Travel Rule Link (TRLink) Integration Guide

const acmeLegalEntity = await fireblocks.trlink.createLegalEntity({
  shortName: "ACME Corp",
  fullLegalName: "ACME Corporation Ltd",
  countryOfRegistration: "US",
  vaults: [0, 1]
});

// 1. Get available partners
const partners = await fireblocks.trlink.getPartners();
const partnerX = partners.find(p => p.ident === "partnerX");

// 2. Create integration
const integration = await fireblocks.trlink.createLegalEntityIntegration({
  customerId: acmeLegalEntity.id,
  partnerIdent: partnerX.ident
});

// 3. Connect with credentials
const connected = await fireblocks.trlink.connectLegalEntityIntegration(
  integration.customerIntegrationId,
  {
    apiKey: "your-trp-api-key",
    secret: "your-trp-secret"
  }
);

// 4. Test connection
const testResult = await fireblocks.trlink.testLegalEntityIntegrationConnection(
  integration.customerIntegrationId
);

if (testResult.success) {
  console.log("Setup complete and connection verified!");
} else {
  console.error("Connection test failed:", testResult.message);
}

const txId = "12345678-1234-1234-1234-123456789abc";

// 1. Assess travel rule requirement using txId
const assessment = await fireblocks.trlink.assessTravelRuleRequirement(
  legalEntityIntegrationId,
  {
    txId: txId,
    originatorVaspId: "originator-vasp-123"
  }
);

if (assessment.decision === "REQUIRED") {
  // 2. Get public key for encryption and save to temp file
  const publicKey = await fireblocks.trlink.getPublicKeyForEncryption(legalEntityIntegrationId);

 await fs.writeFile(path.join(__dirname, 'public-key.json'), JSON.stringify(publicKey, null, 2), 'utf8');

  // 3. Encrypt IVMS data (encrypt data + IVMS specification)

  // WARNING: This is not production-ready code. 
  // Due to the use of fixed file paths (like 'ivms.json'), 
  // race conditions can occur during parallel execution. 
  // It is recommended to use a solution for generating unique temporary 
  // filenames (e.g., using the 'tmp' npm package, or relying on 
  // system-level functions like the Linux tempnam()).
  const publicKeyPath = path.join(__dirname, 'public-key.json');
  const privateKeyPath = path.join(__dirname, 'private-key.json');
  const ivmsDataPath = path.join(__dirname, 'ivms.json');
  const scriptPath = path.join(__dirname, 'encrypt.js');

  const ivmsOutput = execSync(`node "${scriptPath}" "${publicKeyPath}" "${privateKeyPath}" "${ivmsDataPath}"`, {
    encoding: 'utf-8',
    stdio: ['pipe', 'pipe', 'pipe']
  });

  const ivms = JSON.parse(ivmsOutput.trim());


  // 4. Create TRM with txId
  const trm = await fireblocks.trlink.createTravelRuleMessage(
    legalEntityIntegrationId,
    {
      txId: txId,
      originatorVaspId: "originator-vasp-123",
      ivms,
    }
  );

  // 5. Link TRM to transaction.  Recommendation - use the <partnerIdent>:<trmId> format, indicating not only trmId, but also a partner where trm is registered

  await fireblocks.trlink.setTransactionTravelRuleMessageId(txId, {
    travelRuleMessageId: trm.id
  });
}

// 1. Assess travel rule requirement
const assessment = await fireblocks.trlink.assessTravelRuleRequirement(
  legalEntityIntegrationId,
  {
    amount: "1500",
    assetId: "ETH",
    direction: "outbound",
    source: { type: "VAULT_ACCOUNT", id: "0" },
    destination: {
      type: "ONE_TIME_ADDRESS",
      oneTimeAddress: { address: "0xabcd..." }
    },
    beneficiaryVaspId: "vasp-456"
  }
);

if (assessment.decision === "REQUIRED") {
  // 2. Get public key for encryption and save to temp file
  const publicKey = await fireblocks.trlink.getPublicKeyForEncryption(legalEntityIntegrationId);

  await fs.writeFile(path.join(__dirname, 'public-key.json'), JSON.stringify(publicKey, null, 2), 'utf8');

  // 3. Encrypt IVMS data (encrypt data + IVMS specification)
  
  // WARNING: This is not production-ready code. 
  // Due to the use of fixed file paths (like 'ivms.json'), 
  // race conditions can occur during parallel execution. 
  // It is recommended to use a solution for generating unique temporary 
  // filenames (e.g., using the 'tmp' npm package, or relying on 
  // system-level functions like the Linux tempnam()).
  
  const publicKeyPath = path.join(__dirname, 'public-key.json');
  const privateKeyPath = path.join(__dirname, 'private-key.json');
  const ivmsDataPath = path.join(__dirname, 'ivms.json');
  const scriptPath = path.join(__dirname, 'encrypt.js');

  const ivmsOutput = execSync(`node "${scriptPath}" "${publicKeyPath}" "${privateKeyPath}" "${ivmsDataPath}"`, {
    encoding: 'utf-8',
    stdio: ['pipe', 'pipe', 'pipe']
  });

  const ivms = JSON.parse(ivmsOutput.trim());

  // 4. Create TRM
  const trm = await fireblocks.trlink.createTravelRuleMessage(
    legalEntityIntegrationId,
    {
      amount: "1500",
      assetId: "ETH",
      direction: "outbound",
      source: { type: "VAULT_ACCOUNT", id: "0" },
      destination: {
        type: "ONE_TIME_ADDRESS",
        oneTimeAddress: { address: "0xabcd..." }
      },
      beneficiaryVaspId: "vasp-456",
      ivms,
    }
  );

  // 5a. Create Fireblocks transaction - use travelRuleMessageId field to set TRM id
  // recommendation - use the <partnerIdent>:<trmId> format, indicating not only trmId, but also a partner where trm is registered
  const txId = await createFireblocksTransaction({ 
/* ... */ 
travelRuleMessageId: `${partnerIdent}:${trm.id}`
});

  // Or, 5b. Link TRM to transaction later if not set during tx creation
  await fireblocks.trlink.setTransactionTravelRuleMessageId(txId, {
    travelRuleMessageId: `${partnerIdent}:${trm.id}`
  });
}

{
  "issuer": "sumsub.com",
  "publicKey": {
    "kty": "RSA",
    "kid": "test-sender-2025",
    "e": "AQAB",
    "n": "q6fmy_rjX2xizMiXoWKRVZSrDXXYLnMk6J_q-5FAD5q7CdqK10XmQZrlzItLpj9qxl0LfcZhZ93PL55abei1F4u6Jdzh9LrfUF5WZ7Cvi25n6aeJoOd7JIERY0hP8s-xdiDrr5fRqdseHymENhvwK5J8_adEOcWHR_7ymb17c3ivFQmprytkJD6BfXaF7qGeE6cx0UiDlD1sHCGcd26I1JNjYQZJie0qlPT8x7jILNA7sW1_Nk8wx9jRDtUv6-K2qnz4MvFe1D6rddcnCsiX7MRPWKm10hy41MTJkQcWUYgtDqfdOXNo8D8BnaVuaLEsByNxMQiL8ePXZpBro0nrnw"
  }
}

{
  "kty": "RSA",
  "kid": "test-recipient-2025",
  "e": "AQAB",
  "n": "m58UpcvahBK3-Uma_S4HTGwijmASh_3ATDwkjIb1svp2jnrv6lhjE2Yz28b0oUsEa7Wau6x0NPbaUCrQjjN5iUoumn4Jwq6jKttXFtd4v3583co4sBjGoPqk7GbkeYKzEOs2wmKgKbQjjk1BaHFpTPlAmS2JbNy6VmHNj-62BK1vIeegXheqxkr-b-MvESmL746juz_LlTMPmJqbaNuMeQMktT9lBLPfZermLfUuC7myuQhrsD8zJaNiNDWJQ6dzNi-Cy0uGlDcy9xtSQMW1Tv3Fc7hO_bRD1NI-sJp7nVi6hdc-QMOyrv8tzlhTV7gh3Wnn2kIFFkWy86gYYHw79Q",
  "d": "HJYLvmrkYGdp2QZ-zGwUliK09E9MiCOCG97eXdv6rR5aAdEuWe9Tf8BB3Wi-DhTQIpLw8fF7RTFlJ929gqmM9T2lsuZdF6Bpw5kX9c-t1AtBl6IqaJqcffycp_o8lN9_0idK30krn42CDIU_cxaGH8gXaCvXtyISroR3tK1GTTRfLSqcAQ3wI5Kj7IRf_oCyU6zZ9Vo30X1Tus-yE9Gv0D5wDOybfRljQJ7D7lA-thXzVeO8YwvoIp_K7aA5BaJjMg2TaYdPskCV4Wbu3O0ezHw2GCbkgusIG_ZEtcCFbldR45Vwtpp6Hm82g2lqDynNyRrTqeCoigkIqLwW8vir3w",
  "p": "0huuQD7Cv4R6pgucabPQt7I-1BSG5Ao32ZzTQzqB6H5zeyF76G82TRuSu3Ky4WBCJiFr1czHlA5RlpllU6lEivoOaslc4NtgABLyfTE3EPhP45xBhfOh1FmtMkZdJFXGwpIGOlPByc2nQC3mO9I8wRltvDAB0hds4vsEdQPPpNs",
  "q": "vZy-PHqEib7mYEGmhwoJcHzTrFjK5CAcQ0gqH41ALvKdArk1RzGJWEduQqG8s2_g84z3iobnlslSFM_FVvtQjGGqw8ul9VvHTOCiKlOCnJtCTOHqhGZMQTVSxoQito-RidKNA4rHpjHbU5Gq_3gLmVqdMeQw_Fx_NS1D2y5-k28",
  "dp": "YZA4-dwq0oPR8Ai0OOEmqiY6xoBBouKbzJDmCPHCIROWzDZgMy5xKJ0FJcW9CqqIDOy4Bi9w_W8os6XHR3HyQhabWzrlxgQYL_CcaUXRLDAh6K9GPc1D-DcsFYxW8-hgwzjLa4o5ElxMraCiqGSXkZMdQaWJMuVtyniFOVDrusE",
  "dq": "s3uvx-fhldISmIMMcz9Y-BXw-G-EfrS2jCm_VeaLHuWhInbWq_GEJQBYqtIWoXQB6AlEOOjCR8WB4Rlbn558_KVm07ft_HdIDMmGN7KdLEj7VXN0XqfG_uLO3AMwKMd16JRZz0SLABKpnk2BJBoqQJu5uQRcKkYUU-3pEYzNXBk",
  "qi": "k1qx6Qd4FpHw1185FZiRm4wGv6wzqSIm1LC0KS29CsGl4D6CVqVVaBwoW0Olw3jkrQe7znSuezC1_lZOGmjB2h3I5bKPlAUVKVqdfk4mwlh7Dfgs6AFcqUj5mpSx1a2L0SHQeZXsprA_EtXs0L37iLCEsoOre9qYRivZBqiTdJk"
}

{
  "Originator": {
    "originatorPersons": [
      {
        "naturalPerson": {
          "name": {
            "nameIdentifier": [
              {
                "primaryIdentifier": "John",
                "secondaryIdentifier": "Doe",
                "nameIdentifierType": "BIRT"
              }
            ],
            "localNameIdentifier": [],
            "phoneticNameIdentifier": []
          },
          "customerIdentification": "e8nvdf2vwa5036ix",
          "dateAndPlaceOfBirth": {
            "dateOfBirth": "1992-05-08"
          }
        }
      }
    ],
    "accountNumber": []
  },
  "Beneficiary": {
    "beneficiaryPersons": [
      {
        "naturalPerson": {
          "name": {
            "nameIdentifier": [
              {
                "primaryIdentifier": "Jack",
                "secondaryIdentifier": "Doe",
                "nameIdentifierType": "BIRT"
              }
            ],
            "localNameIdentifier": [],
            "phoneticNameIdentifier": []
          },
          "customerIdentification": "67b4defbfa5d2e41d8177ab3",
          "dateAndPlaceOfBirth": {
            "dateOfBirth": "1991-04-07"
          }
        }
      }
    ],
    "accountNumber": []
  }
}

const jose = require('node-jose');
const crypto = require('crypto');
const path = require('path');
const fs = require('fs/promises');

const SIGNATURE_ALGORITHM = 'RS256';
const ENCRYPTION_ALGORITHM = 'RSA-OAEP-256';
const ENCRYPTION_METHOD = 'A256GCM';
const DEFAULT_EXPIRY_MS = 300000; // 5 minutes
const CLOCK_SKEW_SEC = 60; // ±60s skew
const CLAIM_DATA = 'data'; // The JWT claim holding the payload

/**
 * Travel Rule JWT Codec for PII Data Encryption
 *
 * Implements a nested JWT (JWS signed token encrypted inside a JWE)
 * for secure PII exchange, compatible with the Java TRJWTCodec implementation.
 *
 * Features:
 * - Object signing and encryption: `prepareIvmsData` / `decryptAndDecode`
 * - JTI (JWT ID) claim for replay attack protection
 * - Standard claims validation (iss, iat, exp)
 */
class TRJWTCodec {
  constructor() {
    this.keyStore = jose.JWK.createKeyStore();
    this.publicKey = null; // Partner's public key (for encryption)
    this.privateKey = null; // Our private key (for signing)
    this.initialized = false;
  }

  /**
   * Initialize the codec with RSA key pairs.
   *
   * @param {Object} config - Configuration object
   * @param {string} config.publicKey - PEM-encoded RSA public key (partner's key for encryption)
   * @param {string} config.privateKey - PEM-encoded RSA private key (our key for signing)
   */
  async initialize(config) {
    this._assert(config.publicKey, 'Public key is required');
    this._assert(config.privateKey, 'Private key is required');

    try {
      this.publicKey = await this.keyStore.add(config.publicKey);
      this.privateKey = await this.keyStore.add(config.privateKey);
      this.initialized = true;
    } catch (error) {
      throw new Error(`Failed to initialize TRJWTCodec with provided keys: ${error.message}`);
    }
  }

  /**
   * Encrypt and sign an object as a nested JWT (JWS inside JWE).
   * This is the lower-level function that returns only the JWE string.
   *
   * @param {Object} data - The JSON-serializable object to encrypt.
   * @param {string} issuer - The 'iss' claim (our identifier).
   * @param {number} [expiryMs=DEFAULT_EXPIRY_MS] - Expiry time in milliseconds.
   * @returns {Promise<string>} - The compact-serialized JWE token string.
   */
  async encodeAndEncrypt(data, issuer, expiryMs = DEFAULT_EXPIRY_MS) {
    this._assertInitialized();
    this._assert(data, 'Data cannot be null or undefined');
    this._assert(issuer && typeof issuer === 'string' && issuer.trim(), 'Issuer must be a non-empty string');

    // 1. Serialize the object to a JSON string
    const dataJson = JSON.stringify(data);
    // 2. Encode the JSON string as base64url
    const dataB64Url = Buffer.from(dataJson, 'utf8').toString('base64url');
    // 3. Pass the base64url string to the byte-level encryption method
    return this.encryptBytes(dataB64Url, issuer, expiryMs);
  }

  /**
   * Prepares the full IVMS data object, including the encrypted JWE
   * and the list of filled fields.
   *
   * @param {Object} data - The IVMS data object to encrypt.
   * @param {string} issuer - The 'iss' claim (our identifier).
   * @param {number} [expiryMs=DEFAULT_EXPIRY_MS] - Expiry time in milliseconds.
   * @returns {Promise<{version: string, data: string, filledFields: string[]}>}
   * An object containing the API version, the encrypted JWE string,
   * and the dot-notation paths of all non-null fields.
   */
  async prepareIvmsData(data, issuer, expiryMs = DEFAULT_EXPIRY_MS) {
    // 1. Create the encrypted JWE string from the data object.
    // This handles signing with our private key and encrypting with the partner's public key.
    const encryptedData = await this.encodeAndEncrypt(data, issuer, expiryMs);
    // 2. Extract all filled field paths from the original data object.
    const filledFields = this._extractFilledFields(data);

    return {
      version: 'IVMS101.2023', // API version
      data: encryptedData,
      filledFields: filledFields
    };
  }

  /**
   * Decrypt and decode data from an encrypted JWE token.
   *
   * @param {string} encryptedJWT - The compact-serialized JWE token.
   * @param {string} [expectedIssuer] - (Optional) The expected 'iss' claim for validation.
   * @returns {Promise<Object>} - The original decrypted and parsed JSON object.
   */
  async decryptAndDecode(encryptedJWT, expectedIssuer = null) {
    this._assertInitialized();
    this._assert(encryptedJWT, 'Encrypted JWT cannot be null or empty');

    // --- JWE Decryption ---
    // 1. Decrypt the outer JWE layer using our private key.
    const jweResult = await jose.JWE.createDecrypt(this.privateKey)
      .decrypt(encryptedJWT);

    // The payload of the JWE is the inner JWS.
    const signedJWT = jweResult.payload.toString('utf8');

    // --- JWS Verification ---
    // 2. Verify the signature of the inner JWS using the partner's public key.
    const jwsResult = await jose.JWS.createVerify(this.publicKey)
      .verify(signedJWT);

    // The payload of the JWS is the claims object.
    const claimsJson = jwsResult.payload.toString('utf8');
    const claims = JSON.parse(claimsJson);

    // --- Claims Validation ---
    // 3. Validate standard JWT claims (iat, exp, iss, jti).
    if (expectedIssuer && claims.iss !== expectedIssuer) {
      throw new Error(`Invalid issuer: expected ${expectedIssuer}, got ${claims.iss}`);
    }

    const nowSec = Math.floor(Date.now() / 1000);
    if (claims.iat && claims.iat > nowSec + CLOCK_SKEW_SEC) {
      throw new Error('Token "iat" (issued at) is in the future');
    }
    if (claims.exp && nowSec - CLOCK_SKEW_SEC > claims.exp) {
      throw new Error('Token has expired');
    }
    if (!claims.jti) {
      throw new Error('Missing "jti" (JWT ID) claim');
    }

    // --- Payload Extraction ---
    // 4. Extract, decode, and parse the custom 'data' claim.
    const dataB64Url = claims[CLAIM_DATA];
    if (!dataB64Url) {
      throw new Error(`Missing required "${CLAIM_DATA}" claim`);
    }

    const dataBuffer = Buffer.from(dataB64Url, 'base64url');
    const dataJson = dataBuffer.toString('utf8');

    return JSON.parse(dataJson);
  }

  /**
   * Encrypts a base64url-encoded string payload into a nested JWS-in-JWE token.
   *
   * @param {string} dataB64Url - The base64url-encoded data string.
   * @param {string} issuer - The 'iss' claim.
   * @param {number} expiryMs - Expiry time in milliseconds.
   * @returns {Promise<string>} - The compact-serialized JWE token string.
   * @private
   */
  async encryptBytes(dataB64Url, issuer, expiryMs) {
    this._assertInitialized();

    try {
      // --- JWS Claims Setup ---
      // 1. Create the claims for the inner JWS token.
      const nowMs = Date.now();
      const iat = Math.floor(nowMs / 1000); // Issued at
      const exp = Math.floor((nowMs + expiryMs) / 1000); // Expiration
      const jti = crypto.randomUUID(); // Unique token ID

      const claims = {
        iss: issuer,
        iat: iat,
        exp: exp,
        jti: jti,
        [CLAIM_DATA]: dataB64Url,
      };
      const claimsJson = JSON.stringify(claims);

      // --- JWS Creation (Signing) ---
      // 2. Sign the claims with our private key.
      const jwsOptions = {
        format: 'compact',
        fields: {
          alg: SIGNATURE_ALGORITHM,
          typ: 'JWT',
          kid: this.privateKey.kid
        }
      };

      const signedJWT = await jose.JWS.createSign(jwsOptions, this.privateKey)
        .update(claimsJson)
        .final();

      // --- JWE Creation (Encryption) ---
      // 3. Encrypt the signed JWS with the partner's public key.
      const jweOptions = {
        format: 'compact',
        contentAlg: ENCRYPTION_METHOD,
        fields: {
          alg: ENCRYPTION_ALGORITHM,
          enc: ENCRYPTION_METHOD,
          kid: this.publicKey.kid,
          cty: 'JWT' // Content Type: Indicates payload is a JWT
        }
      };

      const encryptedJWT = await jose.JWE.createEncrypt(jweOptions, this.publicKey)
        .update(signedJWT)
        .final();

      return encryptedJWT;

    } catch (error) {
      throw new Error(`Nested JWT encryption failed: ${error.message}`);
    }
  }

  /**
   * Recursively extracts all filled (non-null, non-undefined)
   * leaf node paths from an object in dot-notation.
   *
   * @param {Object} obj - The object to traverse.
   * @returns {string[]} - An array of dot-notation field paths.
   * @private
   */
  _extractFilledFields(obj) {
    // Start the recursion with the root object and no path prefix
    return this._recursiveExtract(obj, '');
  }

  /**
   * Helper function for _extractFilledFields.
   * @param {*} current - The current value being inspected.
   * @param {string} path - The dot-notation path to this value.
   * @returns {string[]} - A flat array of leaf paths found from this node.
   * @private
   */
  _recursiveExtract(current, path) {
    // 1. Base Case: Null/Undefined values are "empty" and ignored.
    if (current === null || current === undefined) {
      return [];
    }

    // 2. Array Case: Recurse on each item, but keep the *same* path.
    // This "flattens" the array, so 'person.addresses[0].city' and
    // 'person.addresses[1].city' both map to 'person.addresses.city'.
    if (Array.isArray(current)) {
      // Use flatMap to collect and flatten results from all items.
      return current.flatMap(item => this._recursiveExtract(item, path));
    }

    // 3. Object Case: Recurse on each key/value pair, *extending* the path.
    if (typeof current === 'object') {
      return Object.entries(current).flatMap(([key, value]) => {
        const newPath = path ? `${path}.${key}` : key;
        return this._recursiveExtract(value, newPath);
      });
    }

    // 4. Primitive Case: This is a leaf node (string, number, boolean).
    // Return its path, as long as it's not an empty path (i.e., a root primitive).
    return path ? [path] : [];
  }

  /**
   * Throws an error if the codec is not initialized.
   * @private
   */
  _assertInitialized() {
    if (!this.initialized || !this.privateKey || !this.publicKey) {
      throw new Error('TRJWTCodec is not initialized. Call initialize() with keys first.');
    }
  }

  /**
   * Simple assertion helper.
   * @private
   */
  _assert(condition, message) {
    if (!condition) {
      throw new Error(message);
    }
  }
}


// --- Command-Line Execution ---

/**
 * Helper to read and parse a JSON file from a given path.
 * @param {string} filePath - Path to the JSON file.
 * @returns {Promise<Object>} - The parsed JSON object.
 */
async function readJsonFile(filePath) {
  const absolutePath = path.resolve(filePath);
  try {
    const content = await fs.readFile(absolutePath, 'utf8');
    return JSON.parse(content);
  } catch (error) {
    throw new Error(`Failed to read or parse file ${absolutePath}: ${error.message}`);
  }
}

/**
 * Main execution function for the command-line demo.
 */
async function main() {
  const args = process.argv;
  // Basic argument check
  if (args.length < 5) {
    console.error('Usage: node your-script-name.js <partnerPublicKeyFile> <ourPrivateKeyFile> <ivmsDataFile>');
    console.error('Example: node encrypt.js partner-public.json my-private.json data.json');
    process.exit(1);
  }

  const [,, publicKeyFile, privateKeyFile, ivmsDataFile] = args;

  try {
    // 1. Load keys and data from files
    const publicKeyData = await readJsonFile(publicKeyFile);
    const privateKey = await readJsonFile(privateKeyFile);
    const ivmsData = await readJsonFile(ivmsDataFile);

    const { issuer, publicKey } = publicKeyData;
    if (!issuer || !publicKey) {
      throw new Error('Public key JSON file must contain "issuer" and "publicKey" fields.');
    }

    // 2. Initialize the Codec
    const codec = new TRJWTCodec();
    await codec.initialize({
      publicKey,  // Partner's public key (for encryption)
      privateKey, // Our private key (for signing)
    });

    // 3. Prepare the IVMS Data
    // This signs with our private key and encrypts with the partner's public key.
    const ivmsRequest = await codec.prepareIvmsData(ivmsData, issuer);

    console.log(JSON.stringify(ivmsRequest, null, 2)); // Pretty-print the result
  } catch (error) {
    console.error(`\n❌ An error occurred: ${error.message}`);
    // console.error(error.stack); // Uncomment for full stack trace
    process.exit(1);
  }
}

// Run the main function
main();

node dec-encrypt.ts public-key.json private-key.json ivms.json
Reading JSON from: public-key.json
Reading JSON from: private-key.json
Reading JSON from: ivms.json
✅ Codec initialized successfully.

Encrypting IVMS data for issuer: sumsub.com...

--- ✅ Prepared IVMS Request ---
{
  "version": "IVMS101.2023",
  "data": "eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIiwia2lkIjoidGVzdC1zZW5kZXItMjAyNSIsImN0eSI6IkpXVCJ9.KNNX0QweA41Dhif_tLS26OFM3TIz7V8SuOnbGjVBJ1erB9GkhSGy3Q638ArSabSN0UoQKObd11UpDkw-ZiwWiGZ_OG1LsTKkfEWBtAQ5YSsNeJNMoQh3voIFHuLRm_RC2f0gj_v4q4iGpkyRqB6YN-kAFYQhWm_RuMuHSbatpBCzFT9XYybvRHe-oQ33WhIPFumiByq2FMzK94JNjwfILeqBtCiL9uWZSQtAPiOTQa88TMilZdeqOWmtg0_j7pYq8fl6x8tp3cyMfYKzpRaTZ8y8VDqt67BTehC0fOrn_Wh8TeuyYFKdiR3ROjIFBWnYEKimSgUeXMMynGMLnLq5Lg.bLixunwV8XdEi-TF.Mu8tSaJH_9fuZ7Sqk6gaR9m1hFJHU8mrPxHlT-jHp0x-3FBfPAxZM1N1vApS_foFIUgbbQA65FlG6kihGvvUBwpOlkQ9TjCaraaFyI3YSacJfBzDLQcL8NsBuaIqTanRcHlu77ph9A2Q0Rsqod_wwkMThAhb47vrq240fNKwwvKw5USeEUISVVc684CsLxxTC9n6PyfTCgUlWWdILxZ5Nv1LKtbHd_6IfNkBwi-ChKVz4E_N9B_KsJSRTquAlQMSLSHopOi50p5mq3LJCy97ZGc5ZKdAuoUV3lkYC7mQlY_T8A4o84pp-9uLI1pHTfyxCy0PUhIXb515jFRt5dFXt9fOWHOqMhCzBdHc_rfkaENw8zJSi3D3bqj8_dAQtw7xzCm0-bDmkj7Zb4-O_XBtehxFxQcQAWAoWdWBpRLw1XeMLgQSvGSGYkgDYJOxYzjTi0Ib8T1k8wQydfEqmdUPWcsw1_P-eDiG-NLdZuMLTdKNQsd2zSZ50JQILSyhsJ-MTYRN_Xn4RveND_sGud_Ck68dISSCUfrbdr7V9MStagCvCzyg6Vsd34g9-o2tjVV4QXR0S5ixweNpG-4mjVymIEf80XK4Eb1fkleLNa3L2vKnT8FjxZQUDbF4DMH2Enf9wx626hPx21AclJHvXWKJlA2bfHhqBpigIDClNQZZ5RZsekjTjCkW90u6myBxC6jz6rKVLkOY8zGY95VomI7aVzGDnWkQkW8v-dJZT9FMN8Z0u4EsH1SMFfOSjVVkTx_HikrHOaXuQ2_v5_-xvT8Cow8P2bkm1MYFQiAmzUwVaIJ87QDd09_iLL5xdOBjRY00M3CWXbvZxo_Oqp-qu62I4_TEIsl8rE42hMOH6lm4-FWJpnk-K8lakjXjSpVQMkPTNHFY3TyWhD3D7V3qa2oxWOWUcJxm0lsAspkNlgg4tG5ReWQlA002HwO4gaX8U0dGxkLqDaJYGIWeFlbn1IaQGEQ3Ia-f4mj9wTBGVDb0nk1dtTMQ-nNRHxDjh5ibbSIi2NCiMu7AKjN7xogh5EkWoSmIYrSZN6cDhSFMlNfsFbkhV8ruQrkV3bZB-kYbuyc1KLLIXdfR0MSTbqCogI3Ud2oJe0DRXpCoQnfb6FWKlXf5wjT5TKgNm6v6i3wj4QMYAzK1NvvmSd4e0XROtFxzz6wcb01IglrjRTN1Ot9G2Z-kycxfT1wkuv2NX0LqrQ3ljDm-virAGMfdamuMzkly2U8AErpBNAXDjFGKm6jdyjtyMvzUgjfpCU_l4H37rJgLaUuHq7L8F_RCLxfzJKQN24Bv4bpdUaji3f2HB0e3HosI4Sn_ZMIwHULs0FwrVeCLnOtn_5VoHFDbl9Vyku5Za6eij6cwU0vcpOgXRnksXdD_p72IUaMbgdJy8O3GiS0Ga9kFeqW9aqQ_JFBo1aUhhRbJVHIOG_AhEMVNBtbm7FkqQ1Qvp-kHSoZGLw4-ymrG60EKdyicGPwMXSeach1tdHZ965vJOpqMEjnjFOCYkkPweaAd-rQjXkGytQ_2N0UacP1SAsr8RQrE1BLBEgr9Yg8GFf4ChF8WcjYp-M68-h0WkG-zWYCXvc7bSJ9R5BdfOVourb1a2lo1Mvbd42Ad6dXx7Libs1yqMOnpCNVj5cWsPuEInd0Amco1UEdoyrsLVHRiJUAWlbZOzNP537StaTt6aK8gf1VkJP8EPZA70U7qdlWF1RyQtjIPORd4FoY-4_4X8IOZbt8yi8uCB7o9wiQyMM_fFHCpftLa5Sy8KHBzzR2pB78T2Pe6wWvRBKsQzxv50w4V7IyWHo8wLz72baG1_dSoLGp0RwxC9MrRNh6ZJF28iYqPCIPaDlikEierJd1JZ5bXt4A_-DvuQopTKhC3fB5_LNilIyNK80BjsgpWh6Fd7a07t8XXz6YvrBZ_2aJRDlVWwsHlmrbRi94OUyIbP5LcY6Z2YOhMIaUL1phMK9voPavhTlA1dDf52aKLnoAmNq_KRkq98n6HagyYscaSuusErKwAQEm7pjw7YxZyEXB47BXhVKTi4ZUQWgZLTpyH29gn0_CAuIfO21q9qa3Gc39GPjxIGF_Ss4i_DKjHnWframX6fOTVjYEtYFfxnE6bjhd9-KqZ0NrZelTIgdHWLxaFv7_RwPTCoTQ6wXSSGXKn-OJM_rITcNg0ikzc2Gv1z3Uvpf_cKmOBXSSwyXjxO4lQRSWTZppVuTDT1AfwfNtR0tsfJJel3lzTo_ldJlOFWWDuoBfOl0t1SAB5Yqh9ABXF89LknqwmIpxL8ykGsP-iByuaJhVngqbLDJdS4KO17VcX69o2oHC47CjzF0sB0lM_jWk69_Kmfl61Ky1nWjZNrDPoiW71oxdmNfAfsS7Rg5v9.Gi1d0Ou_IOu-WuHP8rIOMw",
  "filledFields": [
    "Originator.originatorPersons.naturalPerson.name.nameIdentifier.primaryIdentifier",
    "Originator.originatorPersons.naturalPerson.name.nameIdentifier.secondaryIdentifier",
    "Originator.originatorPersons.naturalPerson.name.nameIdentifier.nameIdentifierType",
    "Originator.originatorPersons.naturalPerson.customerIdentification",
    "Originator.originatorPersons.naturalPerson.dateAndPlaceOfBirth.dateOfBirth",
    "Beneficiary.beneficiaryPersons.naturalPerson.name.nameIdentifier.primaryIdentifier",
    "Beneficiary.beneficiaryPersons.naturalPerson.name.nameIdentifier.secondaryIdentifier",
    "Beneficiary.beneficiaryPersons.naturalPerson.name.nameIdentifier.nameIdentifierType",
    "Beneficiary.beneficiaryPersons.naturalPerson.customerIdentification",
    "Beneficiary.beneficiaryPersons.naturalPerson.dateAndPlaceOfBirth.dateOfBirth"
  ]
}
---------------------------------

{
  "version": "IVMS101.2023",
  "data": "eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIiwia2lkIjoidGVzdC1zZW5kZXItMjAyNSIsImN0eSI6IkpXVCJ9.Q2TS_6NOsy_bfmOmS23uYItJJqtU8mhSxXCvkvuP2aLtZSgBmtnICnfq1l4CJmxP0MI03RHWqfhg4NmNBPwih524GCwu16Vt1T1MUmoEyzUGRGHl1x8rYam_x6tihfGADbXzrCiSOwZYPrc4mbP31wRCiFC8vhTx2PEzCvZrEGfGjWanZIPARtczxfjzN_QEok3D8HVIJOmTq-lYFf6mgaOWwoSz0xbae7wzlLFScWHwaGdQ-Un6_F7OR8ed-6bCrp24_qlpwLkA3dMVqX4cQarVca-DmfGmvVaoXSflUwePRfwkRkcJcvRxECekvoFpQvCQ6VDBg3SAvxK-khFzwQ.AkMTJBpld5ZhxECk.ZgWkgarTGWFnkDCcur9Z0Wr1HDPAG3G11SK5YZ5c8vE2hLTVWmRbof1YedpdVHiWEoUQjBEEzNmIqVIVoRSQ9-pbehXIN_i_lYgBehPJ_dVp0j79nXCGRSY5-vSRzVpMRWtqM-3R6cav-3ftduPEzn6XIjjkVxC_G7Hhp-BIuHNafaoAKJgxOWVZfUyw4HRHZ4s1f14l2lRQymVVFPyIAiNDWSWYivFqybIaMyDrmhJEBlSQKwKBhBMc11JEe11IaJb2asgZkeaf-C77ls-ZG4oVEAK03Rjk_I5C7sRQtunmJSrwBh5coDY_XGL9cmjCGlKW-n3eQMK01cHIHLikYxEN9DQo4XPF0Oi3L6czE7I5lFfzm4BBNeZejP8dvIAce7T-HhFk3SpnJ94omwmCrw_MNLfVFPGCNAxHUX5oM5XdWuazOVA8_fF6F18gVk7nWddkuQsyJEfCRT_-BRmdHhw4CGHDd1nMKjg0its2uHzrFM0hrd88NRLtzwX-7G-elSsydxuD5fWU4um93oYj5BgA70JDoS_N8bGFlBrpt0rv8cP3lEUlblIFAxbSFa3-5N6GP_bKmR02WFy7zaV5TQaQsods015glvTz0DBrNmyOmAu0xUzMj46KOC9qDDGRnZjCiBZW-ySt9CpFnesGEmfln1aw7TgSQ0kel4F7nwB0HykCTGKe8Wm9bEgl6w_aCEtSFt0IioA5lmNyZA8cZf6Cf8rgeihv--sbSWM5Y0zcaaO41_bifTUGnbTE63fApYmn2TceTz2KNy9Db9kMAsnb4moC1DgnVeb3-bRl_NNnnuRftM5LEsBqc-RC1Yt7t6gTmwCMqT3BghZjqm3GPJufXaulG7LpxLUVwcM7NhpJGw3DpCEtBkWJWwHE27EQy-17x2Mwpk_3TLmhvP2W0ZV1uFB_Qz_tsMz9lxQ4NStwmbDyBHBQSZ5gS-FpZzfrtilgIxKBt7-GaalcXRd8wV_MbLbHP4W7k1d3uFYwxAfFUDKWvxderSUQ-TmfzEHyJiXxXSpHIDMEJz9pGC_JKxM6G9zgAfosJ76bBqT3v_YdtPmuFUx9TVxBW_1EPk58yTJR5V1XL7B6HYd_qrCsOahnyaZ6zq3Ygsfza5IOP3-7rSF15JXMoQtN47rgOeplHa3xrTsCuEraXAbVwVp99n3OpPQ9R2MZwPzUEbDkQ7XRYHIhaKYrEiYE9E0atK1Dn4Kd2dB1nukVlC3k1ETMIb6evR0x2JpcrGFlk71rjd61uS07XpDV3gU09JbI-aRsUSbJ7-crssx0158aHsfO_XiTLiQ3e9Mz5vjY6gjiefo-fybxNmOZ7skWuG5-BOrbOAqWEu9j-QfMiHWi3L_r8vPNtythOIh4VkOF-x1SnEujJWEfyvEl6zTqVyy4ArWeJxiIx7eY0jdAh-DQ0lR70iALnr-MudqFbrb5Kda2Yf20B8f6rgcnvLUOm4rNS9ewgzNmzDjS3L_OAFdQahBve2t-8rDvbWYIdYEy4XdU9uBwN47CjfZRqxLbClMsUrEGJyffVsKXkE2q0kPSlHjsVcSIBpuUaFaRXPZDAp-vv0dRlgJnu7ojzmO9twe4rg5gCYWvhuTP6fvLNyxzpVjbuMNso5V_Kh1841510DofG8uJXl_Yweo9AaQ1_km_8PfClKAF9s90hhkc-bDXIQCv2tZasJ-l62iBXL9RgytDr73k5KCNAfREUN-pVT-ePhyoFkRjiJTp4i0UO7DMLHH2evnc6dDPoL38Imc5XVZ3nKDXBCtJqlP_b0fVNialqW-j86bVXPp-ROCZqN8568ohb2w7BcfnrG3Mu5-Z1uuUXkduROIR2YfpIYHs5MF7ibXx_KGDsyhQibqchCDHSihdQl0GcCf1ShIMGYJ6zHsjcRFMD6q_QbS14QSJWGYX5otCK_TEkKRKBDtP5LlPxzOb7t1X5aDkAWABOhiExengSvXKj_fh1LrrG0_hNHuZ3ZTdN33a9sHESwjTG9ftfTFmi8RD_SabVIOKNMjCbA21UAVBeLbj6O16lTMEqwyAg165o3nKIdwrgT4NTz2Q7OEjcmPpTrMUmJNhV5V8MrL6s3K9XOSq245nSfE5VC6U-bXM_U2GSK1_dAAA2PjH6OxiGzrDz3yhrXN_D2gOUkAtxI9zQOF5f__kbE4i4mT9wWLUBnk2zie2X7mPJMrTTPy6S1uPdm811hkmA7pEKwMyh4LI58boeORipzIY7yERWK516GFA1ISIX7AirlHxrgaiojBJ5K7kyI2futrDchX8m-cAnT6dDtzE5fvq_kw_4XzWn-NCtO1nMe7ZydzlNCmI_dHaADHAfxQo9Fi3yTeVV76wWnFEVcrEnoYmibyoW7fNS0Yjlh3D.M6DlnVu5kCnzXwtp3y1ToA",
  "filledFields": [
    "Originator.originatorPersons.naturalPerson.name.nameIdentifier.primaryIdentifier",
    "Originator.originatorPersons.naturalPerson.name.nameIdentifier.secondaryIdentifier",
    "Originator.originatorPersons.naturalPerson.name.nameIdentifier.nameIdentifierType",
    "Originator.originatorPersons.naturalPerson.customerIdentification",
    "Originator.originatorPersons.naturalPerson.dateAndPlaceOfBirth.dateOfBirth",
    "Beneficiary.beneficiaryPersons.naturalPerson.name.nameIdentifier.primaryIdentifier",
    "Beneficiary.beneficiaryPersons.naturalPerson.name.nameIdentifier.secondaryIdentifier",
    "Beneficiary.beneficiaryPersons.naturalPerson.name.nameIdentifier.nameIdentifierType",
    "Beneficiary.beneficiaryPersons.naturalPerson.customerIdentification",
    "Beneficiary.beneficiaryPersons.naturalPerson.dateAndPlaceOfBirth.dateOfBirth"
  ]
}

const jose = require('node-jose');
const crypto = require('crypto');
const path = require('path');
const fs = require('fs/promises');

const SIGNATURE_ALGORITHM = 'RS256';
const ENCRYPTION_ALGORITHM = 'RSA-OAEP-256';
const ENCRYPTION_METHOD = 'A256GCM';
const DEFAULT_EXPIRY_MS = 300000; // 5 minutes
const CLOCK_SKEW_SEC = 60; // ±60s skew
const CLAIM_DATA = 'data'; // The JWT claim holding the payload

/**
 * Travel Rule JWT Codec for PII Data Encryption
 *
 * Implements a nested JWT (JWS signed token encrypted inside a JWE)
 * for secure PII exchange, compatible with the Java TRJWTCodec implementation.
 *
 * Features:
 * - Object signing and encryption: `prepareIvmsData` / `decryptAndDecode`
 * - JTI (JWT ID) claim for replay attack protection
 * - Standard claims validation (iss, iat, exp)
 */
class TRJWTCodec {
  constructor() {
    this.keyStore = jose.JWK.createKeyStore();
    this.publicKey = null; // Partner's public key (for encryption)
    this.privateKey = null; // Our private key (for signing)
    this.initialized = false;
  }

  /**
   * Initialize the codec with RSA key pairs.
   *
   * @param {Object} config - Configuration object
   * @param {string} config.publicKey - PEM-encoded RSA public key (partner's key for encryption)
   * @param {string} config.privateKey - PEM-encoded RSA private key (our key for signing)
   */
  async initialize(config) {
    this._assert(config.publicKey, 'Public key is required');
    this._assert(config.privateKey, 'Private key is required');

    try {
      this.publicKey = await this.keyStore.add(config.publicKey);
      this.privateKey = await this.keyStore.add(config.privateKey);
      this.initialized = true;
    } catch (error) {
      throw new Error(`Failed to initialize TRJWTCodec with provided keys: ${error.message}`);
    }
  }

  /**
   * Encrypt and sign an object as a nested JWT (JWS inside JWE).
   * This is the lower-level function that returns only the JWE string.
   *
   * @param {Object} data - The JSON-serializable object to encrypt.
   * @param {string} issuer - The 'iss' claim (our identifier).
   * @param {number} [expiryMs=DEFAULT_EXPIRY_MS] - Expiry time in milliseconds.
   * @returns {Promise<string>} - The compact-serialized JWE token string.
   */
  async encodeAndEncrypt(data, issuer, expiryMs = DEFAULT_EXPIRY_MS) {
    this._assertInitialized();
    this._assert(data, 'Data cannot be null or undefined');
    this._assert(issuer && typeof issuer === 'string' && issuer.trim(), 'Issuer must be a non-empty string');

    // 1. Serialize the object to a JSON string
    const dataJson = JSON.stringify(data);
    // 2. Encode the JSON string as base64url
    const dataB64Url = Buffer.from(dataJson, 'utf8').toString('base64url');
    // 3. Pass the base64url string to the byte-level encryption method
    return this.encryptBytes(dataB64Url, issuer, expiryMs);
  }

  /**
   * Prepares the full IVMS data object, including the encrypted JWE
   * and the list of filled fields.
   *
   * @param {Object} data - The IVMS data object to encrypt.
   * @param {string} issuer - The 'iss' claim (our identifier).
   * @param {number} [expiryMs=DEFAULT_EXPIRY_MS] - Expiry time in milliseconds.
   * @returns {Promise<{version: string, data: string, filledFields: string[]}>}
   * An object containing the API version, the encrypted JWE string,
   * and the dot-notation paths of all non-null fields.
   */
  async prepareIvmsData(data, issuer, expiryMs = DEFAULT_EXPIRY_MS) {
    // 1. Create the encrypted JWE string from the data object.
    // This handles signing with our private key and encrypting with the partner's public key.
    const encryptedData = await this.encodeAndEncrypt(data, issuer, expiryMs);
    // 2. Extract all filled field paths from the original data object.
    const filledFields = this._extractFilledFields(data);

    return {
      version: 'IVMS101.2023', // API version
      data: encryptedData,
      filledFields: filledFields
    };
  }

  /**
   * Decrypt and decode data from an encrypted JWE token.
   *
   * @param {string} encryptedJWT - The compact-serialized JWE token.
   * @param {string} [expectedIssuer] - (Optional) The expected 'iss' claim for validation.
   * @returns {Promise<Object>} - The original decrypted and parsed JSON object.
   */
  async decryptAndDecode(encryptedJWT, expectedIssuer = null) {
    this._assertInitialized();
    this._assert(encryptedJWT, 'Encrypted JWT cannot be null or empty');

    // --- JWE Decryption ---
    // 1. Decrypt the outer JWE layer using our private key.
    const jweResult = await jose.JWE.createDecrypt(this.privateKey)
      .decrypt(encryptedJWT);

    // The payload of the JWE is the inner JWS.
    const signedJWT = jweResult.payload.toString('utf8');

    // --- JWS Verification ---
    // 2. Verify the signature of the inner JWS using the partner's public key.
    const jwsResult = await jose.JWS.createVerify(this.publicKey)
      .verify(signedJWT);

    // The payload of the JWS is the claims object.
    const claimsJson = jwsResult.payload.toString('utf8');
    const claims = JSON.parse(claimsJson);

    // --- Claims Validation ---
    // 3. Validate standard JWT claims (iat, exp, iss, jti).
    if (expectedIssuer && claims.iss !== expectedIssuer) {
      throw new Error(`Invalid issuer: expected ${expectedIssuer}, got ${claims.iss}`);
    }

    const nowSec = Math.floor(Date.now() / 1000);
    if (claims.iat && claims.iat > nowSec + CLOCK_SKEW_SEC) {
      throw new Error('Token "iat" (issued at) is in the future');
    }
    if (claims.exp && nowSec - CLOCK_SKEW_SEC > claims.exp) {
      throw new Error('Token has expired');
    }
    if (!claims.jti) {
      throw new Error('Missing "jti" (JWT ID) claim');
    }

    // --- Payload Extraction ---
    // 4. Extract, decode, and parse the custom 'data' claim.
    const dataB64Url = claims[CLAIM_DATA];
    if (!dataB64Url) {
      throw new Error(`Missing required "${CLAIM_DATA}" claim`);
    }

    const dataBuffer = Buffer.from(dataB64Url, 'base64url');
    const dataJson = dataBuffer.toString('utf8');

    return JSON.parse(dataJson);
  }

  /**
   * Encrypts a base64url-encoded string payload into a nested JWS-in-JWE token.
   *
   * @param {string} dataB64Url - The base64url-encoded data string.
   * @param {string} issuer - The 'iss' claim.
   * @param {number} expiryMs - Expiry time in milliseconds.
   * @returns {Promise<string>} - The compact-serialized JWE token string.
   * @private
   */
  async encryptBytes(dataB64Url, issuer, expiryMs) {
    this._assertInitialized();

    try {
      // --- JWS Claims Setup ---
      // 1. Create the claims for the inner JWS token.
      const nowMs = Date.now();
      const iat = Math.floor(nowMs / 1000); // Issued at
      const exp = Math.floor((nowMs + expiryMs) / 1000); // Expiration
      const jti = crypto.randomUUID(); // Unique token ID

      const claims = {
        iss: issuer,
        iat: iat,
        exp: exp,
        jti: jti,
        [CLAIM_DATA]: dataB64Url,
      };
      const claimsJson = JSON.stringify(claims);

      // --- JWS Creation (Signing) ---
      // 2. Sign the claims with our private key.
      const jwsOptions = {
        format: 'compact',
        fields: {
          alg: SIGNATURE_ALGORITHM,
          typ: 'JWT',
          kid: this.privateKey.kid
        }
      };

      const signedJWT = await jose.JWS.createSign(jwsOptions, this.privateKey)
        .update(claimsJson)
        .final();

      // --- JWE Creation (Encryption) ---
      // 3. Encrypt the signed JWS with the partner's public key.
      const jweOptions = {
        format: 'compact',
        contentAlg: ENCRYPTION_METHOD,
        fields: {
          alg: ENCRYPTION_ALGORITHM,
          enc: ENCRYPTION_METHOD,
          kid: this.publicKey.kid,
          cty: 'JWT' // Content Type: Indicates payload is a JWT
        }
      };

      const encryptedJWT = await jose.JWE.createEncrypt(jweOptions, this.publicKey)
        .update(signedJWT)
        .final();

      return encryptedJWT;

    } catch (error) {
      throw new Error(`Nested JWT encryption failed: ${error.message}`);
    }
  }

  /**
   * Recursively extracts all filled (non-null, non-undefined)
   * leaf node paths from an object in dot-notation.
   *
   * @param {Object} obj - The object to traverse.
   * @returns {string[]} - An array of dot-notation field paths.
   * @private
   */
  _extractFilledFields(obj) {
    // Start the recursion with the root object and no path prefix
    return this._recursiveExtract(obj, '');
  }

  /**
   * Helper function for _extractFilledFields.
   * @param {*} current - The current value being inspected.
   * @param {string} path - The dot-notation path to this value.
   * @returns {string[]} - A flat array of leaf paths found from this node.
   * @private
   */
  _recursiveExtract(current, path) {
    // 1. Base Case: Null/Undefined values are "empty" and ignored.
    if (current === null || current === undefined) {
      return [];
    }

    // 2. Array Case: Recurse on each item, but keep the *same* path.
    // This "flattens" the array, so 'person.addresses[0].city' and
    // 'person.addresses[1].city' both map to 'person.addresses.city'.
    if (Array.isArray(current)) {
      // Use flatMap to collect and flatten results from all items.
      return current.flatMap(item => this._recursiveExtract(item, path));
    }

    // 3. Object Case: Recurse on each key/value pair, *extending* the path.
    if (typeof current === 'object') {
      return Object.entries(current).flatMap(([key, value]) => {
        const newPath = path ? `${path}.${key}` : key;
        return this._recursiveExtract(value, newPath);
      });
    }

    // 4. Primitive Case: This is a leaf node (string, number, boolean).
    // Return its path, as long as it's not an empty path (i.e., a root primitive).
    return path ? [path] : [];
  }

  /**
   * Throws an error if the codec is not initialized.
   * @private
   */
  _assertInitialized() {
    if (!this.initialized || !this.privateKey || !this.publicKey) {
      throw new Error('TRJWTCodec is not initialized. Call initialize() with keys first.');
    }
  }

  /**
   * Simple assertion helper.
   * @private
   */
  _assert(condition, message) {
    if (!condition) {
      throw new Error(message);
    }
  }
}


// --- Command-Line Execution ---

/**
 * Helper to read and parse a JSON file from a given path.
 * @param {string} filePath - Path to the JSON file.
 * @returns {Promise<Object>} - The parsed JSON object.
 */
async function readJsonFile(filePath) {
  const absolutePath = path.resolve(filePath);
  try {
    const content = await fs.readFile(absolutePath, 'utf8');
    return JSON.parse(content);
  } catch (error) {
    throw new Error(`Failed to read or parse file ${absolutePath}: ${error.message}`);
  }
}

/**
 * Main execution function for the command-line demo.
 */
async function main() {
  const args = process.argv;
  // Basic argument check
  if (args.length < 5) {
    console.error('Usage: node your-script-name.js <partnerPublicKeyFile> <ourPrivateKeyFile> <encryptedIvmsDataFile>');
    console.error('Example: node decrypt.js partner-public.json my-private.json data.json');
    process.exit(1);
  }

  const [,, publicKeyFile, privateKeyFile, ivmsDataFile] = args;

  try {
    // 1. Load keys and data from files
    const publicKeyData = await readJsonFile(publicKeyFile);
    const privateKey = await readJsonFile(privateKeyFile);
    const ivmsData = await readJsonFile(ivmsDataFile);

    const { issuer, publicKey } = publicKeyData;
    if (!issuer || !publicKey) {
      throw new Error('Public key JSON file must contain "issuer" and "publicKey" fields.');
    }

    // 2. Initialize the Codec
    const codec = new TRJWTCodec();
    await codec.initialize({
      publicKey,  // Partner's public key (for encryption)
      privateKey, // Our private key (for signing)
    });

    // 3. Prepare the IVMS Data
    // This signs with our private key and encrypts with the partner's public key.
    const decryptedIvms = await codec.decryptAndDecode(ivmsData.data, issuer);

    console.log(JSON.stringify(decryptedIvms, null, 2)); // Pretty-print the result
  } catch (error) {
    console.error(`\n❌ An error occurred: ${error.message}`);
    // console.error(error.stack); // Uncomment for full stack trace
    process.exit(1);
  }
}

// Run the main function
main();

{
  shortName: string;                // Short name for the legal entity
  fullLegalName?: string;           // Full legal name
  countryOfRegistration?: string;   // ISO 3166-1 alpha-2 code (e.g., "US")
  nationalIdentification?: string;  // National identifier
  dateOfIncorporation?: string;     // ISO date string (e.g., "2023-01-15")
  geographicAddress?: {             // Geographic address
    formattedAddress?: string;
    country?: string;
    streetName?: string;
    buildingNumber?: string;
    city?: string;
    postalCode?: string;
  };
  vaults?: number[];                // Array of vault IDs
  trPrimaryPurpose?: string;        // Travel rule primary purpose enum
  discoverable?: string;            // "discoverable", "hidden", or "anonymous"
}

{
  id: string;
  discoverable: string;
  shortName: string;
  fullLegalName: string;
  geographicAddress: {
    formattedAddress?: string;
    country?: string;
    streetName?: string;
    buildingNumber?: string;
    city?: string;
    postalCode?: string;
  };
  countryOfRegistration: string;
  nationalIdentification: string;
  dateOfIncorporation: Date;
  trPrimaryPurpose: string;
  createDate: Date;
  lastUpdate: Date;
  vaults: number[];
}

// Create a legal entity
const { data: customer } = await fireblocks.trlink.createLegalEntity({
  shortName: "ACME Corp",
  fullLegalName: "ACME Corporation Ltd",
  countryOfRegistration: "US",
  nationalIdentification: "EIN-123456789",
  dateOfIncorporation: "2020-01-15",
  geographicAddress: {
    formattedAddress: "123 Main St, New York, NY 10001",
    country: "US",
    streetName: "Main St",
    buildingNumber: "123",
    city: "New York",
    postalCode: "10001"
  },
  vaults: [0, 1],
  discoverable: "discoverable",
  trPrimaryPurpose: "BUSINESS"
});

console.log(`Legal entity created with ID: ${customer.id}`);

{
  id: string;
  discoverable: string;
  shortName: string;
  fullLegalName: string;
  geographicAddress: object;
  countryOfRegistration: string;
  nationalIdentification: string;
  dateOfIncorporation: Date;
  trPrimaryPurpose: string;
  createDate: Date;
  lastUpdate: Date;
  vaults: number[];
}

const legalEntityId = "12345678-1234-1234-1234-123456789abc";
const { data: legalEntity } = await fireblocks.trlink.getLegalEntity(legalEntityId);
console.log(`Legal entity: ${legalEntity.shortName}`);

Array<{
  id: string;
  discoverable: string;
  shortName: string;
  fullLegalName: string;
  geographicAddress: object;
  countryOfRegistration: string;
  nationalIdentification: string;
  dateOfIncorporation: Date;
  trPrimaryPurpose: string;
  createDate: Date;
  lastUpdate: Date;
  vaults: number[];
}>

const { data: legalEntities } = await fireblocks.trlink.getLegalEntities();

legalEntities.forEach(legalEntity => {
  console.log(`Legal entity: ${legalEntity.shortName} (${legalEntity.id})`);
});

{
  shortName: string;                // Short name for the legal entity
  fullLegalName?: string;           // Full legal name
  countryOfRegistration?: string;   // ISO 3166-1 alpha-2 code (e.g., "US")
  nationalIdentification?: string;  // National identifier
  dateOfIncorporation?: string;     // ISO date string (e.g., "2023-01-15")
  geographicAddress?: {             // Geographic address
    formattedAddress?: string;
    country?: string;
    streetName?: string;
    buildingNumber?: string;
    city?: string;
    postalCode?: string;
  };
  vaults?: number[];                // Array of vault IDs
  trPrimaryPurpose?: string;        // Travel rule primary purpose enum
  discoverable?: string;            // "discoverable", "hidden", or "anonymous"
}

{
  id: string;
  discoverable: string;
  shortName: string;
  fullLegalName: string;
  geographicAddress: object;
  countryOfRegistration: string;
  nationalIdentification: string;
  dateOfIncorporation: Date;
  trPrimaryPurpose: string;
  createDate: Date;
  lastUpdate: Date;
  vaults: number[];
}

const legalEntityId = "12345678-1234-1234-1234-123456789abc";

const { data: updatedLegalEntity } = await fireblocks.trlink.updateLegalEntity(legalEntityId, {
  shortName: "ACME Corp Updated",
  fullLegalName: "ACME Corporation Ltd - Updated",
  vaults: [0, 1, 2]
});

console.log(`Legal entity updated: ${updatedLegalEntity.shortName}`);

const legalEntityId = "12345678-1234-1234-1234-123456789abc";
await fireblocks.trlink.deleteLegalEntity(legalEntityId);

console.log('Legal entity deleted successfully');

{
  customerId: string;     // Required - UUID of the legal entity
  partnerIdent: string;   // Required - Partner identifier (e.g., "notabene")
}

{
  customerIntegrationId: string;
  apiKey: string;              // Partially censored (e.g., "abc****xyz")
  secret: string;              // Censored (e.g., "***")
  createDate: Date;
  lastUpdate: Date;
  partner: {
    ident: string;
    name: string;
    description: string;
    baseUrl: string;
    active: boolean;
    isTest: boolean;
  };
  customer: {
    id: string;
    shortName: string;
    // ... other customer fields
  };
}

const legalEntityId = "12345678-1234-1234-1234-123456789abc";
const partnerIdent = "<partner ident>";

const { data: integration } = await fireblocks.trlink.createLegalEntityIntegration({
  customerId: legalEntityId,
  partnerIdent: partnerIdent
});

console.log(`Integration created with ID: ${integration.customerIntegrationId}`);
console.log(`Partner: ${integration.partner.name}`);

{
  apiKey: string;      // Required - API key from the travel rule provider
  secret?: string;     // Optional - API secret from the travel rule provider
}

{
  customerIntegrationId: string;
  apiKey: string;              // Partially censored (e.g., "abc****xyz")
  secret: string;              // Censored (e.g., "***")
  createDate: Date;
  lastUpdate: Date;
  partner: {
    ident: string;
    name: string;
    description: string;
    baseUrl: string;
    active: boolean;
    isTest: boolean;
  };
  customer: {
    id: string;
    shortName: string;
    // ... other customer fields
  };
}

const legalEntityIntegrationId = "87654321-4321-4321-4321-123456789abc";

const { data: connectedIntegration } = await fireblocks.trlink.connectLegalEntityIntegration(
  legalEntityIntegrationId,
  {
    apiKey: "trp-api-key-12345",
    secret: "trp-secret-67890"
  }
);

console.log(`Integration connected: ${connectedIntegration.customerIntegrationId}`);
console.log(`Partner: ${connectedIntegration.partner.name}`);

{
  customerIntegrationId: string;
  apiKey: string;              // Partially censored (e.g., "abc****xyz")
  secret: string;              // Censored (e.g., "***")
  createDate: Date;
  lastUpdate: Date;
  partner: {
    ident: string;
    name: string;
    description: string;
    baseUrl: string;
    active: boolean;
    isTest: boolean;
  };
  customer: {
    id: string;
    shortName: string;
    // ... other customer fields
  };
}

const legalEntityId = "12345678-1234-1234-1234-123456789abc";
const legalEntityIntegrationId = "87654321-4321-4321-4321-123456789abc";

const { data: integration } = await fireblocks.trlink.getLegalEntityIntegration(
  legalEntityId,
  legalEntityIntegrationId
);

console.log(`Integration: ${integration.customerIntegrationId}`);
console.log(`Partner: ${integration.partner.name}`);

const legalEntityId = "12345678-1234-1234-1234-123456789abc";

const { data: integrations } = await fireblocks.trlink.getLegalEntityIntegrations(legalEntityId);

integrations.forEach(integration => {
  console.log(`Integration: ${integration.partner.name} (${integration.customerIntegrationId})`);
});

const legalEntityIntegrationId = "87654321-4321-4321-4321-123456789abc";

await fireblocks.trlink.disconnectLegalEntityIntegration(legalEntityIntegrationId);

console.log('Integration disconnected successfully');

{
  success: boolean;
  message?: string;          // Error message if connection failed
  timestamp: string;         // ISO timestamp
  partnerIdent?: string;
  partnerName?: string;
}

const legalEntityIntegrationId = "87654321-4321-4321-4321-123456789abc";

const { data: result } = await fireblocks.trlink.testLegalEntityIntegrationConnection(legalEntityIntegrationId);

if (result.success) {
  console.log(`Connection successful to ${result.partnerName} at ${result.timestamp}`);
} else {
  console.error(`Connection failed: ${result.message}`);
}

{
  txId?: string;                        // Fireblocks transaction ID (recommended for inbound)
  amount?: string;                      // Required if txId not provided
  amountUSD?: string;                   // Amount in USD
  destination?: {                       // Required if txId not provided
    type: string;                       // "ONE_TIME_ADDRESS" for outbound, "VAULT_ACCOUNT" for inbound
    id?: string;                        // Required for VAULT_ACCOUNT
    oneTimeAddress?: {
      address: string;
      tag?: string;
    };
  };
  destAddress?: string;                 // Destination address
  destTag?: string;                     // Destination tag
  source?: {                            // 
    type: string;                       // "VAULT_ACCOUNT" for outbound, "UNKNOWN" for inbound
    id?: string;                        // Required for VAULT_ACCOUNT
  };
  srcAddress?: string;                  // Source address
  assetId?: string;                     // Required if txId not provided (e.g., "ETH", "BTC")
  direction?: string;                   // "inbound" or "outbound"
  txHash?: string;                      // Blockchain transaction hash
  originatorVaspId?: string;            // Required for inbound transactions
  beneficiaryVaspId?: string;           // Required for outbound transactions
}

{
  decision: string;                     // "REQUIRED", "NOT_REQUIRED", or "NEED_MORE_INFO"
  reason: string;                       // Explanation of the decision
  requiredFields?: string[];            // List of required IVMS fields if travel rule is required
  missingInfo?: string[];               // List of missing fields if more info is needed
  thresholds?: {
    amount?: string;
    currency?: string;
  };
}

const legalEntityIntegrationId = "87654321-4321-4321-4321-123456789abc";

// Example 1: Assess for outbound transaction (before Fireblocks transaction)
const { data: assessment1 } = await fireblocks.trlink.assessTravelRuleRequirement(
  legalEntityIntegrationId,
  {
    amount: "1500",
    assetId: "ETH",
    direction: "outbound",
    source: {
      type: "VAULT_ACCOUNT",
      id: "0"
    },
    destination: {
      type: "ONE_TIME_ADDRESS",
      oneTimeAddress: {
        address: "0xabcdef1234567890abcdef1234567890abcdef12"
      }
    },
    beneficiaryVaspId: "beneficiary-vasp-456"
  }
);

if (assessment1.decision === "REQUIRED") {
  console.log(`Travel rule is required: ${assessment1.reason}`);
  console.log(`Required fields: ${assessment1.requiredFields.join(', ')}`);
} else {
  console.log(`Travel rule not required: ${assessment1.reason}`);
}

// Example 2: Assess for existing Fireblocks transaction (inbound)
const { data: assessment2 } = await fireblocks.trlink.assessTravelRuleRequirement(
  legalEntityIntegrationId,
  {
    txId: "12345678-1234-1234-1234-123456789abc",
    originatorVaspId: "originator-vasp-123"
  }
);

console.log(`Decision: ${assessment2.decision}`);

{
  assetId?: string;                     // Required if txId not provided (e.g., "ETH", "BTC")
  amount?: string;                      // Required if txId not provided
  amountUSD?: string;                   // Optional - Force specific USD value
  source?: {                            // Required if txId not provided
    type: string;                       // "VAULT_ACCOUNT" for outbound, "UNKNOWN" for inbound
    id?: string;                        // Required for VAULT_ACCOUNT
  };
  srcAddress?: string;                  // Optional
  destination?: {                       // Required for single-destination transactions
    type: string;                       // "ONE_TIME_ADDRESS" for outbound, "VAULT_ACCOUNT" for inbound
    id?: string;                        // Required for VAULT_ACCOUNT
    oneTimeAddress?: {
      address: string;
      tag?: string;
    };
  };
  destAddress?: string;                 // Optional
  destTag?: string;                     // Optional
  txId?: string;                        // Optional - Fireblocks transaction ID (recommended for inbound)
  txHash?: string;                      // Optional - Blockchain transaction hash
  direction?: string;                   // Optional - "inbound" or "outbound"
  originatorVaspId?: string;            // Required for inbound transactions
  beneficiaryVaspId?: string;           // Required for outbound transactions
  ivms: {                               // Required - IVMS101 data
    version: string;                    // e.g., "IVMS101.2023"
    data: string;                       // Base64 encoded encrypted IVMS101 data
    filledFields: string[];             // Array of filled field paths
  };
}

{
  id: string;                           // TRM message ID
  version?: string;
  status?: string;                      // "PENDING", "ACCEPTED", "REJECTED"
  reason?: string;
  externalId: string;                   // Fireblocks transaction ID
  asset: {
    format: string;
    data: string;
  };
  amount: string;
  fiatValue?: {
    amount: string;
    currency: string;
  };
  direction: string;                    // "in" or "out"
  originatorVaspId?: string;
  beneficiaryVaspId?: string;
  txnInfo: {
    originatorWalletAddress: string;
    beneficiaryWalletAddress: string;
    txHash: string;
  };
  ivms101: {
    version: string;
    data: string;
    filledFields: string[];
  };
  providerData?: {
    provider?: string;
    data?: any;
  };
}

const legalEntityIntegrationId = "87654321-4321-4321-4321-123456789abc";

// Example 1: Create TRM for outbound transaction (before Fireblocks transaction)
const { data: trm1 } = await fireblocks.trlink.createTravelRuleMessage(
  legalEntityIntegrationId,
  {
    amount: "1500",
    assetId: "ETH",
    direction: "outbound",
    source: {
      type: "VAULT_ACCOUNT",
      id: "0"
    },
    destination: {
      type: "ONE_TIME_ADDRESS",
      oneTimeAddress: {
        address: "0xabcdef1234567890abcdef1234567890abcdef12"
      }
    },
    beneficiaryVaspId: "beneficiary-vasp-456",
    ivms: {
      version: "IVMS101.2023",
      data: "aGVsbG8gd29ybGQgdGhpcyBpcyBlbmNyeXB0ZWQgZGF0YQ==",
      filledFields: [
        "Beneficiary.beneficiaryPersons[].legalPerson.name.nameIdentifier",
        "Originator.originatorPersons[].legalPerson.name.nameIdentifier"
      ]
    }
  }
);

console.log(`TRM created with ID: ${trm1.id}`);
console.log(`Status: ${trm1.status}`);

// Example 2: Create TRM for existing Fireblocks transaction (inbound)
const { data: trm2 } = await fireblocks.trlink.createTravelRuleMessage(
  legalEntityIntegrationId,
  {
    txId: "12345678-1234-1234-1234-123456789abc",
    originatorVaspId: "originator-vasp-123",
    ivms: {
      version: "IVMS101.2023",
      data: "aGVsbG8gd29ybGQgdGhpcyBpcyBlbmNyeXB0ZWQgZGF0YQ==",
      filledFields: [
        "Beneficiary.beneficiaryPersons[].naturalPerson.name.nameIdentifier",
        "Originator.originatorPersons[].naturalPerson.name.nameIdentifier"
      ]
    }
  }
);

console.log(`TRM created with ID: ${trm2.id}`);

const legalEntityIntegrationId = "87654321-4321-4321-4321-123456789abc";
const messageId = "trm-12345678-1234-1234-1234-123456789abc";

const { data: trm } = await fireblocks.trlink.getTravelRuleMessage(
  legalEntityIntegrationId,
  messageId
);

console.log(`TRM ID: ${trm.id}`);
console.log(`Status: ${trm.status}`);
console.log(`Direction: ${trm.direction}`);
console.log(`Amount: ${trm.amount} (${trm.fiatValue?.amount} ${trm.fiatValue?.currency})`);

{
  reason?: string;          // Optional - Cancellation reason
  cancelledBy?: string;     // Optional - User ID who cancelled
}

const legalEntityIntegrationId = "87654321-4321-4321-4321-123456789abc";
const messageId = "trm-12345678-1234-1234-1234-123456789abc";

const { data: result } = await fireblocks.trlink.cancelTravelRuleMessage(
  legalEntityIntegrationId,
  messageId,
  {
    reason: "Transaction cancelled by user",
    cancelledBy: "user-123"
  }
);

console.log(`TRM cancelled: ${result.id}`);
console.log(`Status: ${result.status}`);

{
  subsidiaryVaspId: string;     // Required - ID of the subsidiary VASP
}

const legalEntityIntegrationId = "87654321-4321-4321-4321-123456789abc";
const messageId = "trm-12345678-1234-1234-1234-123456789abc";

const { data: result } = await fireblocks.trlink.redirectTravelRuleMessage(
  legalEntityIntegrationId,
  messageId,
  {
    subsidiaryVaspId: "subsidiary-vasp-789"
  }
);

console.log(`TRM redirected: ${result.id}`);
console.log(`New beneficiary VASP: ${result.beneficiaryVaspId}`);

{
  travelRuleMessageId: string | null;   // TRM ID or null to clear
}

{
  success: boolean;
}

const txId = "12345678-1234-1234-1234-123456789abc";
const trmId = "trm-12345678-1234-1234-1234-123456789abc";

// Set TRM ID
const result1 = await fireblocks.trlink.setTransactionTravelRuleMessageId(
  txId,
  {
    travelRuleMessageId: trmId
  }
);

console.log(`TRM ID set: ${result1.success}`);

// Clear TRM ID
const result2 = await fireblocks.trlink.setTransactionTravelRuleMessageId(
  txId,
  {
    travelRuleMessageId: null
  }
);

console.log(`TRM ID cleared: ${result2.success}`);

{
  amount: string;                       // Required - Destination amount to match
  destination: {                        // Required - Destination criteria to match
    type?: string;                      // e.g., "ONE_TIME_ADDRESS"
    id?: string;
    subType?: string;
    address?: string;
  };
  travelRuleMessageId: string | null;   // TRM ID or null to clear
}

{
  success: boolean;
  updatedDestinations: number;          // Number of successfully updated destinations
  failedDestinations: number;           // Number of failed updates
  errors?: string[];                    // Error messages if any failed
}

const txId = "12345678-1234-1234-1234-123456789abc";
const trmId = "trm-12345678-1234-1234-1234-123456789abc";

// Set TRM ID for specific destination
const { data: result } = await fireblocks.trlink.setDestinationTravelRuleMessageId(
  txId,
  {
    amount: "1500",
    destination: {
      type: "ONE_TIME_ADDRESS",
      address: "0xabcdef1234567890abcdef1234567890abcdef12"
    },
    travelRuleMessageId: trmId
  }
);

if (result.success) {
  console.log(`Updated ${result.updatedDestinations} destination(s)`);
} else {
  console.error(`Failed to update ${result.failedDestinations} destination(s)`);
  console.error(`Errors: ${result.errors?.join(', ')}`);
}

{
  issuer: string;
  publicKey: {
    kty: string;              // "RSA"
    e: string;                // Public exponent
    use: string;              // "enc"
    kid: string;              // Key ID
    n: string;                // Modulus
  };
}

const legalEntityIntegrationId = "87654321-4321-4321-4321-123456789abc";

const { data: { publicKey, issuer } } = await fireblocks.trlink.getPublicKeyForEncryption(legalEntityIntegrationId);

console.log(`Issuer: ${issuer}`);
console.log(`Key ID: ${publicKey.kid}`);
console.log(`Key type: ${publicKey.kty}`);

// Use the public key to encrypt IVMS data
const encryptedData = encryptIVMSData(ivmsData, keyResponse.publicKey);

{
  pageSize?: number;    // Optional - Max items per page (1-100, default: 100)
  pageCursor?: string;  // Optional - Pagination cursor from previous response
}

{
  data: Array<{
    id: string;
    name: string;
    legalName?: string;
    nationalIdentification?: {
      identifier: string;
      type?: string;
      authority?: string;
    };
    geographicAddress?: {
      formattedAddress?: string;
      country?: string;
      streetName?: string;
      buildingNumber?: string;
      city?: string;
      postalCode?: string;
    };
  }>;
  next?: string;                      // Pagination cursor for next page
}

const legalEntityIntegrationId = "87654321-4321-4321-4321-123456789abc";

// Get first page of VASPs
const vasps1 = await fireblocks.trlink.listVasps(legalEntityIntegrationId, {
  pageSize: 50
});

console.log(`Page 1 VASPs: ${vasps1.data.length}`);
vasps1.data.forEach(vasp => {
  console.log(`VASP: ${vasp.name} (${vasp.id})`);
  if (vasp.geographicAddress?.country) {
    console.log(`  Country: ${vasp.geographicAddress.country}`);
  }
});

// Get next page
if (vasps1.next) {
  const vasps2 = await fireblocks.trlink.listVasps(legalEntityIntegrationId, {
    pageSize: 50,
    pageCursor: vasps1.next
  });

  console.log(`Page 2 VASPs: ${vasps2.data.length} VASPs`);
}

{
  id: string;
  name: string;
  legalName?: string;
  nationalIdentification?: {
    identifier: string;
    type?: string;
    authority?: string;
  };
  geographicAddress?: {
    formattedAddress?: string;
    country?: string;
    streetName?: string;
    buildingNumber?: string;
    city?: string;
    postalCode?: string;
  };
  publicKey?: string;       // VASP's public key
}

const legalEntityIntegrationId = "87654321-4321-4321-4321-123456789abc";
const vaspId = "beneficiary-vasp-456";

const { data: vasp } = await fireblocks.trlink.getVaspById(legalEntityIntegrationId, vaspId);

console.log(`VASP Name: ${vasp.name}`);
console.log(`Legal Name: ${vasp.legalName}`);
console.log(`Country: ${vasp.geographicAddress?.country}`);
if (vasp.nationalIdentification) {
  console.log(`National ID: ${vasp.nationalIdentification.identifier} (${vasp.nationalIdentification.type})`);
}
if (vasp.publicKey) {
  console.log(`Has public key: Yes`);
}

{
  pageSize?: number;    // Optional - Max items per page (1-100, default: 100)
  pageCursor?: string;  // Optional - Pagination cursor from previous response
}

{
  data: Array<{
    id: string;                       // Fireblocks asset ID (e.g., "ETH", "BTC_TEST")
    name?: string;                    // Asset display name
    type?: string;                    // Asset type (e.g., "BASE_ASSET", "ERC20_TOKEN")
    contractAddress?: string;         // Contract address for tokens
    nativeAsset?: string;             // Native blockchain asset
    decimals?: number;                // Decimal precision
    issuerAddress?: string;           // issuer address (used on SOL, and some other blockchains) 
  }>;
  next?: string;                      // Pagination cursor for next page
  partnerCanHandleAnyAsset: boolean;  // Whether partner supports unlisted assets
  note: string;                       // Support capability note
}

const legalEntityIntegrationId = "87654321-4321-4321-4321-123456789abc";

// Get first page of supported assets
const assetsPage1 = await fireblocks.trlink.listSupportedAssets(
  legalEntityIntegrationId,
  {
    pageSize: 50
  }
);

console.log(`Partner can handle any asset: ${assetsPage1.partnerCanHandleAnyAsset}`);
console.log(`Note: ${assetsPage1.note}`);
console.log(`\nSupported assets (page 1):`);
assetsPage1.data.forEach(asset => {
  console.log(`- ${asset.id}: ${asset.name} (${asset.type})`);
  if (asset.contractAddress) {
    console.log(`  Contract: ${asset.contractAddress}`);
  }
});

// Get next page if available
if (assetsPage1.next) {
  const assetsPage2 = await fireblocks.trlink.listSupportedAssets(
    legalEntityIntegrationId,
    {
      pageSize: 50,
      pageCursor: assetsPage1.next
    }
  );
  console.log(`\nPage 2: ${assetsPage2.data.length} more assets`);
}

{
  fireblocksAsset: {
    id: string;                       // Fireblocks asset ID
    name?: string;                    // Asset display name
    type?: string;                    // Asset type
    contractAddress?: string;         // Contract address for tokens
    nativeAsset?: string;             // Native blockchain asset
    decimals?: number;                // Decimal precision
    issuerAddress?: string;           // issuer address (used on SOL, and some other blockchains) 
  };
  partnerResponse: {
    // Raw response from partner API with partner-specific format
    // Structure varies by partner
  };
  partnerCanHandleAnyAsset: boolean;  // Whether partner supports unlisted assets
  note: string;                       // Support capability note
  supported: boolean;                 // Whether asset is supported (true if in catalog OR partner handles any asset)
}

const legalEntityIntegrationId = "87654321-4321-4321-4321-123456789abc";

// Check if ETH is supported
const { data: ethAsset } = await fireblocks.trlink.getSupportedAsset(
  legalEntityIntegrationId,
  "ETH"
);

console.log(`Asset: ${ethAsset.fireblocksAsset.name} (${ethAsset.fireblocksAsset.id})`);
console.log(`Supported: ${ethAsset.supported}`);
console.log(`Partner can handle any asset: ${ethAsset.partnerCanHandleAnyAsset}`);
console.log(`Note: ${ethAsset.note}`);

if (ethAsset.supported) {
  console.log('\nAsset details:');
  console.log(`  Type: ${ethAsset.fireblocksAsset.type}`);
  console.log(`  Decimals: ${ethAsset.fireblocksAsset.decimals}`);
  if (ethAsset.fireblocksAsset.contractAddress) {
    console.log(`  Contract: ${ethAsset.fireblocksAsset.contractAddress}`);
  }

  // Asset is supported, safe to create TRM
  console.log('\nThis asset can be used for travel rule messages.');
} else {
  console.warn('\nWarning: Asset not supported by this partner.');
  console.warn('Choose a different partner or use a supported asset.');
}

// Check a custom token
const { data: customToken } = await fireblocks.trlink.getSupportedAsset(
  legalEntityIntegrationId,
  "CUSTOM_TOKEN_ETH"
);

if (customToken.supported) {
  console.log(`\nCustom token ${customToken.fireblocksAsset.id} is supported.`);
} else if (customToken.partnerCanHandleAnyAsset) {
  console.log(`\nCustom token not in catalog, but partner accepts any asset.`);
} else {
  console.log(`\nCustom token not supported by this partner.`);
}

Array<{
  ident: string;
  name: string;
  description: string;
  baseUrl: string;
  active: boolean;
  isTest: boolean;
}>

const { data: partners } = await fireblocks.trlink.getPartners();

console.log('Available Travel Rule Partners:');
partners.forEach(partner => {
  console.log(`- ${partner.name} (${partner.ident})`);
  console.log(`  Description: ${partner.description}`);
  console.log(`  Active: ${partner.active}`);
  console.log(`  Test Environment: ${partner.isTest}`);
  console.log('');
});

// Filter for production partners
const prodPartners = partners.filter(p => p.active && !p.isTest);
console.log(`Production partners: ${prodPartners.length}`);

{
  message: string;
  code: number;     // e.g., 2120
}

{
  message: string;
  code: number;     // e.g., 2125
}

const transaction = {
    assetId: 'BTC',
    source: {
        type: 'VAULT_ACCOUNT',
        id: '0'
    },
    destination: {
        type: 'ONE_TIME_ADDRESS',
        oneTimeAddress: {
            address: 'bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh'
        }
    },
    amount: '5000',
    note: 'TRLink screened transaction',
    travelRuleMessageId: 'sumsub:12345'
    // TRLink will process based on your configured policies
};

const response = await fireblocks.createTransaction(transaction);

const multiDestTransaction = {
    assetId: 'BTC',
    source: {
        type: 'VAULT_ACCOUNT',
        id: '0'
    },
    destinations: [
        {
            destination: {
                type: 'VAULT_ACCOUNT',
                id: '1'
            },
            amount: '2500',
            travelRuleMessageId: 'sumsub:qwerty'
        },
        {
            destination: {
                type: 'ONE_TIME_ADDRESS',
                oneTimeAddress: {
                    address: 'bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh'
                }
            },
            amount: '3000',
            travelRuleMessageId: 'sumsub:12345'
        },
    ],
    note: 'Multi-destination TRLink transaction'
};

const response = await fireblocks.createTransaction(multiDestTransaction);

interface TRLinkResult {
    // Core compliance information
    verdict: 'ACCEPT' | 'REJECT' | 'ALERT' | 'WAIT';
    status: 'completed' | 'pending' | 'bypassed' | 'failed';
    
    // Policy context
    bypassReason?: 'POLICY' | 'UNSUPPORTED_ASSET' | 'UNSUPPORTED_ROUTE';
    appliedPolicies: {
        preScreening?: PolicyRule;
        missingTRM?: PolicyRule;
        postScreening?: PolicyRule;
    };
    
    // Multi-destination intelligence
    trLinkDestinations?: TRLinkDestinationResult[];
    
    // Registration status
    trlinkRegistration?: {
        status: string;
        success: boolean;
        timestamp: number;
    };
    
    // Provider information
    provider?: string;
    trmStatus?: 'ACCEPTED' | 'REJECTED' | 'PENDING' | 'FAILED';
    
    // Metadata
    processingTime: number;
    timestamp: number;
}

interface TRLinkDestinationResult {
    destRecordId: string;
    destAddress: string;
    timestamp: number;
    status: 'COMPLETED' | 'PENDING' | 'FAILED';
    verdict: 'ACCEPT' | 'REJECT' | 'ALERT' | 'WAIT';
    provider?: string;
    bypassReason?: string;
}

interface PreScreeningRule {
    // Matching criteria
    customerId?: string;
    direction?: 'inbound' | 'outbound';
    asset?: string;
    amount?: {
        range?: {
            min?: number;
            max?: number;
        };
        currency: 'USD' | 'NATIVE';
    };
    sourceType?: string;
    destType?: string;
    
    // Required action
    action: 'SCREEN' | 'PASS';
}

interface MissingTRMRule {
    // Matching criteria (same as screening)
    // Plus timing constraints
    validBefore?: number;  // seconds
    validAfter?: number;   // seconds
    
    // Required action
    action: 'WAIT' | 'ACCEPT' | 'REJECT';
}

interface PostScreeningRule {
    // Matching criteria (same as screening)
    // Plus TRM status
    trmStatus?: 'ACCEPTED' | 'REJECTED' | 'PENDING' | 'FAILED';
    
    // Timing constraints
    validBefore?: number;
    validAfter?: number;
    
    // Required action
    action: 'ACCEPT' | 'REJECT' | 'ALERT' | 'WAIT';
}

class TRLinkIntegration {
    constructor(fireblocks) {
        this.fireblocks = fireblocks;
    }
    
    async submitTransaction(txData) {
        try {
            // Create transaction - TRLink policies apply automatically
            const result = await this.fireblocks.createTransaction(txData);
            
            // Check screening result
            if (result.trlinkResult) {
                return this.handleTRLinkResult(result.trlinkResult);
            }
            
            return result;
        } catch (error) {
            console.error('Transaction failed:', error);
            throw error;
        }
    }
    
    handleTRLinkResult(trlinkResult) {
        switch (trlinkResult.verdict) {
            case 'ACCEPT':
                console.log('Transaction approved');
                break;
            case 'REJECT':
                console.log('Transaction blocked by policy');
                break;
            case 'ALERT':
                console.log('Transaction approved with monitoring');
                this.triggerAlert(trlinkResult);
                break;
            case 'WAIT':
                console.log('Waiting for Travel Rule data');
                this.scheduleRecheck(trlinkResult);
                break;
        }
        return trlinkResult;
    }
}

class MultiDestinationHandler {
    async processMultiDestination(txData) {
        const result = await this.fireblocks.createTransaction(txData);
        
        if (result.trlinkResult?.trLinkDestinations) {
            // Analyze per-destination results
            const destinations = result.trlinkResult.trLinkDestinations;
            
            destinations.forEach(dest => {
                console.log(`Destination ${dest.destAddress}:`);
                console.log(`  Verdict: ${dest.verdict}`);
                console.log(`  Status: ${dest.status}`);
                
                if (dest.bypassReason) {
                    console.log(`  Bypassed: ${dest.bypassReason}`);
                }
            });
            
            // Overall transaction verdict
            console.log(`Transaction verdict: ${result.trlinkResult.verdict}`);
        }
        
        return result;
    }
}

class TRLinkMonitoring {
    async monitorTransaction(txId) {
        const tx = await this.fireblocks.getTransaction(txId);
        
        if (tx.trlinkResult) {
            // Track metrics
            this.metrics.record({
                verdict: tx.trlinkResult.verdict,
                processingTime: tx.trlinkResult.processingTime,
                provider: tx.trlinkResult.provider,
                policyBypassed: !!tx.trlinkResult.bypassReason
            });
            
            // Monitor registration health
            if (tx.trlinkResult.trlinkRegistration) {
                this.checkProviderHealth(tx.trlinkResult.trlinkRegistration);
            }
        }
        
        return tx;
    }
    
    checkProviderHealth(registration) {
        if (!registration.success) {
            console.warn('Provider registration issue detected');
            // Alert operations team
        }
    }
}

// Test internal transfer bypass
const internalTransfer = {
    source: { type: 'VAULT_ACCOUNT', id: '0' },
    destination: { type: 'VAULT_ACCOUNT', id: '1' },
    amount: '1000',
    assetId: 'BTC'
};
// Should bypass if configured

// Test amount thresholds
const belowThreshold = { amount: '2999', ... };  // Should bypass
const aboveThreshold = { amount: '3001', ... };  // Should screen

// Test worst-result-wins logic
const mixedDestinations = {
    destinations: [
        { /* internal - should accept */ },
        { /* trusted - should accept */ },
        { /* unknown - should reject */ }
    ]
};
// Overall should reject

class TRLinkErrorHandler {
    handleError(error) {
        if (error.code === 'TRLINK_POLICY_REJECTION') {
            // Transaction blocked by policy
            return { action: 'blocked', reason: error.message };
        }
        
        if (error.code === 'TRLINK_TIMEOUT') {
            // Processing timeout exceeded
            return { action: 'timeout', fallback: 'accept' };
        }
        
        if (error.code === 'PROVIDER_UNAVAILABLE') {
            // Provider connectivity issue
            return { action: 'failover', fallback: 'business_continuity' };
        }
        
        throw error;
    }
}