatures
+     * @param canisterConnected - Whether VetKeys canister is available
+     * @returns Combined signature or error
+     */
+    async combineSignatures(partialSignatures, canisterConnected = false) {
+        debugLog(`Combining ${partialSignatures.length} partial signatures...`);
+        const threshold = this.options.threshold ?? 2;
+        if (partialSignatures.length < threshold) {
+            return {
+                success: false,
+                error: `Insufficient signatures: ${partialSignatures.length}/${threshold} required`,
+            };
+        }
+        for (let i = 0; i < partialSignatures.length; i++) {
+            const sig = partialSignatures[i];
+            if (!sig || typeof sig !== 'string' || sig.length < 64) {
+                return {
+                    success: false,
+                    error: `Invalid partial signature at index ${i}: must be a valid hex string of at least 64 characters`,
+                };
+            }
+            if (!/^[0-9a-fA-F]+$/.test(sig)) {
+                return {
+                    success: false,
+                    error: `Invalid partial signature at index ${i}: must be hexadecimal`,
+                };
+            }
+        }
+        if (!canisterConnected) {
+            return {
+                success: false,
+                error: 'VetKeys canister not connected: threshold signature combination requires deployed VetKeys canister. Use single-party signing or deploy the VetKeys canister.',
+            };
+        }
+        try {
+            const crypto = await import('node:crypto');
+            const combinedData = Buffer.concat(partialSignatures.map((sig) => Buffer.from(sig, 'hex')));
+            const combined = crypto.createHash('sha256').update(combinedData).digest('hex');
+            debugLog('Signatures combined successfully (VetKeys canister mode)');
+            return {
+                success: true,
+                combinedSignature: combined,
+            };
+        }
+        catch (error) {
+            return {
+                success: false,
+                error: error instanceof Error ? error.message : 'Unknown error',
+            };
+        }
+    }
+    /**
+     * Verify threshold signature
+     *
+     * IMPORTANT: This requires a deployed VetKeys canister for proper threshold
+     * signature verification. Without the canister, this validates format only.
+     *
+     * @param signature - Signature to verify
+     * @param transaction - Transaction data
+     * @param canisterConnected - Whether VetKeys canister is available
+     * @returns Verification result
+     */
+    async verifySignature(signature, transaction, canisterConnected = false) {
+        debugLog('Verifying signature...');
+        if (!signature || typeof signature !== 'string') {
+            return { valid: false, error: 'Signature must be a non-empty string' };
+        }
+        if (signature.length < 64) {
+            return { valid: false, error: 'Signature must be at least 64 characters' };
+        }
+        if (!/^[0-9a-fA-F]+$/.test(signature)) {
+            return { valid: false, error: 'Signature must be hexadecimal' };
+        }
+        if (!transaction || typeof transaction !== 'object') {
+            return { valid: false, error: 'Transaction must be a valid object' };
+        }
+        if (!canisterConnected) {
+            debugLog('Warning: VetKeys canister not connected, signature format validated only');
+            return {
+                valid: false,
+                error: 'VetKeys canister not connected: threshold signature verification requires deployed VetKeys canister. Use single-party verification or deploy the VetKeys canister.',
+            };
+        }
+        try {
+            const crypto = await import('node:crypto');
+            const dataToVerify = JSON.stringify({
+                to: transaction.to,
+                amount: transaction.amount,
+                chain: transaction.chain,
+                memo: transaction.memo,
+            });
+            const expectedHash = crypto.createHash('sha256')
+                .update(dataToVerify)
+                .digest('hex');
+            const isValid = signature.includes(expectedHash.slice(0, 32));
+            if (isValid) {
+                debugLog('Signature verified successfully (VetKeys canister mode)');
+            }
+            else {
+                debugLog('Signature verification failed');
+            }
+            return { valid: isValid };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                error: error instanceof Error ? error.message : 'Unknown error',
+            };
+        }
+    }
+    /**
+     * Get VetKeys status
+     *
+     * @returns VetKeys configuration status
+     */
+    getStatus() {
+        return {
+            thresholdSupported: true,
+            currentThreshold: this.options.threshold ?? 2,
+            totalParties: this.options.totalParties ?? 3,
+            encryptionAlgorithm: this.options.encryptionAlgorithm ?? 'aes-256-gcm',
+            mode: this.canisterId ? 'production' : 'mock',
+        };
+    }
+    /**
+     * Check if canister is connected
+     *
+     * Attempts to ping the VetKeys canister to verify connectivity.
+     * Returns false if canisterId is not configured or canister is unreachable.
+     *
+     * @returns True if VetKeys canister is accessible
+     */
+    async isCanisterConnected() {
+        if (!this.canisterId) {
+            return false;
+        }
+        try {
+            const { createActor } = await import('../canister/actor.js');
+            const actor = createActor(this.canisterId);
+            const status = await actor.getVetKeysStatus();
+            return status && typeof status === 'object' && 'enabled' in status;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            debugLog(`VetKeys canister not accessible: ${message}`);
+            return false;
+        }
+    }
+}
+/**
+ * Create VetKeys adapter
+ *
+ * @param options - Adapter options
+ * @returns VetKeys adapter instance
+ */
+export function createVetKeysAdapter(options) {
+    return new VetKeysAdapter(options);
+}
+//# sourceMappingURL=vetkeys-adapter.js.map

package/dist/src/wallet/vetkeys-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vetkeys-adapter.js","sourceRoot":"","sources":["../../../src/wallet/vetkeys-adapter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAoCxD;;;;;GAKG;AACH,MAAM,OAAO,cAAc;IACjB,OAAO,CAAwB;IAC/B,UAAU,CAAU;IAE5B,YAAY,UAAiC,EAAE;QAC7C,IAAI,CAAC,OAAO,GAAG;YACb,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;YACjC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;YACvC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,aAAa;YACjE,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,aAAsB;QAEtB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAE3C,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAElC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAClC,IAAI,CAAC,OAAO,CAAC,mBAAmB,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,mBAAmB,EACxF,GAAG,EACH,EAAE,CACH,CAAC;QAEF,IAAI,SAAiB,CAAC;QACtB,IAAI,GAAW,CAAC;QAEhB,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,KAAK,aAAa,EAAE,CAAC;YACvD,MAAM,GAAG,GAAG,MAAa,CAAC;YAC1B,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;gBACxB,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;gBAC1B,GAAG,CAAC,KAAK,EAAE;aACZ,CAAC,CAAC;YACH,GAAG,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;gBACxB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;gBAC7B,MAAM,CAAC,KAAK,EAAE;aACf,CAAC,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QAED,OAAO;YACL,EAAE,EAAE,aAAa,IAAI,UAAU,IAAI,CAAC,GAAG,EAAE,EAAE;YAC3C,UAAU,EAAE,IAAI,UAAU,CAAC,SAAS,CAAC;YACrC,EAAE,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC;YACtB,GAAG,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC;YACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CACjB,SAA0B,EAC1B,GAAW;QAEX,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAE3C,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CACtC,IAAI,CAAC,OAAO,CAAC,mBAAmB,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,mBAAmB,EACxF,GAAG,EACH,SAAS,CAAC,EAAE,CACb,CAAC;QAEF,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,KAAK,aAAa,EAAE,CAAC;YACtD,QAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAClD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,0BAA0B,CAC9B,aAAqB,EACrB,MAAkB,EAClB,OAA2B;QAE3B,QAAQ,CAAC,sCAAsC,aAAa,KAAK,CAAC,CAAC;QAEnE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;YACzD,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;YAEzE,MAAM,MAAM,GAAG,IAAI,qBAAqB,CAAC;gBACvC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;gBACjC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;gBACvC,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB;aACtD,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAEjC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;gBAE1D,QAAQ,CAAC,oCAAoC,CAAC,CAAC;gBAE/C,OAAO;oBACL,aAAa;oBACb,OAAO,EAAE,IAAI;oBACb,iBAAiB,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;oBACrE,YAAY,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC;iBAC3C,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,aAAa;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;oBAC/D,YAAY,EAAE,KAAK;iBACpB,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,sCAAsC,CAAC,CAAC;YAEjD,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YAC5D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAE1E,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YAEzB,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAE1E,OAAO;gBACL,aAAa;gBACb,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,YAAY,EAAE,IAAI;aACnB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,iBAAiB,CACrB,iBAA2B,EAC3B,oBAA6B,KAAK;QAElC,QAAQ,CAAC,aAAa,iBAAiB,CAAC,MAAM,wBAAwB,CAAC,CAAC;QAExE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;QAE9C,IAAI,iBAAiB,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YACzC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,4BAA4B,iBAAiB,CAAC,MAAM,IAAI,SAAS,WAAW;aACpF,CAAC;QACJ,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACvD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,sCAAsC,CAAC,wDAAwD;iBACvG,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,sCAAsC,CAAC,uBAAuB;iBACtE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,8JAA8J;aACtK,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YAE3C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAChC,iBAAiB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CACxD,CAAC;YAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEhF,QAAQ,CAAC,0DAA0D,CAAC,CAAC;YAErE,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,iBAAiB,EAAE,QAAQ;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;aAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,eAAe,CACnB,SAAiB,EACjB,WAA+B,EAC/B,oBAA6B,KAAK;QAElC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;QAEnC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;QACzE,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;QAC7E,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,QAAQ,CAAC,0EAA0E,CAAC,CAAC;YACrF,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,oKAAoK;aAC5K,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YAE3C,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;gBAClC,EAAE,EAAE,WAAW,CAAC,EAAE;gBAClB,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,IAAI,EAAE,WAAW,CAAC,IAAI;aACvB,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;iBAC7C,MAAM,CAAC,YAAY,CAAC;iBACpB,MAAM,CAAC,KAAK,CAAC,CAAC;YAEjB,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAE9D,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,CAAC,yDAAyD,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,+BAA+B,CAAC,CAAC;YAC5C,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;aAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,SAAS;QAOP,OAAO;YACL,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC;YAC7C,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC;YAC5C,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,aAAa;YACtE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM;SAC9C,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,mBAAmB;QACvB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAE3C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAE9C,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,SAAS,IAAI,MAAM,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,QAAQ,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA+B;IAE/B,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC"}

package/dist/src/wallet/wallet-crypto.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Wallet Crypto Module
+ *
+ * Provides cryptographic primitives for wallet key generation and at-rest
+ * encryption using industry-standard algorithms:
+ *
+ *   - secp256k1 ECDSA (Ethereum / Polkadot) via @noble/curves
+ *   - Ed25519 EdDSA (Solana / ICP / Arweave)  via @noble/curves
+ *   - AES-256-GCM authenticated encryption for private keys / mnemonics
+ *   - PBKDF2-SHA256 (210 000 iterations) for storage-key derivation
+ *
+ * Private keys and mnemonics are NEVER stored in plaintext.  When a
+ * caller supplies an encryptionKey (the wallet's BIP39 mnemonic) the
+ * sensitive fields are encrypted into an EncryptedKeyBundle before the
+ * wallet is written to disk.
+ */
+import type { EncryptedCiphertext, WalletData } from './types.js';
+/**
+ * Derive a secp256k1 keypair from a 32-byte seed.
+ *
+ * Uses @noble/curves/secp256k1 – the same underlying library used by ethers
+ * and most modern JS wallets.  The uncompressed public key (65 bytes,
+ * 0x04 prefix) is returned so callers can choose their own encoding.
+ *
+ * @param seed - 32 bytes of key material (e.g. from BIP32 derivation)
+ */
+export declare function secp256k1KeypairFromSeed(seed: Uint8Array): {
+    privateKey: Uint8Array;
+    publicKeyUncompressed: Uint8Array;
+    publicKeyCompressed: Uint8Array;
+};
+/**
+ * Derive an Ed25519 keypair from a 32-byte seed.
+ *
+ * Uses @noble/curves/ed25519.  The private key is the raw 32-byte seed;
+ * the public key is the 32-byte Ed25519 point.
+ *
+ * @param seed - 32 bytes of key material
+ */
+export declare function ed25519KeypairFromSeed(seed: Uint8Array): {
+    privateKey: Uint8Array;
+    publicKey: Uint8Array;
+};
+/**
+ * Derive a 32-byte AES-256-GCM key from a BIP39 mnemonic and a random salt
+ * using PBKDF2-SHA256.
+ *
+ * The per-wallet salt ensures that two wallets encrypted with the same
+ * mnemonic produce independent keys, preventing cross-wallet key reuse.
+ *
+ * @param mnemonic - BIP39 mnemonic (the wallet owner's seed phrase)
+ * @param salt     - 32-byte random per-wallet salt (stored alongside ciphertext)
+ */
+export declare function deriveStorageKey(mnemonic: string, salt: Buffer): Buffer;
+/**
+ * Encrypt a UTF-8 plaintext string with AES-256-GCM.
+ *
+ * A fresh 12-byte IV is generated for every call.  The authentication tag
+ * is stored alongside the ciphertext so that any tampering is detected on
+ * decryption.
+ *
+ * @param plaintext - The string to encrypt (private key hex or mnemonic)
+ * @param key       - 32-byte AES key (output of deriveStorageKey)
+ */
+export declare function encryptSecret(plaintext: string, key: Buffer): EncryptedCiphertext;
+/**
+ * Decrypt an AES-256-GCM ciphertext produced by encryptSecret.
+ *
+ * Throws if the authentication tag does not match (tamper detection).
+ *
+ * @param encrypted - EncryptedCiphertext produced by encryptSecret
+ * @param key       - 32-byte AES key (must match the key used for encryption)
+ */
+export declare function decryptSecret(encrypted: EncryptedCiphertext, key: Buffer): string;
+/**
+ * Encrypt a wallet's sensitive fields (privateKey and/or mnemonic) using
+ * AES-256-GCM with a key derived from the supplied mnemonic + a fresh
+ * random salt.
+ *
+ * The returned wallet has:
+ *   - privateKey  set to undefined
+ *   - mnemonic    set to undefined
+ *   - encryptedSecrets populated with the ciphertext bundle
+ *
+ * The in-memory wallet object passed in is not mutated.
+ *
+ * @param wallet   - Wallet whose secrets should be encrypted
+ * @param mnemonic - BIP39 mnemonic used as key-derivation material
+ */
+export declare function encryptWalletSecrets(wallet: WalletData, mnemonic: string): WalletData;
+/**
+ * Decrypt a wallet's EncryptedKeyBundle back into plaintext fields.
+ *
+ * If the wallet has no encryptedSecrets the wallet is returned unchanged.
+ * Throws if the mnemonic is wrong (AES-GCM authentication will fail).
+ *
+ * @param wallet   - Wallet with encryptedSecrets populated
+ * @param mnemonic - BIP39 mnemonic used as key-derivation material
+ */
+export declare function decryptWalletSecrets(wallet: WalletData, mnemonic: string): WalletData;
+//# sourceMappingURL=wallet-crypto.d.ts.map

package/dist/src/wallet/wallet-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-crypto.d.ts","sourceRoot":"","sources":["../../../src/wallet/wallet-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAsB,UAAU,EAAE,MAAM,YAAY,CAAC;AAsBtF;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,UAAU,GAAG;IAC1D,UAAU,EAAE,UAAU,CAAC;IACvB,qBAAqB,EAAE,UAAU,CAAC;IAClC,mBAAmB,EAAE,UAAU,CAAC;CACjC,CAKA;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,UAAU,GAAG;IACxD,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,UAAU,CAAC;CACvB,CAIA;AAMD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvE;AAMD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAcjF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,mBAAmB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAcjF;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CAsBrF;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CAmBrF"}

package/dist/src/wallet/wallet-crypto.js

@@ -0,0 +1,185 @@
+/**
+ * Wallet Crypto Module
+ *
+ * Provides cryptographic primitives for wallet key generation and at-rest
+ * encryption using industry-standard algorithms:
+ *
+ *   - secp256k1 ECDSA (Ethereum / Polkadot) via @noble/curves
+ *   - Ed25519 EdDSA (Solana / ICP / Arweave)  via @noble/curves
+ *   - AES-256-GCM authenticated encryption for private keys / mnemonics
+ *   - PBKDF2-SHA256 (210 000 iterations) for storage-key derivation
+ *
+ * Private keys and mnemonics are NEVER stored in plaintext.  When a
+ * caller supplies an encryptionKey (the wallet's BIP39 mnemonic) the
+ * sensitive fields are encrypted into an EncryptedKeyBundle before the
+ * wallet is written to disk.
+ */
+import * as crypto from 'node:crypto';
+import { secp256k1 } from '@noble/curves/secp256k1';
+import { ed25519 } from '@noble/curves/ed25519';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** PBKDF2 iteration count – OWASP 2023 recommendation for SHA-256 */
+const PBKDF2_ITERATIONS = 210_000;
+/** AES-256-GCM key length in bytes */
+const AES_KEY_BYTES = 32;
+/** AES-256-GCM IV length in bytes */
+const GCM_IV_BYTES = 12;
+/** PBKDF2 salt length in bytes */
+const SALT_BYTES = 32;
+// ---------------------------------------------------------------------------
+// Key-generation helpers (exported for use in key-derivation.ts)
+// ---------------------------------------------------------------------------
+/**
+ * Derive a secp256k1 keypair from a 32-byte seed.
+ *
+ * Uses @noble/curves/secp256k1 – the same underlying library used by ethers
+ * and most modern JS wallets.  The uncompressed public key (65 bytes,
+ * 0x04 prefix) is returned so callers can choose their own encoding.
+ *
+ * @param seed - 32 bytes of key material (e.g. from BIP32 derivation)
+ */
+export function secp256k1KeypairFromSeed(seed) {
+    const privateKey = seed.slice(0, 32);
+    const publicKeyUncompressed = secp256k1.getPublicKey(privateKey, false);
+    const publicKeyCompressed = secp256k1.getPublicKey(privateKey, true);
+    return { privateKey, publicKeyUncompressed, publicKeyCompressed };
+}
+/**
+ * Derive an Ed25519 keypair from a 32-byte seed.
+ *
+ * Uses @noble/curves/ed25519.  The private key is the raw 32-byte seed;
+ * the public key is the 32-byte Ed25519 point.
+ *
+ * @param seed - 32 bytes of key material
+ */
+export function ed25519KeypairFromSeed(seed) {
+    const privateKey = seed.slice(0, 32);
+    const publicKey = ed25519.getPublicKey(privateKey);
+    return { privateKey, publicKey };
+}
+// ---------------------------------------------------------------------------
+// Storage-key derivation
+// ---------------------------------------------------------------------------
+/**
+ * Derive a 32-byte AES-256-GCM key from a BIP39 mnemonic and a random salt
+ * using PBKDF2-SHA256.
+ *
+ * The per-wallet salt ensures that two wallets encrypted with the same
+ * mnemonic produce independent keys, preventing cross-wallet key reuse.
+ *
+ * @param mnemonic - BIP39 mnemonic (the wallet owner's seed phrase)
+ * @param salt     - 32-byte random per-wallet salt (stored alongside ciphertext)
+ */
+export function deriveStorageKey(mnemonic, salt) {
+    return crypto.pbkdf2Sync(mnemonic, salt, PBKDF2_ITERATIONS, AES_KEY_BYTES, 'sha256');
+}
+// ---------------------------------------------------------------------------
+// AES-256-GCM encrypt / decrypt
+// ---------------------------------------------------------------------------
+/**
+ * Encrypt a UTF-8 plaintext string with AES-256-GCM.
+ *
+ * A fresh 12-byte IV is generated for every call.  The authentication tag
+ * is stored alongside the ciphertext so that any tampering is detected on
+ * decryption.
+ *
+ * @param plaintext - The string to encrypt (private key hex or mnemonic)
+ * @param key       - 32-byte AES key (output of deriveStorageKey)
+ */
+export function encryptSecret(plaintext, key) {
+    const iv = crypto.randomBytes(GCM_IV_BYTES);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    const ciphertext = Buffer.concat([
+        cipher.update(plaintext, 'utf8'),
+        cipher.final(),
+    ]);
+    const tag = cipher.getAuthTag();
+    return {
+        iv: iv.toString('hex'),
+        ciphertext: ciphertext.toString('hex'),
+        tag: tag.toString('hex'),
+    };
+}
+/**
+ * Decrypt an AES-256-GCM ciphertext produced by encryptSecret.
+ *
+ * Throws if the authentication tag does not match (tamper detection).
+ *
+ * @param encrypted - EncryptedCiphertext produced by encryptSecret
+ * @param key       - 32-byte AES key (must match the key used for encryption)
+ */
+export function decryptSecret(encrypted, key) {
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, Buffer.from(encrypted.iv, 'hex'));
+    decipher.setAuthTag(Buffer.from(encrypted.tag, 'hex'));
+    const plaintext = Buffer.concat([
+        decipher.update(Buffer.from(encrypted.ciphertext, 'hex')),
+        decipher.final(),
+    ]);
+    return plaintext.toString('utf8');
+}
+// ---------------------------------------------------------------------------
+// Wallet-level encrypt / decrypt
+// ---------------------------------------------------------------------------
+/**
+ * Encrypt a wallet's sensitive fields (privateKey and/or mnemonic) using
+ * AES-256-GCM with a key derived from the supplied mnemonic + a fresh
+ * random salt.
+ *
+ * The returned wallet has:
+ *   - privateKey  set to undefined
+ *   - mnemonic    set to undefined
+ *   - encryptedSecrets populated with the ciphertext bundle
+ *
+ * The in-memory wallet object passed in is not mutated.
+ *
+ * @param wallet   - Wallet whose secrets should be encrypted
+ * @param mnemonic - BIP39 mnemonic used as key-derivation material
+ */
+export function encryptWalletSecrets(wallet, mnemonic) {
+    const salt = crypto.randomBytes(SALT_BYTES);
+    const key = deriveStorageKey(mnemonic, salt);
+    const bundle = {
+        version: 1,
+        salt: salt.toString('hex'),
+    };
+    if (wallet.privateKey) {
+        bundle.privateKey = encryptSecret(wallet.privateKey, key);
+    }
+    if (wallet.mnemonic) {
+        bundle.mnemonic = encryptSecret(wallet.mnemonic, key);
+    }
+    return {
+        ...wallet,
+        privateKey: undefined,
+        mnemonic: undefined,
+        encryptedSecrets: bundle,
+    };
+}
+/**
+ * Decrypt a wallet's EncryptedKeyBundle back into plaintext fields.
+ *
+ * If the wallet has no encryptedSecrets the wallet is returned unchanged.
+ * Throws if the mnemonic is wrong (AES-GCM authentication will fail).
+ *
+ * @param wallet   - Wallet with encryptedSecrets populated
+ * @param mnemonic - BIP39 mnemonic used as key-derivation material
+ */
+export function decryptWalletSecrets(wallet, mnemonic) {
+    if (!wallet.encryptedSecrets) {
+        return wallet;
+    }
+    const { encryptedSecrets } = wallet;
+    const salt = Buffer.from(encryptedSecrets.salt, 'hex');
+    const key = deriveStorageKey(mnemonic, salt);
+    const decrypted = {};
+    if (encryptedSecrets.privateKey) {
+        decrypted.privateKey = decryptSecret(encryptedSecrets.privateKey, key);
+    }
+    if (encryptedSecrets.mnemonic) {
+        decrypted.mnemonic = decryptSecret(encryptedSecrets.mnemonic, key);
+    }
+    return { ...wallet, ...decrypted };
+}
+//# sourceMappingURL=wallet-crypto.js.map

package/dist/src/wallet/wallet-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-crypto.js","sourceRoot":"","sources":["../../../src/wallet/wallet-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAGhD,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,qEAAqE;AACrE,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAElC,sCAAsC;AACtC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,qCAAqC;AACrC,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,kCAAkC;AAClC,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAgB;IAKvD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,MAAM,qBAAqB,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACxE,MAAM,mBAAmB,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACrE,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAgB;IAIrD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACnC,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,IAAY;IAC7D,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;AACvF,CAAC;AAED,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,GAAW;IAC1D,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEhC,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,SAA8B,EAAE,GAAW;IACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CACtC,aAAa,EACb,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CACjC,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAEvD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACzD,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAkB,EAAE,QAAgB;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAuB;QACjC,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;KAC3B,CAAC;IAEF,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,CAAC,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,CAAC,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,SAAS;QACrB,QAAQ,EAAE,SAAS;QACnB,gBAAgB,EAAE,MAAM;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAkB,EAAE,QAAgB;IACvE,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAE7C,MAAM,SAAS,GAAyD,EAAE,CAAC;IAE3E,IAAI,gBAAgB,CAAC,UAAU,EAAE,CAAC;QAChC,SAAS,CAAC,UAAU,GAAG,aAAa,CAAC,gBAAgB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,gBAAgB,CAAC,QAAQ,EAAE,CAAC;QAC9B,SAAS,CAAC,QAAQ,GAAG,aAAa,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;AACrC,CAAC"}