@digitaldefiance/node-ecies-lib 4.5.19 → 4.6.4

package/src/isolated-public.js

@@ -0,0 +1,317 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IsolatedPublicKey = void 0;
+const crypto_1 = require("crypto");
+const paillier_bigint_1 = require("paillier-bigint");
+const voting_error_type_1 = require("./enumerations/voting-error-type");
+const voting_1 = require("./errors/voting");
+const voting_consts_1 = require("./interfaces/voting-consts");
+/**
+ * IsolatedPublicKey extends Paillier PublicKey with instance isolation capabilities.
+ *
+ * This class provides:
+ * - keyId: A deterministic SHA-256 hash of the public key 'n' value for verification
+ * - instanceId: A unique identifier per key instance to prevent cross-instance operations
+ * - HMAC-tagged ciphertexts that bind encrypted values to a specific key instance
+ *
+ * Instance isolation ensures that ciphertexts encrypted with one instance cannot be
+ * used with another instance, even if they share the same underlying key material.
+ * This is critical for voting systems where ballot tampering must be prevented.
+ */
+class IsolatedPublicKey extends paillier_bigint_1.PublicKey {
+    /**
+     * Type guard to check if a PublicKey is an IsolatedPublicKey
+     */
+    static isIsolatedPublicKey(key) {
+        return key instanceof IsolatedPublicKey;
+    }
+    /**
+     * Deterministic identifier derived from the public key (SHA-256 of 'n')
+     */
+    keyId;
+    /**
+     * Original instance ID generated at construction time
+     */
+    _originalInstanceId;
+    /**
+     * Current instance ID (can be updated via updateInstanceId())
+     */
+    _currentInstanceId;
+    /**
+     * Unique salt used for instance ID generation
+     */
+    uniqueInstanceSalt;
+    /**
+     * Updates the current instance ID to a new random value.
+     * This invalidates all previously encrypted ciphertexts.
+     */
+    updateInstanceId() {
+        const randomSalt = (0, crypto_1.randomBytes)(32);
+        this._currentInstanceId = this.generateInstanceId(this.keyId, this.n, randomSalt);
+    }
+    /**
+     * Generates a deterministic instance ID from keyId, n, and a unique salt
+     */
+    generateInstanceId(keyId, n, uniqueInstanceSalt) {
+        // Convert n to hex string with proper padding
+        const nHex = n
+            .toString(voting_consts_1.VOTING.KEY_RADIX)
+            .padStart(voting_consts_1.VOTING.PUB_KEY_OFFSET, '0');
+        const nBytes = this.hexToBuffer(nHex);
+        // Concatenate keyId + nBytes + salt
+        const combined = Buffer.concat([keyId, nBytes, uniqueInstanceSalt]);
+        // Return SHA-256 hash
+        return this.sha256(combined);
+    }
+    /**
+     * SHA-256 hash using Node.js crypto
+     */
+    sha256(data) {
+        return (0, crypto_1.createHash)('sha256').update(data).digest();
+    }
+    /**
+     * Converts hex string to Buffer
+     */
+    hexToBuffer(hex) {
+        if (hex.length % 2 !== 0) {
+            hex = '0' + hex;
+        }
+        return Buffer.from(hex, 'hex');
+    }
+    /**
+     * Converts Buffer to hex string
+     */
+    bufferToHex(bytes) {
+        return bytes.toString('hex');
+    }
+    constructor(n, g, keyId) {
+        super(n, g);
+        this.keyId = keyId;
+        // Generate unique salt for this instance
+        const uniqueInstanceSalt = (0, crypto_1.randomBytes)(32);
+        this.uniqueInstanceSalt = uniqueInstanceSalt;
+        // Generate instance IDs (this is problematic with sync constructor)
+        // We'll need to handle this differently
+        this._originalInstanceId = Buffer.alloc(32); // Placeholder
+        this._currentInstanceId = Buffer.alloc(32); // Placeholder
+        // TODO: This needs to be refactored to use async factory method
+    }
+    /**
+     * Static factory method to create IsolatedPublicKey synchronously
+     */
+    static create(n, g, keyId) {
+        const key = new IsolatedPublicKey(n, g, keyId);
+        // Generate unique salt
+        const uniqueInstanceSalt = (0, crypto_1.randomBytes)(32);
+        // Generate instance ID synchronously
+        const nHex = n
+            .toString(voting_consts_1.VOTING.KEY_RADIX)
+            .padStart(voting_consts_1.VOTING.PUB_KEY_OFFSET, '0');
+        const nBytes = key.hexToBuffer(nHex);
+        const combined = Buffer.concat([keyId, nBytes, uniqueInstanceSalt]);
+        const instanceId = key.sha256(combined);
+        // Use Object.defineProperty to set readonly fields
+        Object.defineProperty(key, 'uniqueInstanceSalt', {
+            value: uniqueInstanceSalt,
+            writable: false,
+            enumerable: true,
+            configurable: false,
+        });
+        Object.defineProperty(key, '_originalInstanceId', {
+            value: instanceId,
+            writable: false,
+            enumerable: false,
+            configurable: false,
+        });
+        Object.defineProperty(key, '_currentInstanceId', {
+            value: Buffer.from(instanceId),
+            writable: true,
+            enumerable: false,
+            configurable: false,
+        });
+        return key;
+    }
+    /**
+     * Static factory method to create IsolatedPublicKey from deserialized data
+     * Used when reconstructing a key from a buffer with a stored instanceId
+     */
+    static fromBuffer(n, g, keyId, instanceId) {
+        const key = new IsolatedPublicKey(n, g, keyId);
+        // For deserialized keys, we don't have the original salt
+        // Set uniqueInstanceSalt to empty buffer
+        const uniqueInstanceSalt = Buffer.alloc(0);
+        // Use Object.defineProperty to set readonly fields
+        Object.defineProperty(key, 'uniqueInstanceSalt', {
+            value: uniqueInstanceSalt,
+            writable: false,
+            enumerable: true,
+            configurable: false,
+        });
+        Object.defineProperty(key, '_originalInstanceId', {
+            value: instanceId,
+            writable: false,
+            enumerable: false,
+            configurable: false,
+        });
+        Object.defineProperty(key, '_currentInstanceId', {
+            value: Buffer.from(instanceId),
+            writable: true,
+            enumerable: false,
+            configurable: false,
+        });
+        return key;
+    }
+    /**
+     * Returns a copy of the keyId
+     */
+    getKeyId() {
+        return Buffer.from(this.keyId);
+    }
+    /**
+     * Returns a copy of the current instance ID
+     */
+    getInstanceId() {
+        return Buffer.from(this._currentInstanceId);
+    }
+    /**
+     * Tags a ciphertext with an HMAC using keyId + instanceId
+     * Returns a new bigint with the HMAC appended
+     */
+    tagCiphertext(ciphertext) {
+        // Create HMAC key from keyId + instanceId
+        const hmacKeyMaterial = Buffer.concat([
+            this.keyId,
+            this._currentInstanceId,
+        ]);
+        // Create HMAC
+        const ciphertextHex = ciphertext.toString(voting_consts_1.VOTING.KEY_RADIX);
+        const ciphertextBytes = Buffer.from(ciphertextHex, 'utf8');
+        const hmac = (0, crypto_1.createHmac)('sha256', hmacKeyMaterial);
+        hmac.update(ciphertextBytes);
+        const signature = hmac.digest();
+        const signatureHex = this.bufferToHex(signature);
+        // Pad ciphertext and append HMAC
+        const hmacLength = 64; // 256 bits = 64 hex chars
+        const paddedCiphertext = ciphertextHex.padStart(hmacLength * 2, '0');
+        const taggedCiphertextString = paddedCiphertext + signatureHex;
+        return BigInt(`0x${taggedCiphertextString}`);
+    }
+    /**
+     * Extracts and validates the instance ID from a tagged ciphertext
+     * Returns the instance ID if valid, or zero-filled buffer if invalid
+     */
+    extractInstanceId(ciphertext) {
+        try {
+            const hmacLength = 64;
+            const ciphertextString = ciphertext.toString(16);
+            const receivedHmac = ciphertextString.slice(-hmacLength);
+            const calculatedCiphertext = BigInt(`0x${ciphertextString.slice(0, -hmacLength)}`);
+            // Create HMAC key from keyId + current instanceId
+            const hmacKeyMaterial = Buffer.concat([
+                this.keyId,
+                this._currentInstanceId,
+            ]);
+            // Calculate expected HMAC
+            const ciphertextHex = calculatedCiphertext.toString(voting_consts_1.VOTING.KEY_RADIX);
+            const ciphertextBytes = Buffer.from(ciphertextHex, 'utf8');
+            const hmac = (0, crypto_1.createHmac)('sha256', hmacKeyMaterial);
+            hmac.update(ciphertextBytes);
+            const expectedHmac = this.bufferToHex(hmac.digest());
+            // If HMAC matches, return current instance ID
+            return receivedHmac === expectedHmac
+                ? Buffer.from(this._currentInstanceId)
+                : Buffer.alloc(1, 0);
+            // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        }
+        catch (_error) {
+            // If any error occurs, return invalid instance ID
+            return Buffer.alloc(1, 0);
+        }
+    }
+    /**
+     * Encrypts a message and tags it with instance HMAC
+     */
+    encryptIsolated(m) {
+        this.verifyKeyId();
+        const ciphertext = super.encrypt(m);
+        return this.tagCiphertext(ciphertext);
+    }
+    /**
+     * Synchronous encrypt override (throws error - use encryptIsolated instead)
+     */
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    encrypt(_m) {
+        throw new voting_1.VotingError(voting_error_type_1.VotingErrorType.KeyPairValidationFailed);
+    }
+    /**
+     * Multiplies a ciphertext by a constant, preserving instance HMAC
+     */
+    multiplyIsolated(ciphertext, constant) {
+        this.verifyKeyId();
+        const instanceId = this.extractInstanceId(ciphertext);
+        // Check if instance IDs match
+        if (!this.bufferEquals(instanceId, this._currentInstanceId)) {
+            throw new voting_1.VotingError(voting_error_type_1.VotingErrorType.InstanceIdMismatch);
+        }
+        const hmacLength = 64;
+        const ciphertextString = ciphertext.toString(voting_consts_1.VOTING.KEY_RADIX);
+        const actualCiphertext = BigInt(`0x${ciphertextString.slice(0, -hmacLength)}`);
+        const product = super.multiply(actualCiphertext, constant);
+        return this.tagCiphertext(product);
+    }
+    /**
+     * Synchronous multiply override (throws error - use multiplyIsolated instead)
+     */
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    multiply(_ciphertext, _constant) {
+        throw new voting_1.VotingError(voting_error_type_1.VotingErrorType.KeyPairValidationFailed);
+    }
+    /**
+     * Adds two ciphertexts, preserving instance HMAC
+     */
+    additionIsolated(a, b) {
+        this.verifyKeyId();
+        const aInstanceID = this.extractInstanceId(a);
+        const bInstanceID = this.extractInstanceId(b);
+        if (!this.bufferEquals(aInstanceID, this._currentInstanceId) ||
+            !this.bufferEquals(bInstanceID, this._currentInstanceId)) {
+            throw new voting_1.VotingError(voting_error_type_1.VotingErrorType.InstanceIdMismatch);
+        }
+        const hmacLength = 64;
+        const aCiphertextString = a.toString(voting_consts_1.VOTING.KEY_RADIX);
+        const bCiphertextString = b.toString(voting_consts_1.VOTING.KEY_RADIX);
+        const aCiphertext = BigInt(`0x${aCiphertextString.slice(0, -hmacLength)}`);
+        const bCiphertext = BigInt(`0x${bCiphertextString.slice(0, -hmacLength)}`);
+        const sum = super.addition(aCiphertext, bCiphertext);
+        return this.tagCiphertext(sum);
+    }
+    /**
+     * Synchronous addition override (throws error - use additionIsolated instead)
+     */
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    addition(_a, _b) {
+        throw new voting_1.VotingError(voting_error_type_1.VotingErrorType.KeyPairValidationFailed);
+    }
+    /**
+     * Verifies that the keyId matches the SHA-256 hash of the public key 'n'
+     */
+    verifyKeyId() {
+        const nHex = this.n
+            .toString(voting_consts_1.VOTING.KEY_RADIX)
+            .padStart(voting_consts_1.VOTING.PUB_KEY_OFFSET, '0');
+        // Encode the hex string as UTF-8 bytes (not parse as hex digits)
+        const nBytes = Buffer.from(nHex, 'utf8');
+        const computedKeyId = this.sha256(nBytes);
+        if (!this.bufferEquals(this.keyId, computedKeyId)) {
+            throw new voting_1.VotingError(voting_error_type_1.VotingErrorType.InvalidPublicKeyIdMismatch);
+        }
+    }
+    /**
+     * Compares two Buffers for equality
+     */
+    bufferEquals(a, b) {
+        return Buffer.compare(a, b) === 0;
+    }
+}
+exports.IsolatedPublicKey = IsolatedPublicKey;
+//# sourceMappingURL=isolated-public.js.map

package/src/isolated-public.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolated-public.js","sourceRoot":"","sources":["../../../../packages/digitaldefiance-node-ecies-lib/src/isolated-public.ts"],"names":[],"mappings":";;;AAAA,mCAA6D;AAG7D,qDAA4C;AAE5C,wEAAmE;AACnE,4CAA8C;AAC9C,8DAAoD;AAEpD;;;;;;;;;;;GAWG;AACH,MAAa,iBACX,SAAQ,2BAAS;IAGjB;;OAEG;IACI,MAAM,CAAC,mBAAmB,CAAC,GAAc;QAC9C,OAAO,GAAG,YAAY,iBAAiB,CAAC;IAC1C,CAAC;IAED;;OAEG;IACa,KAAK,CAAS;IAE9B;;OAEG;IACc,mBAAmB,CAAS;IAE7C;;OAEG;IACK,kBAAkB,CAAS;IAEnC;;OAEG;IACc,kBAAkB,CAAS;IAE5C;;;OAGG;IACI,gBAAgB;QACrB,MAAM,UAAU,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAC/C,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,CAAC,EACN,UAAU,CACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,kBAAkB,CACxB,KAAa,EACb,CAAS,EACT,kBAA0B;QAE1B,8CAA8C;QAC9C,MAAM,IAAI,GAAG,CAAC;aACX,QAAQ,CAAC,sBAAM,CAAC,SAAS,CAAC;aAC1B,QAAQ,CAAC,sBAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAEtC,oCAAoC;QACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAEpE,sBAAsB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,IAAY;QACzB,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACpD,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW;QAC7B,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,KAAa;QAC/B,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,YAAY,CAAS,EAAE,CAAS,EAAE,KAAa;QAC7C,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAEnB,yCAAyC;QACzC,MAAM,kBAAkB,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAE7C,oEAAoE;QACpE,wCAAwC;QACxC,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc;QAC3D,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc;QAE1D,gEAAgE;IAClE,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,MAAM,CAAC,CAAS,EAAE,CAAS,EAAE,KAAa;QACtD,MAAM,GAAG,GAAG,IAAI,iBAAiB,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAE/C,uBAAuB;QACvB,MAAM,kBAAkB,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;QAE3C,qCAAqC;QACrC,MAAM,IAAI,GAAG,CAAC;aACX,QAAQ,CAAC,sBAAM,CAAC,SAAS,CAAC;aAC1B,QAAQ,CAAC,sBAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAEpE,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAExC,mDAAmD;QACnD,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,oBAAoB,EAAE;YAC/C,KAAK,EAAE,kBAAkB;YACzB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE;YAChD,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,oBAAoB,EAAE;YAC/C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YAC9B,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;QAEH,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,UAAU,CACtB,CAAS,EACT,CAAS,EACT,KAAa,EACb,UAAkB;QAElB,MAAM,GAAG,GAAG,IAAI,iBAAiB,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAE/C,yDAAyD;QACzD,yCAAyC;QACzC,MAAM,kBAAkB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAE3C,mDAAmD;QACnD,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,oBAAoB,EAAE;YAC/C,KAAK,EAAE,kBAAkB;YACzB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE;YAChD,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,oBAAoB,EAAE;YAC/C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YAC9B,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;QAEH,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACI,QAAQ;QACb,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACI,aAAa;QAClB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACK,aAAa,CAAC,UAAkB;QACtC,0CAA0C;QAC1C,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;YACpC,IAAI,CAAC,KAAK;YACV,IAAI,CAAC,kBAAkB;SACxB,CAAC,CAAC;QAEH,cAAc;QACd,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,sBAAM,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAEjD,iCAAiC;QACjC,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,0BAA0B;QACjD,MAAM,gBAAgB,GAAG,aAAa,CAAC,QAAQ,CAAC,UAAU,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACrE,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,YAAY,CAAC;QAE/D,OAAO,MAAM,CAAC,KAAK,sBAAsB,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACI,iBAAiB,CAAC,UAAkB;QACzC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,EAAE,CAAC;YACtB,MAAM,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC;YACzD,MAAM,oBAAoB,GAAG,MAAM,CACjC,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAC9C,CAAC;YAEF,kDAAkD;YAClD,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;gBACpC,IAAI,CAAC,KAAK;gBACV,IAAI,CAAC,kBAAkB;aACxB,CAAC,CAAC;YAEH,0BAA0B;YAC1B,MAAM,aAAa,GAAG,oBAAoB,CAAC,QAAQ,CAAC,sBAAM,CAAC,SAAS,CAAC,CAAC;YACtE,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAC3D,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAErD,8CAA8C;YAC9C,OAAO,YAAY,KAAK,YAAY;gBAClC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC;gBACtC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACvB,6DAA6D;QAC/D,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,kDAAkD;YAClD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;OAEG;IACI,eAAe,CAAC,CAAS;QAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,6DAA6D;IACpD,OAAO,CAAC,EAAU;QACzB,MAAM,IAAI,oBAAW,CAAC,mCAAe,CAAC,uBAAuB,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACI,gBAAgB,CAAC,UAAkB,EAAE,QAAgB;QAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAEtD,8BAA8B;QAC9B,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,oBAAW,CAAC,mCAAe,CAAC,kBAAkB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,UAAU,GAAG,EAAE,CAAC;QACtB,MAAM,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC,sBAAM,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,gBAAgB,GAAG,MAAM,CAC7B,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAC9C,CAAC;QAEF,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,6DAA6D;IACpD,QAAQ,CAAC,WAAmB,EAAE,SAAiB;QACtD,MAAM,IAAI,oBAAW,CAAC,mCAAe,CAAC,uBAAuB,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACI,gBAAgB,CAAC,CAAS,EAAE,CAAS;QAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAE9C,IACE,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,kBAAkB,CAAC;YACxD,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,kBAAkB,CAAC,EACxD,CAAC;YACD,MAAM,IAAI,oBAAW,CAAC,mCAAe,CAAC,kBAAkB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,UAAU,GAAG,EAAE,CAAC;QACtB,MAAM,iBAAiB,GAAG,CAAC,CAAC,QAAQ,CAAC,sBAAM,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,iBAAiB,GAAG,CAAC,CAAC,QAAQ,CAAC,sBAAM,CAAC,SAAS,CAAC,CAAC;QAEvD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC3E,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3E,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,6DAA6D;IACpD,QAAQ,CAAC,EAAU,EAAE,EAAU;QACtC,MAAM,IAAI,oBAAW,CAAC,mCAAe,CAAC,uBAAuB,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACI,WAAW;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC;aAChB,QAAQ,CAAC,sBAAM,CAAC,SAAS,CAAC;aAC1B,QAAQ,CAAC,sBAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QACxC,iEAAiE;QACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAE1C,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,oBAAW,CAAC,mCAAe,CAAC,0BAA0B,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,CAAS,EAAE,CAAS;QACvC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;CACF;AA9WD,8CA8WC"}

package/src/lib/crypto-container.d.ts

@@ -0,0 +1,13 @@
+import { IConstants } from '../interfaces/constants';
+export declare enum CryptoServiceKey {
+    ECIES = "ecies",
+    PBKDF2 = "pbkdf2",
+    AES_GCM = "aes-gcm"
+}
+export declare class CryptoContainer {
+    private services;
+    private constructor();
+    static create(config?: IConstants): CryptoContainer;
+    get<T>(key: CryptoServiceKey): T;
+}
+//# sourceMappingURL=crypto-container.d.ts.map

package/src/lib/crypto-container.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-container.d.ts","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-ecies-lib/src/lib/crypto-container.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAKrD,oBAAY,gBAAgB;IAC1B,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAwC;IAExD,OAAO;IAYP,MAAM,CAAC,MAAM,CAAC,MAAM,GAAE,UAAsB,GAAG,eAAe;IAI9D,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,gBAAgB,GAAG,CAAC;CAGjC"}

package/src/lib/crypto-container.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CryptoContainer = exports.CryptoServiceKey = void 0;
+/* eslint-disable @typescript-eslint/no-unsafe-argument */
+/* eslint-disable @typescript-eslint/no-unsafe-member-access */
+/* eslint-disable @typescript-eslint/no-unsafe-assignment */
+const constants_1 = require("../constants");
+const aes_gcm_1 = require("../services/aes-gcm");
+const ecies_1 = require("../services/ecies");
+const pbkdf2_1 = require("../services/pbkdf2");
+var CryptoServiceKey;
+(function (CryptoServiceKey) {
+    CryptoServiceKey["ECIES"] = "ecies";
+    CryptoServiceKey["PBKDF2"] = "pbkdf2";
+    CryptoServiceKey["AES_GCM"] = "aes-gcm";
+})(CryptoServiceKey || (exports.CryptoServiceKey = CryptoServiceKey = {}));
+class CryptoContainer {
+    services = new Map();
+    constructor(config) {
+        this.services.set(CryptoServiceKey.ECIES, new ecies_1.ECIESService(undefined, config.ECIES));
+        this.services.set(CryptoServiceKey.PBKDF2, new pbkdf2_1.Pbkdf2Service(config.PBKDF2_PROFILES, config.ECIES, config.PBKDF2));
+        this.services.set(CryptoServiceKey.AES_GCM, new aes_gcm_1.AESGCMService(config));
+    }
+    static create(config = constants_1.Constants) {
+        return new CryptoContainer(config);
+    }
+    get(key) {
+        return this.services.get(key);
+    }
+}
+exports.CryptoContainer = CryptoContainer;
+//# sourceMappingURL=crypto-container.js.map

package/src/lib/crypto-container.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-container.js","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-ecies-lib/src/lib/crypto-container.ts"],"names":[],"mappings":";;;AAAA,0DAA0D;AAC1D,+DAA+D;AAC/D,4DAA4D;AAC5D,4CAAyC;AAEzC,iDAAoD;AACpD,6CAAiD;AACjD,+CAAmD;AAEnD,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,mCAAe,CAAA;IACf,qCAAiB,CAAA;IACjB,uCAAmB,CAAA;AACrB,CAAC,EAJW,gBAAgB,gCAAhB,gBAAgB,QAI3B;AAED,MAAa,eAAe;IAClB,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;IAExD,YAAoB,MAAkB;QACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CACf,gBAAgB,CAAC,KAAK,EACtB,IAAI,oBAAY,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAC1C,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CACf,gBAAgB,CAAC,MAAM,EACvB,IAAI,sBAAa,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CACvE,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,uBAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,SAAqB,qBAAS;QAC1C,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,GAAG,CAAI,GAAqB;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAM,CAAC;IACrC,CAAC;CACF;AAtBD,0CAsBC"}

package/src/lib/index.d.ts

@@ -0,0 +1,4 @@
+export * from './crypto-container';
+export * from './invariant-validator';
+export * from './invariants';
+//# sourceMappingURL=index.d.ts.map

package/src/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-ecies-lib/src/lib/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC"}

package/src/lib/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./crypto-container"), exports);
+tslib_1.__exportStar(require("./invariant-validator"), exports);
+tslib_1.__exportStar(require("./invariants"), exports);
+//# sourceMappingURL=index.js.map

package/src/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-ecies-lib/src/lib/index.ts"],"names":[],"mappings":";;;AAAA,6DAAmC;AACnC,gEAAsC;AACtC,uDAA6B"}

package/src/lib/invariant-validator.d.ts

@@ -0,0 +1,69 @@
+import { IConstants } from '../interfaces/constants';
+/**
+ * Base interface for invariants
+ */
+interface IInvariant {
+    name: string;
+    description: string;
+    check(config: IConstants): boolean;
+    errorMessage(config: IConstants): string;
+}
+/**
+ * Node.js-specific invariant validator.
+ *
+ * Extends the base ecies-lib validator with Node.js-specific invariants.
+ * Validates configuration consistency to prevent bugs like the 12 vs 32-byte
+ * recipient ID discrepancy.
+ *
+ * @example
+ * ```typescript
+ * import { InvariantValidator } from '@digitaldefiance/node-ecies-lib';
+ * import { MyCustomInvariant } from './my-invariants';
+ *
+ * // Register a custom invariant
+ * InvariantValidator.registerInvariant(new MyCustomInvariant());
+ *
+ * // Validate configuration
+ * InvariantValidator.validateAll(config); // throws if any invariant fails
+ * ```
+ */
+export declare class InvariantValidator {
+    /**
+     * Node-specific invariants registered by default.
+     */
+    private static readonly NODE_DEFAULT_INVARIANTS;
+    private static customInvariants;
+    /**
+     * Register a custom invariant to be checked during validation.
+     *
+     * @param invariant - The invariant to register
+     */
+    static registerInvariant(invariant: IInvariant): void;
+    /**
+     * Unregister a custom invariant by name.
+     *
+     * @param name - The name of the invariant to unregister
+     * @returns true if the invariant was found and removed, false otherwise
+     */
+    static unregisterInvariant(name: string): boolean;
+    /**
+     * Get all registered invariants (default + custom).
+     */
+    static getAllInvariants(): readonly IInvariant[];
+    /**
+     * Validate all registered invariants against a configuration.
+     *
+     * This checks Node-specific invariants.
+     *
+     * @param config - The configuration to validate
+     * @throws Error if any invariant check fails
+     */
+    static validateAll(config: IConstants): void;
+    /**
+     * Clear all custom invariants.
+     * Default invariants are not affected.
+     */
+    static clearCustomInvariants(): void;
+}
+export {};
+//# sourceMappingURL=invariant-validator.d.ts.map

package/src/lib/invariant-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invariant-validator.d.ts","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-ecies-lib/src/lib/invariant-validator.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAIrD;;GAEG;AACH,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC;IACnC,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,kBAAkB;IAC7B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAE7C;IAEF,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAoB;IAEnD;;;;OAIG;IACH,MAAM,CAAC,iBAAiB,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IAIrD;;;;;OAKG;IACH,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IASjD;;OAEG;IACH,MAAM,CAAC,gBAAgB,IAAI,SAAS,UAAU,EAAE;IAIhD;;;;;;;OAOG;IACH,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI;IAuB5C;;;OAGG;IACH,MAAM,CAAC,qBAAqB,IAAI,IAAI;CAGrC"}

package/src/lib/invariant-validator.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvariantValidator = void 0;
+/* eslint-disable @typescript-eslint/no-unsafe-call */
+/* eslint-disable @typescript-eslint/no-unsafe-member-access */
+/* eslint-disable @typescript-eslint/no-unsafe-assignment */
+/* eslint-disable @typescript-eslint/no-unsafe-argument */
+/* eslint-disable @typescript-eslint/no-unsafe-return */
+const i18n_lib_1 = require("@digitaldefiance/i18n-lib");
+const node_ecies_i18n_setup_1 = require("../i18n/node-ecies-i18n-setup");
+const node_keys_1 = require("../i18n/node-keys");
+const recipient_id_consistency_1 = require("./invariants/recipient-id-consistency");
+/**
+ * Node.js-specific invariant validator.
+ *
+ * Extends the base ecies-lib validator with Node.js-specific invariants.
+ * Validates configuration consistency to prevent bugs like the 12 vs 32-byte
+ * recipient ID discrepancy.
+ *
+ * @example
+ * ```typescript
+ * import { InvariantValidator } from '@digitaldefiance/node-ecies-lib';
+ * import { MyCustomInvariant } from './my-invariants';
+ *
+ * // Register a custom invariant
+ * InvariantValidator.registerInvariant(new MyCustomInvariant());
+ *
+ * // Validate configuration
+ * InvariantValidator.validateAll(config); // throws if any invariant fails
+ * ```
+ */
+class InvariantValidator {
+    /**
+     * Node-specific invariants registered by default.
+     */
+    static NODE_DEFAULT_INVARIANTS = [
+        new recipient_id_consistency_1.RecipientIdConsistencyInvariant(),
+    ];
+    static customInvariants = [];
+    /**
+     * Register a custom invariant to be checked during validation.
+     *
+     * @param invariant - The invariant to register
+     */
+    static registerInvariant(invariant) {
+        this.customInvariants.push(invariant);
+    }
+    /**
+     * Unregister a custom invariant by name.
+     *
+     * @param name - The name of the invariant to unregister
+     * @returns true if the invariant was found and removed, false otherwise
+     */
+    static unregisterInvariant(name) {
+        const index = this.customInvariants.findIndex((inv) => inv.name === name);
+        if (index === -1) {
+            return false;
+        }
+        this.customInvariants.splice(index, 1);
+        return true;
+    }
+    /**
+     * Get all registered invariants (default + custom).
+     */
+    static getAllInvariants() {
+        return [...this.NODE_DEFAULT_INVARIANTS, ...this.customInvariants];
+    }
+    /**
+     * Validate all registered invariants against a configuration.
+     *
+     * This checks Node-specific invariants.
+     *
+     * @param config - The configuration to validate
+     * @throws Error if any invariant check fails
+     */
+    static validateAll(config) {
+        const failures = [];
+        // Validate Node-specific invariants
+        for (const invariant of this.getAllInvariants()) {
+            if (!invariant.check(config)) {
+                failures.push(invariant.errorMessage(config));
+            }
+        }
+        if (failures.length > 0) {
+            const engine = (0, node_ecies_i18n_setup_1.getNodeEciesI18nEngine)();
+            throw i18n_lib_1.TranslatableGenericError.withEngine(engine, node_keys_1.NodeEciesComponentId, node_keys_1.NodeEciesStringKey.Error_Invariant_ConfigurationValidationFailedTemplate, { failures: failures.join('\n\n') }, undefined, { invariantCount: failures.length });
+        }
+    }
+    /**
+     * Clear all custom invariants.
+     * Default invariants are not affected.
+     */
+    static clearCustomInvariants() {
+        this.customInvariants = [];
+    }
+}
+exports.InvariantValidator = InvariantValidator;
+//# sourceMappingURL=invariant-validator.js.map

package/src/lib/invariant-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invariant-validator.js","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-ecies-lib/src/lib/invariant-validator.ts"],"names":[],"mappings":";;;AAAA,sDAAsD;AACtD,+DAA+D;AAC/D,4DAA4D;AAC5D,0DAA0D;AAC1D,wDAAwD;AACxD,wDAAqE;AAErE,yEAAuE;AACvE,iDAA6E;AAG7E,oFAAwF;AAYxF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAa,kBAAkB;IAC7B;;OAEG;IACK,MAAM,CAAU,uBAAuB,GAAiB;QAC9D,IAAI,0DAA+B,EAAE;KACtC,CAAC;IAEM,MAAM,CAAC,gBAAgB,GAAiB,EAAE,CAAC;IAEnD;;;;OAIG;IACH,MAAM,CAAC,iBAAiB,CAAC,SAAqB;QAC5C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,mBAAmB,CAAC,IAAY;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC1E,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,gBAAgB;QACrB,OAAO,CAAC,GAAG,IAAI,CAAC,uBAAuB,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,WAAW,CAAC,MAAkB;QACnC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,oCAAoC;QACpC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAChD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,IAAA,8CAAsB,GAAE,CAAC;YACxC,MAAM,mCAAwB,CAAC,UAAU,CACvC,MAAM,EACN,gCAAoB,EACpB,8BAAkB,CAAC,qDAAqD,EACxE,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EACnC,SAAS,EACT,EAAE,cAAc,EAAE,QAAQ,CAAC,MAAM,EAAE,CACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,qBAAqB;QAC1B,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC;IAC7B,CAAC;;AA9EH,gDA+EC"}

package/src/lib/invariants/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Node.js-specific invariants for configuration validation.
+ *
+ * These invariants extend and complement the base ecies-lib invariants
+ * with Node.js-specific validation rules.
+ */
+export { RecipientIdConsistencyInvariant } from './recipient-id-consistency';
+//# sourceMappingURL=index.d.ts.map

package/src/lib/invariants/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../packages/digitaldefiance-node-ecies-lib/src/lib/invariants/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAC"}

package/src/lib/invariants/index.js

@@ -0,0 +1,12 @@
+"use strict";
+/**
+ * Node.js-specific invariants for configuration validation.
+ *
+ * These invariants extend and complement the base ecies-lib invariants
+ * with Node.js-specific validation rules.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RecipientIdConsistencyInvariant = void 0;
+var recipient_id_consistency_1 = require("./recipient-id-consistency");
+Object.defineProperty(exports, "RecipientIdConsistencyInvariant", { enumerable: true, get: function () { return recipient_id_consistency_1.RecipientIdConsistencyInvariant; } });
+//# sourceMappingURL=index.js.map

package/src/lib/invariants/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../packages/digitaldefiance-node-ecies-lib/src/lib/invariants/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,uEAA6E;AAApE,2IAAA,+BAA+B,OAAA"}

package/src/lib/invariants/recipient-id-consistency.d.ts

@@ -0,0 +1,41 @@
+import { IConstants } from '../../interfaces/constants';
+/**
+ * Base interface for invariants
+ */
+interface IInvariant {
+    name: string;
+    description: string;
+    check(config: IConstants): boolean;
+    errorMessage(config: IConstants): string;
+}
+/**
+ * Base class for invariants
+ */
+declare abstract class BaseInvariant implements IInvariant {
+    readonly name: string;
+    readonly description: string;
+    constructor(name: string, description: string);
+    abstract check(config: IConstants): boolean;
+    abstract errorMessage(config: IConstants): string;
+}
+/**
+ * Node.js-specific recipient ID consistency invariant.
+ *
+ * Extends the base ecies-lib invariant to also validate node-specific
+ * ENCRYPTION.RECIPIENT_ID_SIZE constant.
+ *
+ * This invariant would have caught the 12 vs 32 byte discrepancy.
+ *
+ * Checks:
+ * - MEMBER_ID_LENGTH === idProvider.byteLength
+ * - ECIES.MULTIPLE.RECIPIENT_ID_SIZE === idProvider.byteLength
+ * - ENCRYPTION.RECIPIENT_ID_SIZE === idProvider.byteLength (Node-specific)
+ * - All values must be in sync
+ */
+export declare class RecipientIdConsistencyInvariant extends BaseInvariant {
+    constructor();
+    check(config: IConstants): boolean;
+    errorMessage(config: IConstants): string;
+}
+export {};
+//# sourceMappingURL=recipient-id-consistency.d.ts.map