agentvault 1.0.2 → 1.0.5

package/dist/src/wallet/hsm/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * HSM / TEE Keygen Module
+ *
+ * Exports the public API for hardware-backed key generation.
+ *
+ * Quick-start:
+ *
+ *   import { createHsmProvider, isHsmAvailable } from './hsm/index.js';
+ *
+ *   const available = await isHsmAvailable('ledger');
+ *   if (available) {
+ *     const provider = await createHsmProvider('ledger');
+ *     // provider.getPublicKey() never exposes private key material
+ *   }
+ */
+export type { HsmBackend, HsmCurve, HsmProvider, HsmPublicKeyResult, HsmSignatureResult, HsmWalletMetadata, } from './types.js';
+export { HsmError, HsmNotAvailableError, HsmCurveUnsupportedError, HsmOperationError, } from './types.js';
+export { LedgerHsmProvider, isLedgerAvailable } from './ledger-provider.js';
+export { SgxHsmProvider, isSgxAvailable } from './sgx-provider.js';
+import type { HsmBackend, HsmProvider } from './types.js';
+/**
+ * Probe whether the given HSM backend is reachable without fully opening it.
+ *
+ * @param backend - 'ledger' or 'sgx'
+ * @returns `true` if the backend appears available.
+ */
+export declare function isHsmAvailable(backend: HsmBackend): Promise<boolean>;
+/**
+ * Instantiate and open an HSM provider for the given backend.
+ *
+ * The returned provider is already open (open() has been called).
+ * The caller is responsible for calling close() when done.
+ *
+ * @param backend - Which hardware backend to use ('ledger' | 'sgx').
+ * @param options - Backend-specific options (socketPath, enclavePath, …).
+ * @throws {HsmNotAvailableError} when the backend cannot be opened.
+ */
+export declare function createHsmProvider(backend: HsmBackend, options?: Record<string, string>): Promise<HsmProvider>;
+//# sourceMappingURL=index.d.ts.map

package/dist/src/wallet/hsm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/wallet/hsm/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,YAAY,EACV,UAAU,EACV,QAAQ,EACR,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAMnE,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAK1D;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAI1E;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,UAAU,EACnB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,OAAO,CAAC,WAAW,CAAC,CAatB"}

package/dist/src/wallet/hsm/index.js

@@ -0,0 +1,60 @@
+/**
+ * HSM / TEE Keygen Module
+ *
+ * Exports the public API for hardware-backed key generation.
+ *
+ * Quick-start:
+ *
+ *   import { createHsmProvider, isHsmAvailable } from './hsm/index.js';
+ *
+ *   const available = await isHsmAvailable('ledger');
+ *   if (available) {
+ *     const provider = await createHsmProvider('ledger');
+ *     // provider.getPublicKey() never exposes private key material
+ *   }
+ */
+export { HsmError, HsmNotAvailableError, HsmCurveUnsupportedError, HsmOperationError, } from './types.js';
+// Providers
+export { LedgerHsmProvider, isLedgerAvailable } from './ledger-provider.js';
+export { SgxHsmProvider, isSgxAvailable } from './sgx-provider.js';
+import { HsmNotAvailableError } from './types.js';
+import { LedgerHsmProvider, isLedgerAvailable } from './ledger-provider.js';
+import { SgxHsmProvider, isSgxAvailable } from './sgx-provider.js';
+/**
+ * Probe whether the given HSM backend is reachable without fully opening it.
+ *
+ * @param backend - 'ledger' or 'sgx'
+ * @returns `true` if the backend appears available.
+ */
+export async function isHsmAvailable(backend) {
+    if (backend === 'ledger')
+        return isLedgerAvailable();
+    if (backend === 'sgx')
+        return isSgxAvailable();
+    return false;
+}
+/**
+ * Instantiate and open an HSM provider for the given backend.
+ *
+ * The returned provider is already open (open() has been called).
+ * The caller is responsible for calling close() when done.
+ *
+ * @param backend - Which hardware backend to use ('ledger' | 'sgx').
+ * @param options - Backend-specific options (socketPath, enclavePath, …).
+ * @throws {HsmNotAvailableError} when the backend cannot be opened.
+ */
+export async function createHsmProvider(backend, options = {}) {
+    let provider;
+    if (backend === 'ledger') {
+        provider = new LedgerHsmProvider();
+    }
+    else if (backend === 'sgx') {
+        provider = new SgxHsmProvider(options);
+    }
+    else {
+        throw new HsmNotAvailableError(backend, `Unknown backend: ${backend}`);
+    }
+    await provider.open();
+    return provider;
+}
+//# sourceMappingURL=index.js.map

package/dist/src/wallet/hsm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/wallet/hsm/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAYH,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAEpB,YAAY;AACZ,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAOnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAmB;IACtD,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,iBAAiB,EAAE,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,cAAc,EAAE,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAmB,EACnB,UAAkC,EAAE;IAEpC,IAAI,QAAqB,CAAC;IAE1B,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;IACrC,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QAC7B,QAAQ,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,oBAAoB,CAAC,OAAqB,EAAE,oBAAoB,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtB,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/wallet/hsm/ledger-provider.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Ledger Hardware Wallet HSM Provider
+ *
+ * Offloads key generation and signing to a Ledger hardware wallet over USB HID.
+ * The device generates keys internally from its BIP39 seed phrase, which is
+ * entered on the physical keypad and NEVER transmitted to the host machine.
+ *
+ * Security properties:
+ *   - Private key is generated inside the Secure Element and never leaves it.
+ *   - BIP39 mnemonic is air-gapped on the device (entered via physical buttons).
+ *   - The host receives ONLY the derived public key and chain address.
+ *   - Transaction signing: the host sends an unsigned digest; the device returns
+ *     only the signature bytes.
+ *   - RAM dumps of the host process contain zero key material.
+ *
+ * Supported chains / apps (Ledger app must be open on device):
+ *   secp256k1: Ethereum app  → ckETH, Polkadot (ECDSA mode)
+ *   ed25519:   Solana app    → Solana, ICP, Arweave
+ *
+ * Dependencies (optional peer deps, dynamically imported):
+ *   @ledgerhq/hw-transport-node-hid  – USB HID transport
+ *   @ledgerhq/hw-app-eth             – Ethereum APDU client
+ *   @ledgerhq/hw-app-solana          – Solana APDU client
+ *
+ * Install with:
+ *   npm install @ledgerhq/hw-transport-node-hid @ledgerhq/hw-app-eth @ledgerhq/hw-app-solana
+ */
+import type { HsmProvider, HsmBackend, HsmCurve, HsmPublicKeyResult, HsmSignatureResult } from './types.js';
+/**
+ * HSM provider that delegates all key operations to a connected Ledger device.
+ *
+ * Usage:
+ * ```ts
+ * const ledger = new LedgerHsmProvider();
+ * await ledger.open();                          // connects over USB HID
+ * const { address } = await ledger.getPublicKey("m/44'/60'/0'/0/0", 'secp256k1');
+ * await ledger.close();
+ * ```
+ */
+export declare class LedgerHsmProvider implements HsmProvider {
+    readonly name = "Ledger Hardware Wallet";
+    readonly backend: HsmBackend;
+    readonly supportedCurves: ReadonlyArray<HsmCurve>;
+    private _transport;
+    private _deviceProduct;
+    private _deviceSerial;
+    open(): Promise<void>;
+    close(): Promise<void>;
+    getPublicKey(derivationPath: string, curve: HsmCurve): Promise<HsmPublicKeyResult>;
+    /**
+     * Retrieve secp256k1 public key from the Ledger Ethereum app.
+     * The device derives the key at `path` from its internal seed and returns
+     * only the public key + EIP-55 address.  No private key is transmitted.
+     */
+    private _getEthPublicKey;
+    /**
+     * Retrieve Ed25519 public key from the Ledger Solana app.
+     * Works for Solana, ICP, and Arweave (all use Ed25519).
+     * The host receives only the 32-byte public key; the private key stays sealed.
+     */
+    private _getSolanaPublicKey;
+    signDigest(derivationPath: string, digestHex: string, curve: HsmCurve): Promise<HsmSignatureResult>;
+    private _signEth;
+    private _signSolana;
+    deviceId(): Promise<string>;
+    private _assertOpen;
+}
+/**
+ * Quick check: is a Ledger device currently connected and unlocked?
+ *
+ * @returns `true` if at least one HID device is enumerable, `false` otherwise.
+ *          Does NOT verify that any particular Ledger app is open.
+ */
+export declare function isLedgerAvailable(): Promise<boolean>;
+//# sourceMappingURL=ledger-provider.d.ts.map

package/dist/src/wallet/hsm/ledger-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-provider.d.ts","sourceRoot":"","sources":["../../../../src/wallet/hsm/ledger-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAsCpB;;;;;;;;;;GAUG;AACH,qBAAa,iBAAkB,YAAW,WAAW;IACnD,QAAQ,CAAC,IAAI,4BAA4B;IACzC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAY;IACxC,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,QAAQ,CAAC,CAA4B;IAE7E,OAAO,CAAC,UAAU,CAAgC;IAClD,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,aAAa,CAAuB;IAMtC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgDrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAqBxF;;;;OAIG;YACW,gBAAgB;IA0B9B;;;;OAIG;YACW,mBAAmB;IAiC3B,UAAU,CACd,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC,kBAAkB,CAAC;YAqBhB,QAAQ;YAuBR,WAAW;IAuBnB,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IASjC,OAAO,CAAC,WAAW;CAQpB;AAMD;;;;;GAKG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAS1D"}

package/dist/src/wallet/hsm/ledger-provider.js

@@ -0,0 +1,272 @@
+/**
+ * Ledger Hardware Wallet HSM Provider
+ *
+ * Offloads key generation and signing to a Ledger hardware wallet over USB HID.
+ * The device generates keys internally from its BIP39 seed phrase, which is
+ * entered on the physical keypad and NEVER transmitted to the host machine.
+ *
+ * Security properties:
+ *   - Private key is generated inside the Secure Element and never leaves it.
+ *   - BIP39 mnemonic is air-gapped on the device (entered via physical buttons).
+ *   - The host receives ONLY the derived public key and chain address.
+ *   - Transaction signing: the host sends an unsigned digest; the device returns
+ *     only the signature bytes.
+ *   - RAM dumps of the host process contain zero key material.
+ *
+ * Supported chains / apps (Ledger app must be open on device):
+ *   secp256k1: Ethereum app  → ckETH, Polkadot (ECDSA mode)
+ *   ed25519:   Solana app    → Solana, ICP, Arweave
+ *
+ * Dependencies (optional peer deps, dynamically imported):
+ *   @ledgerhq/hw-transport-node-hid  – USB HID transport
+ *   @ledgerhq/hw-app-eth             – Ethereum APDU client
+ *   @ledgerhq/hw-app-solana          – Solana APDU client
+ *
+ * Install with:
+ *   npm install @ledgerhq/hw-transport-node-hid @ledgerhq/hw-app-eth @ledgerhq/hw-app-solana
+ */
+import { createHash } from 'node:crypto';
+import { HsmNotAvailableError, HsmCurveUnsupportedError, HsmOperationError, } from './types.js';
+// ---------------------------------------------------------------------------
+// Address derivation helpers (pure, no private key needed)
+// ---------------------------------------------------------------------------
+// LedgerHsmProvider
+// ---------------------------------------------------------------------------
+/**
+ * HSM provider that delegates all key operations to a connected Ledger device.
+ *
+ * Usage:
+ * ```ts
+ * const ledger = new LedgerHsmProvider();
+ * await ledger.open();                          // connects over USB HID
+ * const { address } = await ledger.getPublicKey("m/44'/60'/0'/0/0", 'secp256k1');
+ * await ledger.close();
+ * ```
+ */
+export class LedgerHsmProvider {
+    name = 'Ledger Hardware Wallet';
+    backend = 'ledger';
+    supportedCurves = ['secp256k1', 'ed25519'];
+    _transport = null;
+    _deviceProduct = null;
+    _deviceSerial = null;
+    // -------------------------------------------------------------------------
+    // Lifecycle
+    // -------------------------------------------------------------------------
+    async open() {
+        if (this._transport)
+            return; // already open
+        // Dynamically import – avoids hard dependency if Ledger is not installed.
+        let TransportNodeHid;
+        try {
+            const mod = await import('@ledgerhq/hw-transport-node-hid');
+            TransportNodeHid = mod.default ?? mod;
+        }
+        catch {
+            throw new HsmNotAvailableError('ledger', 'Package @ledgerhq/hw-transport-node-hid is not installed. ' +
+                'Run: npm install @ledgerhq/hw-transport-node-hid @ledgerhq/hw-app-eth @ledgerhq/hw-app-solana');
+        }
+        // Check that at least one device is reachable before trying to open.
+        let devices;
+        try {
+            devices = await TransportNodeHid.list();
+        }
+        catch (err) {
+            throw new HsmNotAvailableError('ledger', 'Failed to list HID devices: ' + String(err));
+        }
+        if (devices.length === 0) {
+            throw new HsmNotAvailableError('ledger', 'No Ledger device found. Connect the device, unlock it, and open the correct app.');
+        }
+        try {
+            this._transport = await TransportNodeHid.create();
+        }
+        catch (err) {
+            throw new HsmNotAvailableError('ledger', 'Could not open HID transport: ' + String(err));
+        }
+        // Capture device identity for later.
+        this._deviceProduct = this._transport.deviceModel?.productName ?? 'Ledger';
+        // Use a hash of the product name + current open time as a stable-enough ID.
+        this._deviceSerial =
+            this._transport.deviceModel?.id ??
+                createHash('sha256')
+                    .update(this._deviceProduct + '-' + Date.now())
+                    .digest('hex')
+                    .slice(0, 16);
+    }
+    async close() {
+        if (this._transport) {
+            await this._transport.close().catch(() => { });
+            this._transport = null;
+        }
+    }
+    // -------------------------------------------------------------------------
+    // Public key retrieval
+    // -------------------------------------------------------------------------
+    async getPublicKey(derivationPath, curve) {
+        this._assertOpen();
+        if (!this.supportedCurves.includes(curve)) {
+            throw new HsmCurveUnsupportedError('ledger', curve);
+        }
+        try {
+            if (curve === 'secp256k1') {
+                return await this._getEthPublicKey(derivationPath);
+            }
+            else {
+                return await this._getSolanaPublicKey(derivationPath);
+            }
+        }
+        catch (err) {
+            if (err instanceof HsmNotAvailableError || err instanceof HsmCurveUnsupportedError) {
+                throw err;
+            }
+            throw new HsmOperationError('ledger', 'getPublicKey', err);
+        }
+    }
+    /**
+     * Retrieve secp256k1 public key from the Ledger Ethereum app.
+     * The device derives the key at `path` from its internal seed and returns
+     * only the public key + EIP-55 address.  No private key is transmitted.
+     */
+    async _getEthPublicKey(path) {
+        let EthApp;
+        try {
+            const mod = await import('@ledgerhq/hw-app-eth');
+            EthApp = mod.default ?? mod;
+        }
+        catch {
+            throw new HsmNotAvailableError('ledger', 'Package @ledgerhq/hw-app-eth is not installed.');
+        }
+        const eth = new EthApp(this._transport);
+        // display=false → no on-device confirmation required (just address derivation)
+        const result = await eth.getAddress(path, false);
+        return {
+            publicKeyHex: result.publicKey.startsWith('04')
+                ? result.publicKey
+                : '04' + result.publicKey,
+            address: result.address,
+            derivationPath: path,
+            curve: 'secp256k1',
+        };
+    }
+    /**
+     * Retrieve Ed25519 public key from the Ledger Solana app.
+     * Works for Solana, ICP, and Arweave (all use Ed25519).
+     * The host receives only the 32-byte public key; the private key stays sealed.
+     */
+    async _getSolanaPublicKey(path) {
+        let SolanaApp;
+        try {
+            const mod = await import('@ledgerhq/hw-app-solana');
+            SolanaApp = mod.default ?? mod;
+        }
+        catch {
+            throw new HsmNotAvailableError('ledger', 'Package @ledgerhq/hw-app-solana is not installed.');
+        }
+        const sol = new SolanaApp(this._transport);
+        const result = await sol.getAddress(path);
+        const pubkeyHex = Buffer.from(result.address).toString('hex');
+        // For Solana the address is the base58-encoded public key.
+        // We derive it here so callers get a usable address without needing bs58.
+        const { PublicKey } = await import('@solana/web3.js');
+        const address = new PublicKey(result.address).toBase58();
+        return {
+            publicKeyHex: pubkeyHex,
+            address,
+            derivationPath: path,
+            curve: 'ed25519',
+        };
+    }
+    // -------------------------------------------------------------------------
+    // Signing
+    // -------------------------------------------------------------------------
+    async signDigest(derivationPath, digestHex, curve) {
+        this._assertOpen();
+        if (!this.supportedCurves.includes(curve)) {
+            throw new HsmCurveUnsupportedError('ledger', curve);
+        }
+        try {
+            if (curve === 'secp256k1') {
+                return await this._signEth(derivationPath, digestHex);
+            }
+            else {
+                return await this._signSolana(derivationPath, digestHex);
+            }
+        }
+        catch (err) {
+            if (err instanceof HsmNotAvailableError || err instanceof HsmCurveUnsupportedError) {
+                throw err;
+            }
+            throw new HsmOperationError('ledger', 'signDigest', err);
+        }
+    }
+    async _signEth(path, digestHex) {
+        let EthApp;
+        try {
+            const mod = await import('@ledgerhq/hw-app-eth');
+            EthApp = mod.default ?? mod;
+        }
+        catch {
+            throw new HsmNotAvailableError('ledger', 'Package @ledgerhq/hw-app-eth is not installed.');
+        }
+        const eth = new EthApp(this._transport);
+        // The Ledger Ethereum app signs raw transactions; we pass the digest as a
+        // minimal "raw tx" hex.  For EIP-191 personal signs callers should use
+        // signPersonalMessage instead; this method handles arbitrary 32-byte digests.
+        const sig = await eth.signTransaction(path, digestHex);
+        const r = sig.r.replace(/^0x/, '');
+        const s = sig.s.replace(/^0x/, '');
+        const vHex = sig.v.replace(/^0x/, '').padStart(2, '0');
+        const recovery = parseInt(vHex, 16) % 2; // 0 or 1
+        return { signatureHex: r + s + vHex, recovery };
+    }
+    async _signSolana(path, digestHex) {
+        let SolanaApp;
+        try {
+            const mod = await import('@ledgerhq/hw-app-solana');
+            SolanaApp = mod.default ?? mod;
+        }
+        catch {
+            throw new HsmNotAvailableError('ledger', 'Package @ledgerhq/hw-app-solana is not installed.');
+        }
+        const sol = new SolanaApp(this._transport);
+        const txBuffer = Buffer.from(digestHex, 'hex');
+        const result = await sol.signTransaction(path, txBuffer);
+        return { signatureHex: Buffer.from(result.signature).toString('hex') };
+    }
+    // -------------------------------------------------------------------------
+    // Device identity
+    // -------------------------------------------------------------------------
+    async deviceId() {
+        this._assertOpen();
+        return this._deviceSerial ?? 'ledger-unknown';
+    }
+    // -------------------------------------------------------------------------
+    // Internal helpers
+    // -------------------------------------------------------------------------
+    _assertOpen() {
+        if (!this._transport) {
+            throw new HsmNotAvailableError('ledger', 'Provider is not open. Call open() before any key operations.');
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Probe helper – call without opening a full provider
+// ---------------------------------------------------------------------------
+/**
+ * Quick check: is a Ledger device currently connected and unlocked?
+ *
+ * @returns `true` if at least one HID device is enumerable, `false` otherwise.
+ *          Does NOT verify that any particular Ledger app is open.
+ */
+export async function isLedgerAvailable() {
+    try {
+        const mod = await import('@ledgerhq/hw-transport-node-hid');
+        const Transport = mod.default ?? mod;
+        const devices = await Transport.list();
+        return Array.isArray(devices) && devices.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=ledger-provider.js.map

package/dist/src/wallet/hsm/ledger-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-provider.js","sourceRoot":"","sources":["../../../../src/wallet/hsm/ledger-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQzC,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AA2BpB,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IACnB,IAAI,GAAG,wBAAwB,CAAC;IAChC,OAAO,GAAe,QAAQ,CAAC;IAC/B,eAAe,GAA4B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAErE,UAAU,GAA2B,IAAI,CAAC;IAC1C,cAAc,GAAkB,IAAI,CAAC;IACrC,aAAa,GAAkB,IAAI,CAAC;IAE5C,4EAA4E;IAC5E,YAAY;IACZ,4EAA4E;IAE5E,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,eAAe;QAE5C,0EAA0E;QAC1E,IAAI,gBAA4C,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,iCAAwC,CAAC,CAAC;YACnE,gBAAgB,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,oBAAoB,CAC5B,QAAQ,EACR,4DAA4D;gBAC1D,+FAA+F,CAClG,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,IAAI,OAAkB,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,oBAAoB,CAAC,QAAQ,EAAE,8BAA8B,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,oBAAoB,CAC5B,QAAQ,EACR,kFAAkF,CACnF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,oBAAoB,CAAC,QAAQ,EAAE,gCAAgC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3F,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,IAAI,QAAQ,CAAC;QAC3E,4EAA4E;QAC5E,IAAI,CAAC,aAAa;YAChB,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE;gBAC/B,UAAU,CAAC,QAAQ,CAAC;qBACjB,MAAM,CAAC,IAAI,CAAC,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;qBAC9C,MAAM,CAAC,KAAK,CAAC;qBACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC9C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,uBAAuB;IACvB,4EAA4E;IAE5E,KAAK,CAAC,YAAY,CAAC,cAAsB,EAAE,KAAe;QACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,wBAAwB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC;YACH,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC1B,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oBAAoB,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;gBACnF,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,sBAA6B,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,oBAAoB,CAC5B,QAAQ,EACR,gDAAgD,CACjD,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAW,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChD,+EAA+E;QAC/E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEjD,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;gBAC7C,CAAC,CAAC,MAAM,CAAC,SAAS;gBAClB,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,cAAc,EAAE,IAAI;YACpB,KAAK,EAAE,WAAW;SACnB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,mBAAmB,CAAC,IAAY;QAC5C,IAAI,SAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,yBAAgC,CAAC,CAAC;YAC3D,SAAS,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,oBAAoB,CAC5B,QAAQ,EACR,mDAAmD,CACpD,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAc,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE9D,2DAA2D;QAC3D,0EAA0E;QAC1E,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEzD,OAAO;YACL,YAAY,EAAE,SAAS;YACvB,OAAO;YACP,cAAc,EAAE,IAAI;YACpB,KAAK,EAAE,SAAS;SACjB,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,UAAU;IACV,4EAA4E;IAE5E,KAAK,CAAC,UAAU,CACd,cAAsB,EACtB,SAAiB,EACjB,KAAe;QAEf,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,wBAAwB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC;YACH,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC1B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACN,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oBAAoB,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;gBACnF,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,SAAiB;QACpD,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,sBAA6B,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,oBAAoB,CAAC,QAAQ,EAAE,gDAAgD,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,GAAG,GAAW,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChD,0EAA0E;QAC1E,uEAAuE;QACvE,8EAA8E;QAC9E,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAEvD,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAElD,OAAO,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,SAAiB;QACvD,IAAI,SAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,yBAAgC,CAAC,CAAC;YAC3D,SAAS,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,oBAAoB,CAC5B,QAAQ,EACR,mDAAmD,CACpD,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAc,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACzE,CAAC;IAED,4EAA4E;IAC5E,kBAAkB;IAClB,4EAA4E;IAE5E,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,aAAa,IAAI,gBAAgB,CAAC;IAChD,CAAC;IAED,4EAA4E;IAC5E,mBAAmB;IACnB,4EAA4E;IAEpE,WAAW;QACjB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,oBAAoB,CAC5B,QAAQ,EACR,8DAA8D,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,iCAAwC,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/src/wallet/hsm/sgx-provider.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Intel SGX TEE HSM Provider
+ *
+ * Offloads key generation and signing to an Intel SGX trusted enclave.
+ * The enclave generates keys inside its protected memory, seals them with
+ * the processor's platform key, and only ever exposes public keys and
+ * signatures to the untrusted host.
+ *
+ * Security properties:
+ *   - Private key material generated inside the SGX enclave (ring-0 isolation).
+ *   - Keys are *sealed* to the enclave identity (MRENCLAVE / MRSIGNER):
+ *       sealed blobs are opaque byte strings that cannot be read outside
+ *       the matching enclave even with physical DRAM access.
+ *   - Host process receives ONLY public keys and signatures.
+ *   - RAM dumps of the host process contain zero key material.
+ *
+ * Architecture:
+ *   Host (this file) ──UNIX-socket──▶ AESM daemon (aesmd)
+ *                                         │
+ *                                    SGX driver / enclave
+ *
+ * The AESM socket path is configurable; default: /var/run/aesmd/aesm.socket
+ * For development / CI without real SGX hardware, set env SGX_SIMULATION=1
+ * to use the libsgx_urts simulation mode.
+ *
+ * Real deployment:
+ *   1. Install Intel SGX driver + platform software stack.
+ *   2. Build / sign the enclave shared library (agentvault_keygen.signed.so).
+ *   3. Set AGENTVAULT_SGX_ENCLAVE_PATH to point at the .signed.so file.
+ *   4. Start aesmd.
+ *   5. Run `agentvault wallet create --hsm sgx`.
+ *
+ * This file implements the host-side stub that communicates with the enclave
+ * via a JSON-over-UNIX-socket protocol.  The protocol is intentionally simple
+ * so that the enclave-side implementation can be small and auditable.
+ */
+import type { HsmProvider, HsmBackend, HsmCurve, HsmPublicKeyResult, HsmSignatureResult } from './types.js';
+/**
+ * HSM provider that delegates all key operations to an Intel SGX enclave.
+ *
+ * The enclave binary must implement the agentvault_keygen.edl interface and
+ * respond to the JSON-over-UNIX-socket protocol defined above.
+ *
+ * Usage:
+ * ```ts
+ * const sgx = new SgxHsmProvider();
+ * await sgx.open();                              // connects to AESM daemon
+ * const { address } = await sgx.getPublicKey("m/44'/60'/0'/0/0", 'secp256k1');
+ * await sgx.close();
+ * ```
+ */
+export declare class SgxHsmProvider implements HsmProvider {
+    readonly name = "Intel SGX TEE Enclave";
+    readonly backend: HsmBackend;
+    readonly supportedCurves: ReadonlyArray<HsmCurve>;
+    private readonly _socketPath;
+    private readonly _enclavePath;
+    private _socket;
+    constructor(options?: {
+        socketPath?: string;
+        enclavePath?: string;
+    });
+    open(): Promise<void>;
+    close(): Promise<void>;
+    getPublicKey(derivationPath: string, curve: HsmCurve): Promise<HsmPublicKeyResult>;
+    signDigest(derivationPath: string, digestHex: string, curve: HsmCurve): Promise<HsmSignatureResult>;
+    deviceId(): Promise<string>;
+    private _connectSocket;
+    /**
+     * Send a JSON request to the enclave daemon and await a JSON response.
+     * Each message is framed as a 4-byte big-endian length prefix followed by
+     * the UTF-8 JSON payload (same framing as Intel's AESM RPC protocol).
+     */
+    private _send;
+    private _assertOpen;
+}
+/**
+ * Quick check: is the SGX AESM daemon socket accessible?
+ *
+ * @returns `true` if the socket file exists and can be stat'd, `false` otherwise.
+ */
+export declare function isSgxAvailable(socketPath?: string): Promise<boolean>;
+//# sourceMappingURL=sgx-provider.d.ts.map

package/dist/src/wallet/hsm/sgx-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sgx-provider.d.ts","sourceRoot":"","sources":["../../../../src/wallet/hsm/sgx-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAyCpB;;;;;;;;;;;;;GAaG;AACH,qBAAa,cAAe,YAAW,WAAW;IAChD,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAS;IACrC,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,QAAQ,CAAC,CAA4B;IAE7E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,OAAO,CAA2B;gBAE9B,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO;IAYjE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAgClF,UAAU,CACd,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC,kBAAkB,CAAC;IA8BxB,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;YAgBnB,cAAc;IAmC5B;;;;OAIG;YACW,KAAK;IA8DnB,OAAO,CAAC,WAAW;CAQpB;AAcD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,UAAU,GAAE,MAA4B,GACvC,OAAO,CAAC,OAAO,CAAC,CAQlB"}