@aurabx/jmix-js 0.1.0

package/WARP.md

@@ -0,0 +1,143 @@
+# WARP.md
+
+This file provides guidance to WARP (warp.dev) when working with code in this repository.
+
+Repository: jmix-ts - TypeScript library for JMIX (JSON Medical Interchange) format
+
+## What This Library Does
+
+JMIX-TS builds secure JMIX envelopes from DICOM directories, supporting:
+- AES-256-GCM encryption with X25519 key agreement and HKDF key derivation
+- Three JSON components: manifest.json (routing/security), metadata.json (clinical), audit.json (trail)
+- Deterministic payload hash verification over plaintext payload directories
+- Full-featured packaging including original DICOM files and encrypted payload support
+
+## Prerequisites
+
+- Node.js 20+ LTS
+- npm or compatible package manager
+- TypeScript 5+
+
+## Essential Commands
+
+```bash
+# Install dependencies
+npm install
+
+# Build the library
+npm run build
+
+# Run all tests (Jest with ESM support)
+npm test
+
+# Run specific test
+npm test -- JmixBuilder.test.ts
+
+# Test with coverage report (outputs to coverage/)
+npm run test:coverage
+
+# Watch mode for development
+npm run test:watch
+
+# Type checking only
+npm run typecheck
+
+# Format code
+npm run format:fix
+
+# Clean build artifacts and temporary files
+npm run clean
+```
+
+## Demo Commands
+
+```bash
+# Basic package creation (plaintext)
+npm run demo:package
+
+# Encrypted package with generated keys
+npm run demo:package:encrypted
+
+# Decrypt and verify workflow
+npm run demo:decrypt
+
+# Verify payload hash
+npm run demo:verify:hash
+```
+
+## High-Level Architecture
+
+**Core Flow**: JmixBuilder orchestrates DICOM processing → JSON component generation → schema validation → file output/packaging.
+
+```
+DICOM Directory → DicomProcessor → JmixBuilder → {manifest, metadata, audit} → SchemaValidator → Output
+                                       ↓
+                    PayloadEncryptor/Decryptor → Encrypted JMIX Package
+```
+
+**Key Components**:
+- `JmixBuilder`: Main orchestrator with buildFromDicom(), packageToDirectory(), and packageEncryptedToDirectory()
+- `DicomProcessor`: Recursively scans directories, validates DICOM magic signatures, extracts metadata
+- `SchemaValidator`: Ajv-based validation against JSON schemas in configurable path (default: ../jmix/schemas)
+- `PayloadEncryptor/Decryptor`: AES-256-GCM with X25519+HKDF, base64-encoded ephemeral keys/IV/auth tags
+- Deterministic payload hashing: SHA-256 over sorted (path + newline + bytes) for all payload files
+
+## Configuration
+
+### Schema Path
+- Default: `../jmix/schemas` (works in monorepo structure)
+- Override: `JMIX_SCHEMA_PATH` environment variable
+- Constructor: `new SchemaValidator({ schemaPath: '/custom/path' })`
+- Gracefully skips validation when schemas not found
+
+### Output Directory
+- Default: `./tmp` (not system /tmp)
+- Constructor: `new JmixBuilder({ outputPath: './custom-tmp' })`
+
+## Testing Strategy
+
+- Uses sample DICOM files in `samples/` directory
+- All test outputs written to `./tmp` directory
+- Comprehensive coverage: unit tests, integration tests, schema validation
+- Real DICOM file processing with fallback to configuration data
+- Mock-free approach using actual sample data
+
+## Cryptography Implementation
+
+Based on JMIX security whitepaper (see `.ai/security.md`):
+- **Algorithm**: AES-256-GCM
+- **Key Exchange**: X25519 (Curve25519) ECDH
+- **Key Derivation**: HKDF-SHA256 with info="JMIX-Payload-Encryption"
+- **Forward Secrecy**: Ephemeral sender keys for each envelope
+- **Authentication**: GCM authentication tag prevents tampering
+
+Encryption creates `payload.encrypted` from tar-compressed payload directory, with all crypto material (ephemeral_public_key, iv, auth_tag) stored base64-encoded in manifest.security.encryption.
+
+## File Structure Reference
+
+**Generated JMIX Envelope**:
+```
+<envelope_id>.JMIX/
+├── manifest.json     # Routing, security, patient info
+├── audit.json        # Audit trail and events
+└── payload/          # OR payload.encrypted (when encrypted)
+    ├── metadata.json # Clinical metadata and DICOM info  
+    └── dicom/        # Original DICOM files (structure preserved)
+```
+
+## Development Notes
+
+- **ESM modules**: Uses import/export syntax, .js extensions in TypeScript imports
+- **Jest configuration**: Supports ESM with ts-jest preset
+- **Schema validation**: Optional and graceful - continues if schemas missing
+- **Error handling**: Structured error types (JmixError, ValidationError, DicomError, CryptographyError)
+- **DICOM detection**: Magic number 'DICM' at byte offset 128 plus .dcm/.dicom extensions
+
+## Monorepo Context
+
+This library expects to work within a larger jmix monorepo structure where:
+- Schema definitions are available at `../jmix/schemas`
+- Related Rust CLI tools may consume this library's output
+- Sample data in `samples/` is shared across implementations
+
+For more detailed guidance on general WARP usage patterns, see `.ai/WARP.md`.

package/dist/JmixBuilder.d.ts

@@ -0,0 +1,82 @@
+import { SchemaValidator, SchemaValidatorOptions } from './validation/SchemaValidator.js';
+import { DicomProcessor } from './dicom/DicomProcessor.js';
+import { JmixEnvelope, Config } from './types/index.js';
+export interface JmixBuilderOptions {
+    schemaValidatorOptions?: SchemaValidatorOptions;
+    outputPath?: string;
+}
+export declare class JmixBuilder {
+    private validator;
+    private dicomProcessor;
+    private outputPath;
+    constructor(options?: JmixBuilderOptions);
+    /**
+     * Build a JMIX envelope from DICOM files and configuration
+     */
+    buildFromDicom(dicomPath: string, config: Config): Promise<JmixEnvelope>;
+    /**
+     * Save envelope to JSON files
+     */
+    saveToFiles(envelope: JmixEnvelope, outputPath?: string): Promise<void>;
+    /**
+     * Build manifest component
+     */
+    private buildManifest;
+    /**
+     * Build metadata component
+     */
+    private buildMetadata;
+    /**
+     * Build audit component (audit trail)
+     */
+    private buildAudit;
+    /**
+     * Load configuration from JSON file
+     */
+    static loadConfig(configPath: string): Promise<Config>;
+    /**
+     * Get the schema validator instance
+     */
+    getValidator(): SchemaValidator;
+    /**
+     * Get the DICOM processor instance
+     */
+    getDicomProcessor(): DicomProcessor;
+    /**
+     * Package an ENCRYPTED JMIX envelope directory:
+     * - Builds plaintext payload/ first (metadata.json + dicom/)
+     * - Computes payload_hash over payload/
+     * - Tars payload/, encrypts to payload.encrypted with AES-256-GCM via X25519+HKDF
+     * - Removes plaintext payload/ directory
+     * Layout:
+     *   <outputRoot>/<envelope_id>.JMIX/
+     *     manifest.json (includes security.encryption & payload_hash)
+     *     audit.json
+     *     payload.encrypted
+     */
+    packageEncryptedToDirectory(dicomPath: string, config: Config, outputRoot: string, recipientPublicKeyBase64: string): Promise<string>;
+    /**
+     * Package a JMIX envelope to a directory structure that includes original DICOM files.
+     * Layout:
+     *   <outputRoot>/<envelope_id>.JMIX/
+     *     manifest.json
+     *     audit.json
+     *     payload/
+     *       metadata.json
+     *       dicom/ ... (copied from dicomPath, preserving structure)
+     *       files/ (optional in future)
+     *       files.json (optional in future)
+     */
+    packageToDirectory(dicomPath: string, config: Config, outputRoot: string): Promise<string>;
+    private walkFiles;
+    private isLikelyDicom;
+    private computePayloadHash;
+    /**
+     * Decrypt an encrypted JMIX envelope in place: restores a plaintext payload/ directory.
+     * - envelopeDir: path to <id>.JMIX directory
+     * - recipientPrivateKeyBase64: base64 Curve25519 private key (32 bytes)
+     * Returns the extracted payload directory path.
+     */
+    decryptEnvelope(envelopeDir: string, recipientPrivateKeyBase64: string): Promise<string>;
+}
+//# sourceMappingURL=JmixBuilder.d.ts.map

package/dist/JmixBuilder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JmixBuilder.d.ts","sourceRoot":"","sources":["../src/JmixBuilder.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,eAAe,EACf,sBAAsB,EACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAI3D,OAAO,EACL,YAAY,EACZ,MAAM,EAMP,MAAM,kBAAkB,CAAC;AAE1B,MAAM,WAAW,kBAAkB;IACjC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,SAAS,CAAkB;IACnC,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,UAAU,CAAS;gBAEf,OAAO,GAAE,kBAAuB;IAM5C;;OAEG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,YAAY,CAAC;IA2CxB;;OAEG;IACG,WAAW,CACf,QAAQ,EAAE,YAAY,EACtB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IA4ChB;;OAEG;IACH,OAAO,CAAC,aAAa;IAmCrB;;OAEG;IACH,OAAO,CAAC,aAAa;IAarB;;OAEG;IACH,OAAO,CAAC,UAAU;IAqBlB;;OAEG;WACU,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa5D;;OAEG;IACH,YAAY,IAAI,eAAe;IAI/B;;OAEG;IACH,iBAAiB,IAAI,cAAc;IAInC;;;;;;;;;;;OAWG;IACG,2BAA2B,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,wBAAwB,EAAE,MAAM,GAC/B,OAAO,CAAC,MAAM,CAAC;IAyElB;;;;;;;;;;;OAWG;IACG,kBAAkB,CACtB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;YAoDJ,SAAS;YAeT,aAAa;YAmBb,kBAAkB;IAgBhC;;;;;OAKG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,yBAAyB,EAAE,MAAM,GAChC,OAAO,CAAC,MAAM,CAAC;CA6CnB"}

package/dist/JmixBuilder.js

@@ -0,0 +1,353 @@
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import { randomUUID, createHash } from 'crypto';
+import { SchemaValidator, } from './validation/SchemaValidator.js';
+import { DicomProcessor } from './dicom/DicomProcessor.js';
+import { PayloadEncryptor } from './crypto/PayloadEncryptor.js';
+import tar from 'tar';
+import { PayloadDecryptor } from './crypto/PayloadDecryptor.js';
+import { JmixError, } from './types/index.js';
+export class JmixBuilder {
+    validator;
+    dicomProcessor;
+    outputPath;
+    constructor(options = {}) {
+        this.validator = new SchemaValidator(options.schemaValidatorOptions);
+        this.dicomProcessor = new DicomProcessor();
+        this.outputPath = options.outputPath || './tmp';
+    }
+    /**
+     * Build a JMIX envelope from DICOM files and configuration
+     */
+    async buildFromDicom(dicomPath, config) {
+        try {
+            // Generate transmission ID and timestamp
+            const transmissionId = randomUUID();
+            const timestamp = new Date().toISOString();
+            // Extract DICOM metadata
+            const dicomMetadata = await this.dicomProcessor.processDicomFolder(dicomPath, config);
+            // Build envelope components
+            const manifest = this.buildManifest(config, timestamp);
+            const metadata = this.buildMetadata(config, dicomMetadata);
+            const audit = this.buildAudit(transmissionId, timestamp, config);
+            const envelope = {
+                manifest,
+                metadata,
+                audit,
+            };
+            // Validate the envelope components
+            await this.validator.validateEnvelope({
+                manifest,
+                metadata,
+                audit,
+            });
+            return envelope;
+        }
+        catch (error) {
+            throw new JmixError(`Failed to build JMIX envelope from ${dicomPath}`, error instanceof Error ? error : new Error(String(error)));
+        }
+    }
+    /**
+     * Save envelope to JSON files
+     */
+    async saveToFiles(envelope, outputPath) {
+        const finalOutputPath = outputPath || this.outputPath;
+        try {
+            // Ensure output directory exists
+            await fs.mkdir(finalOutputPath, { recursive: true });
+            // Write manifest.json
+            await fs.writeFile(path.join(finalOutputPath, 'manifest.json'), JSON.stringify(envelope.manifest, null, 2), 'utf-8');
+            // Write metadata.json
+            await fs.writeFile(path.join(finalOutputPath, 'metadata.json'), JSON.stringify(envelope.metadata, null, 2), 'utf-8');
+            // Write audit.json (audit trail)
+            await fs.writeFile(path.join(finalOutputPath, 'audit.json'), JSON.stringify(envelope.audit, null, 2), 'utf-8');
+            // Write files.json if present
+            if (envelope.files) {
+                await fs.writeFile(path.join(finalOutputPath, 'files.json'), JSON.stringify(envelope.files, null, 2), 'utf-8');
+            }
+        }
+        catch (error) {
+            throw new JmixError(`Failed to save envelope to ${finalOutputPath}`, error instanceof Error ? error : new Error(String(error)));
+        }
+    }
+    /**
+     * Build manifest component
+     */
+    buildManifest(config, timestamp) {
+        const manifest = {
+            jmix_version: config.version,
+            envelope_id: randomUUID(),
+            created_at: timestamp,
+            sender: config.sender,
+            receivers: config.receivers,
+            patient: config.patient,
+            security: config.security,
+        };
+        // Add optional fields
+        if (config.requester) {
+            manifest.requester = config.requester;
+        }
+        if (config.consent) {
+            manifest.consent = config.consent;
+        }
+        if (config.custom_tags) {
+            manifest.custom_tags = config.custom_tags;
+        }
+        if (config.report) {
+            manifest.report = config.report;
+        }
+        if (config.deid_keys) {
+            manifest.deid_keys = config.deid_keys;
+        }
+        return manifest;
+    }
+    /**
+     * Build metadata component
+     */
+    buildMetadata(config, dicomMetadata) {
+        return {
+            patient: config.patient,
+            study: {
+                description: dicomMetadata.study_description,
+                uid: dicomMetadata.study_uid,
+                date: dicomMetadata.study_date,
+            },
+            dicom: dicomMetadata,
+            custom_metadata: {},
+        };
+    }
+    /**
+     * Build audit component (audit trail)
+     */
+    buildAudit(transmissionId, timestamp, config) {
+        const firstReceiver = config.receivers && config.receivers[0];
+        const entry = {
+            event: 'envelope_created',
+            timestamp,
+            by: { id: config.sender.id, name: config.sender.name },
+            to: firstReceiver ? { id: firstReceiver.id, name: firstReceiver.name } : undefined,
+        };
+        const audit = {
+            audit: [entry],
+        };
+        return audit;
+    }
+    /**
+     * Load configuration from JSON file
+     */
+    static async loadConfig(configPath) {
+        try {
+            const configContent = await fs.readFile(configPath, 'utf-8');
+            return JSON.parse(configContent);
+        }
+        catch (error) {
+            throw new JmixError(`Failed to load configuration from ${configPath}`, error instanceof Error ? error : new Error(String(error)));
+        }
+    }
+    /**
+     * Get the schema validator instance
+     */
+    getValidator() {
+        return this.validator;
+    }
+    /**
+     * Get the DICOM processor instance
+     */
+    getDicomProcessor() {
+        return this.dicomProcessor;
+    }
+    /**
+     * Package an ENCRYPTED JMIX envelope directory:
+     * - Builds plaintext payload/ first (metadata.json + dicom/)
+     * - Computes payload_hash over payload/
+     * - Tars payload/, encrypts to payload.encrypted with AES-256-GCM via X25519+HKDF
+     * - Removes plaintext payload/ directory
+     * Layout:
+     *   <outputRoot>/<envelope_id>.JMIX/
+     *     manifest.json (includes security.encryption & payload_hash)
+     *     audit.json
+     *     payload.encrypted
+     */
+    async packageEncryptedToDirectory(dicomPath, config, outputRoot, recipientPublicKeyBase64) {
+        // Build the envelope first
+        const envelope = await this.buildFromDicom(dicomPath, config);
+        const packageRoot = path.resolve(outputRoot, `${envelope.manifest.envelope_id}.JMIX`);
+        const payloadDir = path.join(packageRoot, 'payload');
+        const dicomOutDir = path.join(payloadDir, 'dicom');
+        // Create directory structure and copy DICOM
+        await fs.mkdir(dicomOutDir, { recursive: true });
+        const allInputFiles = await this.walkFiles(dicomPath);
+        for (const absFile of allInputFiles) {
+            if (!(await this.isLikelyDicom(absFile)))
+                continue;
+            const rel = path.relative(dicomPath, absFile);
+            const dest = path.join(dicomOutDir, rel);
+            await fs.mkdir(path.dirname(dest), { recursive: true });
+            await fs.copyFile(absFile, dest);
+        }
+        // Write payload/metadata.json
+        await fs.mkdir(payloadDir, { recursive: true });
+        await fs.writeFile(path.join(payloadDir, 'metadata.json'), JSON.stringify(envelope.metadata, null, 2), 'utf-8');
+        // Compute payload hash over plaintext payload
+        const payloadHash = await this.computePayloadHash(payloadDir);
+        // Tar the payload directory to a temporary tar file under the package root
+        const tmpTarPath = path.join(packageRoot, 'payload.tmp.tar');
+        await tar.c({ cwd: packageRoot, file: tmpTarPath, portable: true, gzip: false }, ['payload']);
+        // Read tar and encrypt
+        const tarBuf = await fs.readFile(tmpTarPath);
+        const { ciphertext, result } = PayloadEncryptor.encryptTar(tarBuf, recipientPublicKeyBase64);
+        const encryptedPath = path.join(packageRoot, 'payload.encrypted');
+        await fs.writeFile(encryptedPath, ciphertext);
+        // Cleanup plaintext tar and payload directory
+        await fs.rm(tmpTarPath, { force: true });
+        await fs.rm(payloadDir, { recursive: true, force: true });
+        // Update manifest security
+        envelope.manifest.security = {
+            ...envelope.manifest.security,
+            payload_hash: payloadHash,
+            encryption: {
+                algorithm: 'AES-256-GCM',
+                ephemeral_public_key: result.ephemeral_public_key,
+                iv: result.iv,
+                auth_tag: result.auth_tag,
+            },
+        };
+        // Write manifest.json and audit.json
+        await fs.mkdir(packageRoot, { recursive: true });
+        await fs.writeFile(path.join(packageRoot, 'manifest.json'), JSON.stringify(envelope.manifest, null, 2), 'utf-8');
+        await fs.writeFile(path.join(packageRoot, 'audit.json'), JSON.stringify(envelope.audit, null, 2), 'utf-8');
+        return packageRoot;
+    }
+    /**
+     * Package a JMIX envelope to a directory structure that includes original DICOM files.
+     * Layout:
+     *   <outputRoot>/<envelope_id>.JMIX/
+     *     manifest.json
+     *     audit.json
+     *     payload/
+     *       metadata.json
+     *       dicom/ ... (copied from dicomPath, preserving structure)
+     *       files/ (optional in future)
+     *       files.json (optional in future)
+     */
+    async packageToDirectory(dicomPath, config, outputRoot) {
+        // Build the envelope first
+        const envelope = await this.buildFromDicom(dicomPath, config);
+        const packageRoot = path.resolve(outputRoot, `${envelope.manifest.envelope_id}.JMIX`);
+        const payloadDir = path.join(packageRoot, 'payload');
+        const dicomOutDir = path.join(payloadDir, 'dicom');
+        // Create directory structure
+        await fs.mkdir(dicomOutDir, { recursive: true });
+        // Copy DICOM files preserving relative structure
+        const allInputFiles = await this.walkFiles(dicomPath);
+        for (const absFile of allInputFiles) {
+            if (!(await this.isLikelyDicom(absFile)))
+                continue;
+            const rel = path.relative(dicomPath, absFile);
+            const dest = path.join(dicomOutDir, rel);
+            await fs.mkdir(path.dirname(dest), { recursive: true });
+            await fs.copyFile(absFile, dest);
+        }
+        // Write payload/metadata.json
+        await fs.mkdir(payloadDir, { recursive: true });
+        await fs.writeFile(path.join(payloadDir, 'metadata.json'), JSON.stringify(envelope.metadata, null, 2), 'utf-8');
+        // Compute payload hash over all files under payload/
+        const payloadHash = await this.computePayloadHash(payloadDir);
+        envelope.manifest.security = {
+            ...envelope.manifest.security,
+            payload_hash: payloadHash,
+        };
+        // Write manifest.json and audit.json at package root
+        await fs.writeFile(path.join(packageRoot, 'manifest.json'), JSON.stringify(envelope.manifest, null, 2), 'utf-8');
+        await fs.writeFile(path.join(packageRoot, 'audit.json'), JSON.stringify(envelope.audit, null, 2), 'utf-8');
+        return packageRoot;
+    }
+    // Recursively list all files under a directory (files only)
+    async walkFiles(root) {
+        const out = [];
+        const entries = await fs.readdir(root, { withFileTypes: true });
+        for (const entry of entries) {
+            const full = path.join(root, entry.name);
+            if (entry.isDirectory()) {
+                out.push(...(await this.walkFiles(full)));
+            }
+            else if (entry.isFile()) {
+                out.push(full);
+            }
+        }
+        return out;
+    }
+    // Basic DICOM detection: extension or DICM magic at offset 128
+    async isLikelyDicom(filePath) {
+        try {
+            const ext = path.extname(filePath).toLowerCase();
+            if (ext === '.dcm' || ext === '.dicom')
+                return true;
+            const fh = await fs.open(filePath, 'r');
+            try {
+                const buf = Buffer.alloc(4);
+                await fh.read(buf, 0, 4, 128);
+                return buf.toString('ascii') === 'DICM';
+            }
+            finally {
+                await fh.close();
+            }
+        }
+        catch {
+            return false;
+        }
+    }
+    // Deterministic payload hash: sha256 over ordered (path + newline + bytes) for all files under payload/
+    async computePayloadHash(payloadDir) {
+        const all = await this.walkFiles(payloadDir);
+        const rels = all
+            .map((abs) => ({ abs, rel: path.posix.join(...path.relative(payloadDir, abs).split(path.sep)) }))
+            .sort((a, b) => (a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0));
+        const hash = createHash('sha256');
+        for (const f of rels) {
+            hash.update(Buffer.from(f.rel + '\n', 'utf-8'));
+            const data = await fs.readFile(f.abs);
+            hash.update(data);
+        }
+        const digestHex = hash.digest('hex');
+        return `sha256:${digestHex}`;
+    }
+    /**
+     * Decrypt an encrypted JMIX envelope in place: restores a plaintext payload/ directory.
+     * - envelopeDir: path to <id>.JMIX directory
+     * - recipientPrivateKeyBase64: base64 Curve25519 private key (32 bytes)
+     * Returns the extracted payload directory path.
+     */
+    async decryptEnvelope(envelopeDir, recipientPrivateKeyBase64) {
+        const manifestPath = path.join(envelopeDir, 'manifest.json');
+        const encryptedPath = path.join(envelopeDir, 'payload.encrypted');
+        // Read manifest and encryption info
+        const manifestRaw = await fs.readFile(manifestPath, 'utf-8');
+        const manifest = JSON.parse(manifestRaw);
+        const enc = manifest?.security?.encryption;
+        if (!enc || !enc.ephemeral_public_key || !enc.iv || !enc.auth_tag) {
+            throw new Error('Envelope is not encrypted or missing encryption metadata');
+        }
+        // Read ciphertext
+        const ciphertext = await fs.readFile(encryptedPath);
+        // Decrypt to tar buffer
+        const tarBuf = PayloadDecryptor.decryptToBuffer(ciphertext, enc.ephemeral_public_key, enc.iv, enc.auth_tag, recipientPrivateKeyBase64);
+        // Write tar to temp and extract to payload/
+        const tmpTar = path.join(envelopeDir, 'payload.decrypted.tar');
+        await fs.writeFile(tmpTar, tarBuf);
+        const payloadDir = path.join(envelopeDir, 'payload');
+        await fs.mkdir(payloadDir, { recursive: true });
+        await tar.x({ cwd: envelopeDir, file: tmpTar });
+        // Remove temp tar
+        await fs.rm(tmpTar, { force: true });
+        // Optional: verify payload hash
+        if (manifest?.security?.payload_hash) {
+            const computed = await this.computePayloadHash(payloadDir);
+            if (computed !== manifest.security.payload_hash) {
+                throw new Error(`Payload hash mismatch: expected ${manifest.security.payload_hash} but got ${computed}`);
+            }
+        }
+        return payloadDir;
+    }
+}
+//# sourceMappingURL=JmixBuilder.js.map

package/dist/JmixBuilder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JmixBuilder.js","sourceRoot":"","sources":["../src/JmixBuilder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EACL,eAAe,GAEhB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAOL,SAAS,GACV,MAAM,kBAAkB,CAAC;AAO1B,MAAM,OAAO,WAAW;IACd,SAAS,CAAkB;IAC3B,cAAc,CAAiB;IAC/B,UAAU,CAAS;IAE3B,YAAY,UAA8B,EAAE;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACrE,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,SAAiB,EACjB,MAAc;QAEd,IAAI,CAAC;YACH,yCAAyC;YACzC,MAAM,cAAc,GAAG,UAAU,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAE3C,yBAAyB;YACzB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAChE,SAAS,EACT,MAAM,CACP,CAAC;YAEF,4BAA4B;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAC3B,cAAc,EACd,SAAS,EACT,MAAM,CACP,CAAC;YAEF,MAAM,QAAQ,GAAiB;gBAC7B,QAAQ;gBACR,QAAQ;gBACR,KAAK;aACN,CAAC;YAEF,mCAAmC;YACnC,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC;gBACpC,QAAQ;gBACR,QAAQ;gBACR,KAAK;aACN,CAAC,CAAC;YAEH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,SAAS,CACjB,sCAAsC,SAAS,EAAE,EACjD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,QAAsB,EACtB,UAAmB;QAEnB,MAAM,eAAe,GAAG,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC;QAEtD,IAAI,CAAC;YACH,iCAAiC;YACjC,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAErD,sBAAsB;YACtB,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,EAC3C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAC1C,OAAO,CACR,CAAC;YAEF,sBAAsB;YACtB,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,EAC3C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAC1C,OAAO,CACR,CAAC;YAEF,iCAAiC;YACjC,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,EACxC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EACvC,OAAO,CACR,CAAC;YAEF,8BAA8B;YAC9B,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,EACxC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EACvC,OAAO,CACR,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,SAAS,CACjB,8BAA8B,eAAe,EAAE,EAC/C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,MAAc,EAAE,SAAiB;QACrD,MAAM,QAAQ,GAAa;YACzB,YAAY,EAAE,MAAM,CAAC,OAAO;YAC5B,WAAW,EAAE,UAAU,EAAE;YACzB,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC;QAEF,sBAAsB;QACtB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACxC,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACpC,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,QAAQ,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAC5C,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACxC,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,MAAc,EAAE,aAAkB;QACtD,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE;gBACL,WAAW,EAAE,aAAa,CAAC,iBAAiB;gBAC5C,GAAG,EAAE,aAAa,CAAC,SAAS;gBAC5B,IAAI,EAAE,aAAa,CAAC,UAAU;aAC/B;YACD,KAAK,EAAE,aAAa;YACpB,eAAe,EAAE,EAAE;SACpB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,UAAU,CAChB,cAAsB,EACtB,SAAiB,EACjB,MAAc;QAEd,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAE9D,MAAM,KAAK,GAAe;YACxB,KAAK,EAAE,kBAAkB;YACzB,SAAS;YACT,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YACtD,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;SACnF,CAAC;QAEF,MAAM,KAAK,GAAU;YACnB,KAAK,EAAE,CAAC,KAAK,CAAC;SACf,CAAC;QAEF,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,UAAkB;QACxC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAW,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,SAAS,CACjB,qCAAqC,UAAU,EAAE,EACjD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAGD;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,2BAA2B,CAC/B,SAAiB,EACjB,MAAc,EACd,UAAkB,EAClB,wBAAgC;QAEhC,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAE9D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,OAAO,CAAC,CAAC;QACtF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAEnD,4CAA4C;QAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtD,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBAAE,SAAS;YACnD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACzC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,8BAA8B;QAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,EACtC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAC1C,OAAO,CACR,CAAC;QAEF,8CAA8C;QAC9C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAE9D,2EAA2E;QAC3E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAC7D,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAE9F,uBAAuB;QACvB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,UAAU,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QAC7F,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;QAClE,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAE9C,8CAA8C;QAC9C,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,2BAA2B;QAC3B,QAAQ,CAAC,QAAQ,CAAC,QAAQ,GAAG;YAC3B,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ;YAC7B,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE;gBACV,SAAS,EAAE,aAAa;gBACxB,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;gBACjD,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B;SACK,CAAC;QAET,qCAAqC;QACrC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,EACvC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAC1C,OAAO,CACR,CAAC;QACF,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EACpC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EACvC,OAAO,CACR,CAAC;QAEF,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,kBAAkB,CACtB,SAAiB,EACjB,MAAc,EACd,UAAkB;QAElB,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAE9D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,OAAO,CAAC,CAAC;QACtF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAEnD,6BAA6B;QAC7B,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjD,iDAAiD;QACjD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtD,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBAAE,SAAS;YACnD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACzC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,8BAA8B;QAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,EACtC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAC1C,OAAO,CACR,CAAC;QAEF,qDAAqD;QACrD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC9D,QAAQ,CAAC,QAAQ,CAAC,QAAQ,GAAG;YAC3B,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ;YAC7B,YAAY,EAAE,WAAW;SAC1B,CAAC;QAEF,qDAAqD;QACrD,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,EACvC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAC1C,OAAO,CACR,CAAC;QACF,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EACpC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EACvC,OAAO,CACR,CAAC;QAEF,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,4DAA4D;IACpD,KAAK,CAAC,SAAS,CAAC,IAAY;QAClC,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5C,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,+DAA+D;IACvD,KAAK,CAAC,aAAa,CAAC,QAAgB;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAEpD,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC5B,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC;YAC1C,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,wGAAwG;IAChG,KAAK,CAAC,kBAAkB,CAAC,UAAkB;QACjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,GAAG;aACb,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;aAChG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEhE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,UAAU,SAAS,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CACnB,WAAmB,EACnB,yBAAiC;QAEjC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QAC7D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;QAElE,oCAAoC;QACpC,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC;QAC3C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QAED,kBAAkB;QAClB,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAEpD,wBAAwB;QACxB,MAAM,MAAM,GAAG,gBAAgB,CAAC,eAAe,CAC7C,UAAU,EACV,GAAG,CAAC,oBAAoB,EACxB,GAAG,CAAC,EAAE,EACN,GAAG,CAAC,QAAQ,EACZ,yBAAyB,CAC1B,CAAC;QAEF,4CAA4C;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;QAC/D,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAEnC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhD,kBAAkB;QAClB,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAErC,gCAAgC;QAChC,IAAI,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAC3D,IAAI,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,QAAQ,CAAC,YAAY,YAAY,QAAQ,EAAE,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}

package/dist/crypto/PayloadDecryptor.d.ts

@@ -0,0 +1,12 @@
+export declare class PayloadDecryptor {
+    /**
+     * Decrypt AES-256-GCM ciphertext using X25519 + HKDF-SHA256 key derivation.
+     * - ephPubB64: base64 sender ephemeral public key (32 bytes)
+     * - ivB64: base64 12-byte IV
+     * - tagB64: base64 16-byte auth tag
+     * - recipientPrivB64: base64 32-byte recipient private key
+     * Returns plaintext Buffer (tar data).
+     */
+    static decryptToBuffer(ciphertext: Buffer, ephPubB64: string, ivB64: string, tagB64: string, recipientPrivB64: string): Buffer;
+}
+//# sourceMappingURL=PayloadDecryptor.d.ts.map

package/dist/crypto/PayloadDecryptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PayloadDecryptor.d.ts","sourceRoot":"","sources":["../../src/crypto/PayloadDecryptor.ts"],"names":[],"mappings":"AAGA,qBAAa,gBAAgB;IAC3B;;;;;;;OAOG;IACH,MAAM,CAAC,eAAe,CACpB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,MAAM,GACvB,MAAM;CA0BV"}

package/dist/crypto/PayloadDecryptor.js

@@ -0,0 +1,39 @@
+import { createDecipheriv, hkdfSync } from 'crypto';
+import nacl from 'tweetnacl';
+export class PayloadDecryptor {
+    /**
+     * Decrypt AES-256-GCM ciphertext using X25519 + HKDF-SHA256 key derivation.
+     * - ephPubB64: base64 sender ephemeral public key (32 bytes)
+     * - ivB64: base64 12-byte IV
+     * - tagB64: base64 16-byte auth tag
+     * - recipientPrivB64: base64 32-byte recipient private key
+     * Returns plaintext Buffer (tar data).
+     */
+    static decryptToBuffer(ciphertext, ephPubB64, ivB64, tagB64, recipientPrivB64) {
+        const ephPub = Buffer.from(ephPubB64, 'base64');
+        const iv = Buffer.from(ivB64, 'base64');
+        const tag = Buffer.from(tagB64, 'base64');
+        const recipPriv = Buffer.from(recipientPrivB64, 'base64');
+        if (ephPub.length !== 32)
+            throw new Error('Invalid ephemeral public key');
+        if (recipPriv.length !== 32)
+            throw new Error('Invalid recipient private key');
+        if (iv.length !== 12)
+            throw new Error('Invalid IV length (expected 12)');
+        if (tag.length !== 16)
+            throw new Error('Invalid auth tag length (expected 16)');
+        // X25519 shared secret
+        const shared = nacl.scalarMult(new Uint8Array(recipPriv), new Uint8Array(ephPub));
+        // Derive 32-byte AES key with HKDF-SHA256
+        const salt = Buffer.alloc(0);
+        const info = Buffer.from('JMIX-Payload-Encryption');
+        const hkdfOut = hkdfSync('sha256', Buffer.from(shared), salt, info, 32);
+        const key = Buffer.from(hkdfOut);
+        const decipher = createDecipheriv('aes-256-gcm', key, iv);
+        decipher.setAuthTag(tag);
+        const dec1 = decipher.update(ciphertext);
+        const dec2 = decipher.final();
+        return Buffer.concat([dec1, dec2]);
+    }
+}
+//# sourceMappingURL=PayloadDecryptor.js.map

package/dist/crypto/PayloadDecryptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PayloadDecryptor.js","sourceRoot":"","sources":["../../src/crypto/PayloadDecryptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,OAAO,gBAAgB;IAC3B;;;;;;;OAOG;IACH,MAAM,CAAC,eAAe,CACpB,UAAkB,EAClB,SAAiB,EACjB,KAAa,EACb,MAAc,EACd,gBAAwB;QAExB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAE1D,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC1E,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC9E,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACzE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAEhF,uBAAuB;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAElF,0CAA0C;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEjC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC;CACF"}