@countermeasure-platform/web-components 0.2.0

package/dist/crypto/index.js

@@ -0,0 +1,438 @@
+//#region src/crypto/types.ts
+var e = class extends Error {
+	constructor(e, t, n) {
+		super(e), this.code = t, this.cause = n, this.name = "CryptoError";
+	}
+};
+//#endregion
+//#region src/crypto/encoding.ts
+function t(t) {
+	if (typeof btoa == "function") {
+		let e = String.fromCharCode(...t);
+		return btoa(e);
+	}
+	if (typeof Buffer < "u") return Buffer.from(t).toString("base64");
+	throw new e("No base64 encoding available", "ENCODING_ERROR");
+}
+function n(t) {
+	try {
+		if (typeof atob == "function") {
+			let e = atob(t), n = new Uint8Array(e.length);
+			for (let t = 0; t < e.length; t++) n[t] = e.charCodeAt(t);
+			return n;
+		}
+		if (typeof Buffer < "u") return new Uint8Array(Buffer.from(t, "base64"));
+		throw new e("No base64 decoding available", "ENCODING_ERROR");
+	} catch (t) {
+		throw t instanceof e ? t : new e("Invalid base64 string", "ENCODING_ERROR", t);
+	}
+}
+function r(e) {
+	return Array.from(e).map((e) => e.toString(16).padStart(2, "0")).join("");
+}
+function i(t) {
+	let n = t.replace(/\s/g, "").toLowerCase();
+	if (n.length % 2 != 0) throw new e("Invalid hex string: odd length", "ENCODING_ERROR");
+	if (!/^[0-9a-f]*$/.test(n)) throw new e("Invalid hex string: non-hex characters", "ENCODING_ERROR");
+	let r = new Uint8Array(n.length / 2);
+	for (let e = 0; e < n.length; e += 2) r[e / 2] = parseInt(n.slice(e, e + 2), 16);
+	return r;
+}
+function a(e) {
+	return new TextEncoder().encode(e);
+}
+function o(e) {
+	return new TextDecoder().decode(e);
+}
+function s(e, t) {
+	let n = new Uint8Array(1 + e.length + t.length);
+	return n[0] = 1, n.set(e, 1), n.set(t, 1 + e.length), n;
+}
+function c(t) {
+	if (t.length < 14) throw new e("Invalid encrypted data: too short", "INVALID_CIPHERTEXT");
+	let n = t[0];
+	if (n !== 1) throw new e(`Unsupported encryption format version: ${String(n)}`, "INVALID_CIPHERTEXT");
+	return {
+		iv: t.slice(1, 13),
+		ciphertext: t.slice(13)
+	};
+}
+function l(e, t) {
+	if (e.length !== t.length) return !1;
+	let n = 0;
+	for (let r = 0; r < e.length; r++) n |= (e[r] ?? 0) ^ (t[r] ?? 0);
+	return n === 0;
+}
+function u(e) {
+	e.fill(0);
+}
+function d(...e) {
+	let t = e.reduce((e, t) => e + t.length, 0), n = new Uint8Array(t), r = 0;
+	for (let t of e) n.set(t, r), r += t.length;
+	return n;
+}
+//#endregion
+//#region src/crypto/encoding-helpers.ts
+function f(e, n) {
+	switch (n) {
+		case "base64": return t(e);
+		case "hex": return r(e);
+		case "raw": return o(e);
+		default: return t(e);
+	}
+}
+function p(e, t) {
+	switch (t) {
+		case "base64": return n(e);
+		case "hex": return i(e);
+		case "raw": return a(e);
+		default: return n(e);
+	}
+}
+//#endregion
+//#region src/crypto/keys.ts
+var m = 256, h = m / 8, g = 12, _ = 1e5, v = 16;
+async function y() {
+	try {
+		let e = await crypto.subtle.generateKey({
+			name: "AES-GCM",
+			length: m
+		}, !0, ["encrypt", "decrypt"]), t = await crypto.subtle.exportKey("raw", e);
+		return r(new Uint8Array(t));
+	} catch (t) {
+		throw new e("Failed to generate symmetric key", "KEY_GENERATION_FAILED", t);
+	}
+}
+async function b(t) {
+	try {
+		let n = i(t);
+		if (n.length !== h) throw new e(`Invalid key length: expected ${String(h)} bytes, got ${String(n.length)}`, "INVALID_KEY_LENGTH");
+		return await crypto.subtle.importKey("raw", n, {
+			name: "AES-GCM",
+			length: m
+		}, !1, ["encrypt", "decrypt"]);
+	} catch (t) {
+		throw t instanceof e ? t : new e("Failed to import symmetric key", "KEY_IMPORT_FAILED", t);
+	}
+}
+function x() {
+	return crypto.getRandomValues(new Uint8Array(g));
+}
+function S(e) {
+	return crypto.getRandomValues(new Uint8Array(e));
+}
+async function C(t = 4096) {
+	try {
+		let e = await crypto.subtle.generateKey({
+			name: "RSA-OAEP",
+			modulusLength: t,
+			publicExponent: new Uint8Array([
+				1,
+				0,
+				1
+			]),
+			hash: "SHA-256"
+		}, !0, ["encrypt", "decrypt"]);
+		return {
+			publicKey: e.publicKey,
+			privateKey: e.privateKey
+		};
+	} catch (t) {
+		throw new e("Failed to generate RSA key pair", "KEY_GENERATION_FAILED", t);
+	}
+}
+async function w(n) {
+	try {
+		let e = await crypto.subtle.exportKey("spki", n);
+		return E(t(new Uint8Array(e)), "PUBLIC KEY");
+	} catch (t) {
+		throw new e("Failed to export public key", "KEY_EXPORT_FAILED", t);
+	}
+}
+async function T(n) {
+	try {
+		let e = await crypto.subtle.exportKey("pkcs8", n);
+		return E(t(new Uint8Array(e)), "PRIVATE KEY");
+	} catch (t) {
+		throw new e("Failed to export private key", "KEY_EXPORT_FAILED", t);
+	}
+}
+function E(e, t) {
+	let n = [];
+	for (let t = 0; t < e.length; t += 64) n.push(e.slice(t, t + 64));
+	return `-----BEGIN ${t}-----\n${n.join("\n")}\n-----END ${t}-----`;
+}
+async function D(t) {
+	try {
+		let e = n(k(t, "PUBLIC KEY"));
+		return await crypto.subtle.importKey("spki", e, {
+			name: "RSA-OAEP",
+			hash: "SHA-256"
+		}, !0, ["encrypt"]);
+	} catch (t) {
+		throw t instanceof e ? t : new e("Failed to import public key", "KEY_IMPORT_FAILED", t);
+	}
+}
+async function O(t) {
+	try {
+		let e = n(k(t, "PRIVATE KEY"));
+		return await crypto.subtle.importKey("pkcs8", e, {
+			name: "RSA-OAEP",
+			hash: "SHA-256"
+		}, !0, ["decrypt"]);
+	} catch (t) {
+		throw t instanceof e ? t : new e("Failed to import private key", "KEY_IMPORT_FAILED", t);
+	}
+}
+function k(t, n) {
+	let r = `-----BEGIN ${n}-----`, i = `-----END ${n}-----`, a = t.indexOf(r), o = t.indexOf(i);
+	if (a === -1 || o === -1) throw new e(`Invalid PEM format: missing ${n} markers`, "INVALID_KEY");
+	return t.slice(a + r.length, o).replace(/\s/g, "");
+}
+async function A(t, n, r = {}) {
+	let { iterations: i = _, saltLength: a = v, hash: o = "SHA-256" } = r;
+	try {
+		let e = n ?? S(a), r = await crypto.subtle.importKey("raw", new TextEncoder().encode(t), "PBKDF2", !1, ["deriveBits", "deriveKey"]);
+		return {
+			key: await crypto.subtle.deriveKey({
+				name: "PBKDF2",
+				salt: e,
+				iterations: i,
+				hash: o
+			}, r, {
+				name: "AES-GCM",
+				length: m
+			}, !0, ["encrypt", "decrypt"]),
+			salt: e
+		};
+	} catch (t) {
+		throw new e("Failed to derive key from password", "KEY_DERIVATION_FAILED", t);
+	}
+}
+async function j(t) {
+	try {
+		let e = await crypto.subtle.exportKey("raw", t);
+		return r(new Uint8Array(e));
+	} catch (t) {
+		throw new e("Failed to export derived key", "KEY_EXPORT_FAILED", t);
+	}
+}
+//#endregion
+//#region src/crypto/symmetric.ts
+var M = 128, N = class t {
+	key;
+	encoding;
+	constructor(e, t) {
+		this.key = e, this.encoding = t;
+	}
+	static async create(e, n = {}) {
+		return new t(await b(e), n.encoding ?? "base64");
+	}
+	static fromKey(e, n = {}) {
+		return new t(e, n.encoding ?? "base64");
+	}
+	async encrypt(t) {
+		try {
+			let e = typeof t == "string" ? a(t) : t, n = x(), r = await crypto.subtle.encrypt({
+				name: "AES-GCM",
+				iv: n,
+				tagLength: M
+			}, this.key, e);
+			return f(s(n, new Uint8Array(r)), this.encoding);
+		} catch (t) {
+			throw t instanceof e ? t : new e("Encryption failed", "ENCRYPTION_FAILED", t);
+		}
+	}
+	async decrypt(t) {
+		try {
+			let { iv: e, ciphertext: n } = c(p(t, this.encoding)), r = await crypto.subtle.decrypt({
+				name: "AES-GCM",
+				iv: e,
+				tagLength: M
+			}, this.key, n);
+			return o(new Uint8Array(r));
+		} catch (t) {
+			throw t instanceof e ? t : new e("Decryption failed", "DECRYPTION_FAILED", t);
+		}
+	}
+	async encryptBytes(t) {
+		try {
+			let e = x(), n = await crypto.subtle.encrypt({
+				name: "AES-GCM",
+				iv: e,
+				tagLength: M
+			}, this.key, t);
+			return s(e, new Uint8Array(n));
+		} catch (t) {
+			throw t instanceof e ? t : new e("Encryption failed", "ENCRYPTION_FAILED", t);
+		}
+	}
+	async decryptBytes(t) {
+		try {
+			let { iv: e, ciphertext: n } = c(t), r = await crypto.subtle.decrypt({
+				name: "AES-GCM",
+				iv: e,
+				tagLength: M
+			}, this.key, n);
+			return new Uint8Array(r);
+		} catch (t) {
+			throw t instanceof e ? t : new e("Decryption failed", "DECRYPTION_FAILED", t);
+		}
+	}
+	getEncoding() {
+		return this.encoding;
+	}
+};
+async function P(e, t = {}) {
+	return N.create(e, t);
+}
+function F(e, t = {}) {
+	return N.fromKey(e, t);
+}
+async function I(e, t) {
+	return (await P(e)).encrypt(t);
+}
+async function L(e, t) {
+	return (await P(e)).decrypt(t);
+}
+//#endregion
+//#region src/crypto/hybrid.ts
+var R = 256, z = 128, B = 2, V = class {
+	encoding;
+	rsaKeySize;
+	constructor(e = {}) {
+		this.encoding = e.encoding ?? "base64", this.rsaKeySize = e.rsaKeySize ?? 4096;
+	}
+	async encrypt(t, n) {
+		try {
+			let e = typeof n == "string" ? a(n) : n, r = await crypto.subtle.generateKey({
+				name: "AES-GCM",
+				length: R
+			}, !0, ["encrypt", "decrypt"]), i = await crypto.subtle.exportKey("raw", r), o = await crypto.subtle.encrypt({ name: "RSA-OAEP" }, t, i), s = x(), c = await crypto.subtle.encrypt({
+				name: "AES-GCM",
+				iv: s,
+				tagLength: z
+			}, r, e), l = new Uint8Array(o), u = new Uint8Array(c), d = l.length, p = new Uint8Array(3 + d + 12 + u.length);
+			return p[0] = B, p[1] = d >> 8 & 255, p[2] = d & 255, p.set(l, 3), p.set(s, 3 + d), p.set(u, 3 + d + 12), f(p, this.encoding);
+		} catch (t) {
+			throw t instanceof e ? t : new e("Hybrid encryption failed", "ENCRYPTION_FAILED", t);
+		}
+	}
+	async decrypt(t, n) {
+		try {
+			let r = p(n, this.encoding);
+			if (r.length < 16) throw new e("Invalid hybrid ciphertext: too short", "INVALID_CIPHERTEXT");
+			let i = r[0];
+			if (i !== B) throw new e(`Unsupported hybrid encryption version: ${String(i)}`, "INVALID_CIPHERTEXT");
+			let a = (r[1] ?? 0) << 8 | (r[2] ?? 0);
+			if (r.length < 3 + a + 12 + 1) throw new e("Invalid hybrid ciphertext: truncated", "INVALID_CIPHERTEXT");
+			let o = r.slice(3, 3 + a), s = r.slice(3 + a, 3 + a + 12), c = r.slice(3 + a + 12), l = await crypto.subtle.decrypt({ name: "RSA-OAEP" }, t, o), u = await crypto.subtle.importKey("raw", l, {
+				name: "AES-GCM",
+				length: R
+			}, !1, ["decrypt"]), d = await crypto.subtle.decrypt({
+				name: "AES-GCM",
+				iv: s,
+				tagLength: z
+			}, u, c);
+			return new Uint8Array(d);
+		} catch (t) {
+			throw t instanceof e ? t : new e("Hybrid decryption failed", "DECRYPTION_FAILED", t);
+		}
+	}
+	async decryptToString(e, t) {
+		let n = await this.decrypt(e, t);
+		return new TextDecoder().decode(n);
+	}
+	getEncoding() {
+		return this.encoding;
+	}
+	getRsaKeySize() {
+		return this.rsaKeySize;
+	}
+};
+function H(e = {}) {
+	return new V(e);
+}
+async function U(e, t, n = {}) {
+	return H(n).encrypt(e, t);
+}
+async function W(e, t, n = {}) {
+	return H(n).decrypt(e, t);
+}
+async function G(e, t, n = {}) {
+	return H(n).decryptToString(e, t);
+}
+//#endregion
+//#region src/crypto/index.ts
+var K = class {
+	config;
+	constructor(e = {}) {
+		this.config = {
+			encoding: e.encoding ?? "base64",
+			rsaKeySize: e.rsaKeySize ?? 4096,
+			pbkdf2Iterations: e.pbkdf2Iterations ?? 1e5
+		};
+	}
+	async generateSymmetricKey() {
+		return y();
+	}
+	async encryptSecret(e, t) {
+		return (await P(e, { encoding: this.config.encoding })).encrypt(t);
+	}
+	async decryptSecret(e, t) {
+		return (await P(e, { encoding: this.config.encoding })).decrypt(t);
+	}
+	async generateKeyPair() {
+		return C(this.config.rsaKeySize);
+	}
+	async encrypt(e, t) {
+		return H({
+			encoding: this.config.encoding,
+			rsaKeySize: this.config.rsaKeySize
+		}).encrypt(e, t);
+	}
+	async decrypt(e, t) {
+		return H({
+			encoding: this.config.encoding,
+			rsaKeySize: this.config.rsaKeySize
+		}).decrypt(e, t);
+	}
+	async decryptToString(e, t) {
+		return H({
+			encoding: this.config.encoding,
+			rsaKeySize: this.config.rsaKeySize
+		}).decryptToString(e, t);
+	}
+	async exportPublicKey(e) {
+		return w(e);
+	}
+	async exportPrivateKey(e) {
+		return T(e);
+	}
+	async importPublicKey(e) {
+		return D(e);
+	}
+	async importPrivateKey(e) {
+		return O(e);
+	}
+	async deriveKeyFromPassword(e, t) {
+		return A(e, t, { iterations: this.config.pbkdf2Iterations });
+	}
+	getConfig() {
+		return { ...this.config };
+	}
+};
+function q(e = {}) {
+	return new K(e);
+}
+var J = null;
+function Y(e) {
+	return J ??= q(e), J;
+}
+function X(e) {
+	return q(e);
+}
+//#endregion
+export { e as CryptoError, K as CryptoManagerImpl, V as HybridCipherImpl, N as SymmetricCipherImpl, o as bytesToString, d as concat, l as constantTimeEqual, q as createCryptoManager, H as createHybridCipher, P as createSymmetricCipher, F as createSymmetricCipherFromKey, X as cryptum, c as decodeEncryptedData, p as decodeInput, L as decryptSecret, A as deriveKeyFromPassword, s as encodeEncryptedData, f as encodeOutput, I as encryptSecret, j as exportDerivedKey, T as exportPrivateKey, w as exportPublicKey, n as fromBase64, i as fromHex, x as generateIV, C as generateKeyPair, y as generateSymmetricKey, Y as getDefaultCryptoManager, W as hybridDecrypt, G as hybridDecryptToString, U as hybridEncrypt, O as importPrivateKey, D as importPublicKey, b as importSymmetricKey, S as randomBytes, a as stringToBytes, t as toBase64, r as toHex, u as zeroize };
+
+//# sourceMappingURL=index.js.map

package/dist/crypto/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../src/crypto/types.ts","../../src/crypto/encoding.ts","../../src/crypto/encoding-helpers.ts","../../src/crypto/keys.ts","../../src/crypto/symmetric.ts","../../src/crypto/hybrid.ts","../../src/crypto/index.ts"],"sourcesContent":["/**\n * Crypto Types\n * @countermeasure/web-components\n *\n * Shared TypeScript interfaces for encryption operations.\n * Designed for compatibility with FluxEncrypt (Rust).\n */\n\n// ============================================================================\n// ENCODING\n// ============================================================================\n\nexport type EncodingFormat = 'base64' | 'hex' | 'raw'\n\n// ============================================================================\n// SYMMETRIC ENCRYPTION\n// ============================================================================\n\nexport interface SymmetricCipherConfig {\n  /** Output encoding format. Default: 'base64' */\n  encoding?: EncodingFormat\n}\n\nexport interface EncryptedData {\n  /** The encrypted ciphertext */\n  ciphertext: string | Uint8Array\n  /** Initialization vector (nonce) - 12 bytes for GCM */\n  iv: string | Uint8Array\n  /** Authentication tag - 16 bytes for GCM */\n  tag?: string | Uint8Array\n}\n\nexport interface SymmetricCipher {\n  /** Encrypt plaintext data */\n  encrypt(plaintext: string | Uint8Array): Promise<string>\n  /** Decrypt ciphertext data */\n  decrypt(ciphertext: string): Promise<string>\n  /** Get the current encoding format */\n  getEncoding(): EncodingFormat\n}\n\n// ============================================================================\n// HYBRID ENCRYPTION (RSA-OAEP + AES-GCM)\n// ============================================================================\n\nexport interface HybridCipherConfig {\n  /** RSA key size in bits. Default: 4096 */\n  rsaKeySize?: 2048 | 4096\n  /** Output encoding format. Default: 'base64' */\n  encoding?: EncodingFormat\n}\n\nexport interface KeyPair {\n  publicKey: CryptoKey\n  privateKey: CryptoKey\n}\n\nexport interface ExportedKeyPair {\n  publicKey: string\n  privateKey: string\n}\n\nexport interface HybridCipher {\n  /** Encrypt data using hybrid encryption */\n  encrypt(publicKey: CryptoKey, plaintext: string | Uint8Array): Promise<string>\n  /** Decrypt data using hybrid encryption */\n  decrypt(privateKey: CryptoKey, ciphertext: string): Promise<Uint8Array>\n}\n\n// ============================================================================\n// KEY DERIVATION\n// ============================================================================\n\nexport interface KeyDerivationConfig {\n  /** Number of PBKDF2 iterations. Default: 100000 */\n  iterations?: number\n  /** Salt length in bytes. Default: 16 */\n  saltLength?: number\n  /** Hash algorithm. Default: 'SHA-256' */\n  hash?: 'SHA-256' | 'SHA-384' | 'SHA-512'\n}\n\nexport interface DerivedKeyResult {\n  key: CryptoKey\n  salt: Uint8Array\n}\n\n// ============================================================================\n// CRYPTO MANAGER (UNIFIED API)\n// ============================================================================\n\nexport interface CryptoManagerConfig {\n  /** Output encoding format. Default: 'base64' */\n  encoding?: EncodingFormat\n  /** RSA key size for hybrid encryption. Default: 4096 */\n  rsaKeySize?: 2048 | 4096\n  /** PBKDF2 iterations for key derivation. Default: 100000 */\n  pbkdf2Iterations?: number\n}\n\nexport interface CryptoManager {\n  // Symmetric operations\n  encryptSecret(key: string, plaintext: string): Promise<string>\n  decryptSecret(key: string, ciphertext: string): Promise<string>\n  generateSymmetricKey(): Promise<string>\n\n  // Hybrid operations\n  generateKeyPair(): Promise<KeyPair>\n  encrypt(publicKey: CryptoKey, data: string | Uint8Array): Promise<string>\n  decrypt(privateKey: CryptoKey, ciphertext: string): Promise<Uint8Array>\n\n  // Key management\n  exportPublicKey(key: CryptoKey): Promise<string>\n  exportPrivateKey(key: CryptoKey): Promise<string>\n  importPublicKey(pem: string): Promise<CryptoKey>\n  importPrivateKey(pem: string): Promise<CryptoKey>\n\n  // Key derivation\n  deriveKeyFromPassword(password: string, salt?: Uint8Array): Promise<DerivedKeyResult>\n}\n\n// ============================================================================\n// ERRORS\n// ============================================================================\n\nexport class CryptoError extends Error {\n  constructor(\n    message: string,\n    public readonly code: CryptoErrorCode,\n    public readonly cause?: unknown\n  ) {\n    super(message)\n    this.name = 'CryptoError'\n  }\n}\n\nexport type CryptoErrorCode =\n  | 'INVALID_KEY'\n  | 'INVALID_KEY_LENGTH'\n  | 'INVALID_CIPHERTEXT'\n  | 'DECRYPTION_FAILED'\n  | 'ENCRYPTION_FAILED'\n  | 'KEY_GENERATION_FAILED'\n  | 'KEY_DERIVATION_FAILED'\n  | 'KEY_EXPORT_FAILED'\n  | 'KEY_IMPORT_FAILED'\n  | 'UNSUPPORTED_ALGORITHM'\n  | 'ENCODING_ERROR'\n","/**\n * Encoding Utilities\n * @countermeasure/web-components\n *\n * Base64 and hex encoding/decoding utilities for encryption operations.\n * Compatible with FluxEncrypt's encoding format.\n */\n\nimport { CryptoError } from './types'\n\n// ============================================================================\n// BASE64 ENCODING\n// ============================================================================\n\n/**\n * Encode a Uint8Array to base64 string.\n * Uses URL-safe base64 without padding for compatibility.\n */\nexport function toBase64(data: Uint8Array): string {\n  if (typeof btoa === 'function') {\n    const binary = String.fromCharCode(...data)\n    return btoa(binary)\n  }\n  // Node.js fallback\n  if (typeof Buffer !== 'undefined') {\n    return Buffer.from(data).toString('base64')\n  }\n  throw new CryptoError('No base64 encoding available', 'ENCODING_ERROR')\n}\n\n/**\n * Decode a base64 string to Uint8Array.\n */\nexport function fromBase64(base64: string): Uint8Array {\n  try {\n    if (typeof atob === 'function') {\n      const binary = atob(base64)\n      const bytes = new Uint8Array(binary.length)\n      for (let i = 0; i < binary.length; i++) {\n        bytes[i] = binary.charCodeAt(i)\n      }\n      return bytes\n    }\n    // Node.js fallback\n    if (typeof Buffer !== 'undefined') {\n      return new Uint8Array(Buffer.from(base64, 'base64'))\n    }\n    throw new CryptoError('No base64 decoding available', 'ENCODING_ERROR')\n  } catch (error) {\n    if (error instanceof CryptoError) {\n      throw error\n    }\n    throw new CryptoError('Invalid base64 string', 'ENCODING_ERROR', error)\n  }\n}\n\n// ============================================================================\n// HEX ENCODING\n// ============================================================================\n\n/**\n * Encode a Uint8Array to hex string.\n */\nexport function toHex(data: Uint8Array): string {\n  return Array.from(data)\n    .map(byte => byte.toString(16).padStart(2, '0'))\n    .join('')\n}\n\n/**\n * Decode a hex string to Uint8Array.\n */\nexport function fromHex(hex: string): Uint8Array {\n  // Remove any whitespace and validate\n  const cleanHex = hex.replace(/\\s/g, '').toLowerCase()\n\n  if (cleanHex.length % 2 !== 0) {\n    throw new CryptoError('Invalid hex string: odd length', 'ENCODING_ERROR')\n  }\n\n  if (!/^[0-9a-f]*$/.test(cleanHex)) {\n    throw new CryptoError('Invalid hex string: non-hex characters', 'ENCODING_ERROR')\n  }\n\n  const bytes = new Uint8Array(cleanHex.length / 2)\n  for (let i = 0; i < cleanHex.length; i += 2) {\n    bytes[i / 2] = parseInt(cleanHex.slice(i, i + 2), 16)\n  }\n  return bytes\n}\n\n// ============================================================================\n// STRING ENCODING\n// ============================================================================\n\n/**\n * Encode a string to Uint8Array using UTF-8.\n */\nexport function stringToBytes(str: string): Uint8Array {\n  return new TextEncoder().encode(str)\n}\n\n/**\n * Decode a Uint8Array to string using UTF-8.\n */\nexport function bytesToString(bytes: Uint8Array): string {\n  return new TextDecoder().decode(bytes)\n}\n\n// ============================================================================\n// COMBINED FORMAT ENCODING\n// ============================================================================\n\n/**\n * Encode data with format prefix for self-describing ciphertext.\n * Format: [1 byte version][12 bytes IV][16 bytes tag][N bytes ciphertext]\n */\nexport function encodeEncryptedData(iv: Uint8Array, ciphertext: Uint8Array): Uint8Array {\n  // Version 1 format: version(1) + iv(12) + ciphertext(includes tag)\n  const VERSION = 0x01\n  const result = new Uint8Array(1 + iv.length + ciphertext.length)\n  result[0] = VERSION\n  result.set(iv, 1)\n  result.set(ciphertext, 1 + iv.length)\n  return result\n}\n\n/**\n * Decode encrypted data from combined format.\n * Returns { iv, ciphertext } or throws on invalid format.\n */\nexport function decodeEncryptedData(data: Uint8Array): { iv: Uint8Array; ciphertext: Uint8Array } {\n  if (data.length < 14) {\n    // Minimum: 1 version + 12 IV + 1 ciphertext byte\n    throw new CryptoError('Invalid encrypted data: too short', 'INVALID_CIPHERTEXT')\n  }\n\n  const version = data[0]\n  if (version !== 0x01) {\n    throw new CryptoError(\n      `Unsupported encryption format version: ${String(version)}`,\n      'INVALID_CIPHERTEXT'\n    )\n  }\n\n  const iv = data.slice(1, 13)\n  const ciphertext = data.slice(13)\n\n  return { iv, ciphertext }\n}\n\n// ============================================================================\n// UTILITIES\n// ============================================================================\n\n/**\n * Compare two Uint8Arrays in constant time to prevent timing attacks.\n */\nexport function constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== b.length) {\n    return false\n  }\n\n  let result = 0\n  for (let i = 0; i < a.length; i++) {\n    result |= (a[i] ?? 0) ^ (b[i] ?? 0)\n  }\n  return result === 0\n}\n\n/**\n * Securely clear a Uint8Array by overwriting with zeros.\n * Note: JavaScript doesn't guarantee memory clearing, but this is best effort.\n */\nexport function zeroize(data: Uint8Array): void {\n  data.fill(0)\n}\n\n/**\n * Concatenate multiple Uint8Arrays.\n */\nexport function concat(...arrays: Uint8Array[]): Uint8Array {\n  const totalLength = arrays.reduce((sum, arr) => sum + arr.length, 0)\n  const result = new Uint8Array(totalLength)\n  let offset = 0\n  for (const arr of arrays) {\n    result.set(arr, offset)\n    offset += arr.length\n  }\n  return result\n}\n","/**\n * Encoding Helpers\n * @countermeasure/web-components\n *\n * Shared encode/decode helpers for symmetric and hybrid cipher classes.\n * Converts between Uint8Array and string using the configured encoding format.\n */\n\nimport { toBase64, fromBase64, toHex, fromHex, bytesToString, stringToBytes } from './encoding'\nimport type { EncodingFormat } from './types'\n\nexport type { EncodingFormat }\n\n/**\n * Encode a Uint8Array to a string using the specified format.\n */\nexport function encodeOutput(data: Uint8Array, encoding: EncodingFormat): string {\n  switch (encoding) {\n    case 'base64':\n      return toBase64(data)\n    case 'hex':\n      return toHex(data)\n    case 'raw':\n      return bytesToString(data)\n    default:\n      return toBase64(data)\n  }\n}\n\n/**\n * Decode a string to a Uint8Array using the specified format.\n */\nexport function decodeInput(data: string, encoding: EncodingFormat): Uint8Array {\n  switch (encoding) {\n    case 'base64':\n      return fromBase64(data)\n    case 'hex':\n      return fromHex(data)\n    case 'raw':\n      return stringToBytes(data)\n    default:\n      return fromBase64(data)\n  }\n}\n","/**\n * Key Management\n * @countermeasure/web-components\n *\n * Key generation, import/export, and derivation utilities.\n * Compatible with FluxEncrypt's key formats.\n */\n\nimport { toBase64, fromBase64, toHex, fromHex } from './encoding'\nimport { CryptoError, type KeyPair, type DerivedKeyResult, type KeyDerivationConfig } from './types'\n\n// ============================================================================\n// CONSTANTS\n// ============================================================================\n\nconst AES_KEY_LENGTH = 256\nconst AES_KEY_BYTES = AES_KEY_LENGTH / 8\nconst IV_LENGTH = 12\nconst DEFAULT_PBKDF2_ITERATIONS = 100000\nconst DEFAULT_SALT_LENGTH = 16\n\n// ============================================================================\n// SYMMETRIC KEY GENERATION\n// ============================================================================\n\n/**\n * Generate a random AES-256 key.\n * Returns the key as a hex string (64 characters).\n */\nexport async function generateSymmetricKey(): Promise<string> {\n  try {\n    const key = await crypto.subtle.generateKey({ name: 'AES-GCM', length: AES_KEY_LENGTH }, true, [\n      'encrypt',\n      'decrypt',\n    ])\n\n    const rawKey = await crypto.subtle.exportKey('raw', key)\n    return toHex(new Uint8Array(rawKey))\n  } catch (error) {\n    throw new CryptoError('Failed to generate symmetric key', 'KEY_GENERATION_FAILED', error)\n  }\n}\n\n/**\n * Import a symmetric key from a hex string.\n */\nexport async function importSymmetricKey(hexKey: string): Promise<CryptoKey> {\n  try {\n    const keyBytes = fromHex(hexKey)\n\n    if (keyBytes.length !== AES_KEY_BYTES) {\n      throw new CryptoError(\n        `Invalid key length: expected ${String(AES_KEY_BYTES)} bytes, got ${String(keyBytes.length)}`,\n        'INVALID_KEY_LENGTH'\n      )\n    }\n\n    return await crypto.subtle.importKey(\n      'raw',\n      keyBytes as unknown as Uint8Array<ArrayBuffer>,\n      { name: 'AES-GCM', length: AES_KEY_LENGTH },\n      false,\n      ['encrypt', 'decrypt']\n    )\n  } catch (error) {\n    if (error instanceof CryptoError) {\n      throw error\n    }\n    throw new CryptoError('Failed to import symmetric key', 'KEY_IMPORT_FAILED', error)\n  }\n}\n\n/**\n * Generate a random initialization vector (nonce) for AES-GCM.\n * Returns 12 bytes as required by GCM.\n */\nexport function generateIV(): Uint8Array {\n  return crypto.getRandomValues(new Uint8Array(IV_LENGTH))\n}\n\n/**\n * Generate random bytes.\n */\nexport function randomBytes(length: number): Uint8Array {\n  return crypto.getRandomValues(new Uint8Array(length))\n}\n\n// ============================================================================\n// ASYMMETRIC KEY GENERATION (RSA)\n// ============================================================================\n\n/**\n * Generate an RSA key pair for hybrid encryption.\n * Uses RSA-OAEP with SHA-256, compatible with FluxEncrypt.\n */\nexport async function generateKeyPair(keySize: 2048 | 4096 = 4096): Promise<KeyPair> {\n  try {\n    const keyPair = await crypto.subtle.generateKey(\n      {\n        name: 'RSA-OAEP',\n        modulusLength: keySize,\n        publicExponent: new Uint8Array([1, 0, 1]), // 65537\n        hash: 'SHA-256',\n      },\n      true,\n      ['encrypt', 'decrypt']\n    )\n\n    return {\n      publicKey: keyPair.publicKey,\n      privateKey: keyPair.privateKey,\n    }\n  } catch (error) {\n    throw new CryptoError('Failed to generate RSA key pair', 'KEY_GENERATION_FAILED', error)\n  }\n}\n\n// ============================================================================\n// KEY EXPORT (PEM FORMAT)\n// ============================================================================\n\n/**\n * Export a public key to PEM format (SPKI).\n */\nexport async function exportPublicKey(key: CryptoKey): Promise<string> {\n  try {\n    const spki = await crypto.subtle.exportKey('spki', key)\n    const base64 = toBase64(new Uint8Array(spki))\n    return formatPem(base64, 'PUBLIC KEY')\n  } catch (error) {\n    throw new CryptoError('Failed to export public key', 'KEY_EXPORT_FAILED', error)\n  }\n}\n\n/**\n * Export a private key to PEM format (PKCS8).\n */\nexport async function exportPrivateKey(key: CryptoKey): Promise<string> {\n  try {\n    const pkcs8 = await crypto.subtle.exportKey('pkcs8', key)\n    const base64 = toBase64(new Uint8Array(pkcs8))\n    return formatPem(base64, 'PRIVATE KEY')\n  } catch (error) {\n    throw new CryptoError('Failed to export private key', 'KEY_EXPORT_FAILED', error)\n  }\n}\n\n/**\n * Format base64 data as PEM with proper line breaks.\n */\nfunction formatPem(base64: string, label: string): string {\n  const lines: string[] = []\n  for (let i = 0; i < base64.length; i += 64) {\n    lines.push(base64.slice(i, i + 64))\n  }\n  return `-----BEGIN ${label}-----\\n${lines.join('\\n')}\\n-----END ${label}-----`\n}\n\n// ============================================================================\n// KEY IMPORT (PEM FORMAT)\n// ============================================================================\n\n/**\n * Import a public key from PEM format.\n */\nexport async function importPublicKey(pem: string): Promise<CryptoKey> {\n  try {\n    const base64 = parsePem(pem, 'PUBLIC KEY')\n    const spki = fromBase64(base64)\n\n    return await crypto.subtle.importKey(\n      'spki',\n      spki as unknown as Uint8Array<ArrayBuffer>,\n      {\n        name: 'RSA-OAEP',\n        hash: 'SHA-256',\n      },\n      true,\n      ['encrypt']\n    )\n  } catch (error) {\n    if (error instanceof CryptoError) {\n      throw error\n    }\n    throw new CryptoError('Failed to import public key', 'KEY_IMPORT_FAILED', error)\n  }\n}\n\n/**\n * Import a private key from PEM format.\n */\nexport async function importPrivateKey(pem: string): Promise<CryptoKey> {\n  try {\n    const base64 = parsePem(pem, 'PRIVATE KEY')\n    const pkcs8 = fromBase64(base64)\n\n    return await crypto.subtle.importKey(\n      'pkcs8',\n      pkcs8 as unknown as Uint8Array<ArrayBuffer>,\n      {\n        name: 'RSA-OAEP',\n        hash: 'SHA-256',\n      },\n      true,\n      ['decrypt']\n    )\n  } catch (error) {\n    if (error instanceof CryptoError) {\n      throw error\n    }\n    throw new CryptoError('Failed to import private key', 'KEY_IMPORT_FAILED', error)\n  }\n}\n\n/**\n * Parse PEM format and extract base64 content.\n */\nfunction parsePem(pem: string, expectedLabel: string): string {\n  const beginMarker = `-----BEGIN ${expectedLabel}-----`\n  const endMarker = `-----END ${expectedLabel}-----`\n\n  const beginIndex = pem.indexOf(beginMarker)\n  const endIndex = pem.indexOf(endMarker)\n\n  if (beginIndex === -1 || endIndex === -1) {\n    throw new CryptoError(`Invalid PEM format: missing ${expectedLabel} markers`, 'INVALID_KEY')\n  }\n\n  const base64Content = pem.slice(beginIndex + beginMarker.length, endIndex).replace(/\\s/g, '')\n\n  return base64Content\n}\n\n// ============================================================================\n// KEY DERIVATION (PBKDF2)\n// ============================================================================\n\n/**\n * Derive a key from a password using PBKDF2.\n * Compatible with FluxEncrypt's key derivation.\n */\nexport async function deriveKeyFromPassword(\n  password: string,\n  salt?: Uint8Array,\n  config: KeyDerivationConfig = {}\n): Promise<DerivedKeyResult> {\n  const {\n    iterations = DEFAULT_PBKDF2_ITERATIONS,\n    saltLength = DEFAULT_SALT_LENGTH,\n    hash = 'SHA-256',\n  } = config\n\n  try {\n    // Generate salt if not provided\n    const derivationSalt = salt ?? randomBytes(saltLength)\n\n    // Import password as key material\n    const passwordKey = await crypto.subtle.importKey(\n      'raw',\n      new TextEncoder().encode(password),\n      'PBKDF2',\n      false,\n      ['deriveBits', 'deriveKey']\n    )\n\n    // Derive the key\n    const derivedKey = await crypto.subtle.deriveKey(\n      {\n        name: 'PBKDF2',\n        salt: derivationSalt as unknown as Uint8Array<ArrayBuffer>,\n        iterations,\n        hash,\n      },\n      passwordKey,\n      { name: 'AES-GCM', length: AES_KEY_LENGTH },\n      true,\n      ['encrypt', 'decrypt']\n    )\n\n    return {\n      key: derivedKey,\n      salt: derivationSalt,\n    }\n  } catch (error) {\n    throw new CryptoError('Failed to derive key from password', 'KEY_DERIVATION_FAILED', error)\n  }\n}\n\n/**\n * Export a derived key as a hex string.\n */\nexport async function exportDerivedKey(key: CryptoKey): Promise<string> {\n  try {\n    const rawKey = await crypto.subtle.exportKey('raw', key)\n    return toHex(new Uint8Array(rawKey))\n  } catch (error) {\n    throw new CryptoError('Failed to export derived key', 'KEY_EXPORT_FAILED', error)\n  }\n}\n","/**\n * Symmetric Encryption (AES-256-GCM)\n * @countermeasure/web-components\n *\n * AES-256-GCM symmetric encryption for secrets.\n * Compatible with FluxEncrypt's SymmetricCipher.\n */\n\nimport { stringToBytes, bytesToString, encodeEncryptedData, decodeEncryptedData } from './encoding'\nimport { encodeOutput, decodeInput } from './encoding-helpers'\nimport { importSymmetricKey, generateIV } from './keys'\nimport { CryptoError, type SymmetricCipherConfig, type EncodingFormat } from './types'\n\n// ============================================================================\n// CONSTANTS\n// ============================================================================\n\nconst AES_GCM_TAG_LENGTH = 128 // bits\n\n// ============================================================================\n// SYMMETRIC CIPHER CLASS\n// ============================================================================\n\n/**\n * AES-256-GCM symmetric cipher for encrypting secrets.\n * Mirrors FluxEncrypt's SymmetricCipher API.\n *\n * Usage:\n * ```typescript\n * const cipher = await createSymmetricCipher(hexKey)\n * const encrypted = await cipher.encrypt('my-secret')\n * const decrypted = await cipher.decrypt(encrypted)\n * ```\n */\nexport class SymmetricCipherImpl {\n  private key: CryptoKey\n  private encoding: EncodingFormat\n\n  private constructor(key: CryptoKey, encoding: EncodingFormat) {\n    this.key = key\n    this.encoding = encoding\n  }\n\n  /**\n   * Create a new SymmetricCipher from a hex-encoded key.\n   */\n  static async create(\n    hexKey: string,\n    config: SymmetricCipherConfig = {}\n  ): Promise<SymmetricCipherImpl> {\n    const key = await importSymmetricKey(hexKey)\n    return new SymmetricCipherImpl(key, config.encoding ?? 'base64')\n  }\n\n  /**\n   * Create a new SymmetricCipher from a CryptoKey.\n   */\n  static fromKey(key: CryptoKey, config: SymmetricCipherConfig = {}): SymmetricCipherImpl {\n    return new SymmetricCipherImpl(key, config.encoding ?? 'base64')\n  }\n\n  /**\n   * Encrypt plaintext data.\n   * Returns base64-encoded ciphertext by default.\n   */\n  async encrypt(plaintext: string | Uint8Array): Promise<string> {\n    try {\n      const data = typeof plaintext === 'string' ? stringToBytes(plaintext) : plaintext\n      const iv = generateIV()\n\n      const ciphertext = await crypto.subtle.encrypt(\n        {\n          name: 'AES-GCM',\n          iv: iv as unknown as Uint8Array<ArrayBuffer>,\n          tagLength: AES_GCM_TAG_LENGTH,\n        },\n        this.key,\n        data as unknown as BufferSource\n      )\n\n      // Combine version + IV + ciphertext (includes auth tag)\n      const combined = encodeEncryptedData(iv, new Uint8Array(ciphertext))\n\n      return encodeOutput(combined, this.encoding)\n    } catch (error) {\n      if (error instanceof CryptoError) {\n        throw error\n      }\n      throw new CryptoError('Encryption failed', 'ENCRYPTION_FAILED', error)\n    }\n  }\n\n  /**\n   * Decrypt ciphertext data.\n   * Expects base64-encoded input by default.\n   */\n  async decrypt(ciphertext: string): Promise<string> {\n    try {\n      const data = decodeInput(ciphertext, this.encoding)\n      const { iv, ciphertext: encryptedData } = decodeEncryptedData(data)\n\n      const plaintext = await crypto.subtle.decrypt(\n        {\n          name: 'AES-GCM',\n          iv: iv as unknown as Uint8Array<ArrayBuffer>,\n          tagLength: AES_GCM_TAG_LENGTH,\n        },\n        this.key,\n        encryptedData as unknown as BufferSource\n      )\n\n      return bytesToString(new Uint8Array(plaintext))\n    } catch (error) {\n      if (error instanceof CryptoError) {\n        throw error\n      }\n      throw new CryptoError('Decryption failed', 'DECRYPTION_FAILED', error)\n    }\n  }\n\n  /**\n   * Encrypt raw bytes and return raw bytes.\n   */\n  async encryptBytes(plaintext: Uint8Array): Promise<Uint8Array> {\n    try {\n      const iv = generateIV()\n\n      const ciphertext = await crypto.subtle.encrypt(\n        {\n          name: 'AES-GCM',\n          iv: iv as unknown as Uint8Array<ArrayBuffer>,\n          tagLength: AES_GCM_TAG_LENGTH,\n        },\n        this.key,\n        plaintext as unknown as BufferSource\n      )\n\n      return encodeEncryptedData(iv, new Uint8Array(ciphertext))\n    } catch (error) {\n      if (error instanceof CryptoError) {\n        throw error\n      }\n      throw new CryptoError('Encryption failed', 'ENCRYPTION_FAILED', error)\n    }\n  }\n\n  /**\n   * Decrypt raw bytes and return raw bytes.\n   */\n  async decryptBytes(ciphertext: Uint8Array): Promise<Uint8Array> {\n    try {\n      const { iv, ciphertext: encryptedData } = decodeEncryptedData(ciphertext)\n\n      const plaintext = await crypto.subtle.decrypt(\n        {\n          name: 'AES-GCM',\n          iv: iv as unknown as Uint8Array<ArrayBuffer>,\n          tagLength: AES_GCM_TAG_LENGTH,\n        },\n        this.key,\n        encryptedData as unknown as BufferSource\n      )\n\n      return new Uint8Array(plaintext)\n    } catch (error) {\n      if (error instanceof CryptoError) {\n        throw error\n      }\n      throw new CryptoError('Decryption failed', 'DECRYPTION_FAILED', error)\n    }\n  }\n\n  /**\n   * Get the current encoding format.\n   */\n  getEncoding(): EncodingFormat {\n    return this.encoding\n  }\n}\n\n// ============================================================================\n// FACTORY FUNCTIONS\n// ============================================================================\n\n/**\n * Create a symmetric cipher from a hex-encoded key.\n * This is the primary way to create a cipher, matching FluxEncrypt's API.\n *\n * @param hexKey - 64-character hex string (32 bytes / 256 bits)\n * @param config - Optional configuration\n */\nexport async function createSymmetricCipher(\n  hexKey: string,\n  config: SymmetricCipherConfig = {}\n): Promise<SymmetricCipherImpl> {\n  return SymmetricCipherImpl.create(hexKey, config)\n}\n\n/**\n * Create a symmetric cipher from a CryptoKey.\n */\nexport function createSymmetricCipherFromKey(\n  key: CryptoKey,\n  config: SymmetricCipherConfig = {}\n): SymmetricCipherImpl {\n  return SymmetricCipherImpl.fromKey(key, config)\n}\n\n// ============================================================================\n// CONVENIENCE FUNCTIONS\n// ============================================================================\n\n/**\n * Encrypt a secret with a hex key (one-shot operation).\n */\nexport async function encryptSecret(hexKey: string, plaintext: string): Promise<string> {\n  const cipher = await createSymmetricCipher(hexKey)\n  return cipher.encrypt(plaintext)\n}\n\n/**\n * Decrypt a secret with a hex key (one-shot operation).\n */\nexport async function decryptSecret(hexKey: string, ciphertext: string): Promise<string> {\n  const cipher = await createSymmetricCipher(hexKey)\n  return cipher.decrypt(ciphertext)\n}\n","/**\n * Hybrid Encryption (RSA-OAEP + AES-GCM)\n * @countermeasure/web-components\n *\n * Hybrid encryption combining RSA-OAEP for key exchange and AES-256-GCM for data.\n * Compatible with FluxEncrypt's HybridCipher.\n */\n\nimport { stringToBytes } from './encoding'\nimport { encodeOutput, decodeInput } from './encoding-helpers'\nimport { generateIV } from './keys'\nimport { CryptoError, type HybridCipherConfig, type EncodingFormat } from './types'\n\n// ============================================================================\n// CONSTANTS\n// ============================================================================\n\nconst AES_KEY_LENGTH = 256\nconst AES_GCM_TAG_LENGTH = 128 // bits\nconst HYBRID_VERSION = 0x02 // Version 2 for hybrid format\n\n// ============================================================================\n// HYBRID CIPHER CLASS\n// ============================================================================\n\n/**\n * Hybrid cipher combining RSA-OAEP and AES-256-GCM.\n * Mirrors FluxEncrypt's HybridCipher API.\n *\n * The encryption format is:\n * [1 byte version][2 bytes RSA ciphertext length][N bytes RSA ciphertext][12 bytes IV][M bytes AES ciphertext]\n *\n * Usage:\n * ```typescript\n * const keypair = await generateKeyPair()\n * const cipher = createHybridCipher()\n * const encrypted = await cipher.encrypt(keypair.publicKey, 'secret data')\n * const decrypted = await cipher.decrypt(keypair.privateKey, encrypted)\n * ```\n */\nexport class HybridCipherImpl {\n  private encoding: EncodingFormat\n  private rsaKeySize: 2048 | 4096\n\n  constructor(config: HybridCipherConfig = {}) {\n    this.encoding = config.encoding ?? 'base64'\n    this.rsaKeySize = config.rsaKeySize ?? 4096\n  }\n\n  /**\n   * Encrypt data using hybrid encryption.\n   * 1. Generate a random AES key\n   * 2. Encrypt the AES key with RSA-OAEP\n   * 3. Encrypt the data with AES-GCM\n   * 4. Combine: version + RSA ciphertext length + RSA ciphertext + IV + AES ciphertext\n   */\n  async encrypt(publicKey: CryptoKey, plaintext: string | Uint8Array): Promise<string> {\n    try {\n      const data = typeof plaintext === 'string' ? stringToBytes(plaintext) : plaintext\n\n      // Generate random AES key\n      const aesKey = await crypto.subtle.generateKey(\n        { name: 'AES-GCM', length: AES_KEY_LENGTH },\n        true,\n        ['encrypt', 'decrypt']\n      )\n\n      // Export AES key for RSA encryption\n      const rawAesKey = await crypto.subtle.exportKey('raw', aesKey)\n\n      // Encrypt AES key with RSA-OAEP\n      const encryptedAesKey = await crypto.subtle.encrypt(\n        { name: 'RSA-OAEP' },\n        publicKey,\n        rawAesKey\n      )\n\n      // Generate IV and encrypt data with AES-GCM\n      const iv = generateIV()\n      const encryptedData = await crypto.subtle.encrypt(\n        {\n          name: 'AES-GCM',\n          iv: iv as unknown as Uint8Array<ArrayBuffer>,\n          tagLength: AES_GCM_TAG_LENGTH,\n        },\n        aesKey,\n        data as unknown as BufferSource\n      )\n\n      // Combine all parts\n      const rsaCiphertext = new Uint8Array(encryptedAesKey)\n      const aesCiphertext = new Uint8Array(encryptedData)\n\n      // Format: version(1) + rsaLen(2) + rsaCiphertext(N) + iv(12) + aesCiphertext(M)\n      const rsaLen = rsaCiphertext.length\n      const combined = new Uint8Array(1 + 2 + rsaLen + 12 + aesCiphertext.length)\n      combined[0] = HYBRID_VERSION\n      combined[1] = (rsaLen >> 8) & 0xff\n      combined[2] = rsaLen & 0xff\n      combined.set(rsaCiphertext, 3)\n      combined.set(iv, 3 + rsaLen)\n      combined.set(aesCiphertext, 3 + rsaLen + 12)\n\n      return encodeOutput(combined, this.encoding)\n    } catch (error) {\n      if (error instanceof CryptoError) {\n        throw error\n      }\n      throw new CryptoError('Hybrid encryption failed', 'ENCRYPTION_FAILED', error)\n    }\n  }\n\n  /**\n   * Decrypt data using hybrid encryption.\n   * 1. Parse the combined ciphertext\n   * 2. Decrypt the AES key with RSA-OAEP\n   * 3. Decrypt the data with AES-GCM\n   */\n  async decrypt(privateKey: CryptoKey, ciphertext: string): Promise<Uint8Array> {\n    try {\n      const data = decodeInput(ciphertext, this.encoding)\n\n      // Parse format\n      if (data.length < 16) {\n        throw new CryptoError('Invalid hybrid ciphertext: too short', 'INVALID_CIPHERTEXT')\n      }\n\n      const version = data[0]\n      if (version !== HYBRID_VERSION) {\n        throw new CryptoError(\n          `Unsupported hybrid encryption version: ${String(version)}`,\n          'INVALID_CIPHERTEXT'\n        )\n      }\n\n      const rsaLen = ((data[1] ?? 0) << 8) | (data[2] ?? 0)\n      if (data.length < 3 + rsaLen + 12 + 1) {\n        throw new CryptoError('Invalid hybrid ciphertext: truncated', 'INVALID_CIPHERTEXT')\n      }\n\n      const rsaCiphertext = data.slice(3, 3 + rsaLen)\n      const iv = data.slice(3 + rsaLen, 3 + rsaLen + 12)\n      const aesCiphertext = data.slice(3 + rsaLen + 12)\n\n      // Decrypt AES key with RSA-OAEP\n      const rawAesKey = await crypto.subtle.decrypt(\n        { name: 'RSA-OAEP' },\n        privateKey,\n        rsaCiphertext as unknown as BufferSource\n      )\n\n      // Import decrypted AES key\n      const aesKey = await crypto.subtle.importKey(\n        'raw',\n        rawAesKey,\n        { name: 'AES-GCM', length: AES_KEY_LENGTH },\n        false,\n        ['decrypt']\n      )\n\n      // Decrypt data with AES-GCM\n      const plaintext = await crypto.subtle.decrypt(\n        {\n          name: 'AES-GCM',\n          iv: iv as unknown as Uint8Array<ArrayBuffer>,\n          tagLength: AES_GCM_TAG_LENGTH,\n        },\n        aesKey,\n        aesCiphertext as unknown as BufferSource\n      )\n\n      return new Uint8Array(plaintext)\n    } catch (error) {\n      if (error instanceof CryptoError) {\n        throw error\n      }\n      throw new CryptoError('Hybrid decryption failed', 'DECRYPTION_FAILED', error)\n    }\n  }\n\n  /**\n   * Decrypt and return as string.\n   */\n  async decryptToString(privateKey: CryptoKey, ciphertext: string): Promise<string> {\n    const plaintext = await this.decrypt(privateKey, ciphertext)\n    return new TextDecoder().decode(plaintext)\n  }\n\n  /**\n   * Get the current encoding format.\n   */\n  getEncoding(): EncodingFormat {\n    return this.encoding\n  }\n\n  /**\n   * Get the RSA key size.\n   */\n  getRsaKeySize(): number {\n    return this.rsaKeySize\n  }\n}\n\n// ============================================================================\n// FACTORY FUNCTIONS\n// ============================================================================\n\n/**\n * Create a hybrid cipher instance.\n */\nexport function createHybridCipher(config: HybridCipherConfig = {}): HybridCipherImpl {\n  return new HybridCipherImpl(config)\n}\n\n// ============================================================================\n// CONVENIENCE FUNCTIONS\n// ============================================================================\n\n/**\n * Encrypt data with a public key (one-shot operation).\n */\nexport async function hybridEncrypt(\n  publicKey: CryptoKey,\n  plaintext: string | Uint8Array,\n  config: HybridCipherConfig = {}\n): Promise<string> {\n  const cipher = createHybridCipher(config)\n  return cipher.encrypt(publicKey, plaintext)\n}\n\n/**\n * Decrypt data with a private key (one-shot operation).\n */\nexport async function hybridDecrypt(\n  privateKey: CryptoKey,\n  ciphertext: string,\n  config: HybridCipherConfig = {}\n): Promise<Uint8Array> {\n  const cipher = createHybridCipher(config)\n  return cipher.decrypt(privateKey, ciphertext)\n}\n\n/**\n * Decrypt data with a private key and return as string (one-shot operation).\n */\nexport async function hybridDecryptToString(\n  privateKey: CryptoKey,\n  ciphertext: string,\n  config: HybridCipherConfig = {}\n): Promise<string> {\n  const cipher = createHybridCipher(config)\n  return cipher.decryptToString(privateKey, ciphertext)\n}\n","/**\n * Crypto Module\n * @countermeasure/web-components\n *\n * Client-side encryption utilities compatible with FluxEncrypt.\n * Provides AES-256-GCM symmetric encryption and RSA-OAEP hybrid encryption.\n */\n\n// ============================================================================\n// TYPES\n// ============================================================================\n\nexport type {\n  EncodingFormat,\n  SymmetricCipherConfig,\n  EncryptedData,\n  SymmetricCipher,\n  HybridCipherConfig,\n  KeyPair,\n  ExportedKeyPair,\n  HybridCipher,\n  KeyDerivationConfig,\n  DerivedKeyResult,\n  CryptoManagerConfig,\n  CryptoManager,\n  CryptoErrorCode,\n} from './types'\n\nexport { CryptoError } from './types'\n\n// ============================================================================\n// ENCODING\n// ============================================================================\n\nexport {\n  toBase64,\n  fromBase64,\n  toHex,\n  fromHex,\n  stringToBytes,\n  bytesToString,\n  encodeEncryptedData,\n  decodeEncryptedData,\n  constantTimeEqual,\n  zeroize,\n  concat,\n} from './encoding'\n\nexport { encodeOutput, decodeInput } from './encoding-helpers'\n\n// ============================================================================\n// KEYS\n// ============================================================================\n\nexport {\n  generateSymmetricKey,\n  importSymmetricKey,\n  generateIV,\n  randomBytes,\n  generateKeyPair,\n  exportPublicKey,\n  exportPrivateKey,\n  importPublicKey,\n  importPrivateKey,\n  deriveKeyFromPassword,\n  exportDerivedKey,\n} from './keys'\n\n// ============================================================================\n// SYMMETRIC ENCRYPTION\n// ============================================================================\n\nexport {\n  SymmetricCipherImpl,\n  createSymmetricCipher,\n  createSymmetricCipherFromKey,\n  encryptSecret,\n  decryptSecret,\n} from './symmetric'\n\n// ============================================================================\n// HYBRID ENCRYPTION\n// ============================================================================\n\nexport {\n  HybridCipherImpl,\n  createHybridCipher,\n  hybridEncrypt,\n  hybridDecrypt,\n  hybridDecryptToString,\n} from './hybrid'\n\n// ============================================================================\n// UNIFIED CRYPTO MANAGER\n// ============================================================================\n\nimport { createHybridCipher } from './hybrid'\nimport {\n  generateSymmetricKey,\n  generateKeyPair,\n  exportPublicKey,\n  exportPrivateKey,\n  importPublicKey,\n  importPrivateKey,\n  deriveKeyFromPassword,\n} from './keys'\nimport { createSymmetricCipher } from './symmetric'\n\nimport type { CryptoManagerConfig, KeyPair, DerivedKeyResult } from './types'\n\n/**\n * Unified crypto manager providing access to all encryption operations.\n * Mirrors FluxEncrypt's Cryptum interface.\n *\n * Usage:\n * ```typescript\n * const crypto = createCryptoManager()\n *\n * // Symmetric encryption\n * const key = await crypto.generateSymmetricKey()\n * const encrypted = await crypto.encryptSecret(key, 'my-secret')\n * const decrypted = await crypto.decryptSecret(key, encrypted)\n *\n * // Hybrid encryption\n * const keypair = await crypto.generateKeyPair()\n * const ciphertext = await crypto.encrypt(keypair.publicKey, 'secret data')\n * const plaintext = await crypto.decrypt(keypair.privateKey, ciphertext)\n * ```\n */\nexport class CryptoManagerImpl {\n  private config: Required<CryptoManagerConfig>\n\n  constructor(config: CryptoManagerConfig = {}) {\n    this.config = {\n      encoding: config.encoding ?? 'base64',\n      rsaKeySize: config.rsaKeySize ?? 4096,\n      pbkdf2Iterations: config.pbkdf2Iterations ?? 100000,\n    }\n  }\n\n  // -------------------------------------------------------------------------\n  // Symmetric Operations\n  // -------------------------------------------------------------------------\n\n  /**\n   * Generate a new symmetric key (hex-encoded).\n   */\n  async generateSymmetricKey(): Promise<string> {\n    return generateSymmetricKey()\n  }\n\n  /**\n   * Encrypt a secret with a hex key.\n   */\n  async encryptSecret(hexKey: string, plaintext: string): Promise<string> {\n    const cipher = await createSymmetricCipher(hexKey, { encoding: this.config.encoding })\n    return cipher.encrypt(plaintext)\n  }\n\n  /**\n   * Decrypt a secret with a hex key.\n   */\n  async decryptSecret(hexKey: string, ciphertext: string): Promise<string> {\n    const cipher = await createSymmetricCipher(hexKey, { encoding: this.config.encoding })\n    return cipher.decrypt(ciphertext)\n  }\n\n  // -------------------------------------------------------------------------\n  // Hybrid Operations\n  // -------------------------------------------------------------------------\n\n  /**\n   * Generate a new RSA key pair.\n   */\n  async generateKeyPair(): Promise<KeyPair> {\n    return generateKeyPair(this.config.rsaKeySize)\n  }\n\n  /**\n   * Encrypt data with a public key using hybrid encryption.\n   */\n  async encrypt(publicKey: CryptoKey, data: string | Uint8Array): Promise<string> {\n    const cipher = createHybridCipher({\n      encoding: this.config.encoding,\n      rsaKeySize: this.config.rsaKeySize,\n    })\n    return cipher.encrypt(publicKey, data)\n  }\n\n  /**\n   * Decrypt data with a private key using hybrid encryption.\n   */\n  async decrypt(privateKey: CryptoKey, ciphertext: string): Promise<Uint8Array> {\n    const cipher = createHybridCipher({\n      encoding: this.config.encoding,\n      rsaKeySize: this.config.rsaKeySize,\n    })\n    return cipher.decrypt(privateKey, ciphertext)\n  }\n\n  /**\n   * Decrypt data and return as string.\n   */\n  async decryptToString(privateKey: CryptoKey, ciphertext: string): Promise<string> {\n    const cipher = createHybridCipher({\n      encoding: this.config.encoding,\n      rsaKeySize: this.config.rsaKeySize,\n    })\n    return cipher.decryptToString(privateKey, ciphertext)\n  }\n\n  // -------------------------------------------------------------------------\n  // Key Management\n  // -------------------------------------------------------------------------\n\n  /**\n   * Export a public key to PEM format.\n   */\n  async exportPublicKey(key: CryptoKey): Promise<string> {\n    return exportPublicKey(key)\n  }\n\n  /**\n   * Export a private key to PEM format.\n   */\n  async exportPrivateKey(key: CryptoKey): Promise<string> {\n    return exportPrivateKey(key)\n  }\n\n  /**\n   * Import a public key from PEM format.\n   */\n  async importPublicKey(pem: string): Promise<CryptoKey> {\n    return importPublicKey(pem)\n  }\n\n  /**\n   * Import a private key from PEM format.\n   */\n  async importPrivateKey(pem: string): Promise<CryptoKey> {\n    return importPrivateKey(pem)\n  }\n\n  // -------------------------------------------------------------------------\n  // Key Derivation\n  // -------------------------------------------------------------------------\n\n  /**\n   * Derive a key from a password using PBKDF2.\n   */\n  async deriveKeyFromPassword(password: string, salt?: Uint8Array): Promise<DerivedKeyResult> {\n    return deriveKeyFromPassword(password, salt, {\n      iterations: this.config.pbkdf2Iterations,\n    })\n  }\n\n  // -------------------------------------------------------------------------\n  // Configuration\n  // -------------------------------------------------------------------------\n\n  /**\n   * Get the current configuration.\n   */\n  getConfig(): Required<CryptoManagerConfig> {\n    return { ...this.config }\n  }\n}\n\n/**\n * Create a new CryptoManager instance.\n */\nexport function createCryptoManager(config: CryptoManagerConfig = {}): CryptoManagerImpl {\n  return new CryptoManagerImpl(config)\n}\n\n// Default instance for simple usage\nlet defaultManager: CryptoManagerImpl | null = null\n\n/**\n * Get the default CryptoManager instance.\n */\nexport function getDefaultCryptoManager(config?: CryptoManagerConfig): CryptoManagerImpl {\n  defaultManager ??= createCryptoManager(config)\n  return defaultManager\n}\n\n/**\n * Convenience function to create a CryptoManager (matches FluxEncrypt's `cryptum()` function).\n */\nexport function cryptum(config?: CryptoManagerConfig): CryptoManagerImpl {\n  return createCryptoManager(config)\n}\n"],"mappings":";AA6HA,IAAa,IAAb,cAAiC,MAAM;CACrC,YACE,GACA,GACA,GACA;AAEA,EADA,MAAM,EAAQ,EAHE,KAAA,OAAA,GACA,KAAA,QAAA,GAGhB,KAAK,OAAO;;;;;AClHhB,SAAgB,EAAS,GAA0B;AACjD,KAAI,OAAO,QAAS,YAAY;EAC9B,IAAM,IAAS,OAAO,aAAa,GAAG,EAAK;AAC3C,SAAO,KAAK,EAAO;;AAGrB,KAAI,OAAO,SAAW,IACpB,QAAO,OAAO,KAAK,EAAK,CAAC,SAAS,SAAS;AAE7C,OAAM,IAAI,EAAY,gCAAgC,iBAAiB;;AAMzE,SAAgB,EAAW,GAA4B;AACrD,KAAI;AACF,MAAI,OAAO,QAAS,YAAY;GAC9B,IAAM,IAAS,KAAK,EAAO,EACrB,IAAQ,IAAI,WAAW,EAAO,OAAO;AAC3C,QAAK,IAAI,IAAI,GAAG,IAAI,EAAO,QAAQ,IACjC,GAAM,KAAK,EAAO,WAAW,EAAE;AAEjC,UAAO;;AAGT,MAAI,OAAO,SAAW,IACpB,QAAO,IAAI,WAAW,OAAO,KAAK,GAAQ,SAAS,CAAC;AAEtD,QAAM,IAAI,EAAY,gCAAgC,iBAAiB;UAChE,GAAO;AAId,QAHI,aAAiB,IACb,IAEF,IAAI,EAAY,yBAAyB,kBAAkB,EAAM;;;AAW3E,SAAgB,EAAM,GAA0B;AAC9C,QAAO,MAAM,KAAK,EAAK,CACpB,KAAI,MAAQ,EAAK,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAC/C,KAAK,GAAG;;AAMb,SAAgB,EAAQ,GAAyB;CAE/C,IAAM,IAAW,EAAI,QAAQ,OAAO,GAAG,CAAC,aAAa;AAErD,KAAI,EAAS,SAAS,KAAM,EAC1B,OAAM,IAAI,EAAY,kCAAkC,iBAAiB;AAG3E,KAAI,CAAC,cAAc,KAAK,EAAS,CAC/B,OAAM,IAAI,EAAY,0CAA0C,iBAAiB;CAGnF,IAAM,IAAQ,IAAI,WAAW,EAAS,SAAS,EAAE;AACjD,MAAK,IAAI,IAAI,GAAG,IAAI,EAAS,QAAQ,KAAK,EACxC,GAAM,IAAI,KAAK,SAAS,EAAS,MAAM,GAAG,IAAI,EAAE,EAAE,GAAG;AAEvD,QAAO;;AAUT,SAAgB,EAAc,GAAyB;AACrD,QAAO,IAAI,aAAa,CAAC,OAAO,EAAI;;AAMtC,SAAgB,EAAc,GAA2B;AACvD,QAAO,IAAI,aAAa,CAAC,OAAO,EAAM;;AAWxC,SAAgB,EAAoB,GAAgB,GAAoC;CAEtF,IACM,IAAS,IAAI,WAAW,IAAI,EAAG,SAAS,EAAW,OAAO;AAIhE,QAHA,EAAO,KAAK,GACZ,EAAO,IAAI,GAAI,EAAE,EACjB,EAAO,IAAI,GAAY,IAAI,EAAG,OAAO,EAC9B;;AAOT,SAAgB,EAAoB,GAA8D;AAChG,KAAI,EAAK,SAAS,GAEhB,OAAM,IAAI,EAAY,qCAAqC,qBAAqB;CAGlF,IAAM,IAAU,EAAK;AACrB,KAAI,MAAY,EACd,OAAM,IAAI,EACR,0CAA0C,OAAO,EAAQ,IACzD,qBACD;AAMH,QAAO;EAAE,IAHE,EAAK,MAAM,GAAG,GAAG;EAGf,YAFM,EAAK,MAAM,GAAG;EAER;;AAU3B,SAAgB,EAAkB,GAAe,GAAwB;AACvE,KAAI,EAAE,WAAW,EAAE,OACjB,QAAO;CAGT,IAAI,IAAS;AACb,MAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,IAC5B,OAAW,EAAE,MAAM,MAAM,EAAE,MAAM;AAEnC,QAAO,MAAW;;AAOpB,SAAgB,EAAQ,GAAwB;AAC9C,GAAK,KAAK,EAAE;;AAMd,SAAgB,EAAO,GAAG,GAAkC;CAC1D,IAAM,IAAc,EAAO,QAAQ,GAAK,MAAQ,IAAM,EAAI,QAAQ,EAAE,EAC9D,IAAS,IAAI,WAAW,EAAY,EACtC,IAAS;AACb,MAAK,IAAM,KAAO,EAEhB,CADA,EAAO,IAAI,GAAK,EAAO,EACvB,KAAU,EAAI;AAEhB,QAAO;;;;AC7KT,SAAgB,EAAa,GAAkB,GAAkC;AAC/E,SAAQ,GAAR;EACE,KAAK,SACH,QAAO,EAAS,EAAK;EACvB,KAAK,MACH,QAAO,EAAM,EAAK;EACpB,KAAK,MACH,QAAO,EAAc,EAAK;EAC5B,QACE,QAAO,EAAS,EAAK;;;AAO3B,SAAgB,EAAY,GAAc,GAAsC;AAC9E,SAAQ,GAAR;EACE,KAAK,SACH,QAAO,EAAW,EAAK;EACzB,KAAK,MACH,QAAO,EAAQ,EAAK;EACtB,KAAK,MACH,QAAO,EAAc,EAAK;EAC5B,QACE,QAAO,EAAW,EAAK;;;;;AC1B7B,IAAM,IAAiB,KACjB,IAAgB,IAAiB,GACjC,IAAY,IACZ,IAA4B,KAC5B,IAAsB;AAU5B,eAAsB,IAAwC;AAC5D,KAAI;EACF,IAAM,IAAM,MAAM,OAAO,OAAO,YAAY;GAAE,MAAM;GAAW,QAAQ;GAAgB,EAAE,IAAM,CAC7F,WACA,UACD,CAAC,EAEI,IAAS,MAAM,OAAO,OAAO,UAAU,OAAO,EAAI;AACxD,SAAO,EAAM,IAAI,WAAW,EAAO,CAAC;UAC7B,GAAO;AACd,QAAM,IAAI,EAAY,oCAAoC,yBAAyB,EAAM;;;AAO7F,eAAsB,EAAmB,GAAoC;AAC3E,KAAI;EACF,IAAM,IAAW,EAAQ,EAAO;AAEhC,MAAI,EAAS,WAAW,EACtB,OAAM,IAAI,EACR,gCAAgC,OAAO,EAAc,CAAC,cAAc,OAAO,EAAS,OAAO,IAC3F,qBACD;AAGH,SAAO,MAAM,OAAO,OAAO,UACzB,OACA,GACA;GAAE,MAAM;GAAW,QAAQ;GAAgB,EAC3C,IACA,CAAC,WAAW,UAAU,CACvB;UACM,GAAO;AAId,QAHI,aAAiB,IACb,IAEF,IAAI,EAAY,kCAAkC,qBAAqB,EAAM;;;AAQvF,SAAgB,IAAyB;AACvC,QAAO,OAAO,gBAAgB,IAAI,WAAW,EAAU,CAAC;;AAM1D,SAAgB,EAAY,GAA4B;AACtD,QAAO,OAAO,gBAAgB,IAAI,WAAW,EAAO,CAAC;;AAWvD,eAAsB,EAAgB,IAAuB,MAAwB;AACnF,KAAI;EACF,IAAM,IAAU,MAAM,OAAO,OAAO,YAClC;GACE,MAAM;GACN,eAAe;GACf,gBAAgB,IAAI,WAAW;IAAC;IAAG;IAAG;IAAE,CAAC;GACzC,MAAM;GACP,EACD,IACA,CAAC,WAAW,UAAU,CACvB;AAED,SAAO;GACL,WAAW,EAAQ;GACnB,YAAY,EAAQ;GACrB;UACM,GAAO;AACd,QAAM,IAAI,EAAY,mCAAmC,yBAAyB,EAAM;;;AAW5F,eAAsB,EAAgB,GAAiC;AACrE,KAAI;EACF,IAAM,IAAO,MAAM,OAAO,OAAO,UAAU,QAAQ,EAAI;AAEvD,SAAO,EADQ,EAAS,IAAI,WAAW,EAAK,CAAC,EACpB,aAAa;UAC/B,GAAO;AACd,QAAM,IAAI,EAAY,+BAA+B,qBAAqB,EAAM;;;AAOpF,eAAsB,EAAiB,GAAiC;AACtE,KAAI;EACF,IAAM,IAAQ,MAAM,OAAO,OAAO,UAAU,SAAS,EAAI;AAEzD,SAAO,EADQ,EAAS,IAAI,WAAW,EAAM,CAAC,EACrB,cAAc;UAChC,GAAO;AACd,QAAM,IAAI,EAAY,gCAAgC,qBAAqB,EAAM;;;AAOrF,SAAS,EAAU,GAAgB,GAAuB;CACxD,IAAM,IAAkB,EAAE;AAC1B,MAAK,IAAI,IAAI,GAAG,IAAI,EAAO,QAAQ,KAAK,GACtC,GAAM,KAAK,EAAO,MAAM,GAAG,IAAI,GAAG,CAAC;AAErC,QAAO,cAAc,EAAM,SAAS,EAAM,KAAK,KAAK,CAAC,aAAa,EAAM;;AAU1E,eAAsB,EAAgB,GAAiC;AACrE,KAAI;EAEF,IAAM,IAAO,EADE,EAAS,GAAK,aAAa,CACX;AAE/B,SAAO,MAAM,OAAO,OAAO,UACzB,QACA,GACA;GACE,MAAM;GACN,MAAM;GACP,EACD,IACA,CAAC,UAAU,CACZ;UACM,GAAO;AAId,QAHI,aAAiB,IACb,IAEF,IAAI,EAAY,+BAA+B,qBAAqB,EAAM;;;AAOpF,eAAsB,EAAiB,GAAiC;AACtE,KAAI;EAEF,IAAM,IAAQ,EADC,EAAS,GAAK,cAAc,CACX;AAEhC,SAAO,MAAM,OAAO,OAAO,UACzB,SACA,GACA;GACE,MAAM;GACN,MAAM;GACP,EACD,IACA,CAAC,UAAU,CACZ;UACM,GAAO;AAId,QAHI,aAAiB,IACb,IAEF,IAAI,EAAY,gCAAgC,qBAAqB,EAAM;;;AAOrF,SAAS,EAAS,GAAa,GAA+B;CAC5D,IAAM,IAAc,cAAc,EAAc,QAC1C,IAAY,YAAY,EAAc,QAEtC,IAAa,EAAI,QAAQ,EAAY,EACrC,IAAW,EAAI,QAAQ,EAAU;AAEvC,KAAI,MAAe,MAAM,MAAa,GACpC,OAAM,IAAI,EAAY,+BAA+B,EAAc,WAAW,cAAc;AAK9F,QAFsB,EAAI,MAAM,IAAa,EAAY,QAAQ,EAAS,CAAC,QAAQ,OAAO,GAAG;;AAa/F,eAAsB,EACpB,GACA,GACA,IAA8B,EAAE,EACL;CAC3B,IAAM,EACJ,gBAAa,GACb,gBAAa,GACb,UAAO,cACL;AAEJ,KAAI;EAEF,IAAM,IAAiB,KAAQ,EAAY,EAAW,EAGhD,IAAc,MAAM,OAAO,OAAO,UACtC,OACA,IAAI,aAAa,CAAC,OAAO,EAAS,EAClC,UACA,IACA,CAAC,cAAc,YAAY,CAC5B;AAgBD,SAAO;GACL,KAdiB,MAAM,OAAO,OAAO,UACrC;IACE,MAAM;IACN,MAAM;IACN;IACA;IACD,EACD,GACA;IAAE,MAAM;IAAW,QAAQ;IAAgB,EAC3C,IACA,CAAC,WAAW,UAAU,CACvB;GAIC,MAAM;GACP;UACM,GAAO;AACd,QAAM,IAAI,EAAY,sCAAsC,yBAAyB,EAAM;;;AAO/F,eAAsB,EAAiB,GAAiC;AACtE,KAAI;EACF,IAAM,IAAS,MAAM,OAAO,OAAO,UAAU,OAAO,EAAI;AACxD,SAAO,EAAM,IAAI,WAAW,EAAO,CAAC;UAC7B,GAAO;AACd,QAAM,IAAI,EAAY,gCAAgC,qBAAqB,EAAM;;;;;ACvRrF,IAAM,IAAqB,KAiBd,IAAb,MAAa,EAAoB;CAC/B;CACA;CAEA,YAAoB,GAAgB,GAA0B;AAE5D,EADA,KAAK,MAAM,GACX,KAAK,WAAW;;CAMlB,aAAa,OACX,GACA,IAAgC,EAAE,EACJ;AAE9B,SAAO,IAAI,EADC,MAAM,EAAmB,EAAO,EACR,EAAO,YAAY,SAAS;;CAMlE,OAAO,QAAQ,GAAgB,IAAgC,EAAE,EAAuB;AACtF,SAAO,IAAI,EAAoB,GAAK,EAAO,YAAY,SAAS;;CAOlE,MAAM,QAAQ,GAAiD;AAC7D,MAAI;GACF,IAAM,IAAO,OAAO,KAAc,WAAW,EAAc,EAAU,GAAG,GAClE,IAAK,GAAY,EAEjB,IAAa,MAAM,OAAO,OAAO,QACrC;IACE,MAAM;IACF;IACJ,WAAW;IACZ,EACD,KAAK,KACL,EACD;AAKD,UAAO,EAFU,EAAoB,GAAI,IAAI,WAAW,EAAW,CAAC,EAEtC,KAAK,SAAS;WACrC,GAAO;AAId,SAHI,aAAiB,IACb,IAEF,IAAI,EAAY,qBAAqB,qBAAqB,EAAM;;;CAQ1E,MAAM,QAAQ,GAAqC;AACjD,MAAI;GAEF,IAAM,EAAE,OAAI,YAAY,MAAkB,EAD7B,EAAY,GAAY,KAAK,SAAS,CACgB,EAE7D,IAAY,MAAM,OAAO,OAAO,QACpC;IACE,MAAM;IACF;IACJ,WAAW;IACZ,EACD,KAAK,KACL,EACD;AAED,UAAO,EAAc,IAAI,WAAW,EAAU,CAAC;WACxC,GAAO;AAId,SAHI,aAAiB,IACb,IAEF,IAAI,EAAY,qBAAqB,qBAAqB,EAAM;;;CAO1E,MAAM,aAAa,GAA4C;AAC7D,MAAI;GACF,IAAM,IAAK,GAAY,EAEjB,IAAa,MAAM,OAAO,OAAO,QACrC;IACE,MAAM;IACF;IACJ,WAAW;IACZ,EACD,KAAK,KACL,EACD;AAED,UAAO,EAAoB,GAAI,IAAI,WAAW,EAAW,CAAC;WACnD,GAAO;AAId,SAHI,aAAiB,IACb,IAEF,IAAI,EAAY,qBAAqB,qBAAqB,EAAM;;;CAO1E,MAAM,aAAa,GAA6C;AAC9D,MAAI;GACF,IAAM,EAAE,OAAI,YAAY,MAAkB,EAAoB,EAAW,EAEnE,IAAY,MAAM,OAAO,OAAO,QACpC;IACE,MAAM;IACF;IACJ,WAAW;IACZ,EACD,KAAK,KACL,EACD;AAED,UAAO,IAAI,WAAW,EAAU;WACzB,GAAO;AAId,SAHI,aAAiB,IACb,IAEF,IAAI,EAAY,qBAAqB,qBAAqB,EAAM;;;CAO1E,cAA8B;AAC5B,SAAO,KAAK;;;AAehB,eAAsB,EACpB,GACA,IAAgC,EAAE,EACJ;AAC9B,QAAO,EAAoB,OAAO,GAAQ,EAAO;;AAMnD,SAAgB,EACd,GACA,IAAgC,EAAE,EACb;AACrB,QAAO,EAAoB,QAAQ,GAAK,EAAO;;AAUjD,eAAsB,EAAc,GAAgB,GAAoC;AAEtF,SADe,MAAM,EAAsB,EAAO,EACpC,QAAQ,EAAU;;AAMlC,eAAsB,EAAc,GAAgB,GAAqC;AAEvF,SADe,MAAM,EAAsB,EAAO,EACpC,QAAQ,EAAW;;;;AChNnC,IAAM,IAAiB,KACjB,IAAqB,KACrB,IAAiB,GAqBV,IAAb,MAA8B;CAC5B;CACA;CAEA,YAAY,IAA6B,EAAE,EAAE;AAE3C,EADA,KAAK,WAAW,EAAO,YAAY,UACnC,KAAK,aAAa,EAAO,cAAc;;CAUzC,MAAM,QAAQ,GAAsB,GAAiD;AACnF,MAAI;GACF,IAAM,IAAO,OAAO,KAAc,WAAW,EAAc,EAAU,GAAG,GAGlE,IAAS,MAAM,OAAO,OAAO,YACjC;IAAE,MAAM;IAAW,QAAQ;IAAgB,EAC3C,IACA,CAAC,WAAW,UAAU,CACvB,EAGK,IAAY,MAAM,OAAO,OAAO,UAAU,OAAO,EAAO,EAGxD,IAAkB,MAAM,OAAO,OAAO,QAC1C,EAAE,MAAM,YAAY,EACpB,GACA,EACD,EAGK,IAAK,GAAY,EACjB,IAAgB,MAAM,OAAO,OAAO,QACxC;IACE,MAAM;IACF;IACJ,WAAW;IACZ,EACD,GACA,EACD,EAGK,IAAgB,IAAI,WAAW,EAAgB,EAC/C,IAAgB,IAAI,WAAW,EAAc,EAG7C,IAAS,EAAc,QACvB,IAAW,IAAI,WAAW,IAAQ,IAAS,KAAK,EAAc,OAAO;AAQ3E,UAPA,EAAS,KAAK,GACd,EAAS,KAAM,KAAU,IAAK,KAC9B,EAAS,KAAK,IAAS,KACvB,EAAS,IAAI,GAAe,EAAE,EAC9B,EAAS,IAAI,GAAI,IAAI,EAAO,EAC5B,EAAS,IAAI,GAAe,IAAI,IAAS,GAAG,EAErC,EAAa,GAAU,KAAK,SAAS;WACrC,GAAO;AAId,SAHI,aAAiB,IACb,IAEF,IAAI,EAAY,4BAA4B,qBAAqB,EAAM;;;CAUjF,MAAM,QAAQ,GAAuB,GAAyC;AAC5E,MAAI;GACF,IAAM,IAAO,EAAY,GAAY,KAAK,SAAS;AAGnD,OAAI,EAAK,SAAS,GAChB,OAAM,IAAI,EAAY,wCAAwC,qBAAqB;GAGrF,IAAM,IAAU,EAAK;AACrB,OAAI,MAAY,EACd,OAAM,IAAI,EACR,0CAA0C,OAAO,EAAQ,IACzD,qBACD;GAGH,IAAM,KAAW,EAAK,MAAM,MAAM,KAAM,EAAK,MAAM;AACnD,OAAI,EAAK,SAAS,IAAI,IAAS,KAAK,EAClC,OAAM,IAAI,EAAY,wCAAwC,qBAAqB;GAGrF,IAAM,IAAgB,EAAK,MAAM,GAAG,IAAI,EAAO,EACzC,IAAK,EAAK,MAAM,IAAI,GAAQ,IAAI,IAAS,GAAG,EAC5C,IAAgB,EAAK,MAAM,IAAI,IAAS,GAAG,EAG3C,IAAY,MAAM,OAAO,OAAO,QACpC,EAAE,MAAM,YAAY,EACpB,GACA,EACD,EAGK,IAAS,MAAM,OAAO,OAAO,UACjC,OACA,GACA;IAAE,MAAM;IAAW,QAAQ;IAAgB,EAC3C,IACA,CAAC,UAAU,CACZ,EAGK,IAAY,MAAM,OAAO,OAAO,QACpC;IACE,MAAM;IACF;IACJ,WAAW;IACZ,EACD,GACA,EACD;AAED,UAAO,IAAI,WAAW,EAAU;WACzB,GAAO;AAId,SAHI,aAAiB,IACb,IAEF,IAAI,EAAY,4BAA4B,qBAAqB,EAAM;;;CAOjF,MAAM,gBAAgB,GAAuB,GAAqC;EAChF,IAAM,IAAY,MAAM,KAAK,QAAQ,GAAY,EAAW;AAC5D,SAAO,IAAI,aAAa,CAAC,OAAO,EAAU;;CAM5C,cAA8B;AAC5B,SAAO,KAAK;;CAMd,gBAAwB;AACtB,SAAO,KAAK;;;AAWhB,SAAgB,EAAmB,IAA6B,EAAE,EAAoB;AACpF,QAAO,IAAI,EAAiB,EAAO;;AAUrC,eAAsB,EACpB,GACA,GACA,IAA6B,EAAE,EACd;AAEjB,QADe,EAAmB,EAAO,CAC3B,QAAQ,GAAW,EAAU;;AAM7C,eAAsB,EACpB,GACA,GACA,IAA6B,EAAE,EACV;AAErB,QADe,EAAmB,EAAO,CAC3B,QAAQ,GAAY,EAAW;;AAM/C,eAAsB,EACpB,GACA,GACA,IAA6B,EAAE,EACd;AAEjB,QADe,EAAmB,EAAO,CAC3B,gBAAgB,GAAY,EAAW;;;;AC1HvD,IAAa,IAAb,MAA+B;CAC7B;CAEA,YAAY,IAA8B,EAAE,EAAE;AAC5C,OAAK,SAAS;GACZ,UAAU,EAAO,YAAY;GAC7B,YAAY,EAAO,cAAc;GACjC,kBAAkB,EAAO,oBAAoB;GAC9C;;CAUH,MAAM,uBAAwC;AAC5C,SAAO,GAAsB;;CAM/B,MAAM,cAAc,GAAgB,GAAoC;AAEtE,UADe,MAAM,EAAsB,GAAQ,EAAE,UAAU,KAAK,OAAO,UAAU,CAAC,EACxE,QAAQ,EAAU;;CAMlC,MAAM,cAAc,GAAgB,GAAqC;AAEvE,UADe,MAAM,EAAsB,GAAQ,EAAE,UAAU,KAAK,OAAO,UAAU,CAAC,EACxE,QAAQ,EAAW;;CAUnC,MAAM,kBAAoC;AACxC,SAAO,EAAgB,KAAK,OAAO,WAAW;;CAMhD,MAAM,QAAQ,GAAsB,GAA4C;AAK9E,SAJe,EAAmB;GAChC,UAAU,KAAK,OAAO;GACtB,YAAY,KAAK,OAAO;GACzB,CAAC,CACY,QAAQ,GAAW,EAAK;;CAMxC,MAAM,QAAQ,GAAuB,GAAyC;AAK5E,SAJe,EAAmB;GAChC,UAAU,KAAK,OAAO;GACtB,YAAY,KAAK,OAAO;GACzB,CAAC,CACY,QAAQ,GAAY,EAAW;;CAM/C,MAAM,gBAAgB,GAAuB,GAAqC;AAKhF,SAJe,EAAmB;GAChC,UAAU,KAAK,OAAO;GACtB,YAAY,KAAK,OAAO;GACzB,CAAC,CACY,gBAAgB,GAAY,EAAW;;CAUvD,MAAM,gBAAgB,GAAiC;AACrD,SAAO,EAAgB,EAAI;;CAM7B,MAAM,iBAAiB,GAAiC;AACtD,SAAO,EAAiB,EAAI;;CAM9B,MAAM,gBAAgB,GAAiC;AACrD,SAAO,EAAgB,EAAI;;CAM7B,MAAM,iBAAiB,GAAiC;AACtD,SAAO,EAAiB,EAAI;;CAU9B,MAAM,sBAAsB,GAAkB,GAA8C;AAC1F,SAAO,EAAsB,GAAU,GAAM,EAC3C,YAAY,KAAK,OAAO,kBACzB,CAAC;;CAUJ,YAA2C;AACzC,SAAO,EAAE,GAAG,KAAK,QAAQ;;;AAO7B,SAAgB,EAAoB,IAA8B,EAAE,EAAqB;AACvF,QAAO,IAAI,EAAkB,EAAO;;AAItC,IAAI,IAA2C;AAK/C,SAAgB,EAAwB,GAAiD;AAEvF,QADA,MAAmB,EAAoB,EAAO,EACvC;;AAMT,SAAgB,EAAQ,GAAiD;AACvE,QAAO,EAAoB,EAAO"}

package/dist/crypto/keys.d.ts

@@ -0,0 +1,50 @@
+import { KeyPair, DerivedKeyResult, KeyDerivationConfig } from './types';
+/**
+ * Generate a random AES-256 key.
+ * Returns the key as a hex string (64 characters).
+ */
+export declare function generateSymmetricKey(): Promise<string>;
+/**
+ * Import a symmetric key from a hex string.
+ */
+export declare function importSymmetricKey(hexKey: string): Promise<CryptoKey>;
+/**
+ * Generate a random initialization vector (nonce) for AES-GCM.
+ * Returns 12 bytes as required by GCM.
+ */
+export declare function generateIV(): Uint8Array;
+/**
+ * Generate random bytes.
+ */
+export declare function randomBytes(length: number): Uint8Array;
+/**
+ * Generate an RSA key pair for hybrid encryption.
+ * Uses RSA-OAEP with SHA-256, compatible with FluxEncrypt.
+ */
+export declare function generateKeyPair(keySize?: 2048 | 4096): Promise<KeyPair>;
+/**
+ * Export a public key to PEM format (SPKI).
+ */
+export declare function exportPublicKey(key: CryptoKey): Promise<string>;
+/**
+ * Export a private key to PEM format (PKCS8).
+ */
+export declare function exportPrivateKey(key: CryptoKey): Promise<string>;
+/**
+ * Import a public key from PEM format.
+ */
+export declare function importPublicKey(pem: string): Promise<CryptoKey>;
+/**
+ * Import a private key from PEM format.
+ */
+export declare function importPrivateKey(pem: string): Promise<CryptoKey>;
+/**
+ * Derive a key from a password using PBKDF2.
+ * Compatible with FluxEncrypt's key derivation.
+ */
+export declare function deriveKeyFromPassword(password: string, salt?: Uint8Array, config?: KeyDerivationConfig): Promise<DerivedKeyResult>;
+/**
+ * Export a derived key as a hex string.
+ */
+export declare function exportDerivedKey(key: CryptoKey): Promise<string>;
+//# sourceMappingURL=keys.d.ts.map

package/dist/crypto/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/crypto/keys.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAe,KAAK,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAgBpG;;;GAGG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CAY5D;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAwB3E;AAED;;;GAGG;AACH,wBAAgB,UAAU,IAAI,UAAU,CAEvC;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAEtD;AAMD;;;GAGG;AACH,wBAAsB,eAAe,CAAC,OAAO,GAAE,IAAI,GAAG,IAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAoBnF;AAMD;;GAEG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAQrE;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAQtE;AAiBD;;GAEG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAqBrE;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAqBtE;AAyBD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,UAAU,EACjB,MAAM,GAAE,mBAAwB,GAC/B,OAAO,CAAC,gBAAgB,CAAC,CAyC3B;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAOtE"}