@crossdyne/security 0.4.0-beta.1 → 0.5.0-beta.2

package/dist/index.cjs

@@ -48,16 +48,22 @@ var SecurityUtils = class {
       return 0n;
     return BigInt("0x" + Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join(""));
   }
-  /** Converts bigint to fixed-length big-endian bytes (pads/truncates). */
+  /** Converts bigint to fixed-length big-endian bytes (pads only; never truncates). */
   static bigIntToFixedBytes(bn, length) {
+    if (length <= 0)
+      throw new Error("Length must be positive.");
     let hex = bn.toString(16);
     if (hex.length % 2 !== 0)
       hex = "0" + hex;
-    if (hex.length > length * 2)
-      hex = hex.slice(hex.length - length * 2);
-    else
-      hex = hex.padStart(length * 2, "0");
-    return new Uint8Array(hex.match(/.{1,2}/g)?.map((b) => parseInt(b, 16)) || []);
+    const byteLength = hex.length / 2;
+    if (byteLength > length)
+      throw new Error(`Value byte length (${byteLength}) exceeds expected length (${length}). Possible data corruption or context mismatch.`);
+    hex = hex.padStart(length * 2, "0");
+    const bytes = new Uint8Array(length);
+    for (let i = 0; i < length; i++) {
+      bytes[i] = parseInt(hex.substr(i * 2, 2), 16);
+    }
+    return bytes;
   }
   /** Constant-time comparison of two Uint8Arrays. */
   static fixedTimeEquals(a, b) {
@@ -68,18 +74,39 @@ var SecurityUtils = class {
       diff |= a[i] ^ b[i];
     return diff === 0;
   }
-  /** Modular exponentiation (base^exp mod mod) using binary exponentiation. */
-  static expMod(base, exp, mod) {
-    let res = BigInt(1);
+  /**
+   * Async modular exponentiation with event-loop yielding.
+   * @param base - The base value.
+   * @param exp - The exponent.
+   * @param mod - The modulus.
+   * @param yieldEvery - Number of iterations before yielding (default 64).
+   */
+  static async expModAsync(base, exp, mod, yieldEvery = 64) {
+    if (mod === 1n) return 0n;
+    let res = 1n;
     base = base % mod;
+    let i = 0;
     while (exp > 0n) {
-      if (exp % 2n === 1n)
+      if ((exp & 1n) === 1n)
         res = res * base % mod;
-      base = base * base % mod;
-      exp = exp / 2n;
+      exp >>= 1n;
+      if (exp > 0n)
+        base = base * base % mod;
+      if (++i % yieldEvery === 0) {
+        await new Promise((resolve) => setTimeout(resolve, 0));
+      }
     }
     return res;
   }
+  /** Converts bigint to minimal-length big-endian bytes (no padding). */
+  static bigIntToRawBytes(bn) {
+    if (bn === 0n)
+      return new Uint8Array([0]);
+    let hex = bn.toString(16);
+    if (hex.length % 2 !== 0)
+      hex = "0" + hex;
+    return new Uint8Array(hex.match(/.{1,2}/g).map((b) => parseInt(b, 16)));
+  }
 };
 
 // src/crypto/aes-gcm-options.ts
@@ -132,6 +159,97 @@ var AesGcmOptions = class _AesGcmOptions {
   }
 };
 
+// src/crypto/crypto-profile.ts
+var CryptoProfile = class {
+  /**
+   * Creates a new CryptoProfile.
+   * @param params - Object containing version, kdfOptions, aesGcmOptions.
+   */
+  constructor(params) {
+    this.version = params.version;
+    this.kdfOptions = params.kdfOptions;
+    this.aesGcmOptions = params.aesGcmOptions;
+  }
+};
+
+// src/crypto/crypto-version.ts
+var CryptoVersion = /* @__PURE__ */ ((CryptoVersion2) => {
+  CryptoVersion2[CryptoVersion2["V1"] = 1] = "V1";
+  return CryptoVersion2;
+})(CryptoVersion || {});
+
+// src/crypto/kdf-options.ts
+var KdfOptions = class _KdfOptions {
+  constructor() {
+    this._pbkdf2Iterations = SecurityConstants.Pbkdf2IterationsDefault;
+    this._hashAlgorithm = "SHA-256";
+  }
+  /** PBKDF2 iteration count (minimum 100_000). */
+  get pbkdf2Iterations() {
+    return this._pbkdf2Iterations;
+  }
+  set pbkdf2Iterations(v) {
+    if (v < SecurityConstants.Pbkdf2IterationsMinimum)
+      throw new RangeError(`PBKDF2 iterations must be \u2265 ${SecurityConstants.Pbkdf2IterationsMinimum}`);
+    this._pbkdf2Iterations = v;
+  }
+  /** Hash algorithm used by PBKDF2. Must be one of {@link SupportedHashAlgorithms}. */
+  get hashAlgorithm() {
+    return this._hashAlgorithm;
+  }
+  set hashAlgorithm(v) {
+    if (!SupportedHashAlgorithms.includes(v))
+      throw new RangeError(`Unsupported hash: ${v}`);
+    this._hashAlgorithm = v;
+  }
+  /** Validates iterations and hash algorithm. */
+  validate() {
+    if (this.pbkdf2Iterations < SecurityConstants.Pbkdf2IterationsMinimum)
+      throw new Error(`Pbkdf2Iterations (${this.pbkdf2Iterations}) below minimum`);
+    if (!SupportedHashAlgorithms.includes(this.hashAlgorithm))
+      throw new Error(`Invalid hash algorithm: ${this.hashAlgorithm}`);
+  }
+  /** Default preset: SHA-256, 600_000 iterations. */
+  static get default() {
+    return new _KdfOptions();
+  }
+  /** Fluent setter for {@link pbkdf2Iterations}. */
+  withPbkdf2Iterations(i) {
+    this.pbkdf2Iterations = i;
+    return this;
+  }
+  /** Fluent setter for {@link hashAlgorithm}. */
+  withHashAlgorithm(h) {
+    this.hashAlgorithm = h;
+    return this;
+  }
+  /** Validates and returns this instance. */
+  build() {
+    this.validate();
+    return this;
+  }
+};
+
+// src/crypto/crypto-profile-registry.ts
+var CryptoProfileRegistry = class {
+  static getProfile(version) {
+    switch (version) {
+      case 1 /* V1 */:
+        return new CryptoProfile({
+          version: 1 /* V1 */,
+          kdfOptions: KdfOptions.default,
+          aesGcmOptions: AesGcmOptions.default
+        });
+      default:
+        throw new Error(`Unsupported crypto version: ${version}`);
+    }
+  }
+  /** Latest supported profile (currently V1). */
+  static get latest() {
+    return this.getProfile(1 /* V1 */);
+  }
+};
+
 // src/crypto/crypto.service.ts
 var CryptoService = class {
   constructor() {
@@ -146,15 +264,15 @@ var CryptoService = class {
   * Encrypts a serializable object to a Base64 string.
   * @param dataModel - Object or Uint8Array to encrypt.
   * @param key - AES-256 key (32 bytes).
-  * @param options - AES-GCM configuration; uses default if omitted.
   * @returns Base64-encoded ciphertext with prepended nonce.
   */
-  async encryptData(dataModel, key, options) {
-    const opts = options ?? AesGcmOptions.default;
+  async encryptData(dataModel, key, version = 1 /* V1 */) {
+    const profile = CryptoProfileRegistry.getProfile(version);
+    const opts = profile.aesGcmOptions;
     opts.validate();
     const encoder = new TextEncoder();
     let jsonString;
-    if (dataModel instanceof Uint8Array) {
+    if (ArrayBuffer.isView(dataModel) && dataModel.constructor === Uint8Array) {
       jsonString = `"${SecurityUtils.toBase64(dataModel)}"`;
     } else {
       jsonString = JSON.stringify(dataModel);
@@ -182,29 +300,32 @@ var CryptoService = class {
       cryptoKey,
       plainBytes
     );
-    const result = new Uint8Array(opts.nonceSize + encryptedContent.byteLength);
-    result.set(nonce, 0);
-    result.set(new Uint8Array(encryptedContent), opts.nonceSize);
+    const result = new Uint8Array(1 + opts.nonceSize + encryptedContent.byteLength);
+    result[0] = version;
+    result.set(nonce, 1);
+    result.set(new Uint8Array(encryptedContent), 1 + opts.nonceSize);
     return SecurityUtils.toBase64(result);
   }
   /**
   * Decrypts a Base64-encoded ciphertext back to the original object.
   * @param encryptedBase64 - The encrypted data.
   * @param key - AES-256 key (32 bytes).
-  * @param options - AES-GCM configuration; uses default if omitted.
   * @returns Deserialized object, or null if input is empty.
   * @throws If authentication tag mismatch or corrupted data.
   */
-  async decryptData(encryptedBase64, key, options, isBytes = false) {
+  async decryptData(encryptedBase64, key, isBytes = false) {
     if (!encryptedBase64)
       return null;
-    const opts = options ?? AesGcmOptions.default;
-    opts.validate();
     const encryptedBytes = SecurityUtils.fromBase64(encryptedBase64);
-    if (encryptedBytes.length < opts.nonceSize + opts.tagSize)
+    const version = encryptedBytes[0];
+    const payload = encryptedBytes.slice(1);
+    const profile = CryptoProfileRegistry.getProfile(version);
+    const opts = profile.aesGcmOptions;
+    opts.validate();
+    if (payload.length < opts.nonceSize + opts.tagSize)
       throw new Error(`Invalid format: minimum expected ${opts.nonceSize + opts.tagSize} byte.`);
-    const nonce = encryptedBytes.slice(0, opts.nonceSize);
-    const ciphertextWithTag = encryptedBytes.slice(opts.nonceSize);
+    const nonce = payload.slice(0, opts.nonceSize);
+    const ciphertextWithTag = payload.slice(opts.nonceSize);
     const cryptoKey = await crypto.subtle.importKey(
       "raw",
       key,
@@ -214,9 +335,8 @@ var CryptoService = class {
     );
     try {
       let associatedData = new Uint8Array(0);
-      if (opts.associatedData != null) {
+      if (opts.associatedData != null)
         associatedData = opts.associatedData;
-      }
       const decryptedBuffer = await crypto.subtle.decrypt(
         {
           name: "AES-GCM",
@@ -233,7 +353,7 @@ var CryptoService = class {
       if (isBytes && typeof parsed === "string") {
         return SecurityUtils.fromBase64(parsed);
       }
-      return JSON.parse(jsonString);
+      return parsed;
     } catch (e) {
       console.error("Decryption error:", e);
       throw new Error("Decryption failed: authentication tag mismatch or corrupted data.");
@@ -241,88 +361,39 @@ var CryptoService = class {
   }
 };
 
-// src/crypto/kdf-options.ts
-var KdfOptions = class _KdfOptions {
-  constructor() {
-    this._pbkdf2Iterations = SecurityConstants.Pbkdf2IterationsDefault;
-    this._hashAlgorithm = "SHA-256";
-  }
-  /** PBKDF2 iteration count (minimum 100_000). */
-  get pbkdf2Iterations() {
-    return this._pbkdf2Iterations;
-  }
-  set pbkdf2Iterations(v) {
-    if (v < SecurityConstants.Pbkdf2IterationsMinimum)
-      throw new RangeError(`PBKDF2 iterations must be \u2265 ${SecurityConstants.Pbkdf2IterationsMinimum}`);
-    this._pbkdf2Iterations = v;
-  }
-  /** Hash algorithm used by PBKDF2. Must be one of {@link SupportedHashAlgorithms}. */
-  get hashAlgorithm() {
-    return this._hashAlgorithm;
-  }
-  set hashAlgorithm(v) {
-    if (!SupportedHashAlgorithms.includes(v))
-      throw new RangeError(`Unsupported hash: ${v}`);
-    this._hashAlgorithm = v;
-  }
-  /** Validates iterations and hash algorithm. */
-  validate() {
-    if (this.pbkdf2Iterations < SecurityConstants.Pbkdf2IterationsMinimum)
-      throw new Error(`Pbkdf2Iterations (${this.pbkdf2Iterations}) below minimum`);
-    if (!SupportedHashAlgorithms.includes(this.hashAlgorithm))
-      throw new Error(`Invalid hash algorithm: ${this.hashAlgorithm}`);
-  }
-  /** Default preset: SHA-256, 600_000 iterations. */
-  static get default() {
-    return new _KdfOptions();
-  }
-  /** Fluent setter for {@link pbkdf2Iterations}. */
-  withPbkdf2Iterations(i) {
-    this.pbkdf2Iterations = i;
-    return this;
-  }
-  /** Fluent setter for {@link hashAlgorithm}. */
-  withHashAlgorithm(h) {
-    this.hashAlgorithm = h;
-    return this;
-  }
-  /** Validates and returns this instance. */
-  build() {
-    this.validate();
-    return this;
-  }
-};
-
 // src/crypto/key-derivation.service.ts
 var KeyDerivationService = class {
   /**
-  * Derives KEK and Base64 AuthHash. Identity is normalized (trimmed, lowercase).
-  * @param identity - User identity (email, username).
-  * @param password - User password.
-  * @param salt - Random salt.
-  * @param options - KDF configuration; uses default if omitted.
-  * @returns Object with `kek` (Uint8Array) and `authHash` (Base64 string).
-  */
-  async deriveKeysFromPassword(identity, password, salt, options) {
-    if (!identity || identity.trim().length === 0)
+   * Derives KEK and Base64 AuthHash. Identity is used as-is in the 
+   * combined salt string — caller must normalize (trim, lowercase, etc.) before calling.
+   * @param identity - User identity (email, username). Must be pre-normalized by caller.
+   * @param password - User password.
+   * @param salt - Random salt (minimum 16 bytes).
+   * @param version - Crypto version for profile selection.
+   * @returns Object with `kek` (Uint8Array) and `authHash` (Base64 string).
+   */
+  async deriveKeysFromPassword(identity, password, salt, version) {
+    if (!identity || identity.length === 0)
       throw new Error("Identity cannot be null or empty.");
     if (!password || password.trim().length === 0)
       throw new Error("Password cannot be null or empty.");
     if (!salt || salt.length < 16)
       throw new Error("Salt must be at least 16 bytes.");
-    const opts = options ?? KdfOptions.default;
+    const profile = CryptoProfileRegistry.getProfile(version);
+    const opts = profile.kdfOptions;
     opts.validate();
     const safeSalt = new Uint8Array(salt);
     const encoder = new TextEncoder();
     const combinedPassword = `${identity}:${password}`;
     const passwordBytes = encoder.encode(combinedPassword);
     const baseKey = await crypto.subtle.importKey("raw", passwordBytes, "PBKDF2", false, ["deriveBits", "deriveKey"]);
+    const hashSize = HashSizes[opts.hashAlgorithm] ?? 32;
     const masterKeyBits = await crypto.subtle.deriveBits({
       name: "PBKDF2",
       salt: safeSalt,
       iterations: opts.pbkdf2Iterations,
       hash: opts.hashAlgorithm
-    }, baseKey, SecurityConstants.KeySizeBytes * 8);
+    }, baseKey, hashSize * 8);
     const masterKey = await crypto.subtle.importKey("raw", masterKeyBits, "HKDF", false, ["deriveBits"]);
     const kek = await crypto.subtle.deriveBits(
       { name: "HKDF", hash: opts.hashAlgorithm, salt: new Uint8Array(0), info: encoder.encode("AES-GCM-KEK-v1") },
@@ -339,99 +410,6 @@ var KeyDerivationService = class {
       authHash: SecurityUtils.toBase64(new Uint8Array(authBytes))
     };
   }
-  /**
-  * Derives an SRP-compatible authentication hash (output size = hash output length).
-  * @param identity - User identity.
-  * @param password - User password.
-  * @param salt - Random salt.
-  * @param srpHashAlgorithm - SRP hash algorithm (SHA-256/384/512).
-  * @param options - KDF configuration; uses default if omitted.
-  * @returns Raw hash bytes for use as SRP verifier input (x).
-  */
-  async deriveAuthHashForSrp(identity, password, salt, srpHashAlgorithm, options) {
-    if (!identity || identity.trim().length === 0)
-      throw new Error("Identity cannot be null or empty.");
-    if (!password || password.trim().length === 0)
-      throw new Error("Password cannot be null or empty.");
-    if (!salt || salt.length < 16)
-      throw new Error("Salt must be at least 16 bytes.");
-    const opts = options ?? KdfOptions.default;
-    opts.validate();
-    const srpHashSize = HashSizes[srpHashAlgorithm];
-    const combinedPassword = `${identity}:${password}`;
-    const passwordBytes = new TextEncoder().encode(combinedPassword);
-    const baseKey = await crypto.subtle.importKey(
-      "raw",
-      passwordBytes,
-      "PBKDF2",
-      false,
-      ["deriveBits"]
-    );
-    const masterKeyBits = await crypto.subtle.deriveBits({
-      name: "PBKDF2",
-      salt,
-      iterations: opts.pbkdf2Iterations,
-      hash: srpHashAlgorithm
-    }, baseKey, SecurityConstants.KeySizeBytes * 8);
-    const masterKey = await crypto.subtle.importKey(
-      "raw",
-      masterKeyBits,
-      "HKDF",
-      false,
-      ["deriveBits"]
-    );
-    const info = new TextEncoder().encode("SRP-AUTH-HASH-v1");
-    const authBytes = await crypto.subtle.deriveBits(
-      {
-        name: "HKDF",
-        hash: srpHashAlgorithm,
-        salt: new Uint8Array(0),
-        info
-      },
-      masterKey,
-      srpHashSize * 8
-    );
-    return new Uint8Array(authBytes);
-  }
-};
-
-// src/crypto/crypto-version.ts
-var CryptoVersion = /* @__PURE__ */ ((CryptoVersion2) => {
-  CryptoVersion2[CryptoVersion2["V1"] = 1] = "V1";
-  return CryptoVersion2;
-})(CryptoVersion || {});
-
-// src/crypto/crypto-profile.ts
-var CryptoProfile = class {
-  /**
-   * Creates a new CryptoProfile.
-   * @param params - Object containing version, kdfOptions, aesGcmOptions.
-   */
-  constructor(params) {
-    this.version = params.version;
-    this.kdfOptions = params.kdfOptions;
-    this.aesGcmOptions = params.aesGcmOptions;
-  }
-};
-
-// src/crypto/crypto-profile-registry.ts
-var CryptoProfileRegistry = class {
-  static getProfile(version) {
-    switch (version) {
-      case 1 /* V1 */:
-        return new CryptoProfile({
-          version: 1 /* V1 */,
-          kdfOptions: KdfOptions.default,
-          aesGcmOptions: AesGcmOptions.default
-        });
-      default:
-        throw new Error(`Unsupported crypto version: ${version}`);
-    }
-  }
-  /** Latest supported profile (currently V1). */
-  static get latest() {
-    return this.getProfile(1 /* V1 */);
-  }
 };
 
 // src/utils/srp-encoding.ts
@@ -455,14 +433,14 @@ var SrpEncoding = class {
   * Follows RFC 5054 / SRP-6a:
   * - H(N) and H(g) are hashed as modulus-sized values.
   * - Identity (I) is hashed as raw UTF-8 bytes.
-  * - A and B are padded to the modulus size before hashing.
+  * - A and B are zero-padded to the modulus size before hashing.
   * - K is the session key (H(S) without padding).
   * 
   * @param ctx - SRP context containing N, g, hash algorithm, and modulus size.
   * @param A - Client ephemeral public key.
   * @param B - Server ephemeral public key.
   * @param sessionKeyK - Session key K as raw bytes.
-  * @param identity - User identity (login). Should already be normalized (trimmed / lowercased) by the caller.
+  * @param identity - User identity (login). Must be pre-normalized by the caller.
   * @param salt - User-specific salt bytes.
   * @returns The M1 proof as raw hash bytes.
   */
@@ -486,7 +464,10 @@ var SrpEncoding = class {
       sessionKeyK
     );
   }
-  /** Computes M2 = H(A || M1 || sessionKeyK). */
+  /** 
+  * Computes M2 = H( PAD(A) || M1 || sessionKeyK ).
+  * A is zero-padded to the modulus size before hashing.
+  */
   static async computeM2(ctx, A, m1Bytes, sessionKeyK) {
     return this.computeHash(
       ctx.hashAlgorithmName,
@@ -497,14 +478,15 @@ var SrpEncoding = class {
   }
   /** Computes session key K = H(S). */
   static async computeSessionKey(ctx, S) {
-    let hex = S.toString(16);
-    if (hex.length % 2 !== 0)
-      hex = "0" + hex;
-    const sBytes = new Uint8Array(hex.match(/.{1,2}/g).map((b) => parseInt(b, 16)));
-    const hashBuffer = await crypto.subtle.digest(ctx.hashAlgorithmName, sBytes);
+    const sBytes = SecurityUtils.bigIntToRawBytes(S);
+    const safeBuffer = sBytes.buffer.slice(
+      sBytes.byteOffset,
+      sBytes.byteOffset + sBytes.byteLength
+    );
+    const hashBuffer = await crypto.subtle.digest(ctx.hashAlgorithmName, safeBuffer);
     return new Uint8Array(hashBuffer);
   }
-  /** Hashes bytes and returns raw Uint8Array (для M1/M2). */
+  /** Hashes concatenated byte arrays and returns raw Uint8Array. */
   static async computeHash(algo, ...buffers) {
     const totalLen = buffers.reduce((sum, b) => sum + b.length, 0);
     const combined = new Uint8Array(totalLen);
@@ -530,143 +512,6 @@ var SrpEncoding = class {
   }
 };
 
-// src/srp/srp-client-service.ts
-var SrpClientService = class {
-  constructor() {
-    this.keyDerivation = new KeyDerivationService();
-  }
-  /**
-  * Computes SRP verifier v = g^x mod N from the authentication hash.
-  * @param authHash - Auth hash (Base64).
-  * @param ctx - SRP context (N, g, hash algorithm, etc.).
-  * @returns Verifier as Base64 string.
-  */
-  async generateSrpVerifier(authHash, ctx) {
-    const x = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(authHash));
-    const v = SecurityUtils.expMod(ctx.g, x, ctx.N);
-    return SecurityUtils.toBase64(SrpEncoding.toModulusBytes(ctx, v));
-  }
-  /**
-   * Generates client proof (A, M1, session key S) from server challenge.
-   * @param login - User login.
-   * @param password - Plaintext password.
-   * @param saltBase64 - Server salt (URL-safe Base64).
-   * @param B_base64 - Server public ephemeral B (URL-safe Base64).
-   * @param ctx - SRP context.
-   * @returns Object with A, M1, S as Base64 strings.
-   */
-  async generateSrpProof(login, password, saltBase64, B_base64, ctx) {
-    const salt = SecurityUtils.fromBase64(saltBase64);
-    const authHash = await this.keyDerivation.deriveAuthHashForSrp(login, password, salt, ctx.hashAlgorithmName);
-    const x = SecurityUtils.bytesToBigInt(authHash);
-    const privateKeySize = Math.max(32, Math.floor(ctx.modulusSize / 2));
-    const aBytes = crypto.getRandomValues(new Uint8Array(privateKeySize));
-    const a = SecurityUtils.bytesToBigInt(aBytes);
-    const A = SecurityUtils.expMod(ctx.g, a, ctx.N);
-    if (A % ctx.N === 0n)
-      throw new Error("Critical error: A % N === 0");
-    const B = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(B_base64));
-    if (B % ctx.N === 0n)
-      throw new Error("Critical error: B % N === 0");
-    const u = await SrpEncoding.hashModuli(ctx, A, B);
-    if (u === 0n)
-      throw new Error("\u041D\u0435\u0434\u043E\u043F\u0443\u0441\u0442\u0438\u043C\u043E\u0435 \u0437\u043D\u0430\u0447\u0435\u043D\u0438\u0435 u");
-    const gX = SecurityUtils.expMod(ctx.g, x, ctx.N);
-    const term = ctx.k * gX % ctx.N;
-    const base = (B - term + ctx.N) % ctx.N;
-    const exponent = a + u * x;
-    const S = SecurityUtils.expMod(base, exponent, ctx.N);
-    if (S === 0n)
-      throw new Error("Critical error: S === 0");
-    const sessionKeyK = await SrpEncoding.computeSessionKey(ctx, S);
-    const M1 = await SrpEncoding.computeM1(ctx, A, B, sessionKeyK, login, salt);
-    return {
-      A: SecurityUtils.toBase64(SrpEncoding.toModulusBytes(ctx, A)),
-      M1: SecurityUtils.toBase64(M1),
-      SessionKeyK: sessionKeyK
-    };
-  }
-  /**
-   * Validates the server proof M2 to authenticate the server.
-   * @param A_b64 - Client public A (Base64).
-   * @param M1_b64 - Client proof M1 (Base64).
-   * @param S_b64 - Session key S (Base64).
-   * @param serverM2_b64 - Server proof M2 (Base64).
-   * @param ctx - SRP context.
-   * @returns True if the server proof is valid.
-   */
-  async verifyServerM2(A_b64, M1_b64, sessionKeyK, serverM2_b64, ctx) {
-    const A = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(A_b64));
-    const M1 = SecurityUtils.fromBase64(M1_b64);
-    const computedM2 = await SrpEncoding.computeM2(ctx, A, M1, sessionKeyK);
-    const serverM2Bytes = SecurityUtils.fromBase64(serverM2_b64);
-    return SecurityUtils.fixedTimeEquals(computedM2, serverM2Bytes);
-  }
-};
-
-// src/srp/srp-server-service.ts
-var SrpServerService = class {
-  /**
-   * Generates server challenge B and session state from verifier.
-   * @param login - User login.
-   * @param verifierBytes - Stored verifier v as byte array.
-   * @param ctx - SRP context (hash, N, g, etc.).
-   * @returns Session state with private b, verifier, and public B.
-   */
-  async getSrpChallenge(login, verifierBytes, salt, ctx) {
-    const v = SecurityUtils.bytesToBigInt(verifierBytes);
-    const privateKeySize = Math.max(32, Math.floor(ctx.modulusSize / 2));
-    let bBytes;
-    let B;
-    do {
-      bBytes = crypto.getRandomValues(new Uint8Array(privateKeySize));
-      const b = SecurityUtils.bytesToBigInt(bBytes);
-      const gB = SecurityUtils.expMod(ctx.g, b, ctx.N);
-      B = (ctx.k * v + gB) % ctx.N;
-    } while (B === 0n);
-    return {
-      login,
-      privateKeyB: bBytes,
-      verifier: verifierBytes,
-      publicKeyB: SrpEncoding.toModulusBytes(ctx, B),
-      salt
-    };
-  }
-  /**
-   * Verifies client M1 proof and returns server M2 proof.
-   * @param sessionState - Server session state.
-   * @param a - Client public A (Base64).
-   * @param m1 - Client proof M1 (Base64).
-   * @param ctx - SRP context.
-   * @returns Server proof M2 as Base64 string.
-   * @throws If verification fails or input is invalid.
-   */
-  async verifySrpProof(sessionState, a, m1, ctx) {
-    const A = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(a));
-    const M1_client = SecurityUtils.fromBase64(m1);
-    const b = SecurityUtils.bytesToBigInt(sessionState.privateKeyB);
-    const v = SecurityUtils.bytesToBigInt(sessionState.verifier);
-    const B = SecurityUtils.bytesToBigInt(sessionState.publicKeyB);
-    if (v <= 0n)
-      throw new Error("The verifier is corrupted");
-    if (A % ctx.N === 0n)
-      throw new Error("Incorrect value of A");
-    if (A <= 0n || A >= ctx.N)
-      throw new Error("Invalid A (out of range)");
-    const u = await SrpEncoding.hashModuli(ctx, A, B);
-    if (u === 0n)
-      throw new Error("Error in calculating the parameter u");
-    const vU = SecurityUtils.expMod(v, u, ctx.N);
-    const S = SecurityUtils.expMod(A * vU % ctx.N, b, ctx.N);
-    const sessionKeyK = await SrpEncoding.computeSessionKey(ctx, S);
-    const M1_server = await SrpEncoding.computeM1(ctx, A, B, sessionKeyK, sessionState.login, sessionState.salt);
-    if (!SecurityUtils.fixedTimeEquals(M1_server, M1_client))
-      throw new Error("Invalid password");
-    const M2_server = await SrpEncoding.computeM2(ctx, A, M1_client, sessionKeyK);
-    return SecurityUtils.toBase64(M2_server);
-  }
-};
-
 // src/srp/srp-group.ts
 var SrpGroup = /* @__PURE__ */ ((SrpGroup2) => {
   SrpGroup2[SrpGroup2["Rfc5054_1024"] = 1] = "Rfc5054_1024";
@@ -793,6 +638,225 @@ var SrpContextFactory = class {
   }
 };
 
+// src/srp/srp-client-service.ts
+var SrpClientService = class {
+  /**
+  * Computes SRP verifier v = g^x mod N from the authentication hash.
+  * @param authHash - Auth hash (Base64).
+  * @param group - SRP group (determines modulus N, generator g, hash).
+  * @returns Verifier as Base64 string.
+  */
+  async generateSrpVerifier(authHash, group) {
+    const ctx = await SrpContextFactory.create(group);
+    const x = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(authHash));
+    const v = await SecurityUtils.expModAsync(ctx.g, x, ctx.N);
+    return SecurityUtils.toBase64(SrpEncoding.toModulusBytes(ctx, v));
+  }
+  /**
+   * Generates client proof (A, M1, session key S) from server challenge.
+   * @param login - User login.
+   * @param authHashBytes - SRP private exponent x as raw bytes (derived from auth hash).
+   * @param saltBase64 - Server salt (standard Base64).
+   * @param B_base64 - Server public ephemeral B (standard Base64).
+   * @param group - SRP group (determines modulus N, generator g, hash).
+   * @returns Object with A and M1 as standard Base64; SessionKeyK as raw bytes.
+   */
+  async generateSrpProof(login, authHashBytes, saltBase64, B_base64, group) {
+    const ctx = await SrpContextFactory.create(group);
+    const salt = SecurityUtils.fromBase64(saltBase64);
+    const x = SecurityUtils.bytesToBigInt(authHashBytes);
+    const privateKeySize = Math.max(32, Math.floor(ctx.modulusSize / 2));
+    let aBytes;
+    let a;
+    do {
+      aBytes = crypto.getRandomValues(new Uint8Array(privateKeySize));
+      a = SecurityUtils.bytesToBigInt(aBytes);
+    } while (a === 0n);
+    const A = await SecurityUtils.expModAsync(ctx.g, a, ctx.N);
+    if (A <= 0n || A >= ctx.N)
+      throw new Error("Invalid client public key A.");
+    const B = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(B_base64));
+    if (B <= 0n || B >= ctx.N || B % ctx.N === 0n)
+      throw new Error("Critical error: B % N === 0");
+    const u = await SrpEncoding.hashModuli(ctx, A, B);
+    if (u === 0n)
+      throw new Error("\u041D\u0435\u0434\u043E\u043F\u0443\u0441\u0442\u0438\u043C\u043E\u0435 \u0437\u043D\u0430\u0447\u0435\u043D\u0438\u0435 u");
+    const gX = await SecurityUtils.expModAsync(ctx.g, x, ctx.N);
+    const term = ctx.k * gX % ctx.N;
+    const base = (B - term + ctx.N) % ctx.N;
+    const exponent = a + u * x;
+    const S = await SecurityUtils.expModAsync(base, exponent, ctx.N);
+    if (S === 0n)
+      throw new Error("Critical error: S === 0");
+    const sessionKeyK = await SrpEncoding.computeSessionKey(ctx, S);
+    const M1 = await SrpEncoding.computeM1(ctx, A, B, sessionKeyK, login, salt);
+    return {
+      A: SecurityUtils.toBase64(SrpEncoding.toModulusBytes(ctx, A)),
+      M1: SecurityUtils.toBase64(M1),
+      SessionKeyK: sessionKeyK
+    };
+  }
+  /**
+   * Validates the server proof M2 to authenticate the server.
+   * @param A_b64 - Client public A (Base64).
+   * @param M1_b64 - Client proof M1 (Base64).
+   * @param sessionKeyK - Session key K as raw bytes.
+   * @param serverM2_b64 - Server proof M2 (Base64).
+   * @param group - SRP group (determines modulus N, generator g, hash).
+   * @returns True if the server proof is valid.
+   */
+  async verifyServerM2(A_b64, M1_b64, sessionKeyK, serverM2_b64, group) {
+    const ctx = await SrpContextFactory.create(group);
+    const A = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(A_b64));
+    const M1 = SecurityUtils.fromBase64(M1_b64);
+    const computedM2 = await SrpEncoding.computeM2(ctx, A, M1, sessionKeyK);
+    const serverM2Bytes = SecurityUtils.fromBase64(serverM2_b64);
+    return SecurityUtils.fixedTimeEquals(computedM2, serverM2Bytes);
+  }
+};
+
+// src/srp/srp-server-service.ts
+var SrpServerService = class {
+  /**
+   * Generates server challenge B and session state from verifier.
+   * @param login - User login.
+   * @param verifierBytes - Stored verifier v as byte array.
+   * @param salt - User salt (raw bytes).
+   * @param group - SRP group (determines modulus N, generator g, hash).
+   * @returns Session state with private b, verifier, public B, and salt.
+   */
+  async getSrpChallenge(login, verifierBytes, salt, group) {
+    if (!login || login.trim().length === 0)
+      throw new Error("Login cannot be null or empty.");
+    if (!verifierBytes || verifierBytes.length === 0)
+      throw new Error("Verifier cannot be null or empty.");
+    const ctx = await SrpContextFactory.create(group);
+    const v = SecurityUtils.bytesToBigInt(verifierBytes);
+    if (v <= 0n || v >= ctx.N)
+      throw new Error("The verifier is corrupted");
+    const privateKeySize = Math.max(32, Math.floor(ctx.modulusSize / 2));
+    while (true) {
+      const bBytes = crypto.getRandomValues(new Uint8Array(privateKeySize));
+      const b = SecurityUtils.bytesToBigInt(bBytes);
+      if (b === 0n) {
+        continue;
+      }
+      const gB = await SecurityUtils.expModAsync(ctx.g, b, ctx.N);
+      const B = (ctx.k * v + gB) % ctx.N;
+      if (B !== 0n) {
+        return {
+          login,
+          privateKeyB: bBytes,
+          verifier: verifierBytes,
+          publicKeyB: SrpEncoding.toModulusBytes(ctx, B),
+          salt
+        };
+      }
+    }
+  }
+  /**
+   * Verifies client M1 proof and returns server M2 proof.
+   * @param sessionState - Server session state.
+   * @param a - Client public A (Base64).
+   * @param m1 - Client proof M1 (Base64).
+   * @param group - SRP group (determines modulus N, generator g, hash).
+   * @returns Server proof M2 as Base64 string.
+   * @throws If verification fails or input is invalid.
+   */
+  async verifySrpProof(sessionState, a, m1, group) {
+    const ctx = await SrpContextFactory.create(group);
+    const A = SecurityUtils.bytesToBigInt(SecurityUtils.fromBase64(a));
+    const M1_client = SecurityUtils.fromBase64(m1);
+    const b = SecurityUtils.bytesToBigInt(sessionState.privateKeyB);
+    const v = SecurityUtils.bytesToBigInt(sessionState.verifier);
+    const B = SecurityUtils.bytesToBigInt(sessionState.publicKeyB);
+    if (v <= 0n || v >= ctx.N)
+      throw new Error("The verifier is corrupted");
+    if (A % ctx.N === 0n)
+      throw new Error("Incorrect value of A");
+    if (A <= 0n || A >= ctx.N)
+      throw new Error("Invalid A (out of range)");
+    if (B <= 0n || B >= ctx.N)
+      throw new Error("Invalid server public key B.");
+    const u = await SrpEncoding.hashModuli(ctx, A, B);
+    if (u === 0n)
+      throw new Error("Error in calculating the parameter u");
+    const vU = await SecurityUtils.expModAsync(v, u, ctx.N);
+    const S = await SecurityUtils.expModAsync(A * vU % ctx.N, b, ctx.N);
+    if (S === 0n)
+      throw new Error("Critical error: shared secret S is zero (possible malicious A).");
+    const sessionKeyK = await SrpEncoding.computeSessionKey(ctx, S);
+    const M1_server = await SrpEncoding.computeM1(ctx, A, B, sessionKeyK, sessionState.login, sessionState.salt);
+    if (!SecurityUtils.fixedTimeEquals(M1_server, M1_client))
+      throw new Error("Invalid password");
+    const M2_server = await SrpEncoding.computeM2(ctx, A, M1_client, sessionKeyK);
+    return SecurityUtils.toBase64(M2_server);
+  }
+};
+
+// src/srp/srp-key-derivation.service.ts
+var SrpKeyDerivationService = class {
+  /**
+   * Derives an SRP-compatible authentication hash (output size = hash output length).
+   * Identity is used as-is in the combined string — caller must normalize 
+   * (trim, lowercase, etc.) before calling.
+   * @param identity - User identity (email, username). Must be pre-normalized by caller.
+   * @param password - User password.
+   * @param salt - Random salt (minimum 16 bytes).
+   * @param srpGroup - SRP group (determines hash algorithm and modulus).
+   * @param version - Crypto version for KDF profile selection.
+   * @returns Raw hash bytes for use as SRP verifier input (x).
+   */
+  async deriveAuthHashForSrp(identity, password, salt, srpGroup, version) {
+    if (!identity || identity.trim().length === 0)
+      throw new Error("Identity cannot be null or empty.");
+    if (!password || password.trim().length === 0)
+      throw new Error("Password cannot be null or empty.");
+    if (!salt || salt.length < 16)
+      throw new Error("Salt must be at least 16 bytes.");
+    const profile = CryptoProfileRegistry.getProfile(version);
+    const opts = profile.kdfOptions;
+    opts.validate();
+    const ctx = await SrpContextFactory.create(srpGroup);
+    const srpHashAlgorithm = ctx.hashAlgorithmName;
+    const srpHashSize = HashSizes[srpHashAlgorithm];
+    const combinedPassword = `${identity}:${password}`;
+    const passwordBytes = new TextEncoder().encode(combinedPassword);
+    const baseKey = await crypto.subtle.importKey(
+      "raw",
+      passwordBytes,
+      "PBKDF2",
+      false,
+      ["deriveBits"]
+    );
+    const masterKeyBits = await crypto.subtle.deriveBits({
+      name: "PBKDF2",
+      salt,
+      iterations: opts.pbkdf2Iterations,
+      hash: srpHashAlgorithm
+    }, baseKey, srpHashSize * 8);
+    const masterKey = await crypto.subtle.importKey(
+      "raw",
+      masterKeyBits,
+      "HKDF",
+      false,
+      ["deriveBits"]
+    );
+    const info = new TextEncoder().encode("SRP-AUTH-HASH-v1");
+    const authBytes = await crypto.subtle.deriveBits(
+      {
+        name: "HKDF",
+        hash: srpHashAlgorithm,
+        salt: new Uint8Array(0),
+        info
+      },
+      masterKey,
+      srpHashSize * 8
+    );
+    return new Uint8Array(authBytes);
+  }
+};
+
 exports.AesGcmOptions = AesGcmOptions;
 exports.CryptoProfile = CryptoProfile;
 exports.CryptoProfileRegistry = CryptoProfileRegistry;
@@ -807,6 +871,7 @@ exports.SrpContextFactory = SrpContextFactory;
 exports.SrpEncoding = SrpEncoding;
 exports.SrpGroup = SrpGroup;
 exports.SrpGroupParams = SrpGroupParams;
+exports.SrpKeyDerivationService = SrpKeyDerivationService;
 exports.SrpOptions = SrpOptions;
 exports.SrpServerService = SrpServerService;
 exports.SupportedHashAlgorithms = SupportedHashAlgorithms;