@synet/core/dist/identity/KeyManager.js

Core cryptographic and identity primitives for Synet agents.

"use strict";
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    var desc = Object.getOwnPropertyDescriptor(m, k);
    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
      desc = { enumerable: true, get: function() { return m[k]; } };
    }
    Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
    Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
    o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
    var ownKeys = function(o) {
        ownKeys = Object.getOwnPropertyNames || function (o) {
            var ar = [];
            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
            return ar;
        };
        return ownKeys(o);
    };
    return function (mod) {
        if (mod && mod.__esModule) return mod;
        var result = {};
        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
        __setModuleDefault(result, mod);
        return result;
    };
})();
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.getKeyProvider = getKeyProvider;
exports.generateKeyPair = generateKeyPair;
exports.derivePublicKey = derivePublicKey;
exports.getShortId = getShortId;
exports.getFingerprint = getFingerprint;
exports.generateWireGuardKeyPair = generateWireGuardKeyPair;
const crypto = __importStar(require("node:crypto"));
const tweetnacl_1 = __importDefault(require("tweetnacl"));
const tweetnacl_util_1 = require("tweetnacl-util");
class RsaKeyProvider {
    generateKeyPair() {
        const { publicKey, privateKey } = crypto.generateKeyPairSync("rsa", {
            modulusLength: 2048,
            publicKeyEncoding: { type: "spki", format: "pem" },
            privateKeyEncoding: { type: "pkcs8", format: "pem" },
        });
        return { publicKey, privateKey, type: "rsa" };
    }
}
class Ed25519KeyProvider {
    generateKeyPair() {
        const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519", {
            publicKeyEncoding: { type: "spki", format: "pem" },
            privateKeyEncoding: { type: "pkcs8", format: "pem" },
        });
        return { publicKey, privateKey, type: "ed25519" };
    }
}
class WireguardKeyProvider {
    generateKeyPair() {
        const keyPair = tweetnacl_1.default.box.keyPair();
        return {
            privateKey: (0, tweetnacl_util_1.encodeBase64)(keyPair.secretKey),
            publicKey: (0, tweetnacl_util_1.encodeBase64)(keyPair.publicKey),
            type: "wireguard",
        };
    }
}
// Factory
function getKeyProvider(type) {
    switch (type) {
        case "rsa": return new RsaKeyProvider();
        case "ed25519": return new Ed25519KeyProvider();
        case "wireguard": return new WireguardKeyProvider();
        default: throw new Error(`Unsupported key type: ${type}`);
    }
}
/**
 *
 * @param type The type of key to generate (e.g., '
 * rsa', 'ed25519', 'wireguard')
 * @returns A key pair object containing the private and public keys
 * @throws Error if the key type is unsupported
 * @returns
 */
function generateKeyPair(type) {
    try {
        const provider = getKeyProvider(type);
        const { privateKey, publicKey } = provider.generateKeyPair();
        return { privateKey, publicKey, type };
    }
    catch (error) {
        console.error("Error generating key pair:", error);
        throw error;
    }
}
/**
 * Extract the public key from a private key
 * @param privateKey The private key in PEM format
 * @returns The corresponding public key in PEM format, or null if extraction fails
 */
function derivePublicKey(privateKey) {
    try {
        if (!privateKey ||
            !privateKey.includes("-----BEGIN") ||
            !privateKey.includes("-----END")) {
            return null;
        }
        // Create a KeyObject from the private key PEM
        const privateKeyObj = crypto.createPrivateKey({
            key: privateKey,
            format: "pem",
        });
        // Derive the public key from the private key
        const publicKey = crypto.createPublicKey(privateKeyObj).export({
            type: "spki",
            format: "pem",
        });
        return publicKey.toString();
    }
    catch (error) {
        console.error("Failed to derive public key:", error);
        return null;
    }
}
/**
 * Compute a short identifier from a public key
 * @param publicKey The public key in PEM format
 * @returns A 16-character hexadecimal identifier
 */
function getShortId(publicKey) {
    const hash = crypto.createHash("sha256").update(publicKey).digest("hex");
    return hash.substring(0, 16);
}
/**
 * Compute a fingerprint from a public key
 * @param publicKey The public key in PEM format
 * @returns A 64-character hexadecimal fingerprint
 */
function getFingerprint(publicKey) {
    return crypto.createHash("sha256").update(publicKey).digest("hex");
}
/**
 * @deprecated Use generateKeyPair('wireguard') instead.
 * Generates a WireGuard-compatible key pair using TweetNaCl.
 * @returns A key pair object with WireGuard-compatible keys
 */
function generateWireGuardKeyPair() {
    // Generate a keypair using TweetNaCl's box (which uses Curve25519)
    const keyPair = tweetnacl_1.default.box.keyPair();
    // Convert the Uint8Array keys to base64 strings as required by WireGuard
    return {
        privateKey: (0, tweetnacl_util_1.encodeBase64)(keyPair.secretKey),
        publicKey: (0, tweetnacl_util_1.encodeBase64)(keyPair.publicKey)
    };
}