@docstack/client 0.0.1

package/lib/core/crypto-engine/index.d.ts

@@ -0,0 +1,121 @@
+import { Document } from "@docstack/shared";
+import Class from "../class.js";
+import type ClientStack from "../stack.js";
+import { EncryptedPayload } from "./utils.js";
+/**
+ * Engine for handling document-level encryption and decryption.
+ *
+ * CryptoEngine manages AES-GCM encryption for sensitive document fields.
+ * It uses a document key (derived from user credentials) to encrypt/decrypt
+ * fields marked with `encrypted: true` in their attribute configuration.
+ *
+ * The engine can be disabled via stack options for scenarios where
+ * encryption is not required.
+ *
+ * @example
+ * ```typescript
+ * // Encryption is handled automatically during document operations
+ * // when attributes are configured with `encrypted: true`
+ * await Attribute.create(userClass, 'ssn', 'string', 'Social Security Number', {
+ *     encrypted: true
+ * });
+ *
+ * // After authentication, the document key is available
+ * await stack.authenticate({ username: 'user', password: 'pass' });
+ * // Now encrypted fields will be automatically encrypted/decrypted
+ * ```
+ */
+export declare class CryptoEngine {
+    /** The hex-encoded document encryption key. */
+    private documentKey?;
+    /** The imported CryptoKey for Web Crypto API operations. */
+    private cryptoKey?;
+    private readonly logger;
+    /** Reference to the parent stack. */
+    private readonly stack;
+    /** Whether the crypto engine is enabled. */
+    private readonly enabled;
+    /**
+     * Creates a new CryptoEngine instance.
+     * @param stack - The parent ClientStack instance
+     */
+    constructor(stack: ClientStack);
+    /**
+     * Sets the document encryption key.
+     * Called automatically during authentication to provide the key
+     * derived from user credentials.
+     *
+     * @param documentKey - The hex-encoded document key, or null to clear
+     */
+    setDocumentKey(documentKey?: string | null): Promise<void>;
+    /**
+     * Returns the current document key.
+     * @returns The hex-encoded document key, or undefined if not set
+     */
+    getDocumentKey(): string;
+    /**
+     * Generates a cryptographically secure random string.
+     * Useful for generating salts or nonces.
+     *
+     * @param length - The length of the string to generate (default: 16)
+     * @returns A random hex string
+     */
+    generateRandomString(length?: number): string;
+    encryptValueForMarker(value: unknown): Promise<EncryptedPayload>;
+    /**
+     * Checks if the crypto engine is enabled.
+     * @returns `true` if encryption is enabled
+     */
+    isEnabled(): boolean;
+    /**
+     * Wraps a document key using the user's derived key.
+     * Used during user registration to store the encrypted document key.
+     *
+     * @param documentKey - The document key to wrap
+     * @param derivedKeyHex - The user's derived key (from password)
+     * @returns The wrapped (encrypted) document key
+     */
+    wrapDocumentKey(documentKey: string, derivedKeyHex: string): Promise<string>;
+    /**
+     * Unwraps and stores the document key using the user's derived key.
+     * Called during authentication to recover the document key.
+     *
+     * @param wrappedDocumentKey - The wrapped document key from the user record
+     * @param derivedKey - The user's derived key (from password)
+     * @returns The unwrapped document key
+     * @throws Error if the crypto engine is disabled or keys are missing
+     */
+    unwrapAndStoreDocumentKey(wrappedDocumentKey?: string | null, derivedKey?: string | null): Promise<string>;
+    private getCryptoKey;
+    private encryptValue;
+    private decryptValue;
+    /**
+     * Identifies which document keys contain encrypted data.
+     * Combines schema-defined encrypted attributes with runtime detection.
+     *
+     * @param document - The document to analyze
+     * @param classObj - Optional class for schema-based detection
+     * @returns Array of field names that are/should be encrypted
+     */
+    identifyEncryptedKeys(document: Document, classObj?: Class): string[];
+    /**
+     * Encrypts sensitive fields in a document before storage.
+     * Only encrypts fields marked with `encrypted: true` in the schema.
+     * Modifies the document in place.
+     *
+     * @param document - The document to encrypt
+     * @param classObj - The class defining which fields to encrypt
+     */
+    encryptDocument(document: Document, classObj: Class): Promise<void>;
+    /**
+     * Decrypts encrypted fields in a document after retrieval.
+     * Modifies the document in place.
+     *
+     * @param document - The document to decrypt
+     * @param classObj - Optional class for schema-based detection
+     * @param encryptedKeys - Optional pre-computed list of encrypted field names
+     */
+    decryptDocument(document: Document, classObj?: Class, encryptedKeys?: string[]): Promise<void>;
+}
+export type { EncryptedPayload } from "./utils.js";
+export { wrapDocumentKey, unwrapDocumentKey } from "./utils.js";

package/lib/core/crypto-engine/index.js

@@ -0,0 +1,130 @@
+import createLogger from "../../utils/logger/index.js";
+import { decryptWithAesGcm, encryptWithAesGcm, importAesKeyFromHex, isEncryptedPayload, unwrapDocumentKey, } from "./utils.js";
+export class CryptoEngine {
+    constructor(stack) {
+        this.logger = createLogger().child({ module: "crypto-engine" });
+        this.stack = stack;
+        this.enabled = !stack.isCryptoEngineDisabled();
+    }
+    async setDocumentKey(documentKey) {
+        if (!this.enabled)
+            return;
+        this.documentKey = documentKey || undefined;
+        this.cryptoKey = undefined;
+    }
+    getDocumentKey() {
+        return this.enabled ? this.documentKey : undefined;
+    }
+    async encryptValueForMarker(value) {
+        if (!this.enabled)
+            return null;
+        const key = await this.getCryptoKey();
+        if (!key)
+            return null;
+        return await this.encryptValue(value, key);
+    }
+    isEnabled() {
+        return this.enabled;
+    }
+    async unwrapAndStoreDocumentKey(wrappedDocumentKey, derivedKey) {
+        if (!this.enabled)
+            return null;
+        if (!wrappedDocumentKey || !derivedKey)
+            return null;
+        const key = await unwrapDocumentKey(wrappedDocumentKey, derivedKey);
+        await this.setDocumentKey(key);
+        return key;
+    }
+    async getCryptoKey() {
+        if (!this.enabled)
+            return null;
+        if (!this.documentKey)
+            return null;
+        if (this.cryptoKey)
+            return this.cryptoKey;
+        this.cryptoKey = await importAesKeyFromHex(this.documentKey, ["encrypt", "decrypt"]);
+        return this.cryptoKey;
+    }
+    async encryptValue(value, key) {
+        if (!this.enabled)
+            return value;
+        if (!key)
+            return value;
+        if (value === undefined || value === null)
+            return value;
+        if (isEncryptedPayload(value))
+            return value;
+        const serialized = JSON.stringify(value);
+        return encryptWithAesGcm(serialized, key);
+    }
+    async decryptValue(value, key) {
+        if (!this.enabled)
+            return value;
+        if (!key)
+            return value;
+        if (!isEncryptedPayload(value))
+            return value;
+        try {
+            const decrypted = await decryptWithAesGcm(value, key);
+            return JSON.parse(decrypted);
+        }
+        catch (error) {
+            this.logger.error("Failed to decrypt value", { error: (error === null || error === void 0 ? void 0 : error.message) || error });
+            return value;
+        }
+    }
+    identifyEncryptedKeys(document, classObj) {
+        var _a;
+        if (!this.enabled)
+            return [];
+        const encryptedFromSchema = (_a = classObj === null || classObj === void 0 ? void 0 : classObj.getEncryptedAttributes().map((attribute) => attribute.getName())) !== null && _a !== void 0 ? _a : [];
+        const encryptedFromPayload = Object.keys(document).filter((key) => isEncryptedPayload(document[key]));
+        if (!encryptedFromSchema.length) {
+            return encryptedFromPayload;
+        }
+        const merged = new Set(encryptedFromSchema);
+        for (const key of encryptedFromPayload) {
+            merged.add(key);
+        }
+        return Array.from(merged);
+    }
+    async encryptDocument(document, classObj) {
+        var _a, _b, _c;
+        if (!this.enabled)
+            return;
+        const encryptableAttributes = classObj.getEncryptedAttributes();
+        if (!encryptableAttributes.length)
+            return;
+        const key = await this.getCryptoKey();
+        if (!key) {
+            this.logger.warn("Document key is not available; skipping encryption", { className: (_b = (_a = classObj.getName) === null || _a === void 0 ? void 0 : _a.call(classObj)) !== null && _b !== void 0 ? _b : (_c = classObj.model) === null || _c === void 0 ? void 0 : _c.name });
+            return;
+        }
+        for (const attribute of encryptableAttributes) {
+            const name = attribute.getName();
+            if (!(name in document))
+                continue;
+            const encrypted = await this.encryptValue(document[name], key);
+            document[name] = encrypted;
+        }
+    }
+    async decryptDocument(document, classObj, encryptedKeys) {
+        var _a, _b, _c;
+        if (!this.enabled)
+            return;
+        const encryptedAttributes = encryptedKeys !== null && encryptedKeys !== void 0 ? encryptedKeys : this.identifyEncryptedKeys(document, classObj);
+        if (!encryptedAttributes.length)
+            return;
+        const key = await this.getCryptoKey();
+        if (!key) {
+            this.logger.warn("Document key is not available; returning encrypted payload", { className: (_b = (_a = classObj === null || classObj === void 0 ? void 0 : classObj.getName) === null || _a === void 0 ? void 0 : _a.call(classObj)) !== null && _b !== void 0 ? _b : (_c = classObj === null || classObj === void 0 ? void 0 : classObj.model) === null || _c === void 0 ? void 0 : _c.name });
+            return;
+        }
+        for (const name of encryptedAttributes) {
+            const decrypted = await this.decryptValue(document[name], key);
+            document[name] = decrypted;
+        }
+    }
+}
+export { wrapDocumentKey, unwrapDocumentKey } from "./utils.js";
+//# sourceMappingURL=index.js.map

package/lib/core/crypto-engine/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/crypto-engine/index.ts"],"names":[],"mappings":"AACA,OAAO,YAAY,MAAM,6BAA6B,CAAC;AAGvD,OAAO,EAEH,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GACpB,MAAM,YAAY,CAAC;AAEpB,MAAM,OAAO,YAAY;IAOrB,YAAY,KAAkB;QAJb,WAAM,GAAG,YAAY,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAKxE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC;IACnD,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,WAA2B;QACnD,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,WAAW,GAAG,WAAW,IAAI,SAAS,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;IAEM,cAAc;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAEM,KAAK,CAAC,qBAAqB,CAAC,KAAc;QAC7C,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAqB,CAAC;IACnE,CAAC;IAEM,SAAS;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAEM,KAAK,CAAC,yBAAyB,CAAC,kBAAkC,EAAE,UAA0B;QACjG,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC/B,IAAI,CAAC,kBAAkB,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAEpD,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,GAAG,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,YAAY;QACtB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QAE1C,IAAI,CAAC,SAAS,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC,SAAS,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,KAAc,EAAE,GAAqB;QAC5D,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACxD,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,iBAAiB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,KAAc,EAAE,GAAqB;QAC5D,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7C,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,KAAI,KAAK,EAAE,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAEM,qBAAqB,CAAC,QAAkB,EAAE,QAAgB;;QAC7D,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAC7B,MAAM,mBAAmB,GAAG,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,sBAAsB,GAAG,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,mCAAI,EAAE,CAAC;QAC7G,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAE,QAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAE/G,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,oBAAoB,CAAC;QAChC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,mBAAmB,CAAC,CAAC;QACpD,KAAK,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,QAAkB,EAAE,QAAe;;QAC5D,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,qBAAqB,GAAG,QAAQ,CAAC,sBAAsB,EAAE,CAAC;QAChE,IAAI,CAAC,qBAAqB,CAAC,MAAM;YAAE,OAAO;QAE1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE,EAAE,SAAS,EAAE,MAAA,MAAA,QAAQ,CAAC,OAAO,wDAAI,mCAAI,MAAA,QAAQ,CAAC,KAAK,0CAAE,IAAI,EAAE,CAAC,CAAC;YACpI,OAAO;QACX,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,qBAAqB,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC;gBAAE,SAAS;YAClC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAE,QAAgB,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;YACvE,QAAgB,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;QACxC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,QAAkB,EAAE,QAAgB,EAAE,aAAwB;;QACvF,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,mBAAmB,GAAG,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC5F,IAAI,CAAC,mBAAmB,CAAC,MAAM;YAAE,OAAO;QAExC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE,EAAE,SAAS,EAAE,MAAA,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,wDAAI,mCAAI,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK,0CAAE,IAAI,EAAE,CAAC,CAAC;YAC9I,OAAO;QACX,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAE,QAAgB,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;YACvE,QAAgB,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;QACxC,CAAC;IACL,CAAC;CACJ;AAGD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC"}

package/lib/core/crypto-engine/utils.d.ts

@@ -0,0 +1,20 @@
+export type EncryptedPayload = {
+    __enc: true;
+    iv: string;
+    data: string;
+    alg: "AES-GCM";
+};
+export declare const hexToBytes: (hex: string) => Uint8Array;
+export declare const toBase64: (data: ArrayBuffer | Uint8Array) => string;
+export declare const fromBase64: (value: string) => Uint8Array;
+export declare const importAesKeyFromHex: (hexKey: string, usages?: KeyUsage[]) => Promise<CryptoKey>;
+export declare const isEncryptedPayload: (value: unknown) => value is EncryptedPayload;
+export declare const encryptWithAesGcm: (plaintext: string, key: CryptoKey) => Promise<EncryptedPayload>;
+export declare const decryptWithAesGcm: (payload: EncryptedPayload, key: CryptoKey) => Promise<string>;
+export declare const wrapDocumentKey: (documentKey: string, derivedKeyHex: string) => Promise<string>;
+export declare const unwrapDocumentKey: (wrappedDocumentKey: string, cryptoKey: CryptoKey, derivedKeyHex: string) => Promise<string>;
+/**
+ * Generate random string of given length in bytes, returned as hex string
+ *
+**/
+export declare const generateRandomString: (length?: number) => string;

package/lib/core/crypto-engine/utils.js

@@ -0,0 +1,76 @@
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+const getCrypto = () => globalThis.crypto;
+export const hexToBytes = (hex) => {
+    if (hex.length % 2 !== 0) {
+        throw new Error("Hex value must have an even length");
+    }
+    const bytes = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < hex.length; i += 2) {
+        bytes[i / 2] = parseInt(hex.slice(i, i + 2), 16);
+    }
+    return bytes;
+};
+const toUint8Array = (data) => data instanceof ArrayBuffer ? new Uint8Array(data) : data;
+export const toBase64 = (data) => {
+    const bytes = toUint8Array(data);
+    let binary = "";
+    bytes.forEach((byte) => {
+        binary += String.fromCharCode(byte);
+    });
+    return btoa(binary);
+};
+export const fromBase64 = (value) => {
+    const binary = atob(value);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+};
+export const importAesKeyFromHex = async (hexKey, usages = ["encrypt", "decrypt"]) => {
+    const cryptoObj = getCrypto();
+    return cryptoObj.subtle.importKey("raw", hexToBytes(hexKey), { name: "AES-GCM" }, false, usages);
+};
+export const isEncryptedPayload = (value) => {
+    if (!value || typeof value !== "object")
+        return false;
+    const candidate = value;
+    return candidate.__enc === true && typeof candidate.iv === "string" && typeof candidate.data === "string";
+};
+export const encryptWithAesGcm = async (plaintext, key) => {
+    const cryptoObj = getCrypto();
+    const iv = new Uint8Array(12);
+    cryptoObj.getRandomValues(iv);
+    const ivBuffer = iv.buffer.slice(iv.byteOffset, iv.byteOffset + iv.byteLength);
+    const ciphertext = await cryptoObj.subtle.encrypt({ name: "AES-GCM", iv: ivBuffer }, key, encoder.encode(plaintext));
+    return {
+        __enc: true,
+        iv: toBase64(iv),
+        data: toBase64(ciphertext),
+        alg: "AES-GCM",
+    };
+};
+export const decryptWithAesGcm = async (payload, key) => {
+    const cryptoObj = getCrypto();
+    const ivBytes = fromBase64(payload.iv);
+    const dataBytes = fromBase64(payload.data);
+    const ivBuffer = ivBytes.buffer.slice(ivBytes.byteOffset, ivBytes.byteOffset + ivBytes.byteLength);
+    const dataBuffer = dataBytes.buffer.slice(dataBytes.byteOffset, dataBytes.byteOffset + dataBytes.byteLength);
+    const decrypted = await cryptoObj.subtle.decrypt({ name: "AES-GCM", iv: ivBuffer }, key, dataBuffer);
+    return decoder.decode(decrypted);
+};
+export const wrapDocumentKey = async (documentKey, derivedKeyHex) => {
+    const key = await importAesKeyFromHex(derivedKeyHex);
+    const payload = await encryptWithAesGcm(documentKey, key);
+    return JSON.stringify(payload);
+};
+export const unwrapDocumentKey = async (wrappedDocumentKey, derivedKeyHex) => {
+    const parsed = JSON.parse(wrappedDocumentKey);
+    if (!isEncryptedPayload(parsed)) {
+        throw new Error("Wrapped document key payload is malformed");
+    }
+    const key = await importAesKeyFromHex(derivedKeyHex, ["decrypt"]);
+    return decryptWithAesGcm(parsed, key);
+};
+//# sourceMappingURL=utils.js.map

package/lib/core/crypto-engine/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/core/crypto-engine/utils.ts"],"names":[],"mappings":"AASA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;AAE1C,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAW,EAAc,EAAE;IAClD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,IAA8B,EAAE,EAAE,CAAC,IAAI,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAEnH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAA8B,EAAU,EAAE;IAC/D,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACnB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAc,EAAE;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,MAAc,EAAE,SAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAsB,EAAE;IACzH,MAAM,SAAS,GAAG,SAAS,EAAE,CAAC;IAC9B,OAAO,SAAS,CAAC,MAAM,CAAC,SAAS,CAC7B,KAAK,EACL,UAAU,CAAC,MAAM,CAAiB,EAClC,EAAE,IAAI,EAAE,SAAS,EAAS,EAC1B,KAAK,EACL,MAAM,CACT,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAA6B,EAAE;IAC5E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,OAAO,SAAS,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9G,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,SAAiB,EAAE,GAAc,EAA6B,EAAE;IACpG,MAAM,SAAS,GAAG,SAAS,EAAE,CAAC;IAC9B,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7B,SAAiB,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAS,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5H,OAAO;QACH,KAAK,EAAE,IAAI;QACX,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;QAChB,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC;QAC1B,GAAG,EAAE,SAAS;KACjB,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,OAAyB,EAAE,GAAc,EAAmB,EAAE;IAClG,MAAM,SAAS,GAAG,SAAS,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnG,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7G,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAS,EACxC,GAAG,EACH,UAA0B,CAC7B,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,WAAmB,EAAE,aAAqB,EAAmB,EAAE;IACjG,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,kBAA0B,EAAE,aAAqB,EAAmB,EAAE;IAC1G,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACvD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAClE,OAAO,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC,CAAC"}

package/lib/core/datamodel/index.d.ts

@@ -0,0 +1,3 @@
+import { Patch } from "@docstack/shared";
+export declare function getSystemPatches(currentVersion: string): Promise<Patch[]>;
+export declare function getAllSystemPatches(): Promise<Patch[]>;