153 lines
4.1 KiB
Markdown
153 lines
4.1 KiB
Markdown
# Motr Enclave
|
|
|
|
Extism WASM plugin providing encrypted key storage for the Nebula wallet. Built with Go 1.25+ for `wasip1` target.
|
|
|
|
## Features
|
|
|
|
- **WebAuthn Integration** - Device-bound credentials with PRF key derivation
|
|
- **MPC Key Shares** - Secure threshold signature key storage
|
|
- **Multi-Chain Support** - BIP44 derivation for Sonr, Ethereum, Bitcoin
|
|
- **UCAN v1.0.0-rc.1** - Capability-based authorization with CID-indexed delegations
|
|
- **Encryption at Rest** - AES-256-GCM encrypted database serialization
|
|
- **SQLite Functions** - Custom functions for address derivation and signing
|
|
|
|
## Quick Start
|
|
|
|
```bash
|
|
make start
|
|
```
|
|
|
|
This single command:
|
|
1. Installs dependencies (Go, Bun)
|
|
2. Builds the WASM plugin
|
|
3. Builds the TypeScript SDK
|
|
4. Starts the dev server at http://localhost:8080
|
|
|
|
## Manual Setup
|
|
|
|
```bash
|
|
make deps # Install tooling
|
|
make build # Build WASM plugin
|
|
make sdk # Build TypeScript SDK
|
|
make dev # Start dev server
|
|
```
|
|
|
|
## Usage
|
|
|
|
### TypeScript/ESM
|
|
|
|
```typescript
|
|
import { createEnclave } from '@sonr/motr-enclave';
|
|
|
|
const enclave = await createEnclave('/enclave.wasm');
|
|
|
|
// Generate new identity with MPC key share
|
|
const result = await enclave.generate(credentialBase64);
|
|
// Returns: { did, enclave_id, public_key, accounts, database }
|
|
|
|
// Load existing database
|
|
await enclave.load(database);
|
|
|
|
// List accounts across all chains
|
|
const accounts = await enclave.exec('resource:accounts action:list');
|
|
|
|
// Sign data with an enclave
|
|
const signature = await enclave.exec('resource:enclaves action:sign subject:enclave_id:data_hex');
|
|
|
|
// Query DID document
|
|
const didDoc = await enclave.query();
|
|
```
|
|
|
|
### CLI Testing
|
|
|
|
```bash
|
|
make test-plugin
|
|
```
|
|
|
|
## Plugin Functions
|
|
|
|
| Function | Input | Output |
|
|
|----------|-------|--------|
|
|
| `ping` | Message string | Echo response |
|
|
| `generate` | WebAuthn credential (base64) | DID, enclave_id, public_key, accounts[], database |
|
|
| `load` | Database buffer | Success status, DID |
|
|
| `exec` | Filter string | Action result |
|
|
| `query` | DID (optional) | DID document |
|
|
|
|
### Exec Resources & Actions
|
|
|
|
| Resource | Actions |
|
|
|----------|---------|
|
|
| `accounts` | list, get, sign |
|
|
| `enclaves` | list, get, sign, rotate, archive, delete |
|
|
| `credentials` | list, get |
|
|
| `sessions` | list, revoke |
|
|
| `grants` | list, revoke |
|
|
| `delegations` | list, list_received, list_command, get, revoke, verify, cleanup |
|
|
| `verification_methods` | list, get, delete |
|
|
| `services` | list, get, get_by_id |
|
|
|
|
### Filter Syntax
|
|
|
|
```
|
|
resource:<name> action:<action> [subject:<value>]
|
|
```
|
|
|
|
Examples:
|
|
```bash
|
|
# List all accounts
|
|
resource:accounts action:list
|
|
|
|
# Get specific account
|
|
resource:accounts action:get subject:sonr1abc...
|
|
|
|
# Sign with enclave
|
|
resource:enclaves action:sign subject:enc_123:48656c6c6f
|
|
|
|
# List delegations by command
|
|
resource:delegations action:list_command subject:/vault/read
|
|
```
|
|
|
|
## Architecture
|
|
|
|
The enclave uses SQLite as a computation engine with custom functions:
|
|
|
|
| Function | Purpose |
|
|
|----------|---------|
|
|
| `bip44_derive(pubkey, chain)` | Derive address from public key |
|
|
| `bip44_derive_from_enclave(id, chain)` | Derive address from stored enclave |
|
|
|
|
Supported chains: `sonr` (Cosmos 118), `ethereum` (60), `bitcoin` (0)
|
|
|
|
## Project Structure
|
|
|
|
```
|
|
motr-enclave/
|
|
├── cmd/enclave/ # WASM plugin entry point
|
|
├── internal/
|
|
│ ├── keybase/ # Database layer + SQLite functions
|
|
│ ├── crypto/mpc/ # MPC key operations
|
|
│ ├── crypto/ucan/ # UCAN v1.0.0-rc.1 builders
|
|
│ └── migrations/ # Schema + queries
|
|
├── src/ # TypeScript SDK
|
|
├── dist/ # Built SDK
|
|
├── example/ # Browser demo
|
|
└── Makefile
|
|
```
|
|
|
|
## Development
|
|
|
|
```bash
|
|
make test # Run Go tests
|
|
make lint # Run linter
|
|
make clean # Remove build artifacts
|
|
make generate # Regenerate SQLC code
|
|
```
|
|
|
|
## Documentation
|
|
|
|
- [AGENTS.md](./AGENTS.md) - Architecture and coding guidelines
|
|
- [TODO.md](./TODO.md) - Remaining implementation tasks
|
|
- [CHANGELOG.md](./CHANGELOG.md) - Version history
|
|
- [MIGRATION.md](./MIGRATION.md) - Original schema design
|