@dstorage-tech/dstorage-sdk 0.0.6 → 0.0.8

package/dist/browser.mjs

@@ -1,20 +1,20 @@
 import {
   ChainErrorCode
-} from "./chunk-4X5K43JF.mjs";
+} from "./chunk-O6COTUD4.mjs";
 import {
   MnemonicEncryptionAdapter
-} from "./chunk-OLGVVM5Y.mjs";
+} from "./chunk-E73HFT6J.mjs";
 import {
   KDF_PRESETS,
   PasswordEncryptionAdapter,
   generatePqsPassword
-} from "./chunk-HDD6SUU4.mjs";
+} from "./chunk-42O7KEL4.mjs";
 import {
   KeypairEncryptionAdapter
-} from "./chunk-Z6DUAI5B.mjs";
+} from "./chunk-XW4RZG2X.mjs";
 import {
   EncryptionErrorCode
-} from "./chunk-O37NHERH.mjs";
+} from "./chunk-L6WCT64V.mjs";
 import {
   CryptoErrorCode,
   DStorageError,
@@ -42,11 +42,12 @@ import {
   mlkemUnwrapDek,
   mlkemWrapDek,
   parseKeyEnvelope,
+  readResponseTextWithLimit,
   serializeKeyEnvelope,
   serializeXChaChaPayload,
   unwrapKey,
   wrapKey
-} from "./chunk-BWLEAAFW.mjs";
+} from "./chunk-PCXBQRCO.mjs";
 import "./chunk-5QOKJEH3.mjs";
 
 // src/types.ts
@@ -93,6 +94,7 @@ var CoreErrorCode = {
   STORAGE_ADAPTER_MISMATCH: 10052,
   RETRIEVE_BY_REF_ID_ENVELOPE_EMPTY: 10053,
   CONTENT_HASH_MISMATCH: 10054,
+  METADATA_PARSE_FAILED: 10055,
   // listReferences — 10060-10069
   LIST_REFS_REQUIRES_CHAIN: 10060,
   LIST_REFS_NOT_SUPPORTED: 10061,
@@ -106,6 +108,7 @@ var CoreErrorCode = {
   DECRYPT_CHUNK_FAILED: 10093,
   CHUNK_OVERFLOWS_TOTAL_SIZE: 10094,
   REASSEMBLY_SIZE_MISMATCH: 10095,
+  MANIFEST_PARSE_FAILED: 10096,
   // init state — 10100-10109
   NOT_INITIALIZED: 10100,
   // generic catch-all — 10999
@@ -128,7 +131,7 @@ function isStorePartialError(err) {
 // package.json
 var package_default = {
   name: "@dstorage-tech/dstorage-sdk",
-  version: "0.0.6",
+  version: "0.0.8",
   description: "Privacy-first decentralized storage SDK with pluggable adapters",
   license: "MIT",
   homepage: "https://dstorage.pro",
@@ -204,10 +207,11 @@ var package_default = {
     "@midnight-ntwrk/midnight-js-protocol": "4.1.1",
     "@midnight-ntwrk/midnight-js-types": "4.1.1",
     "@midnight-ntwrk/midnight-js-utils": "4.1.1",
-    "@midnight-ntwrk/wallet-sdk": "1.1.0",
+    "@midnight-ntwrk/wallet-sdk": "1.2.0",
     "@noble/ciphers": "^2.2.0",
     "@noble/hashes": "^1.5.0",
     "@noble/post-quantum": "^0.6.1",
+    "@scure/bip39": "^2.0.1",
     arweave: "^1.15.7"
   },
   devDependencies: {
@@ -282,6 +286,9 @@ var DStorage = class {
   }
   /** Tear down active state and clear all in-memory key material. */
   destroy() {
+    for (const provider of this._encryptionProviders) {
+      provider.destroy?.();
+    }
     this.wallet = null;
     this._encryptionProviders = [];
     this._initialized = false;
@@ -381,20 +388,24 @@ var DStorage = class {
             );
           }
           const ownerSeed = generateDek();
-          const ownerSeedWrappers = await Promise.all(
-            this._encryptionProviders.map(async (provider) => ({
-              wrapKeyName: provider.name,
-              ...await provider.wrapDek(ownerSeed)
-            }))
-          );
-          keyEnvelope = serializeKeyEnvelope(
-            buildKeyEnvelope(ownerSeedWrappers)
-          );
-          ownerSecret = await deriveOwnerSecret(
-            ownerSeed,
-            new TextEncoder().encode(storageResult.id),
-            "dstorage:owner-secret:public:v1"
-          );
+          try {
+            const ownerSeedWrappers = await Promise.all(
+              this._encryptionProviders.map(async (provider) => ({
+                wrapKeyName: provider.name,
+                ...await provider.wrapDek(ownerSeed)
+              }))
+            );
+            keyEnvelope = serializeKeyEnvelope(
+              buildKeyEnvelope(ownerSeedWrappers)
+            );
+            ownerSecret = await deriveOwnerSecret(
+              ownerSeed,
+              new TextEncoder().encode(storageResult.id),
+              "dstorage:owner-secret:public:v1"
+            );
+          } finally {
+            ownerSeed.fill(0);
+          }
         }
         onChainStorageId = storageResult.id;
       } else {
@@ -467,6 +478,8 @@ var DStorage = class {
           };
         } catch {
           throw new StorePartialError(storeRecovery);
+        } finally {
+          dek?.fill(0);
         }
       }
       this.logger?.log(
@@ -827,7 +840,10 @@ var DStorage = class {
   async retrieveByStorageId(storageId, dekScheme, contentHash) {
     try {
       this.assertConnected();
-      const { bytes: rawBytes, tags } = await this.config.storageAdapter.retrieve(storageId);
+      const { bytes: rawBytes, tags } = await this.config.storageAdapter.retrieve(
+        storageId,
+        contentHash !== void 0 ? { expectedContentHash: contentHash } : void 0
+      );
       if (contentHash) {
         const computed = await computeBlake3Hex(rawBytes);
         if (computed !== contentHash) {
@@ -968,9 +984,16 @@ var DStorage = class {
       } catch {
       }
       if (manifestBytes !== null) {
-        const parsed = JSON.parse(
-          new TextDecoder().decode(manifestBytes)
-        );
+        let parsed;
+        try {
+          parsed = JSON.parse(new TextDecoder().decode(manifestBytes));
+        } catch (err) {
+          throw new DStorageError(
+            CoreErrorCode.MANIFEST_PARSE_FAILED,
+            `[dStorage] Payload authenticated as manifest but is not valid JSON: ${err}`,
+            { cause: err }
+          );
+        }
         if (!isManifest(parsed)) {
           throw new DStorageError(
             CoreErrorCode.MANIFEST_INVALID_STRUCTURE,
@@ -1094,7 +1117,15 @@ var DStorage = class {
           base64urlToBytes(ref.encryptedMetadata),
           METADATA_AAD
         );
-        metadata = JSON.parse(new TextDecoder().decode(raw));
+        try {
+          metadata = JSON.parse(new TextDecoder().decode(raw));
+        } catch (err) {
+          throw new DStorageError(
+            CoreErrorCode.METADATA_PARSE_FAILED,
+            `[dStorage] Decrypted metadata is not valid JSON: ${err}`,
+            { cause: err }
+          );
+        }
       }
       return { bytes: contentBytes, tags: contentTags, metadata };
     } catch (err) {
@@ -1439,12 +1470,17 @@ var DStorage = class {
         };
       } catch {
         throw new StorePartialError(storeRecovery);
+      } finally {
+        chunkDek?.fill(0);
+        ownerSeed?.fill(0);
       }
     }
     this.logger?.log(
       "dStorage",
       `Chunked upload complete (storage-only) \u2192 ${totalChunks} chunks + manifest, storageId: ${manifestResult.id}`
     );
+    chunkDek?.fill(0);
+    ownerSeed?.fill(0);
     return {
       storageId: manifestResult.id,
       storageProvider: manifestResult.provider,
@@ -2238,7 +2274,8 @@ var StorageErrorCode = {
   ARWEAVE_BUNDLER_INVALID_AUTH_TOKEN_FORMAT: 15411,
   ARWEAVE_BUNDLER_INVALID_AUTH_TOKEN_KEY: 15412,
   ARWEAVE_BUNDLER_NO_TX_ID_RETURNED: 15413,
-  ARWEAVE_BUNDLER_UPLOAD_FAILED: 15414
+  ARWEAVE_BUNDLER_UPLOAD_FAILED: 15414,
+  ARWEAVE_BUNDLER_METADATA_TOO_LARGE: 15415
 };
 var memoryStore = /* @__PURE__ */ new Map();
 function bytesToBase64url2(bytes) {
@@ -2515,7 +2552,7 @@ var ArweaveStorageAdapter = class {
     };
   }
   // ── retrieve ───────────────────────────────────────────────────────────────────
-  async retrieve(id) {
+  async retrieve(id, options) {
     if (!/^[A-Za-z0-9_-]{43}$/.test(id)) {
       throw new DStorageError(
         StorageErrorCode.ARWEAVE_INVALID_TX_ID,
@@ -2579,14 +2616,15 @@ Check status at: https://viewblock.io/arweave/tx/${id}`
       );
     }
     if (!this.skipIntegrityCheck) {
-      if (!storedHash) {
+      const anchorHash = options?.expectedContentHash;
+      if (!anchorHash && !storedHash) {
         throw new DStorageError(
           StorageErrorCode.ARWEAVE_HASH_TAG_MISSING,
-          `[dStorage/arweave] ${CONTENT_HASH_TAG2} tag not found for txId: ${id}.
+          `[dStorage/arweave] Cannot verify content integrity for txId: ${id} \u2014 no expectedContentHash anchor was provided and the ${CONTENT_HASH_TAG2} tag was not found.
 Set skipIntegrityCheck: true to bypass integrity checking for fully trusted gateways.`
         );
       }
-      await assertContentHash(id, bytes, storedHash, "arweave");
+      await assertContentHash(id, bytes, anchorHash ?? storedHash, "arweave");
     }
     this.logger?.log("dStorage/arweave", `Retrieved txId: ${id}`);
     return { bytes, tags };
@@ -2710,14 +2748,19 @@ async function getTurboFactory() {
   return TurboFactory;
 }
 var ARWEAVE_GATEWAY_URL = "https://turbo-gateway.com";
+var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
+var DEFAULT_MAX_METADATA_RESPONSE_BYTES = 1024 * 1024;
+var DEFAULT_MAX_RETRIEVE_SIZE_BYTES = 256 * 1024 * 1024;
 var ArweaveBundlerStorageAdapter = class _ArweaveBundlerStorageAdapter {
   constructor(config = {}) {
     this.name = "arweave_bundler";
     this.providerName = "Arweave (Bundler)";
     this.signingServerUrl = config.signingServerUrl ? config.signingServerUrl.replace(/\/$/, "") : null;
     this.gateway = config.gateway ?? ARWEAVE_GATEWAY_URL;
-    this.maxRetrieveSizeBytes = config.maxRetrieveSizeBytes ?? 256 * 1024 * 1024;
+    this.maxRetrieveSizeBytes = config.maxRetrieveSizeBytes ?? DEFAULT_MAX_RETRIEVE_SIZE_BYTES;
     this.skipIntegrityCheck = config.skipIntegrityCheck ?? false;
+    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+    this.maxMetadataResponseBytes = config.maxMetadataResponseBytes ?? DEFAULT_MAX_METADATA_RESPONSE_BYTES;
     this.logger = config.logger;
     if (config.signingServerUrl) {
       if (!config.authToken?.trim()) {
@@ -2768,8 +2811,13 @@ var ArweaveBundlerStorageAdapter = class _ArweaveBundlerStorageAdapter {
     );
     return { id: txId, provider: this.name, url, uploadedAt: Date.now() };
   }
+  /** Adds an AbortSignal.timeout() to a fetch init object (when requestTimeoutMs > 0). */
+  _withTimeout(init = {}) {
+    const signal = this.requestTimeoutMs > 0 ? AbortSignal.timeout(this.requestTimeoutMs) : void 0;
+    return { ...init, ...signal !== void 0 ? { signal } : {} };
+  }
   // ── retrieve ───────────────────────────────────────────────────────────────────
-  async retrieve(id) {
+  async retrieve(id, options) {
     if (!/^[A-Za-z0-9_-]{43}$/.test(id)) {
       throw new DStorageError(
         StorageErrorCode.ARWEAVE_BUNDLER_INVALID_TX_ID,
@@ -2779,29 +2827,37 @@ var ArweaveBundlerStorageAdapter = class _ArweaveBundlerStorageAdapter {
     let storedHash;
     const tags = {};
     if (!this.skipIntegrityCheck) {
-      const metaResp = await fetch(`${this.gateway}/tx/${id}`);
+      const metaResp = await fetch(
+        `${this.gateway}/tx/${id}`,
+        this._withTimeout()
+      );
       if (!metaResp.ok) {
         throw new DStorageError(
           StorageErrorCode.ARWEAVE_BUNDLER_TX_METADATA_FAILED,
           `[dStorage/arweave-bundler] Could not fetch transaction metadata for txId: ${id} \u2014 content hash cannot be verified. Set skipIntegrityCheck: true to bypass integrity checking for fully trusted gateways.`
         );
       }
-      const tx = await metaResp.json();
+      const metaText = await readResponseTextWithLimit(metaResp, {
+        maxBytes: this.maxMetadataResponseBytes,
+        code: StorageErrorCode.ARWEAVE_BUNDLER_METADATA_TOO_LARGE,
+        component: `[dStorage/arweave-bundler] retrieve(${id}) metadata`
+      });
+      const tx = JSON.parse(metaText);
       for (const tag of tx.tags ?? []) {
         const name = new TextDecoder().decode(_base64urlToBytes(tag.name));
         const value = new TextDecoder().decode(_base64urlToBytes(tag.value));
         tags[name] = value;
         if (name === CONTENT_HASH_TAG2) storedHash = value;
       }
-      if (!storedHash) {
+      if (!options?.expectedContentHash && !storedHash) {
         throw new DStorageError(
           StorageErrorCode.ARWEAVE_BUNDLER_HASH_TAG_MISSING,
-          `[dStorage/arweave-bundler] ${CONTENT_HASH_TAG2} tag not found for txId: ${id}.
+          `[dStorage/arweave-bundler] Cannot verify content integrity for txId: ${id} \u2014 no expectedContentHash anchor was provided and the ${CONTENT_HASH_TAG2} tag was not found.
 Set skipIntegrityCheck: true to bypass integrity checking for fully trusted gateways.`
         );
       }
     }
-    const resp = await fetch(`${this.gateway}/${id}`);
+    const resp = await fetch(`${this.gateway}/${id}`, this._withTimeout());
     if (!resp.ok) {
       throw new DStorageError(
         StorageErrorCode.ARWEAVE_BUNDLER_RETRIEVE_HTTP_ERROR,
@@ -2826,8 +2882,14 @@ Check: https://viewblock.io/arweave/tx/${id}`
         `[dStorage/arweave-bundler] Downloaded ${bytes.byteLength} bytes for txId: ${id}, which exceeds the configured limit of ${this.maxRetrieveSizeBytes} bytes.`
       );
     }
-    if (!this.skipIntegrityCheck && storedHash) {
-      await assertContentHash(id, bytes, storedHash, "arweave-bundler");
+    const anchorHash = options?.expectedContentHash;
+    if (!this.skipIntegrityCheck && (anchorHash || storedHash)) {
+      await assertContentHash(
+        id,
+        bytes,
+        anchorHash ?? storedHash,
+        "arweave-bundler"
+      );
     }
     this.logger?.log("dStorage/arweave-bundler", `Retrieved txId: ${id}`);
     return { bytes, tags };
@@ -3638,6 +3700,8 @@ var MidnightSimulatorChainAdapter = class {
   }
 };
 var COMPONENT = "[dStorage/http-gateway-chain]";
+var DEFAULT_REQUEST_TIMEOUT_MS2 = 3e4;
+var DEFAULT_MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
 function generateRefId2() {
   const id = typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID() : `${Date.now()}-${Math.random().toString(36).slice(2)}`;
   return `ref_${id}`;
@@ -3653,6 +3717,13 @@ var HttpGatewayChainAdapter = class {
     this.readUrl = `${config.baseUrl}${config.readPath}`;
     this.listUrl = `${config.baseUrl}${config.listPath}`;
     this.deleteUrl = `${config.baseUrl}${config.deletePath}`;
+    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS2;
+    this.maxResponseBytes = config.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
+  }
+  /** Adds an AbortSignal.timeout() to a fetch init object (when requestTimeoutMs > 0). */
+  _withTimeout(init) {
+    const signal = this.requestTimeoutMs > 0 ? AbortSignal.timeout(this.requestTimeoutMs) : void 0;
+    return { ...init, ...signal !== void 0 ? { signal } : {} };
   }
   async writeReference(ref) {
     const { ownerSecret: _omit, ...payload } = ref;
@@ -3660,11 +3731,17 @@ var HttpGatewayChainAdapter = class {
     const url = `${this.writeUrl}/${encodeURIComponent(refId)}`;
     let res;
     try {
-      res = await this.fetchFn(url, {
-        method: "POST",
-        headers: { "Content-Type": "application/json", ...this.extraHeaders },
-        body: JSON.stringify(payload)
-      });
+      res = await this.fetchFn(
+        url,
+        this._withTimeout({
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            ...this.extraHeaders
+          },
+          body: JSON.stringify(payload)
+        })
+      );
     } catch (err) {
       throw new DStorageError(
         ChainErrorCode.GATEWAY_WRITE_FAILED,
@@ -3690,11 +3767,17 @@ var HttpGatewayChainAdapter = class {
     const url = `${this.writeUrl}/${encodeURIComponent(refId)}`;
     let res;
     try {
-      res = await this.fetchFn(url, {
-        method: "POST",
-        headers: { "Content-Type": "application/json", ...this.extraHeaders },
-        body: JSON.stringify(update)
-      });
+      res = await this.fetchFn(
+        url,
+        this._withTimeout({
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            ...this.extraHeaders
+          },
+          body: JSON.stringify(update)
+        })
+      );
     } catch (err) {
       throw new DStorageError(
         ChainErrorCode.GATEWAY_UPDATE_FAILED,
@@ -3715,7 +3798,10 @@ var HttpGatewayChainAdapter = class {
     const url = `${this.readUrl}/${encodeURIComponent(refId)}`;
     let res;
     try {
-      res = await this.fetchFn(url, { headers: { ...this.extraHeaders } });
+      res = await this.fetchFn(
+        url,
+        this._withTimeout({ headers: { ...this.extraHeaders } })
+      );
     } catch (err) {
       throw new DStorageError(
         ChainErrorCode.GATEWAY_READ_FAILED,
@@ -3730,9 +3816,14 @@ var HttpGatewayChainAdapter = class {
         { httpStatus: res.status }
       );
     }
+    const text = await readResponseTextWithLimit(res, {
+      maxBytes: this.maxResponseBytes,
+      code: ChainErrorCode.GATEWAY_READ_RESPONSE_TOO_LARGE,
+      component: `${COMPONENT} readReference`
+    });
     let data;
     try {
-      data = await res.json();
+      data = JSON.parse(text);
     } catch {
       throw new DStorageError(
         ChainErrorCode.GATEWAY_READ_INVALID_JSON,
@@ -3751,9 +3842,10 @@ var HttpGatewayChainAdapter = class {
   async listReferences() {
     let res;
     try {
-      res = await this.fetchFn(this.listUrl, {
-        headers: { ...this.extraHeaders }
-      });
+      res = await this.fetchFn(
+        this.listUrl,
+        this._withTimeout({ headers: { ...this.extraHeaders } })
+      );
     } catch (err) {
       throw new DStorageError(
         ChainErrorCode.GATEWAY_LIST_FAILED,
@@ -3768,9 +3860,14 @@ var HttpGatewayChainAdapter = class {
         { httpStatus: res.status }
       );
     }
+    const text = await readResponseTextWithLimit(res, {
+      maxBytes: this.maxResponseBytes,
+      code: ChainErrorCode.GATEWAY_LIST_RESPONSE_TOO_LARGE,
+      component: `${COMPONENT} listReferences`
+    });
     let data;
     try {
-      data = await res.json();
+      data = JSON.parse(text);
     } catch {
       throw new DStorageError(
         ChainErrorCode.GATEWAY_LIST_INVALID_JSON,
@@ -3803,11 +3900,17 @@ var HttpGatewayChainAdapter = class {
     const body = ownerSecret !== void 0 ? { ownerSecret: bytesToBase64url(ownerSecret) } : {};
     let res;
     try {
-      res = await this.fetchFn(url, {
-        method: "DELETE",
-        headers: { "Content-Type": "application/json", ...this.extraHeaders },
-        body: JSON.stringify(body)
-      });
+      res = await this.fetchFn(
+        url,
+        this._withTimeout({
+          method: "DELETE",
+          headers: {
+            "Content-Type": "application/json",
+            ...this.extraHeaders
+          },
+          body: JSON.stringify(body)
+        })
+      );
     } catch (err) {
       throw new DStorageError(
         ChainErrorCode.GATEWAY_REMOVE_FAILED,
@@ -3854,16 +3957,16 @@ var NETWORKS = {
     networkId: "preprod",
     nodeHttp: "https://rpc.preprod.midnight.network",
     nodeWs: "wss://rpc.preprod.midnight.network",
-    indexerHttp: "https://indexer.preprod.midnight.network/api/v3/graphql",
-    indexerWs: "wss://indexer.preprod.midnight.network/api/v3/graphql/ws",
+    indexerHttp: "https://indexer.preprod.midnight.network/api/v4/graphql",
+    indexerWs: "wss://indexer.preprod.midnight.network/api/v4/graphql/ws",
     proofServer: "http://127.0.0.1:6300"
   },
   undeployed: {
     networkId: "undeployed",
     nodeHttp: "http://127.0.0.1:9944",
     nodeWs: "ws://127.0.0.1:9944",
-    indexerHttp: "http://127.0.0.1:8088/api/v3/graphql",
-    indexerWs: "ws://127.0.0.1:8088/api/v3/graphql/ws",
+    indexerHttp: "http://127.0.0.1:8088/api/v4/graphql",
+    indexerWs: "ws://127.0.0.1:8088/api/v4/graphql/ws",
     proofServer: "http://127.0.0.1:6300"
   }
 };
@@ -4273,7 +4376,7 @@ var MidnightChainAdapter = class _MidnightChainAdapter {
     } else {
       providers = await this._buildWalletProviderMode();
     }
-    const { DataRegistryAPI } = await import("./contract-api-AO4RGPLT-ENC72WCG.mjs");
+    const { DataRegistryAPI } = await import("./contract-api-P6YEDYQ6-2X6BMD64.mjs");
     if (!this._contractAddress) {
       this.logger?.log("dStorage/midnight", "Deploying DataRegistry contract\u2026");
       this._api = await DataRegistryAPI.deploy(providers, this.logger);
@@ -4812,6 +4915,7 @@ export {
   mlkemUnwrapDek,
   mlkemWrapDek,
   parseKeyEnvelope,
+  readResponseTextWithLimit,
   serializeKeyEnvelope,
   serializeXChaChaPayload,
   unwrapKey,

package/dist/{chunk-HDD6SUU4.mjs → chunk-42O7KEL4.mjs}

@@ -1,14 +1,14 @@
 import {
   EncryptionErrorCode
-} from "./chunk-O37NHERH.mjs";
+} from "./chunk-L6WCT64V.mjs";
 import {
   DStorageError,
   deriveKek,
   unwrapKey,
   wrapKey
-} from "./chunk-BWLEAAFW.mjs";
+} from "./chunk-PCXBQRCO.mjs";
 
-// ../encryption/dist/chunk-6IHXTW2Y.mjs
+// ../encryption/dist/chunk-ENX7VXEV.mjs
 import { scrypt } from "@noble/hashes/scrypt.js";
 var KDF_PRESETS = {
   v1: { N: 131072, r: 8, p: 1 },
@@ -137,8 +137,8 @@ var PasswordEncryptionAdapter = class _PasswordEncryptionAdapter {
    * @param variant  ML-KEM variant. Default: "mlkem768".
    */
   async intoKeypairEncryptionAdapter(context, variant) {
-    const { KeypairEncryptionAdapter } = await import("./KeypairEncryptionAdapter-XUKCLRFU-ERPYK5S4.mjs");
-    const { mlkemGenerateKeypairFromSeed } = await import("./dist-MOLWJ4Y7.mjs");
+    const { KeypairEncryptionAdapter } = await import("./KeypairEncryptionAdapter-EOBRCIGP-5PFPNLLA.mjs");
+    const { mlkemGenerateKeypairFromSeed } = await import("./dist-J4JUJ2J5.mjs");
     const kekMaterial = await this.kekMaterialPromise;
     const mlkemBits = await globalThis.crypto.subtle.deriveBits(
       {
@@ -170,7 +170,23 @@ function resolveSalt(salt) {
   }
   return bytes;
 }
+var MIN_SCRYPT_N = 32768;
+function assertScryptCost(N) {
+  if (!Number.isInteger(N) || N < 2 || (N & N - 1) !== 0) {
+    throw new DStorageError(
+      EncryptionErrorCode.PASSWORD_SCRYPT_N_NOT_POWER_OF_TWO,
+      `[dStorage] PasswordEncryptionAdapter: scrypt N must be a power of two >= 2 (got ${N}).`
+    );
+  }
+  if (N < MIN_SCRYPT_N) {
+    throw new DStorageError(
+      EncryptionErrorCode.PASSWORD_SCRYPT_N_TOO_LOW,
+      `[dStorage] PasswordEncryptionAdapter: scrypt N=${N} is below the minimum cost floor of ${MIN_SCRYPT_N} (OWASP 2024 minimum, 32 MB memory-hard). A lower N makes the KDF cheap enough to brute-force offline. Use a preset ("v1" or "v1-lite") or a custom N >= 32768.`
+    );
+  }
+}
 function resolveParams(preset, params) {
+  let resolved;
   if (preset !== void 0) {
     if (!(preset in KDF_PRESETS)) {
       throw new DStorageError(
@@ -178,13 +194,16 @@ function resolveParams(preset, params) {
         `[dStorage] PasswordEncryptionAdapter: unknown preset "${preset}". Valid presets: ${Object.keys(KDF_PRESETS).join(", ")}.`
       );
     }
-    return KDF_PRESETS[preset];
+    resolved = KDF_PRESETS[preset];
+  } else {
+    resolved = {
+      N: params?.N ?? KDF_PRESETS["v1"].N,
+      r: params?.r ?? KDF_PRESETS["v1"].r,
+      p: params?.p ?? KDF_PRESETS["v1"].p
+    };
   }
-  return {
-    N: params?.N ?? KDF_PRESETS["v1"].N,
-    r: params?.r ?? KDF_PRESETS["v1"].r,
-    p: params?.p ?? KDF_PRESETS["v1"].p
-  };
+  assertScryptCost(resolved.N);
+  return resolved;
 }
 function estimateEntropyBits(password) {
   let pool = 0;

package/dist/{chunk-X4LEBNK6.mjs → chunk-5F3HZ2RJ.mjs}

@@ -1,14 +1,14 @@
 import {
   EncryptionErrorCode
-} from "./chunk-O37NHERH.mjs";
+} from "./chunk-L6WCT64V.mjs";
 import {
   DStorageError,
   deriveKek,
   unwrapKey,
   wrapKey
-} from "./chunk-BWLEAAFW.mjs";
+} from "./chunk-PCXBQRCO.mjs";
 
-// ../encryption/dist/chunk-6IHXTW2Y.mjs
+// ../encryption/dist/chunk-ENX7VXEV.mjs
 import { scrypt } from "@noble/hashes/scrypt.js";
 var KDF_PRESETS = {
   v1: { N: 131072, r: 8, p: 1 },
@@ -137,8 +137,8 @@ var PasswordEncryptionAdapter = class _PasswordEncryptionAdapter {
    * @param variant  ML-KEM variant. Default: "mlkem768".
    */
   async intoKeypairEncryptionAdapter(context, variant) {
-    const { KeypairEncryptionAdapter } = await import("./KeypairEncryptionAdapter-XUKCLRFU-AYDAZ2TZ.mjs");
-    const { mlkemGenerateKeypairFromSeed } = await import("./dist-INTAFXQ7.mjs");
+    const { KeypairEncryptionAdapter } = await import("./KeypairEncryptionAdapter-EOBRCIGP-FLPJIL26.mjs");
+    const { mlkemGenerateKeypairFromSeed } = await import("./dist-AGNOIJI4.mjs");
     const kekMaterial = await this.kekMaterialPromise;
     const mlkemBits = await globalThis.crypto.subtle.deriveBits(
       {
@@ -170,7 +170,23 @@ function resolveSalt(salt) {
   }
   return bytes;
 }
+var MIN_SCRYPT_N = 32768;
+function assertScryptCost(N) {
+  if (!Number.isInteger(N) || N < 2 || (N & N - 1) !== 0) {
+    throw new DStorageError(
+      EncryptionErrorCode.PASSWORD_SCRYPT_N_NOT_POWER_OF_TWO,
+      `[dStorage] PasswordEncryptionAdapter: scrypt N must be a power of two >= 2 (got ${N}).`
+    );
+  }
+  if (N < MIN_SCRYPT_N) {
+    throw new DStorageError(
+      EncryptionErrorCode.PASSWORD_SCRYPT_N_TOO_LOW,
+      `[dStorage] PasswordEncryptionAdapter: scrypt N=${N} is below the minimum cost floor of ${MIN_SCRYPT_N} (OWASP 2024 minimum, 32 MB memory-hard). A lower N makes the KDF cheap enough to brute-force offline. Use a preset ("v1" or "v1-lite") or a custom N >= 32768.`
+    );
+  }
+}
 function resolveParams(preset, params) {
+  let resolved;
   if (preset !== void 0) {
     if (!(preset in KDF_PRESETS)) {
       throw new DStorageError(
@@ -178,13 +194,16 @@ function resolveParams(preset, params) {
         `[dStorage] PasswordEncryptionAdapter: unknown preset "${preset}". Valid presets: ${Object.keys(KDF_PRESETS).join(", ")}.`
       );
     }
-    return KDF_PRESETS[preset];
+    resolved = KDF_PRESETS[preset];
+  } else {
+    resolved = {
+      N: params?.N ?? KDF_PRESETS["v1"].N,
+      r: params?.r ?? KDF_PRESETS["v1"].r,
+      p: params?.p ?? KDF_PRESETS["v1"].p
+    };
   }
-  return {
-    N: params?.N ?? KDF_PRESETS["v1"].N,
-    r: params?.r ?? KDF_PRESETS["v1"].r,
-    p: params?.p ?? KDF_PRESETS["v1"].p
-  };
+  assertScryptCost(resolved.N);
+  return resolved;
 }
 function estimateEntropyBits(password) {
   let pool = 0;