@dstorage-tech/dstorage-sdk 0.0.5 → 0.0.8

package/dist/{chunk-HDD6SUU4.mjs → chunk-42O7KEL4.mjs}

@@ -1,14 +1,14 @@
 import {
   EncryptionErrorCode
-} from "./chunk-O37NHERH.mjs";
+} from "./chunk-L6WCT64V.mjs";
 import {
   DStorageError,
   deriveKek,
   unwrapKey,
   wrapKey
-} from "./chunk-BWLEAAFW.mjs";
+} from "./chunk-PCXBQRCO.mjs";
 
-// ../encryption/dist/chunk-6IHXTW2Y.mjs
+// ../encryption/dist/chunk-ENX7VXEV.mjs
 import { scrypt } from "@noble/hashes/scrypt.js";
 var KDF_PRESETS = {
   v1: { N: 131072, r: 8, p: 1 },
@@ -137,8 +137,8 @@ var PasswordEncryptionAdapter = class _PasswordEncryptionAdapter {
    * @param variant  ML-KEM variant. Default: "mlkem768".
    */
   async intoKeypairEncryptionAdapter(context, variant) {
-    const { KeypairEncryptionAdapter } = await import("./KeypairEncryptionAdapter-XUKCLRFU-ERPYK5S4.mjs");
-    const { mlkemGenerateKeypairFromSeed } = await import("./dist-MOLWJ4Y7.mjs");
+    const { KeypairEncryptionAdapter } = await import("./KeypairEncryptionAdapter-EOBRCIGP-5PFPNLLA.mjs");
+    const { mlkemGenerateKeypairFromSeed } = await import("./dist-J4JUJ2J5.mjs");
     const kekMaterial = await this.kekMaterialPromise;
     const mlkemBits = await globalThis.crypto.subtle.deriveBits(
       {
@@ -170,7 +170,23 @@ function resolveSalt(salt) {
   }
   return bytes;
 }
+var MIN_SCRYPT_N = 32768;
+function assertScryptCost(N) {
+  if (!Number.isInteger(N) || N < 2 || (N & N - 1) !== 0) {
+    throw new DStorageError(
+      EncryptionErrorCode.PASSWORD_SCRYPT_N_NOT_POWER_OF_TWO,
+      `[dStorage] PasswordEncryptionAdapter: scrypt N must be a power of two >= 2 (got ${N}).`
+    );
+  }
+  if (N < MIN_SCRYPT_N) {
+    throw new DStorageError(
+      EncryptionErrorCode.PASSWORD_SCRYPT_N_TOO_LOW,
+      `[dStorage] PasswordEncryptionAdapter: scrypt N=${N} is below the minimum cost floor of ${MIN_SCRYPT_N} (OWASP 2024 minimum, 32 MB memory-hard). A lower N makes the KDF cheap enough to brute-force offline. Use a preset ("v1" or "v1-lite") or a custom N >= 32768.`
+    );
+  }
+}
 function resolveParams(preset, params) {
+  let resolved;
   if (preset !== void 0) {
     if (!(preset in KDF_PRESETS)) {
       throw new DStorageError(
@@ -178,13 +194,16 @@ function resolveParams(preset, params) {
         `[dStorage] PasswordEncryptionAdapter: unknown preset "${preset}". Valid presets: ${Object.keys(KDF_PRESETS).join(", ")}.`
       );
     }
-    return KDF_PRESETS[preset];
+    resolved = KDF_PRESETS[preset];
+  } else {
+    resolved = {
+      N: params?.N ?? KDF_PRESETS["v1"].N,
+      r: params?.r ?? KDF_PRESETS["v1"].r,
+      p: params?.p ?? KDF_PRESETS["v1"].p
+    };
   }
-  return {
-    N: params?.N ?? KDF_PRESETS["v1"].N,
-    r: params?.r ?? KDF_PRESETS["v1"].r,
-    p: params?.p ?? KDF_PRESETS["v1"].p
-  };
+  assertScryptCost(resolved.N);
+  return resolved;
 }
 function estimateEntropyBits(password) {
   let pool = 0;

package/dist/{chunk-X4LEBNK6.mjs → chunk-5F3HZ2RJ.mjs}

@@ -1,14 +1,14 @@
 import {
   EncryptionErrorCode
-} from "./chunk-O37NHERH.mjs";
+} from "./chunk-L6WCT64V.mjs";
 import {
   DStorageError,
   deriveKek,
   unwrapKey,
   wrapKey
-} from "./chunk-BWLEAAFW.mjs";
+} from "./chunk-PCXBQRCO.mjs";
 
-// ../encryption/dist/chunk-6IHXTW2Y.mjs
+// ../encryption/dist/chunk-ENX7VXEV.mjs
 import { scrypt } from "@noble/hashes/scrypt.js";
 var KDF_PRESETS = {
   v1: { N: 131072, r: 8, p: 1 },
@@ -137,8 +137,8 @@ var PasswordEncryptionAdapter = class _PasswordEncryptionAdapter {
    * @param variant  ML-KEM variant. Default: "mlkem768".
    */
   async intoKeypairEncryptionAdapter(context, variant) {
-    const { KeypairEncryptionAdapter } = await import("./KeypairEncryptionAdapter-XUKCLRFU-AYDAZ2TZ.mjs");
-    const { mlkemGenerateKeypairFromSeed } = await import("./dist-INTAFXQ7.mjs");
+    const { KeypairEncryptionAdapter } = await import("./KeypairEncryptionAdapter-EOBRCIGP-FLPJIL26.mjs");
+    const { mlkemGenerateKeypairFromSeed } = await import("./dist-AGNOIJI4.mjs");
     const kekMaterial = await this.kekMaterialPromise;
     const mlkemBits = await globalThis.crypto.subtle.deriveBits(
       {
@@ -170,7 +170,23 @@ function resolveSalt(salt) {
   }
   return bytes;
 }
+var MIN_SCRYPT_N = 32768;
+function assertScryptCost(N) {
+  if (!Number.isInteger(N) || N < 2 || (N & N - 1) !== 0) {
+    throw new DStorageError(
+      EncryptionErrorCode.PASSWORD_SCRYPT_N_NOT_POWER_OF_TWO,
+      `[dStorage] PasswordEncryptionAdapter: scrypt N must be a power of two >= 2 (got ${N}).`
+    );
+  }
+  if (N < MIN_SCRYPT_N) {
+    throw new DStorageError(
+      EncryptionErrorCode.PASSWORD_SCRYPT_N_TOO_LOW,
+      `[dStorage] PasswordEncryptionAdapter: scrypt N=${N} is below the minimum cost floor of ${MIN_SCRYPT_N} (OWASP 2024 minimum, 32 MB memory-hard). A lower N makes the KDF cheap enough to brute-force offline. Use a preset ("v1" or "v1-lite") or a custom N >= 32768.`
+    );
+  }
+}
 function resolveParams(preset, params) {
+  let resolved;
   if (preset !== void 0) {
     if (!(preset in KDF_PRESETS)) {
       throw new DStorageError(
@@ -178,13 +194,16 @@ function resolveParams(preset, params) {
         `[dStorage] PasswordEncryptionAdapter: unknown preset "${preset}". Valid presets: ${Object.keys(KDF_PRESETS).join(", ")}.`
       );
     }
-    return KDF_PRESETS[preset];
+    resolved = KDF_PRESETS[preset];
+  } else {
+    resolved = {
+      N: params?.N ?? KDF_PRESETS["v1"].N,
+      r: params?.r ?? KDF_PRESETS["v1"].r,
+      p: params?.p ?? KDF_PRESETS["v1"].p
+    };
   }
-  return {
-    N: params?.N ?? KDF_PRESETS["v1"].N,
-    r: params?.r ?? KDF_PRESETS["v1"].r,
-    p: params?.p ?? KDF_PRESETS["v1"].p
-  };
+  assertScryptCost(resolved.N);
+  return resolved;
 }
 function estimateEntropyBits(password) {
   let pool = 0;

package/dist/{chunk-6IAQVMSM.mjs → chunk-E73HFT6J.mjs}

@@ -1,15 +1,15 @@
 import {
   EncryptionErrorCode
-} from "./chunk-O37NHERH.mjs";
+} from "./chunk-L6WCT64V.mjs";
 import {
   DStorageError,
   KeyDeriver,
   deriveKek,
   unwrapKey,
   wrapKey
-} from "./chunk-BWLEAAFW.mjs";
+} from "./chunk-PCXBQRCO.mjs";
 
-// ../encryption/dist/chunk-SW62VRE3.mjs
+// ../encryption/dist/chunk-SOX5GKK4.mjs
 var MnemonicEncryptionAdapter = class {
   constructor(input) {
     this.name = "mnemonic";
@@ -73,8 +73,8 @@ var MnemonicEncryptionAdapter = class {
    * @param variant  ML-KEM variant. Default: "mlkem768".
    */
   async intoKeypairEncryptionAdapter(context, variant) {
-    const { KeypairEncryptionAdapter } = await import("./KeypairEncryptionAdapter-XUKCLRFU-AYDAZ2TZ.mjs");
-    const { mlkemGenerateKeypairFromSeed } = await import("./dist-INTAFXQ7.mjs");
+    const { KeypairEncryptionAdapter } = await import("./KeypairEncryptionAdapter-EOBRCIGP-5PFPNLLA.mjs");
+    const { mlkemGenerateKeypairFromSeed } = await import("./dist-J4JUJ2J5.mjs");
     const kekMaterial = await this.kekMaterialPromise;
     const mlkemBits = await globalThis.crypto.subtle.deriveBits(
       {

package/dist/{chunk-UDYXMII2.mjs → chunk-EOPUNIUH.mjs}

@@ -1,14 +1,14 @@
 import {
   EncryptionErrorCode
-} from "./chunk-O37NHERH.mjs";
+} from "./chunk-L6WCT64V.mjs";
 import {
   DStorageError,
   mlkemGenerateKeypair,
   mlkemUnwrapDek,
   mlkemWrapDek
-} from "./chunk-BWLEAAFW.mjs";
+} from "./chunk-PCXBQRCO.mjs";
 
-// ../encryption/dist/chunk-NAJYQ4J6.mjs
+// ../encryption/dist/chunk-A7BIR2QB.mjs
 var KeypairEncryptionAdapter = class _KeypairEncryptionAdapter {
   constructor(pk, sk, context, variant) {
     this.publicKey = pk;
@@ -64,7 +64,7 @@ var KeypairEncryptionAdapter = class _KeypairEncryptionAdapter {
    * @param variant  Default: "mlkem768"
    */
   static async fromMnemonic(input, context, variant = "mlkem768") {
-    const { MnemonicEncryptionAdapter } = await import("./MnemonicEncryptionAdapter-RCHUETBP-M7NHGSHO.mjs");
+    const { MnemonicEncryptionAdapter } = await import("./MnemonicEncryptionAdapter-S56YG63Q-B3F3TO3T.mjs");
     const ms = new MnemonicEncryptionAdapter(input);
     return ms.intoKeypairEncryptionAdapter(context, variant);
   }
@@ -84,7 +84,7 @@ var KeypairEncryptionAdapter = class _KeypairEncryptionAdapter {
    * @param params    Optional custom scrypt params
    */
   static async fromPassword(password, salt, context, variant = "mlkem768", params) {
-    const { PasswordEncryptionAdapter } = await import("./PasswordEncryptionAdapter-ECHND672-3DEFO6FP.mjs");
+    const { PasswordEncryptionAdapter } = await import("./PasswordEncryptionAdapter-B2UG7MWB-QCSOIQJA.mjs");
     const ps = new PasswordEncryptionAdapter({
       password,
       salt,

package/dist/{chunk-O37NHERH.mjs → chunk-L6WCT64V.mjs}

@@ -1,4 +1,4 @@
-// ../encryption/dist/chunk-WBLC4ONG.mjs
+// ../encryption/dist/chunk-AGSZ3S6J.mjs
 var EncryptionErrorCode = {
   KEYPAIR_MISSING_SECRET_KEY: 13001,
   MNEMONIC_TOO_SHORT: 13002,
@@ -9,7 +9,9 @@ var EncryptionErrorCode = {
   PASSWORD_TOO_FEW_DISTINCT: 13007,
   PASSWORD_SEQUENTIAL_RUN: 13008,
   PASSWORD_KEYBOARD_WALK: 13009,
-  PASSWORD_ENTROPY_TOO_LOW: 13010
+  PASSWORD_ENTROPY_TOO_LOW: 13010,
+  PASSWORD_SCRYPT_N_TOO_LOW: 13011,
+  PASSWORD_SCRYPT_N_NOT_POWER_OF_TWO: 13012
 };
 
 export {

package/dist/{chunk-4X5K43JF.mjs → chunk-M3F2LR3B.mjs}

@@ -1,4 +1,4 @@
-// ../chain/dist/chunk-3H6IQUYK.mjs
+// ../chain/dist/chunk-XMWGGIPS.mjs
 var ChainErrorCode = {
   // mock.ts — 11001-11009
   MOCK_REF_NOT_FOUND: 11001,
@@ -21,6 +21,8 @@ var ChainErrorCode = {
   GATEWAY_LIST_NOT_ARRAY: 11212,
   GATEWAY_REMOVE_FAILED: 11213,
   GATEWAY_REMOVE_HTTP_ERROR: 11214,
+  GATEWAY_READ_RESPONSE_TOO_LARGE: 11215,
+  GATEWAY_LIST_RESPONSE_TOO_LARGE: 11216,
   // contract-api.ts — 11401-11409
   CONTRACT_UNSUPPORTED_VERSION: 11401,
   CONTRACT_CIRCUIT_RESULT_MISSING: 11402,

package/dist/{chunk-JMPRZK5D.mjs → chunk-O6COTUD4.mjs}

@@ -1,4 +1,4 @@
-// ../chain/dist/chunk-AGLD4HA4.mjs
+// ../chain/dist/chunk-GNG6TMQC.mjs
 var ChainErrorCode = {
   // mock.ts — 11001-11009
   MOCK_REF_NOT_FOUND: 11001,
@@ -21,6 +21,8 @@ var ChainErrorCode = {
   GATEWAY_LIST_NOT_ARRAY: 11212,
   GATEWAY_REMOVE_FAILED: 11213,
   GATEWAY_REMOVE_HTTP_ERROR: 11214,
+  GATEWAY_READ_RESPONSE_TOO_LARGE: 11215,
+  GATEWAY_LIST_RESPONSE_TOO_LARGE: 11216,
   // contract-api.ts — 11401-11409
   CONTRACT_UNSUPPORTED_VERSION: 11401,
   CONTRACT_CIRCUIT_RESULT_MISSING: 11402,