@dstorage-tech/dstorage-sdk 0.0.4 → 0.0.5

package/dist/chunk-U3MS6KMF.mjs

@@ -1 +0,0 @@
-import{a as n}from"./chunk-PKHRAYFD.mjs";import{a as i,q as p,r as w,s as h}from"./chunk-UBALMYIY.mjs";import{scrypt as S}from"@noble/hashes/scrypt.js";var d={v1:{N:131072,r:8,p:1},"v1-lite":{N:65536,r:8,p:1}},N=class m{constructor(t){this.name="password",O(t.password,t.minPasswordLength??12,t.minEntropyBits??60,t.additionalValidators),this.salt=P(t.salt);let r=A(t.preset,t.params);this.N=r.N,this.r=r.r,this.p=r.p;let a=new TextEncoder().encode(t.password),s=S(a,this.salt,{N:this.N,r:this.r,p:this.p,dkLen:64});this.kekMaterialPromise=globalThis.crypto.subtle.importKey("raw",s,"HKDF",!1,["deriveBits"]).then(o=>(s.fill(0),o),o=>{throw s.fill(0),o})}static fromKdfParams(t){if(t.kdf!=="scrypt")throw new i(n.PASSWORD_UNSUPPORTED_KDF,`[dStorage] PasswordEncryptionAdapter.fromKdfParams: unsupported kdf "${t.kdf}". Only "scrypt" is supported.`);return new m({password:t.password,salt:t.salt,params:{N:t.N,r:t.r,p:t.p},...t.minPasswordLength!==void 0&&{minPasswordLength:t.minPasswordLength},...t.minEntropyBits!==void 0&&{minEntropyBits:t.minEntropyBits},...t.additionalValidators!==void 0&&{additionalValidators:t.additionalValidators}})}getKdfParams(){return{kdf:"scrypt",N:this.N,r:this.r,p:this.p}}async wrapDek(t){let r=await this.kekMaterialPromise,a=await p(r);try{return{algorithm:"xchacha20poly1305-v1",kekDerivation:"hkdf-sha256-v1",wrappedDek:await w(t,a)}}finally{a.fill(0)}}async unwrapDek({wrappedDek:t}){let r=await this.kekMaterialPromise,a=await p(r);try{return h(t,a)}finally{a.fill(0)}}async intoKeypairEncryptionAdapter(t,r){let{KeypairEncryptionAdapter:a}=await import("./KeypairEncryptionAdapter-AE75YC4W-BAVHRNNJ.mjs"),{mlkemGenerateKeypairFromSeed:s}=await import("./dist-655VYUPJ.mjs"),o=await this.kekMaterialPromise,l=await globalThis.crypto.subtle.deriveBits({name:"HKDF",hash:"SHA-256",salt:new Uint8Array(32),info:new TextEncoder().encode("dstorage:mlkem-seed:v1")},o,512),c=new Uint8Array(l);try{let{pk:u,sk:k}=s(c,r);return a.fromKeypair(u,k,t,r)}finally{c.fill(0)}}};function P(e){let t=typeof e=="string"?new TextEncoder().encode(e):e;if(t.length===0)throw new i(n.PASSWORD_EMPTY_SALT,'[dStorage] PasswordEncryptionAdapter: salt must not be empty. Provide an app-specific domain label, e.g. "myapp:v1:alice@example.com".');return t}function A(e,t){if(e!==void 0){if(!(e in d))throw new i(n.PASSWORD_UNKNOWN_PRESET,`[dStorage] PasswordEncryptionAdapter: unknown preset "${e}". Valid presets: ${Object.keys(d).join(", ")}.`);return d[e]}return{N:t?.N??d.v1.N,r:t?.r??d.v1.r,p:t?.p??d.v1.p}}function E(e){let t=0;return/[a-z]/.test(e)&&(t+=26),/[A-Z]/.test(e)&&(t+=26),/[0-9]/.test(e)&&(t+=10),/[^a-zA-Z0-9]/.test(e)&&(t+=32),t===0?0:Math.log2(t)*e.length}function y(e,t=5){for(let r=0;r<=e.length-t;r++){let a=!0,s=!0;for(let o=1;o<t;o++){let l=e.charCodeAt(r+o)-e.charCodeAt(r+o-1);if(l!==1&&(a=!1),l!==-1&&(s=!1),!a&&!s)break}if(a||s)return!0}return!1}var v=["qwertyuiop","asdfghjkl","zxcvbnm","1234567890"];function f(e,t=5){let r=e.toLowerCase();for(let a of v)for(let s=0;s<=a.length-t;s++){let o=a.slice(s,s+t),l=o.split("").reverse().join("");if(r.includes(o)||r.includes(l))return!0}return!1}function _(){for(;;){let e=globalThis.crypto.getRandomValues(new Uint8Array(32)),r=btoa(Array.from(e,a=>String.fromCharCode(a)).join("")).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"");if(new Set(r).size>=3&&!y(r)&&!f(r))return r}}function O(e,t,r,a){if(e.length<t)throw new i(n.PASSWORD_TOO_SHORT,`[dStorage] Password too short: ${e.length} character(s) (minimum ${t}). Use a longer passphrase.`);if(new Set(e).size<3)throw new i(n.PASSWORD_TOO_FEW_DISTINCT,"[dStorage] Password is too weak: too few distinct characters.");if(y(e))throw new i(n.PASSWORD_SEQUENTIAL_RUN,"[dStorage] Password is too weak: contains a sequential character run (e.g. abcde, 12345).");if(f(e))throw new i(n.PASSWORD_KEYBOARD_WALK,"[dStorage] Password is too weak: contains a keyboard-row pattern (e.g. qwerty, asdfg).");let s=E(e);if(s<r)throw new i(n.PASSWORD_ENTROPY_TOO_LOW,`[dStorage] Password entropy too low: ~${Math.round(s)} bits (minimum ${r} bits). Use a longer password with a mix of uppercase, lowercase, digits, and symbols.`);if(a)for(let o of a)o(e)}export{d as a,N as b,_ as c};