@batalabs/virlow-crypto 3.97.0 → 3.99.0

package/dist/chunked.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The format for a file too large to hold as one ciphertext: v3.
+ *
+ * The file gets a random key of its own. That key, wrapped by the account's
+ * master key, is the header "v3:<ivB64>:<wrappedKeyB64>", which is all the
+ * row's encryptedData column holds. The content is cut into chunks of a fixed
+ * plaintext size and each is sealed on its own with AES-256-GCM, so a reader
+ * can fetch and check any chunk without the rest, and neither end ever holds
+ * the whole file in memory.
+ *
+ * A chunk is bound to its place: its nonce is its index, and its index and
+ * whether it is the last chunk are authenticated with it. A store that
+ * reorders chunks, drops some from the end or hands back one file's chunk as
+ * another's is caught by the tag. The index can be the whole nonce because
+ * the key is used for this one file and nothing else.
+ */
+/** AES-GCM appends its authentication tag to each chunk. */
+export declare const FILE_CHUNK_OVERHEAD = 16;
+export declare function isV3Attachment(encryptedData: string): boolean;
+/** A new file key and the header that carries it, wrapped by the master key. */
+export declare function createFileKey(masterKey: CryptoKey): Promise<{
+    header: string;
+    fileKey: CryptoKey;
+}>;
+/** The file key out of a header. Fails (OperationError) under the wrong master key. */
+export declare function openFileKey(masterKey: CryptoKey, header: string): Promise<CryptoKey>;
+/** Seals chunk `index` (0-based). The result is the chunk plus FILE_CHUNK_OVERHEAD bytes. */
+export declare function encryptFileChunk(fileKey: CryptoKey, index: number, isLast: boolean, plain: Uint8Array | ArrayBuffer): Promise<Uint8Array>;
+/** Opens chunk `index`. Fails if it is not that chunk of that file, or was cut short. */
+export declare function decryptFileChunk(fileKey: CryptoKey, index: number, isLast: boolean, sealed: Uint8Array | ArrayBuffer): Promise<Uint8Array>;
+/** How many chunks a file of `size` bytes is cut into. */
+export declare function fileChunkCount(size: number, chunkSize: number): number;
+/** Where sealed chunk `index` sits in the stored object: [start, end), in bytes. */
+export declare function sealedChunkRange(size: number, chunkSize: number, index: number): {
+    start: number;
+    end: number;
+};
+/**
+ * The same file key, wrapped by another key: what sharing a workspace (or
+ * rotating its key) does to a large file. The content is untouched, so a
+ * file of any size moves over in one small write.
+ */
+export declare function rewrapFileKey(fromKey: CryptoKey, toKey: CryptoKey, header: string): Promise<string>;
+//# sourceMappingURL=chunked.d.ts.map

package/dist/chunked.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunked.d.ts","sourceRoot":"","sources":["../src/chunked.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AAEH,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAStC,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAE7D;AASD,gFAAgF;AAChF,wBAAsB,aAAa,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,CAAA;CAAE,CAAC,CAgBzG;AAED,uFAAuF;AACvF,wBAAsB,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAkB1F;AAeD,6FAA6F;AAC7F,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,SAAS,EAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,UAAU,GAAG,WAAW,GAC9B,OAAO,CAAC,UAAU,CAAC,CAErB;AAED,yFAAyF;AACzF,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,SAAS,EAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,UAAU,GAAG,WAAW,GAC/B,OAAO,CAAC,UAAU,CAAC,CAErB;AAED,0DAA0D;AAC1D,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED,oFAAoF;AACpF,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAKhC;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBzG"}

package/dist/chunked.js

@@ -0,0 +1,124 @@
+import { base64ToBytes, bytesToBase64 } from './base64.js';
+import { ENCRYPTION_CONFIG } from './constants.js';
+/**
+ * The format for a file too large to hold as one ciphertext: v3.
+ *
+ * The file gets a random key of its own. That key, wrapped by the account's
+ * master key, is the header "v3:<ivB64>:<wrappedKeyB64>", which is all the
+ * row's encryptedData column holds. The content is cut into chunks of a fixed
+ * plaintext size and each is sealed on its own with AES-256-GCM, so a reader
+ * can fetch and check any chunk without the rest, and neither end ever holds
+ * the whole file in memory.
+ *
+ * A chunk is bound to its place: its nonce is its index, and its index and
+ * whether it is the last chunk are authenticated with it. A store that
+ * reorders chunks, drops some from the end or hands back one file's chunk as
+ * another's is caught by the tag. The index can be the whole nonce because
+ * the key is used for this one file and nothing else.
+ */
+/** AES-GCM appends its authentication tag to each chunk. */
+export const FILE_CHUNK_OVERHEAD = 16;
+/** The size GCM is specified for. Nothing random goes in it, so there is no
+ *  reason for the longer IV the rest of the formats use. */
+const CHUNK_NONCE_BYTES = 12;
+const HEADER_PREFIX = 'v3:';
+const FILE_KEY_BYTES = 32;
+const AAD_LABEL = new TextEncoder().encode('virlow-file-v3');
+export function isV3Attachment(encryptedData) {
+    return encryptedData.startsWith(HEADER_PREFIX);
+}
+async function importFileKey(raw) {
+    return crypto.subtle.importKey('raw', raw, { name: ENCRYPTION_CONFIG.ALGORITHM }, false, [
+        'encrypt',
+        'decrypt',
+    ]);
+}
+/** A new file key and the header that carries it, wrapped by the master key. */
+export async function createFileKey(masterKey) {
+    const raw = crypto.getRandomValues(new Uint8Array(FILE_KEY_BYTES));
+    const iv = crypto.getRandomValues(new Uint8Array(ENCRYPTION_CONFIG.IV_LENGTH));
+    try {
+        const wrapped = await crypto.subtle.encrypt({ name: ENCRYPTION_CONFIG.ALGORITHM, iv }, masterKey, raw);
+        return {
+            header: `${HEADER_PREFIX}${bytesToBase64(iv)}:${bytesToBase64(wrapped)}`,
+            fileKey: await importFileKey(raw),
+        };
+    }
+    finally {
+        raw.fill(0);
+    }
+}
+/** The file key out of a header. Fails (OperationError) under the wrong master key. */
+export async function openFileKey(masterKey, header) {
+    if (!isV3Attachment(header))
+        throw new Error('Not a v3 attachment header');
+    const rest = header.slice(HEADER_PREFIX.length);
+    const sep = rest.indexOf(':');
+    if (sep === -1)
+        throw new Error('Malformed attachment header: missing the IV separator');
+    const raw = new Uint8Array(await crypto.subtle.decrypt({ name: ENCRYPTION_CONFIG.ALGORITHM, iv: base64ToBytes(rest.slice(0, sep)) }, masterKey, base64ToBytes(rest.slice(sep + 1))));
+    try {
+        if (raw.byteLength !== FILE_KEY_BYTES)
+            throw new Error('Malformed attachment header: wrong key length');
+        return await importFileKey(raw);
+    }
+    finally {
+        raw.fill(0);
+    }
+}
+function chunkParams(index, isLast) {
+    if (!Number.isInteger(index) || index < 0 || index > 0xffffffff) {
+        throw new Error(`Chunk index out of range: ${index}`);
+    }
+    const iv = new Uint8Array(CHUNK_NONCE_BYTES);
+    new DataView(iv.buffer).setUint32(iv.byteLength - 4, index);
+    const aad = new Uint8Array(AAD_LABEL.byteLength + 5);
+    aad.set(AAD_LABEL);
+    new DataView(aad.buffer).setUint32(AAD_LABEL.byteLength, index);
+    aad[aad.byteLength - 1] = isLast ? 1 : 0;
+    return { name: ENCRYPTION_CONFIG.ALGORITHM, iv, additionalData: aad };
+}
+/** Seals chunk `index` (0-based). The result is the chunk plus FILE_CHUNK_OVERHEAD bytes. */
+export async function encryptFileChunk(fileKey, index, isLast, plain) {
+    return new Uint8Array(await crypto.subtle.encrypt(chunkParams(index, isLast), fileKey, plain));
+}
+/** Opens chunk `index`. Fails if it is not that chunk of that file, or was cut short. */
+export async function decryptFileChunk(fileKey, index, isLast, sealed) {
+    return new Uint8Array(await crypto.subtle.decrypt(chunkParams(index, isLast), fileKey, sealed));
+}
+/** How many chunks a file of `size` bytes is cut into. */
+export function fileChunkCount(size, chunkSize) {
+    return Math.max(1, Math.ceil(size / chunkSize));
+}
+/** Where sealed chunk `index` sits in the stored object: [start, end), in bytes. */
+export function sealedChunkRange(size, chunkSize, index) {
+    const count = fileChunkCount(size, chunkSize);
+    const plain = index < count - 1 ? chunkSize : size - chunkSize * (count - 1);
+    const start = index * (chunkSize + FILE_CHUNK_OVERHEAD);
+    return { start, end: start + plain + FILE_CHUNK_OVERHEAD };
+}
+/**
+ * The same file key, wrapped by another key: what sharing a workspace (or
+ * rotating its key) does to a large file. The content is untouched, so a
+ * file of any size moves over in one small write.
+ */
+export async function rewrapFileKey(fromKey, toKey, header) {
+    if (!isV3Attachment(header))
+        throw new Error('Not a v3 attachment header');
+    const rest = header.slice(HEADER_PREFIX.length);
+    const sep = rest.indexOf(':');
+    if (sep === -1)
+        throw new Error('Malformed attachment header: missing the IV separator');
+    const raw = new Uint8Array(await crypto.subtle.decrypt({ name: ENCRYPTION_CONFIG.ALGORITHM, iv: base64ToBytes(rest.slice(0, sep)) }, fromKey, base64ToBytes(rest.slice(sep + 1))));
+    try {
+        if (raw.byteLength !== FILE_KEY_BYTES)
+            throw new Error('Malformed attachment header: wrong key length');
+        const iv = crypto.getRandomValues(new Uint8Array(ENCRYPTION_CONFIG.IV_LENGTH));
+        const wrapped = await crypto.subtle.encrypt({ name: ENCRYPTION_CONFIG.ALGORITHM, iv }, toKey, raw);
+        return `${HEADER_PREFIX}${bytesToBase64(iv)}:${bytesToBase64(wrapped)}`;
+    }
+    finally {
+        raw.fill(0);
+    }
+}
+//# sourceMappingURL=chunked.js.map

package/dist/chunked.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunked.js","sourceRoot":"","sources":["../src/chunked.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD;;;;;;;;;;;;;;;GAeG;AAEH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC;4DAC4D;AAC5D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,aAAa,GAAG,KAAK,CAAC;AAC5B,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAE7D,MAAM,UAAU,cAAc,CAAC,aAAqB;IAClD,OAAO,aAAa,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAe;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAmB,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE;QACvG,SAAS;QACT,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAoB;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IACnE,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzC,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,EAAE,EAAE,EACzC,SAAS,EACT,GAAmB,CACpB,CAAC;QACF,OAAO;YACL,MAAM,EAAE,GAAG,aAAa,GAAG,aAAa,CAAC,EAAE,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE;YACxE,OAAO,EAAE,MAAM,aAAa,CAAC,GAAG,CAAC;SAClC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,SAAoB,EAAE,MAAc;IACpE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,IAAI,UAAU,CACxB,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,EAAE,EAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAiB,EAAE,EAC5F,SAAS,EACT,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAiB,CACnD,CACF,CAAC;IACF,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,UAAU,KAAK,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACxG,OAAO,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,MAAe;IACjD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,UAAU,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,UAAU,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACrD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnB,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAChE,GAAG,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;AACxE,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAkB,EAClB,KAAa,EACb,MAAe,EACf,KAA+B;IAE/B,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAqB,CAAC,CAAC,CAAC;AACjH,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAkB,EAClB,KAAa,EACb,MAAe,EACf,MAAgC;IAEhC,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,MAAsB,CAAC,CAAC,CAAC;AAClH,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,SAAiB;IAC5D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,SAAiB,EACjB,KAAa;IAEb,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,SAAS,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,SAAS,GAAG,mBAAmB,CAAC,CAAC;IACxD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,KAAK,GAAG,mBAAmB,EAAE,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAkB,EAAE,KAAgB,EAAE,MAAc;IACtF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,IAAI,UAAU,CACxB,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,EAAE,EAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAiB,EAAE,EAC5F,OAAO,EACP,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAiB,CACnD,CACF,CAAC;IACF,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,UAAU,KAAK,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACxG,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAmB,CAAC,CAAC;QACnH,OAAO,GAAG,aAAa,GAAG,aAAa,CAAC,EAAE,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1E,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/cjs/chunked.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The format for a file too large to hold as one ciphertext: v3.
+ *
+ * The file gets a random key of its own. That key, wrapped by the account's
+ * master key, is the header "v3:<ivB64>:<wrappedKeyB64>", which is all the
+ * row's encryptedData column holds. The content is cut into chunks of a fixed
+ * plaintext size and each is sealed on its own with AES-256-GCM, so a reader
+ * can fetch and check any chunk without the rest, and neither end ever holds
+ * the whole file in memory.
+ *
+ * A chunk is bound to its place: its nonce is its index, and its index and
+ * whether it is the last chunk are authenticated with it. A store that
+ * reorders chunks, drops some from the end or hands back one file's chunk as
+ * another's is caught by the tag. The index can be the whole nonce because
+ * the key is used for this one file and nothing else.
+ */
+/** AES-GCM appends its authentication tag to each chunk. */
+export declare const FILE_CHUNK_OVERHEAD = 16;
+export declare function isV3Attachment(encryptedData: string): boolean;
+/** A new file key and the header that carries it, wrapped by the master key. */
+export declare function createFileKey(masterKey: CryptoKey): Promise<{
+    header: string;
+    fileKey: CryptoKey;
+}>;
+/** The file key out of a header. Fails (OperationError) under the wrong master key. */
+export declare function openFileKey(masterKey: CryptoKey, header: string): Promise<CryptoKey>;
+/** Seals chunk `index` (0-based). The result is the chunk plus FILE_CHUNK_OVERHEAD bytes. */
+export declare function encryptFileChunk(fileKey: CryptoKey, index: number, isLast: boolean, plain: Uint8Array | ArrayBuffer): Promise<Uint8Array>;
+/** Opens chunk `index`. Fails if it is not that chunk of that file, or was cut short. */
+export declare function decryptFileChunk(fileKey: CryptoKey, index: number, isLast: boolean, sealed: Uint8Array | ArrayBuffer): Promise<Uint8Array>;
+/** How many chunks a file of `size` bytes is cut into. */
+export declare function fileChunkCount(size: number, chunkSize: number): number;
+/** Where sealed chunk `index` sits in the stored object: [start, end), in bytes. */
+export declare function sealedChunkRange(size: number, chunkSize: number, index: number): {
+    start: number;
+    end: number;
+};
+/**
+ * The same file key, wrapped by another key: what sharing a workspace (or
+ * rotating its key) does to a large file. The content is untouched, so a
+ * file of any size moves over in one small write.
+ */
+export declare function rewrapFileKey(fromKey: CryptoKey, toKey: CryptoKey, header: string): Promise<string>;

package/dist/cjs/chunked.js

@@ -0,0 +1,134 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FILE_CHUNK_OVERHEAD = void 0;
+exports.isV3Attachment = isV3Attachment;
+exports.createFileKey = createFileKey;
+exports.openFileKey = openFileKey;
+exports.encryptFileChunk = encryptFileChunk;
+exports.decryptFileChunk = decryptFileChunk;
+exports.fileChunkCount = fileChunkCount;
+exports.sealedChunkRange = sealedChunkRange;
+exports.rewrapFileKey = rewrapFileKey;
+const base64_js_1 = require("./base64.js");
+const constants_js_1 = require("./constants.js");
+/**
+ * The format for a file too large to hold as one ciphertext: v3.
+ *
+ * The file gets a random key of its own. That key, wrapped by the account's
+ * master key, is the header "v3:<ivB64>:<wrappedKeyB64>", which is all the
+ * row's encryptedData column holds. The content is cut into chunks of a fixed
+ * plaintext size and each is sealed on its own with AES-256-GCM, so a reader
+ * can fetch and check any chunk without the rest, and neither end ever holds
+ * the whole file in memory.
+ *
+ * A chunk is bound to its place: its nonce is its index, and its index and
+ * whether it is the last chunk are authenticated with it. A store that
+ * reorders chunks, drops some from the end or hands back one file's chunk as
+ * another's is caught by the tag. The index can be the whole nonce because
+ * the key is used for this one file and nothing else.
+ */
+/** AES-GCM appends its authentication tag to each chunk. */
+exports.FILE_CHUNK_OVERHEAD = 16;
+/** The size GCM is specified for. Nothing random goes in it, so there is no
+ *  reason for the longer IV the rest of the formats use. */
+const CHUNK_NONCE_BYTES = 12;
+const HEADER_PREFIX = 'v3:';
+const FILE_KEY_BYTES = 32;
+const AAD_LABEL = new TextEncoder().encode('virlow-file-v3');
+function isV3Attachment(encryptedData) {
+    return encryptedData.startsWith(HEADER_PREFIX);
+}
+async function importFileKey(raw) {
+    return crypto.subtle.importKey('raw', raw, { name: constants_js_1.ENCRYPTION_CONFIG.ALGORITHM }, false, [
+        'encrypt',
+        'decrypt',
+    ]);
+}
+/** A new file key and the header that carries it, wrapped by the master key. */
+async function createFileKey(masterKey) {
+    const raw = crypto.getRandomValues(new Uint8Array(FILE_KEY_BYTES));
+    const iv = crypto.getRandomValues(new Uint8Array(constants_js_1.ENCRYPTION_CONFIG.IV_LENGTH));
+    try {
+        const wrapped = await crypto.subtle.encrypt({ name: constants_js_1.ENCRYPTION_CONFIG.ALGORITHM, iv }, masterKey, raw);
+        return {
+            header: `${HEADER_PREFIX}${(0, base64_js_1.bytesToBase64)(iv)}:${(0, base64_js_1.bytesToBase64)(wrapped)}`,
+            fileKey: await importFileKey(raw),
+        };
+    }
+    finally {
+        raw.fill(0);
+    }
+}
+/** The file key out of a header. Fails (OperationError) under the wrong master key. */
+async function openFileKey(masterKey, header) {
+    if (!isV3Attachment(header))
+        throw new Error('Not a v3 attachment header');
+    const rest = header.slice(HEADER_PREFIX.length);
+    const sep = rest.indexOf(':');
+    if (sep === -1)
+        throw new Error('Malformed attachment header: missing the IV separator');
+    const raw = new Uint8Array(await crypto.subtle.decrypt({ name: constants_js_1.ENCRYPTION_CONFIG.ALGORITHM, iv: (0, base64_js_1.base64ToBytes)(rest.slice(0, sep)) }, masterKey, (0, base64_js_1.base64ToBytes)(rest.slice(sep + 1))));
+    try {
+        if (raw.byteLength !== FILE_KEY_BYTES)
+            throw new Error('Malformed attachment header: wrong key length');
+        return await importFileKey(raw);
+    }
+    finally {
+        raw.fill(0);
+    }
+}
+function chunkParams(index, isLast) {
+    if (!Number.isInteger(index) || index < 0 || index > 0xffffffff) {
+        throw new Error(`Chunk index out of range: ${index}`);
+    }
+    const iv = new Uint8Array(CHUNK_NONCE_BYTES);
+    new DataView(iv.buffer).setUint32(iv.byteLength - 4, index);
+    const aad = new Uint8Array(AAD_LABEL.byteLength + 5);
+    aad.set(AAD_LABEL);
+    new DataView(aad.buffer).setUint32(AAD_LABEL.byteLength, index);
+    aad[aad.byteLength - 1] = isLast ? 1 : 0;
+    return { name: constants_js_1.ENCRYPTION_CONFIG.ALGORITHM, iv, additionalData: aad };
+}
+/** Seals chunk `index` (0-based). The result is the chunk plus FILE_CHUNK_OVERHEAD bytes. */
+async function encryptFileChunk(fileKey, index, isLast, plain) {
+    return new Uint8Array(await crypto.subtle.encrypt(chunkParams(index, isLast), fileKey, plain));
+}
+/** Opens chunk `index`. Fails if it is not that chunk of that file, or was cut short. */
+async function decryptFileChunk(fileKey, index, isLast, sealed) {
+    return new Uint8Array(await crypto.subtle.decrypt(chunkParams(index, isLast), fileKey, sealed));
+}
+/** How many chunks a file of `size` bytes is cut into. */
+function fileChunkCount(size, chunkSize) {
+    return Math.max(1, Math.ceil(size / chunkSize));
+}
+/** Where sealed chunk `index` sits in the stored object: [start, end), in bytes. */
+function sealedChunkRange(size, chunkSize, index) {
+    const count = fileChunkCount(size, chunkSize);
+    const plain = index < count - 1 ? chunkSize : size - chunkSize * (count - 1);
+    const start = index * (chunkSize + exports.FILE_CHUNK_OVERHEAD);
+    return { start, end: start + plain + exports.FILE_CHUNK_OVERHEAD };
+}
+/**
+ * The same file key, wrapped by another key: what sharing a workspace (or
+ * rotating its key) does to a large file. The content is untouched, so a
+ * file of any size moves over in one small write.
+ */
+async function rewrapFileKey(fromKey, toKey, header) {
+    if (!isV3Attachment(header))
+        throw new Error('Not a v3 attachment header');
+    const rest = header.slice(HEADER_PREFIX.length);
+    const sep = rest.indexOf(':');
+    if (sep === -1)
+        throw new Error('Malformed attachment header: missing the IV separator');
+    const raw = new Uint8Array(await crypto.subtle.decrypt({ name: constants_js_1.ENCRYPTION_CONFIG.ALGORITHM, iv: (0, base64_js_1.base64ToBytes)(rest.slice(0, sep)) }, fromKey, (0, base64_js_1.base64ToBytes)(rest.slice(sep + 1))));
+    try {
+        if (raw.byteLength !== FILE_KEY_BYTES)
+            throw new Error('Malformed attachment header: wrong key length');
+        const iv = crypto.getRandomValues(new Uint8Array(constants_js_1.ENCRYPTION_CONFIG.IV_LENGTH));
+        const wrapped = await crypto.subtle.encrypt({ name: constants_js_1.ENCRYPTION_CONFIG.ALGORITHM, iv }, toKey, raw);
+        return `${HEADER_PREFIX}${(0, base64_js_1.bytesToBase64)(iv)}:${(0, base64_js_1.bytesToBase64)(wrapped)}`;
+    }
+    finally {
+        raw.fill(0);
+    }
+}

package/dist/cjs/index.d.ts

@@ -4,5 +4,7 @@ export { ENCRYPTION_CONFIG, VERIFIER_CONSTANT } from './constants.js';
 export { deriveMasterKey, importMasterKey } from './keys.js';
 export { decryptNoteFields, decryptTitleField, encryptNoteFields, type EncryptedNoteFields, } from './notes.js';
 export { LEGACY_ATTACHMENT_MESSAGE, LegacyAttachmentError, decryptAttachment, decryptAttachmentData, encryptAttachment, encryptAttachmentName, isV2Attachment, type EncryptedAttachment, } from './attachments.js';
+export { FILE_CHUNK_OVERHEAD, createFileKey, decryptFileChunk, encryptFileChunk, fileChunkCount, isV3Attachment, openFileKey, rewrapFileKey, sealedChunkRange, } from './chunked.js';
 export { canDecryptWithKey, createVerifierBlob, verifyVerifierBlob, type VerifierBlob, } from './verifier.js';
+export { GrantRejectedError, createGrant, createIdentity, createWorkspaceKey, decryptUpdate, encryptUpdate, grantAad, grantStatement, openGrant, openIdentity, openSealed, safetyCode, sealTo, updateAad, workspaceKeyCommitment, type Grant, type GrantContext, type Identity, type IdentityPublic, type NewIdentity, type UpdateContext, } from './sharing.js';
 export declare const PACKAGE_NAME = "@batalabs/virlow-crypto";

package/dist/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PACKAGE_NAME = exports.verifyVerifierBlob = exports.createVerifierBlob = exports.canDecryptWithKey = exports.isV2Attachment = exports.encryptAttachmentName = exports.encryptAttachment = exports.decryptAttachmentData = exports.decryptAttachment = exports.LegacyAttachmentError = exports.LEGACY_ATTACHMENT_MESSAGE = exports.encryptNoteFields = exports.decryptTitleField = exports.decryptNoteFields = exports.importMasterKey = exports.deriveMasterKey = exports.VERIFIER_CONSTANT = exports.ENCRYPTION_CONFIG = exports.encryptStringBlob = exports.encryptBytesBlob = exports.decryptStringBlob = exports.decryptBytesBlob = exports.bytesToBase64 = exports.base64ToBytes = exports.base64ToArrayBuffer = void 0;
+exports.PACKAGE_NAME = exports.workspaceKeyCommitment = exports.updateAad = exports.sealTo = exports.safetyCode = exports.openSealed = exports.openIdentity = exports.openGrant = exports.grantStatement = exports.grantAad = exports.encryptUpdate = exports.decryptUpdate = exports.createWorkspaceKey = exports.createIdentity = exports.createGrant = exports.GrantRejectedError = exports.verifyVerifierBlob = exports.createVerifierBlob = exports.canDecryptWithKey = exports.sealedChunkRange = exports.rewrapFileKey = exports.openFileKey = exports.isV3Attachment = exports.fileChunkCount = exports.encryptFileChunk = exports.decryptFileChunk = exports.createFileKey = exports.FILE_CHUNK_OVERHEAD = exports.isV2Attachment = exports.encryptAttachmentName = exports.encryptAttachment = exports.decryptAttachmentData = exports.decryptAttachment = exports.LegacyAttachmentError = exports.LEGACY_ATTACHMENT_MESSAGE = exports.encryptNoteFields = exports.decryptTitleField = exports.decryptNoteFields = exports.importMasterKey = exports.deriveMasterKey = exports.VERIFIER_CONSTANT = exports.ENCRYPTION_CONFIG = exports.encryptStringBlob = exports.encryptBytesBlob = exports.decryptStringBlob = exports.decryptBytesBlob = exports.bytesToBase64 = exports.base64ToBytes = exports.base64ToArrayBuffer = void 0;
 var base64_js_1 = require("./base64.js");
 Object.defineProperty(exports, "base64ToArrayBuffer", { enumerable: true, get: function () { return base64_js_1.base64ToArrayBuffer; } });
 Object.defineProperty(exports, "base64ToBytes", { enumerable: true, get: function () { return base64_js_1.base64ToBytes; } });
@@ -28,8 +28,34 @@ Object.defineProperty(exports, "decryptAttachmentData", { enumerable: true, get:
 Object.defineProperty(exports, "encryptAttachment", { enumerable: true, get: function () { return attachments_js_1.encryptAttachment; } });
 Object.defineProperty(exports, "encryptAttachmentName", { enumerable: true, get: function () { return attachments_js_1.encryptAttachmentName; } });
 Object.defineProperty(exports, "isV2Attachment", { enumerable: true, get: function () { return attachments_js_1.isV2Attachment; } });
+var chunked_js_1 = require("./chunked.js");
+Object.defineProperty(exports, "FILE_CHUNK_OVERHEAD", { enumerable: true, get: function () { return chunked_js_1.FILE_CHUNK_OVERHEAD; } });
+Object.defineProperty(exports, "createFileKey", { enumerable: true, get: function () { return chunked_js_1.createFileKey; } });
+Object.defineProperty(exports, "decryptFileChunk", { enumerable: true, get: function () { return chunked_js_1.decryptFileChunk; } });
+Object.defineProperty(exports, "encryptFileChunk", { enumerable: true, get: function () { return chunked_js_1.encryptFileChunk; } });
+Object.defineProperty(exports, "fileChunkCount", { enumerable: true, get: function () { return chunked_js_1.fileChunkCount; } });
+Object.defineProperty(exports, "isV3Attachment", { enumerable: true, get: function () { return chunked_js_1.isV3Attachment; } });
+Object.defineProperty(exports, "openFileKey", { enumerable: true, get: function () { return chunked_js_1.openFileKey; } });
+Object.defineProperty(exports, "rewrapFileKey", { enumerable: true, get: function () { return chunked_js_1.rewrapFileKey; } });
+Object.defineProperty(exports, "sealedChunkRange", { enumerable: true, get: function () { return chunked_js_1.sealedChunkRange; } });
 var verifier_js_1 = require("./verifier.js");
 Object.defineProperty(exports, "canDecryptWithKey", { enumerable: true, get: function () { return verifier_js_1.canDecryptWithKey; } });
 Object.defineProperty(exports, "createVerifierBlob", { enumerable: true, get: function () { return verifier_js_1.createVerifierBlob; } });
 Object.defineProperty(exports, "verifyVerifierBlob", { enumerable: true, get: function () { return verifier_js_1.verifyVerifierBlob; } });
+var sharing_js_1 = require("./sharing.js");
+Object.defineProperty(exports, "GrantRejectedError", { enumerable: true, get: function () { return sharing_js_1.GrantRejectedError; } });
+Object.defineProperty(exports, "createGrant", { enumerable: true, get: function () { return sharing_js_1.createGrant; } });
+Object.defineProperty(exports, "createIdentity", { enumerable: true, get: function () { return sharing_js_1.createIdentity; } });
+Object.defineProperty(exports, "createWorkspaceKey", { enumerable: true, get: function () { return sharing_js_1.createWorkspaceKey; } });
+Object.defineProperty(exports, "decryptUpdate", { enumerable: true, get: function () { return sharing_js_1.decryptUpdate; } });
+Object.defineProperty(exports, "encryptUpdate", { enumerable: true, get: function () { return sharing_js_1.encryptUpdate; } });
+Object.defineProperty(exports, "grantAad", { enumerable: true, get: function () { return sharing_js_1.grantAad; } });
+Object.defineProperty(exports, "grantStatement", { enumerable: true, get: function () { return sharing_js_1.grantStatement; } });
+Object.defineProperty(exports, "openGrant", { enumerable: true, get: function () { return sharing_js_1.openGrant; } });
+Object.defineProperty(exports, "openIdentity", { enumerable: true, get: function () { return sharing_js_1.openIdentity; } });
+Object.defineProperty(exports, "openSealed", { enumerable: true, get: function () { return sharing_js_1.openSealed; } });
+Object.defineProperty(exports, "safetyCode", { enumerable: true, get: function () { return sharing_js_1.safetyCode; } });
+Object.defineProperty(exports, "sealTo", { enumerable: true, get: function () { return sharing_js_1.sealTo; } });
+Object.defineProperty(exports, "updateAad", { enumerable: true, get: function () { return sharing_js_1.updateAad; } });
+Object.defineProperty(exports, "workspaceKeyCommitment", { enumerable: true, get: function () { return sharing_js_1.workspaceKeyCommitment; } });
 exports.PACKAGE_NAME = '@batalabs/virlow-crypto';

package/dist/cjs/sharing.d.ts

@@ -0,0 +1,74 @@
+export interface IdentityPublic {
+    /** X25519 public key, raw, base64. */
+    box: string;
+    /** Ed25519 public key, raw, base64. */
+    sign: string;
+}
+export interface Identity {
+    public: IdentityPublic;
+    boxPrivate: CryptoKey;
+    signPrivate: CryptoKey;
+}
+export interface NewIdentity {
+    identity: Identity;
+    /** "v2:" blob, under the account key, of the private halves. */
+    sealedPrivate: string;
+}
+export interface GrantContext {
+    workspaceId: string;
+    keyVersion: number;
+    recipientUserId: string;
+}
+export interface Grant {
+    /** "s1:" blob: the workspace key, sealed to the recipient. */
+    sealed: string;
+    /** Ed25519 over the grant statement, base64. */
+    signature: string;
+}
+/** A new identity, and its private halves sealed under the account key. */
+export declare function createIdentity(accountKey: CryptoKey): Promise<NewIdentity>;
+/** The identity out of its sealed private halves. Fails under the wrong account key. */
+export declare function openIdentity(accountKey: CryptoKey, sealedPrivate: string, publicHalves: IdentityPublic): Promise<Identity>;
+/**
+ * The code two people compare to know they hold each other's real keys:
+ * twelve groups of five digits from SHA-512 over both public keys, each group
+ * five bytes of the digest modulo 100000, as Signal's safety numbers are.
+ */
+export declare function safetyCode(publicHalves: IdentityPublic): Promise<string>;
+/** A new workspace key: the raw bytes (to seal to members, then forget) and the key. */
+export declare function createWorkspaceKey(): Promise<{
+    raw: Uint8Array;
+    key: CryptoKey;
+}>;
+export declare function grantAad(context: GrantContext): Uint8Array;
+export declare function workspaceKeyCommitment(raw: Uint8Array): Promise<Uint8Array>;
+export declare function grantStatement(context: GrantContext, recipientBox: string, commitment: Uint8Array): Uint8Array;
+/** Seal raw key bytes to a box public key, bound to `aad`. */
+export declare function sealTo(recipientBox: string, raw: Uint8Array, aad: Uint8Array): Promise<string>;
+/** The raw bytes out of a sealed blob. Fails for anyone but the recipient, or under other `aad`. */
+export declare function openSealed(identity: Identity, sealed: string, aad: Uint8Array): Promise<Uint8Array>;
+/** A grant of `raw` to one member, sealed to them and signed by the granter. */
+export declare function createGrant(granter: Identity, recipientBox: string, raw: Uint8Array, context: GrantContext): Promise<Grant>;
+export declare class GrantRejectedError extends Error {
+    constructor(message: string);
+}
+/**
+ * Open a grant made to this identity and check it: the seal (bound to the
+ * context) and the granter's signature over the key's commitment.
+ * `granterSign` must be the signing key this person first saw for the
+ * granter, never one just fetched without comparing.
+ */
+export declare function openGrant(identity: Identity, grant: Grant, context: GrantContext, granterSign: string): Promise<{
+    raw: Uint8Array;
+    key: CryptoKey;
+}>;
+export interface UpdateContext {
+    noteId: string;
+    keyVersion: number;
+    authorUserId: string;
+    counter: number;
+}
+export declare function updateAad(context: UpdateContext): Uint8Array;
+/** A co-editing update (or snapshot, or awareness message) under the workspace key: iv || ciphertext. */
+export declare function encryptUpdate(key: CryptoKey, update: Uint8Array, context: UpdateContext): Promise<Uint8Array>;
+export declare function decryptUpdate(key: CryptoKey, sealed: Uint8Array, context: UpdateContext): Promise<Uint8Array>;

package/dist/cjs/sharing.js

@@ -0,0 +1,222 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GrantRejectedError = void 0;
+exports.createIdentity = createIdentity;
+exports.openIdentity = openIdentity;
+exports.safetyCode = safetyCode;
+exports.createWorkspaceKey = createWorkspaceKey;
+exports.grantAad = grantAad;
+exports.workspaceKeyCommitment = workspaceKeyCommitment;
+exports.grantStatement = grantStatement;
+exports.sealTo = sealTo;
+exports.openSealed = openSealed;
+exports.createGrant = createGrant;
+exports.openGrant = openGrant;
+exports.updateAad = updateAad;
+exports.encryptUpdate = encryptUpdate;
+exports.decryptUpdate = decryptUpdate;
+const base64_js_1 = require("./base64.js");
+const blob_js_1 = require("./blob.js");
+const constants_js_1 = require("./constants.js");
+/**
+ * Keys for shared workspaces (docs/superpowers/specs/2026-10-14-shared-workspaces-design.md).
+ *
+ * A person has an identity: an X25519 pair ("box") that workspace keys are
+ * sealed to, and an Ed25519 pair ("sign") that signs the grants they make.
+ * The public halves are stored in the clear; the private halves are sealed
+ * under the account key, so the server never holds them.
+ *
+ * A shared workspace has its own AES-256-GCM key, handed to each member as a
+ * grant: the key sealed to the member's box key and bound to one workspace,
+ * one key version and one person, plus the granter's signature over a
+ * commitment to the key. A member uses a key only once the grant opens and
+ * the signature checks out against the granter they remember, so a server
+ * that swaps keys or moves grants is caught.
+ *
+ * VirlowCrypto (iOS) implements the same formats; test/sharing.vectors.json
+ * holds values both sides check.
+ */
+const SEAL_PREFIX = 's1:';
+const SEAL_INFO = new TextEncoder().encode('virlow-seal-v1');
+const COMMIT_LABEL = new TextEncoder().encode('virlow-wk-commit-v1');
+const GCM_NONCE_BYTES = 12;
+const WORKSPACE_KEY_BYTES = 32;
+const X25519_PUBLIC_BYTES = 32;
+const subtle = () => crypto.subtle;
+const encode = (text) => new TextEncoder().encode(text);
+function concat(...parts) {
+    const out = new Uint8Array(parts.reduce((n, p) => n + p.byteLength, 0));
+    let offset = 0;
+    for (const part of parts) {
+        out.set(part, offset);
+        offset += part.byteLength;
+    }
+    return out;
+}
+async function importBoxPublic(raw) {
+    if (raw.byteLength !== X25519_PUBLIC_BYTES)
+        throw new Error('Malformed box key: wrong length');
+    return subtle().importKey('raw', raw, { name: 'X25519' }, true, []);
+}
+async function importSignPublic(raw) {
+    return subtle().importKey('raw', raw, { name: 'Ed25519' }, false, ['verify']);
+}
+async function importWorkspaceKey(raw) {
+    return subtle().importKey('raw', raw, { name: constants_js_1.ENCRYPTION_CONFIG.ALGORITHM }, false, [
+        'encrypt',
+        'decrypt',
+    ]);
+}
+// ---------------------------------------------------------------- identity
+/** A new identity, and its private halves sealed under the account key. */
+async function createIdentity(accountKey) {
+    const box = (await subtle().generateKey({ name: 'X25519' }, true, ['deriveBits']));
+    const sign = (await subtle().generateKey({ name: 'Ed25519' }, true, ['sign', 'verify']));
+    const publicHalves = {
+        box: (0, base64_js_1.bytesToBase64)(await subtle().exportKey('raw', box.publicKey)),
+        sign: (0, base64_js_1.bytesToBase64)(await subtle().exportKey('raw', sign.publicKey)),
+    };
+    const privateHalves = JSON.stringify({
+        v: 1,
+        box: (0, base64_js_1.bytesToBase64)(await subtle().exportKey('pkcs8', box.privateKey)),
+        sign: (0, base64_js_1.bytesToBase64)(await subtle().exportKey('pkcs8', sign.privateKey)),
+    });
+    const sealedPrivate = await (0, blob_js_1.encryptStringBlob)(accountKey, privateHalves);
+    // Hand back keys that cannot be exported again.
+    return { identity: await openIdentity(accountKey, sealedPrivate, publicHalves), sealedPrivate };
+}
+/** The identity out of its sealed private halves. Fails under the wrong account key. */
+async function openIdentity(accountKey, sealedPrivate, publicHalves) {
+    const parsed = JSON.parse(await (0, blob_js_1.decryptStringBlob)(accountKey, sealedPrivate));
+    if (parsed.v !== 1 || !parsed.box || !parsed.sign)
+        throw new Error('Unsupported identity format');
+    const boxPrivate = await subtle().importKey('pkcs8', (0, base64_js_1.base64ToBytes)(parsed.box), { name: 'X25519' }, false, [
+        'deriveBits',
+    ]);
+    const signPrivate = await subtle().importKey('pkcs8', (0, base64_js_1.base64ToBytes)(parsed.sign), { name: 'Ed25519' }, false, [
+        'sign',
+    ]);
+    return { public: publicHalves, boxPrivate, signPrivate };
+}
+/**
+ * The code two people compare to know they hold each other's real keys:
+ * twelve groups of five digits from SHA-512 over both public keys, each group
+ * five bytes of the digest modulo 100000, as Signal's safety numbers are.
+ */
+async function safetyCode(publicHalves) {
+    const digest = new Uint8Array(await subtle().digest('SHA-512', concat(encode('virlow-safety-v1'), (0, base64_js_1.base64ToBytes)(publicHalves.box), (0, base64_js_1.base64ToBytes)(publicHalves.sign))));
+    const groups = [];
+    for (let i = 0; i < 12; i++) {
+        let n = 0;
+        for (let j = 0; j < 5; j++)
+            n = n * 256 + (digest[i * 5 + j] ?? 0);
+        groups.push((n % 100000).toString().padStart(5, '0'));
+    }
+    return groups.join(' ');
+}
+// ---------------------------------------------------------- workspace keys
+/** A new workspace key: the raw bytes (to seal to members, then forget) and the key. */
+async function createWorkspaceKey() {
+    const raw = crypto.getRandomValues(new Uint8Array(WORKSPACE_KEY_BYTES));
+    return { raw, key: await importWorkspaceKey(raw) };
+}
+function grantAad(context) {
+    return encode(`virlow-grant-v1\n${context.workspaceId}\n${context.keyVersion}\n${context.recipientUserId}`);
+}
+async function workspaceKeyCommitment(raw) {
+    return new Uint8Array(await subtle().digest('SHA-256', concat(COMMIT_LABEL, raw)));
+}
+function grantStatement(context, recipientBox, commitment) {
+    return encode(`virlow-grant-v1\n${context.workspaceId}\n${context.keyVersion}\n${context.recipientUserId}\n${recipientBox}\n${(0, base64_js_1.bytesToBase64)(commitment)}`);
+}
+async function sealKey(ephemeralPrivate, ephemeralPublicRaw, recipientBoxRaw) {
+    const shared = await subtle().deriveBits({ name: 'X25519', public: await importBoxPublic(recipientBoxRaw) }, ephemeralPrivate, 256);
+    const ikm = await subtle().importKey('raw', shared, 'HKDF', false, ['deriveKey']);
+    return subtle().deriveKey({ name: 'HKDF', hash: 'SHA-256', salt: concat(ephemeralPublicRaw, recipientBoxRaw), info: SEAL_INFO }, ikm, { name: constants_js_1.ENCRYPTION_CONFIG.ALGORITHM, length: 256 }, false, ['encrypt', 'decrypt']);
+}
+/** Seal raw key bytes to a box public key, bound to `aad`. */
+async function sealTo(recipientBox, raw, aad) {
+    const recipientRaw = (0, base64_js_1.base64ToBytes)(recipientBox);
+    const ephemeral = (await subtle().generateKey({ name: 'X25519' }, true, ['deriveBits']));
+    const ephemeralRaw = new Uint8Array(await subtle().exportKey('raw', ephemeral.publicKey));
+    const kek = await sealKey(ephemeral.privateKey, ephemeralRaw, recipientRaw);
+    const iv = crypto.getRandomValues(new Uint8Array(GCM_NONCE_BYTES));
+    const ciphertext = new Uint8Array(await subtle().encrypt({ name: constants_js_1.ENCRYPTION_CONFIG.ALGORITHM, iv, additionalData: aad }, kek, raw));
+    return SEAL_PREFIX + (0, base64_js_1.bytesToBase64)(concat(ephemeralRaw, iv, ciphertext));
+}
+/** The raw bytes out of a sealed blob. Fails for anyone but the recipient, or under other `aad`. */
+async function openSealed(identity, sealed, aad) {
+    if (!sealed.startsWith(SEAL_PREFIX))
+        throw new Error('Malformed sealed key: missing s1 prefix');
+    const bytes = (0, base64_js_1.base64ToBytes)(sealed.slice(SEAL_PREFIX.length));
+    if (bytes.byteLength < X25519_PUBLIC_BYTES + GCM_NONCE_BYTES + 16)
+        throw new Error('Malformed sealed key: too short');
+    const ephemeralRaw = bytes.subarray(0, X25519_PUBLIC_BYTES);
+    const iv = bytes.subarray(X25519_PUBLIC_BYTES, X25519_PUBLIC_BYTES + GCM_NONCE_BYTES);
+    const ciphertext = bytes.subarray(X25519_PUBLIC_BYTES + GCM_NONCE_BYTES);
+    const shared = await subtle().deriveBits({ name: 'X25519', public: await importBoxPublic(ephemeralRaw) }, identity.boxPrivate, 256);
+    const ikm = await subtle().importKey('raw', shared, 'HKDF', false, ['deriveKey']);
+    const kek = await subtle().deriveKey({
+        name: 'HKDF',
+        hash: 'SHA-256',
+        salt: concat(ephemeralRaw, (0, base64_js_1.base64ToBytes)(identity.public.box)),
+        info: SEAL_INFO,
+    }, ikm, { name: constants_js_1.ENCRYPTION_CONFIG.ALGORITHM, length: 256 }, false, ['decrypt']);
+    return new Uint8Array(await subtle().decrypt({ name: constants_js_1.ENCRYPTION_CONFIG.ALGORITHM, iv: iv, additionalData: aad }, kek, ciphertext));
+}
+/** A grant of `raw` to one member, sealed to them and signed by the granter. */
+async function createGrant(granter, recipientBox, raw, context) {
+    if (raw.byteLength !== WORKSPACE_KEY_BYTES)
+        throw new Error('Workspace keys are 32 bytes');
+    const sealed = await sealTo(recipientBox, raw, grantAad(context));
+    const statement = grantStatement(context, recipientBox, await workspaceKeyCommitment(raw));
+    const signature = await subtle().sign('Ed25519', granter.signPrivate, statement);
+    return { sealed, signature: (0, base64_js_1.bytesToBase64)(signature) };
+}
+class GrantRejectedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GrantRejectedError';
+    }
+}
+exports.GrantRejectedError = GrantRejectedError;
+/**
+ * Open a grant made to this identity and check it: the seal (bound to the
+ * context) and the granter's signature over the key's commitment.
+ * `granterSign` must be the signing key this person first saw for the
+ * granter, never one just fetched without comparing.
+ */
+async function openGrant(identity, grant, context, granterSign) {
+    let raw;
+    try {
+        raw = await openSealed(identity, grant.sealed, grantAad(context));
+    }
+    catch {
+        throw new GrantRejectedError('This key was not sealed to you for this workspace');
+    }
+    if (raw.byteLength !== WORKSPACE_KEY_BYTES)
+        throw new GrantRejectedError('Workspace keys are 32 bytes');
+    const statement = grantStatement(context, identity.public.box, await workspaceKeyCommitment(raw));
+    const valid = await subtle().verify('Ed25519', await importSignPublic((0, base64_js_1.base64ToBytes)(granterSign)), (0, base64_js_1.base64ToBytes)(grant.signature), statement);
+    if (!valid)
+        throw new GrantRejectedError('The signature on this key does not match the person who shared it');
+    return { raw, key: await importWorkspaceKey(raw) };
+}
+function updateAad(context) {
+    return encode(`virlow-yupdate-v1\n${context.noteId}\n${context.keyVersion}\n${context.authorUserId}\n${context.counter}`);
+}
+/** A co-editing update (or snapshot, or awareness message) under the workspace key: iv || ciphertext. */
+async function encryptUpdate(key, update, context) {
+    const iv = crypto.getRandomValues(new Uint8Array(GCM_NONCE_BYTES));
+    const ciphertext = await subtle().encrypt({ name: constants_js_1.ENCRYPTION_CONFIG.ALGORITHM, iv, additionalData: updateAad(context) }, key, update);
+    return concat(iv, new Uint8Array(ciphertext));
+}
+async function decryptUpdate(key, sealed, context) {
+    if (sealed.byteLength < GCM_NONCE_BYTES + 16)
+        throw new Error('Malformed update: too short');
+    return new Uint8Array(await subtle().decrypt({
+        name: constants_js_1.ENCRYPTION_CONFIG.ALGORITHM,
+        iv: sealed.subarray(0, GCM_NONCE_BYTES),
+        additionalData: updateAad(context),
+    }, key, sealed.subarray(GCM_NONCE_BYTES)));
+}

package/dist/index.d.ts

@@ -4,6 +4,8 @@ export { ENCRYPTION_CONFIG, VERIFIER_CONSTANT } from './constants.js';
 export { deriveMasterKey, importMasterKey } from './keys.js';
 export { decryptNoteFields, decryptTitleField, encryptNoteFields, type EncryptedNoteFields, } from './notes.js';
 export { LEGACY_ATTACHMENT_MESSAGE, LegacyAttachmentError, decryptAttachment, decryptAttachmentData, encryptAttachment, encryptAttachmentName, isV2Attachment, type EncryptedAttachment, } from './attachments.js';
+export { FILE_CHUNK_OVERHEAD, createFileKey, decryptFileChunk, encryptFileChunk, fileChunkCount, isV3Attachment, openFileKey, rewrapFileKey, sealedChunkRange, } from './chunked.js';
 export { canDecryptWithKey, createVerifierBlob, verifyVerifierBlob, type VerifierBlob, } from './verifier.js';
+export { GrantRejectedError, createGrant, createIdentity, createWorkspaceKey, decryptUpdate, encryptUpdate, grantAad, grantStatement, openGrant, openIdentity, openSealed, safetyCode, sealTo, updateAad, workspaceKeyCommitment, type Grant, type GrantContext, type Identity, type IdentityPublic, type NewIdentity, type UpdateContext, } from './sharing.js';
 export declare const PACKAGE_NAME = "@batalabs/virlow-crypto";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,KAAK,mBAAmB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,YAAY,GAClB,MAAM,eAAe,CAAC;AACvB,eAAO,MAAM,YAAY,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,KAAK,mBAAmB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,WAAW,EACX,aAAa,EACb,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,YAAY,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,QAAQ,EACR,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,MAAM,EACN,SAAS,EACT,sBAAsB,EACtB,KAAK,KAAK,EACV,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AACtB,eAAO,MAAM,YAAY,4BAA4B,CAAC"}

package/dist/index.js

@@ -4,6 +4,8 @@ export { ENCRYPTION_CONFIG, VERIFIER_CONSTANT } from './constants.js';
 export { deriveMasterKey, importMasterKey } from './keys.js';
 export { decryptNoteFields, decryptTitleField, encryptNoteFields, } from './notes.js';
 export { LEGACY_ATTACHMENT_MESSAGE, LegacyAttachmentError, decryptAttachment, decryptAttachmentData, encryptAttachment, encryptAttachmentName, isV2Attachment, } from './attachments.js';
+export { FILE_CHUNK_OVERHEAD, createFileKey, decryptFileChunk, encryptFileChunk, fileChunkCount, isV3Attachment, openFileKey, rewrapFileKey, sealedChunkRange, } from './chunked.js';
 export { canDecryptWithKey, createVerifierBlob, verifyVerifierBlob, } from './verifier.js';
+export { GrantRejectedError, createGrant, createIdentity, createWorkspaceKey, decryptUpdate, encryptUpdate, grantAad, grantStatement, openGrant, openIdentity, openSealed, safetyCode, sealTo, updateAad, workspaceKeyCommitment, } from './sharing.js';
 export const PACKAGE_NAME = '@batalabs/virlow-crypto';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,GAEf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,eAAe,CAAC;AACvB,MAAM,CAAC,MAAM,YAAY,GAAG,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,GAEf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,WAAW,EACX,aAAa,EACb,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,QAAQ,EACR,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,MAAM,EACN,SAAS,EACT,sBAAsB,GAOvB,MAAM,cAAc,CAAC;AACtB,MAAM,CAAC,MAAM,YAAY,GAAG,yBAAyB,CAAC"}

package/dist/sharing.d.ts

@@ -0,0 +1,75 @@
+export interface IdentityPublic {
+    /** X25519 public key, raw, base64. */
+    box: string;
+    /** Ed25519 public key, raw, base64. */
+    sign: string;
+}
+export interface Identity {
+    public: IdentityPublic;
+    boxPrivate: CryptoKey;
+    signPrivate: CryptoKey;
+}
+export interface NewIdentity {
+    identity: Identity;
+    /** "v2:" blob, under the account key, of the private halves. */
+    sealedPrivate: string;
+}
+export interface GrantContext {
+    workspaceId: string;
+    keyVersion: number;
+    recipientUserId: string;
+}
+export interface Grant {
+    /** "s1:" blob: the workspace key, sealed to the recipient. */
+    sealed: string;
+    /** Ed25519 over the grant statement, base64. */
+    signature: string;
+}
+/** A new identity, and its private halves sealed under the account key. */
+export declare function createIdentity(accountKey: CryptoKey): Promise<NewIdentity>;
+/** The identity out of its sealed private halves. Fails under the wrong account key. */
+export declare function openIdentity(accountKey: CryptoKey, sealedPrivate: string, publicHalves: IdentityPublic): Promise<Identity>;
+/**
+ * The code two people compare to know they hold each other's real keys:
+ * twelve groups of five digits from SHA-512 over both public keys, each group
+ * five bytes of the digest modulo 100000, as Signal's safety numbers are.
+ */
+export declare function safetyCode(publicHalves: IdentityPublic): Promise<string>;
+/** A new workspace key: the raw bytes (to seal to members, then forget) and the key. */
+export declare function createWorkspaceKey(): Promise<{
+    raw: Uint8Array;
+    key: CryptoKey;
+}>;
+export declare function grantAad(context: GrantContext): Uint8Array;
+export declare function workspaceKeyCommitment(raw: Uint8Array): Promise<Uint8Array>;
+export declare function grantStatement(context: GrantContext, recipientBox: string, commitment: Uint8Array): Uint8Array;
+/** Seal raw key bytes to a box public key, bound to `aad`. */
+export declare function sealTo(recipientBox: string, raw: Uint8Array, aad: Uint8Array): Promise<string>;
+/** The raw bytes out of a sealed blob. Fails for anyone but the recipient, or under other `aad`. */
+export declare function openSealed(identity: Identity, sealed: string, aad: Uint8Array): Promise<Uint8Array>;
+/** A grant of `raw` to one member, sealed to them and signed by the granter. */
+export declare function createGrant(granter: Identity, recipientBox: string, raw: Uint8Array, context: GrantContext): Promise<Grant>;
+export declare class GrantRejectedError extends Error {
+    constructor(message: string);
+}
+/**
+ * Open a grant made to this identity and check it: the seal (bound to the
+ * context) and the granter's signature over the key's commitment.
+ * `granterSign` must be the signing key this person first saw for the
+ * granter, never one just fetched without comparing.
+ */
+export declare function openGrant(identity: Identity, grant: Grant, context: GrantContext, granterSign: string): Promise<{
+    raw: Uint8Array;
+    key: CryptoKey;
+}>;
+export interface UpdateContext {
+    noteId: string;
+    keyVersion: number;
+    authorUserId: string;
+    counter: number;
+}
+export declare function updateAad(context: UpdateContext): Uint8Array;
+/** A co-editing update (or snapshot, or awareness message) under the workspace key: iv || ciphertext. */
+export declare function encryptUpdate(key: CryptoKey, update: Uint8Array, context: UpdateContext): Promise<Uint8Array>;
+export declare function decryptUpdate(key: CryptoKey, sealed: Uint8Array, context: UpdateContext): Promise<Uint8Array>;
+//# sourceMappingURL=sharing.d.ts.map

package/dist/sharing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharing.d.ts","sourceRoot":"","sources":["../src/sharing.ts"],"names":[],"mappings":"AA8BA,MAAM,WAAW,cAAc;IAC7B,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,cAAc,CAAC;IACvB,UAAU,EAAE,SAAS,CAAC;IACtB,WAAW,EAAE,SAAS,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,KAAK;IACpB,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB;AAiCD,2EAA2E;AAC3E,wBAAsB,cAAc,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAehF;AAED,wFAAwF;AACxF,wBAAsB,YAAY,CAChC,UAAU,EAAE,SAAS,EACrB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,cAAc,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAcnB;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,YAAY,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAc9E;AAID,wFAAwF;AACxF,wBAAsB,kBAAkB,IAAI,OAAO,CAAC;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,SAAS,CAAA;CAAE,CAAC,CAGvF;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,UAAU,CAE1D;AAED,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAEjF;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,UAAU,CAI9G;AAsBD,8DAA8D;AAC9D,wBAAsB,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAUpG;AAED,oGAAoG;AACpG,wBAAsB,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAgCzG;AAED,gFAAgF;AAChF,wBAAsB,WAAW,CAC/B,OAAO,EAAE,QAAQ,EACjB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC,CAMhB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,SAAS,CAAA;CAAE,CAAC,CAiB9C;AAID,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,UAAU,CAI5D;AAED,yGAAyG;AACzG,wBAAsB,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAQnH;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAanH"}

package/dist/sharing.js

@@ -0,0 +1,205 @@
+import { base64ToBytes, bytesToBase64 } from './base64.js';
+import { decryptStringBlob, encryptStringBlob } from './blob.js';
+import { ENCRYPTION_CONFIG } from './constants.js';
+/**
+ * Keys for shared workspaces (docs/superpowers/specs/2026-10-14-shared-workspaces-design.md).
+ *
+ * A person has an identity: an X25519 pair ("box") that workspace keys are
+ * sealed to, and an Ed25519 pair ("sign") that signs the grants they make.
+ * The public halves are stored in the clear; the private halves are sealed
+ * under the account key, so the server never holds them.
+ *
+ * A shared workspace has its own AES-256-GCM key, handed to each member as a
+ * grant: the key sealed to the member's box key and bound to one workspace,
+ * one key version and one person, plus the granter's signature over a
+ * commitment to the key. A member uses a key only once the grant opens and
+ * the signature checks out against the granter they remember, so a server
+ * that swaps keys or moves grants is caught.
+ *
+ * VirlowCrypto (iOS) implements the same formats; test/sharing.vectors.json
+ * holds values both sides check.
+ */
+const SEAL_PREFIX = 's1:';
+const SEAL_INFO = new TextEncoder().encode('virlow-seal-v1');
+const COMMIT_LABEL = new TextEncoder().encode('virlow-wk-commit-v1');
+const GCM_NONCE_BYTES = 12;
+const WORKSPACE_KEY_BYTES = 32;
+const X25519_PUBLIC_BYTES = 32;
+const subtle = () => crypto.subtle;
+const encode = (text) => new TextEncoder().encode(text);
+function concat(...parts) {
+    const out = new Uint8Array(parts.reduce((n, p) => n + p.byteLength, 0));
+    let offset = 0;
+    for (const part of parts) {
+        out.set(part, offset);
+        offset += part.byteLength;
+    }
+    return out;
+}
+async function importBoxPublic(raw) {
+    if (raw.byteLength !== X25519_PUBLIC_BYTES)
+        throw new Error('Malformed box key: wrong length');
+    return subtle().importKey('raw', raw, { name: 'X25519' }, true, []);
+}
+async function importSignPublic(raw) {
+    return subtle().importKey('raw', raw, { name: 'Ed25519' }, false, ['verify']);
+}
+async function importWorkspaceKey(raw) {
+    return subtle().importKey('raw', raw, { name: ENCRYPTION_CONFIG.ALGORITHM }, false, [
+        'encrypt',
+        'decrypt',
+    ]);
+}
+// ---------------------------------------------------------------- identity
+/** A new identity, and its private halves sealed under the account key. */
+export async function createIdentity(accountKey) {
+    const box = (await subtle().generateKey({ name: 'X25519' }, true, ['deriveBits']));
+    const sign = (await subtle().generateKey({ name: 'Ed25519' }, true, ['sign', 'verify']));
+    const publicHalves = {
+        box: bytesToBase64(await subtle().exportKey('raw', box.publicKey)),
+        sign: bytesToBase64(await subtle().exportKey('raw', sign.publicKey)),
+    };
+    const privateHalves = JSON.stringify({
+        v: 1,
+        box: bytesToBase64(await subtle().exportKey('pkcs8', box.privateKey)),
+        sign: bytesToBase64(await subtle().exportKey('pkcs8', sign.privateKey)),
+    });
+    const sealedPrivate = await encryptStringBlob(accountKey, privateHalves);
+    // Hand back keys that cannot be exported again.
+    return { identity: await openIdentity(accountKey, sealedPrivate, publicHalves), sealedPrivate };
+}
+/** The identity out of its sealed private halves. Fails under the wrong account key. */
+export async function openIdentity(accountKey, sealedPrivate, publicHalves) {
+    const parsed = JSON.parse(await decryptStringBlob(accountKey, sealedPrivate));
+    if (parsed.v !== 1 || !parsed.box || !parsed.sign)
+        throw new Error('Unsupported identity format');
+    const boxPrivate = await subtle().importKey('pkcs8', base64ToBytes(parsed.box), { name: 'X25519' }, false, [
+        'deriveBits',
+    ]);
+    const signPrivate = await subtle().importKey('pkcs8', base64ToBytes(parsed.sign), { name: 'Ed25519' }, false, [
+        'sign',
+    ]);
+    return { public: publicHalves, boxPrivate, signPrivate };
+}
+/**
+ * The code two people compare to know they hold each other's real keys:
+ * twelve groups of five digits from SHA-512 over both public keys, each group
+ * five bytes of the digest modulo 100000, as Signal's safety numbers are.
+ */
+export async function safetyCode(publicHalves) {
+    const digest = new Uint8Array(await subtle().digest('SHA-512', concat(encode('virlow-safety-v1'), base64ToBytes(publicHalves.box), base64ToBytes(publicHalves.sign))));
+    const groups = [];
+    for (let i = 0; i < 12; i++) {
+        let n = 0;
+        for (let j = 0; j < 5; j++)
+            n = n * 256 + (digest[i * 5 + j] ?? 0);
+        groups.push((n % 100000).toString().padStart(5, '0'));
+    }
+    return groups.join(' ');
+}
+// ---------------------------------------------------------- workspace keys
+/** A new workspace key: the raw bytes (to seal to members, then forget) and the key. */
+export async function createWorkspaceKey() {
+    const raw = crypto.getRandomValues(new Uint8Array(WORKSPACE_KEY_BYTES));
+    return { raw, key: await importWorkspaceKey(raw) };
+}
+export function grantAad(context) {
+    return encode(`virlow-grant-v1\n${context.workspaceId}\n${context.keyVersion}\n${context.recipientUserId}`);
+}
+export async function workspaceKeyCommitment(raw) {
+    return new Uint8Array(await subtle().digest('SHA-256', concat(COMMIT_LABEL, raw)));
+}
+export function grantStatement(context, recipientBox, commitment) {
+    return encode(`virlow-grant-v1\n${context.workspaceId}\n${context.keyVersion}\n${context.recipientUserId}\n${recipientBox}\n${bytesToBase64(commitment)}`);
+}
+async function sealKey(ephemeralPrivate, ephemeralPublicRaw, recipientBoxRaw) {
+    const shared = await subtle().deriveBits({ name: 'X25519', public: await importBoxPublic(recipientBoxRaw) }, ephemeralPrivate, 256);
+    const ikm = await subtle().importKey('raw', shared, 'HKDF', false, ['deriveKey']);
+    return subtle().deriveKey({ name: 'HKDF', hash: 'SHA-256', salt: concat(ephemeralPublicRaw, recipientBoxRaw), info: SEAL_INFO }, ikm, { name: ENCRYPTION_CONFIG.ALGORITHM, length: 256 }, false, ['encrypt', 'decrypt']);
+}
+/** Seal raw key bytes to a box public key, bound to `aad`. */
+export async function sealTo(recipientBox, raw, aad) {
+    const recipientRaw = base64ToBytes(recipientBox);
+    const ephemeral = (await subtle().generateKey({ name: 'X25519' }, true, ['deriveBits']));
+    const ephemeralRaw = new Uint8Array(await subtle().exportKey('raw', ephemeral.publicKey));
+    const kek = await sealKey(ephemeral.privateKey, ephemeralRaw, recipientRaw);
+    const iv = crypto.getRandomValues(new Uint8Array(GCM_NONCE_BYTES));
+    const ciphertext = new Uint8Array(await subtle().encrypt({ name: ENCRYPTION_CONFIG.ALGORITHM, iv, additionalData: aad }, kek, raw));
+    return SEAL_PREFIX + bytesToBase64(concat(ephemeralRaw, iv, ciphertext));
+}
+/** The raw bytes out of a sealed blob. Fails for anyone but the recipient, or under other `aad`. */
+export async function openSealed(identity, sealed, aad) {
+    if (!sealed.startsWith(SEAL_PREFIX))
+        throw new Error('Malformed sealed key: missing s1 prefix');
+    const bytes = base64ToBytes(sealed.slice(SEAL_PREFIX.length));
+    if (bytes.byteLength < X25519_PUBLIC_BYTES + GCM_NONCE_BYTES + 16)
+        throw new Error('Malformed sealed key: too short');
+    const ephemeralRaw = bytes.subarray(0, X25519_PUBLIC_BYTES);
+    const iv = bytes.subarray(X25519_PUBLIC_BYTES, X25519_PUBLIC_BYTES + GCM_NONCE_BYTES);
+    const ciphertext = bytes.subarray(X25519_PUBLIC_BYTES + GCM_NONCE_BYTES);
+    const shared = await subtle().deriveBits({ name: 'X25519', public: await importBoxPublic(ephemeralRaw) }, identity.boxPrivate, 256);
+    const ikm = await subtle().importKey('raw', shared, 'HKDF', false, ['deriveKey']);
+    const kek = await subtle().deriveKey({
+        name: 'HKDF',
+        hash: 'SHA-256',
+        salt: concat(ephemeralRaw, base64ToBytes(identity.public.box)),
+        info: SEAL_INFO,
+    }, ikm, { name: ENCRYPTION_CONFIG.ALGORITHM, length: 256 }, false, ['decrypt']);
+    return new Uint8Array(await subtle().decrypt({ name: ENCRYPTION_CONFIG.ALGORITHM, iv: iv, additionalData: aad }, kek, ciphertext));
+}
+/** A grant of `raw` to one member, sealed to them and signed by the granter. */
+export async function createGrant(granter, recipientBox, raw, context) {
+    if (raw.byteLength !== WORKSPACE_KEY_BYTES)
+        throw new Error('Workspace keys are 32 bytes');
+    const sealed = await sealTo(recipientBox, raw, grantAad(context));
+    const statement = grantStatement(context, recipientBox, await workspaceKeyCommitment(raw));
+    const signature = await subtle().sign('Ed25519', granter.signPrivate, statement);
+    return { sealed, signature: bytesToBase64(signature) };
+}
+export class GrantRejectedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GrantRejectedError';
+    }
+}
+/**
+ * Open a grant made to this identity and check it: the seal (bound to the
+ * context) and the granter's signature over the key's commitment.
+ * `granterSign` must be the signing key this person first saw for the
+ * granter, never one just fetched without comparing.
+ */
+export async function openGrant(identity, grant, context, granterSign) {
+    let raw;
+    try {
+        raw = await openSealed(identity, grant.sealed, grantAad(context));
+    }
+    catch {
+        throw new GrantRejectedError('This key was not sealed to you for this workspace');
+    }
+    if (raw.byteLength !== WORKSPACE_KEY_BYTES)
+        throw new GrantRejectedError('Workspace keys are 32 bytes');
+    const statement = grantStatement(context, identity.public.box, await workspaceKeyCommitment(raw));
+    const valid = await subtle().verify('Ed25519', await importSignPublic(base64ToBytes(granterSign)), base64ToBytes(grant.signature), statement);
+    if (!valid)
+        throw new GrantRejectedError('The signature on this key does not match the person who shared it');
+    return { raw, key: await importWorkspaceKey(raw) };
+}
+export function updateAad(context) {
+    return encode(`virlow-yupdate-v1\n${context.noteId}\n${context.keyVersion}\n${context.authorUserId}\n${context.counter}`);
+}
+/** A co-editing update (or snapshot, or awareness message) under the workspace key: iv || ciphertext. */
+export async function encryptUpdate(key, update, context) {
+    const iv = crypto.getRandomValues(new Uint8Array(GCM_NONCE_BYTES));
+    const ciphertext = await subtle().encrypt({ name: ENCRYPTION_CONFIG.ALGORITHM, iv, additionalData: updateAad(context) }, key, update);
+    return concat(iv, new Uint8Array(ciphertext));
+}
+export async function decryptUpdate(key, sealed, context) {
+    if (sealed.byteLength < GCM_NONCE_BYTES + 16)
+        throw new Error('Malformed update: too short');
+    return new Uint8Array(await subtle().decrypt({
+        name: ENCRYPTION_CONFIG.ALGORITHM,
+        iv: sealed.subarray(0, GCM_NONCE_BYTES),
+        additionalData: updateAad(context),
+    }, key, sealed.subarray(GCM_NONCE_BYTES)));
+}
+//# sourceMappingURL=sharing.js.map

package/dist/sharing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharing.js","sourceRoot":"","sources":["../src/sharing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,GAAG,KAAK,CAAC;AAC1B,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC7D,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;AACrE,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAkC/B,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;AACnC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAEhE,SAAS,MAAM,CAAC,GAAG,KAAmB;IACpC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtB,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC;IAC5B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAe;IAC5C,IAAI,GAAG,CAAC,UAAU,KAAK,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC/F,OAAO,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,GAAmB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAe;IAC7C,OAAO,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,GAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAAe;IAC/C,OAAO,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,GAAmB,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE;QAClG,SAAS;QACT,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAE5E,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAqB;IACxD,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,CAAkB,CAAC;IACpG,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAkB,CAAC;IAC1G,MAAM,YAAY,GAAmB;QACnC,GAAG,EAAE,aAAa,CAAC,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,EAAE,aAAa,CAAC,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;KACrE,CAAC;IACF,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC;QACnC,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,aAAa,CAAC,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,EAAE,aAAa,CAAC,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;KACxE,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACzE,gDAAgD;IAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC,UAAU,EAAE,aAAa,EAAE,YAAY,CAAC,EAAE,aAAa,EAAE,CAAC;AAClG,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAAqB,EACrB,aAAqB,EACrB,YAA4B;IAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,aAAa,CAAC,CAI3E,CAAC;IACF,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAClG,MAAM,UAAU,GAAG,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE;QACzH,YAAY;KACb,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE;QAC5H,MAAM;KACP,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,YAA4B;IAC3D,MAAM,MAAM,GAAG,IAAI,UAAU,CAC3B,MAAM,MAAM,EAAE,CAAC,MAAM,CACnB,SAAS,EACT,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,CAAiB,CACtH,CACF,CAAC;IACF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,4EAA4E;AAE5E,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACxE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAqB;IAC5C,OAAO,MAAM,CAAC,oBAAoB,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;AAC9G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAAe;IAC1D,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,CAAiB,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAqB,EAAE,YAAoB,EAAE,UAAsB;IAChG,OAAO,MAAM,CACX,oBAAoB,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,eAAe,KAAK,YAAY,KAAK,aAAa,CAAC,UAAU,CAAC,EAAE,CAC5I,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,gBAA2B,EAC3B,kBAA8B,EAC9B,eAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC,UAAU,CACtC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC,eAAe,CAAC,EAAE,EAClE,gBAAgB,EAChB,GAAG,CACJ,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAClF,OAAO,MAAM,EAAE,CAAC,SAAS,CACvB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,kBAAkB,EAAE,eAAe,CAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,EACrH,GAAG,EACH,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAClD,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,YAAoB,EAAE,GAAe,EAAE,GAAe;IACjF,MAAM,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,CAAkB,CAAC;IAC1G,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IAC5E,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,MAAM,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,GAAmB,EAAE,EAAE,GAAG,EAAE,GAAmB,CAAC,CACjI,CAAC;IACF,OAAO,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAE,MAAc,EAAE,GAAe;IAClF,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,UAAU,GAAG,mBAAmB,GAAG,eAAe,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACtH,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC5D,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,GAAG,eAAe,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,mBAAmB,GAAG,eAAe,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC,UAAU,CACtC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC,YAAY,CAAC,EAAE,EAC/D,QAAQ,CAAC,UAAU,EACnB,GAAG,CACJ,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC,SAAS,CAClC;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAiB;QAC9E,IAAI,EAAE,SAAS;KAChB,EACD,GAAG,EACH,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAClD,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,OAAO,IAAI,UAAU,CACnB,MAAM,MAAM,EAAE,CAAC,OAAO,CACpB,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,EAAE,EAAE,EAAkB,EAAE,cAAc,EAAE,GAAmB,EAAE,EAClG,GAAG,EACH,UAA0B,CAC3B,CACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAiB,EACjB,YAAoB,EACpB,GAAe,EACf,OAAqB;IAErB,IAAI,GAAG,CAAC,UAAU,KAAK,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,SAAyB,CAAC,CAAC;IACjG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAkB,EAClB,KAAY,EACZ,OAAqB,EACrB,WAAmB;IAEnB,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,mDAAmD,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,mBAAmB;QAAE,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;IACxG,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC,MAAM,CACjC,SAAS,EACT,MAAM,gBAAgB,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,EAClD,aAAa,CAAC,KAAK,CAAC,SAAS,CAAiB,EAC9C,SAAyB,CAC1B,CAAC;IACF,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,kBAAkB,CAAC,mEAAmE,CAAC,CAAC;IAC9G,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;AACrD,CAAC;AAWD,MAAM,UAAU,SAAS,CAAC,OAAsB;IAC9C,OAAO,MAAM,CACX,sBAAsB,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,OAAO,EAAE,CAC3G,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAc,EAAE,MAAkB,EAAE,OAAsB;IAC5F,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,MAAM,EAAE,CAAC,OAAO,CACvC,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,OAAO,CAAiB,EAAE,EAC7F,GAAG,EACH,MAAsB,CACvB,CAAC;IACF,OAAO,MAAM,CAAC,EAAE,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAc,EAAE,MAAkB,EAAE,OAAsB;IAC5F,IAAI,MAAM,CAAC,UAAU,GAAG,eAAe,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC7F,OAAO,IAAI,UAAU,CACnB,MAAM,MAAM,EAAE,CAAC,OAAO,CACpB;QACE,IAAI,EAAE,iBAAiB,CAAC,SAAS;QACjC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,eAAe,CAAiB;QACvD,cAAc,EAAE,SAAS,CAAC,OAAO,CAAiB;KACnD,EACD,GAAG,EACH,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAiB,CACjD,CACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@batalabs/virlow-crypto",
-  "version": "3.97.0",
+  "version": "3.99.0",
   "type": "module",
   "description": "Virlow client-side encryption primitives (PBKDF2 + AES-256-GCM). Framework-free; browser and Node 20+.",
   "license": "UNLICENSED",