@batalabs/virlow-crypto 3.79.0 → 3.81.0

package/dist/attachments.d.ts

@@ -0,0 +1,40 @@
+/**
+ * One place for the attachment format, shared by the web app and mcp-core so
+ * a file written by either opens in the other, and so a future format change
+ * (the key envelope) is made once.
+ *
+ * The format is the one the web app has always written: the file is a note
+ * whose title is the filename and whose content is the base64 of the bytes.
+ * `encryptedData` is "v2:<ivB64>:<ciphertextB64>" with its own IV; `iv` is
+ * the filename's IV, stored in the row's iv column.
+ */
+export declare const LEGACY_ATTACHMENT_MESSAGE = "This file uses an older format. Open it in the Virlow app.";
+/** v1 content shares the column IV with the filename and is only readable by
+ * the web app's inline fallback, which can still derive the legacy key. */
+export declare class LegacyAttachmentError extends Error {
+    constructor();
+}
+export interface EncryptedAttachment {
+    encryptedTitle: string;
+    /** "v2:<ivB64>:<ciphertextB64>" */
+    encryptedData: string;
+    /** IV of encryptedTitle (the row's iv column). */
+    iv: string;
+}
+/** base64 never contains ':', so the prefix is unambiguous. */
+export declare function isV2Attachment(encryptedData: string): boolean;
+export declare function encryptAttachment(key: CryptoKey, filename: string, bytes: Uint8Array | ArrayBuffer): Promise<EncryptedAttachment>;
+/**
+ * A new encrypted filename under a fresh IV, for a rename. Safe only for v2
+ * content, which carries its own IV; the API refuses it for anything else.
+ */
+export declare function encryptAttachmentName(key: CryptoKey, filename: string): Promise<{
+    encryptedTitle: string;
+    iv: string;
+}>;
+export declare function decryptAttachmentData(key: CryptoKey, encryptedData: string): Promise<Uint8Array>;
+export declare function decryptAttachment(key: CryptoKey, enc: EncryptedAttachment): Promise<{
+    filename: string;
+    bytes: Uint8Array;
+}>;
+//# sourceMappingURL=attachments.d.ts.map

package/dist/attachments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.d.ts","sourceRoot":"","sources":["../src/attachments.ts"],"names":[],"mappings":"AAIA;;;;;;;;;GASG;AAEH,eAAO,MAAM,yBAAyB,+DAA+D,CAAC;AAEtG;2EAC2E;AAC3E,qBAAa,qBAAsB,SAAQ,KAAK;;CAK/C;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,SAAS,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,UAAU,GAAG,WAAW,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAG9B;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,SAAS,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAQjD;AAED,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CActG;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC,CAMlD"}

package/dist/attachments.js

@@ -0,0 +1,59 @@
+import { base64ToArrayBuffer, base64ToBytes, bytesToBase64 } from './base64.js';
+import { ENCRYPTION_CONFIG } from './constants.js';
+import { decryptTitleField, encryptNoteFields } from './notes.js';
+/**
+ * One place for the attachment format, shared by the web app and mcp-core so
+ * a file written by either opens in the other, and so a future format change
+ * (the key envelope) is made once.
+ *
+ * The format is the one the web app has always written: the file is a note
+ * whose title is the filename and whose content is the base64 of the bytes.
+ * `encryptedData` is "v2:<ivB64>:<ciphertextB64>" with its own IV; `iv` is
+ * the filename's IV, stored in the row's iv column.
+ */
+export const LEGACY_ATTACHMENT_MESSAGE = 'This file uses an older format. Open it in the Virlow app.';
+/** v1 content shares the column IV with the filename and is only readable by
+ * the web app's inline fallback, which can still derive the legacy key. */
+export class LegacyAttachmentError extends Error {
+    constructor() {
+        super(LEGACY_ATTACHMENT_MESSAGE);
+        this.name = 'LegacyAttachmentError';
+    }
+}
+/** base64 never contains ':', so the prefix is unambiguous. */
+export function isV2Attachment(encryptedData) {
+    return encryptedData.startsWith('v2:');
+}
+export async function encryptAttachment(key, filename, bytes) {
+    const fields = await encryptNoteFields(key, filename, bytesToBase64(bytes));
+    return { encryptedTitle: fields.encryptedTitle, encryptedData: fields.encryptedContent, iv: fields.iv };
+}
+/**
+ * A new encrypted filename under a fresh IV, for a rename. Safe only for v2
+ * content, which carries its own IV; the API refuses it for anything else.
+ */
+export async function encryptAttachmentName(key, filename) {
+    const iv = crypto.getRandomValues(new Uint8Array(ENCRYPTION_CONFIG.IV_LENGTH));
+    const ciphertext = await crypto.subtle.encrypt({ name: ENCRYPTION_CONFIG.ALGORITHM, iv }, key, new TextEncoder().encode(filename));
+    return { encryptedTitle: bytesToBase64(ciphertext), iv: bytesToBase64(iv) };
+}
+export async function decryptAttachmentData(key, encryptedData) {
+    if (!isV2Attachment(encryptedData))
+        throw new LegacyAttachmentError();
+    const rest = encryptedData.slice(3);
+    const sep = rest.indexOf(':');
+    if (sep === -1) {
+        throw new Error('Malformed attachment ciphertext: missing the IV separator');
+    }
+    const iv = base64ToBytes(rest.slice(0, sep));
+    const plain = await crypto.subtle.decrypt({ name: ENCRYPTION_CONFIG.ALGORITHM, iv: iv }, key, base64ToArrayBuffer(rest.slice(sep + 1)));
+    return base64ToBytes(new TextDecoder().decode(plain));
+}
+export async function decryptAttachment(key, enc) {
+    // Content first: a legacy file fails with the clear message, not a GCM error
+    // from its placeholder title.
+    const bytes = await decryptAttachmentData(key, enc.encryptedData);
+    const filename = await decryptTitleField(key, enc.encryptedTitle, enc.iv);
+    return { filename, bytes };
+}
+//# sourceMappingURL=attachments.js.map

package/dist/attachments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.js","sourceRoot":"","sources":["../src/attachments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAElE;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,4DAA4D,CAAC;AAEtG;2EAC2E;AAC3E,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C;QACE,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAUD,+DAA+D;AAC/D,MAAM,UAAU,cAAc,CAAC,aAAqB;IAClD,OAAO,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAc,EACd,QAAgB,EAChB,KAA+B;IAE/B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,aAAa,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;AAC1G,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAc,EACd,QAAgB;IAEhB,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,EAAE,EAAE,EACzC,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CACnC,CAAC;IACF,OAAO,EAAE,cAAc,EAAE,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAc,EAAE,aAAqB;IAC/E,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC;QAAE,MAAM,IAAI,qBAAqB,EAAE,CAAC;IACtE,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACvC,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,EAAE,EAAE,EAAkB,EAAE,EAC7D,GAAG,EACH,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,OAAO,aAAa,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAc,EACd,GAAwB;IAExB,6EAA6E;IAC7E,8BAA8B;IAC9B,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/dist/cjs/attachments.d.ts

@@ -0,0 +1,39 @@
+/**
+ * One place for the attachment format, shared by the web app and mcp-core so
+ * a file written by either opens in the other, and so a future format change
+ * (the key envelope) is made once.
+ *
+ * The format is the one the web app has always written: the file is a note
+ * whose title is the filename and whose content is the base64 of the bytes.
+ * `encryptedData` is "v2:<ivB64>:<ciphertextB64>" with its own IV; `iv` is
+ * the filename's IV, stored in the row's iv column.
+ */
+export declare const LEGACY_ATTACHMENT_MESSAGE = "This file uses an older format. Open it in the Virlow app.";
+/** v1 content shares the column IV with the filename and is only readable by
+ * the web app's inline fallback, which can still derive the legacy key. */
+export declare class LegacyAttachmentError extends Error {
+    constructor();
+}
+export interface EncryptedAttachment {
+    encryptedTitle: string;
+    /** "v2:<ivB64>:<ciphertextB64>" */
+    encryptedData: string;
+    /** IV of encryptedTitle (the row's iv column). */
+    iv: string;
+}
+/** base64 never contains ':', so the prefix is unambiguous. */
+export declare function isV2Attachment(encryptedData: string): boolean;
+export declare function encryptAttachment(key: CryptoKey, filename: string, bytes: Uint8Array | ArrayBuffer): Promise<EncryptedAttachment>;
+/**
+ * A new encrypted filename under a fresh IV, for a rename. Safe only for v2
+ * content, which carries its own IV; the API refuses it for anything else.
+ */
+export declare function encryptAttachmentName(key: CryptoKey, filename: string): Promise<{
+    encryptedTitle: string;
+    iv: string;
+}>;
+export declare function decryptAttachmentData(key: CryptoKey, encryptedData: string): Promise<Uint8Array>;
+export declare function decryptAttachment(key: CryptoKey, enc: EncryptedAttachment): Promise<{
+    filename: string;
+    bytes: Uint8Array;
+}>;

package/dist/cjs/attachments.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LegacyAttachmentError = exports.LEGACY_ATTACHMENT_MESSAGE = void 0;
+exports.isV2Attachment = isV2Attachment;
+exports.encryptAttachment = encryptAttachment;
+exports.encryptAttachmentName = encryptAttachmentName;
+exports.decryptAttachmentData = decryptAttachmentData;
+exports.decryptAttachment = decryptAttachment;
+const base64_js_1 = require("./base64.js");
+const constants_js_1 = require("./constants.js");
+const notes_js_1 = require("./notes.js");
+/**
+ * One place for the attachment format, shared by the web app and mcp-core so
+ * a file written by either opens in the other, and so a future format change
+ * (the key envelope) is made once.
+ *
+ * The format is the one the web app has always written: the file is a note
+ * whose title is the filename and whose content is the base64 of the bytes.
+ * `encryptedData` is "v2:<ivB64>:<ciphertextB64>" with its own IV; `iv` is
+ * the filename's IV, stored in the row's iv column.
+ */
+exports.LEGACY_ATTACHMENT_MESSAGE = 'This file uses an older format. Open it in the Virlow app.';
+/** v1 content shares the column IV with the filename and is only readable by
+ * the web app's inline fallback, which can still derive the legacy key. */
+class LegacyAttachmentError extends Error {
+    constructor() {
+        super(exports.LEGACY_ATTACHMENT_MESSAGE);
+        this.name = 'LegacyAttachmentError';
+    }
+}
+exports.LegacyAttachmentError = LegacyAttachmentError;
+/** base64 never contains ':', so the prefix is unambiguous. */
+function isV2Attachment(encryptedData) {
+    return encryptedData.startsWith('v2:');
+}
+async function encryptAttachment(key, filename, bytes) {
+    const fields = await (0, notes_js_1.encryptNoteFields)(key, filename, (0, base64_js_1.bytesToBase64)(bytes));
+    return { encryptedTitle: fields.encryptedTitle, encryptedData: fields.encryptedContent, iv: fields.iv };
+}
+/**
+ * A new encrypted filename under a fresh IV, for a rename. Safe only for v2
+ * content, which carries its own IV; the API refuses it for anything else.
+ */
+async function encryptAttachmentName(key, filename) {
+    const iv = crypto.getRandomValues(new Uint8Array(constants_js_1.ENCRYPTION_CONFIG.IV_LENGTH));
+    const ciphertext = await crypto.subtle.encrypt({ name: constants_js_1.ENCRYPTION_CONFIG.ALGORITHM, iv }, key, new TextEncoder().encode(filename));
+    return { encryptedTitle: (0, base64_js_1.bytesToBase64)(ciphertext), iv: (0, base64_js_1.bytesToBase64)(iv) };
+}
+async function decryptAttachmentData(key, encryptedData) {
+    if (!isV2Attachment(encryptedData))
+        throw new LegacyAttachmentError();
+    const rest = encryptedData.slice(3);
+    const sep = rest.indexOf(':');
+    if (sep === -1) {
+        throw new Error('Malformed attachment ciphertext: missing the IV separator');
+    }
+    const iv = (0, base64_js_1.base64ToBytes)(rest.slice(0, sep));
+    const plain = await crypto.subtle.decrypt({ name: constants_js_1.ENCRYPTION_CONFIG.ALGORITHM, iv: iv }, key, (0, base64_js_1.base64ToArrayBuffer)(rest.slice(sep + 1)));
+    return (0, base64_js_1.base64ToBytes)(new TextDecoder().decode(plain));
+}
+async function decryptAttachment(key, enc) {
+    // Content first: a legacy file fails with the clear message, not a GCM error
+    // from its placeholder title.
+    const bytes = await decryptAttachmentData(key, enc.encryptedData);
+    const filename = await (0, notes_js_1.decryptTitleField)(key, enc.encryptedTitle, enc.iv);
+    return { filename, bytes };
+}

package/dist/cjs/index.d.ts

@@ -3,5 +3,6 @@ export { decryptBytesBlob, decryptStringBlob, encryptBytesBlob, encryptStringBlo
 export { ENCRYPTION_CONFIG, VERIFIER_CONSTANT } from './constants.js';
 export { deriveMasterKey, importMasterKey } from './keys.js';
 export { decryptNoteFields, decryptTitleField, encryptNoteFields, type EncryptedNoteFields, } from './notes.js';
+export { LEGACY_ATTACHMENT_MESSAGE, LegacyAttachmentError, decryptAttachment, decryptAttachmentData, encryptAttachment, encryptAttachmentName, isV2Attachment, type EncryptedAttachment, } from './attachments.js';
 export { canDecryptWithKey, createVerifierBlob, verifyVerifierBlob, type VerifierBlob, } from './verifier.js';
 export declare const PACKAGE_NAME = "@batalabs/virlow-crypto";

package/dist/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PACKAGE_NAME = exports.verifyVerifierBlob = exports.createVerifierBlob = exports.canDecryptWithKey = exports.encryptNoteFields = exports.decryptTitleField = exports.decryptNoteFields = exports.importMasterKey = exports.deriveMasterKey = exports.VERIFIER_CONSTANT = exports.ENCRYPTION_CONFIG = exports.encryptStringBlob = exports.encryptBytesBlob = exports.decryptStringBlob = exports.decryptBytesBlob = exports.bytesToBase64 = exports.base64ToBytes = exports.base64ToArrayBuffer = void 0;
+exports.PACKAGE_NAME = exports.verifyVerifierBlob = exports.createVerifierBlob = exports.canDecryptWithKey = exports.isV2Attachment = exports.encryptAttachmentName = exports.encryptAttachment = exports.decryptAttachmentData = exports.decryptAttachment = exports.LegacyAttachmentError = exports.LEGACY_ATTACHMENT_MESSAGE = exports.encryptNoteFields = exports.decryptTitleField = exports.decryptNoteFields = exports.importMasterKey = exports.deriveMasterKey = exports.VERIFIER_CONSTANT = exports.ENCRYPTION_CONFIG = exports.encryptStringBlob = exports.encryptBytesBlob = exports.decryptStringBlob = exports.decryptBytesBlob = exports.bytesToBase64 = exports.base64ToBytes = exports.base64ToArrayBuffer = void 0;
 var base64_js_1 = require("./base64.js");
 Object.defineProperty(exports, "base64ToArrayBuffer", { enumerable: true, get: function () { return base64_js_1.base64ToArrayBuffer; } });
 Object.defineProperty(exports, "base64ToBytes", { enumerable: true, get: function () { return base64_js_1.base64ToBytes; } });
@@ -20,6 +20,14 @@ var notes_js_1 = require("./notes.js");
 Object.defineProperty(exports, "decryptNoteFields", { enumerable: true, get: function () { return notes_js_1.decryptNoteFields; } });
 Object.defineProperty(exports, "decryptTitleField", { enumerable: true, get: function () { return notes_js_1.decryptTitleField; } });
 Object.defineProperty(exports, "encryptNoteFields", { enumerable: true, get: function () { return notes_js_1.encryptNoteFields; } });
+var attachments_js_1 = require("./attachments.js");
+Object.defineProperty(exports, "LEGACY_ATTACHMENT_MESSAGE", { enumerable: true, get: function () { return attachments_js_1.LEGACY_ATTACHMENT_MESSAGE; } });
+Object.defineProperty(exports, "LegacyAttachmentError", { enumerable: true, get: function () { return attachments_js_1.LegacyAttachmentError; } });
+Object.defineProperty(exports, "decryptAttachment", { enumerable: true, get: function () { return attachments_js_1.decryptAttachment; } });
+Object.defineProperty(exports, "decryptAttachmentData", { enumerable: true, get: function () { return attachments_js_1.decryptAttachmentData; } });
+Object.defineProperty(exports, "encryptAttachment", { enumerable: true, get: function () { return attachments_js_1.encryptAttachment; } });
+Object.defineProperty(exports, "encryptAttachmentName", { enumerable: true, get: function () { return attachments_js_1.encryptAttachmentName; } });
+Object.defineProperty(exports, "isV2Attachment", { enumerable: true, get: function () { return attachments_js_1.isV2Attachment; } });
 var verifier_js_1 = require("./verifier.js");
 Object.defineProperty(exports, "canDecryptWithKey", { enumerable: true, get: function () { return verifier_js_1.canDecryptWithKey; } });
 Object.defineProperty(exports, "createVerifierBlob", { enumerable: true, get: function () { return verifier_js_1.createVerifierBlob; } });

package/dist/index.d.ts

@@ -3,6 +3,7 @@ export { decryptBytesBlob, decryptStringBlob, encryptBytesBlob, encryptStringBlo
 export { ENCRYPTION_CONFIG, VERIFIER_CONSTANT } from './constants.js';
 export { deriveMasterKey, importMasterKey } from './keys.js';
 export { decryptNoteFields, decryptTitleField, encryptNoteFields, type EncryptedNoteFields, } from './notes.js';
+export { LEGACY_ATTACHMENT_MESSAGE, LegacyAttachmentError, decryptAttachment, decryptAttachmentData, encryptAttachment, encryptAttachmentName, isV2Attachment, type EncryptedAttachment, } from './attachments.js';
 export { canDecryptWithKey, createVerifierBlob, verifyVerifierBlob, type VerifierBlob, } from './verifier.js';
 export declare const PACKAGE_NAME = "@batalabs/virlow-crypto";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,YAAY,GAClB,MAAM,eAAe,CAAC;AACvB,eAAO,MAAM,YAAY,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,KAAK,mBAAmB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,YAAY,GAClB,MAAM,eAAe,CAAC;AACvB,eAAO,MAAM,YAAY,4BAA4B,CAAC"}

package/dist/index.js

@@ -3,6 +3,7 @@ export { decryptBytesBlob, decryptStringBlob, encryptBytesBlob, encryptStringBlo
 export { ENCRYPTION_CONFIG, VERIFIER_CONSTANT } from './constants.js';
 export { deriveMasterKey, importMasterKey } from './keys.js';
 export { decryptNoteFields, decryptTitleField, encryptNoteFields, } from './notes.js';
+export { LEGACY_ATTACHMENT_MESSAGE, LegacyAttachmentError, decryptAttachment, decryptAttachmentData, encryptAttachment, encryptAttachmentName, isV2Attachment, } from './attachments.js';
 export { canDecryptWithKey, createVerifierBlob, verifyVerifierBlob, } from './verifier.js';
 export const PACKAGE_NAME = '@batalabs/virlow-crypto';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,eAAe,CAAC;AACvB,MAAM,CAAC,MAAM,YAAY,GAAG,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,GAEf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,eAAe,CAAC;AACvB,MAAM,CAAC,MAAM,YAAY,GAAG,yBAAyB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@batalabs/virlow-crypto",
-  "version": "3.79.0",
+  "version": "3.81.0",
   "type": "module",
   "description": "Virlow client-side encryption primitives (PBKDF2 + AES-256-GCM). Framework-free; browser and Node 20+.",
   "license": "UNLICENSED",