@alikhalilll/nuxt-crypto 1.2.1 → 1.3.1

package/README.md

@@ -1,6 +1,15 @@
-# @alikhalilll/nuxt-crypto
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/alikhalilll/ali-nuxt-toolkit/master/packages/crypto/logo-dark.png">
+    <img src="https://raw.githubusercontent.com/alikhalilll/ali-nuxt-toolkit/master/packages/crypto/logo-light.png" alt="nuxt-crypto" width="96" height="96">
+  </picture>
+</p>
 
-Symmetric encryption for Nuxt 3 / 4, built on the native **Web Crypto API**. Defaults to **AES-256-GCM** with **PBKDF2-SHA256** key derivation.
+<h1 align="center">@alikhalilll/nuxt-crypto</h1>
+
+<p align="center">Symmetric encryption for Nuxt 3 / 4 built on the native <strong>Web Crypto API</strong>. Defaults to <strong>AES-256-GCM</strong> with <strong>PBKDF2-SHA256</strong> key derivation.</p>
+
+---
 
 - **Framework-agnostic core** — `createCryptoService()` works anywhere `SubtleCrypto` exists (browser, Deno, Bun, Node 20+).
 - **Key caching** — derived keys are cached per salt, so bulk decrypt stays fast even at 100k+ PBKDF2 iterations.

package/dist/core/index.d.ts

@@ -1,6 +1,6 @@
-import { c as CryptoServiceConfig, b as CryptoService, C as CryptoAlgorithm, B as Bytes } from '../payload-BOueSWcI.js';
-export { a as CryptoOperationOptions, P as ParsedPayload, e as encodePayload, p as parsePayload } from '../payload-BOueSWcI.js';
+import { a as CryptoAlgorithm, c as CryptoServiceConfig, i as Bytes, n as encodePayload, o as CryptoOperationOptions, r as parsePayload, s as CryptoService, t as ParsedPayload } from "../payload-CvzYMicC.js";
 
+//#region src/core/create-service.d.ts
 /**
  * Create a framework-agnostic `CryptoService` from a passphrase.
  *
@@ -9,13 +9,15 @@ export { a as CryptoOperationOptions, P as ParsedPayload, e as encodePayload, p
  * versioned payload envelope.
  */
 declare function createCryptoService(config: CryptoServiceConfig): Promise<CryptoService>;
-
+//#endregion
+//#region src/core/algorithms/aes-gcm.d.ts
 /**
  * AES-256-GCM with PBKDF2-SHA256 key derivation. This is the default and
  * currently the only built-in algorithm; pluggable via `CryptoServiceConfig.algorithm`.
  */
 declare const aesGcmPbkdf2: CryptoAlgorithm;
-
+//#endregion
+//#region src/core/subtle.d.ts
 /**
  * Resolve a SubtleCrypto implementation across environments:
  *
@@ -25,12 +27,14 @@ declare const aesGcmPbkdf2: CryptoAlgorithm;
 declare function getSubtle(): Promise<SubtleCrypto>;
 /** Fill the given buffer with cryptographically strong random bytes. */
 declare function getRandomBytes(length: number): Uint8Array<ArrayBuffer>;
-
+//#endregion
+//#region src/core/base64.d.ts
 /** Encode bytes to standard base64. Works in browser and Node. */
 declare function toBase64(data: Bytes): string;
 /** Decode a base64 string back to bytes. Works in browser and Node. */
 declare function fromBase64(input: string): Bytes;
-
+//#endregion
+//#region src/core/key-cache.d.ts
 /**
  * A tiny LRU-ish cache for derived `CryptoKey` values, keyed on the salt.
  * When capacity is exceeded the oldest entry is evicted. Derived key
@@ -38,13 +42,14 @@ declare function fromBase64(input: string): Bytes;
  * a big impact when decrypting many payloads in a row.
  */
 declare class KeyCache {
-    private readonly capacity;
-    private readonly map;
-    constructor(capacity: number);
-    static key(salt: Bytes, iterations: number, fingerprint?: string): string;
-    get(key: string): Promise<CryptoKey> | undefined;
-    set(key: string, value: Promise<CryptoKey>): void;
-    clear(): void;
+  private readonly capacity;
+  private readonly map;
+  constructor(capacity: number);
+  static key(salt: Bytes, iterations: number, fingerprint?: string): string;
+  get(key: string): Promise<CryptoKey> | undefined;
+  set(key: string, value: Promise<CryptoKey>): void;
+  clear(): void;
 }
-
-export { Bytes, CryptoAlgorithm, CryptoService, CryptoServiceConfig, KeyCache, aesGcmPbkdf2, createCryptoService, fromBase64, getRandomBytes, getSubtle, toBase64 };
+//#endregion
+export { type Bytes, type CryptoAlgorithm, type CryptoOperationOptions, type CryptoService, type CryptoServiceConfig, KeyCache, type ParsedPayload, aesGcmPbkdf2, createCryptoService, encodePayload, fromBase64, getRandomBytes, getSubtle, parsePayload, toBase64 };
+//# sourceMappingURL=index.d.ts.map

package/dist/core/index.mjs

@@ -1,25 +1,3 @@
-import {
-  KeyCache,
-  aesGcmPbkdf2,
-  createCryptoService,
-  encodePayload,
-  parsePayload
-} from "../chunk-FKHKOTFR.mjs";
-import {
-  fromBase64,
-  getRandomBytes,
-  getSubtle,
-  toBase64
-} from "../chunk-FKXZ7VYW.mjs";
-export {
-  KeyCache,
-  aesGcmPbkdf2,
-  createCryptoService,
-  encodePayload,
-  fromBase64,
-  getRandomBytes,
-  getSubtle,
-  parsePayload,
-  toBase64
-};
-//# sourceMappingURL=index.mjs.map
+import { a as aesGcmPbkdf2, i as KeyCache, n as encodePayload, r as parsePayload, t as createCryptoService } from "../create-service-CgBxeMb0.mjs";
+import { i as toBase64, n as getSubtle, r as fromBase64, t as getRandomBytes } from "../subtle-Dh8m0gIA.mjs";
+export { KeyCache, aesGcmPbkdf2, createCryptoService, encodePayload, fromBase64, getRandomBytes, getSubtle, parsePayload, toBase64 };

package/dist/create-service-CgBxeMb0.mjs

@@ -0,0 +1,179 @@
+import { i as toBase64, n as getSubtle, r as fromBase64, t as getRandomBytes } from "./subtle-Dh8m0gIA.mjs";
+//#region src/core/algorithms/aes-gcm.ts
+/**
+* AES-256-GCM with PBKDF2-SHA256 key derivation. This is the default and
+* currently the only built-in algorithm; pluggable via `CryptoServiceConfig.algorithm`.
+*/
+const aesGcmPbkdf2 = {
+	version: "v1",
+	async deriveKey({ subtle, passphrase, fingerprint, salt, iterations }) {
+		const material = fingerprint ? `${passphrase}\x00${fingerprint}` : passphrase;
+		const keyMaterial = await subtle.importKey("raw", new TextEncoder().encode(material), { name: "PBKDF2" }, false, ["deriveKey"]);
+		return subtle.deriveKey({
+			name: "PBKDF2",
+			salt,
+			iterations,
+			hash: "SHA-256"
+		}, keyMaterial, {
+			name: "AES-GCM",
+			length: 256
+		}, false, ["encrypt", "decrypt"]);
+	},
+	async encrypt({ subtle, key, plainText }) {
+		const iv = new Uint8Array(/* @__PURE__ */ new ArrayBuffer(12));
+		globalThis.crypto.getRandomValues(iv);
+		const buf = await subtle.encrypt({
+			name: "AES-GCM",
+			iv
+		}, key, plainText);
+		const cipher = new Uint8Array(new ArrayBuffer(buf.byteLength));
+		cipher.set(new Uint8Array(buf));
+		return {
+			cipher,
+			iv
+		};
+	},
+	async decrypt({ subtle, key, cipher, iv }) {
+		const buf = await subtle.decrypt({
+			name: "AES-GCM",
+			iv
+		}, key, cipher);
+		const out = new Uint8Array(new ArrayBuffer(buf.byteLength));
+		out.set(new Uint8Array(buf));
+		return out;
+	}
+};
+//#endregion
+//#region src/core/key-cache.ts
+/**
+* A tiny LRU-ish cache for derived `CryptoKey` values, keyed on the salt.
+* When capacity is exceeded the oldest entry is evicted. Derived key
+* material is expensive (PBKDF2 is designed to be slow), so caching has
+* a big impact when decrypting many payloads in a row.
+*/
+var KeyCache = class {
+	capacity;
+	map = /* @__PURE__ */ new Map();
+	constructor(capacity) {
+		this.capacity = capacity;
+	}
+	static key(salt, iterations, fingerprint) {
+		return `${iterations}.${fingerprint ?? ""}.${toBase64(salt)}`;
+	}
+	get(key) {
+		const value = this.map.get(key);
+		if (!value) return void 0;
+		this.map.delete(key);
+		this.map.set(key, value);
+		return value;
+	}
+	set(key, value) {
+		if (this.capacity <= 0) return;
+		this.map.set(key, value);
+		while (this.map.size > this.capacity) {
+			const oldest = this.map.keys().next().value;
+			if (oldest === void 0) break;
+			this.map.delete(oldest);
+		}
+	}
+	clear() {
+		this.map.clear();
+	}
+};
+//#endregion
+//#region src/core/payload.ts
+function encodePayload(parts) {
+	return [
+		parts.version,
+		toBase64(parts.salt),
+		toBase64(parts.iv),
+		toBase64(parts.cipher)
+	].join(".");
+}
+function parsePayload(payload) {
+	const segments = payload.split(".");
+	if (segments.length !== 4) throw new Error("[nuxt-crypto] Invalid payload format — expected 4 dot-separated segments.");
+	const [version, saltB64, ivB64, cipherB64] = segments;
+	if (!version || !saltB64 || !ivB64 || !cipherB64) throw new Error("[nuxt-crypto] Invalid payload format — one or more segments were empty.");
+	return {
+		version,
+		salt: fromBase64(saltB64),
+		iv: fromBase64(ivB64),
+		cipher: fromBase64(cipherB64)
+	};
+}
+//#endregion
+//#region src/core/create-service.ts
+const DEFAULT_ITERATIONS = 1e5;
+const DEFAULT_CACHE = 64;
+const SALT_BYTES = 16;
+/**
+* Create a framework-agnostic `CryptoService` from a passphrase.
+*
+* Uses AES-256-GCM with PBKDF2-SHA256 (100k iterations by default). Pass a
+* different `algorithm` to plug in another cipher while preserving the same
+* versioned payload envelope.
+*/
+async function createCryptoService(config) {
+	if (!config.passphrase) throw new Error("[nuxt-crypto] passphrase is required.");
+	const iterations = config.iterations ?? DEFAULT_ITERATIONS;
+	const algorithm = config.algorithm ?? aesGcmPbkdf2;
+	const subtle = config.subtle ?? await getSubtle();
+	const cache = new KeyCache(config.keyCacheSize ?? DEFAULT_CACHE);
+	const passphrase = String(config.passphrase).trim();
+	const encoder = new TextEncoder();
+	const decoder = new TextDecoder();
+	async function getDerivedKey(salt, fingerprint) {
+		const key = KeyCache.key(salt, iterations, fingerprint);
+		const cached = cache.get(key);
+		if (cached) return cached;
+		const pending = algorithm.deriveKey({
+			subtle,
+			passphrase,
+			fingerprint,
+			salt,
+			iterations
+		});
+		cache.set(key, pending);
+		return pending;
+	}
+	return {
+		async encrypt(plainText, options) {
+			const salt = getRandomBytes(SALT_BYTES);
+			const key = await getDerivedKey(salt, options?.fingerprint);
+			const encoded = encoder.encode(plainText);
+			const plainBytes = new Uint8Array(new ArrayBuffer(encoded.byteLength));
+			plainBytes.set(encoded);
+			const { cipher, iv } = await algorithm.encrypt({
+				subtle,
+				key,
+				plainText: plainBytes
+			});
+			return encodePayload({
+				version: algorithm.version,
+				salt,
+				iv,
+				cipher
+			});
+		},
+		async decrypt(payload, options) {
+			const parsed = parsePayload(payload);
+			if (parsed.version !== algorithm.version) throw new Error(`[nuxt-crypto] Unsupported payload version: ${parsed.version} (algorithm expects ${algorithm.version}).`);
+			const key = await getDerivedKey(parsed.salt, options?.fingerprint);
+			const plainBytes = await algorithm.decrypt({
+				subtle,
+				key,
+				cipher: parsed.cipher,
+				iv: parsed.iv
+			});
+			return decoder.decode(plainBytes);
+		},
+		clearKeyCache() {
+			cache.clear();
+		}
+	};
+}
+//#endregion
+export { aesGcmPbkdf2 as a, KeyCache as i, encodePayload as n, parsePayload as r, createCryptoService as t };
+
+//# sourceMappingURL=create-service-CgBxeMb0.mjs.map

package/dist/create-service-CgBxeMb0.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-service-CgBxeMb0.mjs","names":[],"sources":["../src/core/algorithms/aes-gcm.ts","../src/core/key-cache.ts","../src/core/payload.ts","../src/core/create-service.ts"],"sourcesContent":["import type { CryptoAlgorithm } from '../types';\n\n/**\n * AES-256-GCM with PBKDF2-SHA256 key derivation. This is the default and\n * currently the only built-in algorithm; pluggable via `CryptoServiceConfig.algorithm`.\n */\nexport const aesGcmPbkdf2: CryptoAlgorithm = {\n  version: 'v1',\n\n  async deriveKey({ subtle, passphrase, fingerprint, salt, iterations }) {\n    // NUL separator prevents `\"ab\" + \"cd\"` and `\"abc\" + \"d\"` from colliding.\n    const material = fingerprint ? `${passphrase}\\x00${fingerprint}` : passphrase;\n    const keyMaterial = await subtle.importKey(\n      'raw',\n      new TextEncoder().encode(material),\n      { name: 'PBKDF2' },\n      false,\n      ['deriveKey']\n    );\n\n    return subtle.deriveKey(\n      { name: 'PBKDF2', salt, iterations, hash: 'SHA-256' },\n      keyMaterial,\n      { name: 'AES-GCM', length: 256 },\n      false,\n      ['encrypt', 'decrypt']\n    );\n  },\n\n  async encrypt({ subtle, key, plainText }) {\n    const iv = new Uint8Array(new ArrayBuffer(12));\n    globalThis.crypto.getRandomValues(iv);\n    const buf = await subtle.encrypt({ name: 'AES-GCM', iv }, key, plainText);\n    const cipher = new Uint8Array(new ArrayBuffer(buf.byteLength));\n    cipher.set(new Uint8Array(buf));\n    return { cipher, iv };\n  },\n\n  async decrypt({ subtle, key, cipher, iv }) {\n    const buf = await subtle.decrypt({ name: 'AES-GCM', iv }, key, cipher);\n    const out = new Uint8Array(new ArrayBuffer(buf.byteLength));\n    out.set(new Uint8Array(buf));\n    return out;\n  },\n};\n","import type { Bytes } from './types';\nimport { toBase64 } from './base64';\n\n/**\n * A tiny LRU-ish cache for derived `CryptoKey` values, keyed on the salt.\n * When capacity is exceeded the oldest entry is evicted. Derived key\n * material is expensive (PBKDF2 is designed to be slow), so caching has\n * a big impact when decrypting many payloads in a row.\n */\nexport class KeyCache {\n  private readonly map = new Map<string, Promise<CryptoKey>>();\n  constructor(private readonly capacity: number) {}\n\n  static key(salt: Bytes, iterations: number, fingerprint?: string): string {\n    // `.` separates the fields; iterations and base64 can't contain one,\n    // so the joined key is unambiguous even when fingerprint is empty.\n    return `${iterations}.${fingerprint ?? ''}.${toBase64(salt)}`;\n  }\n\n  get(key: string): Promise<CryptoKey> | undefined {\n    const value = this.map.get(key);\n    if (!value) return undefined;\n    // Refresh recency by re-inserting.\n    this.map.delete(key);\n    this.map.set(key, value);\n    return value;\n  }\n\n  set(key: string, value: Promise<CryptoKey>): void {\n    if (this.capacity <= 0) return;\n    this.map.set(key, value);\n    while (this.map.size > this.capacity) {\n      const oldest = this.map.keys().next().value;\n      if (oldest === undefined) break;\n      this.map.delete(oldest);\n    }\n  }\n\n  clear(): void {\n    this.map.clear();\n  }\n}\n","import { fromBase64, toBase64 } from './base64';\nimport type { Bytes } from './types';\n\n/**\n * Payload serialisation format (v1): `${version}.${saltB64}.${ivB64}.${cipherB64}`.\n *\n * Each part is URL-safe base64, all joined with `.`. The version tag is\n * always the first segment so consumers can route to the correct algorithm\n * during decrypt.\n */\nexport interface ParsedPayload {\n  version: string;\n  salt: Bytes;\n  iv: Bytes;\n  cipher: Bytes;\n}\n\nexport function encodePayload(parts: ParsedPayload): string {\n  return [parts.version, toBase64(parts.salt), toBase64(parts.iv), toBase64(parts.cipher)].join(\n    '.'\n  );\n}\n\nexport function parsePayload(payload: string): ParsedPayload {\n  const segments = payload.split('.');\n  if (segments.length !== 4) {\n    throw new Error('[nuxt-crypto] Invalid payload format — expected 4 dot-separated segments.');\n  }\n  const [version, saltB64, ivB64, cipherB64] = segments;\n  if (!version || !saltB64 || !ivB64 || !cipherB64) {\n    throw new Error('[nuxt-crypto] Invalid payload format — one or more segments were empty.');\n  }\n  return {\n    version,\n    salt: fromBase64(saltB64),\n    iv: fromBase64(ivB64),\n    cipher: fromBase64(cipherB64),\n  };\n}\n","import { aesGcmPbkdf2 } from './algorithms/aes-gcm';\nimport { KeyCache } from './key-cache';\nimport { encodePayload, parsePayload } from './payload';\nimport { getRandomBytes, getSubtle } from './subtle';\nimport type { CryptoAlgorithm, CryptoService, CryptoServiceConfig } from './types';\n\nconst DEFAULT_ITERATIONS = 100_000;\nconst DEFAULT_CACHE = 64;\nconst SALT_BYTES = 16;\n\n/**\n * Create a framework-agnostic `CryptoService` from a passphrase.\n *\n * Uses AES-256-GCM with PBKDF2-SHA256 (100k iterations by default). Pass a\n * different `algorithm` to plug in another cipher while preserving the same\n * versioned payload envelope.\n */\nexport async function createCryptoService(config: CryptoServiceConfig): Promise<CryptoService> {\n  if (!config.passphrase) {\n    throw new Error('[nuxt-crypto] passphrase is required.');\n  }\n\n  const iterations = config.iterations ?? DEFAULT_ITERATIONS;\n  const algorithm: CryptoAlgorithm = config.algorithm ?? aesGcmPbkdf2;\n  const subtle = config.subtle ?? (await getSubtle());\n  const cache = new KeyCache(config.keyCacheSize ?? DEFAULT_CACHE);\n  const passphrase = String(config.passphrase).trim();\n  const encoder = new TextEncoder();\n  const decoder = new TextDecoder();\n\n  async function getDerivedKey(\n    salt: Uint8Array<ArrayBuffer>,\n    fingerprint?: string\n  ): Promise<CryptoKey> {\n    const key = KeyCache.key(salt, iterations, fingerprint);\n    const cached = cache.get(key);\n    if (cached) return cached;\n    const pending = algorithm.deriveKey({ subtle, passphrase, fingerprint, salt, iterations });\n    cache.set(key, pending);\n    return pending;\n  }\n\n  return {\n    async encrypt(plainText, options) {\n      const salt = getRandomBytes(SALT_BYTES);\n      const key = await getDerivedKey(salt, options?.fingerprint);\n      const encoded = encoder.encode(plainText);\n      const plainBytes = new Uint8Array(new ArrayBuffer(encoded.byteLength));\n      plainBytes.set(encoded);\n      const { cipher, iv } = await algorithm.encrypt({ subtle, key, plainText: plainBytes });\n      return encodePayload({ version: algorithm.version, salt, iv, cipher });\n    },\n\n    async decrypt(payload, options) {\n      const parsed = parsePayload(payload);\n      if (parsed.version !== algorithm.version) {\n        throw new Error(\n          `[nuxt-crypto] Unsupported payload version: ${parsed.version} (algorithm expects ${algorithm.version}).`\n        );\n      }\n      const key = await getDerivedKey(parsed.salt, options?.fingerprint);\n      const plainBytes = await algorithm.decrypt({\n        subtle,\n        key,\n        cipher: parsed.cipher,\n        iv: parsed.iv,\n      });\n      return decoder.decode(plainBytes);\n    },\n\n    clearKeyCache(): void {\n      cache.clear();\n    },\n  };\n}\n"],"mappings":";;;;;;AAMA,MAAa,eAAgC;CAC3C,SAAS;CAET,MAAM,UAAU,EAAE,QAAQ,YAAY,aAAa,MAAM,cAAc;EAErE,MAAM,WAAW,cAAc,GAAG,WAAW,MAAM,gBAAgB;EACnE,MAAM,cAAc,MAAM,OAAO,UAC/B,OACA,IAAI,YAAY,EAAE,OAAO,QAAQ,GACjC,EAAE,MAAM,SAAS,GACjB,OACA,CAAC,WAAW,CACd;EAEA,OAAO,OAAO,UACZ;GAAE,MAAM;GAAU;GAAM;GAAY,MAAM;EAAU,GACpD,aACA;GAAE,MAAM;GAAW,QAAQ;EAAI,GAC/B,OACA,CAAC,WAAW,SAAS,CACvB;CACF;CAEA,MAAM,QAAQ,EAAE,QAAQ,KAAK,aAAa;EACxC,MAAM,KAAK,IAAI,2BAAW,IAAI,YAAY,EAAE,CAAC;EAC7C,WAAW,OAAO,gBAAgB,EAAE;EACpC,MAAM,MAAM,MAAM,OAAO,QAAQ;GAAE,MAAM;GAAW;EAAG,GAAG,KAAK,SAAS;EACxE,MAAM,SAAS,IAAI,WAAW,IAAI,YAAY,IAAI,UAAU,CAAC;EAC7D,OAAO,IAAI,IAAI,WAAW,GAAG,CAAC;EAC9B,OAAO;GAAE;GAAQ;EAAG;CACtB;CAEA,MAAM,QAAQ,EAAE,QAAQ,KAAK,QAAQ,MAAM;EACzC,MAAM,MAAM,MAAM,OAAO,QAAQ;GAAE,MAAM;GAAW;EAAG,GAAG,KAAK,MAAM;EACrE,MAAM,MAAM,IAAI,WAAW,IAAI,YAAY,IAAI,UAAU,CAAC;EAC1D,IAAI,IAAI,IAAI,WAAW,GAAG,CAAC;EAC3B,OAAO;CACT;AACF;;;;;;;;;ACnCA,IAAa,WAAb,MAAsB;CAES;CAD7B,sBAAuB,IAAI,IAAgC;CAC3D,YAAY,UAAmC;EAAlB,KAAA,WAAA;CAAmB;CAEhD,OAAO,IAAI,MAAa,YAAoB,aAA8B;EAGxE,OAAO,GAAG,WAAW,GAAG,eAAe,GAAG,GAAG,SAAS,IAAI;CAC5D;CAEA,IAAI,KAA6C;EAC/C,MAAM,QAAQ,KAAK,IAAI,IAAI,GAAG;EAC9B,IAAI,CAAC,OAAO,OAAO,KAAA;EAEnB,KAAK,IAAI,OAAO,GAAG;EACnB,KAAK,IAAI,IAAI,KAAK,KAAK;EACvB,OAAO;CACT;CAEA,IAAI,KAAa,OAAiC;EAChD,IAAI,KAAK,YAAY,GAAG;EACxB,KAAK,IAAI,IAAI,KAAK,KAAK;EACvB,OAAO,KAAK,IAAI,OAAO,KAAK,UAAU;GACpC,MAAM,SAAS,KAAK,IAAI,KAAK,EAAE,KAAK,EAAE;GACtC,IAAI,WAAW,KAAA,GAAW;GAC1B,KAAK,IAAI,OAAO,MAAM;EACxB;CACF;CAEA,QAAc;EACZ,KAAK,IAAI,MAAM;CACjB;AACF;;;ACxBA,SAAgB,cAAc,OAA8B;CAC1D,OAAO;EAAC,MAAM;EAAS,SAAS,MAAM,IAAI;EAAG,SAAS,MAAM,EAAE;EAAG,SAAS,MAAM,MAAM;CAAC,EAAE,KACvF,GACF;AACF;AAEA,SAAgB,aAAa,SAAgC;CAC3D,MAAM,WAAW,QAAQ,MAAM,GAAG;CAClC,IAAI,SAAS,WAAW,GACtB,MAAM,IAAI,MAAM,2EAA2E;CAE7F,MAAM,CAAC,SAAS,SAAS,OAAO,aAAa;CAC7C,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,WACrC,MAAM,IAAI,MAAM,yEAAyE;CAE3F,OAAO;EACL;EACA,MAAM,WAAW,OAAO;EACxB,IAAI,WAAW,KAAK;EACpB,QAAQ,WAAW,SAAS;CAC9B;AACF;;;AChCA,MAAM,qBAAqB;AAC3B,MAAM,gBAAgB;AACtB,MAAM,aAAa;;;;;;;;AASnB,eAAsB,oBAAoB,QAAqD;CAC7F,IAAI,CAAC,OAAO,YACV,MAAM,IAAI,MAAM,uCAAuC;CAGzD,MAAM,aAAa,OAAO,cAAc;CACxC,MAAM,YAA6B,OAAO,aAAa;CACvD,MAAM,SAAS,OAAO,UAAW,MAAM,UAAU;CACjD,MAAM,QAAQ,IAAI,SAAS,OAAO,gBAAgB,aAAa;CAC/D,MAAM,aAAa,OAAO,OAAO,UAAU,EAAE,KAAK;CAClD,MAAM,UAAU,IAAI,YAAY;CAChC,MAAM,UAAU,IAAI,YAAY;CAEhC,eAAe,cACb,MACA,aACoB;EACpB,MAAM,MAAM,SAAS,IAAI,MAAM,YAAY,WAAW;EACtD,MAAM,SAAS,MAAM,IAAI,GAAG;EAC5B,IAAI,QAAQ,OAAO;EACnB,MAAM,UAAU,UAAU,UAAU;GAAE;GAAQ;GAAY;GAAa;GAAM;EAAW,CAAC;EACzF,MAAM,IAAI,KAAK,OAAO;EACtB,OAAO;CACT;CAEA,OAAO;EACL,MAAM,QAAQ,WAAW,SAAS;GAChC,MAAM,OAAO,eAAe,UAAU;GACtC,MAAM,MAAM,MAAM,cAAc,MAAM,SAAS,WAAW;GAC1D,MAAM,UAAU,QAAQ,OAAO,SAAS;GACxC,MAAM,aAAa,IAAI,WAAW,IAAI,YAAY,QAAQ,UAAU,CAAC;GACrE,WAAW,IAAI,OAAO;GACtB,MAAM,EAAE,QAAQ,OAAO,MAAM,UAAU,QAAQ;IAAE;IAAQ;IAAK,WAAW;GAAW,CAAC;GACrF,OAAO,cAAc;IAAE,SAAS,UAAU;IAAS;IAAM;IAAI;GAAO,CAAC;EACvE;EAEA,MAAM,QAAQ,SAAS,SAAS;GAC9B,MAAM,SAAS,aAAa,OAAO;GACnC,IAAI,OAAO,YAAY,UAAU,SAC/B,MAAM,IAAI,MACR,8CAA8C,OAAO,QAAQ,sBAAsB,UAAU,QAAQ,GACvG;GAEF,MAAM,MAAM,MAAM,cAAc,OAAO,MAAM,SAAS,WAAW;GACjE,MAAM,aAAa,MAAM,UAAU,QAAQ;IACzC;IACA;IACA,QAAQ,OAAO;IACf,IAAI,OAAO;GACb,CAAC;GACD,OAAO,QAAQ,OAAO,UAAU;EAClC;EAEA,gBAAsB;GACpB,MAAM,MAAM;EACd;CACF;AACF"}

package/dist/index-DkMNygRG.d.ts

@@ -0,0 +1,30 @@
+//#region src/types/module-options.d.ts
+interface CryptoModuleOptions {
+  /**
+   * Passphrase used to derive the AES key. Prefer wiring this from a
+   * runtime config env var (e.g. `NUXT_ENCRYPTION_PASSPHRASE`) rather than
+   * committing it.
+   */
+  passphrase: string;
+  /**
+   * Name under which the service is provided. Accepts `$crypto` or `crypto`
+   * — the leading `$` is stripped. Default: `$crypto`.
+   */
+  provideName?: string;
+  /** PBKDF2 iterations. Default 100_000. */
+  iterations?: number;
+  /**
+   * Max number of derived keys held in memory. Default 64. Set to 0 to
+   * disable caching.
+   */
+  keyCacheSize?: number;
+  /**
+   * When `true`, the runtime plugin is only registered on the server. Useful
+   * when you do not want the plaintext passphrase shipped to the browser.
+   * Default: `false`.
+   */
+  serverOnly?: boolean;
+}
+//#endregion
+export { CryptoModuleOptions as t };
+//# sourceMappingURL=index-DkMNygRG.d.ts.map

package/dist/module.d.ts

@@ -1,7 +1,9 @@
-import { NuxtModule } from '@nuxt/schema';
-import { CryptoModuleOptions } from './types/index.js';
-export { B as Bytes, C as CryptoAlgorithm, a as CryptoOperationOptions, b as CryptoService, c as CryptoServiceConfig, P as ParsedPayload } from './payload-BOueSWcI.js';
+import { a as CryptoAlgorithm, c as CryptoServiceConfig, i as Bytes, o as CryptoOperationOptions, s as CryptoService, t as ParsedPayload } from "./payload-CvzYMicC.js";
+import { t as CryptoModuleOptions } from "./index-DkMNygRG.js";
+import { NuxtModule } from "@nuxt/schema";
 
+//#region src/module.d.ts
 declare const cryptoModule: NuxtModule<CryptoModuleOptions>;
-
-export { CryptoModuleOptions, cryptoModule as default };
+//#endregion
+export { type Bytes, type CryptoAlgorithm, type CryptoModuleOptions, type CryptoOperationOptions, type CryptoService, type CryptoServiceConfig, type ParsedPayload, cryptoModule as default };
+//# sourceMappingURL=module.d.ts.map

package/dist/module.mjs

@@ -1,25 +1,21 @@
-import "./chunk-EFZPSZWO.mjs";
-
-// src/module.ts
+import "./types/index.mjs";
 import { addPlugin, addTemplate, createResolver, defineNuxtModule } from "@nuxt/kit";
-
-// src/templates/config.template.ts
+//#region src/templates/config.template.ts
 function createConfigTemplateContents(params) {
-  const { options, normalizedProvideName } = params;
-  const cfg = {
-    passphrase: options.passphrase,
-    iterations: options.iterations ?? 1e5,
-    keyCacheSize: options.keyCacheSize ?? 64,
-    provideName: normalizedProvideName
-  };
-  return `export default ${JSON.stringify(cfg)};
-`;
+	const { options, normalizedProvideName } = params;
+	const cfg = {
+		passphrase: options.passphrase,
+		iterations: options.iterations ?? 1e5,
+		keyCacheSize: options.keyCacheSize ?? 64,
+		provideName: normalizedProvideName
+	};
+	return `export default ${JSON.stringify(cfg)};\n`;
 }
-
-// src/templates/types.template.ts
+//#endregion
+//#region src/templates/types.template.ts
 function createTypesTemplateContents(params) {
-  const { typesEntryPath, normalizedProvideName } = params;
-  return `// Auto-generated by @alikhalilll/nuxt-crypto
+	const { typesEntryPath, normalizedProvideName } = params;
+	return `// Auto-generated by @alikhalilll/nuxt-crypto
 import type { CryptoService } from '${typesEntryPath}';
 
 declare module '#app' {
@@ -37,53 +33,54 @@ declare module 'vue' {
 export {};
 `;
 }
-
-// src/utils/normalize-provide-name.ts
+//#endregion
+//#region src/utils/normalize-provide-name.ts
 function normalizeProvideName(provideName, fallback) {
-  const name = (provideName ?? fallback).trim();
-  const stripped = name.startsWith("$") ? name.slice(1) : name;
-  return stripped || fallback;
+	const name = (provideName ?? fallback).trim();
+	return (name.startsWith("$") ? name.slice(1) : name) || fallback;
 }
-
-// src/module.ts
-var cryptoModule = defineNuxtModule({
-  meta: {
-    name: "@alikhalilll/nuxt-crypto",
-    configKey: "crypto",
-    compatibility: { nuxt: ">=3.0.0" }
-  },
-  defaults: {
-    passphrase: "",
-    provideName: "$crypto",
-    iterations: 1e5,
-    keyCacheSize: 64,
-    serverOnly: false
-  },
-  setup(options, nuxt) {
-    const resolver = createResolver(import.meta.url);
-    const normalizedProvideName = normalizeProvideName(options.provideName, "crypto");
-    addTemplate({
-      filename: "crypto-config.mjs",
-      getContents: () => createConfigTemplateContents({ options, normalizedProvideName })
-    });
-    const typesTemplate = addTemplate({
-      filename: "types/crypto.d.ts",
-      getContents: () => createTypesTemplateContents({
-        typesEntryPath: resolver.resolve("./types/index"),
-        normalizedProvideName
-      })
-    });
-    addPlugin({
-      mode: options.serverOnly ? "server" : "all",
-      src: resolver.resolve("./runtime/plugin")
-    });
-    nuxt.hook("prepare:types", ({ references }) => {
-      references.push({ path: typesTemplate.dst });
-    });
-  }
+//#endregion
+//#region src/module.ts
+const cryptoModule = defineNuxtModule({
+	meta: {
+		name: "@alikhalilll/nuxt-crypto",
+		configKey: "crypto",
+		compatibility: { nuxt: ">=3.0.0" }
+	},
+	defaults: {
+		passphrase: "",
+		provideName: "$crypto",
+		iterations: 1e5,
+		keyCacheSize: 64,
+		serverOnly: false
+	},
+	setup(options, nuxt) {
+		const resolver = createResolver(import.meta.url);
+		const normalizedProvideName = normalizeProvideName(options.provideName, "crypto");
+		addTemplate({
+			filename: "crypto-config.mjs",
+			getContents: () => createConfigTemplateContents({
+				options,
+				normalizedProvideName
+			})
+		});
+		const typesTemplate = addTemplate({
+			filename: "types/crypto.d.ts",
+			getContents: () => createTypesTemplateContents({
+				typesEntryPath: resolver.resolve("./types/index"),
+				normalizedProvideName
+			})
+		});
+		addPlugin({
+			mode: options.serverOnly ? "server" : "all",
+			src: resolver.resolve("./runtime/plugin")
+		});
+		nuxt.hook("prepare:types", ({ references }) => {
+			references.push({ path: typesTemplate.dst });
+		});
+	}
 });
-var module_default = cryptoModule;
-export {
-  module_default as default
-};
+//#endregion
+export { cryptoModule as default };
+
 //# sourceMappingURL=module.mjs.map

package/dist/module.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/module.ts","../src/templates/config.template.ts","../src/templates/types.template.ts","../src/utils/normalize-provide-name.ts"],"sourcesContent":["import { addPlugin, addTemplate, createResolver, defineNuxtModule } from '@nuxt/kit';\nimport type { NuxtModule } from '@nuxt/schema';\n\nimport { createConfigTemplateContents } from './templates/config.template';\nimport { createTypesTemplateContents } from './templates/types.template';\nimport type { CryptoModuleOptions } from './types/module-options';\nimport { normalizeProvideName } from './utils/normalize-provide-name';\n\nexport * from './types';\n\nconst cryptoModule: NuxtModule<CryptoModuleOptions> = defineNuxtModule<CryptoModuleOptions>({\n  meta: {\n    name: '@alikhalilll/nuxt-crypto',\n    configKey: 'crypto',\n    compatibility: { nuxt: '>=3.0.0' },\n  },\n  defaults: {\n    passphrase: '',\n    provideName: '$crypto',\n    iterations: 100_000,\n    keyCacheSize: 64,\n    serverOnly: false,\n  },\n  setup(options, nuxt) {\n    const resolver = createResolver(import.meta.url);\n    const normalizedProvideName = normalizeProvideName(options.provideName, 'crypto');\n\n    addTemplate({\n      filename: 'crypto-config.mjs',\n      getContents: () => createConfigTemplateContents({ options, normalizedProvideName }),\n    });\n\n    const typesTemplate = addTemplate({\n      filename: 'types/crypto.d.ts',\n      getContents: () =>\n        createTypesTemplateContents({\n          typesEntryPath: resolver.resolve('./types/index'),\n          normalizedProvideName,\n        }),\n    });\n\n    addPlugin({\n      mode: options.serverOnly ? 'server' : 'all',\n      src: resolver.resolve('./runtime/plugin'),\n    });\n\n    nuxt.hook('prepare:types', ({ references }) => {\n      references.push({ path: typesTemplate.dst });\n    });\n  },\n});\n\nexport default cryptoModule;\n","import type { CryptoModuleOptions } from '../types/module-options';\n\nexport interface ResolvedCryptoConfig {\n  passphrase: string;\n  iterations: number;\n  keyCacheSize: number;\n  provideName: string;\n}\n\nexport function createConfigTemplateContents(params: {\n  options: CryptoModuleOptions;\n  normalizedProvideName: string;\n}): string {\n  const { options, normalizedProvideName } = params;\n  const cfg: ResolvedCryptoConfig = {\n    passphrase: options.passphrase,\n    iterations: options.iterations ?? 100_000,\n    keyCacheSize: options.keyCacheSize ?? 64,\n    provideName: normalizedProvideName,\n  };\n  return `export default ${JSON.stringify(cfg)};\\n`;\n}\n","export function createTypesTemplateContents(params: {\n  typesEntryPath: string;\n  normalizedProvideName: string;\n}): string {\n  const { typesEntryPath, normalizedProvideName } = params;\n\n  return `// Auto-generated by @alikhalilll/nuxt-crypto\nimport type { CryptoService } from '${typesEntryPath}';\n\ndeclare module '#app' {\n  interface NuxtApp {\n    $${normalizedProvideName}: CryptoService;\n  }\n}\n\ndeclare module 'vue' {\n  interface ComponentCustomProperties {\n    $${normalizedProvideName}: CryptoService;\n  }\n}\n\nexport {};\n`;\n}\n","export function normalizeProvideName(provideName: string | undefined, fallback: string): string {\n  const name = (provideName ?? fallback).trim();\n  const stripped = name.startsWith('$') ? name.slice(1) : name;\n  return stripped || fallback;\n}\n"],"mappings":";;;AAAA,SAAS,WAAW,aAAa,gBAAgB,wBAAwB;;;ACSlE,SAAS,6BAA6B,QAGlC;AACT,QAAM,EAAE,SAAS,sBAAsB,IAAI;AAC3C,QAAM,MAA4B;AAAA,IAChC,YAAY,QAAQ;AAAA,IACpB,YAAY,QAAQ,cAAc;AAAA,IAClC,cAAc,QAAQ,gBAAgB;AAAA,IACtC,aAAa;AAAA,EACf;AACA,SAAO,kBAAkB,KAAK,UAAU,GAAG,CAAC;AAAA;AAC9C;;;ACrBO,SAAS,4BAA4B,QAGjC;AACT,QAAM,EAAE,gBAAgB,sBAAsB,IAAI;AAElD,SAAO;AAAA,sCAC6B,cAAc;AAAA;AAAA;AAAA;AAAA,OAI7C,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,OAMrB,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAM5B;;;ACvBO,SAAS,qBAAqB,aAAiC,UAA0B;AAC9F,QAAM,QAAQ,eAAe,UAAU,KAAK;AAC5C,QAAM,WAAW,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI;AACxD,SAAO,YAAY;AACrB;;;AHMA,IAAM,eAAgD,iBAAsC;AAAA,EAC1F,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,WAAW;AAAA,IACX,eAAe,EAAE,MAAM,UAAU;AAAA,EACnC;AAAA,EACA,UAAU;AAAA,IACR,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,YAAY;AAAA,EACd;AAAA,EACA,MAAM,SAAS,MAAM;AACnB,UAAM,WAAW,eAAe,YAAY,GAAG;AAC/C,UAAM,wBAAwB,qBAAqB,QAAQ,aAAa,QAAQ;AAEhF,gBAAY;AAAA,MACV,UAAU;AAAA,MACV,aAAa,MAAM,6BAA6B,EAAE,SAAS,sBAAsB,CAAC;AAAA,IACpF,CAAC;AAED,UAAM,gBAAgB,YAAY;AAAA,MAChC,UAAU;AAAA,MACV,aAAa,MACX,4BAA4B;AAAA,QAC1B,gBAAgB,SAAS,QAAQ,eAAe;AAAA,QAChD;AAAA,MACF,CAAC;AAAA,IACL,CAAC;AAED,cAAU;AAAA,MACR,MAAM,QAAQ,aAAa,WAAW;AAAA,MACtC,KAAK,SAAS,QAAQ,kBAAkB;AAAA,IAC1C,CAAC;AAED,SAAK,KAAK,iBAAiB,CAAC,EAAE,WAAW,MAAM;AAC7C,iBAAW,KAAK,EAAE,MAAM,cAAc,IAAI,CAAC;AAAA,IAC7C,CAAC;AAAA,EACH;AACF,CAAC;AAED,IAAO,iBAAQ;","names":[]}
+{"version":3,"file":"module.mjs","names":[],"sources":["../src/templates/config.template.ts","../src/templates/types.template.ts","../src/utils/normalize-provide-name.ts","../src/module.ts"],"sourcesContent":["import type { CryptoModuleOptions } from '../types/module-options';\n\nexport interface ResolvedCryptoConfig {\n  passphrase: string;\n  iterations: number;\n  keyCacheSize: number;\n  provideName: string;\n}\n\nexport function createConfigTemplateContents(params: {\n  options: CryptoModuleOptions;\n  normalizedProvideName: string;\n}): string {\n  const { options, normalizedProvideName } = params;\n  const cfg: ResolvedCryptoConfig = {\n    passphrase: options.passphrase,\n    iterations: options.iterations ?? 100_000,\n    keyCacheSize: options.keyCacheSize ?? 64,\n    provideName: normalizedProvideName,\n  };\n  return `export default ${JSON.stringify(cfg)};\\n`;\n}\n","export function createTypesTemplateContents(params: {\n  typesEntryPath: string;\n  normalizedProvideName: string;\n}): string {\n  const { typesEntryPath, normalizedProvideName } = params;\n\n  return `// Auto-generated by @alikhalilll/nuxt-crypto\nimport type { CryptoService } from '${typesEntryPath}';\n\ndeclare module '#app' {\n  interface NuxtApp {\n    $${normalizedProvideName}: CryptoService;\n  }\n}\n\ndeclare module 'vue' {\n  interface ComponentCustomProperties {\n    $${normalizedProvideName}: CryptoService;\n  }\n}\n\nexport {};\n`;\n}\n","export function normalizeProvideName(provideName: string | undefined, fallback: string): string {\n  const name = (provideName ?? fallback).trim();\n  const stripped = name.startsWith('$') ? name.slice(1) : name;\n  return stripped || fallback;\n}\n","import { addPlugin, addTemplate, createResolver, defineNuxtModule } from '@nuxt/kit';\nimport type { NuxtModule } from '@nuxt/schema';\n\nimport { createConfigTemplateContents } from './templates/config.template';\nimport { createTypesTemplateContents } from './templates/types.template';\nimport type { CryptoModuleOptions } from './types/module-options';\nimport { normalizeProvideName } from './utils/normalize-provide-name';\n\nexport * from './types';\n\nconst cryptoModule: NuxtModule<CryptoModuleOptions> = defineNuxtModule<CryptoModuleOptions>({\n  meta: {\n    name: '@alikhalilll/nuxt-crypto',\n    configKey: 'crypto',\n    compatibility: { nuxt: '>=3.0.0' },\n  },\n  defaults: {\n    passphrase: '',\n    provideName: '$crypto',\n    iterations: 100_000,\n    keyCacheSize: 64,\n    serverOnly: false,\n  },\n  setup(options, nuxt) {\n    const resolver = createResolver(import.meta.url);\n    const normalizedProvideName = normalizeProvideName(options.provideName, 'crypto');\n\n    addTemplate({\n      filename: 'crypto-config.mjs',\n      getContents: () => createConfigTemplateContents({ options, normalizedProvideName }),\n    });\n\n    const typesTemplate = addTemplate({\n      filename: 'types/crypto.d.ts',\n      getContents: () =>\n        createTypesTemplateContents({\n          typesEntryPath: resolver.resolve('./types/index'),\n          normalizedProvideName,\n        }),\n    });\n\n    addPlugin({\n      mode: options.serverOnly ? 'server' : 'all',\n      src: resolver.resolve('./runtime/plugin'),\n    });\n\n    nuxt.hook('prepare:types', ({ references }) => {\n      references.push({ path: typesTemplate.dst });\n    });\n  },\n});\n\nexport default cryptoModule;\n"],"mappings":";;;AASA,SAAgB,6BAA6B,QAGlC;CACT,MAAM,EAAE,SAAS,0BAA0B;CAC3C,MAAM,MAA4B;EAChC,YAAY,QAAQ;EACpB,YAAY,QAAQ,cAAc;EAClC,cAAc,QAAQ,gBAAgB;EACtC,aAAa;CACf;CACA,OAAO,kBAAkB,KAAK,UAAU,GAAG,EAAE;AAC/C;;;ACrBA,SAAgB,4BAA4B,QAGjC;CACT,MAAM,EAAE,gBAAgB,0BAA0B;CAElD,OAAO;sCAC6B,eAAe;;;;OAI9C,sBAAsB;;;;;;OAMtB,sBAAsB;;;;;;AAM7B;;;ACvBA,SAAgB,qBAAqB,aAAiC,UAA0B;CAC9F,MAAM,QAAQ,eAAe,UAAU,KAAK;CAE5C,QADiB,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI,SACrC;AACrB;;;ACMA,MAAM,eAAgD,iBAAsC;CAC1F,MAAM;EACJ,MAAM;EACN,WAAW;EACX,eAAe,EAAE,MAAM,UAAU;CACnC;CACA,UAAU;EACR,YAAY;EACZ,aAAa;EACb,YAAY;EACZ,cAAc;EACd,YAAY;CACd;CACA,MAAM,SAAS,MAAM;EACnB,MAAM,WAAW,eAAe,OAAO,KAAK,GAAG;EAC/C,MAAM,wBAAwB,qBAAqB,QAAQ,aAAa,QAAQ;EAEhF,YAAY;GACV,UAAU;GACV,mBAAmB,6BAA6B;IAAE;IAAS;GAAsB,CAAC;EACpF,CAAC;EAED,MAAM,gBAAgB,YAAY;GAChC,UAAU;GACV,mBACE,4BAA4B;IAC1B,gBAAgB,SAAS,QAAQ,eAAe;IAChD;GACF,CAAC;EACL,CAAC;EAED,UAAU;GACR,MAAM,QAAQ,aAAa,WAAW;GACtC,KAAK,SAAS,QAAQ,kBAAkB;EAC1C,CAAC;EAED,KAAK,KAAK,kBAAkB,EAAE,iBAAiB;GAC7C,WAAW,KAAK,EAAE,MAAM,cAAc,IAAI,CAAC;EAC7C,CAAC;CACH;AACF,CAAC"}

package/dist/payload-CvzYMicC.d.ts

@@ -0,0 +1,111 @@
+//#region src/core/types.d.ts
+/** Shorthand for the `Uint8Array` we use everywhere in the crypto package. */
+type Bytes = Uint8Array<ArrayBuffer>;
+/**
+ * Options accepted by `encrypt` / `decrypt`. Both calls must receive the
+ * same `fingerprint` value to round-trip; passing different fingerprints
+ * produces undecryptable ciphertext.
+ */
+interface CryptoOperationOptions {
+  /**
+   * Optional extra key material mixed into the PBKDF2 input. Typically a
+   * device fingerprint produced server-side from an HttpOnly device-ID
+   * cookie via `getClientFingerprint()` from `@alikhalilll/nuxt-crypto/server`.
+   *
+   * ⚠️ Binding ciphertext to a fingerprint means the payload becomes
+   * undecryptable the moment the device cookie is cleared. Use only for
+   * ephemeral tokens (short-lived session cookies, one-time links), never
+   * for long-lived user data.
+   */
+  fingerprint?: string;
+}
+/**
+ * A CryptoService encrypts plaintext to a serialisable string payload and
+ * decrypts it back. Every operation is async because it hits the Web Crypto
+ * subtle API.
+ */
+interface CryptoService {
+  /** Encrypt a UTF-8 string to a versioned, base64-encoded payload. */
+  encrypt(plainText: string, options?: CryptoOperationOptions): Promise<string>;
+  /** Decrypt a payload produced by `encrypt`. Pass the same `fingerprint` used at encrypt time, if any. */
+  decrypt(payload: string, options?: CryptoOperationOptions): Promise<string>;
+  /** Clear any cached derived keys. Safe to call at any time. */
+  clearKeyCache(): void;
+}
+/** Config for `createCryptoService`. */
+interface CryptoServiceConfig {
+  /** Passphrase used to derive the symmetric key. */
+  passphrase: string;
+  /** PBKDF2 iteration count. Default 100_000. */
+  iterations?: number;
+  /**
+   * Algorithm implementation. Defaults to AES-256-GCM with PBKDF2-SHA256 key
+   * derivation. Replace to plug in a different cipher.
+   */
+  algorithm?: CryptoAlgorithm;
+  /**
+   * Max number of derived keys held in memory. Derived keys are expensive —
+   * caching them by salt dramatically speeds up bulk decrypt. Default 64.
+   * Set to 0 to disable caching.
+   */
+  keyCacheSize?: number;
+  /** Override the SubtleCrypto implementation. Useful for testing. */
+  subtle?: SubtleCrypto;
+}
+/**
+ * A pluggable symmetric-encryption algorithm. Each implementation owns the
+ * payload format (via its version tag), key derivation, and the actual
+ * encrypt/decrypt work.
+ */
+interface CryptoAlgorithm {
+  /** Short identifier stored as the first segment of every payload (e.g. `'v1'`). */
+  readonly version: string;
+  /**
+   * Derive a CryptoKey from a passphrase + salt pair. Expected to be idempotent.
+   * When `fingerprint` is provided it is mixed into the key-derivation input
+   * (alongside the passphrase) so ciphertext becomes bound to that fingerprint.
+   */
+  deriveKey(args: {
+    subtle: SubtleCrypto;
+    passphrase: string;
+    fingerprint?: string;
+    salt: Bytes;
+    iterations: number;
+  }): Promise<CryptoKey>;
+  /** Encrypt plaintext bytes using a pre-derived key. Returns cipher bytes + any per-call params (e.g. IV). */
+  encrypt(args: {
+    subtle: SubtleCrypto;
+    key: CryptoKey;
+    plainText: Bytes;
+  }): Promise<{
+    cipher: Bytes;
+    iv: Bytes;
+  }>;
+  /** Decrypt cipher bytes using a pre-derived key and the IV produced during encrypt. */
+  decrypt(args: {
+    subtle: SubtleCrypto;
+    key: CryptoKey;
+    cipher: Bytes;
+    iv: Bytes;
+  }): Promise<Bytes>;
+}
+//#endregion
+//#region src/core/payload.d.ts
+/**
+ * Payload serialisation format (v1): `${version}.${saltB64}.${ivB64}.${cipherB64}`.
+ *
+ * Each part is URL-safe base64, all joined with `.`. The version tag is
+ * always the first segment so consumers can route to the correct algorithm
+ * during decrypt.
+ */
+interface ParsedPayload {
+  version: string;
+  salt: Bytes;
+  iv: Bytes;
+  cipher: Bytes;
+}
+declare function encodePayload(parts: ParsedPayload): string;
+declare function parsePayload(payload: string): ParsedPayload;
+//#endregion
+export { CryptoAlgorithm as a, CryptoServiceConfig as c, Bytes as i, encodePayload as n, CryptoOperationOptions as o, parsePayload as r, CryptoService as s, ParsedPayload as t };
+//# sourceMappingURL=payload-CvzYMicC.d.ts.map

package/dist/runtime/plugin.d.ts

@@ -0,0 +1,5 @@
+//#region src/runtime/plugin.d.ts
+declare const _default: any;
+//#endregion
+export { _default as default };
+//# sourceMappingURL=plugin.d.ts.map