@alikhalilll/nuxt-crypto 1.0.0

package/README.md

@@ -0,0 +1,306 @@
+# @alikhalilll/nuxt-crypto
+
+Symmetric encryption for Nuxt 3 / 4, built on the native **Web Crypto API**. Defaults to **AES-256-GCM** with **PBKDF2-SHA256** key derivation.
+
+- **Framework-agnostic core** — `createCryptoService()` works anywhere `SubtleCrypto` exists (browser, Deno, Bun, Node 20+).
+- **Key caching** — derived keys are cached per salt, so bulk decrypt stays fast even at 100k+ PBKDF2 iterations.
+- **Pluggable algorithms** — swap the default AES-GCM implementation for your own `CryptoAlgorithm` without touching the payload envelope.
+- **Versioned payload format** — `v1.{salt}.{iv}.{cipher}` with clean forward compatibility.
+- **Server-only mode** — opt into registering the plugin only on the server so the passphrase never ships to the browser bundle.
+- **Strong types** — `CryptoService`, `CryptoServiceConfig`, and `CryptoAlgorithm` all exported.
+
+---
+
+## Table of contents
+
+1. [Install](#install)
+2. [Register the module](#register-the-module)
+3. [Usage](#usage)
+    - [Basic round-trip](#basic-round-trip)
+    - [Encrypt / decrypt a JSON object](#encrypt--decrypt-a-json-object)
+    - [Encrypt / decrypt an arbitrary value](#encrypt--decrypt-an-arbitrary-value)
+    - [Persist a ciphertext in a cookie](#persist-a-ciphertext-in-a-cookie)
+    - [Bulk encrypt / decrypt (key cache benefits)](#bulk-encrypt--decrypt-key-cache-benefits)
+    - [Clear the key cache](#clear-the-key-cache)
+    - [Error handling](#error-handling)
+4. [Server-only mode](#server-only-mode)
+5. [Nitro / API routes](#nitro--api-routes)
+6. [Framework-agnostic core](#framework-agnostic-core)
+7. [Custom algorithm](#custom-algorithm)
+8. [Rotating the passphrase (re-encryption)](#rotating-the-passphrase-re-encryption)
+9. [Payload format](#payload-format)
+10. [Module options reference](#module-options-reference)
+11. [Exported types](#exported-types)
+
+---
+
+## Install
+
+```bash
+pnpm add @alikhalilll/nuxt-crypto
+```
+
+## Register the module
+
+```ts
+// nuxt.config.ts
+export default defineNuxtConfig({
+  modules: ['@alikhalilll/nuxt-crypto'],
+  crypto: {
+    // Always wire this from an env var. Never commit the passphrase.
+    passphrase: process.env.NUXT_ENCRYPTION_PASSPHRASE ?? '',
+    provideName: '$crypto',  // leading "$" optional
+    iterations: 100_000,
+    keyCacheSize: 64,
+    serverOnly: false,
+  },
+});
+```
+
+`.env` (not committed):
+
+```
+NUXT_ENCRYPTION_PASSPHRASE=replace-me-with-a-long-random-secret
+```
+
+## Usage
+
+### Basic round-trip
+
+```vue
+<script setup lang="ts">
+const { $crypto } = useNuxtApp();
+
+const payload = await $crypto.encrypt('super-secret');
+// payload: "v1.<saltB64>.<ivB64>.<cipherB64>"
+
+const plain = await $crypto.decrypt(payload);
+</script>
+```
+
+`$crypto` is typed as `CryptoService` via auto-generated module augmentation.
+
+### Encrypt / decrypt a JSON object
+
+`encrypt` takes a string, so stringify structured data first:
+
+```ts
+const session = { userId: 42, roles: ['admin'], issuedAt: Date.now() };
+
+const payload = await $crypto.encrypt(JSON.stringify(session));
+
+const restored = JSON.parse(await $crypto.decrypt(payload)) as typeof session;
+```
+
+A tiny helper makes this ergonomic:
+
+```ts
+// composables/useEncrypted.ts
+export function useEncrypted() {
+  const { $crypto } = useNuxtApp();
+  return {
+    encode: async <T>(value: T) => $crypto.encrypt(JSON.stringify(value)),
+    decode: async <T>(payload: string) => JSON.parse(await $crypto.decrypt(payload)) as T,
+  };
+}
+```
+
+### Encrypt / decrypt an arbitrary value
+
+```ts
+const { encode, decode } = useEncrypted();
+
+const token = await encode({ refresh: 'abc123', exp: Date.now() + 3_600_000 });
+const { refresh, exp } = await decode<{ refresh: string; exp: number }>(token);
+```
+
+### Persist a ciphertext in a cookie
+
+```ts
+const cookie = useCookie<string | null>('session');
+
+// Write
+cookie.value = await $crypto.encrypt(JSON.stringify({ userId: 42 }));
+
+// Read
+if (cookie.value) {
+  const { userId } = JSON.parse(await $crypto.decrypt(cookie.value));
+}
+```
+
+### Bulk encrypt / decrypt (key cache benefits)
+
+PBKDF2 is deliberately slow. The built-in key cache (default size 64) keys derived material by salt, so a second decrypt of any payload you've already touched is essentially free:
+
+```ts
+const items = Array.from({ length: 100 }, (_, i) => `item-${i}`);
+
+const payloads = await Promise.all(items.map((i) => $crypto.encrypt(i)));
+
+// Fast — each salt was just derived during encrypt, so decrypt hits the cache.
+const plain = await Promise.all(payloads.map((p) => $crypto.decrypt(p)));
+```
+
+### Clear the key cache
+
+```ts
+$crypto.clearKeyCache();
+```
+
+Useful when:
+- You rotate the passphrase (the cache would still hold old keys).
+- You want to force re-derivation in a security-audit test.
+
+### Error handling
+
+```ts
+try {
+  await $crypto.decrypt('not-a-real-payload');
+} catch (e) {
+  // '[nuxt-crypto] Invalid payload format — expected 4 dot-separated segments.'
+  console.error((e as Error).message);
+}
+```
+
+Errors you can see:
+
+| Scenario                                      | Message |
+|-----------------------------------------------|---------|
+| Payload isn't `a.b.c.d`                       | `Invalid payload format — expected 4 dot-separated segments.` |
+| A segment is empty                            | `Invalid payload format — one or more segments were empty.`   |
+| Algorithm version mismatch                    | `Unsupported payload version: v2 (algorithm expects v1).`     |
+| Wrong passphrase / tampered ciphertext        | Native `OperationError` from Web Crypto.                      |
+| Passphrase not set in module config           | `[nuxt-crypto] passphrase is required.`                       |
+
+## Server-only mode
+
+Set `serverOnly: true` in module options to skip the client plugin entirely — the passphrase never ends up in the browser bundle.
+
+```ts
+crypto: {
+  passphrase: process.env.NUXT_ENCRYPTION_PASSPHRASE ?? '',
+  serverOnly: true,
+}
+```
+
+With this enabled, `$crypto` is `undefined` on the client. Use it only in:
+- Nitro server routes (`server/api/*.ts`)
+- Server-only plugins
+- `<script setup>` blocks guarded by `import.meta.server`
+
+## Nitro / API routes
+
+Encrypt data before sending it to the browser, decrypt it when it comes back:
+
+```ts
+// server/api/session/encode.post.ts
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event);
+  const { $crypto } = useNuxtApp();
+  return { token: await $crypto.encrypt(JSON.stringify(body)) };
+});
+
+// server/api/session/decode.post.ts
+export default defineEventHandler(async (event) => {
+  const { token } = await readBody(event);
+  const { $crypto } = useNuxtApp();
+  return JSON.parse(await $crypto.decrypt(token));
+});
+```
+
+## Framework-agnostic core
+
+Everything the Nuxt plugin wraps is available as a plain factory:
+
+```ts
+import { createCryptoService } from '@alikhalilll/nuxt-crypto/core';
+
+const service = await createCryptoService({
+  passphrase: process.env.ENC_PASS!,
+  iterations: 100_000,
+  keyCacheSize: 64,
+});
+
+const payload = await service.encrypt('hi');
+const clear = await service.decrypt(payload);
+service.clearKeyCache();
+```
+
+Works in Node 20+, Bun, Deno, or any browser. Passing a custom `subtle: SubtleCrypto` is supported for testing.
+
+## Custom algorithm
+
+Replace AES-GCM with any cipher by implementing `CryptoAlgorithm`. The payload envelope (`{version}.{salt}.{iv}.{cipher}`) is preserved, and the version tag routes decrypt to the right algorithm.
+
+```ts
+import { createCryptoService } from '@alikhalilll/nuxt-crypto/core';
+import type { CryptoAlgorithm } from '@alikhalilll/nuxt-crypto/types';
+
+const myAlgo: CryptoAlgorithm = {
+  version: 'v2',
+  async deriveKey({ subtle, passphrase, salt, iterations }) { /* ... */ },
+  async encrypt({ subtle, key, plainText })                  { /* ... */ },
+  async decrypt({ subtle, key, cipher, iv })                 { /* ... */ },
+};
+
+const service = await createCryptoService({
+  passphrase: 'p4ss',
+  algorithm: myAlgo,
+});
+```
+
+Old v1 payloads will cleanly fail decrypt under a v2 service (the version check throws). Build a version router yourself if you need mixed-version reads during a rotation.
+
+## Rotating the passphrase (re-encryption)
+
+```ts
+import { createCryptoService } from '@alikhalilll/nuxt-crypto/core';
+
+const oldService = await createCryptoService({ passphrase: OLD_PASS });
+const newService = await createCryptoService({ passphrase: NEW_PASS });
+
+async function rotate(payload: string): Promise<string> {
+  const plain = await oldService.decrypt(payload);
+  return newService.encrypt(plain);
+}
+```
+
+Run `rotate` over your stored ciphertexts during a background migration. Clear the key cache on whichever service goes out of use.
+
+## Payload format
+
+`v1.{saltB64}.{ivB64}.{cipherB64}` — four dot-separated segments, each standard base64:
+
+| Segment | Bytes | Notes |
+|---------|-------|-------|
+| `v1`    | —     | Algorithm / version tag. |
+| salt    | 16    | Per-encryption PBKDF2 salt. |
+| iv      | 12    | AES-GCM initialization vector. |
+| cipher  | N     | Ciphertext + 16-byte GCM auth tag. |
+
+## Module options reference
+
+| Option         | Type     | Default    | Purpose                                                              |
+|----------------|----------|------------|----------------------------------------------------------------------|
+| `passphrase`   | `string` | `''`       | Passphrase to derive the AES key from. Throws at use if empty.       |
+| `provideName`  | `string` | `'$crypto'`| Injected under `$<name>`. Leading `$` is stripped.                   |
+| `iterations`   | `number` | `100_000`  | PBKDF2 iteration count.                                              |
+| `keyCacheSize` | `number` | `64`       | Max derived keys kept in memory. Set to 0 to disable caching.        |
+| `serverOnly`   | `boolean`| `false`    | When true, plugin runs only on the server.                           |
+
+## Exported types
+
+```ts
+import type {
+  CryptoService,
+  CryptoServiceConfig,
+  CryptoAlgorithm,
+  CryptoModuleOptions,
+  Bytes,
+  ParsedPayload,
+} from '@alikhalilll/nuxt-crypto/types';
+```
+
+## License
+
+MIT

package/dist/chunk-EFZPSZWO.mjs

@@ -0,0 +1 @@
+//# sourceMappingURL=chunk-EFZPSZWO.mjs.map

package/dist/chunk-EFZPSZWO.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/chunk-HNTEUBQ7.mjs

@@ -0,0 +1,199 @@
+// src/core/algorithms/aes-gcm.ts
+var aesGcmPbkdf2 = {
+  version: "v1",
+  async deriveKey({ subtle, passphrase, salt, iterations }) {
+    const keyMaterial = await subtle.importKey(
+      "raw",
+      new TextEncoder().encode(passphrase),
+      { name: "PBKDF2" },
+      false,
+      ["deriveKey"]
+    );
+    return subtle.deriveKey(
+      { name: "PBKDF2", salt, iterations, hash: "SHA-256" },
+      keyMaterial,
+      { name: "AES-GCM", length: 256 },
+      false,
+      ["encrypt", "decrypt"]
+    );
+  },
+  async encrypt({ subtle, key, plainText }) {
+    const iv = new Uint8Array(new ArrayBuffer(12));
+    globalThis.crypto.getRandomValues(iv);
+    const buf = await subtle.encrypt({ name: "AES-GCM", iv }, key, plainText);
+    const cipher = new Uint8Array(new ArrayBuffer(buf.byteLength));
+    cipher.set(new Uint8Array(buf));
+    return { cipher, iv };
+  },
+  async decrypt({ subtle, key, cipher, iv }) {
+    const buf = await subtle.decrypt({ name: "AES-GCM", iv }, key, cipher);
+    const out = new Uint8Array(new ArrayBuffer(buf.byteLength));
+    out.set(new Uint8Array(buf));
+    return out;
+  }
+};
+
+// src/core/base64.ts
+function toBase64(data) {
+  if (typeof btoa === "function") {
+    let binary = "";
+    const CHUNK = 32768;
+    for (let i = 0; i < data.length; i += CHUNK) {
+      binary += String.fromCharCode(...data.subarray(i, i + CHUNK));
+    }
+    return btoa(binary);
+  }
+  return Buffer.from(data).toString("base64");
+}
+function fromBase64(input) {
+  if (typeof atob === "function") {
+    const binary = atob(input);
+    const out2 = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) out2[i] = binary.charCodeAt(i);
+    return out2;
+  }
+  const buf = Buffer.from(input, "base64");
+  const out = new Uint8Array(buf.length);
+  out.set(buf);
+  return out;
+}
+
+// src/core/key-cache.ts
+var KeyCache = class {
+  constructor(capacity) {
+    this.capacity = capacity;
+  }
+  capacity;
+  map = /* @__PURE__ */ new Map();
+  static key(salt, iterations) {
+    return `${iterations}.${toBase64(salt)}`;
+  }
+  get(key) {
+    const value = this.map.get(key);
+    if (!value) return void 0;
+    this.map.delete(key);
+    this.map.set(key, value);
+    return value;
+  }
+  set(key, value) {
+    if (this.capacity <= 0) return;
+    this.map.set(key, value);
+    while (this.map.size > this.capacity) {
+      const oldest = this.map.keys().next().value;
+      if (oldest === void 0) break;
+      this.map.delete(oldest);
+    }
+  }
+  clear() {
+    this.map.clear();
+  }
+};
+
+// src/core/payload.ts
+function encodePayload(parts) {
+  return [parts.version, toBase64(parts.salt), toBase64(parts.iv), toBase64(parts.cipher)].join(
+    "."
+  );
+}
+function parsePayload(payload) {
+  const segments = payload.split(".");
+  if (segments.length !== 4) {
+    throw new Error("[nuxt-crypto] Invalid payload format \u2014 expected 4 dot-separated segments.");
+  }
+  const [version, saltB64, ivB64, cipherB64] = segments;
+  if (!version || !saltB64 || !ivB64 || !cipherB64) {
+    throw new Error("[nuxt-crypto] Invalid payload format \u2014 one or more segments were empty.");
+  }
+  return {
+    version,
+    salt: fromBase64(saltB64),
+    iv: fromBase64(ivB64),
+    cipher: fromBase64(cipherB64)
+  };
+}
+
+// src/core/subtle.ts
+async function getSubtle() {
+  if (globalThis.crypto?.subtle) return globalThis.crypto.subtle;
+  const { webcrypto } = await import("crypto");
+  return webcrypto.subtle;
+}
+function getRandomBytes(length) {
+  const out = new Uint8Array(length);
+  const c = globalThis.crypto;
+  if (c?.getRandomValues) {
+    c.getRandomValues(out);
+    return out;
+  }
+  throw new Error(
+    "[nuxt-crypto] globalThis.crypto.getRandomValues is not available. Upgrade your runtime."
+  );
+}
+
+// src/core/create-service.ts
+var DEFAULT_ITERATIONS = 1e5;
+var DEFAULT_CACHE = 64;
+var SALT_BYTES = 16;
+async function createCryptoService(config) {
+  if (!config.passphrase) {
+    throw new Error("[nuxt-crypto] passphrase is required.");
+  }
+  const iterations = config.iterations ?? DEFAULT_ITERATIONS;
+  const algorithm = config.algorithm ?? aesGcmPbkdf2;
+  const subtle = config.subtle ?? await getSubtle();
+  const cache = new KeyCache(config.keyCacheSize ?? DEFAULT_CACHE);
+  const passphrase = String(config.passphrase).trim();
+  const encoder = new TextEncoder();
+  const decoder = new TextDecoder();
+  async function getDerivedKey(salt) {
+    const key = KeyCache.key(salt, iterations);
+    const cached = cache.get(key);
+    if (cached) return cached;
+    const pending = algorithm.deriveKey({ subtle, passphrase, salt, iterations });
+    cache.set(key, pending);
+    return pending;
+  }
+  return {
+    async encrypt(plainText) {
+      const salt = getRandomBytes(SALT_BYTES);
+      const key = await getDerivedKey(salt);
+      const encoded = encoder.encode(plainText);
+      const plainBytes = new Uint8Array(new ArrayBuffer(encoded.byteLength));
+      plainBytes.set(encoded);
+      const { cipher, iv } = await algorithm.encrypt({ subtle, key, plainText: plainBytes });
+      return encodePayload({ version: algorithm.version, salt, iv, cipher });
+    },
+    async decrypt(payload) {
+      const parsed = parsePayload(payload);
+      if (parsed.version !== algorithm.version) {
+        throw new Error(
+          `[nuxt-crypto] Unsupported payload version: ${parsed.version} (algorithm expects ${algorithm.version}).`
+        );
+      }
+      const key = await getDerivedKey(parsed.salt);
+      const plainBytes = await algorithm.decrypt({
+        subtle,
+        key,
+        cipher: parsed.cipher,
+        iv: parsed.iv
+      });
+      return decoder.decode(plainBytes);
+    },
+    clearKeyCache() {
+      cache.clear();
+    }
+  };
+}
+
+export {
+  aesGcmPbkdf2,
+  toBase64,
+  fromBase64,
+  KeyCache,
+  encodePayload,
+  parsePayload,
+  getSubtle,
+  getRandomBytes,
+  createCryptoService
+};
+//# sourceMappingURL=chunk-HNTEUBQ7.mjs.map

package/dist/chunk-HNTEUBQ7.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/algorithms/aes-gcm.ts","../src/core/base64.ts","../src/core/key-cache.ts","../src/core/payload.ts","../src/core/subtle.ts","../src/core/create-service.ts"],"sourcesContent":["import type { CryptoAlgorithm } from '../types';\n\n/**\n * AES-256-GCM with PBKDF2-SHA256 key derivation. This is the default and\n * currently the only built-in algorithm; pluggable via `CryptoServiceConfig.algorithm`.\n */\nexport const aesGcmPbkdf2: CryptoAlgorithm = {\n  version: 'v1',\n\n  async deriveKey({ subtle, passphrase, salt, iterations }) {\n    const keyMaterial = await subtle.importKey(\n      'raw',\n      new TextEncoder().encode(passphrase),\n      { name: 'PBKDF2' },\n      false,\n      ['deriveKey']\n    );\n\n    return subtle.deriveKey(\n      { name: 'PBKDF2', salt, iterations, hash: 'SHA-256' },\n      keyMaterial,\n      { name: 'AES-GCM', length: 256 },\n      false,\n      ['encrypt', 'decrypt']\n    );\n  },\n\n  async encrypt({ subtle, key, plainText }) {\n    const iv = new Uint8Array(new ArrayBuffer(12));\n    globalThis.crypto.getRandomValues(iv);\n    const buf = await subtle.encrypt({ name: 'AES-GCM', iv }, key, plainText);\n    const cipher = new Uint8Array(new ArrayBuffer(buf.byteLength));\n    cipher.set(new Uint8Array(buf));\n    return { cipher, iv };\n  },\n\n  async decrypt({ subtle, key, cipher, iv }) {\n    const buf = await subtle.decrypt({ name: 'AES-GCM', iv }, key, cipher);\n    const out = new Uint8Array(new ArrayBuffer(buf.byteLength));\n    out.set(new Uint8Array(buf));\n    return out;\n  },\n};\n","import type { Bytes } from './types';\n\n/** Encode bytes to standard base64. Works in browser and Node. */\nexport function toBase64(data: Bytes): string {\n  if (typeof btoa === 'function') {\n    let binary = '';\n    const CHUNK = 0x8000;\n    for (let i = 0; i < data.length; i += CHUNK) {\n      binary += String.fromCharCode(...data.subarray(i, i + CHUNK));\n    }\n    return btoa(binary);\n  }\n  // Node fallback — Buffer is globally available in Node.\n  return Buffer.from(data).toString('base64');\n}\n\n/** Decode a base64 string back to bytes. Works in browser and Node. */\nexport function fromBase64(input: string): Bytes {\n  if (typeof atob === 'function') {\n    const binary = atob(input);\n    const out = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);\n    return out;\n  }\n  const buf = Buffer.from(input, 'base64');\n  const out = new Uint8Array(buf.length);\n  out.set(buf);\n  return out;\n}\n","import type { Bytes } from './types';\nimport { toBase64 } from './base64';\n\n/**\n * A tiny LRU-ish cache for derived `CryptoKey` values, keyed on the salt.\n * When capacity is exceeded the oldest entry is evicted. Derived key\n * material is expensive (PBKDF2 is designed to be slow), so caching has\n * a big impact when decrypting many payloads in a row.\n */\nexport class KeyCache {\n  private readonly map = new Map<string, Promise<CryptoKey>>();\n  constructor(private readonly capacity: number) {}\n\n  static key(salt: Bytes, iterations: number): string {\n    return `${iterations}.${toBase64(salt)}`;\n  }\n\n  get(key: string): Promise<CryptoKey> | undefined {\n    const value = this.map.get(key);\n    if (!value) return undefined;\n    // Refresh recency by re-inserting.\n    this.map.delete(key);\n    this.map.set(key, value);\n    return value;\n  }\n\n  set(key: string, value: Promise<CryptoKey>): void {\n    if (this.capacity <= 0) return;\n    this.map.set(key, value);\n    while (this.map.size > this.capacity) {\n      const oldest = this.map.keys().next().value;\n      if (oldest === undefined) break;\n      this.map.delete(oldest);\n    }\n  }\n\n  clear(): void {\n    this.map.clear();\n  }\n}\n","import { fromBase64, toBase64 } from './base64';\nimport type { Bytes } from './types';\n\n/**\n * Payload serialisation format (v1): `${version}.${saltB64}.${ivB64}.${cipherB64}`.\n *\n * Each part is URL-safe base64, all joined with `.`. The version tag is\n * always the first segment so consumers can route to the correct algorithm\n * during decrypt.\n */\nexport interface ParsedPayload {\n  version: string;\n  salt: Bytes;\n  iv: Bytes;\n  cipher: Bytes;\n}\n\nexport function encodePayload(parts: ParsedPayload): string {\n  return [parts.version, toBase64(parts.salt), toBase64(parts.iv), toBase64(parts.cipher)].join(\n    '.'\n  );\n}\n\nexport function parsePayload(payload: string): ParsedPayload {\n  const segments = payload.split('.');\n  if (segments.length !== 4) {\n    throw new Error('[nuxt-crypto] Invalid payload format — expected 4 dot-separated segments.');\n  }\n  const [version, saltB64, ivB64, cipherB64] = segments;\n  if (!version || !saltB64 || !ivB64 || !cipherB64) {\n    throw new Error('[nuxt-crypto] Invalid payload format — one or more segments were empty.');\n  }\n  return {\n    version,\n    salt: fromBase64(saltB64),\n    iv: fromBase64(ivB64),\n    cipher: fromBase64(cipherB64),\n  };\n}\n","/**\n * Resolve a SubtleCrypto implementation across environments:\n *\n * - Browser / Deno / Bun / Node 20+: `globalThis.crypto.subtle` is available.\n * - Older Node: fall back to `node:crypto`'s `webcrypto`.\n */\nexport async function getSubtle(): Promise<SubtleCrypto> {\n  if (globalThis.crypto?.subtle) return globalThis.crypto.subtle;\n  const { webcrypto } = await import('node:crypto');\n  return webcrypto.subtle as unknown as SubtleCrypto;\n}\n\n/** Fill the given buffer with cryptographically strong random bytes. */\nexport function getRandomBytes(length: number): Uint8Array<ArrayBuffer> {\n  const out = new Uint8Array(length);\n  const c = globalThis.crypto;\n  if (c?.getRandomValues) {\n    c.getRandomValues(out);\n    return out;\n  }\n  throw new Error(\n    '[nuxt-crypto] globalThis.crypto.getRandomValues is not available. Upgrade your runtime.'\n  );\n}\n","import { aesGcmPbkdf2 } from './algorithms/aes-gcm';\nimport { KeyCache } from './key-cache';\nimport { encodePayload, parsePayload } from './payload';\nimport { getRandomBytes, getSubtle } from './subtle';\nimport type { CryptoAlgorithm, CryptoService, CryptoServiceConfig } from './types';\n\nconst DEFAULT_ITERATIONS = 100_000;\nconst DEFAULT_CACHE = 64;\nconst SALT_BYTES = 16;\n\n/**\n * Create a framework-agnostic `CryptoService` from a passphrase.\n *\n * Uses AES-256-GCM with PBKDF2-SHA256 (100k iterations by default). Pass a\n * different `algorithm` to plug in another cipher while preserving the same\n * versioned payload envelope.\n */\nexport async function createCryptoService(config: CryptoServiceConfig): Promise<CryptoService> {\n  if (!config.passphrase) {\n    throw new Error('[nuxt-crypto] passphrase is required.');\n  }\n\n  const iterations = config.iterations ?? DEFAULT_ITERATIONS;\n  const algorithm: CryptoAlgorithm = config.algorithm ?? aesGcmPbkdf2;\n  const subtle = config.subtle ?? (await getSubtle());\n  const cache = new KeyCache(config.keyCacheSize ?? DEFAULT_CACHE);\n  const passphrase = String(config.passphrase).trim();\n  const encoder = new TextEncoder();\n  const decoder = new TextDecoder();\n\n  async function getDerivedKey(salt: Uint8Array<ArrayBuffer>): Promise<CryptoKey> {\n    const key = KeyCache.key(salt, iterations);\n    const cached = cache.get(key);\n    if (cached) return cached;\n    const pending = algorithm.deriveKey({ subtle, passphrase, salt, iterations });\n    cache.set(key, pending);\n    return pending;\n  }\n\n  return {\n    async encrypt(plainText: string): Promise<string> {\n      const salt = getRandomBytes(SALT_BYTES);\n      const key = await getDerivedKey(salt);\n      const encoded = encoder.encode(plainText);\n      const plainBytes = new Uint8Array(new ArrayBuffer(encoded.byteLength));\n      plainBytes.set(encoded);\n      const { cipher, iv } = await algorithm.encrypt({ subtle, key, plainText: plainBytes });\n      return encodePayload({ version: algorithm.version, salt, iv, cipher });\n    },\n\n    async decrypt(payload: string): Promise<string> {\n      const parsed = parsePayload(payload);\n      if (parsed.version !== algorithm.version) {\n        throw new Error(\n          `[nuxt-crypto] Unsupported payload version: ${parsed.version} (algorithm expects ${algorithm.version}).`\n        );\n      }\n      const key = await getDerivedKey(parsed.salt);\n      const plainBytes = await algorithm.decrypt({\n        subtle,\n        key,\n        cipher: parsed.cipher,\n        iv: parsed.iv,\n      });\n      return decoder.decode(plainBytes);\n    },\n\n    clearKeyCache(): void {\n      cache.clear();\n    },\n  };\n}\n"],"mappings":";AAMO,IAAM,eAAgC;AAAA,EAC3C,SAAS;AAAA,EAET,MAAM,UAAU,EAAE,QAAQ,YAAY,MAAM,WAAW,GAAG;AACxD,UAAM,cAAc,MAAM,OAAO;AAAA,MAC/B;AAAA,MACA,IAAI,YAAY,EAAE,OAAO,UAAU;AAAA,MACnC,EAAE,MAAM,SAAS;AAAA,MACjB;AAAA,MACA,CAAC,WAAW;AAAA,IACd;AAEA,WAAO,OAAO;AAAA,MACZ,EAAE,MAAM,UAAU,MAAM,YAAY,MAAM,UAAU;AAAA,MACpD;AAAA,MACA,EAAE,MAAM,WAAW,QAAQ,IAAI;AAAA,MAC/B;AAAA,MACA,CAAC,WAAW,SAAS;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,EAAE,QAAQ,KAAK,UAAU,GAAG;AACxC,UAAM,KAAK,IAAI,WAAW,IAAI,YAAY,EAAE,CAAC;AAC7C,eAAW,OAAO,gBAAgB,EAAE;AACpC,UAAM,MAAM,MAAM,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,SAAS;AACxE,UAAM,SAAS,IAAI,WAAW,IAAI,YAAY,IAAI,UAAU,CAAC;AAC7D,WAAO,IAAI,IAAI,WAAW,GAAG,CAAC;AAC9B,WAAO,EAAE,QAAQ,GAAG;AAAA,EACtB;AAAA,EAEA,MAAM,QAAQ,EAAE,QAAQ,KAAK,QAAQ,GAAG,GAAG;AACzC,UAAM,MAAM,MAAM,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,MAAM;AACrE,UAAM,MAAM,IAAI,WAAW,IAAI,YAAY,IAAI,UAAU,CAAC;AAC1D,QAAI,IAAI,IAAI,WAAW,GAAG,CAAC;AAC3B,WAAO;AAAA,EACT;AACF;;;ACvCO,SAAS,SAAS,MAAqB;AAC5C,MAAI,OAAO,SAAS,YAAY;AAC9B,QAAI,SAAS;AACb,UAAM,QAAQ;AACd,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,OAAO;AAC3C,gBAAU,OAAO,aAAa,GAAG,KAAK,SAAS,GAAG,IAAI,KAAK,CAAC;AAAA,IAC9D;AACA,WAAO,KAAK,MAAM;AAAA,EACpB;AAEA,SAAO,OAAO,KAAK,IAAI,EAAE,SAAS,QAAQ;AAC5C;AAGO,SAAS,WAAW,OAAsB;AAC/C,MAAI,OAAO,SAAS,YAAY;AAC9B,UAAM,SAAS,KAAK,KAAK;AACzB,UAAMA,OAAM,IAAI,WAAW,OAAO,MAAM;AACxC,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,IAAK,CAAAA,KAAI,CAAC,IAAI,OAAO,WAAW,CAAC;AACpE,WAAOA;AAAA,EACT;AACA,QAAM,MAAM,OAAO,KAAK,OAAO,QAAQ;AACvC,QAAM,MAAM,IAAI,WAAW,IAAI,MAAM;AACrC,MAAI,IAAI,GAAG;AACX,SAAO;AACT;;;ACnBO,IAAM,WAAN,MAAe;AAAA,EAEpB,YAA6B,UAAkB;AAAlB;AAAA,EAAmB;AAAA,EAAnB;AAAA,EADZ,MAAM,oBAAI,IAAgC;AAAA,EAG3D,OAAO,IAAI,MAAa,YAA4B;AAClD,WAAO,GAAG,UAAU,IAAI,SAAS,IAAI,CAAC;AAAA,EACxC;AAAA,EAEA,IAAI,KAA6C;AAC/C,UAAM,QAAQ,KAAK,IAAI,IAAI,GAAG;AAC9B,QAAI,CAAC,MAAO,QAAO;AAEnB,SAAK,IAAI,OAAO,GAAG;AACnB,SAAK,IAAI,IAAI,KAAK,KAAK;AACvB,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,KAAa,OAAiC;AAChD,QAAI,KAAK,YAAY,EAAG;AACxB,SAAK,IAAI,IAAI,KAAK,KAAK;AACvB,WAAO,KAAK,IAAI,OAAO,KAAK,UAAU;AACpC,YAAM,SAAS,KAAK,IAAI,KAAK,EAAE,KAAK,EAAE;AACtC,UAAI,WAAW,OAAW;AAC1B,WAAK,IAAI,OAAO,MAAM;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,QAAc;AACZ,SAAK,IAAI,MAAM;AAAA,EACjB;AACF;;;ACtBO,SAAS,cAAc,OAA8B;AAC1D,SAAO,CAAC,MAAM,SAAS,SAAS,MAAM,IAAI,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,MAAM,CAAC,EAAE;AAAA,IACvF;AAAA,EACF;AACF;AAEO,SAAS,aAAa,SAAgC;AAC3D,QAAM,WAAW,QAAQ,MAAM,GAAG;AAClC,MAAI,SAAS,WAAW,GAAG;AACzB,UAAM,IAAI,MAAM,gFAA2E;AAAA,EAC7F;AACA,QAAM,CAAC,SAAS,SAAS,OAAO,SAAS,IAAI;AAC7C,MAAI,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,WAAW;AAChD,UAAM,IAAI,MAAM,8EAAyE;AAAA,EAC3F;AACA,SAAO;AAAA,IACL;AAAA,IACA,MAAM,WAAW,OAAO;AAAA,IACxB,IAAI,WAAW,KAAK;AAAA,IACpB,QAAQ,WAAW,SAAS;AAAA,EAC9B;AACF;;;AChCA,eAAsB,YAAmC;AACvD,MAAI,WAAW,QAAQ,OAAQ,QAAO,WAAW,OAAO;AACxD,QAAM,EAAE,UAAU,IAAI,MAAM,OAAO,QAAa;AAChD,SAAO,UAAU;AACnB;AAGO,SAAS,eAAe,QAAyC;AACtE,QAAM,MAAM,IAAI,WAAW,MAAM;AACjC,QAAM,IAAI,WAAW;AACrB,MAAI,GAAG,iBAAiB;AACtB,MAAE,gBAAgB,GAAG;AACrB,WAAO;AAAA,EACT;AACA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;;;ACjBA,IAAM,qBAAqB;AAC3B,IAAM,gBAAgB;AACtB,IAAM,aAAa;AASnB,eAAsB,oBAAoB,QAAqD;AAC7F,MAAI,CAAC,OAAO,YAAY;AACtB,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAEA,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,YAA6B,OAAO,aAAa;AACvD,QAAM,SAAS,OAAO,UAAW,MAAM,UAAU;AACjD,QAAM,QAAQ,IAAI,SAAS,OAAO,gBAAgB,aAAa;AAC/D,QAAM,aAAa,OAAO,OAAO,UAAU,EAAE,KAAK;AAClD,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,UAAU,IAAI,YAAY;AAEhC,iBAAe,cAAc,MAAmD;AAC9E,UAAM,MAAM,SAAS,IAAI,MAAM,UAAU;AACzC,UAAM,SAAS,MAAM,IAAI,GAAG;AAC5B,QAAI,OAAQ,QAAO;AACnB,UAAM,UAAU,UAAU,UAAU,EAAE,QAAQ,YAAY,MAAM,WAAW,CAAC;AAC5E,UAAM,IAAI,KAAK,OAAO;AACtB,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,MAAM,QAAQ,WAAoC;AAChD,YAAM,OAAO,eAAe,UAAU;AACtC,YAAM,MAAM,MAAM,cAAc,IAAI;AACpC,YAAM,UAAU,QAAQ,OAAO,SAAS;AACxC,YAAM,aAAa,IAAI,WAAW,IAAI,YAAY,QAAQ,UAAU,CAAC;AACrE,iBAAW,IAAI,OAAO;AACtB,YAAM,EAAE,QAAQ,GAAG,IAAI,MAAM,UAAU,QAAQ,EAAE,QAAQ,KAAK,WAAW,WAAW,CAAC;AACrF,aAAO,cAAc,EAAE,SAAS,UAAU,SAAS,MAAM,IAAI,OAAO,CAAC;AAAA,IACvE;AAAA,IAEA,MAAM,QAAQ,SAAkC;AAC9C,YAAM,SAAS,aAAa,OAAO;AACnC,UAAI,OAAO,YAAY,UAAU,SAAS;AACxC,cAAM,IAAI;AAAA,UACR,8CAA8C,OAAO,OAAO,uBAAuB,UAAU,OAAO;AAAA,QACtG;AAAA,MACF;AACA,YAAM,MAAM,MAAM,cAAc,OAAO,IAAI;AAC3C,YAAM,aAAa,MAAM,UAAU,QAAQ;AAAA,QACzC;AAAA,QACA;AAAA,QACA,QAAQ,OAAO;AAAA,QACf,IAAI,OAAO;AAAA,MACb,CAAC;AACD,aAAO,QAAQ,OAAO,UAAU;AAAA,IAClC;AAAA,IAEA,gBAAsB;AACpB,YAAM,MAAM;AAAA,IACd;AAAA,EACF;AACF;","names":["out"]}

package/dist/core/index.d.ts

@@ -0,0 +1,50 @@
+import { b as CryptoServiceConfig, a as CryptoService, C as CryptoAlgorithm, B as Bytes } from '../payload-Cht5Ar0K.js';
+export { P as ParsedPayload, e as encodePayload, p as parsePayload } from '../payload-Cht5Ar0K.js';
+
+/**
+ * Create a framework-agnostic `CryptoService` from a passphrase.
+ *
+ * Uses AES-256-GCM with PBKDF2-SHA256 (100k iterations by default). Pass a
+ * different `algorithm` to plug in another cipher while preserving the same
+ * versioned payload envelope.
+ */
+declare function createCryptoService(config: CryptoServiceConfig): Promise<CryptoService>;
+
+/**
+ * AES-256-GCM with PBKDF2-SHA256 key derivation. This is the default and
+ * currently the only built-in algorithm; pluggable via `CryptoServiceConfig.algorithm`.
+ */
+declare const aesGcmPbkdf2: CryptoAlgorithm;
+
+/**
+ * Resolve a SubtleCrypto implementation across environments:
+ *
+ * - Browser / Deno / Bun / Node 20+: `globalThis.crypto.subtle` is available.
+ * - Older Node: fall back to `node:crypto`'s `webcrypto`.
+ */
+declare function getSubtle(): Promise<SubtleCrypto>;
+/** Fill the given buffer with cryptographically strong random bytes. */
+declare function getRandomBytes(length: number): Uint8Array<ArrayBuffer>;
+
+/** Encode bytes to standard base64. Works in browser and Node. */
+declare function toBase64(data: Bytes): string;
+/** Decode a base64 string back to bytes. Works in browser and Node. */
+declare function fromBase64(input: string): Bytes;
+
+/**
+ * A tiny LRU-ish cache for derived `CryptoKey` values, keyed on the salt.
+ * When capacity is exceeded the oldest entry is evicted. Derived key
+ * material is expensive (PBKDF2 is designed to be slow), so caching has
+ * a big impact when decrypting many payloads in a row.
+ */
+declare class KeyCache {
+    private readonly capacity;
+    private readonly map;
+    constructor(capacity: number);
+    static key(salt: Bytes, iterations: number): string;
+    get(key: string): Promise<CryptoKey> | undefined;
+    set(key: string, value: Promise<CryptoKey>): void;
+    clear(): void;
+}
+
+export { Bytes, CryptoAlgorithm, CryptoService, CryptoServiceConfig, KeyCache, aesGcmPbkdf2, createCryptoService, fromBase64, getRandomBytes, getSubtle, toBase64 };

package/dist/core/index.mjs

@@ -0,0 +1,23 @@
+import {
+  KeyCache,
+  aesGcmPbkdf2,
+  createCryptoService,
+  encodePayload,
+  fromBase64,
+  getRandomBytes,
+  getSubtle,
+  parsePayload,
+  toBase64
+} from "../chunk-HNTEUBQ7.mjs";
+export {
+  KeyCache,
+  aesGcmPbkdf2,
+  createCryptoService,
+  encodePayload,
+  fromBase64,
+  getRandomBytes,
+  getSubtle,
+  parsePayload,
+  toBase64
+};
+//# sourceMappingURL=index.mjs.map

package/dist/core/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/module.d.ts

@@ -0,0 +1,7 @@
+import { NuxtModule } from '@nuxt/schema';
+import { CryptoModuleOptions } from './types/index.js';
+export { B as Bytes, C as CryptoAlgorithm, a as CryptoService, b as CryptoServiceConfig, P as ParsedPayload } from './payload-Cht5Ar0K.js';
+
+declare const cryptoModule: NuxtModule<CryptoModuleOptions>;
+
+export { CryptoModuleOptions, cryptoModule as default };

package/dist/module.mjs

@@ -0,0 +1,89 @@
+import "./chunk-EFZPSZWO.mjs";
+
+// src/module.ts
+import { addPlugin, addTemplate, createResolver, defineNuxtModule } from "@nuxt/kit";
+
+// src/templates/config.template.ts
+function createConfigTemplateContents(params) {
+  const { options, normalizedProvideName } = params;
+  const cfg = {
+    passphrase: options.passphrase,
+    iterations: options.iterations ?? 1e5,
+    keyCacheSize: options.keyCacheSize ?? 64,
+    provideName: normalizedProvideName
+  };
+  return `export default ${JSON.stringify(cfg)};
+`;
+}
+
+// src/templates/types.template.ts
+function createTypesTemplateContents(params) {
+  const { typesEntryPath, normalizedProvideName } = params;
+  return `// Auto-generated by @alikhalilll/nuxt-crypto
+import type { CryptoService } from '${typesEntryPath}';
+
+declare module '#app' {
+  interface NuxtApp {
+    $${normalizedProvideName}: CryptoService;
+  }
+}
+
+declare module 'vue' {
+  interface ComponentCustomProperties {
+    $${normalizedProvideName}: CryptoService;
+  }
+}
+
+export {};
+`;
+}
+
+// src/utils/normalize-provide-name.ts
+function normalizeProvideName(provideName, fallback) {
+  const name = (provideName ?? fallback).trim();
+  const stripped = name.startsWith("$") ? name.slice(1) : name;
+  return stripped || fallback;
+}
+
+// src/module.ts
+var cryptoModule = defineNuxtModule({
+  meta: {
+    name: "@alikhalilll/nuxt-crypto",
+    configKey: "crypto",
+    compatibility: { nuxt: ">=3.0.0" }
+  },
+  defaults: {
+    passphrase: "",
+    provideName: "$crypto",
+    iterations: 1e5,
+    keyCacheSize: 64,
+    serverOnly: false
+  },
+  setup(options, nuxt) {
+    const resolver = createResolver(import.meta.url);
+    const normalizedProvideName = normalizeProvideName(options.provideName, "crypto");
+    addTemplate({
+      filename: "crypto-config.mjs",
+      getContents: () => createConfigTemplateContents({ options, normalizedProvideName })
+    });
+    const typesTemplate = addTemplate({
+      filename: "types/crypto.d.ts",
+      getContents: () => createTypesTemplateContents({
+        typesEntryPath: resolver.resolve("./types/index"),
+        normalizedProvideName
+      })
+    });
+    addPlugin({
+      mode: options.serverOnly ? "server" : "all",
+      src: resolver.resolve("./runtime/plugin")
+    });
+    nuxt.hook("prepare:types", ({ references }) => {
+      references.push({ path: typesTemplate.dst });
+    });
+  }
+});
+var module_default = cryptoModule;
+export {
+  module_default as default
+};
+//# sourceMappingURL=module.mjs.map

package/dist/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/module.ts","../src/templates/config.template.ts","../src/templates/types.template.ts","../src/utils/normalize-provide-name.ts"],"sourcesContent":["import { addPlugin, addTemplate, createResolver, defineNuxtModule } from '@nuxt/kit';\nimport type { NuxtModule } from '@nuxt/schema';\n\nimport { createConfigTemplateContents } from './templates/config.template';\nimport { createTypesTemplateContents } from './templates/types.template';\nimport type { CryptoModuleOptions } from './types/module-options';\nimport { normalizeProvideName } from './utils/normalize-provide-name';\n\nexport * from './types';\n\nconst cryptoModule: NuxtModule<CryptoModuleOptions> = defineNuxtModule<CryptoModuleOptions>({\n  meta: {\n    name: '@alikhalilll/nuxt-crypto',\n    configKey: 'crypto',\n    compatibility: { nuxt: '>=3.0.0' },\n  },\n  defaults: {\n    passphrase: '',\n    provideName: '$crypto',\n    iterations: 100_000,\n    keyCacheSize: 64,\n    serverOnly: false,\n  },\n  setup(options, nuxt) {\n    const resolver = createResolver(import.meta.url);\n    const normalizedProvideName = normalizeProvideName(options.provideName, 'crypto');\n\n    addTemplate({\n      filename: 'crypto-config.mjs',\n      getContents: () => createConfigTemplateContents({ options, normalizedProvideName }),\n    });\n\n    const typesTemplate = addTemplate({\n      filename: 'types/crypto.d.ts',\n      getContents: () =>\n        createTypesTemplateContents({\n          typesEntryPath: resolver.resolve('./types/index'),\n          normalizedProvideName,\n        }),\n    });\n\n    addPlugin({\n      mode: options.serverOnly ? 'server' : 'all',\n      src: resolver.resolve('./runtime/plugin'),\n    });\n\n    nuxt.hook('prepare:types', ({ references }) => {\n      references.push({ path: typesTemplate.dst });\n    });\n  },\n});\n\nexport default cryptoModule;\n","import type { CryptoModuleOptions } from '../types/module-options';\n\nexport interface ResolvedCryptoConfig {\n  passphrase: string;\n  iterations: number;\n  keyCacheSize: number;\n  provideName: string;\n}\n\nexport function createConfigTemplateContents(params: {\n  options: CryptoModuleOptions;\n  normalizedProvideName: string;\n}): string {\n  const { options, normalizedProvideName } = params;\n  const cfg: ResolvedCryptoConfig = {\n    passphrase: options.passphrase,\n    iterations: options.iterations ?? 100_000,\n    keyCacheSize: options.keyCacheSize ?? 64,\n    provideName: normalizedProvideName,\n  };\n  return `export default ${JSON.stringify(cfg)};\\n`;\n}\n","export function createTypesTemplateContents(params: {\n  typesEntryPath: string;\n  normalizedProvideName: string;\n}): string {\n  const { typesEntryPath, normalizedProvideName } = params;\n\n  return `// Auto-generated by @alikhalilll/nuxt-crypto\nimport type { CryptoService } from '${typesEntryPath}';\n\ndeclare module '#app' {\n  interface NuxtApp {\n    $${normalizedProvideName}: CryptoService;\n  }\n}\n\ndeclare module 'vue' {\n  interface ComponentCustomProperties {\n    $${normalizedProvideName}: CryptoService;\n  }\n}\n\nexport {};\n`;\n}\n","export function normalizeProvideName(provideName: string | undefined, fallback: string): string {\n  const name = (provideName ?? fallback).trim();\n  const stripped = name.startsWith('$') ? name.slice(1) : name;\n  return stripped || fallback;\n}\n"],"mappings":";;;AAAA,SAAS,WAAW,aAAa,gBAAgB,wBAAwB;;;ACSlE,SAAS,6BAA6B,QAGlC;AACT,QAAM,EAAE,SAAS,sBAAsB,IAAI;AAC3C,QAAM,MAA4B;AAAA,IAChC,YAAY,QAAQ;AAAA,IACpB,YAAY,QAAQ,cAAc;AAAA,IAClC,cAAc,QAAQ,gBAAgB;AAAA,IACtC,aAAa;AAAA,EACf;AACA,SAAO,kBAAkB,KAAK,UAAU,GAAG,CAAC;AAAA;AAC9C;;;ACrBO,SAAS,4BAA4B,QAGjC;AACT,QAAM,EAAE,gBAAgB,sBAAsB,IAAI;AAElD,SAAO;AAAA,sCAC6B,cAAc;AAAA;AAAA;AAAA;AAAA,OAI7C,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,OAMrB,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAM5B;;;ACvBO,SAAS,qBAAqB,aAAiC,UAA0B;AAC9F,QAAM,QAAQ,eAAe,UAAU,KAAK;AAC5C,QAAM,WAAW,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI;AACxD,SAAO,YAAY;AACrB;;;AHMA,IAAM,eAAgD,iBAAsC;AAAA,EAC1F,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,WAAW;AAAA,IACX,eAAe,EAAE,MAAM,UAAU;AAAA,EACnC;AAAA,EACA,UAAU;AAAA,IACR,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,YAAY;AAAA,EACd;AAAA,EACA,MAAM,SAAS,MAAM;AACnB,UAAM,WAAW,eAAe,YAAY,GAAG;AAC/C,UAAM,wBAAwB,qBAAqB,QAAQ,aAAa,QAAQ;AAEhF,gBAAY;AAAA,MACV,UAAU;AAAA,MACV,aAAa,MAAM,6BAA6B,EAAE,SAAS,sBAAsB,CAAC;AAAA,IACpF,CAAC;AAED,UAAM,gBAAgB,YAAY;AAAA,MAChC,UAAU;AAAA,MACV,aAAa,MACX,4BAA4B;AAAA,QAC1B,gBAAgB,SAAS,QAAQ,eAAe;AAAA,QAChD;AAAA,MACF,CAAC;AAAA,IACL,CAAC;AAED,cAAU;AAAA,MACR,MAAM,QAAQ,aAAa,WAAW;AAAA,MACtC,KAAK,SAAS,QAAQ,kBAAkB;AAAA,IAC1C,CAAC;AAED,SAAK,KAAK,iBAAiB,CAAC,EAAE,WAAW,MAAM;AAC7C,iBAAW,KAAK,EAAE,MAAM,cAAc,IAAI,CAAC;AAAA,IAC7C,CAAC;AAAA,EACH;AACF,CAAC;AAED,IAAO,iBAAQ;","names":[]}

package/dist/payload-Cht5Ar0K.d.ts

@@ -0,0 +1,85 @@
+/** Shorthand for the `Uint8Array` we use everywhere in the crypto package. */
+type Bytes = Uint8Array<ArrayBuffer>;
+/**
+ * A CryptoService encrypts plaintext to a serialisable string payload and
+ * decrypts it back. Every operation is async because it hits the Web Crypto
+ * subtle API.
+ */
+interface CryptoService {
+    /** Encrypt a UTF-8 string to a versioned, base64-encoded payload. */
+    encrypt(plainText: string): Promise<string>;
+    /** Decrypt a payload produced by `encrypt`. */
+    decrypt(payload: string): Promise<string>;
+    /** Clear any cached derived keys. Safe to call at any time. */
+    clearKeyCache(): void;
+}
+/** Config for `createCryptoService`. */
+interface CryptoServiceConfig {
+    /** Passphrase used to derive the symmetric key. */
+    passphrase: string;
+    /** PBKDF2 iteration count. Default 100_000. */
+    iterations?: number;
+    /**
+     * Algorithm implementation. Defaults to AES-256-GCM with PBKDF2-SHA256 key
+     * derivation. Replace to plug in a different cipher.
+     */
+    algorithm?: CryptoAlgorithm;
+    /**
+     * Max number of derived keys held in memory. Derived keys are expensive —
+     * caching them by salt dramatically speeds up bulk decrypt. Default 64.
+     * Set to 0 to disable caching.
+     */
+    keyCacheSize?: number;
+    /** Override the SubtleCrypto implementation. Useful for testing. */
+    subtle?: SubtleCrypto;
+}
+/**
+ * A pluggable symmetric-encryption algorithm. Each implementation owns the
+ * payload format (via its version tag), key derivation, and the actual
+ * encrypt/decrypt work.
+ */
+interface CryptoAlgorithm {
+    /** Short identifier stored as the first segment of every payload (e.g. `'v1'`). */
+    readonly version: string;
+    /** Derive a CryptoKey from a passphrase + salt pair. Expected to be idempotent. */
+    deriveKey(args: {
+        subtle: SubtleCrypto;
+        passphrase: string;
+        salt: Bytes;
+        iterations: number;
+    }): Promise<CryptoKey>;
+    /** Encrypt plaintext bytes using a pre-derived key. Returns cipher bytes + any per-call params (e.g. IV). */
+    encrypt(args: {
+        subtle: SubtleCrypto;
+        key: CryptoKey;
+        plainText: Bytes;
+    }): Promise<{
+        cipher: Bytes;
+        iv: Bytes;
+    }>;
+    /** Decrypt cipher bytes using a pre-derived key and the IV produced during encrypt. */
+    decrypt(args: {
+        subtle: SubtleCrypto;
+        key: CryptoKey;
+        cipher: Bytes;
+        iv: Bytes;
+    }): Promise<Bytes>;
+}
+
+/**
+ * Payload serialisation format (v1): `${version}.${saltB64}.${ivB64}.${cipherB64}`.
+ *
+ * Each part is URL-safe base64, all joined with `.`. The version tag is
+ * always the first segment so consumers can route to the correct algorithm
+ * during decrypt.
+ */
+interface ParsedPayload {
+    version: string;
+    salt: Bytes;
+    iv: Bytes;
+    cipher: Bytes;
+}
+declare function encodePayload(parts: ParsedPayload): string;
+declare function parsePayload(payload: string): ParsedPayload;
+
+export { type Bytes as B, type CryptoAlgorithm as C, type ParsedPayload as P, type CryptoService as a, type CryptoServiceConfig as b, encodePayload as e, parsePayload as p };

package/dist/runtime/plugin.mjs

@@ -0,0 +1,29 @@
+import {
+  createCryptoService
+} from "../chunk-HNTEUBQ7.mjs";
+
+// src/runtime/plugin.ts
+import { defineNuxtPlugin } from "#app";
+import config from "#build/crypto-config.mjs";
+var plugin_default = defineNuxtPlugin(async () => {
+  const { passphrase, iterations, keyCacheSize, provideName } = config;
+  if (!passphrase && import.meta.dev) {
+    console.warn(
+      `[@alikhalilll/nuxt-crypto] Missing passphrase \u2014 $${provideName} will throw when used.`
+    );
+  }
+  const service = await createCryptoService({
+    passphrase: String(passphrase).trim(),
+    iterations,
+    keyCacheSize
+  });
+  return {
+    provide: {
+      [provideName]: service
+    }
+  };
+});
+export {
+  plugin_default as default
+};
+//# sourceMappingURL=plugin.mjs.map

package/dist/runtime/plugin.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/runtime/plugin.ts"],"sourcesContent":["import { defineNuxtPlugin } from '#app';\nimport config from '#build/crypto-config.mjs';\n\nimport { createCryptoService } from '../core/create-service';\n\nexport default defineNuxtPlugin(async () => {\n  const { passphrase, iterations, keyCacheSize, provideName } = config;\n\n  if (!passphrase && (import.meta as ImportMeta & { dev?: boolean }).dev) {\n    // eslint-disable-next-line no-console\n    console.warn(\n      `[@alikhalilll/nuxt-crypto] Missing passphrase — $${provideName} will throw when used.`\n    );\n  }\n\n  const service = await createCryptoService({\n    passphrase: String(passphrase).trim(),\n    iterations,\n    keyCacheSize,\n  });\n\n  return {\n    provide: {\n      [provideName]: service,\n    },\n  };\n});\n"],"mappings":";;;;;AAAA,SAAS,wBAAwB;AACjC,OAAO,YAAY;AAInB,IAAO,iBAAQ,iBAAiB,YAAY;AAC1C,QAAM,EAAE,YAAY,YAAY,cAAc,YAAY,IAAI;AAE9D,MAAI,CAAC,cAAe,YAA+C,KAAK;AAEtE,YAAQ;AAAA,MACN,yDAAoD,WAAW;AAAA,IACjE;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,oBAAoB;AAAA,IACxC,YAAY,OAAO,UAAU,EAAE,KAAK;AAAA,IACpC;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,SAAS;AAAA,MACP,CAAC,WAAW,GAAG;AAAA,IACjB;AAAA,EACF;AACF,CAAC;","names":[]}

package/dist/types/index.d.ts

@@ -0,0 +1,30 @@
+export { B as Bytes, C as CryptoAlgorithm, a as CryptoService, b as CryptoServiceConfig, P as ParsedPayload } from '../payload-Cht5Ar0K.js';
+
+interface CryptoModuleOptions {
+    /**
+     * Passphrase used to derive the AES key. Prefer wiring this from a
+     * runtime config env var (e.g. `NUXT_ENCRYPTION_PASSPHRASE`) rather than
+     * committing it.
+     */
+    passphrase: string;
+    /**
+     * Name under which the service is provided. Accepts `$crypto` or `crypto`
+     * — the leading `$` is stripped. Default: `$crypto`.
+     */
+    provideName?: string;
+    /** PBKDF2 iterations. Default 100_000. */
+    iterations?: number;
+    /**
+     * Max number of derived keys held in memory. Default 64. Set to 0 to
+     * disable caching.
+     */
+    keyCacheSize?: number;
+    /**
+     * When `true`, the runtime plugin is only registered on the server. Useful
+     * when you do not want the plaintext passphrase shipped to the browser.
+     * Default: `false`.
+     */
+    serverOnly?: boolean;
+}
+
+export type { CryptoModuleOptions };

package/dist/types/index.mjs

@@ -0,0 +1,2 @@
+import "../chunk-EFZPSZWO.mjs";
+//# sourceMappingURL=index.mjs.map

package/dist/types/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/package.json

@@ -0,0 +1,75 @@
+{
+  "name": "@alikhalilll/nuxt-crypto",
+  "version": "1.0.0",
+  "description": "Symmetric Web Crypto service for Nuxt 3/4. AES-256-GCM + PBKDF2 with key caching and pluggable algorithms.",
+  "license": "MIT",
+  "author": "alikhalilll",
+  "type": "module",
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "nuxt",
+    "nuxt-module",
+    "crypto",
+    "encryption",
+    "aes-gcm",
+    "web-crypto",
+    "pbkdf2"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/module.d.ts",
+      "import": "./dist/module.mjs"
+    },
+    "./core": {
+      "types": "./dist/core/index.d.ts",
+      "import": "./dist/core/index.mjs"
+    },
+    "./types": {
+      "types": "./dist/types/index.d.ts",
+      "import": "./dist/types/index.mjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "types": "./dist/module.d.ts",
+  "typesVersions": {
+    "*": {
+      ".": [
+        "./dist/module.d.ts"
+      ],
+      "core": [
+        "./dist/core/index.d.ts"
+      ],
+      "types": [
+        "./dist/types/index.d.ts"
+      ]
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "peerDependencies": {
+    "@nuxt/kit": "^3.0.0 || ^4.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@nuxt/kit": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@nuxt/kit": "^4.0.0",
+    "@nuxt/schema": "^4.0.0",
+    "@types/node": "^22.13.0",
+    "rimraf": "^6.0.1",
+    "tsup": "^8.5.0",
+    "typescript": "^5.9.2"
+  },
+  "scripts": {
+    "clean": "rimraf dist",
+    "build": "pnpm clean && tsup",
+    "typecheck": "tsc --noEmit -p tsconfig.json"
+  }
+}