dexbot 1.4.11 → 1.4.13

package/dist/modules/chain_keys.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * modules/chain_keys.ts - Authentication and Key Management
  *
@@ -20,7 +19,6 @@
  * - Raw 64-character hexadecimal private keys
  *
  * Security: Master password never stored; only a derived vault key is kept in memory.
- * Legacy SHA-256 password hashes are supported only to migrate existing vaults.
  * All newly written private keys use the v2 vault format.
  *
  * ===============================================================================
@@ -82,79 +80,18 @@
  *
  * ===============================================================================
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MasterPasswordError = void 0;
-exports.validatePrivateKey = validatePrivateKey;
-exports.loadAccounts = loadAccounts;
-exports.saveAccounts = saveAccounts;
-exports.checkKeysFileSecurity = checkKeysFileSecurity;
-exports.encrypt = encrypt;
-exports.decrypt = decrypt;
-exports.deriveVaultKey = deriveVaultKey;
-exports.createDaemonSigningToken = createDaemonSigningToken;
-exports.createSessionSecret = createSessionSecret;
-exports.createVaultSecret = createVaultSecret;
-exports.isVaultSecret = isVaultSecret;
-exports.isDaemonSigningToken = isDaemonSigningToken;
-exports.unlockWithPassword = unlockWithPassword;
-exports.main = main;
-exports.authenticate = authenticate;
-exports.getPrivateKey = getPrivateKey;
-exports.resolvePrivateKey = resolvePrivateKey;
-exports.isMasterPasswordFailure = isMasterPasswordFailure;
-exports.isDaemonReady = isDaemonReady;
-exports.isDaemonResponsive = isDaemonResponsive;
-exports.waitForDaemon = waitForDaemon;
-exports.probeAccountInDaemon = probeAccountInDaemon;
-exports.pingDaemon = pingDaemon;
-const path_api_1 = require("./path_api");
-const system_1 = require("./order/utils/system");
-const constants_1 = require("./constants");
-const paths_1 = require("./paths");
-const logger_1 = __importDefault(require("./logger"));
-const storage_1 = require("./storage");
-const fs_utils_1 = require("./utils/fs_utils");
-const socket_json_client_1 = require("./socket_json_client");
-const authority_resolver_1 = require("./authority_resolver");
-const config_1 = require("./config");
-const base58check = __importStar(require("./utils/base58check"));
-const sync_1 = require("./crypto/sync");
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+import { path } from './path_api.js';
+import { readInput, readPassword, sleep } from './order/utils/system.js';
+import { TIMING, CREDENTIAL_PROMPTS } from './constants.js';
+import { PATHS } from './paths.js';
+import { getStorage } from './storage/index.js';
+import { sendSocketJsonRequest } from './socket_json_client.js';
+import { resolvePrivateKey as resolveAuthKey } from './authority_resolver.js';
+import { Config } from './config.js';
+import * as base58check from './utils/base58check.js';
+import { randomBytes, hkdfSync, scryptSync, createHmac, timingSafeEqual, createCipheriv, createDecipheriv, } from './crypto/sync.js';
 let _net;
 function getNet() {
     if (_net === undefined) {
@@ -170,11 +107,11 @@ function getNet() {
     }
     return _net;
 }
-const credential_runtime_1 = require("./credential_runtime");
-const errors_1 = require("./utils/errors");
-const env_1 = require("./env");
-const storage = (0, storage_1.getStorage)();
-const chainKeysLogger = new logger_1.default('chain-keys');
+import { getCredentialReadyFilePath, getCredentialSocketPath, assertPrivatePathSecurity, } from './credential_runtime.js';
+import { getErrorMessage } from './utils/errors.js';
+import { hasProcess } from './env.js';
+const storage = getStorage();
+const { ensureDir } = storage;
 const VAULT_VERSION = 2;
 const VAULT_SALT_BYTES = 16;
 const VAULT_RECORD_SALT_BYTES = 16;
@@ -185,7 +122,7 @@ const VAULT_KEY_BYTES = 32;
 // strong default; only DEXBOT_VAULT_SCRYPT_N (or a small N) lowers it.
 const _vaultScryptNOverride = (() => {
     try {
-        if (!(0, env_1.hasProcess)())
+        if (!hasProcess())
             return undefined;
         const raw = process.env?.DEXBOT_VAULT_SCRYPT_N;
         if (!raw)
@@ -211,16 +148,16 @@ const VAULT_SECRET_KIND = 'dexbot-vault-secret';
 const VAULT_SESSION_SECRET_KIND = 'dexbot-session-secret';
 const VAULT_DAEMON_SIGNING_TOKEN_KIND = 'dexbot-daemon-signing-token';
 // Profiles key file (ignored) only
-const PROFILES_KEYS_FILE = config_1.Config.DEXBOT_KEYS_FILE
-    ? path_api_1.path.resolve(config_1.Config.DEXBOT_KEYS_FILE)
-    : paths_1.PATHS.PROFILES.KEYS_JSON();
+const PROFILES_KEYS_FILE = Config.DEXBOT_KEYS_FILE
+    ? path.resolve(Config.DEXBOT_KEYS_FILE)
+    : PATHS.PROFILES.KEYS_JSON();
 /**
  * Ensures that the profiles/keys directory exists.
  * @private
  */
 function ensureProfilesKeysDirectory() {
-    const dir = path_api_1.path.dirname(PROFILES_KEYS_FILE);
-    (0, fs_utils_1.ensureDir)(dir);
+    const dir = path.dirname(PROFILES_KEYS_FILE);
+    ensureDir(dir);
 }
 function toBuffer(value, encoding = 'hex') {
     if (Buffer.isBuffer(value)) {
@@ -262,13 +199,13 @@ function createVaultSecret(vaultKey, extra = {}) {
         vaultKeyHex: keyBuffer.toString('hex'),
     };
 }
-function createSessionSecret(vaultKey, sessionSalt = (0, sync_1.randomBytes)(VAULT_SALT_BYTES)) {
+function createSessionSecret(vaultKey, sessionSalt = randomBytes(VAULT_SALT_BYTES)) {
     const keyBuffer = resolveVaultKey(vaultKey);
     const saltBuffer = toBuffer(sessionSalt);
     if (!keyBuffer || !saltBuffer) {
         throw new Error('Vault secret and session salt are required');
     }
-    const sessionKey = Buffer.from((0, sync_1.hkdfSync)('sha256', keyBuffer, saltBuffer, VAULT_SESSION_INFO, VAULT_KEY_BYTES));
+    const sessionKey = Buffer.from(hkdfSync('sha256', keyBuffer, saltBuffer, VAULT_SESSION_INFO, VAULT_KEY_BYTES));
     return {
         kind: VAULT_SESSION_SECRET_KIND,
         version: VAULT_VERSION,
@@ -283,7 +220,7 @@ function createDaemonSigningToken(accountName, options = {}) {
     return {
         kind: VAULT_DAEMON_SIGNING_TOKEN_KIND,
         accountName,
-        socketPath: options.socketPath || (0, credential_runtime_1.getCredentialSocketPath)(options),
+        socketPath: options.socketPath || getCredentialSocketPath(options),
         sessionId: options.sessionId || null,
         botHmacSecret: options.botHmacSecret || null,
     };
@@ -292,8 +229,8 @@ function isDaemonSigningToken(value) {
     return !!(value && typeof value === 'object' && value.kind === VAULT_DAEMON_SIGNING_TOKEN_KIND && typeof value.accountName === 'string');
 }
 function deriveVaultKey(password, vaultSalt) {
-    const saltBuffer = toBuffer(vaultSalt) || (0, sync_1.randomBytes)(VAULT_SALT_BYTES);
-    return (0, sync_1.scryptSync)(password, saltBuffer, VAULT_KEY_BYTES, VAULT_SCRYPT_PARAMS);
+    const saltBuffer = toBuffer(vaultSalt) || randomBytes(VAULT_SALT_BYTES);
+    return scryptSync(password, saltBuffer, VAULT_KEY_BYTES, VAULT_SCRYPT_PARAMS);
 }
 function deriveRecordKey(vaultKey, recordSalt) {
     const keyBuffer = resolveVaultKey(vaultKey);
@@ -301,14 +238,14 @@ function deriveRecordKey(vaultKey, recordSalt) {
     if (!keyBuffer || !saltBuffer) {
         throw new Error('Vault key and record salt are required');
     }
-    return Buffer.from((0, sync_1.hkdfSync)('sha256', keyBuffer, saltBuffer, VAULT_RECORD_INFO, VAULT_KEY_BYTES));
+    return Buffer.from(hkdfSync('sha256', keyBuffer, saltBuffer, VAULT_RECORD_INFO, VAULT_KEY_BYTES));
 }
 function createVaultVerifier(vaultKey) {
     const keyBuffer = resolveVaultKey(vaultKey);
     if (!keyBuffer) {
         throw new Error('Vault key is required');
     }
-    return (0, sync_1.createHmac)('sha256', keyBuffer).update(VAULT_VERIFIER_LABEL).digest('hex');
+    return createHmac('sha256', keyBuffer).update(VAULT_VERIFIER_LABEL).digest('hex');
 }
 function timingSafeEqualHex(leftHex, rightHex) {
     if (typeof leftHex !== 'string' || typeof rightHex !== 'string' || leftHex.length !== rightHex.length) {
@@ -319,7 +256,7 @@ function timingSafeEqualHex(leftHex, rightHex) {
     if (left.length !== right.length) {
         return false;
     }
-    return (0, sync_1.timingSafeEqual)(left, right);
+    return timingSafeEqual(left, right);
 }
 function normalizeAccountsData(data = {}) {
     const accountsSource = data.accounts && typeof data.accounts === 'object'
@@ -329,7 +266,6 @@ function normalizeAccountsData(data = {}) {
         vaultVersion: Number(data.vaultVersion) || 0,
         vaultSalt: typeof data.vaultSalt === 'string' ? data.vaultSalt : '',
         vaultVerifier: typeof data.vaultVerifier === 'string' ? data.vaultVerifier : '',
-        masterPasswordHash: typeof data.masterPasswordHash === 'string' ? data.masterPasswordHash : '',
         accounts: accountsSource,
     };
 }
@@ -356,9 +292,6 @@ function verifyModernPassword(password, accountsData) {
     const secret = deriveModernSecretFromPassword(password, accountsData);
     return timingSafeEqualHex(createVaultVerifier(secret), accountsData.vaultVerifier);
 }
-function isVersionedEncryptedPayload(encrypted) {
-    return String(encrypted || '').startsWith('v2:');
-}
 /**
  * Encrypt text using the v2 AES-256-GCM vault format.
  * @param {string} text - Plain text to encrypt
@@ -370,10 +303,10 @@ function encrypt(text, secret) {
     if (!vaultKey) {
         throw new Error('A derived vault secret is required to encrypt v2 key data');
     }
-    const salt = (0, sync_1.randomBytes)(VAULT_RECORD_SALT_BYTES);
+    const salt = randomBytes(VAULT_RECORD_SALT_BYTES);
     const key = deriveRecordKey(vaultKey, salt);
-    const iv = (0, sync_1.randomBytes)(VAULT_IV_BYTES);
-    const cipher = (0, sync_1.createCipheriv)('aes-256-gcm', key, iv);
+    const iv = randomBytes(VAULT_IV_BYTES);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
     let encrypted = cipher.update(text, 'utf8', 'hex');
     encrypted += cipher.final('hex');
     const authTag = cipher.getAuthTag();
@@ -388,33 +321,22 @@ function encrypt(text, secret) {
  */
 function decrypt(encrypted, secret) {
     const parts = String(encrypted || '').split(':');
-    if (parts.length < 4) {
-        throw new Error('Invalid encrypted payload');
-    }
-    const isVersioned = parts.length === 5 && parts[0] === 'v2';
-    if (!isVersioned && parts.length !== 4) {
+    if (parts.length !== 5 || parts[0] !== 'v2') {
         throw new Error('Unsupported encrypted payload version');
     }
-    const saltIndex = isVersioned ? 1 : 0;
-    const ivIndex = isVersioned ? 2 : 1;
-    const authTagIndex = isVersioned ? 3 : 2;
-    const payloadIndex = isVersioned ? 4 : 3;
-    const salt = toBuffer(parts[saltIndex]);
-    const iv = toBuffer(parts[ivIndex]);
-    const authTag = toBuffer(parts[authTagIndex]);
-    const encryptedText = parts[payloadIndex];
+    const salt = toBuffer(parts[1]);
+    const iv = toBuffer(parts[2]);
+    const authTag = toBuffer(parts[3]);
+    const encryptedText = parts[4];
     if (!salt || !iv || !authTag || typeof encryptedText !== 'string') {
         throw new Error('Invalid encrypted payload');
     }
-    if (!isVersioned) {
-        throw new Error('Legacy encrypted data requires migration before decrypt');
-    }
     const vaultKey = resolveVaultKey(secret);
     if (!vaultKey) {
         throw new Error('A derived vault secret is required to decrypt v2 key data');
     }
     const key = deriveRecordKey(vaultKey, salt);
-    const decipher = (0, sync_1.createDecipheriv)('aes-256-gcm', key, iv);
+    const decipher = createDecipheriv('aes-256-gcm', key, iv);
     decipher.setAuthTag(authTag);
     let decrypted = decipher.update(encryptedText, 'hex', 'utf8');
     decrypted += decipher.final('utf8');
@@ -466,7 +388,7 @@ function validatePrivateKey(key) {
             return { valid: false, reason: `PVT_K1_ key decoded to ${payload.length} bytes, expected 32` };
         }
         catch (err) {
-            return { valid: false, reason: `PVT_K1_ key has invalid base58check encoding: ${(0, errors_1.getErrorMessage)(err)}` };
+            return { valid: false, reason: `PVT_K1_ key has invalid base58check encoding: ${getErrorMessage(err)}` };
         }
     }
     // Hex private key (64 hex chars) - accept optionally
@@ -478,7 +400,7 @@ function validatePrivateKey(key) {
 /**
  * Load stored accounts from profiles/keys.json.
  * Returns empty structure if file doesn't exist or is corrupted.
- * @returns {Object} { vaultVersion: number, vaultSalt: string, vaultVerifier: string, masterPasswordHash: string, accounts: Object }
+ * @returns {Object} { vaultVersion: number, vaultSalt: string, vaultVerifier: string, accounts: Object }
  */
 function loadAccounts() {
     try {
@@ -486,18 +408,17 @@ function loadAccounts() {
     }
     catch (error) {
         if (error.code !== 'ENOENT' && !(error instanceof SyntaxError)) {
-            console.error('Error loading accounts file, resetting to default:', (0, errors_1.getErrorMessage)(error));
+            console.error('Error loading accounts file, resetting to default:', getErrorMessage(error));
         }
         return normalizeAccountsData();
     }
 }
 function setupModernVault(accountsData, password) {
-    const vaultSalt = (0, sync_1.randomBytes)(VAULT_SALT_BYTES);
+    const vaultSalt = randomBytes(VAULT_SALT_BYTES);
     const vaultKey = deriveVaultKey(password, vaultSalt);
     accountsData.vaultVersion = VAULT_VERSION;
     accountsData.vaultSalt = vaultSalt.toString('hex');
     accountsData.vaultVerifier = createVaultVerifier(vaultKey);
-    delete accountsData.masterPasswordHash;
     return createVaultSecret(vaultKey);
 }
 /**
@@ -505,38 +426,20 @@ function setupModernVault(accountsData, password) {
  * the current user.  Returns silently if the file doesn't exist yet (it will be
  * created correctly by saveAccounts).
  *
- * MIGRATION: If the file has the legacy 0o644 mode (from before the atomic-write
- * fix), auto-remediate to 0o600 and log a warning.  This prevents the first run
- * after upgrade from crashing with "Unexpected permissions".
- *
+ * Fails closed on any violation (world-readable mode, symlink, wrong owner).
  * Should be called early in every entry point that may read or write keys.json.
  */
 function checkKeysFileSecurity() {
     if (!storage.exists(PROFILES_KEYS_FILE))
         return;
-    try {
-        (0, credential_runtime_1.assertPrivatePathSecurity)(PROFILES_KEYS_FILE, { expectedType: 'file', requiredMode: 0o600 });
-    }
-    catch (err) {
-        // Auto-remediate legacy 0o644 mode (the state per the security audit)
-        const stat = storage.lstat(PROFILES_KEYS_FILE);
-        const mode = stat.mode & 0o777;
-        if (mode === 0o644 && !stat.isSymbolicLink()) {
-            storage.chmod(PROFILES_KEYS_FILE, 0o600);
-            chainKeysLogger.warn(`[security] Auto-fixed ${PROFILES_KEYS_FILE} permissions from 0o644 to 0o600. Run: chmod 600 profiles/keys.json`);
-            return;
-        }
-        // For any other security issue (symlink, wrong owner, unexpected mode),
-        // fail closed — this is a real security violation, not a migration artifact.
-        throw err;
-    }
+    assertPrivatePathSecurity(PROFILES_KEYS_FILE, { expectedType: 'file', requiredMode: 0o600 });
 }
 /**
  * Unlock the key vault with a master password.
  * Uses modern scrypt v2 vault format with HMAC verification.
  * @param {string} password - Master password
- * @param {import('./types').KeysFile} [accountsData=loadAccounts()] - Accounts data object
- * @returns {import('./types').VaultSecret} Derived vault secret
+ * @param {import('./types.js').KeysFile} [accountsData=loadAccounts()] - Accounts data object
+ * @returns {import('./types.js').VaultSecret} Derived vault secret
  * @throws {MasterPasswordError} If password is incorrect
  * @throws {Error} If vault format is unsupported
  */
@@ -564,7 +467,6 @@ class MasterPasswordError extends Error {
         this.code = MasterPasswordError.code;
     }
 }
-exports.MasterPasswordError = MasterPasswordError;
 /**
  * Check if an error is a master password authentication failure.
  * @param {Error} err - Error to check
@@ -573,7 +475,7 @@ exports.MasterPasswordError = MasterPasswordError;
 function isMasterPasswordFailure(err) {
     return !!(err && (err instanceof MasterPasswordError || err.code === MasterPasswordError.code));
 }
-const MASTER_PASSWORD_MAX_ATTEMPTS = constants_1.CREDENTIAL_PROMPTS.MAX_MASTER_PASSWORD_ATTEMPTS;
+const MASTER_PASSWORD_MAX_ATTEMPTS = CREDENTIAL_PROMPTS.MAX_MASTER_PASSWORD_ATTEMPTS;
 let masterPasswordAttempts = 0;
 /**
  * Prompts the user for the master password with retry tracking.
@@ -587,7 +489,7 @@ async function _promptPassword() {
     }
     masterPasswordAttempts += 1;
     // Use readPassword instead of readlineSync to support Delete key and consistent masking
-    return await (0, system_1.readPassword)('Enter master password: ');
+    return await readPassword('Enter master password: ');
 }
 /**
  * Authenticate and return a derived vault secret.
@@ -642,9 +544,6 @@ function getPrivateKey(accountName, vaultSecret) {
     if (!account) {
         throw new Error(`Account '${accountName}' not found.`);
     }
-    if (!isVersionedEncryptedPayload(account.encryptedKey)) {
-        throw new Error('Legacy encrypted data should have been migrated during unlock');
-    }
     return decrypt(account.encryptedKey, vaultSecret);
 }
 /**
@@ -676,7 +575,7 @@ async function resolvePrivateKey(accountName, vaultSecret, chainClient) {
             return [];
         }
     };
-    return (0, authority_resolver_1.resolvePrivateKey)(accountName, chainClient, tryGetKey, listNames, 0, pubKeyCache);
+    return resolveAuthKey(accountName, chainClient, tryGetKey, listNames, 0, pubKeyCache);
 }
 /**
  * Display stored account names to console.
@@ -707,7 +606,7 @@ async function selectKeyName(accounts, promptText) {
         return null;
     }
     names.forEach((name, index) => console.log(`  ${index + 1}. ${name}`));
-    const raw = (await (0, system_1.readInput)(`${promptText} [1-${names.length}]: `)).trim();
+    const raw = (await readInput(`${promptText} [1-${names.length}]: `)).trim();
     if (raw === '\x1b')
         return '\x1b';
     const idx = Number(raw) - 1;
@@ -725,11 +624,11 @@ async function selectKeyName(accounts, promptText) {
  * @returns {Promise<Object|Buffer|null>} The new vault secret, or the old one if failed/cancelled.
  */
 async function changeMasterPassword(accountsData, currentSecret) {
-    if (!hasModernVault(accountsData) && !accountsData.masterPasswordHash) {
+    if (!hasModernVault(accountsData)) {
         console.log('No master password is set yet.');
         return currentSecret;
     }
-    const oldPassword = await (0, system_1.readPassword)('Enter current master password: ');
+    const oldPassword = await readPassword('Enter current master password: ');
     if (oldPassword === '\x1b')
         return currentSecret;
     if (!verifyCurrentPassword(oldPassword, accountsData)) {
@@ -737,10 +636,10 @@ async function changeMasterPassword(accountsData, currentSecret) {
         return currentSecret;
     }
     const oldSecret = deriveModernSecretFromPassword(oldPassword, accountsData);
-    const newPassword = await (0, system_1.readPassword)('Enter new master password:     ');
+    const newPassword = await readPassword('Enter new master password:     ');
     if (newPassword === '\x1b')
         return currentSecret;
-    const confirmPassword = await (0, system_1.readPassword)('Confirm new master password:   ');
+    const confirmPassword = await readPassword('Confirm new master password:   ');
     if (confirmPassword === '\x1b')
         return currentSecret;
     if (newPassword !== confirmPassword) {
@@ -761,7 +660,7 @@ async function changeMasterPassword(accountsData, currentSecret) {
         // Clear any partially-decrypted keys before returning
         for (const key of Object.keys(decryptedKeys))
             delete decryptedKeys[key];
-        console.log('Failed to decrypt stored keys with the current master password:', (0, errors_1.getErrorMessage)(error));
+        console.log('Failed to decrypt stored keys with the current master password:', getErrorMessage(error));
         return currentSecret;
     }
     const newSecret = setupModernVault(accountsData, newPassword);
@@ -791,12 +690,8 @@ function saveAccounts(data) {
         vaultVersion: data && Number(data.vaultVersion) ? Number(data.vaultVersion) : 0,
         vaultSalt: data && typeof data.vaultSalt === 'string' ? data.vaultSalt : '',
         vaultVerifier: data && typeof data.vaultVerifier === 'string' ? data.vaultVerifier : '',
-        masterPasswordHash: data && typeof data.masterPasswordHash === 'string' ? data.masterPasswordHash : '',
         accounts: data && data.accounts && typeof data.accounts === 'object' ? data.accounts : {},
     };
-    if (!serialized.masterPasswordHash) {
-        delete serialized.masterPasswordHash;
-    }
     if (!serialized.vaultSalt) {
         delete serialized.vaultSalt;
     }
@@ -823,8 +718,8 @@ async function main() {
     // Check if master password is set
     if (!hasModernVault(accountsData)) {
         console.log('No master password set. Please set one:');
-        const password1 = await (0, system_1.readPassword)('Enter master password:   ');
-        const password2 = await (0, system_1.readPassword)('Confirm master password: ');
+        const password1 = await readPassword('Enter master password:   ');
+        const password2 = await readPassword('Confirm master password: ');
         if (password1 !== password2) {
             console.log('Passwords do not match!');
             return;
@@ -841,7 +736,7 @@ async function main() {
         }
         catch (err) {
             if (err instanceof MasterPasswordError) {
-                console.log((0, errors_1.getErrorMessage)(err));
+                console.log(getErrorMessage(err));
                 return;
             }
             throw err;
@@ -856,7 +751,7 @@ async function main() {
         console.log('5. Test decryption');
         console.log('6. Change master password');
         console.log('7. Exit (or press Enter)');
-        const choiceRaw = await (0, system_1.readInput)('Choose an option: ');
+        const choiceRaw = await readInput('Choose an option: ');
         console.log('');
         if (choiceRaw === '\x1b' || choiceRaw.trim() === '') {
             console.log('Keymanager closed!');
@@ -864,14 +759,14 @@ async function main() {
         }
         const choice = choiceRaw.trim();
         if (choice === '1') {
-            const accountNameRaw = await (0, system_1.readInput)('Enter account name: ');
+            const accountNameRaw = await readInput('Enter account name: ');
             if (accountNameRaw === '\x1b')
                 continue;
             const accountName = accountNameRaw.trim();
             if (!accountName) {
                 continue;
             }
-            const privateKeyRaw = await (0, system_1.readPassword)('Enter private key:  ');
+            const privateKeyRaw = await readPassword('Enter private key:  ');
             if (privateKeyRaw === '\x1b')
                 continue;
             const privateKey = privateKeyRaw.replace(/\s+/g, '');
@@ -890,7 +785,7 @@ async function main() {
             const accountName = await selectKeyName(accountsData.accounts, 'Select key to modify');
             if (accountName === '\x1b' || !accountName)
                 continue;
-            const privateKeyRaw = await (0, system_1.readPassword)('Enter private key:   ');
+            const privateKeyRaw = await readPassword('Enter private key:   ');
             if (privateKeyRaw === '\x1b')
                 continue;
             const privateKey = privateKeyRaw.replace(/\s+/g, '');
@@ -909,7 +804,7 @@ async function main() {
             const accountName = await selectKeyName(accountsData.accounts, 'Select key to remove');
             if (accountName === '\x1b' || !accountName)
                 continue;
-            const confirm = (await (0, system_1.readInput)(`Remove '${accountName}'? (y/n): `)).trim().toLowerCase();
+            const confirm = (await readInput(`Remove '${accountName}'? (y/n): `)).trim().toLowerCase();
             if (confirm === '\x1b')
                 continue;
             if (confirm === 'y') {
@@ -955,7 +850,7 @@ async function main() {
  */
 function isDaemonReady(options = {}) {
     try {
-        return storage.exists((0, credential_runtime_1.getCredentialReadyFilePath)(options)) && storage.exists((0, credential_runtime_1.getCredentialSocketPath)(options));
+        return storage.exists(getCredentialReadyFilePath(options)) && storage.exists(getCredentialSocketPath(options));
     }
     catch {
         return false;
@@ -981,7 +876,7 @@ function isDaemonResponsive(options = {}, timeout = 2000) {
         catch {
             return resolve(false);
         }
-        const socketPath = (0, credential_runtime_1.getCredentialSocketPath)(options);
+        const socketPath = getCredentialSocketPath(options);
         const socket = net.createConnection(socketPath);
         let settled = false;
         let responseBuffer = '';
@@ -1030,14 +925,14 @@ function isDaemonResponsive(options = {}, timeout = 2000) {
  * @returns {Promise<void>} Resolves when daemon is ready
  * @throws {Error} If daemon doesn't start within timeout
  */
-async function waitForDaemon(maxWaitMs = constants_1.TIMING.DAEMON_STARTUP_TIMEOUT_MS, options = {}) {
+async function waitForDaemon(maxWaitMs = TIMING.DAEMON_STARTUP_TIMEOUT_MS, options = {}) {
     const startTime = Date.now();
-    const checkInterval = constants_1.TIMING.CHECK_INTERVAL_MS; // Check every 100ms
+    const checkInterval = TIMING.CHECK_INTERVAL_MS; // Check every 100ms
     while (Date.now() - startTime < maxWaitMs) {
         if (isDaemonReady(options)) {
             return;
         }
-        await (0, system_1.sleep)(checkInterval);
+        await sleep(checkInterval);
     }
     throw new Error(`Daemon did not start within ${maxWaitMs}ms`);
 }
@@ -1052,9 +947,9 @@ async function waitForDaemon(maxWaitMs = constants_1.TIMING.DAEMON_STARTUP_TIMEO
  * @param {function} extractResult - Callback: (response) => resolved value; throw to reject
  * @returns {Promise<*>} Resolved value from extractResult
  */
-function sendDaemonRequest(requestType, accountName, timeout = constants_1.TIMING.DAEMON_PING_TIMEOUT_MS, options = {}, label = 'request', extractResult = null) {
-    return (0, socket_json_client_1.sendSocketJsonRequest)({
-        socketPath: (0, credential_runtime_1.getCredentialSocketPath)(options),
+function sendDaemonRequest(requestType, accountName, timeout = TIMING.DAEMON_PING_TIMEOUT_MS, options = {}, label = 'request', extractResult = null) {
+    return sendSocketJsonRequest({
+        socketPath: getCredentialSocketPath(options),
         timeoutMs: timeout,
         writePayload: (socket) => {
             socket.write(JSON.stringify({ type: requestType, accountName }) + '\n');
@@ -1064,7 +959,7 @@ function sendDaemonRequest(requestType, accountName, timeout = constants_1.TIMIN
                 case 'timeout':
                     return new Error(`Daemon ${label} timeout`);
                 case 'connection':
-                    return new Error(`Daemon connection failed: ${(0, errors_1.getErrorMessage)(detail)}`);
+                    return new Error(`Daemon connection failed: ${getErrorMessage(detail)}`);
                 case 'invalid':
                     return new Error(`Invalid daemon ${label} response`);
                 default:
@@ -1098,7 +993,7 @@ function sendDaemonRequest(requestType, accountName, timeout = constants_1.TIMIN
  * @param {Object} options - Optional socket path overrides
  * @returns {Promise<boolean>} Resolves with true if daemon responds
  */
-function pingDaemon(accountName, timeout = constants_1.TIMING.DAEMON_PING_TIMEOUT_MS, options = {}) {
+function pingDaemon(accountName, timeout = TIMING.DAEMON_PING_TIMEOUT_MS, options = {}) {
     return sendDaemonRequest('ping', accountName, timeout, options, 'ping', (response) => {
         if (response.success && response.pong)
             return true;
@@ -1112,12 +1007,12 @@ function pingDaemon(accountName, timeout = constants_1.TIMING.DAEMON_PING_TIMEOU
  * @param {Object} options - Optional socket path overrides
  * @returns {Promise<string|null>} Resolves with sessionId if account is available, rejects otherwise
  */
-function probeAccountInDaemon(accountName, timeout = constants_1.TIMING.DAEMON_PING_TIMEOUT_MS, options = {}) {
+function probeAccountInDaemon(accountName, timeout = TIMING.DAEMON_PING_TIMEOUT_MS, options = {}) {
     return sendDaemonRequest('probe-account', accountName, timeout, options, 'probe', (response) => {
         if (response.success)
             return response.sessionId || null;
         throw new Error(response.error || 'Daemon probe failed');
     });
 }
-module.exports = { validatePrivateKey, loadAccounts, saveAccounts, checkKeysFileSecurity, encrypt, decrypt, deriveVaultKey, createDaemonSigningToken, createSessionSecret, createVaultSecret, isVaultSecret, isDaemonSigningToken, unlockWithPassword, main, authenticate, getPrivateKey, resolvePrivateKey, isMasterPasswordFailure, MasterPasswordError, isDaemonReady, isDaemonResponsive, waitForDaemon, probeAccountInDaemon, pingDaemon };
+export { validatePrivateKey, loadAccounts, saveAccounts, checkKeysFileSecurity, encrypt, decrypt, deriveVaultKey, createDaemonSigningToken, createSessionSecret, createVaultSecret, isVaultSecret, isDaemonSigningToken, unlockWithPassword, main, authenticate, getPrivateKey, resolvePrivateKey, isMasterPasswordFailure, MasterPasswordError, isDaemonReady, isDaemonResponsive, waitForDaemon, probeAccountInDaemon, pingDaemon };
 //# sourceMappingURL=chain_keys.js.map