agentvault 1.0.2 → 1.0.5

package/dist/src/wallet/hsm/sgx-provider.js

@@ -0,0 +1,281 @@
+/**
+ * Intel SGX TEE HSM Provider
+ *
+ * Offloads key generation and signing to an Intel SGX trusted enclave.
+ * The enclave generates keys inside its protected memory, seals them with
+ * the processor's platform key, and only ever exposes public keys and
+ * signatures to the untrusted host.
+ *
+ * Security properties:
+ *   - Private key material generated inside the SGX enclave (ring-0 isolation).
+ *   - Keys are *sealed* to the enclave identity (MRENCLAVE / MRSIGNER):
+ *       sealed blobs are opaque byte strings that cannot be read outside
+ *       the matching enclave even with physical DRAM access.
+ *   - Host process receives ONLY public keys and signatures.
+ *   - RAM dumps of the host process contain zero key material.
+ *
+ * Architecture:
+ *   Host (this file) ──UNIX-socket──▶ AESM daemon (aesmd)
+ *                                         │
+ *                                    SGX driver / enclave
+ *
+ * The AESM socket path is configurable; default: /var/run/aesmd/aesm.socket
+ * For development / CI without real SGX hardware, set env SGX_SIMULATION=1
+ * to use the libsgx_urts simulation mode.
+ *
+ * Real deployment:
+ *   1. Install Intel SGX driver + platform software stack.
+ *   2. Build / sign the enclave shared library (agentvault_keygen.signed.so).
+ *   3. Set AGENTVAULT_SGX_ENCLAVE_PATH to point at the .signed.so file.
+ *   4. Start aesmd.
+ *   5. Run `agentvault wallet create --hsm sgx`.
+ *
+ * This file implements the host-side stub that communicates with the enclave
+ * via a JSON-over-UNIX-socket protocol.  The protocol is intentionally simple
+ * so that the enclave-side implementation can be small and auditable.
+ */
+import * as net from 'node:net';
+import * as crypto from 'node:crypto';
+import { HsmNotAvailableError, HsmCurveUnsupportedError, HsmOperationError, } from './types.js';
+// ---------------------------------------------------------------------------
+// Configuration constants
+// ---------------------------------------------------------------------------
+/** Default UNIX socket path used by Intel's AESM daemon. */
+const DEFAULT_AESM_SOCKET = '/var/run/aesmd/aesm.socket';
+/**
+ * Environment variable pointing to the signed enclave shared object.
+ * When unset the provider falls back to simulation mode (SGX_SIMULATION=1).
+ */
+const ENCLAVE_PATH_ENV = 'AGENTVAULT_SGX_ENCLAVE_PATH';
+/** Socket I/O timeout in milliseconds. */
+const SOCKET_TIMEOUT_MS = 10_000;
+// ---------------------------------------------------------------------------
+// SgxHsmProvider
+// ---------------------------------------------------------------------------
+/**
+ * HSM provider that delegates all key operations to an Intel SGX enclave.
+ *
+ * The enclave binary must implement the agentvault_keygen.edl interface and
+ * respond to the JSON-over-UNIX-socket protocol defined above.
+ *
+ * Usage:
+ * ```ts
+ * const sgx = new SgxHsmProvider();
+ * await sgx.open();                              // connects to AESM daemon
+ * const { address } = await sgx.getPublicKey("m/44'/60'/0'/0/0", 'secp256k1');
+ * await sgx.close();
+ * ```
+ */
+export class SgxHsmProvider {
+    name = 'Intel SGX TEE Enclave';
+    backend = 'sgx';
+    supportedCurves = ['secp256k1', 'ed25519'];
+    _socketPath;
+    _enclavePath;
+    _socket = null;
+    constructor(options = {}) {
+        this._socketPath = options.socketPath ?? DEFAULT_AESM_SOCKET;
+        this._enclavePath =
+            options.enclavePath ??
+                process.env[ENCLAVE_PATH_ENV] ??
+                '/usr/lib/agentvault/agentvault_keygen.signed.so';
+    }
+    // -------------------------------------------------------------------------
+    // Lifecycle
+    // -------------------------------------------------------------------------
+    async open() {
+        if (this._socket)
+            return; // already open
+        await this._connectSocket();
+        try {
+            await this._send({ op: 'ping' });
+        }
+        catch (err) {
+            await this.close();
+            throw new HsmNotAvailableError('sgx', `SGX daemon at ${this._socketPath} did not respond to ping: ${String(err)}`);
+        }
+    }
+    async close() {
+        if (this._socket) {
+            this._socket.destroy();
+            this._socket = null;
+        }
+    }
+    // -------------------------------------------------------------------------
+    // Public key retrieval
+    // -------------------------------------------------------------------------
+    async getPublicKey(derivationPath, curve) {
+        this._assertOpen();
+        if (!this.supportedCurves.includes(curve)) {
+            throw new HsmCurveUnsupportedError('sgx', curve);
+        }
+        let result;
+        try {
+            result = await this._send({ op: 'getPublicKey', path: derivationPath, curve });
+        }
+        catch (err) {
+            throw new HsmOperationError('sgx', 'getPublicKey', err);
+        }
+        // Validate response shape
+        const r = result;
+        if (typeof r.publicKeyHex !== 'string' || typeof r.address !== 'string') {
+            throw new HsmOperationError('sgx', 'getPublicKey', 'Malformed response from enclave');
+        }
+        return {
+            publicKeyHex: r.publicKeyHex,
+            address: r.address,
+            derivationPath,
+            curve,
+        };
+    }
+    // -------------------------------------------------------------------------
+    // Signing
+    // -------------------------------------------------------------------------
+    async signDigest(derivationPath, digestHex, curve) {
+        this._assertOpen();
+        if (!this.supportedCurves.includes(curve)) {
+            throw new HsmCurveUnsupportedError('sgx', curve);
+        }
+        if (!/^[0-9a-fA-F]{64}$/.test(digestHex)) {
+            throw new HsmOperationError('sgx', 'signDigest', 'digestHex must be exactly 32 bytes (64 hex chars)');
+        }
+        let result;
+        try {
+            result = await this._send({ op: 'signDigest', path: derivationPath, digestHex, curve });
+        }
+        catch (err) {
+            throw new HsmOperationError('sgx', 'signDigest', err);
+        }
+        const r = result;
+        if (typeof r.signatureHex !== 'string') {
+            throw new HsmOperationError('sgx', 'signDigest', 'Malformed signature from enclave');
+        }
+        return { signatureHex: r.signatureHex, recovery: r.recovery };
+    }
+    // -------------------------------------------------------------------------
+    // Device identity
+    // -------------------------------------------------------------------------
+    async deviceId() {
+        this._assertOpen();
+        try {
+            const result = await this._send({ op: 'deviceId' });
+            return typeof result?.id === 'string' ? result.id : 'sgx-unknown';
+        }
+        catch {
+            // Fall back to a stable hash derived from the enclave path
+            return createHash('sha256').update(this._enclavePath).digest('hex').slice(0, 16);
+        }
+    }
+    // -------------------------------------------------------------------------
+    // UNIX socket transport
+    // -------------------------------------------------------------------------
+    async _connectSocket() {
+        return new Promise((resolve, reject) => {
+            const socket = net.createConnection({ path: this._socketPath });
+            const onConnect = () => {
+                socket.removeListener('error', onError);
+                this._socket = socket;
+                resolve();
+            };
+            const onError = (err) => {
+                socket.destroy();
+                reject(new HsmNotAvailableError('sgx', `Cannot connect to SGX AESM socket at ${this._socketPath}: ${err.message}. ` +
+                    'Is Intel SGX installed and aesmd running? (systemctl status aesmd)'));
+            };
+            socket.once('connect', onConnect);
+            socket.once('error', onError);
+            socket.setTimeout(SOCKET_TIMEOUT_MS, () => {
+                socket.destroy();
+                reject(new HsmNotAvailableError('sgx', `Timeout connecting to SGX AESM socket at ${this._socketPath}`));
+            });
+        });
+    }
+    /**
+     * Send a JSON request to the enclave daemon and await a JSON response.
+     * Each message is framed as a 4-byte big-endian length prefix followed by
+     * the UTF-8 JSON payload (same framing as Intel's AESM RPC protocol).
+     */
+    async _send(request) {
+        const socket = this._socket;
+        if (!socket)
+            throw new Error('Socket not connected');
+        return new Promise((resolve, reject) => {
+            const payload = Buffer.from(JSON.stringify(request), 'utf8');
+            const frame = Buffer.allocUnsafe(4 + payload.length);
+            frame.writeUInt32BE(payload.length, 0);
+            payload.copy(frame, 4);
+            const chunks = [];
+            const onData = (chunk) => {
+                chunks.push(chunk);
+                const accumulated = Buffer.concat(chunks);
+                // Wait for at least 4 bytes (length prefix)
+                if (accumulated.length < 4)
+                    return;
+                const bodyLen = accumulated.readUInt32BE(0);
+                if (accumulated.length < 4 + bodyLen)
+                    return;
+                // Full response received
+                socket.removeListener('data', onData);
+                socket.removeListener('error', onError);
+                const bodyStr = accumulated.slice(4, 4 + bodyLen).toString('utf8');
+                let parsed;
+                try {
+                    parsed = JSON.parse(bodyStr);
+                }
+                catch {
+                    return reject(new Error(`Invalid JSON from enclave: ${bodyStr}`));
+                }
+                if (!parsed.ok) {
+                    return reject(new Error(parsed.error ?? 'Unknown enclave error'));
+                }
+                resolve(parsed.data);
+            };
+            const onError = (err) => {
+                socket.removeListener('data', onData);
+                reject(err);
+            };
+            socket.on('data', onData);
+            socket.once('error', onError);
+            socket.write(frame, (err) => {
+                if (err) {
+                    socket.removeListener('data', onData);
+                    socket.removeListener('error', onError);
+                    reject(err);
+                }
+            });
+        });
+    }
+    // -------------------------------------------------------------------------
+    // Internal helpers
+    // -------------------------------------------------------------------------
+    _assertOpen() {
+        if (!this._socket) {
+            throw new HsmNotAvailableError('sgx', 'Provider is not open. Call open() before any key operations.');
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Helper
+// ---------------------------------------------------------------------------
+function createHash(alg) {
+    return crypto.createHash(alg);
+}
+// ---------------------------------------------------------------------------
+// Probe helper
+// ---------------------------------------------------------------------------
+/**
+ * Quick check: is the SGX AESM daemon socket accessible?
+ *
+ * @returns `true` if the socket file exists and can be stat'd, `false` otherwise.
+ */
+export async function isSgxAvailable(socketPath = DEFAULT_AESM_SOCKET) {
+    try {
+        const { stat } = await import('node:fs/promises');
+        const info = await stat(socketPath);
+        return info.isSocket();
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=sgx-provider.js.map

package/dist/src/wallet/hsm/sgx-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sgx-provider.js","sourceRoot":"","sources":["../../../../src/wallet/hsm/sgx-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAQtC,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAEpB,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,4DAA4D;AAC5D,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEzD;;;GAGG;AACH,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAEvD,0CAA0C;AAC1C,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAgBjC,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,uBAAuB,CAAC;IAC/B,OAAO,GAAe,KAAK,CAAC;IAC5B,eAAe,GAA4B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAE5D,WAAW,CAAS;IACpB,YAAY,CAAS;IAC9B,OAAO,GAAsB,IAAI,CAAC;IAE1C,YAAY,UAAyD,EAAE;QACrE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC7D,IAAI,CAAC,YAAY;YACf,OAAO,CAAC,WAAW;gBACnB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBAC7B,iDAAiD,CAAC;IACtD,CAAC;IAED,4EAA4E;IAC5E,YAAY;IACZ,4EAA4E;IAE5E,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,eAAe;QAEzC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,oBAAoB,CAC5B,KAAK,EACL,iBAAiB,IAAI,CAAC,WAAW,6BAA6B,MAAM,CAAC,GAAG,CAAC,EAAE,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,uBAAuB;IACvB,4EAA4E;IAE5E,KAAK,CAAC,YAAY,CAAC,cAAsB,EAAE,KAAe;QACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;QAED,0BAA0B;QAC1B,MAAM,CAAC,GAAG,MAAmD,CAAC;QAC9D,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACxE,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,iCAAiC,CAAC,CAAC;QACxF,CAAC;QAED,OAAO;YACL,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,cAAc;YACd,KAAK;SACN,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,UAAU;IACV,4EAA4E;IAE5E,KAAK,CAAC,UAAU,CACd,cAAsB,EACtB,SAAiB,EACjB,KAAe;QAEf,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,mDAAmD,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,CAAC,GAAG,MAAqD,CAAC;QAChE,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,kCAAkC,CAAC,CAAC;QACvF,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChE,CAAC;IAED,4EAA4E;IAC5E,kBAAkB;IAClB,4EAA4E;IAE5E,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAmB,CAAC;YACtE,OAAO,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,wBAAwB;IACxB,4EAA4E;IAEpE,KAAK,CAAC,cAAc;QAC1B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAEhE,MAAM,SAAS,GAAG,GAAG,EAAE;gBACrB,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;gBACtB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE;gBAC7B,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CACJ,IAAI,oBAAoB,CACtB,KAAK,EACL,wCAAwC,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,OAAO,IAAI;oBAC1E,oEAAoE,CACvE,CACF,CAAC;YACJ,CAAC,CAAC;YAEF,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,MAAM,CAAC,UAAU,CAAC,iBAAiB,EAAE,GAAG,EAAE;gBACxC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CACJ,IAAI,oBAAoB,CACtB,KAAK,EACL,4CAA4C,IAAI,CAAC,WAAW,EAAE,CAC/D,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,KAAK,CAAC,OAAmB;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAErD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YACrD,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAEvB,MAAM,MAAM,GAAa,EAAE,CAAC;YAE5B,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;gBAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAE1C,4CAA4C;gBAC5C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO;gBAEnC,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC5C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO;oBAAE,OAAO;gBAE7C,yBAAyB;gBACzB,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAExC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnE,IAAI,MAAmB,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC;gBAC9C,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC,CAAC;gBACpE,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAC,CAAC;gBACpE,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE;gBAC7B,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtC,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC;YAEF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAE9B,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC1B,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;oBACtC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACxC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,mBAAmB;IACnB,4EAA4E;IAEpE,WAAW;QACjB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,oBAAoB,CAC5B,KAAK,EACL,8DAA8D,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,aAAqB,mBAAmB;IAExC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/src/wallet/hsm/types.d.ts

@@ -0,0 +1,134 @@
+/**
+ * HSM / TEE Keygen Types
+ *
+ * Defines the common interface for hardware-backed key generation providers:
+ *   - Ledger hardware wallets (secp256k1 / Ed25519 via APDU over USB HID)
+ *   - Intel SGX Trusted Execution Environments (sealed enclave key storage)
+ *
+ * The central contract is that a private key NEVER leaves the secure boundary.
+ * The host process only ever receives public keys and signatures.
+ */
+/** Identifies the underlying secure element / TEE backend. */
+export type HsmBackend = 'ledger' | 'sgx';
+/** Curve used for the derived key-pair. */
+export type HsmCurve = 'secp256k1' | 'ed25519';
+/**
+ * Result of a public-key derivation performed entirely inside the secure
+ * boundary.  No private key material is included.
+ */
+export interface HsmPublicKeyResult {
+    /** Hex-encoded compressed public key (secp256k1: 33 bytes, ed25519: 32 bytes). */
+    publicKeyHex: string;
+    /** Chain-native address derived from the public key on the device. */
+    address: string;
+    /** BIP32 / SLIP10 derivation path used. */
+    derivationPath: string;
+    /** Curve the key uses. */
+    curve: HsmCurve;
+}
+/**
+ * Result of an in-device signing operation.
+ * Only the signature is returned to the host – the private key stays sealed.
+ */
+export interface HsmSignatureResult {
+    /** DER-encoded or raw signature, hex-encoded. */
+    signatureHex: string;
+    /** Recovery byte (secp256k1 only; undefined for Ed25519). */
+    recovery?: number;
+}
+/**
+ * Minimum interface that every HSM / TEE backend must implement.
+ *
+ * Implementations may support only a subset of curves; callers should check
+ * `supportedCurves` before invoking curve-specific methods.
+ */
+export interface HsmProvider {
+    /** Human-readable name, e.g. "Ledger Nano X", "Intel SGX enclave v2". */
+    readonly name: string;
+    /** Backend type tag for serialization / display. */
+    readonly backend: HsmBackend;
+    /** Which curves are supported by this backend. */
+    readonly supportedCurves: ReadonlyArray<HsmCurve>;
+    /**
+     * Open a channel to the secure element / TEE.
+     * Must be called before any other method.
+     *
+     * @throws {HsmNotAvailableError} when device / daemon is unreachable.
+     */
+    open(): Promise<void>;
+    /**
+     * Close the channel gracefully.
+     * Safe to call even if open() was never called (no-op).
+     */
+    close(): Promise<void>;
+    /**
+     * Derive a key-pair inside the device and return ONLY the public key.
+     * The private key is generated and stored entirely within the secure boundary.
+     *
+     * @param derivationPath - BIP32 (m/purpose'/coin'/acc'/change/index) or
+     *                         SLIP10 path for Ed25519 chains.
+     * @param curve          - Which curve to use.
+     * @returns Public key + address.  Private key is NEVER included.
+     *
+     * @throws {HsmCurveUnsupportedError} when `curve` is not in supportedCurves.
+     * @throws {HsmOperationError} on device / enclave errors.
+     */
+    getPublicKey(derivationPath: string, curve: HsmCurve): Promise<HsmPublicKeyResult>;
+    /**
+     * Sign a 32-byte digest inside the device.
+     * The host provides only the digest; the private key never crosses the boundary.
+     *
+     * @param derivationPath - Same path used when generating the key.
+     * @param digestHex      - 32-byte Keccak / SHA-256 / Blake2 digest, hex-encoded.
+     * @param curve          - Curve the key was generated on.
+     * @returns Signature bytes.  Private key is NEVER included.
+     */
+    signDigest(derivationPath: string, digestHex: string, curve: HsmCurve): Promise<HsmSignatureResult>;
+    /**
+     * Returns a stable identifier for this specific device / enclave instance.
+     * Used to record which hardware produced a given wallet.
+     */
+    deviceId(): Promise<string>;
+}
+/** Base class for all HSM-related errors. */
+export declare class HsmError extends Error {
+    readonly backend: HsmBackend;
+    constructor(message: string, backend: HsmBackend);
+}
+/** Thrown when the hardware / daemon is not found or cannot be opened. */
+export declare class HsmNotAvailableError extends HsmError {
+    constructor(backend: HsmBackend, detail?: string);
+}
+/** Thrown when the requested curve is not supported by the backend. */
+export declare class HsmCurveUnsupportedError extends HsmError {
+    constructor(backend: HsmBackend, curve: HsmCurve);
+}
+/** Thrown on device / enclave operation failures. */
+export declare class HsmOperationError extends HsmError {
+    constructor(backend: HsmBackend, operation: string, cause?: unknown);
+}
+/**
+ * Serialisable metadata stored in `WalletData.chainMetadata.hsm` for wallets
+ * whose keys were generated by an HSM / TEE.
+ *
+ * This is the only artefact of the keygen that is saved locally.
+ * No private key or seed phrase is ever present.
+ */
+export interface HsmWalletMetadata {
+    /** Which backend generated this key. */
+    backend: HsmBackend;
+    /** Stable device identifier captured at creation time. */
+    deviceId: string;
+    /** BIP32 / SLIP10 derivation path used inside the device. */
+    derivationPath: string;
+    /** Curve the key was generated on. */
+    curve: HsmCurve;
+    /** ISO-8601 timestamp of key creation. */
+    createdAt: string;
+    /**
+     * Compressed public key, hex-encoded.
+     * Stored so callers can re-derive the address without querying the device.
+     */
+    publicKeyHex: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/wallet/hsm/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/wallet/hsm/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,8DAA8D;AAC9D,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE1C,2CAA2C;AAC3C,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AAM/C;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,kFAAkF;IAClF,YAAY,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,0BAA0B;IAC1B,KAAK,EAAE,QAAQ,CAAC;CACjB;AAMD;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,kDAAkD;IAClD,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IAElD;;;;;OAKG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtB;;;OAGG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEnF;;;;;;;;OAQG;IACH,UAAU,CACR,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE/B;;;OAGG;IACH,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7B;AAMD,6CAA6C;AAC7C,qBAAa,QAAS,SAAQ,KAAK;aACY,OAAO,EAAE,UAAU;gBAApD,OAAO,EAAE,MAAM,EAAkB,OAAO,EAAE,UAAU;CAIjE;AAED,0EAA0E;AAC1E,qBAAa,oBAAqB,SAAQ,QAAQ;gBACpC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,MAAM;CAQjD;AAED,uEAAuE;AACvE,qBAAa,wBAAyB,SAAQ,QAAQ;gBACxC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ;CAIjD;AAED,qDAAqD;AACrD,qBAAa,iBAAkB,SAAQ,QAAQ;gBACjC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAKpE;AAMD;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,OAAO,EAAE,UAAU,CAAC;IACpB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,cAAc,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,KAAK,EAAE,QAAQ,CAAC;IAChB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB"}

package/dist/src/wallet/hsm/types.js

@@ -0,0 +1,46 @@
+/**
+ * HSM / TEE Keygen Types
+ *
+ * Defines the common interface for hardware-backed key generation providers:
+ *   - Ledger hardware wallets (secp256k1 / Ed25519 via APDU over USB HID)
+ *   - Intel SGX Trusted Execution Environments (sealed enclave key storage)
+ *
+ * The central contract is that a private key NEVER leaves the secure boundary.
+ * The host process only ever receives public keys and signatures.
+ */
+// ---------------------------------------------------------------------------
+// Error hierarchy
+// ---------------------------------------------------------------------------
+/** Base class for all HSM-related errors. */
+export class HsmError extends Error {
+    backend;
+    constructor(message, backend) {
+        super(message);
+        this.backend = backend;
+        this.name = 'HsmError';
+    }
+}
+/** Thrown when the hardware / daemon is not found or cannot be opened. */
+export class HsmNotAvailableError extends HsmError {
+    constructor(backend, detail) {
+        super(`HSM backend "${backend}" is not available${detail ? ': ' + detail : ''}.` +
+            ' Is the device connected / daemon running?', backend);
+        this.name = 'HsmNotAvailableError';
+    }
+}
+/** Thrown when the requested curve is not supported by the backend. */
+export class HsmCurveUnsupportedError extends HsmError {
+    constructor(backend, curve) {
+        super(`Backend "${backend}" does not support curve "${curve}".`, backend);
+        this.name = 'HsmCurveUnsupportedError';
+    }
+}
+/** Thrown on device / enclave operation failures. */
+export class HsmOperationError extends HsmError {
+    constructor(backend, operation, cause) {
+        const detail = cause instanceof Error ? cause.message : String(cause ?? 'unknown');
+        super(`HSM operation "${operation}" failed on "${backend}": ${detail}`, backend);
+        this.name = 'HsmOperationError';
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/src/wallet/hsm/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/wallet/hsm/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAkHH,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,6CAA6C;AAC7C,MAAM,OAAO,QAAS,SAAQ,KAAK;IACY;IAA7C,YAAY,OAAe,EAAkB,OAAmB;QAC9D,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,YAAO,GAAP,OAAO,CAAY;QAE9D,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAmB,EAAE,MAAe;QAC9C,KAAK,CACH,gBAAgB,OAAO,qBAAqB,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG;YACxE,4CAA4C,EAC9C,OAAO,CACR,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,OAAO,wBAAyB,SAAQ,QAAQ;IACpD,YAAY,OAAmB,EAAE,KAAe;QAC9C,KAAK,CAAC,YAAY,OAAO,6BAA6B,KAAK,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,qDAAqD;AACrD,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IAC7C,YAAY,OAAmB,EAAE,SAAiB,EAAE,KAAe;QACjE,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;QACnF,KAAK,CAAC,kBAAkB,SAAS,gBAAgB,OAAO,MAAM,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF"}

package/dist/src/wallet/index.d.ts

@@ -1,16 +1,22 @@
 /**
  * Wallet Module
  *
- * Complete wallet management system for ckETH, Polkadot, and Solana.
+ * Complete wallet management system for ckETH, Polkadot, Solana, ICP, and Arweave.
  * Provides per-agent wallet isolation, encryption, and CBOR serialization.
  */
 export * from './types.js';
 export { serializeWallet, deserializeWallet, serializeTransaction, deserializeTransaction, serializeTransactionRequest, deserializeTransactionRequest, serializeSignedTransaction, deserializeSignedTransaction, validateCborData, } from './cbor-serializer.js';
 export { getWalletBaseDir, getAgentWalletDir, getWalletFilePath, ensureWalletDirectories, saveWallet, loadWallet, deleteWallet, listWallets, listAgents, walletExists, getWalletStats, backupWallets, restoreWallets, clearWallets, getWalletStorageSize, } from './wallet-storage.js';
 export { parseDerivationPath, buildDerivationPath, validateSeedPhrase, generateSeedFromMnemonic, generateMnemonic, getDefaultDerivationPath, deriveWalletKey, } from './key-derivation.js';
-export { createWallet, importWalletFromPrivateKey, importWalletFromSeed, importWalletFromMnemonic, generateWallet, getWallet, listAgentWallets, hasWallet, removeWallet, clearAgentWallets, cacheWalletConnection, getCachedConnection, clearCachedConnection, validateSeedPhraseWrapper, } from './wallet-manager.js';
+export { secp256k1KeypairFromSeed, ed25519KeypairFromSeed, deriveStorageKey, encryptSecret, decryptSecret, encryptWalletSecrets, decryptWalletSecrets, } from './wallet-crypto.js';
+export { createWallet, importWalletFromPrivateKey, importWalletFromSeed, importWalletFromMnemonic, generateWallet, createWalletWithHsm, getWallet, listAgentWallets, hasWallet, removeWallet, clearAgentWallets, cacheWalletConnection, getCachedConnection, clearCachedConnection, validateSeedPhraseWrapper, } from './wallet-manager.js';
+export { LedgerHsmProvider, SgxHsmProvider, isLedgerAvailable, isSgxAvailable, isHsmAvailable, createHsmProvider, HsmError, HsmNotAvailableError, HsmCurveUnsupportedError, HsmOperationError, } from './hsm/index.js';
+export type { HsmBackend, HsmCurve, HsmProvider, HsmPublicKeyResult, HsmSignatureResult, HsmWalletMetadata, } from './hsm/index.js';
 export { BaseWalletProvider } from './providers/base-provider.js';
 export { CkEthProvider } from './providers/cketh-provider.js';
 export { PolkadotProvider } from './providers/polkadot-provider.js';
 export { SolanaProvider } from './providers/solana-provider.js';
+export { IcpProvider } from './providers/icp-provider.js';
+export { ArweaveProvider } from './providers/arweave-provider.js';
+export { createWalletProvider, normalizeWalletChain } from './providers/provider-factory.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/wallet/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/wallet/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,YAAY,CAAC;AAG3B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,UAAU,EACV,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,YAAY,EACZ,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,EACxB,cAAc,EACd,mBAAmB,EACnB,SAAS,EACT,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,QAAQ,EACR,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,UAAU,EACV,QAAQ,EACR,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/src/wallet/index.js

@@ -1,7 +1,7 @@
 /**
  * Wallet Module
  *
- * Complete wallet management system for ckETH, Polkadot, and Solana.
+ * Complete wallet management system for ckETH, Polkadot, Solana, ICP, and Arweave.
  * Provides per-agent wallet isolation, encryption, and CBOR serialization.
  */
 // Types
@@ -12,11 +12,18 @@ export { serializeWallet, deserializeWallet, serializeTransaction, deserializeTr
 export { getWalletBaseDir, getAgentWalletDir, getWalletFilePath, ensureWalletDirectories, saveWallet, loadWallet, deleteWallet, listWallets, listAgents, walletExists, getWalletStats, backupWallets, restoreWallets, clearWallets, getWalletStorageSize, } from './wallet-storage.js';
 // Key Derivation
 export { parseDerivationPath, buildDerivationPath, validateSeedPhrase, generateSeedFromMnemonic, generateMnemonic, getDefaultDerivationPath, deriveWalletKey, } from './key-derivation.js';
+// Wallet Crypto (key generation + at-rest encryption)
+export { secp256k1KeypairFromSeed, ed25519KeypairFromSeed, deriveStorageKey, encryptSecret, decryptSecret, encryptWalletSecrets, decryptWalletSecrets, } from './wallet-crypto.js';
 // Wallet Manager
-export { createWallet, importWalletFromPrivateKey, importWalletFromSeed, importWalletFromMnemonic, generateWallet, getWallet, listAgentWallets, hasWallet, removeWallet, clearAgentWallets, cacheWalletConnection, getCachedConnection, clearCachedConnection, validateSeedPhraseWrapper, } from './wallet-manager.js';
+export { createWallet, importWalletFromPrivateKey, importWalletFromSeed, importWalletFromMnemonic, generateWallet, createWalletWithHsm, getWallet, listAgentWallets, hasWallet, removeWallet, clearAgentWallets, cacheWalletConnection, getCachedConnection, clearCachedConnection, validateSeedPhraseWrapper, } from './wallet-manager.js';
+// HSM / TEE keygen
+export { LedgerHsmProvider, SgxHsmProvider, isLedgerAvailable, isSgxAvailable, isHsmAvailable, createHsmProvider, HsmError, HsmNotAvailableError, HsmCurveUnsupportedError, HsmOperationError, } from './hsm/index.js';
 // Providers
 export { BaseWalletProvider } from './providers/base-provider.js';
 export { CkEthProvider } from './providers/cketh-provider.js';
 export { PolkadotProvider } from './providers/polkadot-provider.js';
 export { SolanaProvider } from './providers/solana-provider.js';
+export { IcpProvider } from './providers/icp-provider.js';
+export { ArweaveProvider } from './providers/arweave-provider.js';
+export { createWalletProvider, normalizeWalletChain } from './providers/provider-factory.js';
 //# sourceMappingURL=index.js.map

package/dist/src/wallet/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/wallet/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,QAAQ;AACR,cAAc,YAAY,CAAC;AAE3B,qBAAqB;AACrB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAE9B,iBAAiB;AACjB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,UAAU,EACV,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,YAAY,EACZ,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,iBAAiB;AACjB,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAE7B,sDAAsD;AACtD,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,iBAAiB;AACjB,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,EACxB,cAAc,EACd,mBAAmB,EACnB,SAAS,EACT,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,QAAQ,EACR,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAUxB,YAAY;AACZ,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/src/wallet/key-derivation.d.ts

@@ -3,6 +3,11 @@
  *
  * Implements BIP39 seed phrase derivation for wallet keys.
  * Supports multiple derivation paths for different blockchains.
+ *
+ * Curve usage:
+ *   secp256k1 – Ethereum / ckETH / Polkadot  (@noble/curves/secp256k1)
+ *   Ed25519   – ICP / Arweave                (@noble/curves/ed25519)
+ *   Ed25519   – Solana                       (@solana/web3.js Keypair for base58)
  */
 import type { WalletCreationMethod } from './types.js';
 /**
@@ -81,7 +86,8 @@ export declare function deriveEthKey(seed: Buffer, derivationPath?: string): Der
 /**
  * Derive Polkadot-compatible key
  *
- * Uses SR25519 for key derivation and SS58 for address encoding.
+ * Uses secp256k1 (via @noble/curves) for key derivation and SS58 for address
+ * encoding.
  *
  * @param seed - Seed bytes
  * @param derivationPath - Derivation path (default: "//hard//stash")
@@ -96,6 +102,28 @@ export declare function derivePolkadotKey(seed: Buffer, derivationPath?: string)
  * @returns Derived key with Solana address
  */
 export declare function deriveSolanaKey(seed: Buffer, derivationPath?: string): DerivedKey;
+/**
+ * Derive ICP-compatible key
+ *
+ * Uses Ed25519 via @noble/curves to match the ICP identity standard.
+ * Private key stored as 32 bytes (raw scalar); public key 32 bytes.
+ *
+ * @param seed - Seed bytes
+ * @param derivationPath - Derivation path (default: "m/44'/223'/0'/0/0")
+ * @returns Derived key with ICP principal address
+ */
+export declare function deriveIcpKey(seed: Buffer, derivationPath?: string): DerivedKey;
+/**
+ * Derive Arweave-compatible key
+ *
+ * Uses Ed25519 via @noble/curves for key generation; the address is
+ * SHA-256(publicKey) encoded as base64url (43 chars).
+ *
+ * @param seed - Seed bytes
+ * @param derivationPath - Derivation path (default: "m/44'/472'/0'/0/0")
+ * @returns Derived key with Arweave address
+ */
+export declare function deriveArweaveKey(seed: Buffer, derivationPath?: string): DerivedKey;
 /**
  * Get default derivation path for chain
  *

package/dist/src/wallet/key-derivation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-derivation.d.ts","sourceRoot":"","sources":["../../../src/wallet/key-derivation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAOvD;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,wBAAwB;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,cAAc,EAAE,MAAM,CAAC;CACxB;AAoBD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,CAuC1E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,wBAAwB,GACnC,MAAM,CAUR;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,UAAU,GAAE,MAAW,GACtB,MAAM,CAER;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,GAAE,MAAY,EACtB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAC7B,MAAM,CAER;AAwCD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,MAAsC,GACrD,UAAU,CAcZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,MAA2C,GAC1D,UAAU,CAaZ;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,MAAyC,GACxD,UAAU,CAiBZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,MAAsC,GACrD,UAAU,CAWZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,MAA0C,GACzD,UAAU,CAWZ;AAgCD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAoB9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,oBAAoB,EAC5B,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,cAAc,CAAC,EAAE,MAAM,EACvB,KAAK,GAAE,MAAgB,GACtB,UAAU,CA0EZ"}