@alikhalilll/nuxt-crypto 1.2.1 → 1.3.1

package/dist/runtime/plugin.mjs

@@ -1,30 +1,18 @@
-import {
-  createCryptoService
-} from "../chunk-FKHKOTFR.mjs";
-import "../chunk-FKXZ7VYW.mjs";
-
-// src/runtime/plugin.ts
+import { t as createCryptoService } from "../create-service-CgBxeMb0.mjs";
 import { defineNuxtPlugin } from "#app";
 import config from "#build/crypto-config.mjs";
+//#region src/runtime/plugin.ts
 var plugin_default = defineNuxtPlugin(async () => {
-  const { passphrase, iterations, keyCacheSize, provideName } = config;
-  if (!passphrase && import.meta.dev) {
-    console.warn(
-      `[@alikhalilll/nuxt-crypto] Missing passphrase \u2014 $${provideName} will throw when used.`
-    );
-  }
-  const service = await createCryptoService({
-    passphrase: String(passphrase).trim(),
-    iterations,
-    keyCacheSize
-  });
-  return {
-    provide: {
-      [provideName]: service
-    }
-  };
+	const { passphrase, iterations, keyCacheSize, provideName } = config;
+	if (!passphrase && import.meta.dev) console.warn(`[@alikhalilll/nuxt-crypto] Missing passphrase — $${provideName} will throw when used.`);
+	const service = await createCryptoService({
+		passphrase: String(passphrase).trim(),
+		iterations,
+		keyCacheSize
+	});
+	return { provide: { [provideName]: service } };
 });
-export {
-  plugin_default as default
-};
+//#endregion
+export { plugin_default as default };
+
 //# sourceMappingURL=plugin.mjs.map

package/dist/runtime/plugin.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/runtime/plugin.ts"],"sourcesContent":["import { defineNuxtPlugin } from '#app';\nimport config from '#build/crypto-config.mjs';\n\nimport { createCryptoService } from '../core/create-service';\n\nexport default defineNuxtPlugin(async () => {\n  const { passphrase, iterations, keyCacheSize, provideName } = config;\n\n  if (!passphrase && (import.meta as ImportMeta & { dev?: boolean }).dev) {\n    // eslint-disable-next-line no-console\n    console.warn(\n      `[@alikhalilll/nuxt-crypto] Missing passphrase — $${provideName} will throw when used.`\n    );\n  }\n\n  const service = await createCryptoService({\n    passphrase: String(passphrase).trim(),\n    iterations,\n    keyCacheSize,\n  });\n\n  return {\n    provide: {\n      [provideName]: service,\n    },\n  };\n});\n"],"mappings":";;;;;;AAAA,SAAS,wBAAwB;AACjC,OAAO,YAAY;AAInB,IAAO,iBAAQ,iBAAiB,YAAY;AAC1C,QAAM,EAAE,YAAY,YAAY,cAAc,YAAY,IAAI;AAE9D,MAAI,CAAC,cAAe,YAA+C,KAAK;AAEtE,YAAQ;AAAA,MACN,yDAAoD,WAAW;AAAA,IACjE;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,oBAAoB;AAAA,IACxC,YAAY,OAAO,UAAU,EAAE,KAAK;AAAA,IACpC;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,SAAS;AAAA,MACP,CAAC,WAAW,GAAG;AAAA,IACjB;AAAA,EACF;AACF,CAAC;","names":[]}
+{"version":3,"file":"plugin.mjs","names":[],"sources":["../../src/runtime/plugin.ts"],"sourcesContent":["import { defineNuxtPlugin } from '#app';\nimport config from '#build/crypto-config.mjs';\n\nimport { createCryptoService } from '../core/create-service';\n\nexport default defineNuxtPlugin(async () => {\n  const { passphrase, iterations, keyCacheSize, provideName } = config;\n\n  if (!passphrase && (import.meta as ImportMeta & { dev?: boolean }).dev) {\n    // eslint-disable-next-line no-console\n    console.warn(\n      `[@alikhalilll/nuxt-crypto] Missing passphrase — $${provideName} will throw when used.`\n    );\n  }\n\n  const service = await createCryptoService({\n    passphrase: String(passphrase).trim(),\n    iterations,\n    keyCacheSize,\n  });\n\n  return {\n    provide: {\n      [provideName]: service,\n    },\n  };\n});\n"],"mappings":";;;;AAKA,IAAA,iBAAe,iBAAiB,YAAY;CAC1C,MAAM,EAAE,YAAY,YAAY,cAAc,gBAAgB;CAE9D,IAAI,CAAC,cAAe,OAAO,KAAwC,KAEjE,QAAQ,KACN,oDAAoD,YAAY,uBAClE;CAGF,MAAM,UAAU,MAAM,oBAAoB;EACxC,YAAY,OAAO,UAAU,EAAE,KAAK;EACpC;EACA;CACF,CAAC;CAED,OAAO,EACL,SAAS,GACN,cAAc,QACjB,EACF;AACF,CAAC"}

package/dist/server/index.d.ts

@@ -1,26 +1,27 @@
-import { setCookie, H3Event } from 'h3';
+import { H3Event, setCookie } from "h3";
 
+//#region src/server/index.d.ts
 type CookieSerializeOptions = NonNullable<Parameters<typeof setCookie>[3]>;
 /**
  * Options for {@link getClientFingerprint}.
  */
 interface ClientFingerprintOptions {
-    /**
-     * Per-app pepper. Stored in a runtime-config secret (e.g.
-     * `NUXT_CRYPTO_FINGERPRINT_SALT`) — keeping it off the client means the
-     * fingerprint can't be reproduced from a leaked device cookie alone.
-     */
-    salt: string;
-    /** Cookie name holding the device ID. Default `__nuxt_crypto_device`. */
-    cookieName?: string;
-    /** Cookie lifetime in seconds. Default 1 year. */
-    cookieMaxAge?: number;
-    /**
-     * Override individual cookie flags. Sensible defaults apply (`httpOnly: true`,
-     * `sameSite: 'lax'`, `path: '/'`, and `secure` auto-detected from the request
-     * protocol).
-     */
-    cookieOptions?: Partial<CookieSerializeOptions>;
+  /**
+   * Per-app pepper. Stored in a runtime-config secret (e.g.
+   * `NUXT_CRYPTO_FINGERPRINT_SALT`) — keeping it off the client means the
+   * fingerprint can't be reproduced from a leaked device cookie alone.
+   */
+  salt: string;
+  /** Cookie name holding the device ID. Default `__nuxt_crypto_device`. */
+  cookieName?: string;
+  /** Cookie lifetime in seconds. Default 1 year. */
+  cookieMaxAge?: number;
+  /**
+   * Override individual cookie flags. Sensible defaults apply (`httpOnly: true`,
+   * `sameSite: 'lax'`, `path: '/'`, and `secure` auto-detected from the request
+   * protocol).
+   */
+  cookieOptions?: Partial<CookieSerializeOptions>;
 }
 /**
  * Pure inputs accepted by {@link deriveFingerprint}. Use this if you already
@@ -28,10 +29,10 @@ interface ClientFingerprintOptions {
  * or a signed JWT) and want to plug a fingerprint into `crypto.encrypt`.
  */
 interface FingerprintParts {
-    /** Opaque, stable per-device identifier. 16+ random bytes recommended. */
-    deviceId: string;
-    /** Per-app pepper. Required. */
-    salt: string;
+  /** Opaque, stable per-device identifier. 16+ random bytes recommended. */
+  deviceId: string;
+  /** Per-app pepper. Required. */
+  salt: string;
 }
 /**
  * Compute a fingerprint string from explicit parts. SHA-256 → base64.
@@ -72,5 +73,6 @@ declare function deriveFingerprint(parts: FingerprintParts): Promise<string>;
  * ```
  */
 declare function getClientFingerprint(event: H3Event, options: ClientFingerprintOptions): Promise<string>;
-
-export { type ClientFingerprintOptions, type FingerprintParts, deriveFingerprint, getClientFingerprint };
+//#endregion
+export { ClientFingerprintOptions, FingerprintParts, deriveFingerprint, getClientFingerprint };
+//# sourceMappingURL=index.d.ts.map

package/dist/server/index.mjs

@@ -1,42 +1,73 @@
-import {
-  getRandomBytes,
-  getSubtle,
-  toBase64
-} from "../chunk-FKXZ7VYW.mjs";
-
-// src/server/index.ts
+import { i as toBase64, n as getSubtle, t as getRandomBytes } from "../subtle-Dh8m0gIA.mjs";
 import { getCookie, getRequestProtocol, setCookie } from "h3";
-var DEFAULT_COOKIE_NAME = "__nuxt_crypto_device";
-var DEFAULT_COOKIE_MAX_AGE = 60 * 60 * 24 * 365;
-var DEVICE_ID_BYTES = 32;
+//#region src/server/index.ts
+const DEFAULT_COOKIE_NAME = "__nuxt_crypto_device";
+const DEFAULT_COOKIE_MAX_AGE = 3600 * 24 * 365;
+const DEVICE_ID_BYTES = 32;
+/**
+* Compute a fingerprint string from explicit parts. SHA-256 → base64.
+*
+* The fingerprint is deterministic — call it twice with the same inputs and
+* you get the same output. That's what lets `crypto.decrypt` succeed on a
+* payload encrypted earlier with the same device ID.
+*/
 async function deriveFingerprint(parts) {
-  const material = `${parts.deviceId}\0${parts.salt}`;
-  const subtle = await getSubtle();
-  const hash = await subtle.digest("SHA-256", new TextEncoder().encode(material));
-  return toBase64(new Uint8Array(hash));
+	const material = `${parts.deviceId}\x00${parts.salt}`;
+	const hash = await (await getSubtle()).digest("SHA-256", new TextEncoder().encode(material));
+	return toBase64(new Uint8Array(hash));
 }
+/**
+* Ensure the client has a persistent HttpOnly device-ID cookie, then derive a
+* fingerprint from it. Call this from Nitro route handlers or server
+* middleware before encrypting / decrypting.
+*
+* Why an HttpOnly cookie (and not the client IP)?
+*   - **Survives network changes.** The cookie travels with the browser, so
+*     Wi-Fi ↔ 4G handoffs, cell-tower roaming, VPN rotations, and residential
+*     IP rotation don't invalidate the fingerprint.
+*   - **Anti-theft.** The cookie is HttpOnly, so XSS-exfiltrated ciphertext
+*     stored in localStorage can't be decrypted — the attacker can't read the
+*     cookie.
+*   - **Per-device / per-browser.** A token copied to another browser or
+*     device finds no device cookie there, so it won't decrypt.
+*
+* @example
+* ```ts
+* // server/api/session.post.ts
+* import { getClientFingerprint } from '@alikhalilll/nuxt-crypto/server';
+*
+* export default defineEventHandler(async (event) => {
+*   const body = await readBody(event);
+*   const { $crypto } = useNuxtApp();
+*   const fingerprint = await getClientFingerprint(event, {
+*     salt: useRuntimeConfig().cryptoFingerprintSalt,
+*   });
+*   return { token: await $crypto.encrypt(JSON.stringify(body), { fingerprint }) };
+* });
+* ```
+*/
 async function getClientFingerprint(event, options) {
-  if (!options.salt) {
-    throw new Error("[nuxt-crypto] getClientFingerprint: `salt` is required.");
-  }
-  const cookieName = options.cookieName ?? DEFAULT_COOKIE_NAME;
-  let deviceId = getCookie(event, cookieName);
-  if (!deviceId) {
-    deviceId = toBase64(getRandomBytes(DEVICE_ID_BYTES));
-    const isSecure = options.cookieOptions?.secure ?? getRequestProtocol(event, { xForwardedProto: true }) === "https";
-    setCookie(event, cookieName, deviceId, {
-      httpOnly: true,
-      sameSite: "lax",
-      path: "/",
-      maxAge: options.cookieMaxAge ?? DEFAULT_COOKIE_MAX_AGE,
-      ...options.cookieOptions,
-      secure: isSecure
-    });
-  }
-  return deriveFingerprint({ deviceId, salt: options.salt });
+	if (!options.salt) throw new Error("[nuxt-crypto] getClientFingerprint: `salt` is required.");
+	const cookieName = options.cookieName ?? DEFAULT_COOKIE_NAME;
+	let deviceId = getCookie(event, cookieName);
+	if (!deviceId) {
+		deviceId = toBase64(getRandomBytes(DEVICE_ID_BYTES));
+		const isSecure = options.cookieOptions?.secure ?? getRequestProtocol(event, { xForwardedProto: true }) === "https";
+		setCookie(event, cookieName, deviceId, {
+			httpOnly: true,
+			sameSite: "lax",
+			path: "/",
+			maxAge: options.cookieMaxAge ?? DEFAULT_COOKIE_MAX_AGE,
+			...options.cookieOptions,
+			secure: isSecure
+		});
+	}
+	return deriveFingerprint({
+		deviceId,
+		salt: options.salt
+	});
 }
-export {
-  deriveFingerprint,
-  getClientFingerprint
-};
+//#endregion
+export { deriveFingerprint, getClientFingerprint };
+
 //# sourceMappingURL=index.mjs.map

package/dist/server/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/index.ts"],"sourcesContent":["import type { H3Event } from 'h3';\nimport { getCookie, getRequestProtocol, setCookie } from 'h3';\n\nimport { toBase64 } from '../core/base64';\nimport { getRandomBytes, getSubtle } from '../core/subtle';\n\n// h3 doesn't re-export its cookie-options type, so derive it from setCookie.\ntype CookieSerializeOptions = NonNullable<Parameters<typeof setCookie>[3]>;\n\nconst DEFAULT_COOKIE_NAME = '__nuxt_crypto_device';\nconst DEFAULT_COOKIE_MAX_AGE = 60 * 60 * 24 * 365; // one year\nconst DEVICE_ID_BYTES = 32;\n\n/**\n * Options for {@link getClientFingerprint}.\n */\nexport interface ClientFingerprintOptions {\n  /**\n   * Per-app pepper. Stored in a runtime-config secret (e.g.\n   * `NUXT_CRYPTO_FINGERPRINT_SALT`) — keeping it off the client means the\n   * fingerprint can't be reproduced from a leaked device cookie alone.\n   */\n  salt: string;\n  /** Cookie name holding the device ID. Default `__nuxt_crypto_device`. */\n  cookieName?: string;\n  /** Cookie lifetime in seconds. Default 1 year. */\n  cookieMaxAge?: number;\n  /**\n   * Override individual cookie flags. Sensible defaults apply (`httpOnly: true`,\n   * `sameSite: 'lax'`, `path: '/'`, and `secure` auto-detected from the request\n   * protocol).\n   */\n  cookieOptions?: Partial<CookieSerializeOptions>;\n}\n\n/**\n * Pure inputs accepted by {@link deriveFingerprint}. Use this if you already\n * manage the device identity yourself (e.g. an existing session-cookie system\n * or a signed JWT) and want to plug a fingerprint into `crypto.encrypt`.\n */\nexport interface FingerprintParts {\n  /** Opaque, stable per-device identifier. 16+ random bytes recommended. */\n  deviceId: string;\n  /** Per-app pepper. Required. */\n  salt: string;\n}\n\n/**\n * Compute a fingerprint string from explicit parts. SHA-256 → base64.\n *\n * The fingerprint is deterministic — call it twice with the same inputs and\n * you get the same output. That's what lets `crypto.decrypt` succeed on a\n * payload encrypted earlier with the same device ID.\n */\nexport async function deriveFingerprint(parts: FingerprintParts): Promise<string> {\n  // NUL separator prevents `\"abc\" + \"d\"` vs `\"ab\" + \"cd\"` collisions.\n  const material = `${parts.deviceId}\\x00${parts.salt}`;\n  const subtle = await getSubtle();\n  const hash = await subtle.digest('SHA-256', new TextEncoder().encode(material));\n  return toBase64(new Uint8Array(hash));\n}\n\n/**\n * Ensure the client has a persistent HttpOnly device-ID cookie, then derive a\n * fingerprint from it. Call this from Nitro route handlers or server\n * middleware before encrypting / decrypting.\n *\n * Why an HttpOnly cookie (and not the client IP)?\n *   - **Survives network changes.** The cookie travels with the browser, so\n *     Wi-Fi ↔ 4G handoffs, cell-tower roaming, VPN rotations, and residential\n *     IP rotation don't invalidate the fingerprint.\n *   - **Anti-theft.** The cookie is HttpOnly, so XSS-exfiltrated ciphertext\n *     stored in localStorage can't be decrypted — the attacker can't read the\n *     cookie.\n *   - **Per-device / per-browser.** A token copied to another browser or\n *     device finds no device cookie there, so it won't decrypt.\n *\n * @example\n * ```ts\n * // server/api/session.post.ts\n * import { getClientFingerprint } from '@alikhalilll/nuxt-crypto/server';\n *\n * export default defineEventHandler(async (event) => {\n *   const body = await readBody(event);\n *   const { $crypto } = useNuxtApp();\n *   const fingerprint = await getClientFingerprint(event, {\n *     salt: useRuntimeConfig().cryptoFingerprintSalt,\n *   });\n *   return { token: await $crypto.encrypt(JSON.stringify(body), { fingerprint }) };\n * });\n * ```\n */\nexport async function getClientFingerprint(\n  event: H3Event,\n  options: ClientFingerprintOptions\n): Promise<string> {\n  if (!options.salt) {\n    throw new Error('[nuxt-crypto] getClientFingerprint: `salt` is required.');\n  }\n\n  const cookieName = options.cookieName ?? DEFAULT_COOKIE_NAME;\n  let deviceId = getCookie(event, cookieName);\n\n  if (!deviceId) {\n    deviceId = toBase64(getRandomBytes(DEVICE_ID_BYTES));\n    const isSecure =\n      options.cookieOptions?.secure ??\n      getRequestProtocol(event, { xForwardedProto: true }) === 'https';\n    setCookie(event, cookieName, deviceId, {\n      httpOnly: true,\n      sameSite: 'lax',\n      path: '/',\n      maxAge: options.cookieMaxAge ?? DEFAULT_COOKIE_MAX_AGE,\n      ...options.cookieOptions,\n      secure: isSecure,\n    });\n  }\n\n  return deriveFingerprint({ deviceId, salt: options.salt });\n}\n"],"mappings":";;;;;;;AACA,SAAS,WAAW,oBAAoB,iBAAiB;AAQzD,IAAM,sBAAsB;AAC5B,IAAM,yBAAyB,KAAK,KAAK,KAAK;AAC9C,IAAM,kBAAkB;AA2CxB,eAAsB,kBAAkB,OAA0C;AAEhF,QAAM,WAAW,GAAG,MAAM,QAAQ,KAAO,MAAM,IAAI;AACnD,QAAM,SAAS,MAAM,UAAU;AAC/B,QAAM,OAAO,MAAM,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC;AAC9E,SAAO,SAAS,IAAI,WAAW,IAAI,CAAC;AACtC;AAgCA,eAAsB,qBACpB,OACA,SACiB;AACjB,MAAI,CAAC,QAAQ,MAAM;AACjB,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AAEA,QAAM,aAAa,QAAQ,cAAc;AACzC,MAAI,WAAW,UAAU,OAAO,UAAU;AAE1C,MAAI,CAAC,UAAU;AACb,eAAW,SAAS,eAAe,eAAe,CAAC;AACnD,UAAM,WACJ,QAAQ,eAAe,UACvB,mBAAmB,OAAO,EAAE,iBAAiB,KAAK,CAAC,MAAM;AAC3D,cAAU,OAAO,YAAY,UAAU;AAAA,MACrC,UAAU;AAAA,MACV,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ,QAAQ,gBAAgB;AAAA,MAChC,GAAG,QAAQ;AAAA,MACX,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AAEA,SAAO,kBAAkB,EAAE,UAAU,MAAM,QAAQ,KAAK,CAAC;AAC3D;","names":[]}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/server/index.ts"],"sourcesContent":["import type { H3Event } from 'h3';\nimport { getCookie, getRequestProtocol, setCookie } from 'h3';\n\nimport { toBase64 } from '../core/base64';\nimport { getRandomBytes, getSubtle } from '../core/subtle';\n\n// h3 doesn't re-export its cookie-options type, so derive it from setCookie.\ntype CookieSerializeOptions = NonNullable<Parameters<typeof setCookie>[3]>;\n\nconst DEFAULT_COOKIE_NAME = '__nuxt_crypto_device';\nconst DEFAULT_COOKIE_MAX_AGE = 60 * 60 * 24 * 365; // one year\nconst DEVICE_ID_BYTES = 32;\n\n/**\n * Options for {@link getClientFingerprint}.\n */\nexport interface ClientFingerprintOptions {\n  /**\n   * Per-app pepper. Stored in a runtime-config secret (e.g.\n   * `NUXT_CRYPTO_FINGERPRINT_SALT`) — keeping it off the client means the\n   * fingerprint can't be reproduced from a leaked device cookie alone.\n   */\n  salt: string;\n  /** Cookie name holding the device ID. Default `__nuxt_crypto_device`. */\n  cookieName?: string;\n  /** Cookie lifetime in seconds. Default 1 year. */\n  cookieMaxAge?: number;\n  /**\n   * Override individual cookie flags. Sensible defaults apply (`httpOnly: true`,\n   * `sameSite: 'lax'`, `path: '/'`, and `secure` auto-detected from the request\n   * protocol).\n   */\n  cookieOptions?: Partial<CookieSerializeOptions>;\n}\n\n/**\n * Pure inputs accepted by {@link deriveFingerprint}. Use this if you already\n * manage the device identity yourself (e.g. an existing session-cookie system\n * or a signed JWT) and want to plug a fingerprint into `crypto.encrypt`.\n */\nexport interface FingerprintParts {\n  /** Opaque, stable per-device identifier. 16+ random bytes recommended. */\n  deviceId: string;\n  /** Per-app pepper. Required. */\n  salt: string;\n}\n\n/**\n * Compute a fingerprint string from explicit parts. SHA-256 → base64.\n *\n * The fingerprint is deterministic — call it twice with the same inputs and\n * you get the same output. That's what lets `crypto.decrypt` succeed on a\n * payload encrypted earlier with the same device ID.\n */\nexport async function deriveFingerprint(parts: FingerprintParts): Promise<string> {\n  // NUL separator prevents `\"abc\" + \"d\"` vs `\"ab\" + \"cd\"` collisions.\n  const material = `${parts.deviceId}\\x00${parts.salt}`;\n  const subtle = await getSubtle();\n  const hash = await subtle.digest('SHA-256', new TextEncoder().encode(material));\n  return toBase64(new Uint8Array(hash));\n}\n\n/**\n * Ensure the client has a persistent HttpOnly device-ID cookie, then derive a\n * fingerprint from it. Call this from Nitro route handlers or server\n * middleware before encrypting / decrypting.\n *\n * Why an HttpOnly cookie (and not the client IP)?\n *   - **Survives network changes.** The cookie travels with the browser, so\n *     Wi-Fi ↔ 4G handoffs, cell-tower roaming, VPN rotations, and residential\n *     IP rotation don't invalidate the fingerprint.\n *   - **Anti-theft.** The cookie is HttpOnly, so XSS-exfiltrated ciphertext\n *     stored in localStorage can't be decrypted — the attacker can't read the\n *     cookie.\n *   - **Per-device / per-browser.** A token copied to another browser or\n *     device finds no device cookie there, so it won't decrypt.\n *\n * @example\n * ```ts\n * // server/api/session.post.ts\n * import { getClientFingerprint } from '@alikhalilll/nuxt-crypto/server';\n *\n * export default defineEventHandler(async (event) => {\n *   const body = await readBody(event);\n *   const { $crypto } = useNuxtApp();\n *   const fingerprint = await getClientFingerprint(event, {\n *     salt: useRuntimeConfig().cryptoFingerprintSalt,\n *   });\n *   return { token: await $crypto.encrypt(JSON.stringify(body), { fingerprint }) };\n * });\n * ```\n */\nexport async function getClientFingerprint(\n  event: H3Event,\n  options: ClientFingerprintOptions\n): Promise<string> {\n  if (!options.salt) {\n    throw new Error('[nuxt-crypto] getClientFingerprint: `salt` is required.');\n  }\n\n  const cookieName = options.cookieName ?? DEFAULT_COOKIE_NAME;\n  let deviceId = getCookie(event, cookieName);\n\n  if (!deviceId) {\n    deviceId = toBase64(getRandomBytes(DEVICE_ID_BYTES));\n    const isSecure =\n      options.cookieOptions?.secure ??\n      getRequestProtocol(event, { xForwardedProto: true }) === 'https';\n    setCookie(event, cookieName, deviceId, {\n      httpOnly: true,\n      sameSite: 'lax',\n      path: '/',\n      maxAge: options.cookieMaxAge ?? DEFAULT_COOKIE_MAX_AGE,\n      ...options.cookieOptions,\n      secure: isSecure,\n    });\n  }\n\n  return deriveFingerprint({ deviceId, salt: options.salt });\n}\n"],"mappings":";;;AASA,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB,OAAU,KAAK;AAC9C,MAAM,kBAAkB;;;;;;;;AA2CxB,eAAsB,kBAAkB,OAA0C;CAEhF,MAAM,WAAW,GAAG,MAAM,SAAS,MAAM,MAAM;CAE/C,MAAM,OAAO,OAAM,MADE,UAAU,GACL,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC;CAC9E,OAAO,SAAS,IAAI,WAAW,IAAI,CAAC;AACtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,eAAsB,qBACpB,OACA,SACiB;CACjB,IAAI,CAAC,QAAQ,MACX,MAAM,IAAI,MAAM,yDAAyD;CAG3E,MAAM,aAAa,QAAQ,cAAc;CACzC,IAAI,WAAW,UAAU,OAAO,UAAU;CAE1C,IAAI,CAAC,UAAU;EACb,WAAW,SAAS,eAAe,eAAe,CAAC;EACnD,MAAM,WACJ,QAAQ,eAAe,UACvB,mBAAmB,OAAO,EAAE,iBAAiB,KAAK,CAAC,MAAM;EAC3D,UAAU,OAAO,YAAY,UAAU;GACrC,UAAU;GACV,UAAU;GACV,MAAM;GACN,QAAQ,QAAQ,gBAAgB;GAChC,GAAG,QAAQ;GACX,QAAQ;EACV,CAAC;CACH;CAEA,OAAO,kBAAkB;EAAE;EAAU,MAAM,QAAQ;CAAK,CAAC;AAC3D"}

package/dist/subtle-Dh8m0gIA.mjs

@@ -0,0 +1,51 @@
+//#region src/core/base64.ts
+/** Encode bytes to standard base64. Works in browser and Node. */
+function toBase64(data) {
+	if (typeof btoa === "function") {
+		let binary = "";
+		const CHUNK = 32768;
+		for (let i = 0; i < data.length; i += CHUNK) binary += String.fromCharCode(...data.subarray(i, i + CHUNK));
+		return btoa(binary);
+	}
+	return Buffer.from(data).toString("base64");
+}
+/** Decode a base64 string back to bytes. Works in browser and Node. */
+function fromBase64(input) {
+	if (typeof atob === "function") {
+		const binary = atob(input);
+		const out = new Uint8Array(binary.length);
+		for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+		return out;
+	}
+	const buf = Buffer.from(input, "base64");
+	const out = new Uint8Array(buf.length);
+	out.set(buf);
+	return out;
+}
+//#endregion
+//#region src/core/subtle.ts
+/**
+* Resolve a SubtleCrypto implementation across environments:
+*
+* - Browser / Deno / Bun / Node 20+: `globalThis.crypto.subtle` is available.
+* - Older Node: fall back to `node:crypto`'s `webcrypto`.
+*/
+async function getSubtle() {
+	if (globalThis.crypto?.subtle) return globalThis.crypto.subtle;
+	const { webcrypto } = await import("node:crypto");
+	return webcrypto.subtle;
+}
+/** Fill the given buffer with cryptographically strong random bytes. */
+function getRandomBytes(length) {
+	const out = new Uint8Array(length);
+	const c = globalThis.crypto;
+	if (c?.getRandomValues) {
+		c.getRandomValues(out);
+		return out;
+	}
+	throw new Error("[nuxt-crypto] globalThis.crypto.getRandomValues is not available. Upgrade your runtime.");
+}
+//#endregion
+export { toBase64 as i, getSubtle as n, fromBase64 as r, getRandomBytes as t };
+
+//# sourceMappingURL=subtle-Dh8m0gIA.mjs.map

package/dist/subtle-Dh8m0gIA.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"subtle-Dh8m0gIA.mjs","names":[],"sources":["../src/core/base64.ts","../src/core/subtle.ts"],"sourcesContent":["import type { Bytes } from './types';\n\n/** Encode bytes to standard base64. Works in browser and Node. */\nexport function toBase64(data: Bytes): string {\n  if (typeof btoa === 'function') {\n    let binary = '';\n    const CHUNK = 0x8000;\n    for (let i = 0; i < data.length; i += CHUNK) {\n      binary += String.fromCharCode(...data.subarray(i, i + CHUNK));\n    }\n    return btoa(binary);\n  }\n  // Node fallback — Buffer is globally available in Node.\n  return Buffer.from(data).toString('base64');\n}\n\n/** Decode a base64 string back to bytes. Works in browser and Node. */\nexport function fromBase64(input: string): Bytes {\n  if (typeof atob === 'function') {\n    const binary = atob(input);\n    const out = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);\n    return out;\n  }\n  const buf = Buffer.from(input, 'base64');\n  const out = new Uint8Array(buf.length);\n  out.set(buf);\n  return out;\n}\n","/**\n * Resolve a SubtleCrypto implementation across environments:\n *\n * - Browser / Deno / Bun / Node 20+: `globalThis.crypto.subtle` is available.\n * - Older Node: fall back to `node:crypto`'s `webcrypto`.\n */\nexport async function getSubtle(): Promise<SubtleCrypto> {\n  if (globalThis.crypto?.subtle) return globalThis.crypto.subtle;\n  const { webcrypto } = await import('node:crypto');\n  return webcrypto.subtle as unknown as SubtleCrypto;\n}\n\n/** Fill the given buffer with cryptographically strong random bytes. */\nexport function getRandomBytes(length: number): Uint8Array<ArrayBuffer> {\n  const out = new Uint8Array(length);\n  const c = globalThis.crypto;\n  if (c?.getRandomValues) {\n    c.getRandomValues(out);\n    return out;\n  }\n  throw new Error(\n    '[nuxt-crypto] globalThis.crypto.getRandomValues is not available. Upgrade your runtime.'\n  );\n}\n"],"mappings":";;AAGA,SAAgB,SAAS,MAAqB;CAC5C,IAAI,OAAO,SAAS,YAAY;EAC9B,IAAI,SAAS;EACb,MAAM,QAAQ;EACd,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,OACpC,UAAU,OAAO,aAAa,GAAG,KAAK,SAAS,GAAG,IAAI,KAAK,CAAC;EAE9D,OAAO,KAAK,MAAM;CACpB;CAEA,OAAO,OAAO,KAAK,IAAI,EAAE,SAAS,QAAQ;AAC5C;;AAGA,SAAgB,WAAW,OAAsB;CAC/C,IAAI,OAAO,SAAS,YAAY;EAC9B,MAAM,SAAS,KAAK,KAAK;EACzB,MAAM,MAAM,IAAI,WAAW,OAAO,MAAM;EACxC,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,IAAI,KAAK,OAAO,WAAW,CAAC;EACpE,OAAO;CACT;CACA,MAAM,MAAM,OAAO,KAAK,OAAO,QAAQ;CACvC,MAAM,MAAM,IAAI,WAAW,IAAI,MAAM;CACrC,IAAI,IAAI,GAAG;CACX,OAAO;AACT;;;;;;;;;ACtBA,eAAsB,YAAmC;CACvD,IAAI,WAAW,QAAQ,QAAQ,OAAO,WAAW,OAAO;CACxD,MAAM,EAAE,cAAc,MAAM,OAAO;CACnC,OAAO,UAAU;AACnB;;AAGA,SAAgB,eAAe,QAAyC;CACtE,MAAM,MAAM,IAAI,WAAW,MAAM;CACjC,MAAM,IAAI,WAAW;CACrB,IAAI,GAAG,iBAAiB;EACtB,EAAE,gBAAgB,GAAG;EACrB,OAAO;CACT;CACA,MAAM,IAAI,MACR,yFACF;AACF"}

package/dist/types/index.d.ts

@@ -1,30 +1,3 @@
-export { B as Bytes, C as CryptoAlgorithm, a as CryptoOperationOptions, b as CryptoService, c as CryptoServiceConfig, P as ParsedPayload } from '../payload-BOueSWcI.js';
-
-interface CryptoModuleOptions {
-    /**
-     * Passphrase used to derive the AES key. Prefer wiring this from a
-     * runtime config env var (e.g. `NUXT_ENCRYPTION_PASSPHRASE`) rather than
-     * committing it.
-     */
-    passphrase: string;
-    /**
-     * Name under which the service is provided. Accepts `$crypto` or `crypto`
-     * — the leading `$` is stripped. Default: `$crypto`.
-     */
-    provideName?: string;
-    /** PBKDF2 iterations. Default 100_000. */
-    iterations?: number;
-    /**
-     * Max number of derived keys held in memory. Default 64. Set to 0 to
-     * disable caching.
-     */
-    keyCacheSize?: number;
-    /**
-     * When `true`, the runtime plugin is only registered on the server. Useful
-     * when you do not want the plaintext passphrase shipped to the browser.
-     * Default: `false`.
-     */
-    serverOnly?: boolean;
-}
-
-export type { CryptoModuleOptions };
+import { a as CryptoAlgorithm, c as CryptoServiceConfig, i as Bytes, o as CryptoOperationOptions, s as CryptoService, t as ParsedPayload } from "../payload-CvzYMicC.js";
+import { t as CryptoModuleOptions } from "../index-DkMNygRG.js";
+export type { Bytes, CryptoAlgorithm, CryptoModuleOptions, CryptoOperationOptions, CryptoService, CryptoServiceConfig, ParsedPayload };

package/dist/types/index.mjs

@@ -1,2 +0,0 @@
-import "../chunk-EFZPSZWO.mjs";
-//# sourceMappingURL=index.mjs.map

package/logo.svg

@@ -0,0 +1,23 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" fill="none">
+  <circle cx="32" cy="32" r="26" stroke="currentColor" stroke-width="2.5"/>
+  <g stroke="currentColor" stroke-width="2.5" stroke-linecap="round">
+    <g transform="translate(20 32)">
+      <line x1="-4" y1="0" x2="4" y2="0"/>
+      <line x1="0" y1="-4" x2="0" y2="4"/>
+      <line x1="-3" y1="-3" x2="3" y2="3"/>
+      <line x1="3" y1="-3" x2="-3" y2="3"/>
+    </g>
+    <g transform="translate(32 32)">
+      <line x1="-4" y1="0" x2="4" y2="0"/>
+      <line x1="0" y1="-4" x2="0" y2="4"/>
+      <line x1="-3" y1="-3" x2="3" y2="3"/>
+      <line x1="3" y1="-3" x2="-3" y2="3"/>
+    </g>
+    <g transform="translate(44 32)">
+      <line x1="-4" y1="0" x2="4" y2="0"/>
+      <line x1="0" y1="-4" x2="0" y2="4"/>
+      <line x1="-3" y1="-3" x2="3" y2="3"/>
+      <line x1="3" y1="-3" x2="-3" y2="3"/>
+    </g>
+  </g>
+</svg>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alikhalilll/nuxt-crypto",
-  "version": "1.2.1",
+  "version": "1.3.1",
   "description": "Symmetric Web Crypto service for Nuxt 3/4. AES-256-GCM + PBKDF2 with key caching, pluggable algorithms, and optional device-fingerprint binding.",
   "license": "MIT",
   "author": "alikhalilll",
@@ -66,6 +66,9 @@
   },
   "files": [
     "dist",
+    "logo.svg",
+    "logo-dark.png",
+    "logo-light.png",
     "README.md",
     "LICENSE"
   ],
@@ -90,12 +93,16 @@
     "@types/node": "^22.13.0",
     "h3": "^1.13.0",
     "rimraf": "^6.0.1",
-    "tsup": "^8.5.0",
-    "typescript": "^5.9.2"
+    "tsdown": "0.22.0",
+    "typescript": "^5.9.2",
+    "unrun": "0.3.0"
   },
   "scripts": {
     "clean": "rimraf dist",
-    "build": "pnpm clean && tsup",
-    "typecheck": "tsc --noEmit -p tsconfig.json"
+    "build": "tsdown",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "validate-dist": "tsx ../../scripts/validate/dist-validate.ts --pkg crypto",
+    "validate-consumer": "tsx ../../scripts/validate/consumer-validate.ts --pkg crypto",
+    "validate": "pnpm build && pnpm validate-dist && pnpm validate-consumer"
   }
 }

package/dist/chunk-EFZPSZWO.mjs

@@ -1 +0,0 @@
-//# sourceMappingURL=chunk-EFZPSZWO.mjs.map

package/dist/chunk-EFZPSZWO.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/chunk-FKHKOTFR.mjs

@@ -1,160 +0,0 @@
-import {
-  fromBase64,
-  getRandomBytes,
-  getSubtle,
-  toBase64
-} from "./chunk-FKXZ7VYW.mjs";
-
-// src/core/algorithms/aes-gcm.ts
-var aesGcmPbkdf2 = {
-  version: "v1",
-  async deriveKey({ subtle, passphrase, fingerprint, salt, iterations }) {
-    const material = fingerprint ? `${passphrase}\0${fingerprint}` : passphrase;
-    const keyMaterial = await subtle.importKey(
-      "raw",
-      new TextEncoder().encode(material),
-      { name: "PBKDF2" },
-      false,
-      ["deriveKey"]
-    );
-    return subtle.deriveKey(
-      { name: "PBKDF2", salt, iterations, hash: "SHA-256" },
-      keyMaterial,
-      { name: "AES-GCM", length: 256 },
-      false,
-      ["encrypt", "decrypt"]
-    );
-  },
-  async encrypt({ subtle, key, plainText }) {
-    const iv = new Uint8Array(new ArrayBuffer(12));
-    globalThis.crypto.getRandomValues(iv);
-    const buf = await subtle.encrypt({ name: "AES-GCM", iv }, key, plainText);
-    const cipher = new Uint8Array(new ArrayBuffer(buf.byteLength));
-    cipher.set(new Uint8Array(buf));
-    return { cipher, iv };
-  },
-  async decrypt({ subtle, key, cipher, iv }) {
-    const buf = await subtle.decrypt({ name: "AES-GCM", iv }, key, cipher);
-    const out = new Uint8Array(new ArrayBuffer(buf.byteLength));
-    out.set(new Uint8Array(buf));
-    return out;
-  }
-};
-
-// src/core/key-cache.ts
-var KeyCache = class {
-  constructor(capacity) {
-    this.capacity = capacity;
-  }
-  capacity;
-  map = /* @__PURE__ */ new Map();
-  static key(salt, iterations, fingerprint) {
-    return `${iterations}.${fingerprint ?? ""}.${toBase64(salt)}`;
-  }
-  get(key) {
-    const value = this.map.get(key);
-    if (!value) return void 0;
-    this.map.delete(key);
-    this.map.set(key, value);
-    return value;
-  }
-  set(key, value) {
-    if (this.capacity <= 0) return;
-    this.map.set(key, value);
-    while (this.map.size > this.capacity) {
-      const oldest = this.map.keys().next().value;
-      if (oldest === void 0) break;
-      this.map.delete(oldest);
-    }
-  }
-  clear() {
-    this.map.clear();
-  }
-};
-
-// src/core/payload.ts
-function encodePayload(parts) {
-  return [parts.version, toBase64(parts.salt), toBase64(parts.iv), toBase64(parts.cipher)].join(
-    "."
-  );
-}
-function parsePayload(payload) {
-  const segments = payload.split(".");
-  if (segments.length !== 4) {
-    throw new Error("[nuxt-crypto] Invalid payload format \u2014 expected 4 dot-separated segments.");
-  }
-  const [version, saltB64, ivB64, cipherB64] = segments;
-  if (!version || !saltB64 || !ivB64 || !cipherB64) {
-    throw new Error("[nuxt-crypto] Invalid payload format \u2014 one or more segments were empty.");
-  }
-  return {
-    version,
-    salt: fromBase64(saltB64),
-    iv: fromBase64(ivB64),
-    cipher: fromBase64(cipherB64)
-  };
-}
-
-// src/core/create-service.ts
-var DEFAULT_ITERATIONS = 1e5;
-var DEFAULT_CACHE = 64;
-var SALT_BYTES = 16;
-async function createCryptoService(config) {
-  if (!config.passphrase) {
-    throw new Error("[nuxt-crypto] passphrase is required.");
-  }
-  const iterations = config.iterations ?? DEFAULT_ITERATIONS;
-  const algorithm = config.algorithm ?? aesGcmPbkdf2;
-  const subtle = config.subtle ?? await getSubtle();
-  const cache = new KeyCache(config.keyCacheSize ?? DEFAULT_CACHE);
-  const passphrase = String(config.passphrase).trim();
-  const encoder = new TextEncoder();
-  const decoder = new TextDecoder();
-  async function getDerivedKey(salt, fingerprint) {
-    const key = KeyCache.key(salt, iterations, fingerprint);
-    const cached = cache.get(key);
-    if (cached) return cached;
-    const pending = algorithm.deriveKey({ subtle, passphrase, fingerprint, salt, iterations });
-    cache.set(key, pending);
-    return pending;
-  }
-  return {
-    async encrypt(plainText, options) {
-      const salt = getRandomBytes(SALT_BYTES);
-      const key = await getDerivedKey(salt, options?.fingerprint);
-      const encoded = encoder.encode(plainText);
-      const plainBytes = new Uint8Array(new ArrayBuffer(encoded.byteLength));
-      plainBytes.set(encoded);
-      const { cipher, iv } = await algorithm.encrypt({ subtle, key, plainText: plainBytes });
-      return encodePayload({ version: algorithm.version, salt, iv, cipher });
-    },
-    async decrypt(payload, options) {
-      const parsed = parsePayload(payload);
-      if (parsed.version !== algorithm.version) {
-        throw new Error(
-          `[nuxt-crypto] Unsupported payload version: ${parsed.version} (algorithm expects ${algorithm.version}).`
-        );
-      }
-      const key = await getDerivedKey(parsed.salt, options?.fingerprint);
-      const plainBytes = await algorithm.decrypt({
-        subtle,
-        key,
-        cipher: parsed.cipher,
-        iv: parsed.iv
-      });
-      return decoder.decode(plainBytes);
-    },
-    clearKeyCache() {
-      cache.clear();
-    }
-  };
-}
-
-export {
-  aesGcmPbkdf2,
-  KeyCache,
-  encodePayload,
-  parsePayload,
-  createCryptoService
-};
-//# sourceMappingURL=chunk-FKHKOTFR.mjs.map

package/dist/chunk-FKHKOTFR.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/core/algorithms/aes-gcm.ts","../src/core/key-cache.ts","../src/core/payload.ts","../src/core/create-service.ts"],"sourcesContent":["import type { CryptoAlgorithm } from '../types';\n\n/**\n * AES-256-GCM with PBKDF2-SHA256 key derivation. This is the default and\n * currently the only built-in algorithm; pluggable via `CryptoServiceConfig.algorithm`.\n */\nexport const aesGcmPbkdf2: CryptoAlgorithm = {\n  version: 'v1',\n\n  async deriveKey({ subtle, passphrase, fingerprint, salt, iterations }) {\n    // NUL separator prevents `\"ab\" + \"cd\"` and `\"abc\" + \"d\"` from colliding.\n    const material = fingerprint ? `${passphrase}\\x00${fingerprint}` : passphrase;\n    const keyMaterial = await subtle.importKey(\n      'raw',\n      new TextEncoder().encode(material),\n      { name: 'PBKDF2' },\n      false,\n      ['deriveKey']\n    );\n\n    return subtle.deriveKey(\n      { name: 'PBKDF2', salt, iterations, hash: 'SHA-256' },\n      keyMaterial,\n      { name: 'AES-GCM', length: 256 },\n      false,\n      ['encrypt', 'decrypt']\n    );\n  },\n\n  async encrypt({ subtle, key, plainText }) {\n    const iv = new Uint8Array(new ArrayBuffer(12));\n    globalThis.crypto.getRandomValues(iv);\n    const buf = await subtle.encrypt({ name: 'AES-GCM', iv }, key, plainText);\n    const cipher = new Uint8Array(new ArrayBuffer(buf.byteLength));\n    cipher.set(new Uint8Array(buf));\n    return { cipher, iv };\n  },\n\n  async decrypt({ subtle, key, cipher, iv }) {\n    const buf = await subtle.decrypt({ name: 'AES-GCM', iv }, key, cipher);\n    const out = new Uint8Array(new ArrayBuffer(buf.byteLength));\n    out.set(new Uint8Array(buf));\n    return out;\n  },\n};\n","import type { Bytes } from './types';\nimport { toBase64 } from './base64';\n\n/**\n * A tiny LRU-ish cache for derived `CryptoKey` values, keyed on the salt.\n * When capacity is exceeded the oldest entry is evicted. Derived key\n * material is expensive (PBKDF2 is designed to be slow), so caching has\n * a big impact when decrypting many payloads in a row.\n */\nexport class KeyCache {\n  private readonly map = new Map<string, Promise<CryptoKey>>();\n  constructor(private readonly capacity: number) {}\n\n  static key(salt: Bytes, iterations: number, fingerprint?: string): string {\n    // `.` separates the fields; iterations and base64 can't contain one,\n    // so the joined key is unambiguous even when fingerprint is empty.\n    return `${iterations}.${fingerprint ?? ''}.${toBase64(salt)}`;\n  }\n\n  get(key: string): Promise<CryptoKey> | undefined {\n    const value = this.map.get(key);\n    if (!value) return undefined;\n    // Refresh recency by re-inserting.\n    this.map.delete(key);\n    this.map.set(key, value);\n    return value;\n  }\n\n  set(key: string, value: Promise<CryptoKey>): void {\n    if (this.capacity <= 0) return;\n    this.map.set(key, value);\n    while (this.map.size > this.capacity) {\n      const oldest = this.map.keys().next().value;\n      if (oldest === undefined) break;\n      this.map.delete(oldest);\n    }\n  }\n\n  clear(): void {\n    this.map.clear();\n  }\n}\n","import { fromBase64, toBase64 } from './base64';\nimport type { Bytes } from './types';\n\n/**\n * Payload serialisation format (v1): `${version}.${saltB64}.${ivB64}.${cipherB64}`.\n *\n * Each part is URL-safe base64, all joined with `.`. The version tag is\n * always the first segment so consumers can route to the correct algorithm\n * during decrypt.\n */\nexport interface ParsedPayload {\n  version: string;\n  salt: Bytes;\n  iv: Bytes;\n  cipher: Bytes;\n}\n\nexport function encodePayload(parts: ParsedPayload): string {\n  return [parts.version, toBase64(parts.salt), toBase64(parts.iv), toBase64(parts.cipher)].join(\n    '.'\n  );\n}\n\nexport function parsePayload(payload: string): ParsedPayload {\n  const segments = payload.split('.');\n  if (segments.length !== 4) {\n    throw new Error('[nuxt-crypto] Invalid payload format — expected 4 dot-separated segments.');\n  }\n  const [version, saltB64, ivB64, cipherB64] = segments;\n  if (!version || !saltB64 || !ivB64 || !cipherB64) {\n    throw new Error('[nuxt-crypto] Invalid payload format — one or more segments were empty.');\n  }\n  return {\n    version,\n    salt: fromBase64(saltB64),\n    iv: fromBase64(ivB64),\n    cipher: fromBase64(cipherB64),\n  };\n}\n","import { aesGcmPbkdf2 } from './algorithms/aes-gcm';\nimport { KeyCache } from './key-cache';\nimport { encodePayload, parsePayload } from './payload';\nimport { getRandomBytes, getSubtle } from './subtle';\nimport type { CryptoAlgorithm, CryptoService, CryptoServiceConfig } from './types';\n\nconst DEFAULT_ITERATIONS = 100_000;\nconst DEFAULT_CACHE = 64;\nconst SALT_BYTES = 16;\n\n/**\n * Create a framework-agnostic `CryptoService` from a passphrase.\n *\n * Uses AES-256-GCM with PBKDF2-SHA256 (100k iterations by default). Pass a\n * different `algorithm` to plug in another cipher while preserving the same\n * versioned payload envelope.\n */\nexport async function createCryptoService(config: CryptoServiceConfig): Promise<CryptoService> {\n  if (!config.passphrase) {\n    throw new Error('[nuxt-crypto] passphrase is required.');\n  }\n\n  const iterations = config.iterations ?? DEFAULT_ITERATIONS;\n  const algorithm: CryptoAlgorithm = config.algorithm ?? aesGcmPbkdf2;\n  const subtle = config.subtle ?? (await getSubtle());\n  const cache = new KeyCache(config.keyCacheSize ?? DEFAULT_CACHE);\n  const passphrase = String(config.passphrase).trim();\n  const encoder = new TextEncoder();\n  const decoder = new TextDecoder();\n\n  async function getDerivedKey(\n    salt: Uint8Array<ArrayBuffer>,\n    fingerprint?: string\n  ): Promise<CryptoKey> {\n    const key = KeyCache.key(salt, iterations, fingerprint);\n    const cached = cache.get(key);\n    if (cached) return cached;\n    const pending = algorithm.deriveKey({ subtle, passphrase, fingerprint, salt, iterations });\n    cache.set(key, pending);\n    return pending;\n  }\n\n  return {\n    async encrypt(plainText, options) {\n      const salt = getRandomBytes(SALT_BYTES);\n      const key = await getDerivedKey(salt, options?.fingerprint);\n      const encoded = encoder.encode(plainText);\n      const plainBytes = new Uint8Array(new ArrayBuffer(encoded.byteLength));\n      plainBytes.set(encoded);\n      const { cipher, iv } = await algorithm.encrypt({ subtle, key, plainText: plainBytes });\n      return encodePayload({ version: algorithm.version, salt, iv, cipher });\n    },\n\n    async decrypt(payload, options) {\n      const parsed = parsePayload(payload);\n      if (parsed.version !== algorithm.version) {\n        throw new Error(\n          `[nuxt-crypto] Unsupported payload version: ${parsed.version} (algorithm expects ${algorithm.version}).`\n        );\n      }\n      const key = await getDerivedKey(parsed.salt, options?.fingerprint);\n      const plainBytes = await algorithm.decrypt({\n        subtle,\n        key,\n        cipher: parsed.cipher,\n        iv: parsed.iv,\n      });\n      return decoder.decode(plainBytes);\n    },\n\n    clearKeyCache(): void {\n      cache.clear();\n    },\n  };\n}\n"],"mappings":";;;;;;;;AAMO,IAAM,eAAgC;AAAA,EAC3C,SAAS;AAAA,EAET,MAAM,UAAU,EAAE,QAAQ,YAAY,aAAa,MAAM,WAAW,GAAG;AAErE,UAAM,WAAW,cAAc,GAAG,UAAU,KAAO,WAAW,KAAK;AACnE,UAAM,cAAc,MAAM,OAAO;AAAA,MAC/B;AAAA,MACA,IAAI,YAAY,EAAE,OAAO,QAAQ;AAAA,MACjC,EAAE,MAAM,SAAS;AAAA,MACjB;AAAA,MACA,CAAC,WAAW;AAAA,IACd;AAEA,WAAO,OAAO;AAAA,MACZ,EAAE,MAAM,UAAU,MAAM,YAAY,MAAM,UAAU;AAAA,MACpD;AAAA,MACA,EAAE,MAAM,WAAW,QAAQ,IAAI;AAAA,MAC/B;AAAA,MACA,CAAC,WAAW,SAAS;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,EAAE,QAAQ,KAAK,UAAU,GAAG;AACxC,UAAM,KAAK,IAAI,WAAW,IAAI,YAAY,EAAE,CAAC;AAC7C,eAAW,OAAO,gBAAgB,EAAE;AACpC,UAAM,MAAM,MAAM,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,SAAS;AACxE,UAAM,SAAS,IAAI,WAAW,IAAI,YAAY,IAAI,UAAU,CAAC;AAC7D,WAAO,IAAI,IAAI,WAAW,GAAG,CAAC;AAC9B,WAAO,EAAE,QAAQ,GAAG;AAAA,EACtB;AAAA,EAEA,MAAM,QAAQ,EAAE,QAAQ,KAAK,QAAQ,GAAG,GAAG;AACzC,UAAM,MAAM,MAAM,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,MAAM;AACrE,UAAM,MAAM,IAAI,WAAW,IAAI,YAAY,IAAI,UAAU,CAAC;AAC1D,QAAI,IAAI,IAAI,WAAW,GAAG,CAAC;AAC3B,WAAO;AAAA,EACT;AACF;;;ACnCO,IAAM,WAAN,MAAe;AAAA,EAEpB,YAA6B,UAAkB;AAAlB;AAAA,EAAmB;AAAA,EAAnB;AAAA,EADZ,MAAM,oBAAI,IAAgC;AAAA,EAG3D,OAAO,IAAI,MAAa,YAAoB,aAA8B;AAGxE,WAAO,GAAG,UAAU,IAAI,eAAe,EAAE,IAAI,SAAS,IAAI,CAAC;AAAA,EAC7D;AAAA,EAEA,IAAI,KAA6C;AAC/C,UAAM,QAAQ,KAAK,IAAI,IAAI,GAAG;AAC9B,QAAI,CAAC,MAAO,QAAO;AAEnB,SAAK,IAAI,OAAO,GAAG;AACnB,SAAK,IAAI,IAAI,KAAK,KAAK;AACvB,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,KAAa,OAAiC;AAChD,QAAI,KAAK,YAAY,EAAG;AACxB,SAAK,IAAI,IAAI,KAAK,KAAK;AACvB,WAAO,KAAK,IAAI,OAAO,KAAK,UAAU;AACpC,YAAM,SAAS,KAAK,IAAI,KAAK,EAAE,KAAK,EAAE;AACtC,UAAI,WAAW,OAAW;AAC1B,WAAK,IAAI,OAAO,MAAM;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,QAAc;AACZ,SAAK,IAAI,MAAM;AAAA,EACjB;AACF;;;ACxBO,SAAS,cAAc,OAA8B;AAC1D,SAAO,CAAC,MAAM,SAAS,SAAS,MAAM,IAAI,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,MAAM,CAAC,EAAE;AAAA,IACvF;AAAA,EACF;AACF;AAEO,SAAS,aAAa,SAAgC;AAC3D,QAAM,WAAW,QAAQ,MAAM,GAAG;AAClC,MAAI,SAAS,WAAW,GAAG;AACzB,UAAM,IAAI,MAAM,gFAA2E;AAAA,EAC7F;AACA,QAAM,CAAC,SAAS,SAAS,OAAO,SAAS,IAAI;AAC7C,MAAI,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,WAAW;AAChD,UAAM,IAAI,MAAM,8EAAyE;AAAA,EAC3F;AACA,SAAO;AAAA,IACL;AAAA,IACA,MAAM,WAAW,OAAO;AAAA,IACxB,IAAI,WAAW,KAAK;AAAA,IACpB,QAAQ,WAAW,SAAS;AAAA,EAC9B;AACF;;;AChCA,IAAM,qBAAqB;AAC3B,IAAM,gBAAgB;AACtB,IAAM,aAAa;AASnB,eAAsB,oBAAoB,QAAqD;AAC7F,MAAI,CAAC,OAAO,YAAY;AACtB,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAEA,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,YAA6B,OAAO,aAAa;AACvD,QAAM,SAAS,OAAO,UAAW,MAAM,UAAU;AACjD,QAAM,QAAQ,IAAI,SAAS,OAAO,gBAAgB,aAAa;AAC/D,QAAM,aAAa,OAAO,OAAO,UAAU,EAAE,KAAK;AAClD,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,UAAU,IAAI,YAAY;AAEhC,iBAAe,cACb,MACA,aACoB;AACpB,UAAM,MAAM,SAAS,IAAI,MAAM,YAAY,WAAW;AACtD,UAAM,SAAS,MAAM,IAAI,GAAG;AAC5B,QAAI,OAAQ,QAAO;AACnB,UAAM,UAAU,UAAU,UAAU,EAAE,QAAQ,YAAY,aAAa,MAAM,WAAW,CAAC;AACzF,UAAM,IAAI,KAAK,OAAO;AACtB,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,MAAM,QAAQ,WAAW,SAAS;AAChC,YAAM,OAAO,eAAe,UAAU;AACtC,YAAM,MAAM,MAAM,cAAc,MAAM,SAAS,WAAW;AAC1D,YAAM,UAAU,QAAQ,OAAO,SAAS;AACxC,YAAM,aAAa,IAAI,WAAW,IAAI,YAAY,QAAQ,UAAU,CAAC;AACrE,iBAAW,IAAI,OAAO;AACtB,YAAM,EAAE,QAAQ,GAAG,IAAI,MAAM,UAAU,QAAQ,EAAE,QAAQ,KAAK,WAAW,WAAW,CAAC;AACrF,aAAO,cAAc,EAAE,SAAS,UAAU,SAAS,MAAM,IAAI,OAAO,CAAC;AAAA,IACvE;AAAA,IAEA,MAAM,QAAQ,SAAS,SAAS;AAC9B,YAAM,SAAS,aAAa,OAAO;AACnC,UAAI,OAAO,YAAY,UAAU,SAAS;AACxC,cAAM,IAAI;AAAA,UACR,8CAA8C,OAAO,OAAO,uBAAuB,UAAU,OAAO;AAAA,QACtG;AAAA,MACF;AACA,YAAM,MAAM,MAAM,cAAc,OAAO,MAAM,SAAS,WAAW;AACjE,YAAM,aAAa,MAAM,UAAU,QAAQ;AAAA,QACzC;AAAA,QACA;AAAA,QACA,QAAQ,OAAO;AAAA,QACf,IAAI,OAAO;AAAA,MACb,CAAC;AACD,aAAO,QAAQ,OAAO,UAAU;AAAA,IAClC;AAAA,IAEA,gBAAsB;AACpB,YAAM,MAAM;AAAA,IACd;AAAA,EACF;AACF;","names":[]}