@alikhalilll/nuxt-crypto 1.2.0 → 1.3.0

package/dist/chunk-FKXZ7VYW.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/core/base64.ts","../src/core/subtle.ts"],"sourcesContent":["import type { Bytes } from './types';\n\n/** Encode bytes to standard base64. Works in browser and Node. */\nexport function toBase64(data: Bytes): string {\n  if (typeof btoa === 'function') {\n    let binary = '';\n    const CHUNK = 0x8000;\n    for (let i = 0; i < data.length; i += CHUNK) {\n      binary += String.fromCharCode(...data.subarray(i, i + CHUNK));\n    }\n    return btoa(binary);\n  }\n  // Node fallback — Buffer is globally available in Node.\n  return Buffer.from(data).toString('base64');\n}\n\n/** Decode a base64 string back to bytes. Works in browser and Node. */\nexport function fromBase64(input: string): Bytes {\n  if (typeof atob === 'function') {\n    const binary = atob(input);\n    const out = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);\n    return out;\n  }\n  const buf = Buffer.from(input, 'base64');\n  const out = new Uint8Array(buf.length);\n  out.set(buf);\n  return out;\n}\n","/**\n * Resolve a SubtleCrypto implementation across environments:\n *\n * - Browser / Deno / Bun / Node 20+: `globalThis.crypto.subtle` is available.\n * - Older Node: fall back to `node:crypto`'s `webcrypto`.\n */\nexport async function getSubtle(): Promise<SubtleCrypto> {\n  if (globalThis.crypto?.subtle) return globalThis.crypto.subtle;\n  const { webcrypto } = await import('node:crypto');\n  return webcrypto.subtle as unknown as SubtleCrypto;\n}\n\n/** Fill the given buffer with cryptographically strong random bytes. */\nexport function getRandomBytes(length: number): Uint8Array<ArrayBuffer> {\n  const out = new Uint8Array(length);\n  const c = globalThis.crypto;\n  if (c?.getRandomValues) {\n    c.getRandomValues(out);\n    return out;\n  }\n  throw new Error(\n    '[nuxt-crypto] globalThis.crypto.getRandomValues is not available. Upgrade your runtime.'\n  );\n}\n"],"mappings":";AAGO,SAAS,SAAS,MAAqB;AAC5C,MAAI,OAAO,SAAS,YAAY;AAC9B,QAAI,SAAS;AACb,UAAM,QAAQ;AACd,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,OAAO;AAC3C,gBAAU,OAAO,aAAa,GAAG,KAAK,SAAS,GAAG,IAAI,KAAK,CAAC;AAAA,IAC9D;AACA,WAAO,KAAK,MAAM;AAAA,EACpB;AAEA,SAAO,OAAO,KAAK,IAAI,EAAE,SAAS,QAAQ;AAC5C;AAGO,SAAS,WAAW,OAAsB;AAC/C,MAAI,OAAO,SAAS,YAAY;AAC9B,UAAM,SAAS,KAAK,KAAK;AACzB,UAAMA,OAAM,IAAI,WAAW,OAAO,MAAM;AACxC,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,IAAK,CAAAA,KAAI,CAAC,IAAI,OAAO,WAAW,CAAC;AACpE,WAAOA;AAAA,EACT;AACA,QAAM,MAAM,OAAO,KAAK,OAAO,QAAQ;AACvC,QAAM,MAAM,IAAI,WAAW,IAAI,MAAM;AACrC,MAAI,IAAI,GAAG;AACX,SAAO;AACT;;;ACtBA,eAAsB,YAAmC;AACvD,MAAI,WAAW,QAAQ,OAAQ,QAAO,WAAW,OAAO;AACxD,QAAM,EAAE,UAAU,IAAI,MAAM,OAAO,QAAa;AAChD,SAAO,UAAU;AACnB;AAGO,SAAS,eAAe,QAAyC;AACtE,QAAM,MAAM,IAAI,WAAW,MAAM;AACjC,QAAM,IAAI,WAAW;AACrB,MAAI,GAAG,iBAAiB;AACtB,MAAE,gBAAgB,GAAG;AACrB,WAAO;AAAA,EACT;AACA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;","names":["out"]}

package/dist/core/index.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/payload-BOueSWcI.d.ts

@@ -1,108 +0,0 @@
-/** Shorthand for the `Uint8Array` we use everywhere in the crypto package. */
-type Bytes = Uint8Array<ArrayBuffer>;
-/**
- * Options accepted by `encrypt` / `decrypt`. Both calls must receive the
- * same `fingerprint` value to round-trip; passing different fingerprints
- * produces undecryptable ciphertext.
- */
-interface CryptoOperationOptions {
-    /**
-     * Optional extra key material mixed into the PBKDF2 input. Typically a
-     * device fingerprint produced server-side from an HttpOnly device-ID
-     * cookie via `getClientFingerprint()` from `@alikhalilll/nuxt-crypto/server`.
-     *
-     * ⚠️ Binding ciphertext to a fingerprint means the payload becomes
-     * undecryptable the moment the device cookie is cleared. Use only for
-     * ephemeral tokens (short-lived session cookies, one-time links), never
-     * for long-lived user data.
-     */
-    fingerprint?: string;
-}
-/**
- * A CryptoService encrypts plaintext to a serialisable string payload and
- * decrypts it back. Every operation is async because it hits the Web Crypto
- * subtle API.
- */
-interface CryptoService {
-    /** Encrypt a UTF-8 string to a versioned, base64-encoded payload. */
-    encrypt(plainText: string, options?: CryptoOperationOptions): Promise<string>;
-    /** Decrypt a payload produced by `encrypt`. Pass the same `fingerprint` used at encrypt time, if any. */
-    decrypt(payload: string, options?: CryptoOperationOptions): Promise<string>;
-    /** Clear any cached derived keys. Safe to call at any time. */
-    clearKeyCache(): void;
-}
-/** Config for `createCryptoService`. */
-interface CryptoServiceConfig {
-    /** Passphrase used to derive the symmetric key. */
-    passphrase: string;
-    /** PBKDF2 iteration count. Default 100_000. */
-    iterations?: number;
-    /**
-     * Algorithm implementation. Defaults to AES-256-GCM with PBKDF2-SHA256 key
-     * derivation. Replace to plug in a different cipher.
-     */
-    algorithm?: CryptoAlgorithm;
-    /**
-     * Max number of derived keys held in memory. Derived keys are expensive —
-     * caching them by salt dramatically speeds up bulk decrypt. Default 64.
-     * Set to 0 to disable caching.
-     */
-    keyCacheSize?: number;
-    /** Override the SubtleCrypto implementation. Useful for testing. */
-    subtle?: SubtleCrypto;
-}
-/**
- * A pluggable symmetric-encryption algorithm. Each implementation owns the
- * payload format (via its version tag), key derivation, and the actual
- * encrypt/decrypt work.
- */
-interface CryptoAlgorithm {
-    /** Short identifier stored as the first segment of every payload (e.g. `'v1'`). */
-    readonly version: string;
-    /**
-     * Derive a CryptoKey from a passphrase + salt pair. Expected to be idempotent.
-     * When `fingerprint` is provided it is mixed into the key-derivation input
-     * (alongside the passphrase) so ciphertext becomes bound to that fingerprint.
-     */
-    deriveKey(args: {
-        subtle: SubtleCrypto;
-        passphrase: string;
-        fingerprint?: string;
-        salt: Bytes;
-        iterations: number;
-    }): Promise<CryptoKey>;
-    /** Encrypt plaintext bytes using a pre-derived key. Returns cipher bytes + any per-call params (e.g. IV). */
-    encrypt(args: {
-        subtle: SubtleCrypto;
-        key: CryptoKey;
-        plainText: Bytes;
-    }): Promise<{
-        cipher: Bytes;
-        iv: Bytes;
-    }>;
-    /** Decrypt cipher bytes using a pre-derived key and the IV produced during encrypt. */
-    decrypt(args: {
-        subtle: SubtleCrypto;
-        key: CryptoKey;
-        cipher: Bytes;
-        iv: Bytes;
-    }): Promise<Bytes>;
-}
-
-/**
- * Payload serialisation format (v1): `${version}.${saltB64}.${ivB64}.${cipherB64}`.
- *
- * Each part is URL-safe base64, all joined with `.`. The version tag is
- * always the first segment so consumers can route to the correct algorithm
- * during decrypt.
- */
-interface ParsedPayload {
-    version: string;
-    salt: Bytes;
-    iv: Bytes;
-    cipher: Bytes;
-}
-declare function encodePayload(parts: ParsedPayload): string;
-declare function parsePayload(payload: string): ParsedPayload;
-
-export { type Bytes as B, type CryptoAlgorithm as C, type ParsedPayload as P, type CryptoOperationOptions as a, type CryptoService as b, type CryptoServiceConfig as c, encodePayload as e, parsePayload as p };

package/dist/types/index.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}