@aurabx/jmix-js 0.1.0

package/src/JmixBuilder.ts

@@ -0,0 +1,572 @@
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import { randomUUID, createHash } from 'crypto';
+import {
+  SchemaValidator,
+  SchemaValidatorOptions,
+} from './validation/SchemaValidator.js';
+import { DicomProcessor } from './dicom/DicomProcessor.js';
+import { PayloadEncryptor } from './crypto/PayloadEncryptor.js';
+import tar from 'tar';
+import { PayloadDecryptor } from './crypto/PayloadDecryptor.js';
+import {
+  JmixEnvelope,
+  Config,
+  Manifest,
+  Metadata,
+  Audit,
+  AuditEntry,
+  JmixError,
+} from './types/index.js';
+
+export interface JmixBuilderOptions {
+  schemaValidatorOptions?: SchemaValidatorOptions;
+  outputPath?: string;
+}
+
+export class JmixBuilder {
+  private validator: SchemaValidator;
+  private dicomProcessor: DicomProcessor;
+  private outputPath: string;
+
+  constructor(options: JmixBuilderOptions = {}) {
+    this.validator = new SchemaValidator(options.schemaValidatorOptions);
+    this.dicomProcessor = new DicomProcessor();
+    this.outputPath = options.outputPath || './tmp';
+  }
+
+  /**
+   * Build a JMIX envelope from DICOM files and configuration
+   */
+  async buildFromDicom(
+    dicomPath: string,
+    config: Config
+  ): Promise<JmixEnvelope> {
+    try {
+      // Generate transmission ID and timestamp
+      const transmissionId = randomUUID();
+      const timestamp = new Date().toISOString();
+
+      // Extract DICOM metadata
+      const dicomMetadata = await this.dicomProcessor.processDicomFolder(
+        dicomPath,
+        config
+      );
+
+      // Build envelope components
+      const manifest = this.buildManifest(config, timestamp);
+      const metadata = this.buildMetadata(config, dicomMetadata);
+      const audit = this.buildAudit(
+        transmissionId,
+        timestamp,
+        config
+      );
+
+      const envelope: JmixEnvelope = {
+        manifest,
+        metadata,
+        audit,
+      };
+
+      // Validate the envelope components
+      await this.validator.validateEnvelope({
+        manifest,
+        metadata,
+        audit,
+      });
+
+      return envelope;
+    } catch (error) {
+      throw new JmixError(
+        `Failed to build JMIX envelope from ${dicomPath}`,
+        error instanceof Error ? error : new Error(String(error))
+      );
+    }
+  }
+
+  /**
+   * Save envelope to JSON files
+   */
+  async saveToFiles(
+    envelope: JmixEnvelope,
+    outputPath?: string
+  ): Promise<void> {
+    const finalOutputPath = outputPath || this.outputPath;
+
+    try {
+      // Ensure output directory exists
+      await fs.mkdir(finalOutputPath, { recursive: true });
+
+      // Write manifest.json
+      await fs.writeFile(
+        path.join(finalOutputPath, 'manifest.json'),
+        JSON.stringify(envelope.manifest, null, 2),
+        'utf-8'
+      );
+
+      // Write metadata.json
+      await fs.writeFile(
+        path.join(finalOutputPath, 'metadata.json'),
+        JSON.stringify(envelope.metadata, null, 2),
+        'utf-8'
+      );
+
+      // Write audit.json (audit trail)
+      await fs.writeFile(
+        path.join(finalOutputPath, 'audit.json'),
+        JSON.stringify(envelope.audit, null, 2),
+        'utf-8'
+      );
+
+      // Write files.json if present
+      if (envelope.files) {
+        await fs.writeFile(
+          path.join(finalOutputPath, 'files.json'),
+          JSON.stringify(envelope.files, null, 2),
+          'utf-8'
+        );
+      }
+    } catch (error) {
+      throw new JmixError(
+        `Failed to save envelope to ${finalOutputPath}`,
+        error instanceof Error ? error : new Error(String(error))
+      );
+    }
+  }
+
+  /**
+   * Build manifest component
+   */
+  private buildManifest(config: Config, timestamp: string): Manifest {
+    const manifest: Manifest = {
+      jmix_version: config.version,
+      envelope_id: randomUUID(),
+      created_at: timestamp,
+      sender: config.sender,
+      receivers: config.receivers,
+      patient: config.patient,
+      security: config.security,
+    };
+
+    // Add optional fields
+    if (config.requester) {
+      manifest.requester = config.requester;
+    }
+
+    if (config.consent) {
+      manifest.consent = config.consent;
+    }
+
+    if (config.custom_tags) {
+      manifest.custom_tags = config.custom_tags;
+    }
+
+    if (config.report) {
+      manifest.report = config.report;
+    }
+
+    if (config.deid_keys) {
+      manifest.deid_keys = config.deid_keys;
+    }
+
+    return manifest;
+  }
+
+  /**
+   * Build metadata component
+   */
+  private buildMetadata(config: Config, dicomMetadata: any): Metadata {
+    return {
+      patient: config.patient,
+      study: {
+        description: dicomMetadata.study_description,
+        uid: dicomMetadata.study_uid,
+        date: dicomMetadata.study_date,
+      },
+      dicom: dicomMetadata,
+      custom_metadata: {},
+    };
+  }
+
+  /**
+   * Build audit component (audit trail)
+   */
+  private buildAudit(
+    transmissionId: string,
+    timestamp: string,
+    config: Config
+  ): Audit {
+    const firstReceiver = config.receivers && config.receivers[0];
+
+    const entry: AuditEntry = {
+      event: 'envelope_created',
+      timestamp,
+      by: { id: config.sender.id, name: config.sender.name },
+      to: firstReceiver ? { id: firstReceiver.id, name: firstReceiver.name } : undefined,
+    };
+
+    const audit: Audit = {
+      audit: [entry],
+    };
+
+    return audit;
+  }
+
+  /**
+   * Load configuration from JSON file
+   */
+  static async loadConfig(configPath: string): Promise<Config> {
+    try {
+      const configContent = await fs.readFile(configPath, 'utf-8');
+      return JSON.parse(configContent) as Config;
+    } catch (error) {
+      throw new JmixError(
+        `Failed to load configuration from ${configPath}`,
+        error instanceof Error ? error : new Error(String(error))
+      );
+    }
+  }
+
+
+  /**
+   * Get the schema validator instance
+   */
+  getValidator(): SchemaValidator {
+    return this.validator;
+  }
+
+  /**
+   * Get the DICOM processor instance
+   */
+  getDicomProcessor(): DicomProcessor {
+    return this.dicomProcessor;
+  }
+
+  /**
+   * Package an ENCRYPTED JMIX envelope directory:
+   * - Builds plaintext payload/ first (metadata.json + dicom/)
+   * - Computes payload_hash over payload/
+   * - Tars payload/, encrypts to payload.encrypted with AES-256-GCM via X25519+HKDF
+   * - Removes plaintext payload/ directory
+   * Layout:
+   *   <outputRoot>/<envelope_id>.JMIX/
+   *     manifest.json (includes security.encryption & payload_hash)
+   *     audit.json
+   *     payload.encrypted
+   */
+  async packageEncryptedToDirectory(
+    dicomPath: string,
+    config: Config,
+    outputRoot: string,
+    recipientPublicKeyBase64: string
+  ): Promise<string> {
+    // Build the envelope first
+    const envelope = await this.buildFromDicom(dicomPath, config);
+
+    const packageRoot = path.resolve(outputRoot, `${envelope.manifest.envelope_id}.JMIX`);
+    const payloadDir = path.join(packageRoot, 'payload');
+    const dicomOutDir = path.join(payloadDir, 'dicom');
+
+    // Create directory structure and copy DICOM
+    await fs.mkdir(dicomOutDir, { recursive: true });
+
+    const allInputFiles = await this.walkFiles(dicomPath);
+    for (const absFile of allInputFiles) {
+      if (!(await this.isLikelyDicom(absFile))) continue;
+      const rel = path.relative(dicomPath, absFile);
+      const dest = path.join(dicomOutDir, rel);
+      await fs.mkdir(path.dirname(dest), { recursive: true });
+      await fs.copyFile(absFile, dest);
+    }
+
+    // Write payload/metadata.json
+    await fs.mkdir(payloadDir, { recursive: true });
+    await fs.writeFile(
+      path.join(payloadDir, 'metadata.json'),
+      JSON.stringify(envelope.metadata, null, 2),
+      'utf-8'
+    );
+
+    // Compute payload hash over plaintext payload
+    const payloadHash = await this.computePayloadHash(payloadDir);
+
+    // Tar the payload directory to a temporary tar file under the package root
+    const tmpTarPath = path.join(packageRoot, 'payload.tmp.tar');
+    await tar.c({ cwd: packageRoot, file: tmpTarPath, portable: true, gzip: false }, ['payload']);
+
+    // Read tar and encrypt
+    const tarBuf = await fs.readFile(tmpTarPath);
+    const { ciphertext, result } = PayloadEncryptor.encryptTar(tarBuf, recipientPublicKeyBase64);
+    const encryptedPath = path.join(packageRoot, 'payload.encrypted');
+    await fs.writeFile(encryptedPath, ciphertext);
+
+    // Cleanup plaintext tar and payload directory
+    await fs.rm(tmpTarPath, { force: true });
+    await fs.rm(payloadDir, { recursive: true, force: true });
+
+    // Update manifest security
+    envelope.manifest.security = {
+      ...envelope.manifest.security,
+      payload_hash: payloadHash,
+      encryption: {
+        algorithm: 'AES-256-GCM',
+        ephemeral_public_key: result.ephemeral_public_key,
+        iv: result.iv,
+        auth_tag: result.auth_tag,
+      },
+    } as any;
+
+    // Write manifest.json and audit.json
+    await fs.mkdir(packageRoot, { recursive: true });
+    await fs.writeFile(
+      path.join(packageRoot, 'manifest.json'),
+      JSON.stringify(envelope.manifest, null, 2),
+      'utf-8'
+    );
+    await fs.writeFile(
+      path.join(packageRoot, 'audit.json'),
+      JSON.stringify(envelope.audit, null, 2),
+      'utf-8'
+    );
+
+    return packageRoot;
+  }
+
+  /**
+   * Package a JMIX envelope to a directory structure that includes original DICOM files.
+   * Layout:
+   *   <outputRoot>/<envelope_id>.JMIX/
+   *     manifest.json
+   *     audit.json
+   *     payload/
+   *       metadata.json
+   *       dicom/ ... (copied from dicomPath, preserving structure)
+   *       files/ (optional in future)
+   *       files.json (optional in future)
+   */
+  async packageToDirectory(
+    dicomPath: string,
+    config: Config,
+    outputRoot: string
+  ): Promise<string> {
+    // Build the envelope first
+    const envelope = await this.buildFromDicom(dicomPath, config);
+
+    const packageRoot = path.resolve(outputRoot, `${envelope.manifest.envelope_id}.JMIX`);
+    const payloadDir = path.join(packageRoot, 'payload');
+    const dicomOutDir = path.join(payloadDir, 'dicom');
+
+    // Create directory structure
+    await fs.mkdir(dicomOutDir, { recursive: true });
+
+    // Copy DICOM files preserving relative structure
+    const allInputFiles = await this.walkFiles(dicomPath);
+    for (const absFile of allInputFiles) {
+      if (!(await this.isLikelyDicom(absFile))) continue;
+      const rel = path.relative(dicomPath, absFile);
+      const dest = path.join(dicomOutDir, rel);
+      await fs.mkdir(path.dirname(dest), { recursive: true });
+      await fs.copyFile(absFile, dest);
+    }
+
+    // Write payload/metadata.json
+    await fs.mkdir(payloadDir, { recursive: true });
+    await fs.writeFile(
+      path.join(payloadDir, 'metadata.json'),
+      JSON.stringify(envelope.metadata, null, 2),
+      'utf-8'
+    );
+
+    // Compute payload hash over all files under payload/
+    const payloadHash = await this.computePayloadHash(payloadDir);
+    envelope.manifest.security = {
+      ...envelope.manifest.security,
+      payload_hash: payloadHash,
+    };
+
+    // Write manifest.json and audit.json at package root
+    await fs.writeFile(
+      path.join(packageRoot, 'manifest.json'),
+      JSON.stringify(envelope.manifest, null, 2),
+      'utf-8'
+    );
+    await fs.writeFile(
+      path.join(packageRoot, 'audit.json'),
+      JSON.stringify(envelope.audit, null, 2),
+      'utf-8'
+    );
+
+    return packageRoot;
+  }
+
+  // Recursively list all files under a directory (files only)
+  private async walkFiles(root: string): Promise<string[]> {
+    const out: string[] = [];
+    const entries = await fs.readdir(root, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = path.join(root, entry.name);
+      if (entry.isDirectory()) {
+        out.push(...(await this.walkFiles(full)));
+      } else if (entry.isFile()) {
+        out.push(full);
+      }
+    }
+    return out;
+  }
+
+  // Basic DICOM detection: extension or DICM magic at offset 128
+  private async isLikelyDicom(filePath: string): Promise<boolean> {
+    try {
+      const ext = path.extname(filePath).toLowerCase();
+      if (ext === '.dcm' || ext === '.dicom') return true;
+
+      const fh = await fs.open(filePath, 'r');
+      try {
+        const buf = Buffer.alloc(4);
+        await fh.read(buf, 0, 4, 128);
+        return buf.toString('ascii') === 'DICM';
+      } finally {
+        await fh.close();
+      }
+    } catch {
+      return false;
+    }
+  }
+
+  // Deterministic payload hash: sha256 over ordered (path + newline + bytes) for all files under payload/
+  private async computePayloadHash(payloadDir: string): Promise<string> {
+    const all = await this.walkFiles(payloadDir);
+    const rels = all
+      .map((abs) => ({ abs, rel: path.posix.join(...path.relative(payloadDir, abs).split(path.sep)) }))
+      .sort((a, b) => (a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0));
+
+    const hash = createHash('sha256');
+    for (const f of rels) {
+      hash.update(Buffer.from(f.rel + '\n', 'utf-8'));
+      const data = await fs.readFile(f.abs);
+      hash.update(data);
+    }
+    const digestHex = hash.digest('hex');
+    return `sha256:${digestHex}`;
+  }
+
+  /**
+   * Decrypt an encrypted JMIX envelope in place: restores a plaintext payload/ directory.
+   * - envelopeDir: path to <id>.JMIX directory
+   * - recipientPrivateKeyBase64: base64 Curve25519 private key (32 bytes)
+   * Returns the extracted payload directory path.
+   */
+  async decryptEnvelope(
+    envelopeDir: string,
+    recipientPrivateKeyBase64: string
+  ): Promise<string> {
+    const manifestPath = path.join(envelopeDir, 'manifest.json');
+    const encryptedPath = path.join(envelopeDir, 'payload.encrypted');
+
+    // Read manifest and encryption info
+    const manifestRaw = await fs.readFile(manifestPath, 'utf-8');
+    const manifest = JSON.parse(manifestRaw);
+    const enc = manifest?.security?.encryption;
+    if (!enc || !enc.ephemeral_public_key || !enc.iv || !enc.auth_tag) {
+      throw new Error('Envelope is not encrypted or missing encryption metadata');
+    }
+
+    // Read ciphertext
+    const ciphertext = await fs.readFile(encryptedPath);
+
+    // Decrypt to tar buffer
+    const tarBuf = PayloadDecryptor.decryptToBuffer(
+      ciphertext,
+      enc.ephemeral_public_key,
+      enc.iv,
+      enc.auth_tag,
+      recipientPrivateKeyBase64
+    );
+
+    // Write tar to temp and extract to payload/
+    const tmpTar = path.join(envelopeDir, 'payload.decrypted.tar');
+    await fs.writeFile(tmpTar, tarBuf);
+
+    const payloadDir = path.join(envelopeDir, 'payload');
+    await fs.mkdir(payloadDir, { recursive: true });
+    await tar.x({ cwd: envelopeDir, file: tmpTar });
+
+    // Remove temp tar
+    await fs.rm(tmpTar, { force: true });
+
+    // Optional: verify payload hash
+    if (manifest?.security?.payload_hash) {
+      const computed = await this.computePayloadHash(payloadDir);
+      if (computed !== manifest.security.payload_hash) {
+        throw new Error(`Payload hash mismatch: expected ${manifest.security.payload_hash} but got ${computed}`);
+      }
+    }
+
+    return payloadDir;
+  }
+
+  /**
+   * Verify the payload hash in manifest.security.payload_hash.
+   * - If payload/ exists: compute directly.
+   * - If payload.encrypted exists: requires recipientPrivateKeyBase64 to decrypt to a temporary folder.
+   * Returns { ok, expected, computed, mode } where mode is 'plaintext' or 'encrypted'.
+   */
+  async verifyPayloadHash(
+    envelopeDir: string,
+    opts: { recipientPrivateKeyBase64?: string; tempDir?: string } = {}
+  ): Promise<{ ok: boolean; expected?: string; computed?: string; mode: 'plaintext' | 'encrypted' }> {
+    const manifestPath = path.join(envelopeDir, 'manifest.json');
+    const manifestRaw = await fs.readFile(manifestPath, 'utf-8');
+    const manifest = JSON.parse(manifestRaw);
+    const expected: string | undefined = manifest?.security?.payload_hash;
+
+    const payloadDir = path.join(envelopeDir, 'payload');
+    const encryptedPath = path.join(envelopeDir, 'payload.encrypted');
+
+    try {
+      const stat = await fs.stat(payloadDir).catch(() => undefined);
+      if (stat && stat.isDirectory()) {
+        const computed = await this.computePayloadHash(payloadDir);
+        return { ok: !!expected && computed === expected, expected, computed, mode: 'plaintext' };
+      }
+    } catch {}
+
+    // Encrypted path
+    const encStat = await fs.stat(encryptedPath).catch(() => undefined);
+    if (encStat && encStat.isFile()) {
+      if (!opts.recipientPrivateKeyBase64) {
+        return { ok: false, expected, computed: undefined, mode: 'encrypted' };
+      }
+      // Decrypt to temp payload under ./tmp
+      const tmpRoot = path.resolve(opts.tempDir || this.outputPath || './tmp');
+      await fs.mkdir(tmpRoot, { recursive: true });
+      const tmpWork = path.join(tmpRoot, `verify-${randomUUID()}`);
+      await fs.mkdir(tmpWork, { recursive: true });
+
+      const ciphertext = await fs.readFile(encryptedPath);
+      const enc = manifest.security.encryption;
+      const tarBuf = PayloadDecryptor.decryptToBuffer(
+        ciphertext,
+        enc.ephemeral_public_key,
+        enc.iv,
+        enc.auth_tag,
+        opts.recipientPrivateKeyBase64
+      );
+      const tmpTar = path.join(tmpWork, 'payload.tar');
+      await fs.writeFile(tmpTar, tarBuf);
+      const tmpPayload = path.join(tmpWork, 'payload');
+      await fs.mkdir(tmpPayload, { recursive: true });
+      await tar.x({ cwd: tmpWork, file: tmpTar });
+
+      const computed = await this.computePayloadHash(tmpPayload);
+
+      // Cleanup
+      await fs.rm(tmpWork, { recursive: true, force: true });
+
+      return { ok: !!expected && computed === expected, expected, computed, mode: 'encrypted' };
+    }
+
+    // No payload present
+    return { ok: false, expected, computed: undefined, mode: 'plaintext' };
+  }
+}

package/src/crypto/PayloadDecryptor.ts

@@ -0,0 +1,45 @@
+import { createDecipheriv, hkdfSync } from 'crypto';
+import nacl from 'tweetnacl';
+
+export class PayloadDecryptor {
+  /**
+   * Decrypt AES-256-GCM ciphertext using X25519 + HKDF-SHA256 key derivation.
+   * - ephPubB64: base64 sender ephemeral public key (32 bytes)
+   * - ivB64: base64 12-byte IV
+   * - tagB64: base64 16-byte auth tag
+   * - recipientPrivB64: base64 32-byte recipient private key
+   * Returns plaintext Buffer (tar data).
+   */
+  static decryptToBuffer(
+    ciphertext: Buffer,
+    ephPubB64: string,
+    ivB64: string,
+    tagB64: string,
+    recipientPrivB64: string,
+  ): Buffer {
+    const ephPub = Buffer.from(ephPubB64, 'base64');
+    const iv = Buffer.from(ivB64, 'base64');
+    const tag = Buffer.from(tagB64, 'base64');
+    const recipPriv = Buffer.from(recipientPrivB64, 'base64');
+
+    if (ephPub.length !== 32) throw new Error('Invalid ephemeral public key');
+    if (recipPriv.length !== 32) throw new Error('Invalid recipient private key');
+    if (iv.length !== 12) throw new Error('Invalid IV length (expected 12)');
+    if (tag.length !== 16) throw new Error('Invalid auth tag length (expected 16)');
+
+    // X25519 shared secret
+    const shared = nacl.scalarMult(new Uint8Array(recipPriv), new Uint8Array(ephPub));
+
+    // Derive 32-byte AES key with HKDF-SHA256
+    const salt = Buffer.alloc(0);
+    const info = Buffer.from('JMIX-Payload-Encryption');
+    const hkdfOut = hkdfSync('sha256', Buffer.from(shared), salt, info, 32);
+    const key = Buffer.from(hkdfOut);
+
+    const decipher = createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(tag);
+    const dec1 = decipher.update(ciphertext);
+    const dec2 = decipher.final();
+    return Buffer.concat([dec1, dec2]);
+  }
+}

package/src/crypto/PayloadEncryptor.ts

@@ -0,0 +1,97 @@
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import { randomBytes, createCipheriv, hkdfSync } from 'crypto';
+import nacl from 'tweetnacl';
+import tar from 'tar-stream';
+import { buffer as consumeBuffer } from 'node:stream/consumers';
+
+export interface EncryptResult {
+  ephemeral_public_key: string; // base64
+  iv: string; // base64
+  auth_tag: string; // base64
+}
+
+export class PayloadEncryptor {
+  /**
+   * Create a tar archive (in-memory) from a directory.
+   * Paths inside the tar are relative to baseDir.
+   */
+  static async tarDirectory(baseDir: string): Promise<Buffer> {
+    const pack = tar.pack();
+
+    async function addDir(dir: string, relPrefix = ''): Promise<void> {
+      const entries = await fs.readdir(dir, { withFileTypes: true });
+      for (const entry of entries) {
+        const abs = path.join(dir, entry.name);
+        const rel = path.posix.join(relPrefix, entry.name);
+        if (entry.isDirectory()) {
+          await addDir(abs, rel);
+        } else if (entry.isFile()) {
+          const stat = await fs.stat(abs);
+          const content = await fs.readFile(abs);
+          await new Promise<void>((resolve, reject) => {
+            const header = {
+              name: rel,
+              size: stat.size,
+              mode: stat.mode,
+              mtime: stat.mtime,
+              type: 'file' as const,
+            };
+            pack.entry(header, content, (err: any) => (err ? reject(err) : resolve()));
+          });
+        }
+      }
+    }
+
+    await addDir(baseDir);
+    pack.finalize();
+
+    // Collect to Buffer using Node's consumers
+    const outBuf = await consumeBuffer(pack as any);
+    return Buffer.from(outBuf);
+  }
+
+  /**
+   * Encrypt payload tar with AES-256-GCM using ECDH (X25519) derived key via HKDF-SHA256.
+   * recipientPublicKeyBase64 is a 32-byte Curve25519 public key, base64 encoded.
+   */
+  static encryptTar(
+    tarData: Buffer,
+    recipientPublicKeyBase64: string,
+  ): { ciphertext: Buffer; result: EncryptResult } {
+    const recipientPub = Buffer.from(recipientPublicKeyBase64, 'base64');
+    if (recipientPub.length !== 32) {
+      throw new Error('Invalid recipient public key length: expected 32 bytes base64');
+    }
+
+    // Ephemeral keypair
+    const eph = nacl.box.keyPair();
+
+    // X25519 shared secret
+    const shared = nacl.scalarMult(eph.secretKey, new Uint8Array(recipientPub));
+
+    // Derive 32-byte AES key with HKDF-SHA256
+    const salt = Buffer.alloc(0); // empty salt
+    const info = Buffer.from('JMIX-Payload-Encryption');
+    const hkdfOut = hkdfSync('sha256', Buffer.from(shared), salt, info, 32);
+    const key = Buffer.from(hkdfOut);
+
+    // Encrypt with AES-256-GCM
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    const enc1 = cipher.update(tarData);
+    const enc2 = cipher.final();
+    const auth = cipher.getAuthTag();
+
+    const ciphertext = Buffer.concat([enc1, enc2]);
+
+    return {
+      ciphertext,
+      result: {
+        ephemeral_public_key: Buffer.from(eph.publicKey).toString('base64'),
+        iv: iv.toString('base64'),
+        auth_tag: auth.toString('base64'),
+      },
+    };
+  }
+}