@haex-space/vault-sdk 2.3.15 → 2.3.16

package/dist/index.d.mts

@@ -267,6 +267,17 @@ declare function encryptCrdtData(data: object, vaultKey: Uint8Array): Promise<{
     encryptedData: string;
     nonce: string;
 }>;
+/**
+ * Wraps (encrypts) a key with another key using AES-GCM
+ * Used for key hierarchies (e.g., master key -> space key -> file key)
+ * Returns: nonce (12 bytes) + ciphertext as Uint8Array
+ */
+declare function wrapKey(keyToWrap: Uint8Array, wrappingKey: Uint8Array): Promise<Uint8Array>;
+/**
+ * Unwraps (decrypts) a key with another key using AES-GCM
+ * Expects: nonce (12 bytes) + ciphertext as Uint8Array
+ */
+declare function unwrapKey(wrappedKey: Uint8Array, wrappingKey: Uint8Array): Promise<Uint8Array>;
 /**
  * Decrypts CRDT log data with the vault key
  */
@@ -276,4 +287,4 @@ declare function base64ToArrayBuffer(base64: string): Uint8Array;
 
 declare function createHaexVaultClient(config?: HaexHubConfig): HaexVaultClient;
 
-export { ExtensionManifest, HAEXSPACE_MESSAGE_TYPES, HAEXTENSION_METHODS, HaexHubConfig, HaexVaultClient, type HaexspaceMessageType, type HaextensionMethod, type VerifyResult, type ZipFileEntry, arrayBufferToBase64, base64ToArrayBuffer, createHaexVaultClient, decryptCrdtData, decryptString, decryptVaultKey, decryptVaultName, deriveKeyFromPassword, encryptCrdtData, encryptString, encryptVaultKey, generateVaultKey, hexToBytes, installBaseTag, installCookiePolyfill, installHistoryPolyfill, installLocalStoragePolyfill, installPolyfills, installSessionStoragePolyfill, sortObjectKeysRecursively, verifyExtensionSignature };
+export { ExtensionManifest, HAEXSPACE_MESSAGE_TYPES, HAEXTENSION_METHODS, HaexHubConfig, HaexVaultClient, type HaexspaceMessageType, type HaextensionMethod, type VerifyResult, type ZipFileEntry, arrayBufferToBase64, base64ToArrayBuffer, createHaexVaultClient, decryptCrdtData, decryptString, decryptVaultKey, decryptVaultName, deriveKeyFromPassword, encryptCrdtData, encryptString, encryptVaultKey, generateVaultKey, hexToBytes, installBaseTag, installCookiePolyfill, installHistoryPolyfill, installLocalStoragePolyfill, installPolyfills, installSessionStoragePolyfill, sortObjectKeysRecursively, unwrapKey, verifyExtensionSignature, wrapKey };

package/dist/index.d.ts

@@ -267,6 +267,17 @@ declare function encryptCrdtData(data: object, vaultKey: Uint8Array): Promise<{
     encryptedData: string;
     nonce: string;
 }>;
+/**
+ * Wraps (encrypts) a key with another key using AES-GCM
+ * Used for key hierarchies (e.g., master key -> space key -> file key)
+ * Returns: nonce (12 bytes) + ciphertext as Uint8Array
+ */
+declare function wrapKey(keyToWrap: Uint8Array, wrappingKey: Uint8Array): Promise<Uint8Array>;
+/**
+ * Unwraps (decrypts) a key with another key using AES-GCM
+ * Expects: nonce (12 bytes) + ciphertext as Uint8Array
+ */
+declare function unwrapKey(wrappedKey: Uint8Array, wrappingKey: Uint8Array): Promise<Uint8Array>;
 /**
  * Decrypts CRDT log data with the vault key
  */
@@ -276,4 +287,4 @@ declare function base64ToArrayBuffer(base64: string): Uint8Array;
 
 declare function createHaexVaultClient(config?: HaexHubConfig): HaexVaultClient;
 
-export { ExtensionManifest, HAEXSPACE_MESSAGE_TYPES, HAEXTENSION_METHODS, HaexHubConfig, HaexVaultClient, type HaexspaceMessageType, type HaextensionMethod, type VerifyResult, type ZipFileEntry, arrayBufferToBase64, base64ToArrayBuffer, createHaexVaultClient, decryptCrdtData, decryptString, decryptVaultKey, decryptVaultName, deriveKeyFromPassword, encryptCrdtData, encryptString, encryptVaultKey, generateVaultKey, hexToBytes, installBaseTag, installCookiePolyfill, installHistoryPolyfill, installLocalStoragePolyfill, installPolyfills, installSessionStoragePolyfill, sortObjectKeysRecursively, verifyExtensionSignature };
+export { ExtensionManifest, HAEXSPACE_MESSAGE_TYPES, HAEXTENSION_METHODS, HaexHubConfig, HaexVaultClient, type HaexspaceMessageType, type HaextensionMethod, type VerifyResult, type ZipFileEntry, arrayBufferToBase64, base64ToArrayBuffer, createHaexVaultClient, decryptCrdtData, decryptString, decryptVaultKey, decryptVaultName, deriveKeyFromPassword, encryptCrdtData, encryptString, encryptVaultKey, generateVaultKey, hexToBytes, installBaseTag, installCookiePolyfill, installHistoryPolyfill, installLocalStoragePolyfill, installPolyfills, installSessionStoragePolyfill, sortObjectKeysRecursively, unwrapKey, verifyExtensionSignature, wrapKey };

package/dist/index.js

@@ -1980,6 +1980,42 @@ async function encryptCrdtData(data, vaultKey) {
     nonce: arrayBufferToBase64(nonce)
   };
 }
+async function wrapKey(keyToWrap, wrappingKey) {
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    new Uint8Array(wrappingKey),
+    { name: ALGORITHM },
+    false,
+    ["encrypt"]
+  );
+  const nonce = crypto.getRandomValues(new Uint8Array(12));
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: ALGORITHM, iv: nonce },
+    cryptoKey,
+    new Uint8Array(keyToWrap)
+  );
+  const result = new Uint8Array(12 + ciphertext.byteLength);
+  result.set(nonce, 0);
+  result.set(new Uint8Array(ciphertext), 12);
+  return result;
+}
+async function unwrapKey(wrappedKey, wrappingKey) {
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    new Uint8Array(wrappingKey),
+    { name: ALGORITHM },
+    false,
+    ["decrypt"]
+  );
+  const nonce = wrappedKey.slice(0, 12);
+  const ciphertext = wrappedKey.slice(12);
+  const plaintext = await crypto.subtle.decrypt(
+    { name: ALGORITHM, iv: nonce },
+    cryptoKey,
+    ciphertext
+  );
+  return new Uint8Array(plaintext);
+}
 async function decryptCrdtData(encryptedData, nonce, vaultKey) {
   const vaultKeyBuffer = new Uint8Array(vaultKey);
   const cryptoKey = await crypto.subtle.importKey(
@@ -2071,6 +2107,8 @@ exports.installLocalStoragePolyfill = installLocalStoragePolyfill;
 exports.installPolyfills = installPolyfills;
 exports.installSessionStoragePolyfill = installSessionStoragePolyfill;
 exports.sortObjectKeysRecursively = sortObjectKeysRecursively;
+exports.unwrapKey = unwrapKey;
 exports.verifyExtensionSignature = verifyExtensionSignature;
+exports.wrapKey = wrapKey;
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map