@fgv/ts-extras 5.1.0-41 → 5.1.0-43

package/dist/ts-extras.d.ts

@@ -720,6 +720,7 @@ declare namespace CryptoUtils {
         IDirectEncryptionProviderParams,
         IKeyPairAlgorithmParams,
         keyPairAlgorithmParams,
+        deriveKeyPairFromSeed,
         NodeCryptoProvider,
         nodeCryptoProvider,
         createEncryptedFile,
@@ -731,6 +732,8 @@ declare namespace CryptoUtils {
         base64UrlNoPadDecode,
         base64UrlNoPadEncode,
         exportPublicKeyAsMultibaseSpki,
+        hexDecode,
+        hexEncode,
         importPublicKeyFromMultibaseSpki,
         isValidMultibaseSpkiPublicKey,
         MultibaseSpkiPublicKeyRegExp,
@@ -747,6 +750,7 @@ declare namespace CryptoUtils {
         IEncryptionResult,
         IEncryptBytesResult,
         KeyPairAlgorithm,
+        SeedDerivableAlgorithm,
         IWrapBytesOptions,
         IWrappedBytes,
         allKeyPairAlgorithms,
@@ -757,6 +761,7 @@ declare namespace CryptoUtils {
         IArgon2idParams,
         ARGON2ID_OWASP_MIN,
         ARGON2ID_PASSPHRASE,
+        IArgon2idKeyingOptions,
         IArgon2idProvider,
         IEncryptedFile,
         ICryptoProvider,
@@ -841,6 +846,46 @@ declare const DEFAULT_RANGEOF_FORMATS: RangeOfFormats;
  */
 declare const DEFAULT_SECRET_ITERATIONS: number;
 
+/**
+ * Derives an asymmetric keypair *deterministically* from a fixed secret seed
+ * using `globalThis.crypto.subtle`, shared by the Node and browser
+ * {@link CryptoUtils.ICryptoProvider} implementations (both speak the same
+ * WebCrypto API). See
+ * {@link CryptoUtils.ICryptoProvider.importKeyPairFromSeed | importKeyPairFromSeed}
+ * for the public contract.
+ *
+ * For each supported algorithm: wraps the 32-byte seed in the RFC 8410 PKCS#8
+ * envelope, then runs a transient-extractable-then-derive dance so the public
+ * key is recoverable even when the caller requests a non-extractable private key:
+ *
+ * 1. Import the PKCS#8 as a *transient* extractable private key.
+ * 2. Export it to JWK to read the deterministic public coordinate `x`.
+ * 3. Import `{ kty: 'OKP', crv, x }` as the returned public key.
+ * 4. For the returned private key: reuse the transient key when `extractable`
+ *    is `true`; otherwise re-import the same PKCS#8 as a non-extractable key.
+ *    The transient extractable key is never returned when `extractable` is
+ *    `false`, so seed material cannot escape through it.
+ *
+ * The two algorithms differ only in the OID/name/curve/usages (see
+ * {@link ISeedAlgorithmParams}); `'x25519'` yields the DH key-agreement keypair
+ * (private `'deriveBits'`, public no-usage) that {@link CryptoUtils.HpkeProvider}
+ * consumes as its recipient key.
+ *
+ * The seed bytes are copied into a freshly allocated PKCS#8 buffer, so the
+ * `BufferSource` handed to WebCrypto is always backed by a plain `ArrayBuffer`
+ * (side-stepping the Node-20 `SharedArrayBuffer`-view rejection) and the
+ * caller's `seed` is never mutated.
+ *
+ * @param algorithm - The seed-derivable algorithm (`'ed25519'` or `'x25519'`).
+ * Any other value fails loudly rather than being mis-handled.
+ * @param seed - The 32-byte secret seed. Any other length fails loudly, before
+ * any WebCrypto call.
+ * @param extractable - Whether the returned private key may be exported.
+ * @returns `Success` with the derived `CryptoKeyPair`, or `Failure` with error context.
+ * @public
+ */
+declare function deriveKeyPairFromSeed(algorithm: SeedDerivableAlgorithm, seed: Uint8Array, extractable: boolean): Promise<Result<CryptoKeyPair>>;
+
 /**
  * An {@link IEncryptionProvider} that uses a pre-supplied key and crypto provider.
  *
@@ -1368,6 +1413,34 @@ declare namespace Hash {
 }
 export { Hash }
 
+/**
+ * Decodes a hexadecimal string (no `0x` prefix) back to a `Uint8Array`.
+ *
+ * Liberal in what it accepts: both lowercase and uppercase hex digits are
+ * allowed (whereas {@link CryptoUtils.hexEncode} always emits lowercase). The
+ * input must have even length and contain only hex digits (`0-9`, `a-f`, `A-F`);
+ * an empty string decodes to an empty `Uint8Array`. Odd length or any non-hex
+ * character fails with error context.
+ *
+ * @param encoded - The hex string to decode.
+ * @returns `Success` with the decoded bytes, or `Failure` with error context.
+ * @public
+ */
+declare function hexDecode(encoded: string): Result<Uint8Array>;
+
+/**
+ * Encodes a `Uint8Array` as a lowercase hexadecimal string with no `0x` prefix.
+ *
+ * Each byte becomes exactly two lowercase hex characters (zero-padded), so an
+ * `n`-byte input yields a `2n`-character string. An empty input yields the empty
+ * string. This is the inverse of {@link CryptoUtils.hexDecode}.
+ *
+ * @param data - The binary data to encode.
+ * @returns The lowercase, unprefixed hex string.
+ * @public
+ */
+declare function hexEncode(data: Uint8Array): string;
+
 /**
  * HPKE base mode (RFC 9180) — `DHKEM(X25519, HKDF-SHA256) + HKDF-SHA256 + AES-256-GCM`.
  *
@@ -2523,6 +2596,33 @@ declare interface IArgon2idKeyDerivationParams {
     readonly parallelism: number;
 }
 
+/**
+ * Optional keyed-hashing inputs for {@link CryptoUtils.IArgon2idProvider.argon2id | argon2id}
+ * (RFC 9106 §3.1). These are distinct from the cost parameters in
+ * {@link CryptoUtils.IArgon2idParams} — they change the derived output but are
+ * not tuning knobs. Both fields are optional; omitting a field (or passing an
+ * empty `Uint8Array`) is a no-op that leaves the output byte-identical to a call
+ * with no options at all.
+ * @public
+ */
+declare interface IArgon2idKeyingOptions {
+    /**
+     * Optional secret key K (RFC 9106 keyed hashing, sometimes called a "pepper").
+     * When present and non-empty it is mixed into the hash so that the derived
+     * output cannot be reproduced without also knowing K. Empty or omitted means
+     * no secret. Honored by both the Node and browser backends.
+     */
+    readonly secret?: Uint8Array;
+    /**
+     * Optional associated data X (RFC 9106 §3.1). When present and non-empty it is
+     * mixed into the hash. **Node-only:** the WASM (`hash-wasm`) browser backend
+     * has no associated-data input, so `BrowserArgon2Provider` fails loudly rather
+     * than silently dropping it (which would produce wrong bytes). Empty or omitted
+     * means no associated data and is accepted by both backends.
+     */
+    readonly associatedData?: Uint8Array;
+}
+
 /**
  * Parameters for Argon2id key derivation (RFC 9106).
  * All fields are required; fgv does not pick defaults silently.
@@ -2570,15 +2670,24 @@ declare interface IArgon2idProvider {
     /**
      * Derives key material from a password using Argon2id (RFC 9106 §3.1).
      *
-     * Returns the raw derived bytes as a `Uint8Array`. Both Node and browser
-     * implementations produce bit-identical output for identical inputs.
+     * Returns the raw derived bytes as a `Uint8Array`. For the same inputs that
+     * both backends support, the Node and browser implementations produce
+     * byte-identical output. The optional `associatedData` in
+     * {@link CryptoUtils.IArgon2idKeyingOptions} is the one exception: it is
+     * Node-only (the browser WASM backend has no associated-data input), so a call
+     * that supplies non-empty `associatedData` is not portable to the browser
+     * backend. Every input the browser backend *does* support (including the
+     * optional `secret`) is byte-identical across the two.
      *
      * @param password - Password or passphrase. Accepts string (UTF-8) or raw bytes.
      * @param salt - Salt bytes. Must be random and unique per credential (\>= 16 bytes recommended).
      * @param params - Argon2id parameters. Use `ARGON2ID_OWASP_MIN` as a starting point.
+     * @param options - Optional {@link CryptoUtils.IArgon2idKeyingOptions | keyed-hashing inputs}
+     * (secret K and/or associated data X). Omitting them (the default) leaves the
+     * output byte-identical to prior behavior.
      * @returns Success with derived bytes, Failure with error context.
      */
-    argon2id(password: Uint8Array | string, salt: Uint8Array, params: IArgon2idParams): Promise<Result<Uint8Array>>;
+    argon2id(password: Uint8Array | string, salt: Uint8Array, params: IArgon2idParams, options?: IArgon2idKeyingOptions): Promise<Result<Uint8Array>>;
 }
 
 /**
@@ -2837,6 +2946,31 @@ declare interface ICryptoProvider {
      * @returns Success with the generated `CryptoKeyPair`, or Failure with error context.
      */
     generateKeyPair(algorithm: KeyPairAlgorithm, extractable: boolean): Promise<Result<CryptoKeyPair>>;
+    /**
+     * Derives an asymmetric keypair *deterministically* from a fixed secret seed.
+     * The same `seed` always yields the same keypair on every runtime, so this is
+     * the primitive to use when a keypair must be reconstructable from stored seed
+     * material (key escrow, HD-style derivation, deterministic test vectors) rather
+     * than freshly sampled by {@link CryptoUtils.ICryptoProvider.generateKeyPair | generateKeyPair}.
+     *
+     * For both `'ed25519'` and `'x25519'` the private key *is* its 32-byte seed and
+     * the public key is a deterministic function of that seed (RFC 8032 / RFC 7748),
+     * so the returned public key is recovered even when the caller requests a
+     * non-extractable private key. The transient extractable key used internally to
+     * recover the public half is never returned or logged when `extractable` is
+     * `false`. The returned keys carry the algorithm's usages: `'ed25519'` →
+     * private `'sign'` / public `'verify'`; `'x25519'` → private `'deriveBits'` /
+     * public no-usage (ready to hand to {@link CryptoUtils.HpkeProvider}).
+     * @param algorithm - The {@link CryptoUtils.SeedDerivableAlgorithm | seed-derivable algorithm}
+     * (`'ed25519'` or `'x25519'`); any other value fails loudly with context.
+     * @param seed - The secret seed. It must be exactly 32 bytes for both supported
+     * algorithms; any other length fails loudly, before any WebCrypto call. The
+     * bytes are copied, not retained or mutated.
+     * @param extractable - Whether the returned private key may be exported. The
+     * returned public key is identical for a given seed regardless of this flag.
+     * @returns Success with the derived `CryptoKeyPair`, or Failure with error context.
+     */
+    importKeyPairFromSeed(algorithm: SeedDerivableAlgorithm, seed: Uint8Array, extractable: boolean): Promise<Result<CryptoKeyPair>>;
     /**
      * Exports the public half of a keypair as a JSON Web Key.
      * @param publicKey - The public `CryptoKey` to export. Must be an `extractable`
@@ -3511,6 +3645,19 @@ declare interface IImportKeyOptions extends IImportSecretOptions {
     readonly type?: KeyStoreSymmetricSecretType;
 }
 
+/**
+ * Options for importing raw opaque bytes via {@link KeyStore.importSecretBytes}.
+ * Extends {@link IImportSecretOptions} with optional initial metadata.
+ * @public
+ */
+declare interface IImportSecretBytesOptions extends IImportSecretOptions {
+    /**
+     * Optional initial mutable metadata to store with the entry. Can also be set
+     * or replaced later via {@link KeyStore.setSecretMetadata}.
+     */
+    readonly metadata?: JsonValue;
+}
+
 /**
  * Options for importing a secret.
  * @public
@@ -3791,16 +3938,36 @@ declare interface IKeyStoreSymmetricEntry {
      * The secret data.
      * - For `'encryption-key'`: 32-byte AES-256 key.
      * - For `'api-key'`: UTF-8 encoded API key string (arbitrary length).
+     * - For `'opaque'`: arbitrary raw bytes, stored and returned verbatim.
      */
     readonly key: Uint8Array;
     /**
      * Optional description for this secret.
      */
     readonly description?: string;
+    /**
+     * Optional mutable, non-secret-by-contract metadata for this entry. Set via
+     * {@link CryptoUtils.KeyStore.KeyStore.setSecretMetadata} without touching the
+     * secret `key` bytes.
+     *
+     * "Non-secret by contract" means the field is intended for lifecycle metadata
+     * (rotation timestamps, labels, provenance) rather than secret material.
+     * PHYSICALLY it lives inside the vault's AES-GCM ciphertext alongside the key
+     * bytes — the vault has no plaintext index — so it is protected at rest by the
+     * master password; the "non-secret" designation is a usage contract, not a
+     * weaker custody class.
+     */
+    readonly metadata?: JsonValue;
     /**
      * When this secret was added (ISO 8601).
      */
     readonly createdAt: string;
+    /**
+     * When this entry was last mutated (ISO 8601). Stamped on any metadata
+     * mutation (see {@link CryptoUtils.KeyStore.KeyStore.setSecretMetadata}).
+     * Absent on entries that have never been mutated since creation.
+     */
+    readonly updatedAt?: string;
 }
 
 /**
@@ -3840,10 +4007,22 @@ declare interface IKeyStoreSymmetricEntryJson {
      * Optional description.
      */
     readonly description?: string;
+    /**
+     * Optional mutable, non-secret-by-contract metadata for this entry. Present
+     * only on `'keystore-v3'` vaults whose entry carried metadata; a v1/v2 vault
+     * omits the field. Physically carried inside the vault ciphertext (the vault
+     * has no plaintext index).
+     */
+    readonly metadata?: JsonValue;
     /**
      * When this secret was added (ISO 8601).
      */
     readonly createdAt: string;
+    /**
+     * When this entry was last mutated (ISO 8601). Present only on `'keystore-v3'`
+     * vaults whose entry has been mutated since creation.
+     */
+    readonly updatedAt?: string;
 }
 
 /**
@@ -4800,6 +4979,7 @@ declare namespace KeyStore {
         IAddSecretOptions,
         IImportSecretOptions,
         IImportKeyOptions,
+        IImportSecretBytesOptions,
         IAddSecretFromPasswordOptions,
         DEFAULT_SECRET_ITERATIONS,
         IAddSecretFromPasswordResult,
@@ -5120,6 +5300,50 @@ declare class KeyStore_2 implements IEncryptionProvider {
      * @public
      */
     getApiKey(name: string): Result<string>;
+    /**
+     * Imports arbitrary raw bytes into the vault with type `'opaque'`.
+     *
+     * Unlike {@link KeyStore.importSecret} (which enforces a 32-byte AES-256 key)
+     * and {@link KeyStore.importApiKey} (which UTF-8 encodes a string), this
+     * accepts a byte buffer of any length and stores it verbatim — including
+     * embedded NUL bytes. Use it for byte blobs that are neither a fixed-size key
+     * nor a UTF-8 string (e.g. a serialized credential bundle), so they are not
+     * mistyped as `'api-key'`.
+     *
+     * @param name - Unique name for the secret
+     * @param bytes - The raw bytes to store
+     * @param options - Optional description, initial metadata, whether to replace existing
+     * @returns Success with entry, Failure if locked, empty, or exists and !replace
+     * @public
+     */
+    importSecretBytes(name: string, bytes: Uint8Array, options?: IImportSecretBytesOptions): Promise<Result<IAddSecretResult>>;
+    /**
+     * Retrieves the raw stored bytes for a symmetric entry, returned verbatim
+     * (never UTF-8 decoded). Intended for `'opaque'` entries but works for any
+     * symmetric type; asymmetric-keypair entries carry no raw key material and
+     * are rejected.
+     *
+     * @param name - Name of the secret
+     * @returns Success with a copy of the stored bytes, Failure if not found,
+     * locked, or the entry is asymmetric
+     * @public
+     */
+    getSecretBytes(name: string): Result<Uint8Array>;
+    /**
+     * Replaces the mutable metadata on a symmetric entry and stamps `updatedAt`
+     * with the current timestamp. Does NOT touch the secret `key` bytes — the
+     * material reads back identically afterward.
+     *
+     * Metadata is non-secret by contract but physically lives inside the vault
+     * ciphertext (see {@link CryptoUtils.KeyStore.IKeyStoreSymmetricEntry.metadata}).
+     *
+     * @param name - Name of the secret to update
+     * @param value - New metadata value (replaces any prior metadata)
+     * @returns Success with the updated entry, Failure if not found, locked, or
+     * the entry is asymmetric
+     * @public
+     */
+    setSecretMetadata(name: string, value: JsonValue): Result<IKeyStoreSymmetricEntry>;
     /**
      * Adds a new asymmetric keypair to the vault. Storage-first: the private key
      * is stored under a freshly-minted `id` before the public-key vault entry is
@@ -5305,7 +5529,7 @@ declare class KeyStore_2 implements IEncryptionProvider {
 }
 
 /**
- * Current format version constant. New vaults are written as `'keystore-v2'`.
+ * Current format version constant. New vaults are written as `'keystore-v3'`.
  * @public
  */
 declare const KEYSTORE_FORMAT: KeyStoreFormat;
@@ -5349,9 +5573,14 @@ declare const keystoreFile: Converter<IKeyStoreFile>;
  *   asymmetric-keypair entries. A strict superset of v1 — the field is
  *   optional, so a v2 reader opens a v1 vault with no special-casing, and a
  *   v1 vault opened and re-saved is silently upgraded to v2.
+ * - `'keystore-v3'`: adds the `'opaque'` symmetric secret type and the optional
+ *   `metadata` / `updatedAt` fields on symmetric entries. A strict superset of
+ *   v1/v2 — the additions are optional (and `'opaque'` is simply a new enum
+ *   value), so a v3 reader opens a v1/v2 vault with no special-casing, and a
+ *   v1/v2 vault opened and re-saved is silently upgraded to v3.
  * @public
  */
-declare type KeyStoreFormat = 'keystore-v1' | 'keystore-v2';
+declare type KeyStoreFormat = 'keystore-v1' | 'keystore-v2' | 'keystore-v3';
 
 /**
  * Converter for {@link CryptoUtils.KeyStore.KeyStoreFormat | key store format} version.
@@ -5409,13 +5638,17 @@ declare const keystoreSymmetricEntryJson: Converter<IKeyStoreSymmetricEntryJson>
  * Discriminator for symmetric secret types stored in the vault.
  * - `'encryption-key'`: A 32-byte AES-256 encryption key.
  * - `'api-key'`: An arbitrary-length API key string (UTF-8 encoded).
+ * - `'opaque'`: Arbitrary raw bytes with no encoding contract — stored and
+ *   returned verbatim (never UTF-8 decoded). Use for byte blobs that are
+ *   neither a fixed-size AES key nor a UTF-8 string (e.g. a serialized
+ *   credential bundle), so they are not mistyped as `'api-key'`.
  * @public
  */
-declare type KeyStoreSymmetricSecretType = 'encryption-key' | 'api-key';
+declare type KeyStoreSymmetricSecretType = 'encryption-key' | 'api-key' | 'opaque';
 
 /**
  * Converter for {@link CryptoUtils.KeyStore.KeyStoreSymmetricSecretType | symmetric secret type} discriminator.
- * Accepts only `'encryption-key'` and `'api-key'`.
+ * Accepts `'encryption-key'`, `'api-key'`, and `'opaque'`.
  * @public
  */
 declare const keystoreSymmetricSecretType: Converter<KeyStoreSymmetricSecretType>;
@@ -5763,6 +5996,14 @@ declare class NodeCryptoProvider implements ICryptoProvider {
      * @returns `Success` with the generated `CryptoKeyPair`, or `Failure` with an error.
      */
     generateKeyPair(algorithm: KeyPairAlgorithm, extractable: boolean): Promise<Result<CryptoKeyPair>>;
+    /**
+     * Derives an asymmetric keypair deterministically from a fixed secret seed.
+     * @param algorithm - The seed-derivable algorithm (only `'ed25519'` today).
+     * @param seed - The 32-byte secret seed.
+     * @param extractable - Whether the returned private key may be exported.
+     * @returns `Success` with the derived `CryptoKeyPair`, or `Failure` with an error.
+     */
+    importKeyPairFromSeed(algorithm: SeedDerivableAlgorithm, seed: Uint8Array, extractable: boolean): Promise<Result<CryptoKeyPair>>;
     /**
      * Exports a public `CryptoKey` as a JSON Web Key.
      * @remarks
@@ -6214,6 +6455,28 @@ declare function resolveProviderModel(descriptor: IAiProviderDescriptor, modelOv
  */
 declare type SecretProvider = (secretName: string) => Promise<Result<Uint8Array>>;
 
+/**
+ * The subset of {@link CryptoUtils.KeyPairAlgorithm} whose keypair can be
+ * derived *deterministically* from a fixed secret seed, for use with
+ * {@link CryptoUtils.ICryptoProvider.importKeyPairFromSeed | importKeyPairFromSeed}.
+ *
+ * Two algorithms are supported, both of whose 32-byte private scalar *is* the
+ * seed and whose public key is a deterministic function of it, so the same seed
+ * always yields the same keypair on every runtime:
+ * - `'ed25519'` — signing keypair (RFC 8032). Private usage `'sign'`, public
+ *   usage `'verify'`.
+ * - `'x25519'` — Diffie-Hellman key-agreement keypair (RFC 7748), the recipient
+ *   keypair consumed by {@link CryptoUtils.HpkeProvider}. Private usage
+ *   `'deriveBits'`, public key imported with no usages. Deriving a fixed X25519
+ *   recipient keypair from a checked-in seed is what makes a deterministic HPKE
+ *   seal/open round-trip vector possible.
+ *
+ * The type is a proper subset of {@link CryptoUtils.KeyPairAlgorithm} because
+ * algorithms like RSA or the NIST curves are not recoverable from a bare seed.
+ * @public
+ */
+declare type SeedDerivableAlgorithm = 'ed25519' | 'x25519';
+
 /**
  * Default system-prompt suffix appended when {@link AiAssist.IGenerateJsonCompletionParams.promptHint}
  * is `'smart'` (the default). Designed to discourage code fences and prose in

package/lib/packlets/crypto-utils/index.browser.d.ts

@@ -11,7 +11,8 @@ import * as Converters from './converters';
 export { Converters };
 export { DirectEncryptionProvider, IDirectEncryptionProviderParams } from './directEncryptionProvider';
 export { IKeyPairAlgorithmParams, keyPairAlgorithmParams } from './keyPairAlgorithmParams';
+export { deriveKeyPairFromSeed } from './seedDerivedKeyPair';
 export { createEncryptedFile, decryptFile, fromBase64, ICreateEncryptedFileParams, toBase64, tryDecryptFile } from './encryptedFile';
-export { base64UrlNoPadDecode, base64UrlNoPadEncode, exportPublicKeyAsMultibaseSpki, importPublicKeyFromMultibaseSpki, isValidMultibaseSpkiPublicKey, MultibaseSpkiPublicKeyRegExp, multibaseBase64UrlDecode, multibaseBase64UrlEncode, spkiToRawX25519 } from './spkiHelpers';
+export { base64UrlNoPadDecode, base64UrlNoPadEncode, exportPublicKeyAsMultibaseSpki, hexDecode, hexEncode, importPublicKeyFromMultibaseSpki, isValidMultibaseSpkiPublicKey, MultibaseSpkiPublicKeyRegExp, multibaseBase64UrlDecode, multibaseBase64UrlEncode, spkiToRawX25519 } from './spkiHelpers';
 export { HpkeProvider, IHpkeSealResult } from './hpkeProvider';
 //# sourceMappingURL=index.browser.d.ts.map

package/lib/packlets/crypto-utils/index.browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.browser.d.ts","sourceRoot":"","sources":["../../../src/packlets/crypto-utils/index.browser.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AAGH,cAAc,SAAS,CAAC;AAGxB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,WAAW,EACZ,MAAM,aAAa,CAAC;AAIrB,OAAO,KAAK,QAAQ,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,CAAC;AAGpB,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,CAAC;AAGtB,OAAO,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAC;AAGvG,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAM3F,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,UAAU,EACV,0BAA0B,EAC1B,QAAQ,EACR,cAAc,EACf,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,8BAA8B,EAC9B,gCAAgC,EAChC,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,eAAe,EAChB,MAAM,eAAe,CAAC;AAIvB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.browser.d.ts","sourceRoot":"","sources":["../../../src/packlets/crypto-utils/index.browser.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AAGH,cAAc,SAAS,CAAC;AAGxB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,WAAW,EACZ,MAAM,aAAa,CAAC;AAIrB,OAAO,KAAK,QAAQ,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,CAAC;AAGpB,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,CAAC;AAGtB,OAAO,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAC;AAGvG,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAI3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAM7D,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,UAAU,EACV,0BAA0B,EAC1B,QAAQ,EACR,cAAc,EACf,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,8BAA8B,EAC9B,SAAS,EACT,SAAS,EACT,gCAAgC,EAChC,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,eAAe,EAChB,MAAM,eAAe,CAAC;AAIvB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC"}

package/lib/packlets/crypto-utils/index.browser.js

@@ -55,7 +55,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HpkeProvider = exports.spkiToRawX25519 = exports.multibaseBase64UrlEncode = exports.multibaseBase64UrlDecode = exports.MultibaseSpkiPublicKeyRegExp = exports.isValidMultibaseSpkiPublicKey = exports.importPublicKeyFromMultibaseSpki = exports.exportPublicKeyAsMultibaseSpki = exports.base64UrlNoPadEncode = exports.base64UrlNoPadDecode = exports.tryDecryptFile = exports.toBase64 = exports.fromBase64 = exports.decryptFile = exports.createEncryptedFile = exports.keyPairAlgorithmParams = exports.DirectEncryptionProvider = exports.Converters = exports.KeyStore = exports.GCM_IV_SIZE = exports.GCM_AUTH_TAG_SIZE = exports.ENCRYPTED_FILE_FORMAT = exports.DEFAULT_ALGORITHM = exports.AES_256_KEY_SIZE = void 0;
+exports.HpkeProvider = exports.spkiToRawX25519 = exports.multibaseBase64UrlEncode = exports.multibaseBase64UrlDecode = exports.MultibaseSpkiPublicKeyRegExp = exports.isValidMultibaseSpkiPublicKey = exports.importPublicKeyFromMultibaseSpki = exports.hexEncode = exports.hexDecode = exports.exportPublicKeyAsMultibaseSpki = exports.base64UrlNoPadEncode = exports.base64UrlNoPadDecode = exports.tryDecryptFile = exports.toBase64 = exports.fromBase64 = exports.decryptFile = exports.createEncryptedFile = exports.deriveKeyPairFromSeed = exports.keyPairAlgorithmParams = exports.DirectEncryptionProvider = exports.Converters = exports.KeyStore = exports.GCM_IV_SIZE = exports.GCM_AUTH_TAG_SIZE = exports.ENCRYPTED_FILE_FORMAT = exports.DEFAULT_ALGORITHM = exports.AES_256_KEY_SIZE = void 0;
 /**
  * Crypto utilities for encrypted file handling and key management (browser version).
  * Note: For browser crypto provider, use \@fgv/ts-web-extras.
@@ -83,6 +83,10 @@ Object.defineProperty(exports, "DirectEncryptionProvider", { enumerable: true, g
 // WebCrypto parameter table for asymmetric keypair algorithms
 var keyPairAlgorithmParams_1 = require("./keyPairAlgorithmParams");
 Object.defineProperty(exports, "keyPairAlgorithmParams", { enumerable: true, get: function () { return keyPairAlgorithmParams_1.keyPairAlgorithmParams; } });
+// Deterministic seed → keypair derivation shared by the Node/browser providers
+// (globalThis.crypto.subtle only — no node:crypto, safe in the browser entry point)
+var seedDerivedKeyPair_1 = require("./seedDerivedKeyPair");
+Object.defineProperty(exports, "deriveKeyPairFromSeed", { enumerable: true, get: function () { return seedDerivedKeyPair_1.deriveKeyPairFromSeed; } });
 // Note: NodeCryptoProvider is NOT exported in browser version
 // Use BrowserCryptoProvider from @fgv/ts-web-extras instead
 // Encrypted file helpers
@@ -97,6 +101,8 @@ var spkiHelpers_1 = require("./spkiHelpers");
 Object.defineProperty(exports, "base64UrlNoPadDecode", { enumerable: true, get: function () { return spkiHelpers_1.base64UrlNoPadDecode; } });
 Object.defineProperty(exports, "base64UrlNoPadEncode", { enumerable: true, get: function () { return spkiHelpers_1.base64UrlNoPadEncode; } });
 Object.defineProperty(exports, "exportPublicKeyAsMultibaseSpki", { enumerable: true, get: function () { return spkiHelpers_1.exportPublicKeyAsMultibaseSpki; } });
+Object.defineProperty(exports, "hexDecode", { enumerable: true, get: function () { return spkiHelpers_1.hexDecode; } });
+Object.defineProperty(exports, "hexEncode", { enumerable: true, get: function () { return spkiHelpers_1.hexEncode; } });
 Object.defineProperty(exports, "importPublicKeyFromMultibaseSpki", { enumerable: true, get: function () { return spkiHelpers_1.importPublicKeyFromMultibaseSpki; } });
 Object.defineProperty(exports, "isValidMultibaseSpkiPublicKey", { enumerable: true, get: function () { return spkiHelpers_1.isValidMultibaseSpkiPublicKey; } });
 Object.defineProperty(exports, "MultibaseSpkiPublicKeyRegExp", { enumerable: true, get: function () { return spkiHelpers_1.MultibaseSpkiPublicKeyRegExp; } });

package/lib/packlets/crypto-utils/index.browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.browser.js","sourceRoot":"","sources":["../../../src/packlets/crypto-utils/index.browser.ts"],"names":[],"mappings":";AAAA,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,gFAAgF;AAChF,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEZ;;;;GAIG;AAEH,iCAAiC;AACjC,0CAAwB;AAExB,YAAY;AACZ,yCAMqB;AALnB,6GAAA,gBAAgB,OAAA;AAChB,8GAAA,iBAAiB,OAAA;AACjB,kHAAA,qBAAqB,OAAA;AACrB,8GAAA,iBAAiB,OAAA;AACjB,wGAAA,WAAW,OAAA;AAGb,gEAAgE;AAChE,iFAAiF;AACjF,mEAAqD;AAC5C,4BAAQ;AAEjB,uBAAuB;AACvB,yDAA2C;AAClC,gCAAU;AAEnB,6BAA6B;AAC7B,uEAAuG;AAA9F,oIAAA,wBAAwB,OAAA;AAEjC,8DAA8D;AAC9D,mEAA2F;AAAzD,gIAAA,sBAAsB,OAAA;AAExD,8DAA8D;AAC9D,4DAA4D;AAE5D,yBAAyB;AACzB,iDAOyB;AANvB,oHAAA,mBAAmB,OAAA;AACnB,4GAAA,WAAW,OAAA;AACX,2GAAA,UAAU,OAAA;AAEV,yGAAA,QAAQ,OAAA;AACR,+GAAA,cAAc,OAAA;AAGhB,qCAAqC;AACrC,6CAUuB;AATrB,mHAAA,oBAAoB,OAAA;AACpB,mHAAA,oBAAoB,OAAA;AACpB,6HAAA,8BAA8B,OAAA;AAC9B,+HAAA,gCAAgC,OAAA;AAChC,4HAAA,6BAA6B,OAAA;AAC7B,2HAAA,4BAA4B,OAAA;AAC5B,uHAAA,wBAAwB,OAAA;AACxB,uHAAA,wBAAwB,OAAA;AACxB,8GAAA,eAAe,OAAA;AAGjB,qFAAqF;AACrF,uFAAuF;AACvF,+CAA+D;AAAtD,4GAAA,YAAY,OAAA","sourcesContent":["// Copyright (c) 2024 Erik Fortune\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal\n// in the Software without restriction, including without limitation the rights\n// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n// copies of the Software, and to permit persons to whom the Software is\n// furnished to do so, subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all\n// copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n// SOFTWARE.\n\n/**\n * Crypto utilities for encrypted file handling and key management (browser version).\n * Note: For browser crypto provider, use \\@fgv/ts-web-extras.\n * @packageDocumentation\n */\n\n// Re-export all types from model\nexport * from './model';\n\n// Constants\nexport {\n  AES_256_KEY_SIZE,\n  DEFAULT_ALGORITHM,\n  ENCRYPTED_FILE_FORMAT,\n  GCM_AUTH_TAG_SIZE,\n  GCM_IV_SIZE\n} from './constants';\n\n// KeyStore namespace (browser-safe barrel — omits the Node-only\n// EncryptedFilePrivateKeyStorage so the browser entry stays free of node:crypto)\nimport * as KeyStore from './keystore/index.browser';\nexport { KeyStore };\n\n// Converters namespace\nimport * as Converters from './converters';\nexport { Converters };\n\n// Direct encryption provider\nexport { DirectEncryptionProvider, IDirectEncryptionProviderParams } from './directEncryptionProvider';\n\n// WebCrypto parameter table for asymmetric keypair algorithms\nexport { IKeyPairAlgorithmParams, keyPairAlgorithmParams } from './keyPairAlgorithmParams';\n\n// Note: NodeCryptoProvider is NOT exported in browser version\n// Use BrowserCryptoProvider from @fgv/ts-web-extras instead\n\n// Encrypted file helpers\nexport {\n  createEncryptedFile,\n  decryptFile,\n  fromBase64,\n  ICreateEncryptedFileParams,\n  toBase64,\n  tryDecryptFile\n} from './encryptedFile';\n\n// Multibase/SPKI + base64url helpers\nexport {\n  base64UrlNoPadDecode,\n  base64UrlNoPadEncode,\n  exportPublicKeyAsMultibaseSpki,\n  importPublicKeyFromMultibaseSpki,\n  isValidMultibaseSpkiPublicKey,\n  MultibaseSpkiPublicKeyRegExp,\n  multibaseBase64UrlDecode,\n  multibaseBase64UrlEncode,\n  spkiToRawX25519\n} from './spkiHelpers';\n\n// HPKE base mode (RFC 9180) — DHKEM(X25519, HKDF-SHA256) + HKDF-SHA256 + AES-256-GCM\n// hpkeProvider.ts has no Node-specific imports and is safe in the browser entry point.\nexport { HpkeProvider, IHpkeSealResult } from './hpkeProvider';\n"]}
+{"version":3,"file":"index.browser.js","sourceRoot":"","sources":["../../../src/packlets/crypto-utils/index.browser.ts"],"names":[],"mappings":";AAAA,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,gFAAgF;AAChF,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEZ;;;;GAIG;AAEH,iCAAiC;AACjC,0CAAwB;AAExB,YAAY;AACZ,yCAMqB;AALnB,6GAAA,gBAAgB,OAAA;AAChB,8GAAA,iBAAiB,OAAA;AACjB,kHAAA,qBAAqB,OAAA;AACrB,8GAAA,iBAAiB,OAAA;AACjB,wGAAA,WAAW,OAAA;AAGb,gEAAgE;AAChE,iFAAiF;AACjF,mEAAqD;AAC5C,4BAAQ;AAEjB,uBAAuB;AACvB,yDAA2C;AAClC,gCAAU;AAEnB,6BAA6B;AAC7B,uEAAuG;AAA9F,oIAAA,wBAAwB,OAAA;AAEjC,8DAA8D;AAC9D,mEAA2F;AAAzD,gIAAA,sBAAsB,OAAA;AAExD,+EAA+E;AAC/E,oFAAoF;AACpF,2DAA6D;AAApD,2HAAA,qBAAqB,OAAA;AAE9B,8DAA8D;AAC9D,4DAA4D;AAE5D,yBAAyB;AACzB,iDAOyB;AANvB,oHAAA,mBAAmB,OAAA;AACnB,4GAAA,WAAW,OAAA;AACX,2GAAA,UAAU,OAAA;AAEV,yGAAA,QAAQ,OAAA;AACR,+GAAA,cAAc,OAAA;AAGhB,qCAAqC;AACrC,6CAYuB;AAXrB,mHAAA,oBAAoB,OAAA;AACpB,mHAAA,oBAAoB,OAAA;AACpB,6HAAA,8BAA8B,OAAA;AAC9B,wGAAA,SAAS,OAAA;AACT,wGAAA,SAAS,OAAA;AACT,+HAAA,gCAAgC,OAAA;AAChC,4HAAA,6BAA6B,OAAA;AAC7B,2HAAA,4BAA4B,OAAA;AAC5B,uHAAA,wBAAwB,OAAA;AACxB,uHAAA,wBAAwB,OAAA;AACxB,8GAAA,eAAe,OAAA;AAGjB,qFAAqF;AACrF,uFAAuF;AACvF,+CAA+D;AAAtD,4GAAA,YAAY,OAAA","sourcesContent":["// Copyright (c) 2024 Erik Fortune\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal\n// in the Software without restriction, including without limitation the rights\n// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n// copies of the Software, and to permit persons to whom the Software is\n// furnished to do so, subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all\n// copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n// SOFTWARE.\n\n/**\n * Crypto utilities for encrypted file handling and key management (browser version).\n * Note: For browser crypto provider, use \\@fgv/ts-web-extras.\n * @packageDocumentation\n */\n\n// Re-export all types from model\nexport * from './model';\n\n// Constants\nexport {\n  AES_256_KEY_SIZE,\n  DEFAULT_ALGORITHM,\n  ENCRYPTED_FILE_FORMAT,\n  GCM_AUTH_TAG_SIZE,\n  GCM_IV_SIZE\n} from './constants';\n\n// KeyStore namespace (browser-safe barrel — omits the Node-only\n// EncryptedFilePrivateKeyStorage so the browser entry stays free of node:crypto)\nimport * as KeyStore from './keystore/index.browser';\nexport { KeyStore };\n\n// Converters namespace\nimport * as Converters from './converters';\nexport { Converters };\n\n// Direct encryption provider\nexport { DirectEncryptionProvider, IDirectEncryptionProviderParams } from './directEncryptionProvider';\n\n// WebCrypto parameter table for asymmetric keypair algorithms\nexport { IKeyPairAlgorithmParams, keyPairAlgorithmParams } from './keyPairAlgorithmParams';\n\n// Deterministic seed → keypair derivation shared by the Node/browser providers\n// (globalThis.crypto.subtle only — no node:crypto, safe in the browser entry point)\nexport { deriveKeyPairFromSeed } from './seedDerivedKeyPair';\n\n// Note: NodeCryptoProvider is NOT exported in browser version\n// Use BrowserCryptoProvider from @fgv/ts-web-extras instead\n\n// Encrypted file helpers\nexport {\n  createEncryptedFile,\n  decryptFile,\n  fromBase64,\n  ICreateEncryptedFileParams,\n  toBase64,\n  tryDecryptFile\n} from './encryptedFile';\n\n// Multibase/SPKI + base64url helpers\nexport {\n  base64UrlNoPadDecode,\n  base64UrlNoPadEncode,\n  exportPublicKeyAsMultibaseSpki,\n  hexDecode,\n  hexEncode,\n  importPublicKeyFromMultibaseSpki,\n  isValidMultibaseSpkiPublicKey,\n  MultibaseSpkiPublicKeyRegExp,\n  multibaseBase64UrlDecode,\n  multibaseBase64UrlEncode,\n  spkiToRawX25519\n} from './spkiHelpers';\n\n// HPKE base mode (RFC 9180) — DHKEM(X25519, HKDF-SHA256) + HKDF-SHA256 + AES-256-GCM\n// hpkeProvider.ts has no Node-specific imports and is safe in the browser entry point.\nexport { HpkeProvider, IHpkeSealResult } from './hpkeProvider';\n"]}

package/lib/packlets/crypto-utils/index.d.ts

@@ -11,8 +11,9 @@ import * as Converters from './converters';
 export { Converters };
 export { DirectEncryptionProvider, IDirectEncryptionProviderParams } from './directEncryptionProvider';
 export { IKeyPairAlgorithmParams, keyPairAlgorithmParams } from './keyPairAlgorithmParams';
+export { deriveKeyPairFromSeed } from './seedDerivedKeyPair';
 export { NodeCryptoProvider, nodeCryptoProvider } from './nodeCryptoProvider';
 export { createEncryptedFile, decryptFile, fromBase64, ICreateEncryptedFileParams, toBase64, tryDecryptFile } from './encryptedFile';
-export { base64UrlNoPadDecode, base64UrlNoPadEncode, exportPublicKeyAsMultibaseSpki, importPublicKeyFromMultibaseSpki, isValidMultibaseSpkiPublicKey, MultibaseSpkiPublicKeyRegExp, multibaseBase64UrlDecode, multibaseBase64UrlEncode, spkiToRawX25519 } from './spkiHelpers';
+export { base64UrlNoPadDecode, base64UrlNoPadEncode, exportPublicKeyAsMultibaseSpki, hexDecode, hexEncode, importPublicKeyFromMultibaseSpki, isValidMultibaseSpkiPublicKey, MultibaseSpkiPublicKeyRegExp, multibaseBase64UrlDecode, multibaseBase64UrlEncode, spkiToRawX25519 } from './spkiHelpers';
 export { HpkeProvider, IHpkeSealResult } from './hpkeProvider';
 //# sourceMappingURL=index.d.ts.map

package/lib/packlets/crypto-utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/packlets/crypto-utils/index.ts"],"names":[],"mappings":"AAoBA;;;GAGG;AAGH,cAAc,SAAS,CAAC;AAGxB,OAAO,KAAK,SAAS,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,CAAC;AAGrB,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,CAAC;AAGpB,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,CAAC;AAGtB,OAAO,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAC;AAGvG,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAG3F,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG9E,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,UAAU,EACV,0BAA0B,EAC1B,QAAQ,EACR,cAAc,EACf,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,8BAA8B,EAC9B,gCAAgC,EAChC,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,eAAe,EAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/packlets/crypto-utils/index.ts"],"names":[],"mappings":"AAoBA;;;GAGG;AAGH,cAAc,SAAS,CAAC;AAGxB,OAAO,KAAK,SAAS,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,CAAC;AAGrB,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,CAAC;AAGpB,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,CAAC;AAGtB,OAAO,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAC;AAGvG,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAG3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG7D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG9E,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,UAAU,EACV,0BAA0B,EAC1B,QAAQ,EACR,cAAc,EACf,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,8BAA8B,EAC9B,SAAS,EACT,SAAS,EACT,gCAAgC,EAChC,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,eAAe,EAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC"}

package/lib/packlets/crypto-utils/index.js

@@ -55,7 +55,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HpkeProvider = exports.spkiToRawX25519 = exports.multibaseBase64UrlEncode = exports.multibaseBase64UrlDecode = exports.MultibaseSpkiPublicKeyRegExp = exports.isValidMultibaseSpkiPublicKey = exports.importPublicKeyFromMultibaseSpki = exports.exportPublicKeyAsMultibaseSpki = exports.base64UrlNoPadEncode = exports.base64UrlNoPadDecode = exports.tryDecryptFile = exports.toBase64 = exports.fromBase64 = exports.decryptFile = exports.createEncryptedFile = exports.nodeCryptoProvider = exports.NodeCryptoProvider = exports.keyPairAlgorithmParams = exports.DirectEncryptionProvider = exports.Converters = exports.KeyStore = exports.Constants = void 0;
+exports.HpkeProvider = exports.spkiToRawX25519 = exports.multibaseBase64UrlEncode = exports.multibaseBase64UrlDecode = exports.MultibaseSpkiPublicKeyRegExp = exports.isValidMultibaseSpkiPublicKey = exports.importPublicKeyFromMultibaseSpki = exports.hexEncode = exports.hexDecode = exports.exportPublicKeyAsMultibaseSpki = exports.base64UrlNoPadEncode = exports.base64UrlNoPadDecode = exports.tryDecryptFile = exports.toBase64 = exports.fromBase64 = exports.decryptFile = exports.createEncryptedFile = exports.nodeCryptoProvider = exports.NodeCryptoProvider = exports.deriveKeyPairFromSeed = exports.keyPairAlgorithmParams = exports.DirectEncryptionProvider = exports.Converters = exports.KeyStore = exports.Constants = void 0;
 /**
  * Crypto utilities for encrypted file handling and key management.
  * @packageDocumentation
@@ -77,6 +77,9 @@ Object.defineProperty(exports, "DirectEncryptionProvider", { enumerable: true, g
 // WebCrypto parameter table for asymmetric keypair algorithms
 var keyPairAlgorithmParams_1 = require("./keyPairAlgorithmParams");
 Object.defineProperty(exports, "keyPairAlgorithmParams", { enumerable: true, get: function () { return keyPairAlgorithmParams_1.keyPairAlgorithmParams; } });
+// Deterministic seed → keypair derivation shared by the Node/browser providers
+var seedDerivedKeyPair_1 = require("./seedDerivedKeyPair");
+Object.defineProperty(exports, "deriveKeyPairFromSeed", { enumerable: true, get: function () { return seedDerivedKeyPair_1.deriveKeyPairFromSeed; } });
 // Node.js crypto provider (Node.js environment only)
 var nodeCryptoProvider_1 = require("./nodeCryptoProvider");
 Object.defineProperty(exports, "NodeCryptoProvider", { enumerable: true, get: function () { return nodeCryptoProvider_1.NodeCryptoProvider; } });
@@ -93,6 +96,8 @@ var spkiHelpers_1 = require("./spkiHelpers");
 Object.defineProperty(exports, "base64UrlNoPadDecode", { enumerable: true, get: function () { return spkiHelpers_1.base64UrlNoPadDecode; } });
 Object.defineProperty(exports, "base64UrlNoPadEncode", { enumerable: true, get: function () { return spkiHelpers_1.base64UrlNoPadEncode; } });
 Object.defineProperty(exports, "exportPublicKeyAsMultibaseSpki", { enumerable: true, get: function () { return spkiHelpers_1.exportPublicKeyAsMultibaseSpki; } });
+Object.defineProperty(exports, "hexDecode", { enumerable: true, get: function () { return spkiHelpers_1.hexDecode; } });
+Object.defineProperty(exports, "hexEncode", { enumerable: true, get: function () { return spkiHelpers_1.hexEncode; } });
 Object.defineProperty(exports, "importPublicKeyFromMultibaseSpki", { enumerable: true, get: function () { return spkiHelpers_1.importPublicKeyFromMultibaseSpki; } });
 Object.defineProperty(exports, "isValidMultibaseSpkiPublicKey", { enumerable: true, get: function () { return spkiHelpers_1.isValidMultibaseSpkiPublicKey; } });
 Object.defineProperty(exports, "MultibaseSpkiPublicKeyRegExp", { enumerable: true, get: function () { return spkiHelpers_1.MultibaseSpkiPublicKeyRegExp; } });

package/lib/packlets/crypto-utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/packlets/crypto-utils/index.ts"],"names":[],"mappings":";AAAA,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,gFAAgF;AAChF,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEZ;;;GAGG;AAEH,iCAAiC;AACjC,0CAAwB;AAExB,YAAY;AACZ,uDAAyC;AAChC,8BAAS;AAElB,qBAAqB;AACrB,qDAAuC;AAC9B,4BAAQ;AAEjB,uBAAuB;AACvB,yDAA2C;AAClC,gCAAU;AAEnB,6BAA6B;AAC7B,uEAAuG;AAA9F,oIAAA,wBAAwB,OAAA;AAEjC,8DAA8D;AAC9D,mEAA2F;AAAzD,gIAAA,sBAAsB,OAAA;AAExD,qDAAqD;AACrD,2DAA8E;AAArE,wHAAA,kBAAkB,OAAA;AAAE,wHAAA,kBAAkB,OAAA;AAE/C,yBAAyB;AACzB,iDAOyB;AANvB,oHAAA,mBAAmB,OAAA;AACnB,4GAAA,WAAW,OAAA;AACX,2GAAA,UAAU,OAAA;AAEV,yGAAA,QAAQ,OAAA;AACR,+GAAA,cAAc,OAAA;AAGhB,qCAAqC;AACrC,6CAUuB;AATrB,mHAAA,oBAAoB,OAAA;AACpB,mHAAA,oBAAoB,OAAA;AACpB,6HAAA,8BAA8B,OAAA;AAC9B,+HAAA,gCAAgC,OAAA;AAChC,4HAAA,6BAA6B,OAAA;AAC7B,2HAAA,4BAA4B,OAAA;AAC5B,uHAAA,wBAAwB,OAAA;AACxB,uHAAA,wBAAwB,OAAA;AACxB,8GAAA,eAAe,OAAA;AAGjB,qFAAqF;AACrF,+CAA+D;AAAtD,4GAAA,YAAY,OAAA","sourcesContent":["// Copyright (c) 2024 Erik Fortune\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal\n// in the Software without restriction, including without limitation the rights\n// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n// copies of the Software, and to permit persons to whom the Software is\n// furnished to do so, subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all\n// copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n// SOFTWARE.\n\n/**\n * Crypto utilities for encrypted file handling and key management.\n * @packageDocumentation\n */\n\n// Re-export all types from model\nexport * from './model';\n\n// Constants\nimport * as Constants from './constants';\nexport { Constants };\n\n// KeyStore namespace\nimport * as KeyStore from './keystore';\nexport { KeyStore };\n\n// Converters namespace\nimport * as Converters from './converters';\nexport { Converters };\n\n// Direct encryption provider\nexport { DirectEncryptionProvider, IDirectEncryptionProviderParams } from './directEncryptionProvider';\n\n// WebCrypto parameter table for asymmetric keypair algorithms\nexport { IKeyPairAlgorithmParams, keyPairAlgorithmParams } from './keyPairAlgorithmParams';\n\n// Node.js crypto provider (Node.js environment only)\nexport { NodeCryptoProvider, nodeCryptoProvider } from './nodeCryptoProvider';\n\n// Encrypted file helpers\nexport {\n  createEncryptedFile,\n  decryptFile,\n  fromBase64,\n  ICreateEncryptedFileParams,\n  toBase64,\n  tryDecryptFile\n} from './encryptedFile';\n\n// Multibase/SPKI + base64url helpers\nexport {\n  base64UrlNoPadDecode,\n  base64UrlNoPadEncode,\n  exportPublicKeyAsMultibaseSpki,\n  importPublicKeyFromMultibaseSpki,\n  isValidMultibaseSpkiPublicKey,\n  MultibaseSpkiPublicKeyRegExp,\n  multibaseBase64UrlDecode,\n  multibaseBase64UrlEncode,\n  spkiToRawX25519\n} from './spkiHelpers';\n\n// HPKE base mode (RFC 9180) — DHKEM(X25519, HKDF-SHA256) + HKDF-SHA256 + AES-256-GCM\nexport { HpkeProvider, IHpkeSealResult } from './hpkeProvider';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/packlets/crypto-utils/index.ts"],"names":[],"mappings":";AAAA,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,gFAAgF;AAChF,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEZ;;;GAGG;AAEH,iCAAiC;AACjC,0CAAwB;AAExB,YAAY;AACZ,uDAAyC;AAChC,8BAAS;AAElB,qBAAqB;AACrB,qDAAuC;AAC9B,4BAAQ;AAEjB,uBAAuB;AACvB,yDAA2C;AAClC,gCAAU;AAEnB,6BAA6B;AAC7B,uEAAuG;AAA9F,oIAAA,wBAAwB,OAAA;AAEjC,8DAA8D;AAC9D,mEAA2F;AAAzD,gIAAA,sBAAsB,OAAA;AAExD,+EAA+E;AAC/E,2DAA6D;AAApD,2HAAA,qBAAqB,OAAA;AAE9B,qDAAqD;AACrD,2DAA8E;AAArE,wHAAA,kBAAkB,OAAA;AAAE,wHAAA,kBAAkB,OAAA;AAE/C,yBAAyB;AACzB,iDAOyB;AANvB,oHAAA,mBAAmB,OAAA;AACnB,4GAAA,WAAW,OAAA;AACX,2GAAA,UAAU,OAAA;AAEV,yGAAA,QAAQ,OAAA;AACR,+GAAA,cAAc,OAAA;AAGhB,qCAAqC;AACrC,6CAYuB;AAXrB,mHAAA,oBAAoB,OAAA;AACpB,mHAAA,oBAAoB,OAAA;AACpB,6HAAA,8BAA8B,OAAA;AAC9B,wGAAA,SAAS,OAAA;AACT,wGAAA,SAAS,OAAA;AACT,+HAAA,gCAAgC,OAAA;AAChC,4HAAA,6BAA6B,OAAA;AAC7B,2HAAA,4BAA4B,OAAA;AAC5B,uHAAA,wBAAwB,OAAA;AACxB,uHAAA,wBAAwB,OAAA;AACxB,8GAAA,eAAe,OAAA;AAGjB,qFAAqF;AACrF,+CAA+D;AAAtD,4GAAA,YAAY,OAAA","sourcesContent":["// Copyright (c) 2024 Erik Fortune\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal\n// in the Software without restriction, including without limitation the rights\n// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n// copies of the Software, and to permit persons to whom the Software is\n// furnished to do so, subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all\n// copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n// SOFTWARE.\n\n/**\n * Crypto utilities for encrypted file handling and key management.\n * @packageDocumentation\n */\n\n// Re-export all types from model\nexport * from './model';\n\n// Constants\nimport * as Constants from './constants';\nexport { Constants };\n\n// KeyStore namespace\nimport * as KeyStore from './keystore';\nexport { KeyStore };\n\n// Converters namespace\nimport * as Converters from './converters';\nexport { Converters };\n\n// Direct encryption provider\nexport { DirectEncryptionProvider, IDirectEncryptionProviderParams } from './directEncryptionProvider';\n\n// WebCrypto parameter table for asymmetric keypair algorithms\nexport { IKeyPairAlgorithmParams, keyPairAlgorithmParams } from './keyPairAlgorithmParams';\n\n// Deterministic seed → keypair derivation shared by the Node/browser providers\nexport { deriveKeyPairFromSeed } from './seedDerivedKeyPair';\n\n// Node.js crypto provider (Node.js environment only)\nexport { NodeCryptoProvider, nodeCryptoProvider } from './nodeCryptoProvider';\n\n// Encrypted file helpers\nexport {\n  createEncryptedFile,\n  decryptFile,\n  fromBase64,\n  ICreateEncryptedFileParams,\n  toBase64,\n  tryDecryptFile\n} from './encryptedFile';\n\n// Multibase/SPKI + base64url helpers\nexport {\n  base64UrlNoPadDecode,\n  base64UrlNoPadEncode,\n  exportPublicKeyAsMultibaseSpki,\n  hexDecode,\n  hexEncode,\n  importPublicKeyFromMultibaseSpki,\n  isValidMultibaseSpkiPublicKey,\n  MultibaseSpkiPublicKeyRegExp,\n  multibaseBase64UrlDecode,\n  multibaseBase64UrlEncode,\n  spkiToRawX25519\n} from './spkiHelpers';\n\n// HPKE base mode (RFC 9180) — DHKEM(X25519, HKDF-SHA256) + HKDF-SHA256 + AES-256-GCM\nexport { HpkeProvider, IHpkeSealResult } from './hpkeProvider';\n"]}

package/lib/packlets/crypto-utils/keystore/converters.d.ts

@@ -13,7 +13,7 @@ export declare const keystoreFormat: Converter<KeyStoreFormat>;
 export declare const keystoreSecretType: Converter<KeyStoreSecretType>;
 /**
  * Converter for {@link CryptoUtils.KeyStore.KeyStoreSymmetricSecretType | symmetric secret type} discriminator.
- * Accepts only `'encryption-key'` and `'api-key'`.
+ * Accepts `'encryption-key'`, `'api-key'`, and `'opaque'`.
  * @public
  */
 export declare const keystoreSymmetricSecretType: Converter<KeyStoreSymmetricSecretType>;

package/lib/packlets/crypto-utils/keystore/converters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converters.d.ts","sourceRoot":"","sources":["../../../../src/packlets/crypto-utils/keystore/converters.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,SAAS,EAAmC,SAAS,EAAc,MAAM,eAAe,CAAC;AAElG,OAAO,EAKL,4BAA4B,EAC5B,kBAAkB,EAClB,aAAa,EACb,2BAA2B,EAC3B,sBAAsB,EACtB,gBAAgB,EAChB,4BAA4B,EAC5B,cAAc,EACd,kBAAkB,EAClB,2BAA2B,EAE5B,MAAM,SAAS,CAAC;AAMjB;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,CAAC,cAAc,CACW,CAAC;AAMjE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,CACW,CAAC;AAEzE;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,CAAC,2BAA2B,CACW,CAAC;AAE3F;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,CAAC,4BAA4B,CACW,CAAC;AAM7F;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,CACW,CAAC;AAMrE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,CAAC,UAAU,CAEE,CAAC;AAMrD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,CAAC,2BAA2B,CAmB3E,CAAC;AAMJ;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,CAAC,4BAA4B,CAU5E,CAAC;AAML;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,CAAC,kBAAkB,CAGhE,CAAC;AAMH;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,CAAC,sBAAsB,CAIhE,CAAC;AAML;;;GAGG;AACH,eAAO,MAAM,YAAY,EAAE,SAAS,CAAC,aAAa,CAOhD,CAAC"}
+{"version":3,"file":"converters.d.ts","sourceRoot":"","sources":["../../../../src/packlets/crypto-utils/keystore/converters.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,SAAS,EAAmC,SAAS,EAAc,MAAM,eAAe,CAAC;AAGlG,OAAO,EAKL,4BAA4B,EAC5B,kBAAkB,EAClB,aAAa,EACb,2BAA2B,EAC3B,sBAAsB,EACtB,gBAAgB,EAChB,4BAA4B,EAC5B,cAAc,EACd,kBAAkB,EAClB,2BAA2B,EAE5B,MAAM,SAAS,CAAC;AAMjB;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,CAAC,cAAc,CACW,CAAC;AAMjE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,CACW,CAAC;AAEzE;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,CAAC,2BAA2B,CACW,CAAC;AAE3F;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,CAAC,4BAA4B,CACW,CAAC;AAM7F;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,CACW,CAAC;AAMrE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,CAAC,UAAU,CAEE,CAAC;AAMrD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,CAAC,2BAA2B,CAsB3E,CAAC;AAMJ;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,CAAC,4BAA4B,CAU5E,CAAC;AAML;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,CAAC,kBAAkB,CAGhE,CAAC;AAMH;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,CAAC,sBAAsB,CAIhE,CAAC;AAML;;;GAGG;AACH,eAAO,MAAM,YAAY,EAAE,SAAS,CAAC,aAAa,CAOhD,CAAC"}

package/lib/packlets/crypto-utils/keystore/converters.js

@@ -21,6 +21,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.keystoreFile = exports.keystoreVaultContents = exports.keystoreSecretEntryJson = exports.keystoreAsymmetricEntryJson = exports.keystoreSymmetricEntryJson = exports.jsonWebKeyShape = exports.keyPairAlgorithm = exports.keystoreAsymmetricSecretType = exports.keystoreSymmetricSecretType = exports.keystoreSecretType = exports.keystoreFormat = void 0;
 const ts_utils_1 = require("@fgv/ts-utils");
+const ts_json_base_1 = require("@fgv/ts-json-base");
 const converters_1 = require("../converters");
 const model_1 = require("./model");
 // ============================================================================
@@ -42,7 +43,7 @@ exports.keystoreFormat = ts_utils_1.Converters.enumeratedValue(model_1.allKeySto
 exports.keystoreSecretType = ts_utils_1.Converters.enumeratedValue(model_1.allKeyStoreSecretTypes);
 /**
  * Converter for {@link CryptoUtils.KeyStore.KeyStoreSymmetricSecretType | symmetric secret type} discriminator.
- * Accepts only `'encryption-key'` and `'api-key'`.
+ * Accepts `'encryption-key'`, `'api-key'`, and `'opaque'`.
  * @public
  */
 exports.keystoreSymmetricSecretType = ts_utils_1.Converters.enumeratedValue(model_1.allKeyStoreSymmetricSecretTypes);
@@ -105,11 +106,14 @@ exports.keystoreSymmetricEntryJson = ts_utils_1.Converters.object({
     type: exports.keystoreSymmetricSecretType,
     key: converters_1.base64String,
     description: ts_utils_1.Converters.string,
-    createdAt: ts_utils_1.Converters.string
+    metadata: ts_json_base_1.Converters.jsonValue,
+    createdAt: ts_utils_1.Converters.string,
+    updatedAt: ts_utils_1.Converters.string
 }, {
     // `type` is optional at the input layer for legacy-vault compatibility;
-    // the .map() below normalizes by injecting the default.
-    optionalFields: ['type', 'description']
+    // the .map() below normalizes by injecting the default. `metadata` and
+    // `updatedAt` are keystore-v3 additions, optional so v1/v2 entries parse.
+    optionalFields: ['type', 'description', 'metadata', 'updatedAt']
 }).map((entry) => {
     var _a;
     return (0, ts_utils_1.succeed)(Object.assign(Object.assign({}, entry), { type: (_a = entry.type) !== null && _a !== void 0 ? _a : 'encryption-key' }));