@de-otio/trellis 0.4.0 → 0.6.0

package/dist/lib/crypto/voting/hash-utils.d.ts

@@ -1,58 +1,12 @@
 /**
  * Hash Utilities for Secure Voting
  *
- * Provides hash functions for Secure Voting System using the shared cryptographic library.
- * These functions are used for:
- * - Verification codes
- * - Election record hashing
- * - Proof challenges (Fiat-Shamir heuristic)
- *
- * Note: ElGamal encryption remains separate (homomorphic requirement).
- * Only hash functions use the shared library.
- *
- * @see packages/crypto for shared cryptographic operations
- * @see doc/02-technical/architecture/cryptography/ for design documentation
- */
-/**
- * Hash data for verification codes
- *
- * Verification codes are used to allow voters to verify their vote was counted.
- * Uses SHA-256 from the shared cryptographic library.
- *
- * @param data - Data to hash (typically ballot identifier or vote data)
- * @returns SHA-256 hash as hex string
+ * SHA-256 helpers for verification codes, election records, proof
+ * challenges (Fiat-Shamir), and device-info tracking. ElGamal stays
+ * separate (homomorphic requirement).
  */
 export declare function hashVerificationCode(data: string | object): Promise<string>;
-/**
- * Hash election record for integrity verification
- *
- * Election records contain cryptographic commitments to election parameters.
- * Uses SHA-256 from the shared cryptographic library.
- *
- * @param electionRecord - Election record data to hash
- * @returns SHA-256 hash as hex string
- */
 export declare function hashElectionRecord(electionRecord: string | object): Promise<string>;
-/**
- * Generate proof challenge using Fiat-Shamir heuristic
- *
- * The Fiat-Shamir heuristic converts interactive zero-knowledge proofs
- * to non-interactive proofs by using a hash of the proof transcript as the challenge.
- *
- * Uses SHA-256 from the shared cryptographic library.
- *
- * @param transcript - Proof transcript (public values, commitments, etc.)
- * @returns Challenge value (hash of transcript) as hex string
- */
 export declare function generateFiatShamirChallenge(transcript: string | object): Promise<string>;
-/**
- * Hash device information for ballot tracking
- *
- * Device information is hashed (not stored in plaintext) to enable
- * ballot tracking while maintaining privacy.
- *
- * @param deviceInfo - Device information object
- * @returns SHA-256 hash as hex string
- */
 export declare function hashDeviceInfo(deviceInfo: object): Promise<string>;
 //# sourceMappingURL=hash-utils.d.ts.map

package/dist/lib/crypto/voting/hash-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hash-utils.d.ts","sourceRoot":"","sources":["../../../../src/lib/crypto/voting/hash-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,GAAG,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,cAAc,EAAE,MAAM,GAAG,MAAM,GAC9B,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,MAAM,GAAG,MAAM,GAC1B,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAExE"}
+{"version":3,"file":"hash-utils.d.ts","sourceRoot":"","sources":["../../../../src/lib/crypto/voting/hash-utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,GAAG,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAsB,kBAAkB,CACtC,cAAc,EAAE,MAAM,GAAG,MAAM,GAC9B,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,MAAM,GAAG,MAAM,GAC1B,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAExE"}

package/dist/lib/crypto/voting/hash-utils.js

@@ -2,72 +2,30 @@
 /**
  * Hash Utilities for Secure Voting
  *
- * Provides hash functions for Secure Voting System using the shared cryptographic library.
- * These functions are used for:
- * - Verification codes
- * - Election record hashing
- * - Proof challenges (Fiat-Shamir heuristic)
- *
- * Note: ElGamal encryption remains separate (homomorphic requirement).
- * Only hash functions use the shared library.
- *
- * @see packages/crypto for shared cryptographic operations
- * @see doc/02-technical/architecture/cryptography/ for design documentation
+ * SHA-256 helpers for verification codes, election records, proof
+ * challenges (Fiat-Shamir), and device-info tracking. ElGamal stays
+ * separate (homomorphic requirement).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.hashVerificationCode = hashVerificationCode;
 exports.hashElectionRecord = hashElectionRecord;
 exports.generateFiatShamirChallenge = generateFiatShamirChallenge;
 exports.hashDeviceInfo = hashDeviceInfo;
-const index_js_1 = require("../index.js");
-/**
- * Hash data for verification codes
- *
- * Verification codes are used to allow voters to verify their vote was counted.
- * Uses SHA-256 from the shared cryptographic library.
- *
- * @param data - Data to hash (typically ballot identifier or vote data)
- * @returns SHA-256 hash as hex string
- */
+const node_crypto_1 = require("node:crypto");
+function sha256Hex(data) {
+    const s = typeof data === "string" ? data : JSON.stringify(data);
+    return (0, node_crypto_1.createHash)("sha256").update(s, "utf8").digest("hex");
+}
 async function hashVerificationCode(data) {
-    return await index_js_1.EncryptionService.hash(data);
+    return sha256Hex(data);
 }
-/**
- * Hash election record for integrity verification
- *
- * Election records contain cryptographic commitments to election parameters.
- * Uses SHA-256 from the shared cryptographic library.
- *
- * @param electionRecord - Election record data to hash
- * @returns SHA-256 hash as hex string
- */
 async function hashElectionRecord(electionRecord) {
-    return await index_js_1.EncryptionService.hash(electionRecord);
+    return sha256Hex(electionRecord);
 }
-/**
- * Generate proof challenge using Fiat-Shamir heuristic
- *
- * The Fiat-Shamir heuristic converts interactive zero-knowledge proofs
- * to non-interactive proofs by using a hash of the proof transcript as the challenge.
- *
- * Uses SHA-256 from the shared cryptographic library.
- *
- * @param transcript - Proof transcript (public values, commitments, etc.)
- * @returns Challenge value (hash of transcript) as hex string
- */
 async function generateFiatShamirChallenge(transcript) {
-    return await index_js_1.EncryptionService.hash(transcript);
+    return sha256Hex(transcript);
 }
-/**
- * Hash device information for ballot tracking
- *
- * Device information is hashed (not stored in plaintext) to enable
- * ballot tracking while maintaining privacy.
- *
- * @param deviceInfo - Device information object
- * @returns SHA-256 hash as hex string
- */
 async function hashDeviceInfo(deviceInfo) {
-    return await index_js_1.EncryptionService.hash(deviceInfo);
+    return sha256Hex(deviceInfo);
 }
 //# sourceMappingURL=hash-utils.js.map

package/dist/lib/crypto/voting/hash-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"hash-utils.js","sourceRoot":"","sources":["../../../../src/lib/crypto/voting/hash-utils.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAaH,oDAIC;AAWD,gDAIC;AAaD,kEAIC;AAWD,wCAEC;AA5DD,0CAAgD;AAEhD;;;;;;;;GAQG;AACI,KAAK,UAAU,oBAAoB,CACxC,IAAqB;IAErB,OAAO,MAAM,4BAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,kBAAkB,CACtC,cAA+B;IAE/B,OAAO,MAAM,4BAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,2BAA2B,CAC/C,UAA2B;IAE3B,OAAO,MAAM,4BAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,cAAc,CAAC,UAAkB;IACrD,OAAO,MAAM,4BAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAClD,CAAC"}
+{"version":3,"file":"hash-utils.js","sourceRoot":"","sources":["../../../../src/lib/crypto/voting/hash-utils.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AASH,oDAIC;AAED,gDAIC;AAED,kEAIC;AAED,wCAEC;AA3BD,6CAAyC;AAEzC,SAAS,SAAS,CAAC,IAAqB;IACtC,MAAM,CAAC,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAEM,KAAK,UAAU,oBAAoB,CACxC,IAAqB;IAErB,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAEM,KAAK,UAAU,kBAAkB,CACtC,cAA+B;IAE/B,OAAO,SAAS,CAAC,cAAc,CAAC,CAAC;AACnC,CAAC;AAEM,KAAK,UAAU,2BAA2B,CAC/C,UAA2B;IAE3B,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC;AAC/B,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,UAAkB;IACrD,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC;AAC/B,CAAC"}

package/dist/lib/email-privacy.d.ts

@@ -1,54 +1,16 @@
 /**
  * Email Privacy Utilities
  *
- * PREPARATORY: Border Safety Mode - Email hashing for privacy
- *
- * Provides utilities for hashing emails to support zero-knowledge architecture.
- * Email hashes allow lookups without exposing plaintext emails to the server.
- *
- * FUTURE USE: When zero-knowledge architecture is implemented, email hashes will:
- * - Enable email lookups without server seeing plaintext
- * - Support account recovery without exposing email
- * - Enable anonymous account linking
- *
- * @see doc/01-business/features/b2c-features/border-safety-mode/preparatory-design-changes/07-privacy.md
+ * Hashes emails for privacy-preserving lookups. Plain SHA-256 over the
+ * normalized email (lowercased + trimmed). For pepper-based HMAC use
+ * `node:crypto` directly at the call site.
  */
 /**
- * Hash an email address using SHA-256
- *
- * PREPARATORY: Creates a consistent hash of an email address for privacy-preserving lookups.
- * The email is normalized (lowercased and trimmed) before hashing to ensure consistent results.
- *
- * Uses the shared cryptographic library (@de-otio/trellis (inlined crypto)) for consistent hashing.
- *
- * FUTURE USE: When zero-knowledge architecture is implemented, this hash will be used for:
- * - Email lookups without exposing plaintext
- * - Account recovery workflows
- * - Anonymous account linking
+ * Hash a normalized email via SHA-256. Returns hex.
  *
- * NOTE: This function uses plain SHA-256. For enhanced security with pepper,
- * consider using EncryptionService.hashEmail(email, pepper) instead.
- *
- * @param email - Email address to hash
- * @returns SHA-256 hash of the normalized email as a hex string
- * @throws Error if email is empty or invalid after normalization
- *
- * @example
- * ```typescript
- * const hash = hashEmail('  User@Example.com  ');
- * // Returns: hash of 'user@example.com'
- * ```
+ * @throws if `email` is empty / non-string / empty after normalization.
  */
 export declare function hashEmail(email: string): Promise<string>;
-/**
- * Synchronous version of hashEmail (for compatibility)
- *
- * Note: This uses the async Web Crypto API but provides a synchronous interface
- * by returning a Promise. Use hashEmail() directly for better clarity.
- *
- * @deprecated Use hashEmail() instead
- * @param email - Email address to hash
- * @returns Promise that resolves to SHA-256 hash as hex string
- */
+/** @deprecated Use hashEmail() directly — this wrapper exists for compat. */
 export declare function hashEmailSync(email: string): Promise<string>;
 //# sourceMappingURL=email-privacy.d.ts.map

package/dist/lib/email-privacy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-privacy.d.ts","sourceRoot":"","sources":["../../src/lib/email-privacy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAc9D;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAElE"}
+{"version":3,"file":"email-privacy.d.ts","sourceRoot":"","sources":["../../src/lib/email-privacy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAW9D;AAED,6EAA6E;AAC7E,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAElE"}

package/dist/lib/email-privacy.js

@@ -2,70 +2,30 @@
 /**
  * Email Privacy Utilities
  *
- * PREPARATORY: Border Safety Mode - Email hashing for privacy
- *
- * Provides utilities for hashing emails to support zero-knowledge architecture.
- * Email hashes allow lookups without exposing plaintext emails to the server.
- *
- * FUTURE USE: When zero-knowledge architecture is implemented, email hashes will:
- * - Enable email lookups without server seeing plaintext
- * - Support account recovery without exposing email
- * - Enable anonymous account linking
- *
- * @see doc/01-business/features/b2c-features/border-safety-mode/preparatory-design-changes/07-privacy.md
+ * Hashes emails for privacy-preserving lookups. Plain SHA-256 over the
+ * normalized email (lowercased + trimmed). For pepper-based HMAC use
+ * `node:crypto` directly at the call site.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.hashEmail = hashEmail;
 exports.hashEmailSync = hashEmailSync;
-const index_js_1 = require("./crypto/index.js");
+const node_crypto_1 = require("node:crypto");
 /**
- * Hash an email address using SHA-256
- *
- * PREPARATORY: Creates a consistent hash of an email address for privacy-preserving lookups.
- * The email is normalized (lowercased and trimmed) before hashing to ensure consistent results.
- *
- * Uses the shared cryptographic library (@de-otio/trellis (inlined crypto)) for consistent hashing.
- *
- * FUTURE USE: When zero-knowledge architecture is implemented, this hash will be used for:
- * - Email lookups without exposing plaintext
- * - Account recovery workflows
- * - Anonymous account linking
+ * Hash a normalized email via SHA-256. Returns hex.
  *
- * NOTE: This function uses plain SHA-256. For enhanced security with pepper,
- * consider using EncryptionService.hashEmail(email, pepper) instead.
- *
- * @param email - Email address to hash
- * @returns SHA-256 hash of the normalized email as a hex string
- * @throws Error if email is empty or invalid after normalization
- *
- * @example
- * ```typescript
- * const hash = hashEmail('  User@Example.com  ');
- * // Returns: hash of 'user@example.com'
- * ```
+ * @throws if `email` is empty / non-string / empty after normalization.
  */
 async function hashEmail(email) {
     if (!email || typeof email !== "string") {
         throw new Error("Email must be a non-empty string");
     }
-    // Normalize email: lowercase and trim whitespace
-    const normalizedEmail = email.toLowerCase().trim();
-    if (normalizedEmail.length === 0) {
+    const normalized = email.toLowerCase().trim();
+    if (normalized.length === 0) {
         throw new Error("Email cannot be empty after normalization");
     }
-    // Use shared cryptographic library for consistent hashing
-    return await index_js_1.EncryptionService.hash(normalizedEmail);
+    return (0, node_crypto_1.createHash)("sha256").update(normalized, "utf8").digest("hex");
 }
-/**
- * Synchronous version of hashEmail (for compatibility)
- *
- * Note: This uses the async Web Crypto API but provides a synchronous interface
- * by returning a Promise. Use hashEmail() directly for better clarity.
- *
- * @deprecated Use hashEmail() instead
- * @param email - Email address to hash
- * @returns Promise that resolves to SHA-256 hash as hex string
- */
+/** @deprecated Use hashEmail() directly — this wrapper exists for compat. */
 async function hashEmailSync(email) {
     return hashEmail(email);
 }

package/dist/lib/email-privacy.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-privacy.js","sourceRoot":"","sources":["../../src/lib/email-privacy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AA8BH,8BAcC;AAYD,sCAEC;AAxDD,gDAAsD;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACI,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,iDAAiD;IACjD,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAEnD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,0DAA0D;IAC1D,OAAO,MAAM,4BAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"email-privacy.js","sourceRoot":"","sources":["../../src/lib/email-privacy.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AASH,8BAWC;AAGD,sCAEC;AAvBD,6CAAyC;AAEzC;;;;GAIG;AACI,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@de-otio/trellis",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -30,7 +30,7 @@
     "test:postdeployment": "vitest run --config vitest.postdeployment.config.ts",
     "test:postdeployment:api": "vitest run --config vitest.postdeployment.api.config.ts",
     "test:postdeployment:followers": "vitest run --config vitest.postdeployment.followers.config.ts",
-    "lint": "tsc --build --noEmit",
+    "lint": "tsc --build",
     "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
     "prisma:generate": "prisma generate",
     "prisma:migrate:dev": "prisma migrate dev",
@@ -52,7 +52,7 @@
     "@prisma/adapter-pg": "^6.0.0",
     "@prisma/client": "^6.0.0",
     "@prisma/extension-accelerate": "^1.0.0",
-    "@de-otio/trellis-extension-api": "^0.1.0",
+    "@de-otio/trellis-extension-api": "^0.2.0",
     "aws-jwt-verify": "^4.0.0",
     "exifr": "^7.1.3",
     "isomorphic-dompurify": "^2.18.0",
@@ -76,8 +76,8 @@
     "@types/node": "^22.0.0",
     "@types/pg": "^8.18.0",
     "@types/sharp": "^0.31.0",
-    "@vitest/coverage-v8": "^2.0.0",
-    "@vitest/ui": "^2.0.0",
+    "@vitest/coverage-v8": "^4.0.0",
+    "@vitest/ui": "^4.0.0",
     "@aws-lambda-powertools/parameters": "^2.32.0",
     "esbuild": "^0.27.0",
     "form-data": "^4.0.1",
@@ -86,6 +86,6 @@
     "prisma": "^6.0.0",
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
-    "vitest": "^2.0.0"
+    "vitest": "^4.0.0"
   }
 }