@dstorage-tech/dstorage-sdk 0.0.4 → 0.0.6

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@dstorage-tech/dstorage-sdk",
-  "version": "0.0.4",
+  "version": "0.0.6",
   "description": "Privacy-first decentralized storage SDK with pluggable adapters",
   "license": "MIT",
+  "homepage": "https://dstorage.pro",
   "keywords": [
     "dstorage",
     "privacy",

package/dist/KeypairEncryptionAdapter-AE75YC4W-AOWNSH2M.mjs

@@ -1,9 +0,0 @@
-import {
-  KeypairEncryptionAdapter
-} from "./chunk-62RSKZ6T.mjs";
-import "./chunk-O37NHERH.mjs";
-import "./chunk-TSZ37JDY.mjs";
-import "./chunk-UJCSKKID.mjs";
-export {
-  KeypairEncryptionAdapter
-};

package/dist/KeypairEncryptionAdapter-AE75YC4W-BAVHRNNJ.mjs

@@ -1 +0,0 @@
-import{a as r}from"./chunk-UOOF4V2Y.mjs";import"./chunk-PKHRAYFD.mjs";import"./chunk-UBALMYIY.mjs";export{r as KeypairEncryptionAdapter};

package/dist/KeypairEncryptionAdapter-AE75YC4W-BEYO4RUO.mjs

@@ -1 +0,0 @@
-import{a as r}from"./chunk-ZEPZ4QDD.mjs";import"./chunk-PKHRAYFD.mjs";import"./chunk-EYF3263P.mjs";export{r as KeypairEncryptionAdapter};

package/dist/KeypairEncryptionAdapter-AE75YC4W-VAOH6AAL.mjs

@@ -1,9 +0,0 @@
-import {
-  KeypairEncryptionAdapter
-} from "./chunk-QKA2DCR6.mjs";
-import "./chunk-O37NHERH.mjs";
-import "./chunk-BWLEAAFW.mjs";
-import "./chunk-UJCSKKID.mjs";
-export {
-  KeypairEncryptionAdapter
-};

package/dist/KeypairEncryptionAdapter-XUKCLRFU-6ERIZN2M.mjs

@@ -1 +0,0 @@
-import{a as r}from"./chunk-TESUOXRJ.mjs";import"./chunk-PKHRAYFD.mjs";import"./chunk-EYF3263P.mjs";export{r as KeypairEncryptionAdapter};

package/dist/MnemonicEncryptionAdapter-J6IE5OKA-6DFVUVD6.mjs

@@ -1 +0,0 @@
-import{a as o}from"./chunk-5RW7SGA7.mjs";import"./chunk-PKHRAYFD.mjs";import"./chunk-UBALMYIY.mjs";export{o as MnemonicEncryptionAdapter};

package/dist/MnemonicEncryptionAdapter-J6IE5OKA-O5AJPX42.mjs

@@ -1 +0,0 @@
-import{a as o}from"./chunk-5MZ7FPPY.mjs";import"./chunk-PKHRAYFD.mjs";import"./chunk-EYF3263P.mjs";export{o as MnemonicEncryptionAdapter};

package/dist/MnemonicEncryptionAdapter-J6IE5OKA-SI6TBLTQ.mjs

@@ -1,9 +0,0 @@
-import {
-  MnemonicEncryptionAdapter
-} from "./chunk-PLAOCKSS.mjs";
-import "./chunk-O37NHERH.mjs";
-import "./chunk-BWLEAAFW.mjs";
-import "./chunk-UJCSKKID.mjs";
-export {
-  MnemonicEncryptionAdapter
-};

package/dist/MnemonicEncryptionAdapter-J6IE5OKA-WEPFOTSJ.mjs

@@ -1,9 +0,0 @@
-import {
-  MnemonicEncryptionAdapter
-} from "./chunk-L5QD6GHB.mjs";
-import "./chunk-O37NHERH.mjs";
-import "./chunk-TSZ37JDY.mjs";
-import "./chunk-UJCSKKID.mjs";
-export {
-  MnemonicEncryptionAdapter
-};

package/dist/MnemonicEncryptionAdapter-RCHUETBP-ELAMJMMO.mjs

@@ -1 +0,0 @@
-import{a as o}from"./chunk-5P4EW2YL.mjs";import"./chunk-PKHRAYFD.mjs";import"./chunk-EYF3263P.mjs";export{o as MnemonicEncryptionAdapter};

package/dist/PasswordEncryptionAdapter-CWOXUGR4-2YZ64B4A.mjs

@@ -1 +0,0 @@
-import{a as r,b as o,c as t}from"./chunk-TMLXCRJU.mjs";import"./chunk-PKHRAYFD.mjs";import"./chunk-EYF3263P.mjs";export{r as KDF_PRESETS,o as PasswordEncryptionAdapter,t as generatePqsPassword};

package/dist/PasswordEncryptionAdapter-CWOXUGR4-DCEGC2NX.mjs

@@ -1 +0,0 @@
-import{a as r,b as o,c as t}from"./chunk-U3MS6KMF.mjs";import"./chunk-PKHRAYFD.mjs";import"./chunk-UBALMYIY.mjs";export{r as KDF_PRESETS,o as PasswordEncryptionAdapter,t as generatePqsPassword};

package/dist/PasswordEncryptionAdapter-CWOXUGR4-QEGGYPFJ.mjs

@@ -1,13 +0,0 @@
-import {
-  KDF_PRESETS,
-  PasswordEncryptionAdapter,
-  generatePqsPassword
-} from "./chunk-RPSRFFXN.mjs";
-import "./chunk-O37NHERH.mjs";
-import "./chunk-TSZ37JDY.mjs";
-import "./chunk-UJCSKKID.mjs";
-export {
-  KDF_PRESETS,
-  PasswordEncryptionAdapter,
-  generatePqsPassword
-};

package/dist/PasswordEncryptionAdapter-CWOXUGR4-ZYUBUYUI.mjs

@@ -1,13 +0,0 @@
-import {
-  KDF_PRESETS,
-  PasswordEncryptionAdapter,
-  generatePqsPassword
-} from "./chunk-BBJCQFWP.mjs";
-import "./chunk-O37NHERH.mjs";
-import "./chunk-BWLEAAFW.mjs";
-import "./chunk-UJCSKKID.mjs";
-export {
-  KDF_PRESETS,
-  PasswordEncryptionAdapter,
-  generatePqsPassword
-};

package/dist/PasswordEncryptionAdapter-ECHND672-XVBPHPPT.mjs

@@ -1 +0,0 @@
-import{a as r,b as o,c as t}from"./chunk-GUYENY5N.mjs";import"./chunk-PKHRAYFD.mjs";import"./chunk-EYF3263P.mjs";export{r as KDF_PRESETS,o as PasswordEncryptionAdapter,t as generatePqsPassword};

package/dist/chunk-4YMF57VY.mjs

@@ -1 +0,0 @@
-var _={MOCK_REF_NOT_FOUND:11001,MOCK_REF_NOT_FOUND_REMOVE:11002,MOCK_REF_NOT_FOUND_UPDATE:11003,MOCK_OWNER_SECRET_REQUIRED:11004,MOCK_OWNER_SECRET_MISMATCH:11005,GATEWAY_WRITE_FAILED:11201,GATEWAY_WRITE_HTTP_ERROR:11202,GATEWAY_UPDATE_FAILED:11203,GATEWAY_UPDATE_HTTP_ERROR:11204,GATEWAY_READ_FAILED:11205,GATEWAY_READ_HTTP_ERROR:11206,GATEWAY_READ_INVALID_JSON:11207,GATEWAY_READ_INVALID_SHAPE:11208,GATEWAY_LIST_FAILED:11209,GATEWAY_LIST_HTTP_ERROR:11210,GATEWAY_LIST_INVALID_JSON:11211,GATEWAY_LIST_NOT_ARRAY:11212,GATEWAY_REMOVE_FAILED:11213,GATEWAY_REMOVE_HTTP_ERROR:11214,CONTRACT_UNSUPPORTED_VERSION:11401,CONTRACT_CIRCUIT_RESULT_MISSING:11402,MIDNIGHT_NETWORK_REQUIRED:11501,MIDNIGHT_WALLET_PROVIDER_REQUIRED:11502,MIDNIGHT_PRIVATE_STATE_PASSWORD_REQUIRED:11503,MIDNIGHT_ZK_ARTIFACTS_PATH_EMPTY:11504,MIDNIGHT_ZK_CONFIG_BASE_URL_EMPTY:11505,MIDNIGHT_UNSUPPORTED_NETWORK:11506,MIDNIGHT_AUTH_TOKEN_REQUIRED:11507,MIDNIGHT_ZK_CONFIG_BASE_URL_REQUIRED:11508,MIDNIGHT_ZK_ARTIFACTS_PATH_REQUIRED:11509,MIDNIGHT_ZK_ARTIFACTS_PATH_NOT_FOUND:11510,MIDNIGHT_CONNECTOR_NOT_INITIALIZED:11511,MIDNIGHT_COIN_PUBLIC_KEY_MISSING:11512,MIDNIGHT_ENC_PUBLIC_KEY_MISSING:11513,MIDNIGHT_INDEXER_HTTP_NOT_SET:11514,MIDNIGHT_INDEXER_WS_NOT_SET:11515,MIDNIGHT_PROOF_SERVER_NOT_SET:11516,MIDNIGHT_NOT_INITIALIZED:11517,MIDNIGHT_INVALID_CONTRACT_ADDRESS:11518,MIDNIGHT_REF_NOT_FOUND:11519,MIDNIGHT_KEYENVELOPE_REQUIRED:11520,MIDNIGHT_OWNER_SECRET_REQUIRED_WRITE:11521,MIDNIGHT_OWNER_SECRET_REQUIRED_REMOVE:11522,MIDNIGHT_OWNER_SECRET_REQUIRED_UPDATE:11523,MIDNIGHT_WALLET_NOT_FOUND:11524,MIDNIGHT_NO_WALLETS_FOUND:11525,MIDNIGHT_WALLET_CONNECT_FAILED:11526,MIDNIGHT_NO_ADDRESSES:11527,MIDNIGHT_EXTRACT_ADDRESSES_FAILED:11528,MIDNIGHT_GET_ADDRESSES_NOT_INITIALIZED:11529,MIDNIGHT_GET_BALANCES_NOT_INITIALIZED:11530};export{_ as a};

package/dist/chunk-5MZ7FPPY.mjs

@@ -1 +0,0 @@
-import{a as c}from"./chunk-PKHRAYFD.mjs";import{a as n,f as s,q as o,r as m,s as l}from"./chunk-EYF3263P.mjs";var u=class{constructor(r){if(this.name="mnemonic",r.mnemonic!==void 0){let e=r.mnemonic.trim().split(/\s+/).length;if(e<24)throw new n(c.MNEMONIC_TOO_SHORT,`[dStorage] MnemonicEncryptionAdapter: a 24-word BIP-39 mnemonic is required (${e} word${e===1?"":"s"} provided). Shorter mnemonics provide insufficient entropy for post-quantum-safe key derivation \u2014 a 12-word mnemonic gives only 64-bit PQ security (below NIST's 128-bit minimum). Use a 24-word mnemonic or pass a 64-byte seedHex instead.`)}let t=new s(r);this.kekMaterialPromise=t.getSeed().then(e=>globalThis.crypto.subtle.importKey("raw",Uint8Array.from(e),"HKDF",!1,["deriveBits"]).then(i=>(e.fill(0),i),i=>{throw e.fill(0),i}))}async wrapDek(r){let t=await this.kekMaterialPromise,e=await o(t);try{return{algorithm:"xchacha20poly1305-v1",kekDerivation:"hkdf-sha256-v1",wrappedDek:await m(r,e)}}finally{e.fill(0)}}async unwrapDek({wrappedDek:r}){let t=await this.kekMaterialPromise,e=await o(t);try{return l(r,e)}finally{e.fill(0)}}async intoKeypairEncryptionAdapter(r,t){let{KeypairEncryptionAdapter:e}=await import("./KeypairEncryptionAdapter-AE75YC4W-BEYO4RUO.mjs"),{mlkemGenerateKeypairFromSeed:i}=await import("./dist-MEZZWKP4.mjs"),p=await this.kekMaterialPromise,y=await globalThis.crypto.subtle.deriveBits({name:"HKDF",hash:"SHA-256",salt:new Uint8Array(32),info:new TextEncoder().encode("dstorage:mlkem-seed:v1")},p,512),a=new Uint8Array(y);try{let{pk:k,sk:d}=i(a,t);return e.fromKeypair(k,d,r,t)}finally{a.fill(0)}}};export{u as a};

package/dist/chunk-5P4EW2YL.mjs

@@ -1 +0,0 @@
-import{a as c}from"./chunk-PKHRAYFD.mjs";import{a as n,f as s,q as o,r as m,s as l}from"./chunk-EYF3263P.mjs";var u=class{constructor(r){if(this.name="mnemonic",r.mnemonic!==void 0){let e=r.mnemonic.trim().split(/\s+/).length;if(e<24)throw new n(c.MNEMONIC_TOO_SHORT,`[dStorage] MnemonicEncryptionAdapter: a 24-word BIP-39 mnemonic is required (${e} word${e===1?"":"s"} provided). Shorter mnemonics provide insufficient entropy for post-quantum-safe key derivation \u2014 a 12-word mnemonic gives only 64-bit PQ security (below NIST's 128-bit minimum). Use a 24-word mnemonic or pass a 64-byte seedHex instead.`)}let t=new s(r);this.kekMaterialPromise=t.getSeed().then(e=>globalThis.crypto.subtle.importKey("raw",Uint8Array.from(e),"HKDF",!1,["deriveBits"]).then(i=>(e.fill(0),i),i=>{throw e.fill(0),i}))}async wrapDek(r){let t=await this.kekMaterialPromise,e=await o(t);try{return{algorithm:"xchacha20poly1305-v1",kekDerivation:"hkdf-sha256-v1",wrappedDek:await m(r,e)}}finally{e.fill(0)}}async unwrapDek({wrappedDek:r}){let t=await this.kekMaterialPromise,e=await o(t);try{return l(r,e)}finally{e.fill(0)}}async intoKeypairEncryptionAdapter(r,t){let{KeypairEncryptionAdapter:e}=await import("./KeypairEncryptionAdapter-XUKCLRFU-6ERIZN2M.mjs"),{mlkemGenerateKeypairFromSeed:i}=await import("./dist-MEZZWKP4.mjs"),p=await this.kekMaterialPromise,y=await globalThis.crypto.subtle.deriveBits({name:"HKDF",hash:"SHA-256",salt:new Uint8Array(32),info:new TextEncoder().encode("dstorage:mlkem-seed:v1")},p,512),a=new Uint8Array(y);try{let{pk:k,sk:d}=i(a,t);return e.fromKeypair(k,d,r,t)}finally{a.fill(0)}}};export{u as a};

package/dist/chunk-5RW7SGA7.mjs

@@ -1 +0,0 @@
-import{a as c}from"./chunk-PKHRAYFD.mjs";import{a as n,f as s,q as o,r as m,s as l}from"./chunk-UBALMYIY.mjs";var u=class{constructor(r){if(this.name="mnemonic",r.mnemonic!==void 0){let e=r.mnemonic.trim().split(/\s+/).length;if(e<24)throw new n(c.MNEMONIC_TOO_SHORT,`[dStorage] MnemonicEncryptionAdapter: a 24-word BIP-39 mnemonic is required (${e} word${e===1?"":"s"} provided). Shorter mnemonics provide insufficient entropy for post-quantum-safe key derivation \u2014 a 12-word mnemonic gives only 64-bit PQ security (below NIST's 128-bit minimum). Use a 24-word mnemonic or pass a 64-byte seedHex instead.`)}let t=new s(r);this.kekMaterialPromise=t.getSeed().then(e=>globalThis.crypto.subtle.importKey("raw",Uint8Array.from(e),"HKDF",!1,["deriveBits"]).then(i=>(e.fill(0),i),i=>{throw e.fill(0),i}))}async wrapDek(r){let t=await this.kekMaterialPromise,e=await o(t);try{return{algorithm:"xchacha20poly1305-v1",kekDerivation:"hkdf-sha256-v1",wrappedDek:await m(r,e)}}finally{e.fill(0)}}async unwrapDek({wrappedDek:r}){let t=await this.kekMaterialPromise,e=await o(t);try{return l(r,e)}finally{e.fill(0)}}async intoKeypairEncryptionAdapter(r,t){let{KeypairEncryptionAdapter:e}=await import("./KeypairEncryptionAdapter-AE75YC4W-BAVHRNNJ.mjs"),{mlkemGenerateKeypairFromSeed:i}=await import("./dist-655VYUPJ.mjs"),p=await this.kekMaterialPromise,y=await globalThis.crypto.subtle.deriveBits({name:"HKDF",hash:"SHA-256",salt:new Uint8Array(32),info:new TextEncoder().encode("dstorage:mlkem-seed:v1")},p,512),a=new Uint8Array(y);try{let{pk:k,sk:d}=i(a,t);return e.fromKeypair(k,d,r,t)}finally{a.fill(0)}}};export{u as a};

package/dist/chunk-62RSKZ6T.mjs

@@ -1,118 +0,0 @@
-import {
-  EncryptionErrorCode
-} from "./chunk-O37NHERH.mjs";
-import {
-  DStorageError,
-  mlkemGenerateKeypair,
-  mlkemUnwrapDek,
-  mlkemWrapDek
-} from "./chunk-TSZ37JDY.mjs";
-
-// ../encryption/dist/chunk-55C752ON.mjs
-var KeypairEncryptionAdapter = class _KeypairEncryptionAdapter {
-  constructor(pk, sk, context, variant) {
-    this.publicKey = pk;
-    this.secretKey = sk;
-    this.context = context;
-    this.variant = variant;
-    this.name = variant;
-  }
-  /**
-   * Upload-only adapter — holds only the Public Key.
-   * wrapDek() works normally; unwrapDek() throws (no SK available).
-   */
-  static fromPublicKey(pk, context, variant = "mlkem768") {
-    return new _KeypairEncryptionAdapter(pk, void 0, context, variant);
-  }
-  /**
-   * Full adapter — holds both Public Key and Secret Key.
-   * Both wrapDek() and unwrapDek() work.
-   */
-  static fromKeypair(pk, sk, context, variant = "mlkem768") {
-    return new _KeypairEncryptionAdapter(pk, sk, context, variant);
-  }
-  /**
-   * Generate a fresh random ML-KEM keypair.
-   *
-   * Returns the adapter (with both PK+SK) plus the raw keys so the caller
-   * can persist the secret key and share the public key separately.
-   *
-   * @param variant  Default: "mlkem768".
-   */
-  static generateKeypair(context, variant = "mlkem768") {
-    const { pk, sk } = mlkemGenerateKeypair(variant);
-    return {
-      adapter: new _KeypairEncryptionAdapter(pk, sk, context, variant),
-      publicKey: pk,
-      secretKey: sk
-    };
-  }
-  /**
-   * Deterministically derive a ML-KEM keypair from a BIP-39 mnemonic phrase or hex seed.
-   *
-   * Delegates to MnemonicEncryptionAdapter.intoKeypairEncryptionAdapter() so all
-   * mnemonic/seed handling lives in a single place.
-   *
-   * Same inputs + variant always produce the same keypair.
-   *
-   * Note: 32-byte seedHex (64 hex characters) is not supported — use a mnemonic
-   * or a 64-byte seedHex (128 hex characters) instead.
-   *
-   * @param input    { mnemonic } or { seedHex } (64-byte hex, 128 chars)
-   * @param variant  Default: "mlkem768"
-   */
-  static async fromMnemonic(input, context, variant = "mlkem768") {
-    const { MnemonicEncryptionAdapter } = await import("./MnemonicEncryptionAdapter-J6IE5OKA-WEPFOTSJ.mjs");
-    const ms = new MnemonicEncryptionAdapter(input);
-    return ms.intoKeypairEncryptionAdapter(context, variant);
-  }
-  /**
-   * Deterministically derive a ML-KEM keypair from a password and salt.
-   *
-   * Delegates to PasswordEncryptionAdapter.intoKeypairEncryptionAdapter() so all
-   * password handling (scrypt params, entropy validation, 64-byte seed derivation)
-   * lives in a single place.
-   *
-   * Same password + salt + variant always produces the same keypair.
-   *
-   * @param password  User password (validated for entropy)
-   * @param salt      Domain salt — must not be empty
-   * @param variant   Default: "mlkem768"
-   * @param params    Optional custom scrypt params
-   */
-  static async fromPassword(password, salt, context, variant = "mlkem768", params) {
-    const { PasswordEncryptionAdapter } = await import("./PasswordEncryptionAdapter-CWOXUGR4-QEGGYPFJ.mjs");
-    const ps = new PasswordEncryptionAdapter({
-      password,
-      salt,
-      ...params ? { params } : {}
-    });
-    return ps.intoKeypairEncryptionAdapter(context, variant);
-  }
-  /**
-   * Zero the Secret Key bytes and mark this adapter as read-only.
-   * Call when the adapter is no longer needed to minimise the window
-   * during which raw ML-KEM key material sits in GC-reachable memory.
-   * After destroy(), unwrapDek() will throw.
-   */
-  destroy() {
-    this.secretKey?.fill(0);
-    this.secretKey = void 0;
-  }
-  async wrapDek(dek) {
-    return mlkemWrapDek(dek, this.publicKey, this.context, this.variant);
-  }
-  async unwrapDek(data) {
-    if (!this.secretKey) {
-      throw new DStorageError(
-        EncryptionErrorCode.KEYPAIR_MISSING_SECRET_KEY,
-        `[dStorage] KeypairEncryptionAdapter(${this.variant}): cannot unwrapDek \u2014 no Secret Key is available. Use fromKeypair() or fromPassword() to create an adapter with a SK.`
-      );
-    }
-    return mlkemUnwrapDek(data, this.secretKey, this.context);
-  }
-};
-
-export {
-  KeypairEncryptionAdapter
-};

package/dist/chunk-BBJCQFWP.mjs

@@ -1,275 +0,0 @@
-import {
-  EncryptionErrorCode
-} from "./chunk-O37NHERH.mjs";
-import {
-  DStorageError,
-  deriveKek,
-  unwrapKey,
-  wrapKey
-} from "./chunk-BWLEAAFW.mjs";
-
-// ../encryption/dist/chunk-PDWRI7YP.mjs
-import { scrypt } from "@noble/hashes/scrypt.js";
-var KDF_PRESETS = {
-  v1: { N: 131072, r: 8, p: 1 },
-  "v1-lite": { N: 65536, r: 8, p: 1 }
-};
-var PasswordEncryptionAdapter = class _PasswordEncryptionAdapter {
-  constructor(config) {
-    this.name = "password";
-    validatePassword(
-      config.password,
-      config.minPasswordLength ?? 12,
-      config.minEntropyBits ?? 60,
-      config.additionalValidators
-    );
-    this.salt = resolveSalt(config.salt);
-    const resolved = resolveParams(config.preset, config.params);
-    this.N = resolved.N;
-    this.r = resolved.r;
-    this.p = resolved.p;
-    const passwordBytes = new TextEncoder().encode(config.password);
-    const seed = scrypt(passwordBytes, this.salt, {
-      N: this.N,
-      r: this.r,
-      p: this.p,
-      dkLen: 64
-    });
-    this.kekMaterialPromise = globalThis.crypto.subtle.importKey("raw", seed, "HKDF", false, ["deriveBits"]).then(
-      (key) => {
-        seed.fill(0);
-        return key;
-      },
-      (err) => {
-        seed.fill(0);
-        throw err;
-      }
-    );
-  }
-  /**
-   * Reconstruct an adapter from parameters previously stored via `getKdfParams()`.
-   * Use this when loading existing encrypted data — ensures the exact same N/r/p
-   * are used regardless of what the current SDK defaults are.
-   *
-   * @example
-   * const adapter = PasswordEncryptionAdapter.fromKdfParams({
-   *   password,
-   *   salt: meta.salt,
-   *   kdf: meta.kdf,
-   *   N: meta.N,
-   *   r: meta.r,
-   *   p: meta.p,
-   * });
-   */
-  static fromKdfParams(config) {
-    if (config.kdf !== "scrypt") {
-      throw new DStorageError(
-        EncryptionErrorCode.PASSWORD_UNSUPPORTED_KDF,
-        `[dStorage] PasswordEncryptionAdapter.fromKdfParams: unsupported kdf "${config.kdf}". Only "scrypt" is supported.`
-      );
-    }
-    return new _PasswordEncryptionAdapter({
-      password: config.password,
-      salt: config.salt,
-      params: { N: config.N, r: config.r, p: config.p },
-      ...config.minPasswordLength !== void 0 && {
-        minPasswordLength: config.minPasswordLength
-      },
-      ...config.minEntropyBits !== void 0 && {
-        minEntropyBits: config.minEntropyBits
-      },
-      ...config.additionalValidators !== void 0 && {
-        additionalValidators: config.additionalValidators
-      }
-    });
-  }
-  /**
-   * Returns the resolved KDF parameters to store alongside encrypted data.
-   *
-   * These values are language- and SDK-agnostic: any scrypt implementation
-   * can re-derive the key from `{ kdf, N, r, p }` + the original salt and
-   * password, without any knowledge of this SDK's preset names.
-   *
-   * @example
-   * const meta = {
-   *   ...adapter.getKdfParams(),  // { kdf: "scrypt", N: 131072, r: 8, p: 1 }
-   *   salt: "myapp:alice@example.com",
-   * };
-   * await db.save({ encryptedData, meta });
-   */
-  getKdfParams() {
-    return { kdf: "scrypt", N: this.N, r: this.r, p: this.p };
-  }
-  async wrapDek(dek) {
-    const kekMaterial = await this.kekMaterialPromise;
-    const kek = await deriveKek(kekMaterial);
-    try {
-      return {
-        algorithm: "xchacha20poly1305-v1",
-        kekDerivation: "hkdf-sha256-v1",
-        wrappedDek: await wrapKey(dek, kek)
-      };
-    } finally {
-      kek.fill(0);
-    }
-  }
-  async unwrapDek({ wrappedDek }) {
-    const kekMaterial = await this.kekMaterialPromise;
-    const kek = await deriveKek(kekMaterial);
-    try {
-      return unwrapKey(wrappedDek, kek);
-    } finally {
-      kek.fill(0);
-    }
-  }
-  /**
-   * Deterministically derive a ML-KEM keypair from this adapter's key material.
-   *
-   * Uses Web Crypto HKDF to derive a 64-byte ML-KEM seed from the stored
-   * CryptoKey, domain-separated from the symmetric KEK derivation path with
-   * info="dstorage:mlkem-seed:v1". This is equivalent to noble's
-   * hkdf(sha256, scryptOutput, undefined, info, 64) but avoids materialising
-   * the raw scrypt output in a JS-accessible variable.
-   *
-   * Same password + salt + variant always produces the same keypair.
-   *
-   * @param variant  ML-KEM variant. Default: "mlkem768".
-   */
-  async intoKeypairEncryptionAdapter(context, variant) {
-    const { KeypairEncryptionAdapter } = await import("./KeypairEncryptionAdapter-AE75YC4W-VAOH6AAL.mjs");
-    const { mlkemGenerateKeypairFromSeed } = await import("./dist-INTAFXQ7.mjs");
-    const kekMaterial = await this.kekMaterialPromise;
-    const mlkemBits = await globalThis.crypto.subtle.deriveBits(
-      {
-        name: "HKDF",
-        hash: "SHA-256",
-        salt: new Uint8Array(32),
-        info: new TextEncoder().encode("dstorage:mlkem-seed:v1")
-      },
-      kekMaterial,
-      512
-      // 64 bytes
-    );
-    const mlkemSeed = new Uint8Array(mlkemBits);
-    try {
-      const { pk, sk } = mlkemGenerateKeypairFromSeed(mlkemSeed, variant);
-      return KeypairEncryptionAdapter.fromKeypair(pk, sk, context, variant);
-    } finally {
-      mlkemSeed.fill(0);
-    }
-  }
-};
-function resolveSalt(salt) {
-  const bytes = typeof salt === "string" ? new TextEncoder().encode(salt) : salt;
-  if (bytes.length === 0) {
-    throw new DStorageError(
-      EncryptionErrorCode.PASSWORD_EMPTY_SALT,
-      '[dStorage] PasswordEncryptionAdapter: salt must not be empty. Provide an app-specific domain label, e.g. "myapp:v1:alice@example.com".'
-    );
-  }
-  return bytes;
-}
-function resolveParams(preset, params) {
-  if (preset !== void 0) {
-    if (!(preset in KDF_PRESETS)) {
-      throw new DStorageError(
-        EncryptionErrorCode.PASSWORD_UNKNOWN_PRESET,
-        `[dStorage] PasswordEncryptionAdapter: unknown preset "${preset}". Valid presets: ${Object.keys(KDF_PRESETS).join(", ")}.`
-      );
-    }
-    return KDF_PRESETS[preset];
-  }
-  return {
-    N: params?.N ?? KDF_PRESETS["v1"].N,
-    r: params?.r ?? KDF_PRESETS["v1"].r,
-    p: params?.p ?? KDF_PRESETS["v1"].p
-  };
-}
-function estimateEntropyBits(password) {
-  let pool = 0;
-  if (/[a-z]/.test(password)) pool += 26;
-  if (/[A-Z]/.test(password)) pool += 26;
-  if (/[0-9]/.test(password)) pool += 10;
-  if (/[^a-zA-Z0-9]/.test(password)) pool += 32;
-  return pool === 0 ? 0 : Math.log2(pool) * password.length;
-}
-function hasSequentialRun(pw, runLength = 5) {
-  for (let i = 0; i <= pw.length - runLength; i++) {
-    let ascending = true;
-    let descending = true;
-    for (let j = 1; j < runLength; j++) {
-      const diff = pw.charCodeAt(i + j) - pw.charCodeAt(i + j - 1);
-      if (diff !== 1) ascending = false;
-      if (diff !== -1) descending = false;
-      if (!ascending && !descending) break;
-    }
-    if (ascending || descending) return true;
-  }
-  return false;
-}
-var KEYBOARD_ROWS = ["qwertyuiop", "asdfghjkl", "zxcvbnm", "1234567890"];
-function hasKeyboardWalk(pw, minLen = 5) {
-  const lower = pw.toLowerCase();
-  for (const row of KEYBOARD_ROWS) {
-    for (let i = 0; i <= row.length - minLen; i++) {
-      const fwd = row.slice(i, i + minLen);
-      const rev = fwd.split("").reverse().join("");
-      if (lower.includes(fwd) || lower.includes(rev)) return true;
-    }
-  }
-  return false;
-}
-function generatePqsPassword() {
-  while (true) {
-    const bytes = globalThis.crypto.getRandomValues(new Uint8Array(32));
-    const b64 = btoa(Array.from(bytes, (b) => String.fromCharCode(b)).join(""));
-    const password = b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-    if (new Set(password).size >= 3 && !hasSequentialRun(password) && !hasKeyboardWalk(password)) {
-      return password;
-    }
-  }
-}
-function validatePassword(password, minLength, minEntropyBits, additionalValidators) {
-  if (password.length < minLength) {
-    throw new DStorageError(
-      EncryptionErrorCode.PASSWORD_TOO_SHORT,
-      `[dStorage] Password too short: ${password.length} character(s) (minimum ${minLength}). Use a longer passphrase.`
-    );
-  }
-  if (new Set(password).size < 3) {
-    throw new DStorageError(
-      EncryptionErrorCode.PASSWORD_TOO_FEW_DISTINCT,
-      "[dStorage] Password is too weak: too few distinct characters."
-    );
-  }
-  if (hasSequentialRun(password)) {
-    throw new DStorageError(
-      EncryptionErrorCode.PASSWORD_SEQUENTIAL_RUN,
-      "[dStorage] Password is too weak: contains a sequential character run (e.g. abcde, 12345)."
-    );
-  }
-  if (hasKeyboardWalk(password)) {
-    throw new DStorageError(
-      EncryptionErrorCode.PASSWORD_KEYBOARD_WALK,
-      "[dStorage] Password is too weak: contains a keyboard-row pattern (e.g. qwerty, asdfg)."
-    );
-  }
-  const entropy = estimateEntropyBits(password);
-  if (entropy < minEntropyBits) {
-    throw new DStorageError(
-      EncryptionErrorCode.PASSWORD_ENTROPY_TOO_LOW,
-      `[dStorage] Password entropy too low: ~${Math.round(entropy)} bits (minimum ${minEntropyBits} bits). Use a longer password with a mix of uppercase, lowercase, digits, and symbols.`
-    );
-  }
-  if (additionalValidators) {
-    for (const validate of additionalValidators) {
-      validate(password);
-    }
-  }
-}
-
-export {
-  KDF_PRESETS,
-  PasswordEncryptionAdapter,
-  generatePqsPassword
-};