@ajna-inc/vaults 0.1.0

package/build/services/VaultService.js

@@ -0,0 +1,398 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __setFunctionName = (this && this.__setFunctionName) || function (f, name, prefix) {
+    if (typeof name === "symbol") name = name.description ? "[".concat(name.description, "]") : "";
+    return Object.defineProperty(f, "name", { configurable: true, value: prefix ? "".concat(prefix, " ", name) : name });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VaultService = void 0;
+var core_1 = require("@credo-ts/core");
+var VaultRecord_1 = require("../repository/VaultRecord");
+var errors_1 = require("../errors");
+var VaultCrypto_1 = require("../crypto/wasm/VaultCrypto");
+var VaultsEvents_1 = require("../VaultsEvents");
+// ═══════════════════════════════════════════════════════════════════════════
+// Service
+// ═══════════════════════════════════════════════════════════════════════════
+/**
+ * Vault Service
+ *
+ * Main orchestration layer for vault operations.
+ * Coordinates encryption, storage, and events.
+ *
+ * All encryption/decryption happens client-side.
+ */
+var VaultService = function () {
+    var _classDecorators = [(0, core_1.injectable)()];
+    var _classDescriptor;
+    var _classExtraInitializers = [];
+    var _classThis;
+    var VaultService = _classThis = /** @class */ (function () {
+        function VaultService_1(encryptionService, vaultRepository, eventEmitter) {
+            this.encryptionService = encryptionService;
+            this.vaultRepository = vaultRepository;
+            this.eventEmitter = eventEmitter;
+        }
+        /**
+         * Create a new vault with passphrase encryption
+         * Stores encrypted data locally in agent storage
+         *
+         * @param agentContext - Agent context
+         * @param data - Raw data to encrypt
+         * @param options - Creation options including passphrase
+         * @returns Created vault identifiers
+         */
+        VaultService_1.prototype.createVault = function (agentContext, data, options) {
+            var _a;
+            return __awaiter(this, void 0, void 0, function () {
+                var vault, record;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
+                        case 0: return [4 /*yield*/, this.encryptionService.encryptWithPassphrase(data, options.passphrase, {
+                                vaultId: options.vaultId,
+                                memory: options.memory,
+                                iterations: options.iterations,
+                            })
+                            // 2. Add metadata to header
+                        ];
+                        case 1:
+                            vault = _b.sent();
+                            // 2. Add metadata to header
+                            if (options.metadata) {
+                                vault.header.metadata = __assign(__assign({}, vault.header.metadata), { description: options.metadata.description, tags: options.metadata.tags, createdAt: new Date().toISOString() });
+                            }
+                            else {
+                                vault.header.metadata = {
+                                    createdAt: new Date().toISOString(),
+                                };
+                            }
+                            record = new VaultRecord_1.VaultRecord({
+                                vaultId: (_a = vault.header.vaultId) !== null && _a !== void 0 ? _a : vault.header.docId,
+                                docId: vault.header.docId,
+                                header: vault.header,
+                                ciphertext: (0, VaultCrypto_1.toBase64Url)(vault.ciphertext),
+                                ownerDid: agentContext.contextCorrelationId,
+                            });
+                            // 4. Save to local storage
+                            return [4 /*yield*/, this.vaultRepository.save(agentContext, record)
+                                // 5. Emit event
+                            ];
+                        case 2:
+                            // 4. Save to local storage
+                            _b.sent();
+                            // 5. Emit event
+                            this.eventEmitter.emit(agentContext, {
+                                type: VaultsEvents_1.VaultEventTypes.VaultCreated,
+                                payload: {
+                                    vaultId: record.vaultId,
+                                    docId: record.docId,
+                                    policyMode: record.policyMode,
+                                },
+                            });
+                            return [2 /*return*/, {
+                                    vaultId: record.vaultId,
+                                    docId: record.docId,
+                                }];
+                    }
+                });
+            });
+        };
+        /**
+         * Open (decrypt) a vault
+         * All decryption happens client-side
+         *
+         * @param agentContext - Agent context
+         * @param vaultId - Vault identifier
+         * @param options - Open options including passphrase
+         * @returns Decrypted data
+         */
+        VaultService_1.prototype.openVault = function (agentContext, vaultId, options) {
+            return __awaiter(this, void 0, void 0, function () {
+                var record, vault, plaintext;
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, this.vaultRepository.findByVaultId(agentContext, vaultId)];
+                        case 1:
+                            record = _a.sent();
+                            if (!record) {
+                                throw new errors_1.VaultError(errors_1.VaultErrorCode.NOT_FOUND, "Vault not found: ".concat(vaultId));
+                            }
+                            vault = {
+                                header: record.header,
+                                ciphertext: (0, VaultCrypto_1.fromBase64Url)(record.ciphertext),
+                            };
+                            return [4 /*yield*/, this.encryptionService.decryptWithPassphrase(vault, options.passphrase)
+                                // 4. Emit event
+                            ];
+                        case 2:
+                            plaintext = _a.sent();
+                            // 4. Emit event
+                            this.eventEmitter.emit(agentContext, {
+                                type: VaultsEvents_1.VaultEventTypes.VaultOpened,
+                                payload: {
+                                    vaultId: record.vaultId,
+                                    docId: record.docId,
+                                },
+                            });
+                            return [2 /*return*/, plaintext];
+                    }
+                });
+            });
+        };
+        /**
+         * Update vault content (re-encrypt with new data)
+         * Increments epoch for revocation tracking
+         *
+         * @param agentContext - Agent context
+         * @param vaultId - Vault identifier
+         * @param newData - New data to encrypt
+         * @param options - Update options including passphrase
+         */
+        VaultService_1.prototype.updateVault = function (agentContext, vaultId, newData, options) {
+            return __awaiter(this, void 0, void 0, function () {
+                var record, vault;
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, this.vaultRepository.findByVaultId(agentContext, vaultId)];
+                        case 1:
+                            record = _a.sent();
+                            if (!record) {
+                                throw new errors_1.VaultError(errors_1.VaultErrorCode.NOT_FOUND, "Vault not found: ".concat(vaultId));
+                            }
+                            return [4 /*yield*/, this.encryptionService.encryptWithPassphrase(newData, options.passphrase, {
+                                    docId: record.docId,
+                                    vaultId: record.vaultId,
+                                })
+                                // 3. Increment epoch (spec §12 - key rotation)
+                            ];
+                        case 2:
+                            vault = _a.sent();
+                            // 3. Increment epoch (spec §12 - key rotation)
+                            vault.header.epoch = record.header.epoch + 1;
+                            // 4. Update metadata
+                            vault.header.metadata = __assign(__assign(__assign({}, record.header.metadata), options.metadata), { updatedAt: new Date().toISOString() });
+                            // 5. Update record
+                            record.header = vault.header;
+                            record.ciphertext = (0, VaultCrypto_1.toBase64Url)(vault.ciphertext);
+                            record.updatedAt = new Date();
+                            return [4 /*yield*/, this.vaultRepository.update(agentContext, record)
+                                // 6. Emit event
+                            ];
+                        case 3:
+                            _a.sent();
+                            // 6. Emit event
+                            this.eventEmitter.emit(agentContext, {
+                                type: VaultsEvents_1.VaultEventTypes.VaultUpdated,
+                                payload: {
+                                    vaultId: record.vaultId,
+                                    docId: record.docId,
+                                    epoch: vault.header.epoch,
+                                },
+                            });
+                            return [2 /*return*/];
+                    }
+                });
+            });
+        };
+        /**
+         * Delete a vault
+         *
+         * @param agentContext - Agent context
+         * @param vaultId - Vault identifier
+         */
+        VaultService_1.prototype.deleteVault = function (agentContext, vaultId) {
+            return __awaiter(this, void 0, void 0, function () {
+                var record;
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, this.vaultRepository.findByVaultId(agentContext, vaultId)];
+                        case 1:
+                            record = _a.sent();
+                            if (!record) {
+                                throw new errors_1.VaultError(errors_1.VaultErrorCode.NOT_FOUND, "Vault not found: ".concat(vaultId));
+                            }
+                            return [4 /*yield*/, this.vaultRepository.delete(agentContext, record)];
+                        case 2:
+                            _a.sent();
+                            this.eventEmitter.emit(agentContext, {
+                                type: VaultsEvents_1.VaultEventTypes.VaultDeleted,
+                                payload: {
+                                    vaultId: record.vaultId,
+                                    docId: record.docId,
+                                },
+                            });
+                            return [2 /*return*/];
+                    }
+                });
+            });
+        };
+        /**
+         * List all vaults
+         *
+         * @param agentContext - Agent context
+         * @returns Array of vault records
+         */
+        VaultService_1.prototype.listVaults = function (agentContext) {
+            return __awaiter(this, void 0, void 0, function () {
+                return __generator(this, function (_a) {
+                    return [2 /*return*/, this.vaultRepository.getAll(agentContext)];
+                });
+            });
+        };
+        /**
+         * Get vault info (metadata without decrypting)
+         *
+         * @param agentContext - Agent context
+         * @param vaultId - Vault identifier
+         * @returns Vault information
+         */
+        VaultService_1.prototype.getVaultInfo = function (agentContext, vaultId) {
+            return __awaiter(this, void 0, void 0, function () {
+                var record;
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, this.vaultRepository.findByVaultId(agentContext, vaultId)];
+                        case 1:
+                            record = _a.sent();
+                            if (!record) {
+                                throw new errors_1.VaultError(errors_1.VaultErrorCode.NOT_FOUND, "Vault not found: ".concat(vaultId));
+                            }
+                            return [2 /*return*/, {
+                                    vaultId: record.vaultId,
+                                    docId: record.docId,
+                                    recordId: record.id,
+                                    header: record.header,
+                                    createdAt: record.createdAt,
+                                    updatedAt: record.updatedAt,
+                                }];
+                    }
+                });
+            });
+        };
+        /**
+         * Check if a vault exists
+         *
+         * @param agentContext - Agent context
+         * @param vaultId - Vault identifier
+         * @returns True if vault exists
+         */
+        VaultService_1.prototype.vaultExists = function (agentContext, vaultId) {
+            return __awaiter(this, void 0, void 0, function () {
+                var record;
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, this.vaultRepository.findByVaultId(agentContext, vaultId)];
+                        case 1:
+                            record = _a.sent();
+                            return [2 /*return*/, record !== null];
+                    }
+                });
+            });
+        };
+        /**
+         * Get vault record by ID (for advanced operations)
+         *
+         * @param agentContext - Agent context
+         * @param vaultId - Vault identifier
+         * @returns Vault record or null
+         */
+        VaultService_1.prototype.getVaultRecord = function (agentContext, vaultId) {
+            return __awaiter(this, void 0, void 0, function () {
+                return __generator(this, function (_a) {
+                    return [2 /*return*/, this.vaultRepository.findByVaultId(agentContext, vaultId)];
+                });
+            });
+        };
+        return VaultService_1;
+    }());
+    __setFunctionName(_classThis, "VaultService");
+    (function () {
+        var _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
+        __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+        VaultService = _classThis = _classDescriptor.value;
+        if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        __runInitializers(_classThis, _classExtraInitializers);
+    })();
+    return VaultService = _classThis;
+}();
+exports.VaultService = VaultService;

package/build/services/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VaultService = exports.VaultEncryptionService = void 0;
+// Core services
+var VaultEncryptionService_1 = require("./VaultEncryptionService");
+Object.defineProperty(exports, "VaultEncryptionService", { enumerable: true, get: function () { return VaultEncryptionService_1.VaultEncryptionService; } });
+var VaultService_1 = require("./VaultService");
+Object.defineProperty(exports, "VaultService", { enumerable: true, get: function () { return VaultService_1.VaultService; } });

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@ajna-inc/vaults",
+  "version": "0.1.0",
+  "description": "Post-quantum encrypted vaults with DIDComm protocol for Credo",
+  "license": "Apache-2.0",
+  "main": "build/index.js",
+  "types": "build/index.d.ts",
+  "files": [
+    "build",
+    "wasm"
+  ],
+  "dependencies": {
+    "@hpke/core": "^1.7.4",
+    "@noble/hashes": "^1.3.3",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.14.0",
+    "hash-wasm": "^4.11.0",
+    "@credo-ts/core": "0.5.17"
+  },
+  "optionalDependencies": {
+    "@aws-sdk/client-s3": "^3.400.0",
+    "@aws-sdk/s3-request-presigner": "^3.400.0"
+  },
+  "devDependencies": {
+    "@types/jest": "^29.5.0",
+    "@types/node": "^18.0.0",
+    "jest": "^29.5.0",
+    "ts-jest": "^29.1.0",
+    "typescript": "~5.3.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/ajna-inc/credo-ts",
+    "directory": "packages/vaults"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "jest",
+    "test:watch": "jest --watch",
+    "build:wasm": "cd ../../../rust/wasm/vault-crypto && wasm-pack build --target nodejs --out-dir ../../../credo-ts/packages/vaults/wasm"
+  }
+}

package/wasm/README.md

@@ -0,0 +1,166 @@
+# vault-crypto
+
+Post-quantum cryptographic primitives for the ZK-Vault protocol, compiled to WebAssembly.
+
+## Features
+
+- **AEAD Encryption**: AES-256-GCM and XChaCha20-Poly1305
+- **Post-Quantum KEM**: ML-KEM-768 (Kyber-768) key encapsulation
+- **Key Derivation**: HKDF-SHA256 and HKDF-join for all-of policies
+- **Secret Sharing**: Shamir (t, n)-threshold secret splitting
+- **Utilities**: Key commitment, random generation, hashing
+
+## Installation
+
+```bash
+npm install @ajna-inc/vault-crypto
+```
+
+## Usage
+
+### Generate and Encrypt with CEK
+
+```typescript
+import * as vault from '@ajna-inc/vault-crypto';
+
+// Initialize WASM
+await vault.init();
+
+// Generate a random CEK
+const cek = vault.generateCek();
+
+// Generate nonce
+const nonce = vault.generateNonceAesGcm();
+
+// Encrypt data
+const plaintext = new TextEncoder().encode('Secret document');
+const aad = new TextEncoder().encode('{"docId":"abc","epoch":0}');
+
+const result = vault.aesGcmEncrypt(cek, nonce, plaintext, aad);
+const ciphertext = result.ciphertext();
+
+// Decrypt
+const decrypted = vault.aesGcmDecrypt(cek, nonce, ciphertext, aad);
+console.log(new TextDecoder().decode(decrypted)); // "Secret document"
+```
+
+### KEM: Wrap CEK for Recipient
+
+```typescript
+// Recipient generates keypair
+const keypair = vault.kemGenerateKeypair();
+const publicKey = keypair.publicKey();
+const secretKey = keypair.secretKey();
+
+// Sender wraps CEK to recipient's public key
+const wrappedCek = vault.kemWrapCek(cek, publicKey);
+
+// Recipient unwraps
+const unwrappedCek = vault.kemUnwrapCek(wrappedCek, secretKey);
+```
+
+### Shamir Secret Sharing
+
+```typescript
+// Split CEK into 5 shares, need any 3 to reconstruct
+const shares = vault.shamirSplit(cek, 3, 5);
+
+// Reconstruct from any 3 shares
+const selected = [shares[0], shares[2], shares[4]];
+const reconstructed = vault.shamirReconstruct(selected);
+```
+
+### HKDF-join for All-Of Policy
+
+```typescript
+// Combine multiple keys into joint wrap key
+const keys = [
+  { kid: 'alice', key: aliceKey },
+  { kid: 'bob', key: bobKey },
+];
+
+const wrapKey = vault.hkdfJoin(keys, 'doc:123:epoch:0');
+```
+
+### Key Commitment
+
+```typescript
+// Compute key commitment
+const kcmp = vault.keyCommitment(cek);
+
+// Verify
+const valid = vault.verifyKeyCommitment(cek, kcmp);
+```
+
+## API Reference
+
+### AEAD Encryption
+
+- `aesGcmEncrypt(key, nonce, plaintext, aad)` → `AeadResult`
+- `aesGcmDecrypt(key, nonce, ciphertext, aad)` → `Uint8Array`
+- `xchachaEncrypt(key, nonce, plaintext, aad)` → `AeadResult`
+- `xchachaDecrypt(key, nonce, ciphertext, aad)` → `Uint8Array`
+
+### KEM (ML-KEM-768)
+
+- `kemGenerateKeypair()` → `KemKeypair`
+- `kemEncapsulate(recipientPublicKey)` → `KemEncapResult`
+- `kemDecapsulate(ciphertext, secretKey)` → `Uint8Array`
+- `kemWrapCek(cek, recipientPublicKey)` → `Uint8Array`
+- `kemUnwrapCek(wrappedCek, secretKey)` → `Uint8Array`
+
+### Key Derivation
+
+- `hkdfExpand(ikm, salt, info, length)` → `Uint8Array`
+- `hkdfJoin(keys, context)` → `Uint8Array`
+- `deriveCek(seed, context)` → `Uint8Array`
+- `deriveKid(publicKey)` → `string`
+- `deriveSymmetricKid(key)` → `string`
+
+### Shamir Secret Sharing
+
+- `shamirSplit(secret, threshold, totalShares)` → `SecretShare[]`
+- `shamirReconstruct(shares)` → `Uint8Array`
+- `shamirSplitAndWrap(secret, threshold, publicKeys)` → `WrappedShare[]`
+- `shamirUnwrapAndReconstruct(wrappedShares, secretKeys)` → `Uint8Array`
+
+### Utilities
+
+- `generateCek()` → `Uint8Array` (32 bytes)
+- `generateNonceAesGcm()` → `Uint8Array` (12 bytes)
+- `generateNonceXchacha()` → `Uint8Array` (24 bytes)
+- `randomBytes(length)` → `Uint8Array`
+- `keyCommitment(cek)` → `Uint8Array`
+- `verifyKeyCommitment(cek, kcmp)` → `boolean`
+- `sha256(data)` → `Uint8Array`
+- `blake2s256(data)` → `Uint8Array`
+- `computeSummary(digest)` → `Uint8Array` (16 bytes)
+- `constantTimeEq(a, b)` → `boolean`
+- `toBase64Url(data)` → `string`
+- `fromBase64Url(encoded)` → `Uint8Array`
+- `toHex(data)` → `string`
+- `fromHex(encoded)` → `Uint8Array`
+- `generateUuid()` → `string`
+- `canonicalAad(headerFields)` → `Uint8Array`
+- `buildContext(docId, epoch)` → `string`
+
+## Building from Source
+
+```bash
+# Install wasm-pack
+curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+
+# Build for web
+wasm-pack build --target web --release
+
+# Build for Node.js
+wasm-pack build --target nodejs --release
+
+# Run tests
+cargo test
+wasm-pack test --headless --firefox
+```
+
+## License
+
+Proprietary - Copyright © 2025 Ajna Inc. All rights reserved.

package/wasm/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "vault-crypto",
+  "collaborators": [
+    "Ajna Inc."
+  ],
+  "description": "Post-quantum vault cryptography for browser and Node.js",
+  "version": "0.1.0",
+  "license": "PROPRIETARY",
+  "files": [
+    "vault_crypto_bg.wasm",
+    "vault_crypto.js",
+    "vault_crypto.d.ts"
+  ],
+  "main": "vault_crypto.js",
+  "types": "vault_crypto.d.ts"
+}