@ajna-inc/vaults 0.1.0

package/build/services/VaultEncryptionService.js

@@ -0,0 +1,613 @@
+"use strict";
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __setFunctionName = (this && this.__setFunctionName) || function (f, name, prefix) {
+    if (typeof name === "symbol") name = name.description ? "[".concat(name.description, "]") : "";
+    return Object.defineProperty(f, "name", { configurable: true, value: prefix ? "".concat(prefix, " ", name) : name });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VaultEncryptionService = void 0;
+var core_1 = require("@credo-ts/core");
+var hash_wasm_1 = require("hash-wasm");
+var VaultCrypto_1 = require("../crypto/wasm/VaultCrypto");
+var errors_1 = require("../errors");
+// ═══════════════════════════════════════════════════════════════════════════
+// Service
+// ═══════════════════════════════════════════════════════════════════════════
+/**
+ * Vault Encryption Service
+ *
+ * Provides client-side encryption/decryption for all vault policy modes:
+ * - S3 suite: Passphrase-based (Argon2id → AES-256-GCM)
+ * - P1 suite: Post-quantum (ML-KEM-768 → AES-256-GCM)
+ *
+ * All encryption and decryption happens client-side per ZK-Vault spec.
+ */
+var VaultEncryptionService = function () {
+    var _classDecorators = [(0, core_1.injectable)()];
+    var _classDescriptor;
+    var _classExtraInitializers = [];
+    var _classThis;
+    var VaultEncryptionService = _classThis = /** @class */ (function () {
+        function VaultEncryptionService_1() {
+        }
+        // ═══════════════════════════════════════════════════════════════════════
+        // S3 SUITE (PASSPHRASE) - For Local Storage
+        // Spec §4.1: CEK = Argon2id(passphrase, salt, m=64-128MiB, t=2-3)
+        // ═══════════════════════════════════════════════════════════════════════
+        /**
+         * Encrypt data with passphrase (S3 suite)
+         * All encryption happens CLIENT-SIDE
+         *
+         * @param plaintext - Data to encrypt
+         * @param passphrase - User passphrase
+         * @param options - Encryption options
+         * @returns Encrypted vault document
+         */
+        VaultEncryptionService_1.prototype.encryptWithPassphrase = function (plaintext, passphrase, options) {
+            var _a, _b, _c, _d;
+            if (options === void 0) { options = {}; }
+            return __awaiter(this, void 0, void 0, function () {
+                var salt, argon2Params, cek, nonce, docId, vaultId, epoch, aadFields, aad, encResult, ciphertext, kcmp, header;
+                return __generator(this, function (_e) {
+                    switch (_e.label) {
+                        case 0:
+                            salt = (0, VaultCrypto_1.randomBytes)(32);
+                            argon2Params = {
+                                memory: (_a = options.memory) !== null && _a !== void 0 ? _a : 65536, // 64 MiB
+                                iterations: (_b = options.iterations) !== null && _b !== void 0 ? _b : 3,
+                                parallelism: 1,
+                            };
+                            return [4 /*yield*/, this.deriveKeyArgon2(passphrase, salt, argon2Params)
+                                // 3. Generate nonce (12 bytes for AES-GCM)
+                            ];
+                        case 1:
+                            cek = _e.sent();
+                            nonce = (0, VaultCrypto_1.generateNonceAesGcm)();
+                            docId = (_c = options.docId) !== null && _c !== void 0 ? _c : (0, VaultCrypto_1.generateUuid)();
+                            vaultId = (_d = options.vaultId) !== null && _d !== void 0 ? _d : docId;
+                            epoch = 1;
+                            aadFields = {
+                                v: 1,
+                                suite: 'S3',
+                                aead: 'AES-256-GCM',
+                                docId: docId,
+                                vaultId: vaultId,
+                                epoch: epoch,
+                                policy: { mode: 'passphrase' },
+                            };
+                            aad = (0, VaultCrypto_1.canonicalAad)(aadFields);
+                            encResult = (0, VaultCrypto_1.aesGcmEncrypt)(cek, nonce, plaintext, aad);
+                            ciphertext = encResult.ciphertext();
+                            kcmp = (0, VaultCrypto_1.keyCommitment)(cek);
+                            header = {
+                                v: 1,
+                                suite: 'S3',
+                                aead: 'AES-256-GCM',
+                                docId: docId,
+                                vaultId: vaultId,
+                                epoch: epoch,
+                                nonce: (0, VaultCrypto_1.toBase64Url)(nonce),
+                                kcmp: (0, VaultCrypto_1.toBase64Url)(kcmp),
+                                salt: (0, VaultCrypto_1.toBase64Url)(salt),
+                                argon2: argon2Params,
+                                policy: { mode: 'passphrase' },
+                            };
+                            // 9. Zero out CEK from memory (security best practice)
+                            this.zeroize(cek);
+                            return [2 /*return*/, { header: header, ciphertext: ciphertext }];
+                    }
+                });
+            });
+        };
+        /**
+         * Decrypt passphrase-protected vault (S3 suite)
+         * All decryption happens CLIENT-SIDE
+         *
+         * @param vault - Encrypted vault document
+         * @param passphrase - User passphrase
+         * @returns Decrypted plaintext
+         */
+        VaultEncryptionService_1.prototype.decryptWithPassphrase = function (vault, passphrase) {
+            return __awaiter(this, void 0, void 0, function () {
+                var header, ciphertext, salt, cek, expectedKcmp, aad, nonce, plaintext;
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            header = vault.header, ciphertext = vault.ciphertext;
+                            // 1. Validate suite
+                            if (header.suite !== 'S3' && header.suite !== 'S1') {
+                                throw new errors_1.BadSuiteError("Expected S1/S3 suite for passphrase vault, got ".concat(header.suite));
+                            }
+                            if (!header.salt || !header.argon2) {
+                                throw new errors_1.PolicyError('Missing salt or argon2 params for passphrase vault');
+                            }
+                            salt = (0, VaultCrypto_1.fromBase64Url)(header.salt);
+                            return [4 /*yield*/, this.deriveKeyArgon2(passphrase, salt, header.argon2)
+                                // 3. Verify key commitment (spec §9.2 step 3)
+                            ];
+                        case 1:
+                            cek = _a.sent();
+                            expectedKcmp = (0, VaultCrypto_1.fromBase64Url)(header.kcmp);
+                            if (!(0, VaultCrypto_1.verifyKeyCommitment)(cek, expectedKcmp)) {
+                                this.zeroize(cek);
+                                throw new errors_1.DecryptAeadError('Key commitment verification failed - wrong passphrase');
+                            }
+                            aad = (0, VaultCrypto_1.canonicalAad)({
+                                v: header.v,
+                                suite: header.suite,
+                                aead: header.aead,
+                                docId: header.docId,
+                                vaultId: header.vaultId,
+                                epoch: header.epoch,
+                                policy: header.policy,
+                            });
+                            nonce = (0, VaultCrypto_1.fromBase64Url)(header.nonce);
+                            try {
+                                plaintext = (0, VaultCrypto_1.aesGcmDecrypt)(cek, nonce, ciphertext, aad);
+                                this.zeroize(cek);
+                                return [2 /*return*/, plaintext];
+                            }
+                            catch (e) {
+                                this.zeroize(cek);
+                                throw new errors_1.DecryptAeadError('AEAD decryption failed - data may be corrupted or tampered');
+                            }
+                            return [2 /*return*/];
+                    }
+                });
+            });
+        };
+        // ═══════════════════════════════════════════════════════════════════════
+        // P1 SUITE (POST-QUANTUM) - For Multi-Party Sharing
+        // Spec §4.1: KEM = ML-KEM-768, AEAD = AES-256-GCM
+        // ═══════════════════════════════════════════════════════════════════════
+        /**
+         * Encrypt with any-of policy (spec §6.1)
+         * Each recipient gets their own KEM-wrapped CEK
+         *
+         * @param plaintext - Data to encrypt
+         * @param recipients - Array of recipient public keys
+         * @param options - Encryption options
+         * @returns Encrypted vault document
+         */
+        VaultEncryptionService_1.prototype.encryptAnyOf = function (plaintext, recipients, options) {
+            var _a, _b;
+            if (options === void 0) { options = {}; }
+            return __awaiter(this, void 0, void 0, function () {
+                var cek, nonce, docId, vaultId, epoch, aad, encResult, ciphertext, recipientWraps, kcmp, header;
+                return __generator(this, function (_c) {
+                    if (recipients.length === 0) {
+                        throw new errors_1.PolicyError('At least one recipient required for any-of policy');
+                    }
+                    cek = (0, VaultCrypto_1.generateCek)();
+                    nonce = (0, VaultCrypto_1.generateNonceAesGcm)();
+                    docId = (_a = options.docId) !== null && _a !== void 0 ? _a : (0, VaultCrypto_1.generateUuid)();
+                    vaultId = (_b = options.vaultId) !== null && _b !== void 0 ? _b : docId;
+                    epoch = 1;
+                    aad = (0, VaultCrypto_1.canonicalAad)({
+                        v: 1,
+                        suite: 'P1',
+                        aead: 'AES-256-GCM',
+                        docId: docId,
+                        vaultId: vaultId,
+                        epoch: epoch,
+                        policy: { mode: 'any-of' },
+                    });
+                    encResult = (0, VaultCrypto_1.aesGcmEncrypt)(cek, nonce, plaintext, aad);
+                    ciphertext = encResult.ciphertext();
+                    recipientWraps = recipients.map(function (r) { return ({
+                        kid: r.kid,
+                        kem: 'ML-KEM-768',
+                        ct: (0, VaultCrypto_1.toBase64Url)((0, VaultCrypto_1.kemWrapCek)(cek, r.publicKey)),
+                    }); });
+                    kcmp = (0, VaultCrypto_1.keyCommitment)(cek);
+                    header = {
+                        v: 1,
+                        suite: 'P1',
+                        aead: 'AES-256-GCM',
+                        docId: docId,
+                        vaultId: vaultId,
+                        epoch: epoch,
+                        nonce: (0, VaultCrypto_1.toBase64Url)(nonce),
+                        kcmp: (0, VaultCrypto_1.toBase64Url)(kcmp),
+                        policy: { mode: 'any-of' },
+                        recipients: recipientWraps,
+                    };
+                    this.zeroize(cek);
+                    return [2 /*return*/, { header: header, ciphertext: ciphertext }];
+                });
+            });
+        };
+        /**
+         * Decrypt any-of vault (spec §9.2)
+         * Try the specified recipient's wrap
+         *
+         * @param vault - Encrypted vault document
+         * @param recipientSecretKey - Recipient's ML-KEM secret key
+         * @param recipientKid - Recipient's key identifier
+         * @returns Decrypted plaintext
+         */
+        VaultEncryptionService_1.prototype.decryptAnyOf = function (vault, recipientSecretKey, recipientKid) {
+            var _a;
+            return __awaiter(this, void 0, void 0, function () {
+                var header, ciphertext, recipient, wrappedCek, cek, aad, nonce, plaintext;
+                return __generator(this, function (_b) {
+                    header = vault.header, ciphertext = vault.ciphertext;
+                    if (((_a = header.policy) === null || _a === void 0 ? void 0 : _a.mode) !== 'any-of' || !header.recipients) {
+                        throw new errors_1.PolicyError('Not an any-of policy vault');
+                    }
+                    recipient = header.recipients.find(function (r) { return r.kid === recipientKid; });
+                    if (!recipient) {
+                        throw new errors_1.DecryptKemError("No recipient wrap found for kid: ".concat(recipientKid));
+                    }
+                    wrappedCek = (0, VaultCrypto_1.fromBase64Url)(recipient.ct);
+                    try {
+                        cek = (0, VaultCrypto_1.kemUnwrapCek)(wrappedCek, recipientSecretKey);
+                    }
+                    catch (e) {
+                        throw new errors_1.DecryptKemError('Failed to unwrap CEK - invalid key or corrupted wrap');
+                    }
+                    // Verify key commitment
+                    if (!(0, VaultCrypto_1.verifyKeyCommitment)(cek, (0, VaultCrypto_1.fromBase64Url)(header.kcmp))) {
+                        this.zeroize(cek);
+                        throw new errors_1.DecryptAeadError('Key commitment verification failed');
+                    }
+                    aad = (0, VaultCrypto_1.canonicalAad)({
+                        v: header.v,
+                        suite: header.suite,
+                        aead: header.aead,
+                        docId: header.docId,
+                        vaultId: header.vaultId,
+                        epoch: header.epoch,
+                        policy: header.policy,
+                    });
+                    nonce = (0, VaultCrypto_1.fromBase64Url)(header.nonce);
+                    try {
+                        plaintext = (0, VaultCrypto_1.aesGcmDecrypt)(cek, nonce, ciphertext, aad);
+                        this.zeroize(cek);
+                        return [2 /*return*/, plaintext];
+                    }
+                    catch (e) {
+                        this.zeroize(cek);
+                        throw new errors_1.DecryptAeadError('AEAD decryption failed');
+                    }
+                    return [2 /*return*/];
+                });
+            });
+        };
+        /**
+         * Encrypt with all-of policy (spec §6.2)
+         * Requires ALL listed keys to decrypt via HKDF-join
+         *
+         * @param plaintext - Data to encrypt
+         * @param participants - Array of participant public keys
+         * @param options - Encryption options
+         * @returns Encrypted vault document
+         */
+        VaultEncryptionService_1.prototype.encryptAllOf = function (plaintext, participants, options) {
+            var _a, _b;
+            if (options === void 0) { options = {}; }
+            return __awaiter(this, void 0, void 0, function () {
+                var cek, nonce, wrapNonce, docId, vaultId, epoch, keyMaterials, context, wrapKey, wrappedCekResult, aad, encResult, ciphertext, header;
+                return __generator(this, function (_c) {
+                    if (participants.length < 2) {
+                        throw new errors_1.PolicyError('At least 2 participants required for all-of policy');
+                    }
+                    cek = (0, VaultCrypto_1.generateCek)();
+                    nonce = (0, VaultCrypto_1.generateNonceAesGcm)();
+                    wrapNonce = (0, VaultCrypto_1.generateNonceAesGcm)();
+                    docId = (_a = options.docId) !== null && _a !== void 0 ? _a : (0, VaultCrypto_1.generateUuid)();
+                    vaultId = (_b = options.vaultId) !== null && _b !== void 0 ? _b : docId;
+                    epoch = 1;
+                    keyMaterials = participants.map(function (p) { return ({
+                        kid: p.kid,
+                        key: p.publicKey,
+                    }); });
+                    context = "wrap:doc:".concat(docId, ":epoch:").concat(epoch);
+                    wrapKey = (0, VaultCrypto_1.hkdfJoin)(keyMaterials, context);
+                    wrappedCekResult = (0, VaultCrypto_1.aesGcmEncrypt)(wrapKey, wrapNonce, cek, new Uint8Array(0));
+                    aad = (0, VaultCrypto_1.canonicalAad)({
+                        v: 1,
+                        suite: 'P1',
+                        aead: 'AES-256-GCM',
+                        docId: docId,
+                        vaultId: vaultId,
+                        epoch: epoch,
+                        policy: { mode: 'all-of' },
+                    });
+                    encResult = (0, VaultCrypto_1.aesGcmEncrypt)(cek, nonce, plaintext, aad);
+                    ciphertext = encResult.ciphertext();
+                    header = {
+                        v: 1,
+                        suite: 'P1',
+                        aead: 'AES-256-GCM',
+                        docId: docId,
+                        vaultId: vaultId,
+                        epoch: epoch,
+                        nonce: (0, VaultCrypto_1.toBase64Url)(nonce),
+                        kcmp: (0, VaultCrypto_1.toBase64Url)((0, VaultCrypto_1.keyCommitment)(cek)),
+                        policy: { mode: 'all-of' },
+                        wrap_all: {
+                            alg: 'HKDF-join',
+                            kids: participants.map(function (p) { return p.kid; }),
+                            ct: (0, VaultCrypto_1.toBase64Url)(wrappedCekResult.ciphertext()),
+                        },
+                    };
+                    this.zeroize(cek);
+                    this.zeroize(wrapKey);
+                    return [2 /*return*/, { header: header, ciphertext: ciphertext }];
+                });
+            });
+        };
+        /**
+         * Encrypt with threshold policy (spec §6.3)
+         * Any t-of-n participants can decrypt
+         *
+         * @param plaintext - Data to encrypt
+         * @param threshold - Minimum shares required (t)
+         * @param participants - Array of participant public keys (n)
+         * @param options - Encryption options
+         * @returns Encrypted vault document
+         */
+        VaultEncryptionService_1.prototype.encryptThreshold = function (plaintext, threshold, participants, options) {
+            var _a, _b;
+            if (options === void 0) { options = {}; }
+            return __awaiter(this, void 0, void 0, function () {
+                var n, cek, nonce, docId, vaultId, epoch, shares, thresholdShares, aad, encResult, ciphertext, header, _i, shares_1, share;
+                return __generator(this, function (_c) {
+                    n = participants.length;
+                    if (threshold < 1 || threshold > n) {
+                        throw new errors_1.PolicyError("Invalid threshold: ".concat(threshold, " of ").concat(n));
+                    }
+                    cek = (0, VaultCrypto_1.generateCek)();
+                    nonce = (0, VaultCrypto_1.generateNonceAesGcm)();
+                    docId = (_a = options.docId) !== null && _a !== void 0 ? _a : (0, VaultCrypto_1.generateUuid)();
+                    vaultId = (_b = options.vaultId) !== null && _b !== void 0 ? _b : docId;
+                    epoch = 1;
+                    shares = (0, VaultCrypto_1.shamirSplit)(cek, threshold, n);
+                    thresholdShares = participants.map(function (p, i) { return ({
+                        kid: p.kid,
+                        enc_share: {
+                            kem: 'ML-KEM-768',
+                            ct: (0, VaultCrypto_1.toBase64Url)((0, VaultCrypto_1.kemWrapCek)(shares[i], p.publicKey)),
+                        },
+                    }); });
+                    aad = (0, VaultCrypto_1.canonicalAad)({
+                        v: 1,
+                        suite: 'P1',
+                        aead: 'AES-256-GCM',
+                        docId: docId,
+                        vaultId: vaultId,
+                        epoch: epoch,
+                        policy: { mode: 'threshold', t: threshold, n: n },
+                    });
+                    encResult = (0, VaultCrypto_1.aesGcmEncrypt)(cek, nonce, plaintext, aad);
+                    ciphertext = encResult.ciphertext();
+                    header = {
+                        v: 1,
+                        suite: 'P1',
+                        aead: 'AES-256-GCM',
+                        docId: docId,
+                        vaultId: vaultId,
+                        epoch: epoch,
+                        nonce: (0, VaultCrypto_1.toBase64Url)(nonce),
+                        kcmp: (0, VaultCrypto_1.toBase64Url)((0, VaultCrypto_1.keyCommitment)(cek)),
+                        policy: { mode: 'threshold', t: threshold, n: n },
+                        shares: thresholdShares,
+                    };
+                    this.zeroize(cek);
+                    // Zero out shares
+                    for (_i = 0, shares_1 = shares; _i < shares_1.length; _i++) {
+                        share = shares_1[_i];
+                        this.zeroize(share);
+                    }
+                    return [2 /*return*/, { header: header, ciphertext: ciphertext }];
+                });
+            });
+        };
+        /**
+         * Decrypt threshold vault with collected shares
+         *
+         * @param vault - Encrypted vault document
+         * @param decryptedShares - Array of decrypted shares (at least t shares)
+         * @returns Decrypted plaintext
+         */
+        VaultEncryptionService_1.prototype.decryptThreshold = function (vault, decryptedShares) {
+            var _a, _b;
+            return __awaiter(this, void 0, void 0, function () {
+                var header, ciphertext, threshold, shareData, cek, aad, nonce, plaintext;
+                return __generator(this, function (_c) {
+                    header = vault.header, ciphertext = vault.ciphertext;
+                    if (((_a = header.policy) === null || _a === void 0 ? void 0 : _a.mode) !== 'threshold') {
+                        throw new errors_1.PolicyError('Not a threshold policy vault');
+                    }
+                    threshold = (_b = header.policy.t) !== null && _b !== void 0 ? _b : 1;
+                    if (decryptedShares.length < threshold) {
+                        throw new errors_1.PolicyError("Need ".concat(threshold, " shares, got ").concat(decryptedShares.length));
+                    }
+                    shareData = decryptedShares.map(function (s) { return ({
+                        index: s.index,
+                        data: s.share,
+                    }); });
+                    cek = (0, VaultCrypto_1.shamirReconstruct)(shareData);
+                    // Verify key commitment
+                    if (!(0, VaultCrypto_1.verifyKeyCommitment)(cek, (0, VaultCrypto_1.fromBase64Url)(header.kcmp))) {
+                        this.zeroize(cek);
+                        throw new errors_1.DecryptAeadError('Key commitment verification failed');
+                    }
+                    aad = (0, VaultCrypto_1.canonicalAad)({
+                        v: header.v,
+                        suite: header.suite,
+                        aead: header.aead,
+                        docId: header.docId,
+                        vaultId: header.vaultId,
+                        epoch: header.epoch,
+                        policy: header.policy,
+                    });
+                    nonce = (0, VaultCrypto_1.fromBase64Url)(header.nonce);
+                    try {
+                        plaintext = (0, VaultCrypto_1.aesGcmDecrypt)(cek, nonce, ciphertext, aad);
+                        this.zeroize(cek);
+                        return [2 /*return*/, plaintext];
+                    }
+                    catch (e) {
+                        this.zeroize(cek);
+                        throw new errors_1.DecryptAeadError('AEAD decryption failed');
+                    }
+                    return [2 /*return*/];
+                });
+            });
+        };
+        /**
+         * Unwrap a single threshold share for a participant
+         *
+         * @param vault - Encrypted vault document
+         * @param participantSecretKey - Participant's ML-KEM secret key
+         * @param participantKid - Participant's key identifier
+         * @returns Decrypted share with its index
+         */
+        VaultEncryptionService_1.prototype.unwrapThresholdShare = function (vault, participantSecretKey, participantKid) {
+            var _a;
+            return __awaiter(this, void 0, void 0, function () {
+                var header, shareIndex, shareEntry, wrappedShare, share;
+                return __generator(this, function (_b) {
+                    header = vault.header;
+                    if (((_a = header.policy) === null || _a === void 0 ? void 0 : _a.mode) !== 'threshold' || !header.shares) {
+                        throw new errors_1.PolicyError('Not a threshold policy vault');
+                    }
+                    shareIndex = header.shares.findIndex(function (s) { return s.kid === participantKid; });
+                    if (shareIndex === -1) {
+                        throw new errors_1.DecryptKemError("No share found for kid: ".concat(participantKid));
+                    }
+                    shareEntry = header.shares[shareIndex];
+                    wrappedShare = (0, VaultCrypto_1.fromBase64Url)(shareEntry.enc_share.ct);
+                    try {
+                        share = (0, VaultCrypto_1.kemUnwrapCek)(wrappedShare, participantSecretKey);
+                    }
+                    catch (e) {
+                        throw new errors_1.DecryptKemError('Failed to unwrap share - invalid key');
+                    }
+                    // Return with 1-based index (Shamir convention)
+                    return [2 /*return*/, {
+                            index: shareIndex + 1,
+                            share: share,
+                        }];
+                });
+            });
+        };
+        // ═══════════════════════════════════════════════════════════════════════
+        // HELPER METHODS
+        // ═══════════════════════════════════════════════════════════════════════
+        /**
+         * Derive key from passphrase using Argon2id
+         * Spec §4.1 S1/S3 suite
+         */
+        VaultEncryptionService_1.prototype.deriveKeyArgon2 = function (passphrase, salt, params) {
+            return __awaiter(this, void 0, void 0, function () {
+                var hash;
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, (0, hash_wasm_1.argon2id)({
+                                password: passphrase,
+                                salt: salt,
+                                parallelism: params.parallelism,
+                                iterations: params.iterations,
+                                memorySize: params.memory,
+                                hashLength: 32,
+                                outputType: 'binary',
+                            })];
+                        case 1:
+                            hash = _a.sent();
+                            return [2 /*return*/, new Uint8Array(hash)];
+                    }
+                });
+            });
+        };
+        /**
+         * Zero out sensitive data from memory
+         * Security best practice to minimize exposure window
+         */
+        VaultEncryptionService_1.prototype.zeroize = function (data) {
+            data.fill(0);
+        };
+        return VaultEncryptionService_1;
+    }());
+    __setFunctionName(_classThis, "VaultEncryptionService");
+    (function () {
+        var _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
+        __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+        VaultEncryptionService = _classThis = _classDescriptor.value;
+        if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        __runInitializers(_classThis, _classExtraInitializers);
+    })();
+    return VaultEncryptionService = _classThis;
+}();
+exports.VaultEncryptionService = VaultEncryptionService;