@dstorage-tech/dstorage-sdk 0.0.4

package/dist/chunk-UDYXMII2.mjs

@@ -0,0 +1,121 @@
+import {
+  EncryptionErrorCode
+} from "./chunk-O37NHERH.mjs";
+import {
+  DStorageError,
+  mlkemGenerateKeypair,
+  mlkemUnwrapDek,
+  mlkemWrapDek
+} from "./chunk-BWLEAAFW.mjs";
+
+// ../encryption/dist/chunk-NAJYQ4J6.mjs
+var KeypairEncryptionAdapter = class _KeypairEncryptionAdapter {
+  constructor(pk, sk, context, variant) {
+    this.publicKey = pk;
+    this.secretKey = sk;
+    this.context = context;
+    this.variant = variant;
+    this.name = variant;
+  }
+  /**
+   * Upload-only adapter — holds only the Public Key.
+   * wrapDek() works normally; unwrapDek() throws (no SK available).
+   */
+  static fromPublicKey(pk, context, variant = "mlkem768") {
+    return new _KeypairEncryptionAdapter(pk, void 0, context, variant);
+  }
+  /**
+   * Full adapter — holds both Public Key and Secret Key.
+   * Both wrapDek() and unwrapDek() work.
+   */
+  static fromKeypair(pk, sk, context, variant = "mlkem768") {
+    return new _KeypairEncryptionAdapter(pk, sk, context, variant);
+  }
+  /**
+   * Generate a fresh random ML-KEM keypair.
+   *
+   * Returns the adapter (with both PK+SK) plus the raw keys so the caller
+   * can persist the secret key and share the public key separately.
+   *
+   * @param context  Domain-separation string bound into the KEK derivation
+   * @param variant  Default: "mlkem768".
+   */
+  static generateKeypair(context, variant = "mlkem768") {
+    const { pk, sk } = mlkemGenerateKeypair(variant);
+    return {
+      adapter: new _KeypairEncryptionAdapter(pk, sk, context, variant),
+      publicKey: pk,
+      secretKey: sk
+    };
+  }
+  /**
+   * Deterministically derive a ML-KEM keypair from a BIP-39 mnemonic phrase or hex seed.
+   *
+   * Delegates to MnemonicEncryptionAdapter.intoKeypairEncryptionAdapter() so all
+   * mnemonic/seed handling lives in a single place.
+   *
+   * Same inputs + variant always produce the same keypair.
+   *
+   * `seedHex` may be either 32 bytes (64 hex chars) or 64 bytes (128 hex chars) —
+   * both are expanded to the 64-byte ML-KEM seed via HKDF.
+   *
+   * @param input    { mnemonic } (24-word BIP-39) or { seedHex } (32- or 64-byte hex)
+   * @param context  Domain-separation string bound into the KEK derivation
+   * @param variant  Default: "mlkem768"
+   */
+  static async fromMnemonic(input, context, variant = "mlkem768") {
+    const { MnemonicEncryptionAdapter } = await import("./MnemonicEncryptionAdapter-RCHUETBP-M7NHGSHO.mjs");
+    const ms = new MnemonicEncryptionAdapter(input);
+    return ms.intoKeypairEncryptionAdapter(context, variant);
+  }
+  /**
+   * Deterministically derive a ML-KEM keypair from a password and salt.
+   *
+   * Delegates to PasswordEncryptionAdapter.intoKeypairEncryptionAdapter() so all
+   * password handling (scrypt params, entropy validation, 64-byte seed derivation)
+   * lives in a single place.
+   *
+   * Same password + salt + variant always produces the same keypair.
+   *
+   * @param password  User password (validated for entropy)
+   * @param salt      Domain salt — must not be empty
+   * @param context   Domain-separation string bound into the KEK derivation
+   * @param variant   Default: "mlkem768"
+   * @param params    Optional custom scrypt params
+   */
+  static async fromPassword(password, salt, context, variant = "mlkem768", params) {
+    const { PasswordEncryptionAdapter } = await import("./PasswordEncryptionAdapter-ECHND672-3DEFO6FP.mjs");
+    const ps = new PasswordEncryptionAdapter({
+      password,
+      salt,
+      ...params ? { params } : {}
+    });
+    return ps.intoKeypairEncryptionAdapter(context, variant);
+  }
+  /**
+   * Zero the Secret Key bytes and mark this adapter as read-only.
+   * Call when the adapter is no longer needed to minimise the window
+   * during which raw ML-KEM key material sits in GC-reachable memory.
+   * After destroy(), unwrapDek() will throw.
+   */
+  destroy() {
+    this.secretKey?.fill(0);
+    this.secretKey = void 0;
+  }
+  async wrapDek(dek) {
+    return mlkemWrapDek(dek, this.publicKey, this.context, this.variant);
+  }
+  async unwrapDek(data) {
+    if (!this.secretKey) {
+      throw new DStorageError(
+        EncryptionErrorCode.KEYPAIR_MISSING_SECRET_KEY,
+        `[dStorage] KeypairEncryptionAdapter(${this.variant}): cannot unwrapDek \u2014 no Secret Key is available. Use fromKeypair() or fromPassword() to create an adapter with a SK.`
+      );
+    }
+    return mlkemUnwrapDek(data, this.secretKey, this.context);
+  }
+};
+
+export {
+  KeypairEncryptionAdapter
+};

package/dist/chunk-UJCSKKID.mjs

@@ -0,0 +1,30 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+export {
+  __commonJS,
+  __toESM
+};

package/dist/chunk-UOOF4V2Y.mjs

@@ -0,0 +1 @@
+import{a as m}from"./chunk-PKHRAYFD.mjs";import{A as c,B as p,a as o,y as s}from"./chunk-UBALMYIY.mjs";var h=class n{constructor(e,t,r,i){this.publicKey=e,this.secretKey=t,this.context=r,this.variant=i,this.name=i}static fromPublicKey(e,t,r="mlkem768"){return new n(e,void 0,t,r)}static fromKeypair(e,t,r,i="mlkem768"){return new n(e,t,r,i)}static generateKeypair(e,t="mlkem768"){let{pk:r,sk:i}=s(t);return{adapter:new n(r,i,e,t),publicKey:r,secretKey:i}}static async fromMnemonic(e,t,r="mlkem768"){let{MnemonicEncryptionAdapter:i}=await import("./MnemonicEncryptionAdapter-J6IE5OKA-6DFVUVD6.mjs");return new i(e).intoKeypairEncryptionAdapter(t,r)}static async fromPassword(e,t,r,i="mlkem768",a){let{PasswordEncryptionAdapter:y}=await import("./PasswordEncryptionAdapter-CWOXUGR4-DCEGC2NX.mjs");return new y({password:e,salt:t,...a?{params:a}:{}}).intoKeypairEncryptionAdapter(r,i)}destroy(){this.secretKey?.fill(0),this.secretKey=void 0}async wrapDek(e){return c(e,this.publicKey,this.context,this.variant)}async unwrapDek(e){if(!this.secretKey)throw new o(m.KEYPAIR_MISSING_SECRET_KEY,`[dStorage] KeypairEncryptionAdapter(${this.variant}): cannot unwrapDek \u2014 no Secret Key is available. Use fromKeypair() or fromPassword() to create an adapter with a SK.`);return p(e,this.secretKey,this.context)}};export{h as a};