@happyvertical/encryption 0.111.5 → 0.111.7

package/AGENT.md

@@ -30,3 +30,12 @@ pnpm --filter @happyvertical/encryption typecheck
 - Requires: @happyvertical/logger, @happyvertical/utils, @openpgp/web-stream-tools, openpgp, tweetnacl, tweetnacl-util
 - Stability: stable (Primary package surface is described as implemented and production-oriented.)
 <!-- END AGENT:GENERATED -->
+
+
+## Vault snapshots
+
+Import `sealVaultSnapshot` and `openVaultSnapshot` from
+`@happyvertical/encryption/vault-snapshot` for bounded user-key-encrypted bytes. Supply trusted account, device, and sequence context when
+opening, and scope the single key lookup to that account. The
+[v1 wire specification](./README.md#version-1-wire-format) describes framing,
+limits, and Kotlin interoperability vectors.

package/README.md

@@ -137,6 +137,79 @@ const encrypted = await rsaEncryption.encryptText('Small message');
 const decrypted = await rsaEncryption.decryptText(encrypted);
 ```
 
+## Vault snapshot envelopes
+
+```typescript
+import { openVaultSnapshot, sealVaultSnapshot } from '@happyvertical/encryption/vault-snapshot';
+```
+
+`sealVaultSnapshot(snapshot, { key, keyId, context, compression })` and
+`openVaultSnapshot(envelope, { context, resolveKey })` are synchronous Node.js
+byte APIs. The key is a raw 32-byte user key dedicated to snapshot envelopes.
+The key ID is an opaque 16-byte identifier encoded as 32 lowercase hexadecimal
+digits in TypeScript. Supply the expected `{ accountId, deviceId, sequence }`
+independently when opening. Scope `resolveKey(keyId)` to that account and return
+`undefined` for an unknown ID. A syntactically valid envelope can trigger one
+lookup with an untrusted ID. Opening returns bytes only after authentication and
+validation succeed.
+
+Compression is optional and defaults to `none`. Use `zlib` for snapshots where
+revealing the resulting size is acceptable. Envelope length is public in both
+modes, and compression can reveal relationships between attacker-controlled and
+secret bytes. Account and device IDs and the sequence are encrypted. Callers
+that require replay or rollback protection must track which sequences are
+acceptable in their trusted state. Every seal generates a fresh random nonce.
+
+### Version 1 wire format
+
+The envelope is a binary byte array with a 47-byte clear header followed by
+the combined output of
+[NaCl XSalsa20-Poly1305 secretbox](https://doc.libsodium.org/secret-key_cryptography/secretbox)
+(`crypto_secretbox_easy` in libsodium). The output begins with its 16-byte
+authentication tag and continues with the encrypted message to end of input.
+
+| Header offset | Size | Value |
+| --- | --- | --- |
+| 0 | 4 | ASCII `HVSE` (`48 56 53 45`) |
+| 4 | 1 | Version `01` |
+| 5 | 1 | Algorithm `01` (XSalsa20-Poly1305 secretbox) |
+| 6 | 1 | Compression `00` for raw bytes or `01` for zlib |
+| 7 | 16 | Raw opaque key ID bytes, in the same order as the hex encoding |
+| 23 | 24 | Secretbox nonce |
+
+The authenticated message is this exact concatenation:
+
+```text
+clear header (47 bytes)
+account ID UTF-8 byte length (uint8) || account ID UTF-8 bytes
+device ID UTF-8 byte length (uint8) || device ID UTF-8 bytes
+sequence (uint64 big-endian)
+payload (to end of message)
+```
+
+Each ID is 1 to 255 bytes of valid UTF-8, with exact byte matching and no Unicode
+normalization. For Kotlin, convert byte lengths to unsigned values and interpret
+the eight sequence bytes as a big-endian `ULong` (TypeScript `bigint`).
+Compression `01` is one [RFC 1950](https://www.rfc-editor.org/rfc/rfc1950)
+zlib stream with DEFLATE, checksum and no preset dictionary. A JVM reader can
+use `Inflater(false)` with an output limit and check `finished()` and zero
+remaining input. Different compressors may produce different valid payload bytes.
+
+Reject unknown header values, envelope lengths outside 122 to 8,454,774 bytes,
+and payload lengths outside the mode limits. A v1 envelope holds at most
+8,388,608 decoded bytes (8 MiB). The raw payload has the same cap. The compressed
+payload cap is 8,454,144 bytes. These are fixed v1 limits for a single in-memory
+envelope. Open secretbox with the clear nonce and the one key identified by the
+header. Compare the authenticated header and context prefix against the clear
+header and independently supplied expected context, then decode the payload.
+For zlib, reject truncated streams, dictionaries, invalid checksums, trailing
+bytes and output above the decoded limit.
+
+The [v1 interoperability vectors](./vault-snapshot-v1-vectors.json) were generated
+with libsodium via PyNaCl and Python zlib. They include the test key, raw IDs and
+sequence, encoded context, snapshot, nonce, encoded payload and full envelope
+for both modes. The fixed keys and nonces are for testing.
+
 ## Common Use Cases
 
 ### Email Encryption (PGP/MIME)

package/dist/chunks/base-COUQhj5x.js

@@ -0,0 +1,100 @@
+import { n as DecryptError, o as InvalidKeyError, r as EncryptError, s as KeyError } from "./errors-Q_wX_NMz.js";
+import { readFile, writeFile } from "node:fs/promises";
+//#region src/shared/base.ts
+/**
+* Base adapter class that provides common functionality for all encryption adapters
+*/
+var BaseEncryption = class {
+	adapterType;
+	debug;
+	constructor(adapterType, debug = false) {
+		this.adapterType = adapterType;
+		this.debug = debug;
+	}
+	/**
+	* Get the adapter type
+	*/
+	getAdapter() {
+		return this.adapterType;
+	}
+	/**
+	* Log debug messages if debug mode is enabled
+	*/
+	log(message, ...args) {
+		if (this.debug) console.log(`[${this.adapterType}] ${message}`, ...args);
+	}
+	/**
+	* Validate that a key is provided
+	*/
+	validateKey(key, keyType) {
+		if (!key) throw new KeyError(`${keyType} key is required but was not provided`, this.adapterType);
+		if (typeof key === "string" && key.trim().length === 0) throw new InvalidKeyError(`${keyType} key cannot be empty`, this.adapterType);
+		if (Buffer.isBuffer(key) && key.length === 0) throw new InvalidKeyError(`${keyType} key cannot be empty`, this.adapterType);
+		if (key instanceof Uint8Array && key.length === 0) throw new InvalidKeyError(`${keyType} key cannot be empty`, this.adapterType);
+	}
+	/**
+	* Validate encryption options
+	*/
+	validateEncryptOptions(options) {
+		if (!options) return;
+		if (options.encoding && ![
+			"base64",
+			"hex",
+			"utf8"
+		].includes(options.encoding)) throw new Error(`Invalid encoding: ${options.encoding}. Must be 'base64', 'hex', or 'utf8'`);
+	}
+	/**
+	* Validate decryption options
+	*/
+	validateDecryptOptions(options) {
+		if (!options) return;
+		if (options.encoding && ![
+			"base64",
+			"hex",
+			"utf8"
+		].includes(options.encoding)) throw new Error(`Invalid encoding: ${options.encoding}. Must be 'base64', 'hex', or 'utf8'`);
+	}
+	/**
+	* Convert Buffer to string based on encoding
+	*/
+	bufferToString(buffer, encoding = "base64") {
+		return buffer.toString(encoding);
+	}
+	/**
+	* Convert string to Buffer based on encoding
+	*/
+	stringToBuffer(str, encoding = "base64") {
+		return Buffer.from(str, encoding);
+	}
+	/**
+	* Wrap errors with adapter context
+	*/
+	wrapError(error, operation) {
+		if (error instanceof Error) return error;
+		return /* @__PURE__ */ new Error(`${operation} failed in ${this.adapterType} adapter: ${String(error)}`);
+	}
+	async encryptFile(inputPath, outputPath, options) {
+		try {
+			this.log(`Encrypting file: ${inputPath} -> ${outputPath}`);
+			const input = await readFile(inputPath);
+			await writeFile(outputPath, await this.encryptBuffer(input, options));
+			this.log(`File encrypted successfully: ${outputPath}`);
+		} catch (error) {
+			throw new EncryptError(`Failed to encrypt file: ${error.message}`, this.adapterType, error);
+		}
+	}
+	async decryptFile(inputPath, outputPath, options) {
+		try {
+			this.log(`Decrypting file: ${inputPath} -> ${outputPath}`);
+			const input = await readFile(inputPath);
+			await writeFile(outputPath, await this.decryptBuffer(input, options));
+			this.log(`File decrypted successfully: ${outputPath}`);
+		} catch (error) {
+			throw new DecryptError(`Failed to decrypt file: ${error.message}`, this.adapterType, error);
+		}
+	}
+};
+//#endregion
+export { BaseEncryption as t };
+
+//# sourceMappingURL=base-COUQhj5x.js.map

package/dist/chunks/base-COUQhj5x.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-COUQhj5x.js","names":[],"sources":["../../src/shared/base.ts"],"sourcesContent":["import { readFile, writeFile } from 'node:fs/promises';\nimport type { Transform } from 'node:stream';\nimport {\n  DecryptError,\n  EncryptError,\n  InvalidKeyError,\n  KeyError,\n} from './errors.js';\nimport type {\n  AdapterType,\n  DecryptEmailOptions,\n  DecryptedEmail,\n  DecryptOptions,\n  EmailMessage,\n  EncryptEmailOptions,\n  Encryption,\n  EncryptionCapabilities,\n  EncryptOptions,\n  ExportKeyOptions,\n  ImportKeyOptions,\n  Key,\n  KeyPair,\n  KeyPairOptions,\n  SignEmailOptions,\n  SignOptions,\n  VerificationResult,\n  VerifyEmailOptions,\n  VerifyOptions,\n} from './types.js';\n\n/**\n * Base adapter class that provides common functionality for all encryption adapters\n */\nexport abstract class BaseEncryption implements Encryption {\n  protected readonly adapterType: AdapterType;\n  protected readonly debug: boolean;\n\n  constructor(adapterType: AdapterType, debug = false) {\n    this.adapterType = adapterType;\n    this.debug = debug;\n  }\n\n  /**\n   * Get the adapter type\n   */\n  getAdapter(): AdapterType {\n    return this.adapterType;\n  }\n\n  /**\n   * Log debug messages if debug mode is enabled\n   */\n  protected log(message: string, ...args: unknown[]): void {\n    if (this.debug) {\n      console.log(`[${this.adapterType}] ${message}`, ...args);\n    }\n  }\n\n  /**\n   * Validate that a key is provided\n   */\n  protected validateKey(\n    key: string | Buffer | Uint8Array | undefined,\n    keyType: 'public' | 'private',\n  ): void {\n    if (!key) {\n      throw new KeyError(\n        `${keyType} key is required but was not provided`,\n        this.adapterType,\n      );\n    }\n\n    if (typeof key === 'string' && key.trim().length === 0) {\n      throw new InvalidKeyError(\n        `${keyType} key cannot be empty`,\n        this.adapterType,\n      );\n    }\n\n    if (Buffer.isBuffer(key) && key.length === 0) {\n      throw new InvalidKeyError(\n        `${keyType} key cannot be empty`,\n        this.adapterType,\n      );\n    }\n\n    if (key instanceof Uint8Array && key.length === 0) {\n      throw new InvalidKeyError(\n        `${keyType} key cannot be empty`,\n        this.adapterType,\n      );\n    }\n  }\n\n  /**\n   * Validate encryption options\n   */\n  protected validateEncryptOptions(options?: EncryptOptions): void {\n    // Base validation - adapters can override\n    if (!options) return;\n\n    // Validate encoding if provided\n    if (\n      options.encoding &&\n      !['base64', 'hex', 'utf8'].includes(options.encoding)\n    ) {\n      throw new Error(\n        `Invalid encoding: ${options.encoding}. Must be 'base64', 'hex', or 'utf8'`,\n      );\n    }\n  }\n\n  /**\n   * Validate decryption options\n   */\n  protected validateDecryptOptions(options?: DecryptOptions): void {\n    // Base validation - adapters can override\n    if (!options) return;\n\n    // Validate encoding if provided\n    if (\n      options.encoding &&\n      !['base64', 'hex', 'utf8'].includes(options.encoding)\n    ) {\n      throw new Error(\n        `Invalid encoding: ${options.encoding}. Must be 'base64', 'hex', or 'utf8'`,\n      );\n    }\n  }\n\n  /**\n   * Convert Buffer to string based on encoding\n   */\n  protected bufferToString(\n    buffer: Buffer,\n    encoding: 'base64' | 'hex' | 'utf8' = 'base64',\n  ): string {\n    return buffer.toString(encoding);\n  }\n\n  /**\n   * Convert string to Buffer based on encoding\n   */\n  protected stringToBuffer(\n    str: string,\n    encoding: 'base64' | 'hex' | 'utf8' = 'base64',\n  ): Buffer {\n    return Buffer.from(str, encoding);\n  }\n\n  /**\n   * Wrap errors with adapter context\n   */\n  protected wrapError(error: unknown, operation: string): Error {\n    if (error instanceof Error) {\n      return error;\n    }\n    return new Error(\n      `${operation} failed in ${this.adapterType} adapter: ${String(error)}`,\n    );\n  }\n\n  // =============================================================================\n  // Text operations (must be implemented by adapters)\n  // =============================================================================\n\n  abstract encryptText(text: string, options?: EncryptOptions): Promise<string>;\n\n  abstract decryptText(\n    encrypted: string,\n    options?: DecryptOptions,\n  ): Promise<string>;\n\n  // =============================================================================\n  // File operations (default implementation using text/buffer methods)\n  // =============================================================================\n\n  async encryptFile(\n    inputPath: string,\n    outputPath: string,\n    options?: EncryptOptions,\n  ): Promise<void> {\n    try {\n      this.log(`Encrypting file: ${inputPath} -> ${outputPath}`);\n\n      // Read input file\n      const input = await readFile(inputPath);\n\n      // Encrypt buffer\n      const encrypted = await this.encryptBuffer(input, options);\n\n      // Write output file\n      await writeFile(outputPath, encrypted);\n\n      this.log(`File encrypted successfully: ${outputPath}`);\n    } catch (error) {\n      throw new EncryptError(\n        `Failed to encrypt file: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  async decryptFile(\n    inputPath: string,\n    outputPath: string,\n    options?: DecryptOptions,\n  ): Promise<void> {\n    try {\n      this.log(`Decrypting file: ${inputPath} -> ${outputPath}`);\n\n      // Read input file\n      const input = await readFile(inputPath);\n\n      // Decrypt buffer\n      const decrypted = await this.decryptBuffer(input, options);\n\n      // Write output file\n      await writeFile(outputPath, decrypted);\n\n      this.log(`File decrypted successfully: ${outputPath}`);\n    } catch (error) {\n      throw new DecryptError(\n        `Failed to decrypt file: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  // =============================================================================\n  // Buffer operations (must be implemented by adapters)\n  // =============================================================================\n\n  abstract encryptBuffer(\n    buffer: Buffer,\n    options?: EncryptOptions,\n  ): Promise<Buffer>;\n\n  abstract decryptBuffer(\n    buffer: Buffer,\n    options?: DecryptOptions,\n  ): Promise<Buffer>;\n\n  // =============================================================================\n  // Stream operations (optional - not implemented by default)\n  // =============================================================================\n\n  encryptStream?(options?: EncryptOptions): Transform;\n\n  decryptStream?(options?: DecryptOptions): Transform;\n\n  // =============================================================================\n  // Email operations (optional - mainly PGP)\n  // =============================================================================\n\n  encryptEmail?(\n    message: EmailMessage,\n    options?: EncryptEmailOptions,\n  ): Promise<EmailMessage>;\n\n  decryptEmail?(\n    message: EmailMessage,\n    options?: DecryptEmailOptions,\n  ): Promise<DecryptedEmail>;\n\n  signEmail?(\n    message: EmailMessage,\n    options?: SignEmailOptions,\n  ): Promise<EmailMessage>;\n\n  verifyEmail?(\n    message: EmailMessage,\n    options?: VerifyEmailOptions,\n  ): Promise<VerificationResult>;\n\n  // =============================================================================\n  // Signing operations (optional - mainly PGP)\n  // =============================================================================\n\n  sign?(data: string | Buffer, options?: SignOptions): Promise<string | Buffer>;\n\n  verify?(\n    data: string | Buffer,\n    signature: string | Buffer,\n    options?: VerifyOptions,\n  ): Promise<boolean>;\n\n  // =============================================================================\n  // Key management (must be implemented by adapters)\n  // =============================================================================\n\n  abstract generateKeyPair(options?: KeyPairOptions): Promise<KeyPair>;\n\n  abstract importKey(\n    key: string | Buffer,\n    options?: ImportKeyOptions,\n  ): Promise<Key>;\n\n  abstract exportKey(\n    key: Key,\n    options?: ExportKeyOptions,\n  ): Promise<string | Buffer>;\n\n  // =============================================================================\n  // Adapter capabilities (must be implemented by adapters)\n  // =============================================================================\n\n  abstract getCapabilities(): Promise<EncryptionCapabilities>;\n}\n"],"mappings":";;;;;;AAiCA,IAAsB,iBAAtB,MAA2D;CACzD;CACA;CAEA,YAAY,aAA0B,QAAQ,OAAO;EACnD,KAAK,cAAc;EACnB,KAAK,QAAQ;CACf;;;;CAKA,aAA0B;EACxB,OAAO,KAAK;CACd;;;;CAKA,IAAc,SAAiB,GAAG,MAAuB;EACvD,IAAI,KAAK,OACP,QAAQ,IAAI,IAAI,KAAK,YAAY,IAAI,WAAW,GAAG,IAAI;CAE3D;;;;CAKA,YACE,KACA,SACM;EACN,IAAI,CAAC,KACH,MAAM,IAAI,SACR,GAAG,QAAQ,wCACX,KAAK,WACP;EAGF,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,CAAC,CAAC,WAAW,GACnD,MAAM,IAAI,gBACR,GAAG,QAAQ,uBACX,KAAK,WACP;EAGF,IAAI,OAAO,SAAS,GAAG,KAAK,IAAI,WAAW,GACzC,MAAM,IAAI,gBACR,GAAG,QAAQ,uBACX,KAAK,WACP;EAGF,IAAI,eAAe,cAAc,IAAI,WAAW,GAC9C,MAAM,IAAI,gBACR,GAAG,QAAQ,uBACX,KAAK,WACP;CAEJ;;;;CAKA,uBAAiC,SAAgC;EAE/D,IAAI,CAAC,SAAS;EAGd,IACE,QAAQ,YACR,CAAC;GAAC;GAAU;GAAO;EAAM,CAAC,CAAC,SAAS,QAAQ,QAAQ,GAEpD,MAAM,IAAI,MACR,qBAAqB,QAAQ,SAAS,qCACxC;CAEJ;;;;CAKA,uBAAiC,SAAgC;EAE/D,IAAI,CAAC,SAAS;EAGd,IACE,QAAQ,YACR,CAAC;GAAC;GAAU;GAAO;EAAM,CAAC,CAAC,SAAS,QAAQ,QAAQ,GAEpD,MAAM,IAAI,MACR,qBAAqB,QAAQ,SAAS,qCACxC;CAEJ;;;;CAKA,eACE,QACA,WAAsC,UAC9B;EACR,OAAO,OAAO,SAAS,QAAQ;CACjC;;;;CAKA,eACE,KACA,WAAsC,UAC9B;EACR,OAAO,OAAO,KAAK,KAAK,QAAQ;CAClC;;;;CAKA,UAAoB,OAAgB,WAA0B;EAC5D,IAAI,iBAAiB,OACnB,OAAO;EAET,uBAAO,IAAI,MACT,GAAG,UAAU,aAAa,KAAK,YAAY,YAAY,OAAO,KAAK,GACrE;CACF;CAiBA,MAAM,YACJ,WACA,YACA,SACe;EACf,IAAI;GACF,KAAK,IAAI,oBAAoB,UAAU,MAAM,YAAY;GAGzD,MAAM,QAAQ,MAAM,SAAS,SAAS;GAMtC,MAAM,UAAU,YAAY,MAHJ,KAAK,cAAc,OAAO,OAAO,CAGpB;GAErC,KAAK,IAAI,gCAAgC,YAAY;EACvD,SAAS,OAAO;GACd,MAAM,IAAI,aACR,2BAA4B,MAAgB,WAC5C,KAAK,aACL,KACF;EACF;CACF;CAEA,MAAM,YACJ,WACA,YACA,SACe;EACf,IAAI;GACF,KAAK,IAAI,oBAAoB,UAAU,MAAM,YAAY;GAGzD,MAAM,QAAQ,MAAM,SAAS,SAAS;GAMtC,MAAM,UAAU,YAAY,MAHJ,KAAK,cAAc,OAAO,OAAO,CAGpB;GAErC,KAAK,IAAI,gCAAgC,YAAY;EACvD,SAAS,OAAO;GACd,MAAM,IAAI,aACR,2BAA4B,MAAgB,WAC5C,KAAK,aACL,KACF;EACF;CACF;AAiFF"}

package/dist/chunks/errors-Q_wX_NMz.js

@@ -0,0 +1,143 @@
+//#region src/shared/errors.ts
+/**
+* Base error class for all encryption errors
+*/
+var EncryptionError = class extends Error {
+	code;
+	adapter;
+	cause;
+	timestamp;
+	constructor(message, code, adapter, cause) {
+		super(message);
+		this.name = "EncryptionError";
+		this.code = code;
+		this.adapter = adapter;
+		this.cause = cause;
+		this.timestamp = /* @__PURE__ */ new Date();
+		if (Error.captureStackTrace) Error.captureStackTrace(this, this.constructor);
+	}
+	/**
+	* Convert error to JSON for logging/serialization
+	*/
+	toJSON() {
+		return {
+			name: this.name,
+			message: this.message,
+			code: this.code,
+			adapter: this.adapter,
+			timestamp: this.timestamp.toISOString(),
+			stack: this.stack,
+			cause: this.cause
+		};
+	}
+};
+/**
+* Key-related errors
+*/
+var KeyError = class extends EncryptionError {
+	constructor(message, adapter, cause) {
+		super(message, "KEY_ERROR", adapter, cause);
+		this.name = "KeyError";
+	}
+};
+/**
+* Invalid key format or content
+*/
+var InvalidKeyError = class extends EncryptionError {
+	constructor(message, adapter, cause) {
+		super(message, "INVALID_KEY", adapter, cause);
+		this.name = "InvalidKeyError";
+	}
+};
+/**
+* Key not found error
+*/
+var KeyNotFoundError = class extends EncryptionError {
+	keyId;
+	constructor(message, keyId, adapter) {
+		super(message, "KEY_NOT_FOUND", adapter);
+		this.name = "KeyNotFoundError";
+		this.keyId = keyId;
+	}
+	toJSON() {
+		return {
+			...super.toJSON(),
+			keyId: this.keyId
+		};
+	}
+};
+/**
+* Passphrase-related errors
+*/
+var PassphraseError = class extends EncryptionError {
+	constructor(message, adapter, cause) {
+		super(message, "PASSPHRASE_ERROR", adapter, cause);
+		this.name = "PassphraseError";
+	}
+};
+/**
+* Encryption operation errors
+*/
+var EncryptError = class extends EncryptionError {
+	constructor(message, adapter, cause) {
+		super(message, "ENCRYPT_ERROR", adapter, cause);
+		this.name = "EncryptError";
+	}
+};
+/**
+* Decryption operation errors
+*/
+var DecryptError = class extends EncryptionError {
+	constructor(message, adapter, cause) {
+		super(message, "DECRYPT_ERROR", adapter, cause);
+		this.name = "DecryptError";
+	}
+};
+/**
+* Signature operation errors
+*/
+var SignatureError = class extends EncryptionError {
+	constructor(message, adapter, cause) {
+		super(message, "SIGNATURE_ERROR", adapter, cause);
+		this.name = "SignatureError";
+	}
+};
+/**
+* Verification operation errors
+*/
+var VerificationError = class extends EncryptionError {
+	constructor(message, adapter, cause) {
+		super(message, "VERIFICATION_ERROR", adapter, cause);
+		this.name = "VerificationError";
+	}
+};
+/**
+* Format-related errors
+*/
+var FormatError = class extends EncryptionError {
+	constructor(message, adapter, cause) {
+		super(message, "FORMAT_ERROR", adapter, cause);
+		this.name = "FormatError";
+	}
+};
+/**
+* Algorithm-related errors
+*/
+var AlgorithmError = class extends EncryptionError {
+	algorithm;
+	constructor(message, algorithm, adapter) {
+		super(message, "ALGORITHM_ERROR", adapter);
+		this.name = "AlgorithmError";
+		this.algorithm = algorithm;
+	}
+	toJSON() {
+		return {
+			...super.toJSON(),
+			algorithm: this.algorithm
+		};
+	}
+};
+//#endregion
+export { FormatError as a, KeyNotFoundError as c, VerificationError as d, EncryptionError as i, PassphraseError as l, DecryptError as n, InvalidKeyError as o, EncryptError as r, KeyError as s, AlgorithmError as t, SignatureError as u };
+
+//# sourceMappingURL=errors-Q_wX_NMz.js.map

package/dist/chunks/errors-Q_wX_NMz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors-Q_wX_NMz.js","names":[],"sources":["../../src/shared/errors.ts"],"sourcesContent":["/**\n * Base error class for all encryption errors\n */\nexport class EncryptionError extends Error {\n  public readonly code: string;\n  public readonly adapter?: string;\n  public readonly cause?: unknown;\n  public readonly timestamp: Date;\n\n  constructor(\n    message: string,\n    code: string,\n    adapter?: string,\n    cause?: unknown,\n  ) {\n    super(message);\n    this.name = 'EncryptionError';\n    this.code = code;\n    this.adapter = adapter;\n    this.cause = cause;\n    this.timestamp = new Date();\n\n    // Maintains proper stack trace for where error was thrown (only available on V8)\n    if (Error.captureStackTrace) {\n      Error.captureStackTrace(this, this.constructor);\n    }\n  }\n\n  /**\n   * Convert error to JSON for logging/serialization\n   */\n  toJSON(): Record<string, unknown> {\n    return {\n      name: this.name,\n      message: this.message,\n      code: this.code,\n      adapter: this.adapter,\n      timestamp: this.timestamp.toISOString(),\n      stack: this.stack,\n      cause: this.cause,\n    };\n  }\n}\n\n/**\n * Key-related errors\n */\nexport class KeyError extends EncryptionError {\n  constructor(message: string, adapter?: string, cause?: unknown) {\n    super(message, 'KEY_ERROR', adapter, cause);\n    this.name = 'KeyError';\n  }\n}\n\n/**\n * Invalid key format or content\n */\nexport class InvalidKeyError extends EncryptionError {\n  constructor(message: string, adapter?: string, cause?: unknown) {\n    super(message, 'INVALID_KEY', adapter, cause);\n    this.name = 'InvalidKeyError';\n  }\n}\n\n/**\n * Key not found error\n */\nexport class KeyNotFoundError extends EncryptionError {\n  public readonly keyId?: string;\n\n  constructor(message: string, keyId?: string, adapter?: string) {\n    super(message, 'KEY_NOT_FOUND', adapter);\n    this.name = 'KeyNotFoundError';\n    this.keyId = keyId;\n  }\n\n  override toJSON(): Record<string, unknown> {\n    return {\n      ...super.toJSON(),\n      keyId: this.keyId,\n    };\n  }\n}\n\n/**\n * Passphrase-related errors\n */\nexport class PassphraseError extends EncryptionError {\n  constructor(message: string, adapter?: string, cause?: unknown) {\n    super(message, 'PASSPHRASE_ERROR', adapter, cause);\n    this.name = 'PassphraseError';\n  }\n}\n\n/**\n * Encryption operation errors\n */\nexport class EncryptError extends EncryptionError {\n  constructor(message: string, adapter?: string, cause?: unknown) {\n    super(message, 'ENCRYPT_ERROR', adapter, cause);\n    this.name = 'EncryptError';\n  }\n}\n\n/**\n * Decryption operation errors\n */\nexport class DecryptError extends EncryptionError {\n  constructor(message: string, adapter?: string, cause?: unknown) {\n    super(message, 'DECRYPT_ERROR', adapter, cause);\n    this.name = 'DecryptError';\n  }\n}\n\n/**\n * Signature operation errors\n */\nexport class SignatureError extends EncryptionError {\n  constructor(message: string, adapter?: string, cause?: unknown) {\n    super(message, 'SIGNATURE_ERROR', adapter, cause);\n    this.name = 'SignatureError';\n  }\n}\n\n/**\n * Verification operation errors\n */\nexport class VerificationError extends EncryptionError {\n  constructor(message: string, adapter?: string, cause?: unknown) {\n    super(message, 'VERIFICATION_ERROR', adapter, cause);\n    this.name = 'VerificationError';\n  }\n}\n\n/**\n * Format-related errors\n */\nexport class FormatError extends EncryptionError {\n  constructor(message: string, adapter?: string, cause?: unknown) {\n    super(message, 'FORMAT_ERROR', adapter, cause);\n    this.name = 'FormatError';\n  }\n}\n\n/**\n * Algorithm-related errors\n */\nexport class AlgorithmError extends EncryptionError {\n  public readonly algorithm?: string;\n\n  constructor(message: string, algorithm?: string, adapter?: string) {\n    super(message, 'ALGORITHM_ERROR', adapter);\n    this.name = 'AlgorithmError';\n    this.algorithm = algorithm;\n  }\n\n  override toJSON(): Record<string, unknown> {\n    return {\n      ...super.toJSON(),\n      algorithm: this.algorithm,\n    };\n  }\n}\n"],"mappings":";;;;AAGA,IAAa,kBAAb,cAAqC,MAAM;CACzC;CACA;CACA;CACA;CAEA,YACE,SACA,MACA,SACA,OACA;EACA,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,UAAU;EACf,KAAK,QAAQ;EACb,KAAK,4BAAY,IAAI,KAAK;EAG1B,IAAI,MAAM,mBACR,MAAM,kBAAkB,MAAM,KAAK,WAAW;CAElD;;;;CAKA,SAAkC;EAChC,OAAO;GACL,MAAM,KAAK;GACX,SAAS,KAAK;GACd,MAAM,KAAK;GACX,SAAS,KAAK;GACd,WAAW,KAAK,UAAU,YAAY;GACtC,OAAO,KAAK;GACZ,OAAO,KAAK;EACd;CACF;AACF;;;;AAKA,IAAa,WAAb,cAA8B,gBAAgB;CAC5C,YAAY,SAAiB,SAAkB,OAAiB;EAC9D,MAAM,SAAS,aAAa,SAAS,KAAK;EAC1C,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,kBAAb,cAAqC,gBAAgB;CACnD,YAAY,SAAiB,SAAkB,OAAiB;EAC9D,MAAM,SAAS,eAAe,SAAS,KAAK;EAC5C,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,mBAAb,cAAsC,gBAAgB;CACpD;CAEA,YAAY,SAAiB,OAAgB,SAAkB;EAC7D,MAAM,SAAS,iBAAiB,OAAO;EACvC,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;CAEA,SAA2C;EACzC,OAAO;GACL,GAAG,MAAM,OAAO;GAChB,OAAO,KAAK;EACd;CACF;AACF;;;;AAKA,IAAa,kBAAb,cAAqC,gBAAgB;CACnD,YAAY,SAAiB,SAAkB,OAAiB;EAC9D,MAAM,SAAS,oBAAoB,SAAS,KAAK;EACjD,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,eAAb,cAAkC,gBAAgB;CAChD,YAAY,SAAiB,SAAkB,OAAiB;EAC9D,MAAM,SAAS,iBAAiB,SAAS,KAAK;EAC9C,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,eAAb,cAAkC,gBAAgB;CAChD,YAAY,SAAiB,SAAkB,OAAiB;EAC9D,MAAM,SAAS,iBAAiB,SAAS,KAAK;EAC9C,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,iBAAb,cAAoC,gBAAgB;CAClD,YAAY,SAAiB,SAAkB,OAAiB;EAC9D,MAAM,SAAS,mBAAmB,SAAS,KAAK;EAChD,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,oBAAb,cAAuC,gBAAgB;CACrD,YAAY,SAAiB,SAAkB,OAAiB;EAC9D,MAAM,SAAS,sBAAsB,SAAS,KAAK;EACnD,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,cAAb,cAAiC,gBAAgB;CAC/C,YAAY,SAAiB,SAAkB,OAAiB;EAC9D,MAAM,SAAS,gBAAgB,SAAS,KAAK;EAC7C,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,iBAAb,cAAoC,gBAAgB;CAClD;CAEA,YAAY,SAAiB,WAAoB,SAAkB;EACjE,MAAM,SAAS,mBAAmB,OAAO;EACzC,KAAK,OAAO;EACZ,KAAK,YAAY;CACnB;CAEA,SAA2C;EACzC,OAAO;GACL,GAAG,MAAM,OAAO;GAChB,WAAW,KAAK;EAClB;CACF;AACF"}

package/dist/chunks/{nacl-BElkPprm.js → nacl-Ct71p1KK.js}

@@ -1,4 +1,5 @@
-import { c as KeyError, d as SignatureError, i as EncryptError, r as DecryptError, s as InvalidKeyError, t as BaseEncryption } from "./base-qiu-WiZ0.js";
+import { n as DecryptError, o as InvalidKeyError, r as EncryptError, s as KeyError, u as SignatureError } from "./errors-Q_wX_NMz.js";
+import { t as BaseEncryption } from "./base-COUQhj5x.js";
 import nacl from "tweetnacl";
 import { decodeBase64, decodeUTF8, encodeBase64, encodeUTF8 } from "tweetnacl-util";
 //#region src/adapters/nacl.ts
@@ -331,4 +332,4 @@ var NaClEncryption = class extends BaseEncryption {
 //#endregion
 export { NaClEncryption };
 
-//# sourceMappingURL=nacl-BElkPprm.js.map
+//# sourceMappingURL=nacl-Ct71p1KK.js.map

package/dist/chunks/{nacl-BElkPprm.js.map → nacl-Ct71p1KK.js.map}

@@ -1 +1 @@
-{"version":3,"file":"nacl-BElkPprm.js","names":[],"sources":["../../src/adapters/nacl.ts"],"sourcesContent":["import nacl from 'tweetnacl';\nimport {\n  decodeBase64,\n  decodeUTF8,\n  encodeBase64,\n  encodeUTF8,\n} from 'tweetnacl-util';\nimport { BaseEncryption } from '../shared/base.js';\nimport {\n  DecryptError,\n  EncryptError,\n  InvalidKeyError,\n  KeyError,\n  SignatureError,\n} from '../shared/errors.js';\nimport type {\n  DecryptOptions,\n  EncryptionCapabilities,\n  EncryptOptions,\n  ExportKeyOptions,\n  ImportKeyOptions,\n  Key,\n  KeyPair,\n  KeyPairOptions,\n  NaClOptions,\n  SignOptions,\n  VerifyOptions,\n} from '../shared/types.js';\n\n/**\n * NaCl/TweetNaCl encryption adapter\n *\n * Provides fast, modern cryptography using the NaCl library.\n * Supports both symmetric (secretbox) and asymmetric (box) encryption.\n *\n * @example\n * ```typescript\n * // Symmetric encryption\n * const nacl = new NaClEncryption({\n *   type: 'nacl',\n *   secretKey: secretKey\n * });\n *\n * const encrypted = await nacl.encryptText('Secret message');\n * const decrypted = await nacl.decryptText(encrypted);\n *\n * // Asymmetric encryption\n * const nacl = new NaClEncryption({\n *   type: 'nacl',\n *   publicKey: theirPublicKey,\n *   secretKey: mySecretKey\n * });\n *\n * const encrypted = await nacl.encryptText('Secret message', {\n *   recipientPublicKey: theirPublicKey\n * });\n * const decrypted = await nacl.decryptText(encrypted);\n * ```\n */\nexport class NaClEncryption extends BaseEncryption {\n  private options: NaClOptions;\n  private secretKey?: Uint8Array;\n  private publicKey?: Uint8Array;\n\n  constructor(options: NaClOptions) {\n    super('nacl', options.debug);\n    this.options = options;\n    this.initializeKeys();\n  }\n\n  /**\n   * Initialize keys from options\n   */\n  private initializeKeys(): void {\n    const encoding = this.options.encoding || 'base64';\n\n    // Initialize secret key for symmetric encryption\n    if (this.options.secretKey) {\n      this.secretKey = this.parseKey(this.options.secretKey, encoding);\n      if (this.secretKey.length !== nacl.secretbox.keyLength) {\n        throw new InvalidKeyError(\n          `NaCl secret key must be ${nacl.secretbox.keyLength} bytes`,\n          this.adapterType,\n        );\n      }\n    }\n\n    // Initialize public key for asymmetric encryption\n    if (this.options.publicKey) {\n      this.publicKey = this.parseKey(this.options.publicKey, encoding);\n      if (this.publicKey.length !== nacl.box.publicKeyLength) {\n        throw new InvalidKeyError(\n          `NaCl public key must be ${nacl.box.publicKeyLength} bytes`,\n          this.adapterType,\n        );\n      }\n    }\n  }\n\n  /**\n   * Parse key from various formats\n   */\n  private parseKey(\n    key: Uint8Array | Buffer | string,\n    encoding: 'base64' | 'hex' | 'utf8',\n  ): Uint8Array {\n    if (key instanceof Uint8Array) {\n      return key;\n    }\n\n    if (Buffer.isBuffer(key)) {\n      return new Uint8Array(key);\n    }\n\n    if (typeof key === 'string') {\n      if (encoding === 'base64') {\n        return decodeBase64(key);\n      }\n      if (encoding === 'hex') {\n        return new Uint8Array(Buffer.from(key, 'hex'));\n      }\n      if (encoding === 'utf8') {\n        return decodeUTF8(key);\n      }\n    }\n\n    throw new InvalidKeyError('Invalid key format for NaCl', this.adapterType);\n  }\n\n  /**\n   * Format key for output\n   */\n  private formatKey(\n    key: Uint8Array,\n    encoding: 'base64' | 'hex' | 'utf8' = 'base64',\n  ): string {\n    if (encoding === 'base64') {\n      return encodeBase64(key);\n    }\n    if (encoding === 'hex') {\n      return Buffer.from(key).toString('hex');\n    }\n    if (encoding === 'utf8') {\n      return encodeUTF8(key);\n    }\n    return encodeBase64(key);\n  }\n\n  async encryptText(text: string, options?: EncryptOptions): Promise<string> {\n    try {\n      this.log('Encrypting text', { length: text.length });\n\n      const message = decodeUTF8(text);\n\n      // Check if asymmetric or symmetric encryption\n      if (options?.recipientPublicKey) {\n        // Asymmetric encryption (box)\n        return this.encryptAsymmetric(message, options);\n      }\n\n      // Symmetric encryption (secretbox)\n      return this.encryptSymmetric(message);\n    } catch (error) {\n      throw new EncryptError(\n        `Failed to encrypt text: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  async decryptText(\n    encrypted: string,\n    options?: DecryptOptions,\n  ): Promise<string> {\n    try {\n      this.log('Decrypting text', { length: encrypted.length });\n\n      // Decode the encrypted message\n      const encryptedData = decodeBase64(encrypted);\n\n      // Extract nonce and ciphertext\n      const nonceLength = nacl.secretbox.nonceLength;\n      const nonce = encryptedData.slice(0, nonceLength);\n      const ciphertext = encryptedData.slice(nonceLength);\n\n      let decrypted: Uint8Array | null;\n\n      // Try asymmetric decryption first if we have keys\n      if (this.publicKey && this.secretKey) {\n        // Check if there's a public key in the message (for box)\n        if (ciphertext.length > nacl.box.publicKeyLength) {\n          const senderPublicKey = ciphertext.slice(0, nacl.box.publicKeyLength);\n          const actualCiphertext = ciphertext.slice(nacl.box.publicKeyLength);\n\n          decrypted = nacl.box.open(\n            actualCiphertext,\n            nonce,\n            senderPublicKey,\n            this.secretKey,\n          );\n\n          if (decrypted) {\n            this.log('Text decrypted successfully (asymmetric)');\n            return encodeUTF8(decrypted);\n          }\n        }\n      }\n\n      // Try symmetric decryption\n      if (this.secretKey) {\n        decrypted = nacl.secretbox.open(ciphertext, nonce, this.secretKey);\n\n        if (decrypted) {\n          this.log('Text decrypted successfully (symmetric)');\n          return encodeUTF8(decrypted);\n        }\n      }\n\n      throw new DecryptError(\n        'Decryption failed: invalid key or corrupted ciphertext',\n        this.adapterType,\n      );\n    } catch (error) {\n      if (error instanceof DecryptError) {\n        throw error;\n      }\n      throw new DecryptError(\n        `Failed to decrypt text: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  async encryptBuffer(\n    buffer: Buffer,\n    options?: EncryptOptions,\n  ): Promise<Buffer> {\n    try {\n      this.log('Encrypting buffer', { size: buffer.length });\n\n      const message = new Uint8Array(buffer);\n\n      // Check if asymmetric or symmetric encryption\n      if (options?.recipientPublicKey) {\n        // Asymmetric encryption (box)\n        const encrypted = this.encryptAsymmetric(message, options);\n        return Buffer.from(decodeBase64(encrypted));\n      }\n\n      // Symmetric encryption (secretbox)\n      const encrypted = this.encryptSymmetric(message);\n      return Buffer.from(decodeBase64(encrypted));\n    } catch (error) {\n      throw new EncryptError(\n        `Failed to encrypt buffer: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  async decryptBuffer(\n    buffer: Buffer,\n    options?: DecryptOptions,\n  ): Promise<Buffer> {\n    try {\n      this.log('Decrypting buffer', { size: buffer.length });\n\n      // Decode the base64 buffer\n      const decoded = decodeBase64(buffer.toString('base64'));\n\n      // Extract nonce and ciphertext\n      const nonce = decoded.slice(0, nacl.secretbox.nonceLength);\n      const ciphertext = decoded.slice(nacl.secretbox.nonceLength);\n\n      let decrypted: Uint8Array | null = null;\n\n      // Try asymmetric decryption first if we have keys\n      if (this.publicKey && this.secretKey) {\n        // Check if there's a public key in the message (for box)\n        if (ciphertext.length > nacl.box.publicKeyLength) {\n          const senderPublicKey = ciphertext.slice(0, nacl.box.publicKeyLength);\n          const actualCiphertext = ciphertext.slice(nacl.box.publicKeyLength);\n\n          decrypted = nacl.box.open(\n            actualCiphertext,\n            nonce,\n            senderPublicKey,\n            this.secretKey,\n          );\n\n          if (decrypted) {\n            this.log('Buffer decrypted successfully (asymmetric)');\n            return Buffer.from(decrypted);\n          }\n        }\n      }\n\n      // Try symmetric decryption\n      if (this.secretKey) {\n        decrypted = nacl.secretbox.open(ciphertext, nonce, this.secretKey);\n\n        if (decrypted) {\n          this.log('Buffer decrypted successfully (symmetric)');\n          return Buffer.from(decrypted);\n        }\n      }\n\n      throw new DecryptError(\n        'Decryption failed: invalid key or corrupted ciphertext',\n        this.adapterType,\n      );\n    } catch (error) {\n      if (error instanceof DecryptError) {\n        throw error;\n      }\n      throw new DecryptError(\n        `Failed to decrypt buffer: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  /**\n   * Symmetric encryption using secretbox\n   */\n  private encryptSymmetric(message: Uint8Array): string {\n    if (!this.secretKey) {\n      throw new KeyError(\n        'Secret key required for symmetric encryption',\n        this.adapterType,\n      );\n    }\n\n    // Generate random nonce\n    const nonce = nacl.randomBytes(nacl.secretbox.nonceLength);\n\n    // Encrypt the message\n    const ciphertext = nacl.secretbox(message, nonce, this.secretKey);\n\n    // Combine nonce and ciphertext\n    const encrypted = new Uint8Array(nonce.length + ciphertext.length);\n    encrypted.set(nonce);\n    encrypted.set(ciphertext, nonce.length);\n\n    return encodeBase64(encrypted);\n  }\n\n  /**\n   * Asymmetric encryption using box\n   */\n  private encryptAsymmetric(\n    message: Uint8Array,\n    options: EncryptOptions,\n  ): string {\n    if (!this.secretKey) {\n      throw new KeyError(\n        'Secret key required for asymmetric encryption',\n        this.adapterType,\n      );\n    }\n\n    // Get recipient public key\n    const recipientPublicKey = this.parseKey(\n      options.recipientPublicKey as string | Uint8Array | Buffer,\n      this.options.encoding || 'base64',\n    );\n\n    if (recipientPublicKey.length !== nacl.box.publicKeyLength) {\n      throw new InvalidKeyError(\n        `Recipient public key must be ${nacl.box.publicKeyLength} bytes`,\n        this.adapterType,\n      );\n    }\n\n    // Generate random nonce\n    const nonce = nacl.randomBytes(nacl.box.nonceLength);\n\n    // Encrypt the message\n    const ciphertext = nacl.box(\n      message,\n      nonce,\n      recipientPublicKey,\n      this.secretKey,\n    );\n\n    // Include sender's public key in the message\n    const senderPublicKey =\n      this.publicKey ||\n      nacl.box.keyPair.fromSecretKey(this.secretKey).publicKey;\n\n    // Combine nonce, sender public key, and ciphertext\n    const encrypted = new Uint8Array(\n      nonce.length + senderPublicKey.length + ciphertext.length,\n    );\n    encrypted.set(nonce);\n    encrypted.set(senderPublicKey, nonce.length);\n    encrypted.set(ciphertext, nonce.length + senderPublicKey.length);\n\n    return encodeBase64(encrypted);\n  }\n\n  async generateKeyPair(options?: KeyPairOptions): Promise<KeyPair> {\n    try {\n      this.log('Generating NaCl key pair', options);\n\n      const keyType = options?.type || 'box';\n\n      if (keyType === 'box' || keyType === 'ecdh') {\n        // Generate encryption keypair\n        const keypair = nacl.box.keyPair();\n\n        this.log('Encryption key pair generated');\n\n        return {\n          publicKey: keypair.publicKey,\n          privateKey: keypair.secretKey,\n        };\n      }\n\n      if (keyType === 'ecdsa') {\n        // Generate signing keypair\n        const keypair = nacl.sign.keyPair();\n\n        this.log('Signing key pair generated');\n\n        return {\n          publicKey: keypair.publicKey,\n          privateKey: keypair.secretKey,\n        };\n      }\n\n      throw new KeyError(\n        `Unsupported key type for NaCl: ${keyType}. Use 'box' for encryption or 'sign' for signatures.`,\n        this.adapterType,\n      );\n    } catch (error) {\n      throw new KeyError(\n        `Failed to generate NaCl key pair: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  async importKey(\n    key: string | Buffer,\n    options?: ImportKeyOptions,\n  ): Promise<Key> {\n    try {\n      this.log('Importing NaCl key');\n\n      const encoding = this.options.encoding || 'base64';\n      const keyData = typeof key === 'string' ? key : key.toString(encoding);\n      const keyBytes = this.parseKey(keyData, encoding);\n\n      const keyType = options?.type || 'public';\n      const format = (options?.format || 'armored') as\n        | 'armored'\n        | 'binary'\n        | 'pem'\n        | 'der';\n\n      // Validate key length\n      const expectedLength =\n        keyType === 'public'\n          ? nacl.box.publicKeyLength\n          : nacl.box.secretKeyLength;\n\n      if (keyBytes.length !== expectedLength) {\n        throw new InvalidKeyError(\n          `NaCl ${keyType} key must be ${expectedLength} bytes`,\n          this.adapterType,\n        );\n      }\n\n      this.log('Key imported successfully');\n\n      return {\n        type: keyType as 'public' | 'private',\n        format,\n        data: keyData,\n        algorithm: 'nacl',\n      };\n    } catch (error) {\n      throw new InvalidKeyError(\n        `Failed to import NaCl key: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  async exportKey(\n    key: Key,\n    options?: ExportKeyOptions,\n  ): Promise<string | Buffer> {\n    try {\n      this.log('Exporting NaCl key');\n\n      const format = options?.format || key.format || 'armored';\n      // Use NaCl encoding from options or default\n      const encoding = this.options.encoding || 'base64';\n\n      if (typeof key.data === 'string') {\n        if (format === 'binary') {\n          return Buffer.from(key.data, encoding);\n        }\n        return key.data;\n      }\n\n      if (Buffer.isBuffer(key.data)) {\n        if (format === 'armored') {\n          return key.data.toString(encoding);\n        }\n        return key.data;\n      }\n\n      if (key.data instanceof Uint8Array) {\n        if (format === 'binary') {\n          return Buffer.from(key.data);\n        }\n        return this.formatKey(key.data, encoding);\n      }\n\n      throw new InvalidKeyError(\n        'Invalid key data format for export',\n        this.adapterType,\n      );\n    } catch (error) {\n      throw new KeyError(\n        `Failed to export NaCl key: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  /**\n   * Sign data with signing key\n   */\n  async sign(\n    data: string | Buffer,\n    options?: SignOptions,\n  ): Promise<string | Buffer> {\n    try {\n      this.log('Signing data');\n\n      // Get signing key\n      let signingKey: Uint8Array;\n\n      if (options?.privateKey) {\n        signingKey = this.parseKey(\n          options.privateKey,\n          this.options.encoding || 'base64',\n        );\n      } else if (this.secretKey) {\n        signingKey = this.secretKey;\n      } else {\n        throw new KeyError('No signing key available', this.adapterType);\n      }\n\n      // Validate key length for signing\n      if (signingKey.length !== nacl.sign.secretKeyLength) {\n        throw new InvalidKeyError(\n          `NaCl signing key must be ${nacl.sign.secretKeyLength} bytes`,\n          this.adapterType,\n        );\n      }\n\n      // Prepare message\n      const message =\n        typeof data === 'string' ? decodeUTF8(data) : new Uint8Array(data);\n\n      // Sign the message\n      const signed = nacl.sign(message, signingKey);\n\n      this.log('Data signed successfully');\n\n      if (typeof data === 'string') {\n        return encodeBase64(signed);\n      }\n\n      return Buffer.from(signed);\n    } catch (error) {\n      throw new SignatureError(\n        `Failed to sign data: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  /**\n   * Verify signature\n   */\n  async verify(\n    data: string | Buffer,\n    signature: string | Buffer,\n    options?: VerifyOptions,\n  ): Promise<boolean> {\n    try {\n      this.log('Verifying signature');\n\n      if (!options?.publicKey) {\n        throw new KeyError(\n          'Public key required for signature verification',\n          this.adapterType,\n        );\n      }\n\n      // Get verification key\n      const verificationKey = this.parseKey(\n        options.publicKey,\n        this.options.encoding || 'base64',\n      );\n\n      // Validate key length\n      if (verificationKey.length !== nacl.sign.publicKeyLength) {\n        throw new InvalidKeyError(\n          `NaCl verification key must be ${nacl.sign.publicKeyLength} bytes`,\n          this.adapterType,\n        );\n      }\n\n      // Parse signed message\n      const signedMessage =\n        typeof signature === 'string'\n          ? decodeBase64(signature)\n          : new Uint8Array(signature);\n\n      // Verify and open the signed message (extracts original message)\n      const verified = nacl.sign.open(signedMessage, verificationKey);\n\n      if (!verified) {\n        this.log('Signature verification failed');\n        return false;\n      }\n\n      // Compare extracted message with provided data\n      const originalMessage =\n        typeof data === 'string' ? decodeUTF8(data) : new Uint8Array(data);\n\n      // Check if messages match\n      if (verified.length !== originalMessage.length) {\n        this.log('Signature verification failed: message mismatch');\n        return false;\n      }\n\n      for (let i = 0; i < verified.length; i++) {\n        if (verified[i] !== originalMessage[i]) {\n          this.log('Signature verification failed: message mismatch');\n          return false;\n        }\n      }\n\n      this.log('Signature verified successfully');\n      return true;\n    } catch (error) {\n      this.log('Signature verification failed', error);\n      return false;\n    }\n  }\n\n  async getCapabilities(): Promise<EncryptionCapabilities> {\n    return {\n      textEncryption: true,\n      fileEncryption: true,\n      bufferEncryption: true,\n      streamEncryption: false,\n      emailEncryption: false,\n      signing: true,\n      verification: true,\n      keyGeneration: true,\n      keyManagement: true,\n      multipleRecipients: false,\n      symmetricEncryption: true,\n      asymmetricEncryption: true,\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,IAAa,iBAAb,cAAoC,eAAe;CACjD;CACA;CACA;CAEA,YAAY,SAAsB;EAChC,MAAM,QAAQ,QAAQ,KAAK;EAC3B,KAAK,UAAU;EACf,KAAK,eAAe;CACtB;;;;CAKA,iBAA+B;EAC7B,MAAM,WAAW,KAAK,QAAQ,YAAY;EAG1C,IAAI,KAAK,QAAQ,WAAW;GAC1B,KAAK,YAAY,KAAK,SAAS,KAAK,QAAQ,WAAW,QAAQ;GAC/D,IAAI,KAAK,UAAU,WAAW,KAAK,UAAU,WAC3C,MAAM,IAAI,gBACR,2BAA2B,KAAK,UAAU,UAAU,SACpD,KAAK,WACP;EAEJ;EAGA,IAAI,KAAK,QAAQ,WAAW;GAC1B,KAAK,YAAY,KAAK,SAAS,KAAK,QAAQ,WAAW,QAAQ;GAC/D,IAAI,KAAK,UAAU,WAAW,KAAK,IAAI,iBACrC,MAAM,IAAI,gBACR,2BAA2B,KAAK,IAAI,gBAAgB,SACpD,KAAK,WACP;EAEJ;CACF;;;;CAKA,SACE,KACA,UACY;EACZ,IAAI,eAAe,YACjB,OAAO;EAGT,IAAI,OAAO,SAAS,GAAG,GACrB,OAAO,IAAI,WAAW,GAAG;EAG3B,IAAI,OAAO,QAAQ,UAAU;GAC3B,IAAI,aAAa,UACf,OAAO,aAAa,GAAG;GAEzB,IAAI,aAAa,OACf,OAAO,IAAI,WAAW,OAAO,KAAK,KAAK,KAAK,CAAC;GAE/C,IAAI,aAAa,QACf,OAAO,WAAW,GAAG;EAEzB;EAEA,MAAM,IAAI,gBAAgB,+BAA+B,KAAK,WAAW;CAC3E;;;;CAKA,UACE,KACA,WAAsC,UAC9B;EACR,IAAI,aAAa,UACf,OAAO,aAAa,GAAG;EAEzB,IAAI,aAAa,OACf,OAAO,OAAO,KAAK,GAAG,CAAC,CAAC,SAAS,KAAK;EAExC,IAAI,aAAa,QACf,OAAO,WAAW,GAAG;EAEvB,OAAO,aAAa,GAAG;CACzB;CAEA,MAAM,YAAY,MAAc,SAA2C;EACzE,IAAI;GACF,KAAK,IAAI,mBAAmB,EAAE,QAAQ,KAAK,OAAO,CAAC;GAEnD,MAAM,UAAU,WAAW,IAAI;GAG/B,IAAI,SAAS,oBAEX,OAAO,KAAK,kBAAkB,SAAS,OAAO;GAIhD,OAAO,KAAK,iBAAiB,OAAO;EACtC,SAAS,OAAO;GACd,MAAM,IAAI,aACR,2BAA4B,MAAgB,WAC5C,KAAK,aACL,KACF;EACF;CACF;CAEA,MAAM,YACJ,WACA,SACiB;EACjB,IAAI;GACF,KAAK,IAAI,mBAAmB,EAAE,QAAQ,UAAU,OAAO,CAAC;GAGxD,MAAM,gBAAgB,aAAa,SAAS;GAG5C,MAAM,cAAc,KAAK,UAAU;GACnC,MAAM,QAAQ,cAAc,MAAM,GAAG,WAAW;GAChD,MAAM,aAAa,cAAc,MAAM,WAAW;GAElD,IAAI;GAGJ,IAAI,KAAK,aAAa,KAAK;QAErB,WAAW,SAAS,KAAK,IAAI,iBAAiB;KAChD,MAAM,kBAAkB,WAAW,MAAM,GAAG,KAAK,IAAI,eAAe;KACpE,MAAM,mBAAmB,WAAW,MAAM,KAAK,IAAI,eAAe;KAElE,YAAY,KAAK,IAAI,KACnB,kBACA,OACA,iBACA,KAAK,SACP;KAEA,IAAI,WAAW;MACb,KAAK,IAAI,0CAA0C;MACnD,OAAO,WAAW,SAAS;KAC7B;IACF;;GAIF,IAAI,KAAK,WAAW;IAClB,YAAY,KAAK,UAAU,KAAK,YAAY,OAAO,KAAK,SAAS;IAEjE,IAAI,WAAW;KACb,KAAK,IAAI,yCAAyC;KAClD,OAAO,WAAW,SAAS;IAC7B;GACF;GAEA,MAAM,IAAI,aACR,0DACA,KAAK,WACP;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,cACnB,MAAM;GAER,MAAM,IAAI,aACR,2BAA4B,MAAgB,WAC5C,KAAK,aACL,KACF;EACF;CACF;CAEA,MAAM,cACJ,QACA,SACiB;EACjB,IAAI;GACF,KAAK,IAAI,qBAAqB,EAAE,MAAM,OAAO,OAAO,CAAC;GAErD,MAAM,UAAU,IAAI,WAAW,MAAM;GAGrC,IAAI,SAAS,oBAAoB;IAE/B,MAAM,YAAY,KAAK,kBAAkB,SAAS,OAAO;IACzD,OAAO,OAAO,KAAK,aAAa,SAAS,CAAC;GAC5C;GAGA,MAAM,YAAY,KAAK,iBAAiB,OAAO;GAC/C,OAAO,OAAO,KAAK,aAAa,SAAS,CAAC;EAC5C,SAAS,OAAO;GACd,MAAM,IAAI,aACR,6BAA8B,MAAgB,WAC9C,KAAK,aACL,KACF;EACF;CACF;CAEA,MAAM,cACJ,QACA,SACiB;EACjB,IAAI;GACF,KAAK,IAAI,qBAAqB,EAAE,MAAM,OAAO,OAAO,CAAC;GAGrD,MAAM,UAAU,aAAa,OAAO,SAAS,QAAQ,CAAC;GAGtD,MAAM,QAAQ,QAAQ,MAAM,GAAG,KAAK,UAAU,WAAW;GACzD,MAAM,aAAa,QAAQ,MAAM,KAAK,UAAU,WAAW;GAE3D,IAAI,YAA+B;GAGnC,IAAI,KAAK,aAAa,KAAK;QAErB,WAAW,SAAS,KAAK,IAAI,iBAAiB;KAChD,MAAM,kBAAkB,WAAW,MAAM,GAAG,KAAK,IAAI,eAAe;KACpE,MAAM,mBAAmB,WAAW,MAAM,KAAK,IAAI,eAAe;KAElE,YAAY,KAAK,IAAI,KACnB,kBACA,OACA,iBACA,KAAK,SACP;KAEA,IAAI,WAAW;MACb,KAAK,IAAI,4CAA4C;MACrD,OAAO,OAAO,KAAK,SAAS;KAC9B;IACF;;GAIF,IAAI,KAAK,WAAW;IAClB,YAAY,KAAK,UAAU,KAAK,YAAY,OAAO,KAAK,SAAS;IAEjE,IAAI,WAAW;KACb,KAAK,IAAI,2CAA2C;KACpD,OAAO,OAAO,KAAK,SAAS;IAC9B;GACF;GAEA,MAAM,IAAI,aACR,0DACA,KAAK,WACP;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,cACnB,MAAM;GAER,MAAM,IAAI,aACR,6BAA8B,MAAgB,WAC9C,KAAK,aACL,KACF;EACF;CACF;;;;CAKA,iBAAyB,SAA6B;EACpD,IAAI,CAAC,KAAK,WACR,MAAM,IAAI,SACR,gDACA,KAAK,WACP;EAIF,MAAM,QAAQ,KAAK,YAAY,KAAK,UAAU,WAAW;EAGzD,MAAM,aAAa,KAAK,UAAU,SAAS,OAAO,KAAK,SAAS;EAGhE,MAAM,YAAY,IAAI,WAAW,MAAM,SAAS,WAAW,MAAM;EACjE,UAAU,IAAI,KAAK;EACnB,UAAU,IAAI,YAAY,MAAM,MAAM;EAEtC,OAAO,aAAa,SAAS;CAC/B;;;;CAKA,kBACE,SACA,SACQ;EACR,IAAI,CAAC,KAAK,WACR,MAAM,IAAI,SACR,iDACA,KAAK,WACP;EAIF,MAAM,qBAAqB,KAAK,SAC9B,QAAQ,oBACR,KAAK,QAAQ,YAAY,QAC3B;EAEA,IAAI,mBAAmB,WAAW,KAAK,IAAI,iBACzC,MAAM,IAAI,gBACR,gCAAgC,KAAK,IAAI,gBAAgB,SACzD,KAAK,WACP;EAIF,MAAM,QAAQ,KAAK,YAAY,KAAK,IAAI,WAAW;EAGnD,MAAM,aAAa,KAAK,IACtB,SACA,OACA,oBACA,KAAK,SACP;EAGA,MAAM,kBACJ,KAAK,aACL,KAAK,IAAI,QAAQ,cAAc,KAAK,SAAS,CAAC,CAAC;EAGjD,MAAM,YAAY,IAAI,WACpB,MAAM,SAAS,gBAAgB,SAAS,WAAW,MACrD;EACA,UAAU,IAAI,KAAK;EACnB,UAAU,IAAI,iBAAiB,MAAM,MAAM;EAC3C,UAAU,IAAI,YAAY,MAAM,SAAS,gBAAgB,MAAM;EAE/D,OAAO,aAAa,SAAS;CAC/B;CAEA,MAAM,gBAAgB,SAA4C;EAChE,IAAI;GACF,KAAK,IAAI,4BAA4B,OAAO;GAE5C,MAAM,UAAU,SAAS,QAAQ;GAEjC,IAAI,YAAY,SAAS,YAAY,QAAQ;IAE3C,MAAM,UAAU,KAAK,IAAI,QAAQ;IAEjC,KAAK,IAAI,+BAA+B;IAExC,OAAO;KACL,WAAW,QAAQ;KACnB,YAAY,QAAQ;IACtB;GACF;GAEA,IAAI,YAAY,SAAS;IAEvB,MAAM,UAAU,KAAK,KAAK,QAAQ;IAElC,KAAK,IAAI,4BAA4B;IAErC,OAAO;KACL,WAAW,QAAQ;KACnB,YAAY,QAAQ;IACtB;GACF;GAEA,MAAM,IAAI,SACR,kCAAkC,QAAQ,uDAC1C,KAAK,WACP;EACF,SAAS,OAAO;GACd,MAAM,IAAI,SACR,qCAAsC,MAAgB,WACtD,KAAK,aACL,KACF;EACF;CACF;CAEA,MAAM,UACJ,KACA,SACc;EACd,IAAI;GACF,KAAK,IAAI,oBAAoB;GAE7B,MAAM,WAAW,KAAK,QAAQ,YAAY;GAC1C,MAAM,UAAU,OAAO,QAAQ,WAAW,MAAM,IAAI,SAAS,QAAQ;GACrE,MAAM,WAAW,KAAK,SAAS,SAAS,QAAQ;GAEhD,MAAM,UAAU,SAAS,QAAQ;GACjC,MAAM,SAAU,SAAS,UAAU;GAOnC,MAAM,iBACJ,YAAY,WACR,KAAK,IAAI,kBACT,KAAK,IAAI;GAEf,IAAI,SAAS,WAAW,gBACtB,MAAM,IAAI,gBACR,QAAQ,QAAQ,eAAe,eAAe,SAC9C,KAAK,WACP;GAGF,KAAK,IAAI,2BAA2B;GAEpC,OAAO;IACL,MAAM;IACN;IACA,MAAM;IACN,WAAW;GACb;EACF,SAAS,OAAO;GACd,MAAM,IAAI,gBACR,8BAA+B,MAAgB,WAC/C,KAAK,aACL,KACF;EACF;CACF;CAEA,MAAM,UACJ,KACA,SAC0B;EAC1B,IAAI;GACF,KAAK,IAAI,oBAAoB;GAE7B,MAAM,SAAS,SAAS,UAAU,IAAI,UAAU;GAEhD,MAAM,WAAW,KAAK,QAAQ,YAAY;GAE1C,IAAI,OAAO,IAAI,SAAS,UAAU;IAChC,IAAI,WAAW,UACb,OAAO,OAAO,KAAK,IAAI,MAAM,QAAQ;IAEvC,OAAO,IAAI;GACb;GAEA,IAAI,OAAO,SAAS,IAAI,IAAI,GAAG;IAC7B,IAAI,WAAW,WACb,OAAO,IAAI,KAAK,SAAS,QAAQ;IAEnC,OAAO,IAAI;GACb;GAEA,IAAI,IAAI,gBAAgB,YAAY;IAClC,IAAI,WAAW,UACb,OAAO,OAAO,KAAK,IAAI,IAAI;IAE7B,OAAO,KAAK,UAAU,IAAI,MAAM,QAAQ;GAC1C;GAEA,MAAM,IAAI,gBACR,sCACA,KAAK,WACP;EACF,SAAS,OAAO;GACd,MAAM,IAAI,SACR,8BAA+B,MAAgB,WAC/C,KAAK,aACL,KACF;EACF;CACF;;;;CAKA,MAAM,KACJ,MACA,SAC0B;EAC1B,IAAI;GACF,KAAK,IAAI,cAAc;GAGvB,IAAI;GAEJ,IAAI,SAAS,YACX,aAAa,KAAK,SAChB,QAAQ,YACR,KAAK,QAAQ,YAAY,QAC3B;QACK,IAAI,KAAK,WACd,aAAa,KAAK;QAElB,MAAM,IAAI,SAAS,4BAA4B,KAAK,WAAW;GAIjE,IAAI,WAAW,WAAW,KAAK,KAAK,iBAClC,MAAM,IAAI,gBACR,4BAA4B,KAAK,KAAK,gBAAgB,SACtD,KAAK,WACP;GAIF,MAAM,UACJ,OAAO,SAAS,WAAW,WAAW,IAAI,IAAI,IAAI,WAAW,IAAI;GAGnE,MAAM,SAAS,KAAK,KAAK,SAAS,UAAU;GAE5C,KAAK,IAAI,0BAA0B;GAEnC,IAAI,OAAO,SAAS,UAClB,OAAO,aAAa,MAAM;GAG5B,OAAO,OAAO,KAAK,MAAM;EAC3B,SAAS,OAAO;GACd,MAAM,IAAI,eACR,wBAAyB,MAAgB,WACzC,KAAK,aACL,KACF;EACF;CACF;;;;CAKA,MAAM,OACJ,MACA,WACA,SACkB;EAClB,IAAI;GACF,KAAK,IAAI,qBAAqB;GAE9B,IAAI,CAAC,SAAS,WACZ,MAAM,IAAI,SACR,kDACA,KAAK,WACP;GAIF,MAAM,kBAAkB,KAAK,SAC3B,QAAQ,WACR,KAAK,QAAQ,YAAY,QAC3B;GAGA,IAAI,gBAAgB,WAAW,KAAK,KAAK,iBACvC,MAAM,IAAI,gBACR,iCAAiC,KAAK,KAAK,gBAAgB,SAC3D,KAAK,WACP;GAIF,MAAM,gBACJ,OAAO,cAAc,WACjB,aAAa,SAAS,IACtB,IAAI,WAAW,SAAS;GAG9B,MAAM,WAAW,KAAK,KAAK,KAAK,eAAe,eAAe;GAE9D,IAAI,CAAC,UAAU;IACb,KAAK,IAAI,+BAA+B;IACxC,OAAO;GACT;GAGA,MAAM,kBACJ,OAAO,SAAS,WAAW,WAAW,IAAI,IAAI,IAAI,WAAW,IAAI;GAGnE,IAAI,SAAS,WAAW,gBAAgB,QAAQ;IAC9C,KAAK,IAAI,iDAAiD;IAC1D,OAAO;GACT;GAEA,KAAK,IAAI,IAAI,GAAG,IAAI,SAAS,QAAQ,KACnC,IAAI,SAAS,OAAO,gBAAgB,IAAI;IACtC,KAAK,IAAI,iDAAiD;IAC1D,OAAO;GACT;GAGF,KAAK,IAAI,iCAAiC;GAC1C,OAAO;EACT,SAAS,OAAO;GACd,KAAK,IAAI,iCAAiC,KAAK;GAC/C,OAAO;EACT;CACF;CAEA,MAAM,kBAAmD;EACvD,OAAO;GACL,gBAAgB;GAChB,gBAAgB;GAChB,kBAAkB;GAClB,kBAAkB;GAClB,iBAAiB;GACjB,SAAS;GACT,cAAc;GACd,eAAe;GACf,eAAe;GACf,oBAAoB;GACpB,qBAAqB;GACrB,sBAAsB;EACxB;CACF;AACF"}
+{"version":3,"file":"nacl-Ct71p1KK.js","names":[],"sources":["../../src/adapters/nacl.ts"],"sourcesContent":["import nacl from 'tweetnacl';\nimport {\n  decodeBase64,\n  decodeUTF8,\n  encodeBase64,\n  encodeUTF8,\n} from 'tweetnacl-util';\nimport { BaseEncryption } from '../shared/base.js';\nimport {\n  DecryptError,\n  EncryptError,\n  InvalidKeyError,\n  KeyError,\n  SignatureError,\n} from '../shared/errors.js';\nimport type {\n  DecryptOptions,\n  EncryptionCapabilities,\n  EncryptOptions,\n  ExportKeyOptions,\n  ImportKeyOptions,\n  Key,\n  KeyPair,\n  KeyPairOptions,\n  NaClOptions,\n  SignOptions,\n  VerifyOptions,\n} from '../shared/types.js';\n\n/**\n * NaCl/TweetNaCl encryption adapter\n *\n * Provides fast, modern cryptography using the NaCl library.\n * Supports both symmetric (secretbox) and asymmetric (box) encryption.\n *\n * @example\n * ```typescript\n * // Symmetric encryption\n * const nacl = new NaClEncryption({\n *   type: 'nacl',\n *   secretKey: secretKey\n * });\n *\n * const encrypted = await nacl.encryptText('Secret message');\n * const decrypted = await nacl.decryptText(encrypted);\n *\n * // Asymmetric encryption\n * const nacl = new NaClEncryption({\n *   type: 'nacl',\n *   publicKey: theirPublicKey,\n *   secretKey: mySecretKey\n * });\n *\n * const encrypted = await nacl.encryptText('Secret message', {\n *   recipientPublicKey: theirPublicKey\n * });\n * const decrypted = await nacl.decryptText(encrypted);\n * ```\n */\nexport class NaClEncryption extends BaseEncryption {\n  private options: NaClOptions;\n  private secretKey?: Uint8Array;\n  private publicKey?: Uint8Array;\n\n  constructor(options: NaClOptions) {\n    super('nacl', options.debug);\n    this.options = options;\n    this.initializeKeys();\n  }\n\n  /**\n   * Initialize keys from options\n   */\n  private initializeKeys(): void {\n    const encoding = this.options.encoding || 'base64';\n\n    // Initialize secret key for symmetric encryption\n    if (this.options.secretKey) {\n      this.secretKey = this.parseKey(this.options.secretKey, encoding);\n      if (this.secretKey.length !== nacl.secretbox.keyLength) {\n        throw new InvalidKeyError(\n          `NaCl secret key must be ${nacl.secretbox.keyLength} bytes`,\n          this.adapterType,\n        );\n      }\n    }\n\n    // Initialize public key for asymmetric encryption\n    if (this.options.publicKey) {\n      this.publicKey = this.parseKey(this.options.publicKey, encoding);\n      if (this.publicKey.length !== nacl.box.publicKeyLength) {\n        throw new InvalidKeyError(\n          `NaCl public key must be ${nacl.box.publicKeyLength} bytes`,\n          this.adapterType,\n        );\n      }\n    }\n  }\n\n  /**\n   * Parse key from various formats\n   */\n  private parseKey(\n    key: Uint8Array | Buffer | string,\n    encoding: 'base64' | 'hex' | 'utf8',\n  ): Uint8Array {\n    if (key instanceof Uint8Array) {\n      return key;\n    }\n\n    if (Buffer.isBuffer(key)) {\n      return new Uint8Array(key);\n    }\n\n    if (typeof key === 'string') {\n      if (encoding === 'base64') {\n        return decodeBase64(key);\n      }\n      if (encoding === 'hex') {\n        return new Uint8Array(Buffer.from(key, 'hex'));\n      }\n      if (encoding === 'utf8') {\n        return decodeUTF8(key);\n      }\n    }\n\n    throw new InvalidKeyError('Invalid key format for NaCl', this.adapterType);\n  }\n\n  /**\n   * Format key for output\n   */\n  private formatKey(\n    key: Uint8Array,\n    encoding: 'base64' | 'hex' | 'utf8' = 'base64',\n  ): string {\n    if (encoding === 'base64') {\n      return encodeBase64(key);\n    }\n    if (encoding === 'hex') {\n      return Buffer.from(key).toString('hex');\n    }\n    if (encoding === 'utf8') {\n      return encodeUTF8(key);\n    }\n    return encodeBase64(key);\n  }\n\n  async encryptText(text: string, options?: EncryptOptions): Promise<string> {\n    try {\n      this.log('Encrypting text', { length: text.length });\n\n      const message = decodeUTF8(text);\n\n      // Check if asymmetric or symmetric encryption\n      if (options?.recipientPublicKey) {\n        // Asymmetric encryption (box)\n        return this.encryptAsymmetric(message, options);\n      }\n\n      // Symmetric encryption (secretbox)\n      return this.encryptSymmetric(message);\n    } catch (error) {\n      throw new EncryptError(\n        `Failed to encrypt text: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  async decryptText(\n    encrypted: string,\n    options?: DecryptOptions,\n  ): Promise<string> {\n    try {\n      this.log('Decrypting text', { length: encrypted.length });\n\n      // Decode the encrypted message\n      const encryptedData = decodeBase64(encrypted);\n\n      // Extract nonce and ciphertext\n      const nonceLength = nacl.secretbox.nonceLength;\n      const nonce = encryptedData.slice(0, nonceLength);\n      const ciphertext = encryptedData.slice(nonceLength);\n\n      let decrypted: Uint8Array | null;\n\n      // Try asymmetric decryption first if we have keys\n      if (this.publicKey && this.secretKey) {\n        // Check if there's a public key in the message (for box)\n        if (ciphertext.length > nacl.box.publicKeyLength) {\n          const senderPublicKey = ciphertext.slice(0, nacl.box.publicKeyLength);\n          const actualCiphertext = ciphertext.slice(nacl.box.publicKeyLength);\n\n          decrypted = nacl.box.open(\n            actualCiphertext,\n            nonce,\n            senderPublicKey,\n            this.secretKey,\n          );\n\n          if (decrypted) {\n            this.log('Text decrypted successfully (asymmetric)');\n            return encodeUTF8(decrypted);\n          }\n        }\n      }\n\n      // Try symmetric decryption\n      if (this.secretKey) {\n        decrypted = nacl.secretbox.open(ciphertext, nonce, this.secretKey);\n\n        if (decrypted) {\n          this.log('Text decrypted successfully (symmetric)');\n          return encodeUTF8(decrypted);\n        }\n      }\n\n      throw new DecryptError(\n        'Decryption failed: invalid key or corrupted ciphertext',\n        this.adapterType,\n      );\n    } catch (error) {\n      if (error instanceof DecryptError) {\n        throw error;\n      }\n      throw new DecryptError(\n        `Failed to decrypt text: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  async encryptBuffer(\n    buffer: Buffer,\n    options?: EncryptOptions,\n  ): Promise<Buffer> {\n    try {\n      this.log('Encrypting buffer', { size: buffer.length });\n\n      const message = new Uint8Array(buffer);\n\n      // Check if asymmetric or symmetric encryption\n      if (options?.recipientPublicKey) {\n        // Asymmetric encryption (box)\n        const encrypted = this.encryptAsymmetric(message, options);\n        return Buffer.from(decodeBase64(encrypted));\n      }\n\n      // Symmetric encryption (secretbox)\n      const encrypted = this.encryptSymmetric(message);\n      return Buffer.from(decodeBase64(encrypted));\n    } catch (error) {\n      throw new EncryptError(\n        `Failed to encrypt buffer: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  async decryptBuffer(\n    buffer: Buffer,\n    options?: DecryptOptions,\n  ): Promise<Buffer> {\n    try {\n      this.log('Decrypting buffer', { size: buffer.length });\n\n      // Decode the base64 buffer\n      const decoded = decodeBase64(buffer.toString('base64'));\n\n      // Extract nonce and ciphertext\n      const nonce = decoded.slice(0, nacl.secretbox.nonceLength);\n      const ciphertext = decoded.slice(nacl.secretbox.nonceLength);\n\n      let decrypted: Uint8Array | null = null;\n\n      // Try asymmetric decryption first if we have keys\n      if (this.publicKey && this.secretKey) {\n        // Check if there's a public key in the message (for box)\n        if (ciphertext.length > nacl.box.publicKeyLength) {\n          const senderPublicKey = ciphertext.slice(0, nacl.box.publicKeyLength);\n          const actualCiphertext = ciphertext.slice(nacl.box.publicKeyLength);\n\n          decrypted = nacl.box.open(\n            actualCiphertext,\n            nonce,\n            senderPublicKey,\n            this.secretKey,\n          );\n\n          if (decrypted) {\n            this.log('Buffer decrypted successfully (asymmetric)');\n            return Buffer.from(decrypted);\n          }\n        }\n      }\n\n      // Try symmetric decryption\n      if (this.secretKey) {\n        decrypted = nacl.secretbox.open(ciphertext, nonce, this.secretKey);\n\n        if (decrypted) {\n          this.log('Buffer decrypted successfully (symmetric)');\n          return Buffer.from(decrypted);\n        }\n      }\n\n      throw new DecryptError(\n        'Decryption failed: invalid key or corrupted ciphertext',\n        this.adapterType,\n      );\n    } catch (error) {\n      if (error instanceof DecryptError) {\n        throw error;\n      }\n      throw new DecryptError(\n        `Failed to decrypt buffer: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  /**\n   * Symmetric encryption using secretbox\n   */\n  private encryptSymmetric(message: Uint8Array): string {\n    if (!this.secretKey) {\n      throw new KeyError(\n        'Secret key required for symmetric encryption',\n        this.adapterType,\n      );\n    }\n\n    // Generate random nonce\n    const nonce = nacl.randomBytes(nacl.secretbox.nonceLength);\n\n    // Encrypt the message\n    const ciphertext = nacl.secretbox(message, nonce, this.secretKey);\n\n    // Combine nonce and ciphertext\n    const encrypted = new Uint8Array(nonce.length + ciphertext.length);\n    encrypted.set(nonce);\n    encrypted.set(ciphertext, nonce.length);\n\n    return encodeBase64(encrypted);\n  }\n\n  /**\n   * Asymmetric encryption using box\n   */\n  private encryptAsymmetric(\n    message: Uint8Array,\n    options: EncryptOptions,\n  ): string {\n    if (!this.secretKey) {\n      throw new KeyError(\n        'Secret key required for asymmetric encryption',\n        this.adapterType,\n      );\n    }\n\n    // Get recipient public key\n    const recipientPublicKey = this.parseKey(\n      options.recipientPublicKey as string | Uint8Array | Buffer,\n      this.options.encoding || 'base64',\n    );\n\n    if (recipientPublicKey.length !== nacl.box.publicKeyLength) {\n      throw new InvalidKeyError(\n        `Recipient public key must be ${nacl.box.publicKeyLength} bytes`,\n        this.adapterType,\n      );\n    }\n\n    // Generate random nonce\n    const nonce = nacl.randomBytes(nacl.box.nonceLength);\n\n    // Encrypt the message\n    const ciphertext = nacl.box(\n      message,\n      nonce,\n      recipientPublicKey,\n      this.secretKey,\n    );\n\n    // Include sender's public key in the message\n    const senderPublicKey =\n      this.publicKey ||\n      nacl.box.keyPair.fromSecretKey(this.secretKey).publicKey;\n\n    // Combine nonce, sender public key, and ciphertext\n    const encrypted = new Uint8Array(\n      nonce.length + senderPublicKey.length + ciphertext.length,\n    );\n    encrypted.set(nonce);\n    encrypted.set(senderPublicKey, nonce.length);\n    encrypted.set(ciphertext, nonce.length + senderPublicKey.length);\n\n    return encodeBase64(encrypted);\n  }\n\n  async generateKeyPair(options?: KeyPairOptions): Promise<KeyPair> {\n    try {\n      this.log('Generating NaCl key pair', options);\n\n      const keyType = options?.type || 'box';\n\n      if (keyType === 'box' || keyType === 'ecdh') {\n        // Generate encryption keypair\n        const keypair = nacl.box.keyPair();\n\n        this.log('Encryption key pair generated');\n\n        return {\n          publicKey: keypair.publicKey,\n          privateKey: keypair.secretKey,\n        };\n      }\n\n      if (keyType === 'ecdsa') {\n        // Generate signing keypair\n        const keypair = nacl.sign.keyPair();\n\n        this.log('Signing key pair generated');\n\n        return {\n          publicKey: keypair.publicKey,\n          privateKey: keypair.secretKey,\n        };\n      }\n\n      throw new KeyError(\n        `Unsupported key type for NaCl: ${keyType}. Use 'box' for encryption or 'sign' for signatures.`,\n        this.adapterType,\n      );\n    } catch (error) {\n      throw new KeyError(\n        `Failed to generate NaCl key pair: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  async importKey(\n    key: string | Buffer,\n    options?: ImportKeyOptions,\n  ): Promise<Key> {\n    try {\n      this.log('Importing NaCl key');\n\n      const encoding = this.options.encoding || 'base64';\n      const keyData = typeof key === 'string' ? key : key.toString(encoding);\n      const keyBytes = this.parseKey(keyData, encoding);\n\n      const keyType = options?.type || 'public';\n      const format = (options?.format || 'armored') as\n        | 'armored'\n        | 'binary'\n        | 'pem'\n        | 'der';\n\n      // Validate key length\n      const expectedLength =\n        keyType === 'public'\n          ? nacl.box.publicKeyLength\n          : nacl.box.secretKeyLength;\n\n      if (keyBytes.length !== expectedLength) {\n        throw new InvalidKeyError(\n          `NaCl ${keyType} key must be ${expectedLength} bytes`,\n          this.adapterType,\n        );\n      }\n\n      this.log('Key imported successfully');\n\n      return {\n        type: keyType as 'public' | 'private',\n        format,\n        data: keyData,\n        algorithm: 'nacl',\n      };\n    } catch (error) {\n      throw new InvalidKeyError(\n        `Failed to import NaCl key: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  async exportKey(\n    key: Key,\n    options?: ExportKeyOptions,\n  ): Promise<string | Buffer> {\n    try {\n      this.log('Exporting NaCl key');\n\n      const format = options?.format || key.format || 'armored';\n      // Use NaCl encoding from options or default\n      const encoding = this.options.encoding || 'base64';\n\n      if (typeof key.data === 'string') {\n        if (format === 'binary') {\n          return Buffer.from(key.data, encoding);\n        }\n        return key.data;\n      }\n\n      if (Buffer.isBuffer(key.data)) {\n        if (format === 'armored') {\n          return key.data.toString(encoding);\n        }\n        return key.data;\n      }\n\n      if (key.data instanceof Uint8Array) {\n        if (format === 'binary') {\n          return Buffer.from(key.data);\n        }\n        return this.formatKey(key.data, encoding);\n      }\n\n      throw new InvalidKeyError(\n        'Invalid key data format for export',\n        this.adapterType,\n      );\n    } catch (error) {\n      throw new KeyError(\n        `Failed to export NaCl key: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  /**\n   * Sign data with signing key\n   */\n  async sign(\n    data: string | Buffer,\n    options?: SignOptions,\n  ): Promise<string | Buffer> {\n    try {\n      this.log('Signing data');\n\n      // Get signing key\n      let signingKey: Uint8Array;\n\n      if (options?.privateKey) {\n        signingKey = this.parseKey(\n          options.privateKey,\n          this.options.encoding || 'base64',\n        );\n      } else if (this.secretKey) {\n        signingKey = this.secretKey;\n      } else {\n        throw new KeyError('No signing key available', this.adapterType);\n      }\n\n      // Validate key length for signing\n      if (signingKey.length !== nacl.sign.secretKeyLength) {\n        throw new InvalidKeyError(\n          `NaCl signing key must be ${nacl.sign.secretKeyLength} bytes`,\n          this.adapterType,\n        );\n      }\n\n      // Prepare message\n      const message =\n        typeof data === 'string' ? decodeUTF8(data) : new Uint8Array(data);\n\n      // Sign the message\n      const signed = nacl.sign(message, signingKey);\n\n      this.log('Data signed successfully');\n\n      if (typeof data === 'string') {\n        return encodeBase64(signed);\n      }\n\n      return Buffer.from(signed);\n    } catch (error) {\n      throw new SignatureError(\n        `Failed to sign data: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  /**\n   * Verify signature\n   */\n  async verify(\n    data: string | Buffer,\n    signature: string | Buffer,\n    options?: VerifyOptions,\n  ): Promise<boolean> {\n    try {\n      this.log('Verifying signature');\n\n      if (!options?.publicKey) {\n        throw new KeyError(\n          'Public key required for signature verification',\n          this.adapterType,\n        );\n      }\n\n      // Get verification key\n      const verificationKey = this.parseKey(\n        options.publicKey,\n        this.options.encoding || 'base64',\n      );\n\n      // Validate key length\n      if (verificationKey.length !== nacl.sign.publicKeyLength) {\n        throw new InvalidKeyError(\n          `NaCl verification key must be ${nacl.sign.publicKeyLength} bytes`,\n          this.adapterType,\n        );\n      }\n\n      // Parse signed message\n      const signedMessage =\n        typeof signature === 'string'\n          ? decodeBase64(signature)\n          : new Uint8Array(signature);\n\n      // Verify and open the signed message (extracts original message)\n      const verified = nacl.sign.open(signedMessage, verificationKey);\n\n      if (!verified) {\n        this.log('Signature verification failed');\n        return false;\n      }\n\n      // Compare extracted message with provided data\n      const originalMessage =\n        typeof data === 'string' ? decodeUTF8(data) : new Uint8Array(data);\n\n      // Check if messages match\n      if (verified.length !== originalMessage.length) {\n        this.log('Signature verification failed: message mismatch');\n        return false;\n      }\n\n      for (let i = 0; i < verified.length; i++) {\n        if (verified[i] !== originalMessage[i]) {\n          this.log('Signature verification failed: message mismatch');\n          return false;\n        }\n      }\n\n      this.log('Signature verified successfully');\n      return true;\n    } catch (error) {\n      this.log('Signature verification failed', error);\n      return false;\n    }\n  }\n\n  async getCapabilities(): Promise<EncryptionCapabilities> {\n    return {\n      textEncryption: true,\n      fileEncryption: true,\n      bufferEncryption: true,\n      streamEncryption: false,\n      emailEncryption: false,\n      signing: true,\n      verification: true,\n      keyGeneration: true,\n      keyManagement: true,\n      multipleRecipients: false,\n      symmetricEncryption: true,\n      asymmetricEncryption: true,\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,IAAa,iBAAb,cAAoC,eAAe;CACjD;CACA;CACA;CAEA,YAAY,SAAsB;EAChC,MAAM,QAAQ,QAAQ,KAAK;EAC3B,KAAK,UAAU;EACf,KAAK,eAAe;CACtB;;;;CAKA,iBAA+B;EAC7B,MAAM,WAAW,KAAK,QAAQ,YAAY;EAG1C,IAAI,KAAK,QAAQ,WAAW;GAC1B,KAAK,YAAY,KAAK,SAAS,KAAK,QAAQ,WAAW,QAAQ;GAC/D,IAAI,KAAK,UAAU,WAAW,KAAK,UAAU,WAC3C,MAAM,IAAI,gBACR,2BAA2B,KAAK,UAAU,UAAU,SACpD,KAAK,WACP;EAEJ;EAGA,IAAI,KAAK,QAAQ,WAAW;GAC1B,KAAK,YAAY,KAAK,SAAS,KAAK,QAAQ,WAAW,QAAQ;GAC/D,IAAI,KAAK,UAAU,WAAW,KAAK,IAAI,iBACrC,MAAM,IAAI,gBACR,2BAA2B,KAAK,IAAI,gBAAgB,SACpD,KAAK,WACP;EAEJ;CACF;;;;CAKA,SACE,KACA,UACY;EACZ,IAAI,eAAe,YACjB,OAAO;EAGT,IAAI,OAAO,SAAS,GAAG,GACrB,OAAO,IAAI,WAAW,GAAG;EAG3B,IAAI,OAAO,QAAQ,UAAU;GAC3B,IAAI,aAAa,UACf,OAAO,aAAa,GAAG;GAEzB,IAAI,aAAa,OACf,OAAO,IAAI,WAAW,OAAO,KAAK,KAAK,KAAK,CAAC;GAE/C,IAAI,aAAa,QACf,OAAO,WAAW,GAAG;EAEzB;EAEA,MAAM,IAAI,gBAAgB,+BAA+B,KAAK,WAAW;CAC3E;;;;CAKA,UACE,KACA,WAAsC,UAC9B;EACR,IAAI,aAAa,UACf,OAAO,aAAa,GAAG;EAEzB,IAAI,aAAa,OACf,OAAO,OAAO,KAAK,GAAG,CAAC,CAAC,SAAS,KAAK;EAExC,IAAI,aAAa,QACf,OAAO,WAAW,GAAG;EAEvB,OAAO,aAAa,GAAG;CACzB;CAEA,MAAM,YAAY,MAAc,SAA2C;EACzE,IAAI;GACF,KAAK,IAAI,mBAAmB,EAAE,QAAQ,KAAK,OAAO,CAAC;GAEnD,MAAM,UAAU,WAAW,IAAI;GAG/B,IAAI,SAAS,oBAEX,OAAO,KAAK,kBAAkB,SAAS,OAAO;GAIhD,OAAO,KAAK,iBAAiB,OAAO;EACtC,SAAS,OAAO;GACd,MAAM,IAAI,aACR,2BAA4B,MAAgB,WAC5C,KAAK,aACL,KACF;EACF;CACF;CAEA,MAAM,YACJ,WACA,SACiB;EACjB,IAAI;GACF,KAAK,IAAI,mBAAmB,EAAE,QAAQ,UAAU,OAAO,CAAC;GAGxD,MAAM,gBAAgB,aAAa,SAAS;GAG5C,MAAM,cAAc,KAAK,UAAU;GACnC,MAAM,QAAQ,cAAc,MAAM,GAAG,WAAW;GAChD,MAAM,aAAa,cAAc,MAAM,WAAW;GAElD,IAAI;GAGJ,IAAI,KAAK,aAAa,KAAK;QAErB,WAAW,SAAS,KAAK,IAAI,iBAAiB;KAChD,MAAM,kBAAkB,WAAW,MAAM,GAAG,KAAK,IAAI,eAAe;KACpE,MAAM,mBAAmB,WAAW,MAAM,KAAK,IAAI,eAAe;KAElE,YAAY,KAAK,IAAI,KACnB,kBACA,OACA,iBACA,KAAK,SACP;KAEA,IAAI,WAAW;MACb,KAAK,IAAI,0CAA0C;MACnD,OAAO,WAAW,SAAS;KAC7B;IACF;;GAIF,IAAI,KAAK,WAAW;IAClB,YAAY,KAAK,UAAU,KAAK,YAAY,OAAO,KAAK,SAAS;IAEjE,IAAI,WAAW;KACb,KAAK,IAAI,yCAAyC;KAClD,OAAO,WAAW,SAAS;IAC7B;GACF;GAEA,MAAM,IAAI,aACR,0DACA,KAAK,WACP;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,cACnB,MAAM;GAER,MAAM,IAAI,aACR,2BAA4B,MAAgB,WAC5C,KAAK,aACL,KACF;EACF;CACF;CAEA,MAAM,cACJ,QACA,SACiB;EACjB,IAAI;GACF,KAAK,IAAI,qBAAqB,EAAE,MAAM,OAAO,OAAO,CAAC;GAErD,MAAM,UAAU,IAAI,WAAW,MAAM;GAGrC,IAAI,SAAS,oBAAoB;IAE/B,MAAM,YAAY,KAAK,kBAAkB,SAAS,OAAO;IACzD,OAAO,OAAO,KAAK,aAAa,SAAS,CAAC;GAC5C;GAGA,MAAM,YAAY,KAAK,iBAAiB,OAAO;GAC/C,OAAO,OAAO,KAAK,aAAa,SAAS,CAAC;EAC5C,SAAS,OAAO;GACd,MAAM,IAAI,aACR,6BAA8B,MAAgB,WAC9C,KAAK,aACL,KACF;EACF;CACF;CAEA,MAAM,cACJ,QACA,SACiB;EACjB,IAAI;GACF,KAAK,IAAI,qBAAqB,EAAE,MAAM,OAAO,OAAO,CAAC;GAGrD,MAAM,UAAU,aAAa,OAAO,SAAS,QAAQ,CAAC;GAGtD,MAAM,QAAQ,QAAQ,MAAM,GAAG,KAAK,UAAU,WAAW;GACzD,MAAM,aAAa,QAAQ,MAAM,KAAK,UAAU,WAAW;GAE3D,IAAI,YAA+B;GAGnC,IAAI,KAAK,aAAa,KAAK;QAErB,WAAW,SAAS,KAAK,IAAI,iBAAiB;KAChD,MAAM,kBAAkB,WAAW,MAAM,GAAG,KAAK,IAAI,eAAe;KACpE,MAAM,mBAAmB,WAAW,MAAM,KAAK,IAAI,eAAe;KAElE,YAAY,KAAK,IAAI,KACnB,kBACA,OACA,iBACA,KAAK,SACP;KAEA,IAAI,WAAW;MACb,KAAK,IAAI,4CAA4C;MACrD,OAAO,OAAO,KAAK,SAAS;KAC9B;IACF;;GAIF,IAAI,KAAK,WAAW;IAClB,YAAY,KAAK,UAAU,KAAK,YAAY,OAAO,KAAK,SAAS;IAEjE,IAAI,WAAW;KACb,KAAK,IAAI,2CAA2C;KACpD,OAAO,OAAO,KAAK,SAAS;IAC9B;GACF;GAEA,MAAM,IAAI,aACR,0DACA,KAAK,WACP;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,cACnB,MAAM;GAER,MAAM,IAAI,aACR,6BAA8B,MAAgB,WAC9C,KAAK,aACL,KACF;EACF;CACF;;;;CAKA,iBAAyB,SAA6B;EACpD,IAAI,CAAC,KAAK,WACR,MAAM,IAAI,SACR,gDACA,KAAK,WACP;EAIF,MAAM,QAAQ,KAAK,YAAY,KAAK,UAAU,WAAW;EAGzD,MAAM,aAAa,KAAK,UAAU,SAAS,OAAO,KAAK,SAAS;EAGhE,MAAM,YAAY,IAAI,WAAW,MAAM,SAAS,WAAW,MAAM;EACjE,UAAU,IAAI,KAAK;EACnB,UAAU,IAAI,YAAY,MAAM,MAAM;EAEtC,OAAO,aAAa,SAAS;CAC/B;;;;CAKA,kBACE,SACA,SACQ;EACR,IAAI,CAAC,KAAK,WACR,MAAM,IAAI,SACR,iDACA,KAAK,WACP;EAIF,MAAM,qBAAqB,KAAK,SAC9B,QAAQ,oBACR,KAAK,QAAQ,YAAY,QAC3B;EAEA,IAAI,mBAAmB,WAAW,KAAK,IAAI,iBACzC,MAAM,IAAI,gBACR,gCAAgC,KAAK,IAAI,gBAAgB,SACzD,KAAK,WACP;EAIF,MAAM,QAAQ,KAAK,YAAY,KAAK,IAAI,WAAW;EAGnD,MAAM,aAAa,KAAK,IACtB,SACA,OACA,oBACA,KAAK,SACP;EAGA,MAAM,kBACJ,KAAK,aACL,KAAK,IAAI,QAAQ,cAAc,KAAK,SAAS,CAAC,CAAC;EAGjD,MAAM,YAAY,IAAI,WACpB,MAAM,SAAS,gBAAgB,SAAS,WAAW,MACrD;EACA,UAAU,IAAI,KAAK;EACnB,UAAU,IAAI,iBAAiB,MAAM,MAAM;EAC3C,UAAU,IAAI,YAAY,MAAM,SAAS,gBAAgB,MAAM;EAE/D,OAAO,aAAa,SAAS;CAC/B;CAEA,MAAM,gBAAgB,SAA4C;EAChE,IAAI;GACF,KAAK,IAAI,4BAA4B,OAAO;GAE5C,MAAM,UAAU,SAAS,QAAQ;GAEjC,IAAI,YAAY,SAAS,YAAY,QAAQ;IAE3C,MAAM,UAAU,KAAK,IAAI,QAAQ;IAEjC,KAAK,IAAI,+BAA+B;IAExC,OAAO;KACL,WAAW,QAAQ;KACnB,YAAY,QAAQ;IACtB;GACF;GAEA,IAAI,YAAY,SAAS;IAEvB,MAAM,UAAU,KAAK,KAAK,QAAQ;IAElC,KAAK,IAAI,4BAA4B;IAErC,OAAO;KACL,WAAW,QAAQ;KACnB,YAAY,QAAQ;IACtB;GACF;GAEA,MAAM,IAAI,SACR,kCAAkC,QAAQ,uDAC1C,KAAK,WACP;EACF,SAAS,OAAO;GACd,MAAM,IAAI,SACR,qCAAsC,MAAgB,WACtD,KAAK,aACL,KACF;EACF;CACF;CAEA,MAAM,UACJ,KACA,SACc;EACd,IAAI;GACF,KAAK,IAAI,oBAAoB;GAE7B,MAAM,WAAW,KAAK,QAAQ,YAAY;GAC1C,MAAM,UAAU,OAAO,QAAQ,WAAW,MAAM,IAAI,SAAS,QAAQ;GACrE,MAAM,WAAW,KAAK,SAAS,SAAS,QAAQ;GAEhD,MAAM,UAAU,SAAS,QAAQ;GACjC,MAAM,SAAU,SAAS,UAAU;GAOnC,MAAM,iBACJ,YAAY,WACR,KAAK,IAAI,kBACT,KAAK,IAAI;GAEf,IAAI,SAAS,WAAW,gBACtB,MAAM,IAAI,gBACR,QAAQ,QAAQ,eAAe,eAAe,SAC9C,KAAK,WACP;GAGF,KAAK,IAAI,2BAA2B;GAEpC,OAAO;IACL,MAAM;IACN;IACA,MAAM;IACN,WAAW;GACb;EACF,SAAS,OAAO;GACd,MAAM,IAAI,gBACR,8BAA+B,MAAgB,WAC/C,KAAK,aACL,KACF;EACF;CACF;CAEA,MAAM,UACJ,KACA,SAC0B;EAC1B,IAAI;GACF,KAAK,IAAI,oBAAoB;GAE7B,MAAM,SAAS,SAAS,UAAU,IAAI,UAAU;GAEhD,MAAM,WAAW,KAAK,QAAQ,YAAY;GAE1C,IAAI,OAAO,IAAI,SAAS,UAAU;IAChC,IAAI,WAAW,UACb,OAAO,OAAO,KAAK,IAAI,MAAM,QAAQ;IAEvC,OAAO,IAAI;GACb;GAEA,IAAI,OAAO,SAAS,IAAI,IAAI,GAAG;IAC7B,IAAI,WAAW,WACb,OAAO,IAAI,KAAK,SAAS,QAAQ;IAEnC,OAAO,IAAI;GACb;GAEA,IAAI,IAAI,gBAAgB,YAAY;IAClC,IAAI,WAAW,UACb,OAAO,OAAO,KAAK,IAAI,IAAI;IAE7B,OAAO,KAAK,UAAU,IAAI,MAAM,QAAQ;GAC1C;GAEA,MAAM,IAAI,gBACR,sCACA,KAAK,WACP;EACF,SAAS,OAAO;GACd,MAAM,IAAI,SACR,8BAA+B,MAAgB,WAC/C,KAAK,aACL,KACF;EACF;CACF;;;;CAKA,MAAM,KACJ,MACA,SAC0B;EAC1B,IAAI;GACF,KAAK,IAAI,cAAc;GAGvB,IAAI;GAEJ,IAAI,SAAS,YACX,aAAa,KAAK,SAChB,QAAQ,YACR,KAAK,QAAQ,YAAY,QAC3B;QACK,IAAI,KAAK,WACd,aAAa,KAAK;QAElB,MAAM,IAAI,SAAS,4BAA4B,KAAK,WAAW;GAIjE,IAAI,WAAW,WAAW,KAAK,KAAK,iBAClC,MAAM,IAAI,gBACR,4BAA4B,KAAK,KAAK,gBAAgB,SACtD,KAAK,WACP;GAIF,MAAM,UACJ,OAAO,SAAS,WAAW,WAAW,IAAI,IAAI,IAAI,WAAW,IAAI;GAGnE,MAAM,SAAS,KAAK,KAAK,SAAS,UAAU;GAE5C,KAAK,IAAI,0BAA0B;GAEnC,IAAI,OAAO,SAAS,UAClB,OAAO,aAAa,MAAM;GAG5B,OAAO,OAAO,KAAK,MAAM;EAC3B,SAAS,OAAO;GACd,MAAM,IAAI,eACR,wBAAyB,MAAgB,WACzC,KAAK,aACL,KACF;EACF;CACF;;;;CAKA,MAAM,OACJ,MACA,WACA,SACkB;EAClB,IAAI;GACF,KAAK,IAAI,qBAAqB;GAE9B,IAAI,CAAC,SAAS,WACZ,MAAM,IAAI,SACR,kDACA,KAAK,WACP;GAIF,MAAM,kBAAkB,KAAK,SAC3B,QAAQ,WACR,KAAK,QAAQ,YAAY,QAC3B;GAGA,IAAI,gBAAgB,WAAW,KAAK,KAAK,iBACvC,MAAM,IAAI,gBACR,iCAAiC,KAAK,KAAK,gBAAgB,SAC3D,KAAK,WACP;GAIF,MAAM,gBACJ,OAAO,cAAc,WACjB,aAAa,SAAS,IACtB,IAAI,WAAW,SAAS;GAG9B,MAAM,WAAW,KAAK,KAAK,KAAK,eAAe,eAAe;GAE9D,IAAI,CAAC,UAAU;IACb,KAAK,IAAI,+BAA+B;IACxC,OAAO;GACT;GAGA,MAAM,kBACJ,OAAO,SAAS,WAAW,WAAW,IAAI,IAAI,IAAI,WAAW,IAAI;GAGnE,IAAI,SAAS,WAAW,gBAAgB,QAAQ;IAC9C,KAAK,IAAI,iDAAiD;IAC1D,OAAO;GACT;GAEA,KAAK,IAAI,IAAI,GAAG,IAAI,SAAS,QAAQ,KACnC,IAAI,SAAS,OAAO,gBAAgB,IAAI;IACtC,KAAK,IAAI,iDAAiD;IAC1D,OAAO;GACT;GAGF,KAAK,IAAI,iCAAiC;GAC1C,OAAO;EACT,SAAS,OAAO;GACd,KAAK,IAAI,iCAAiC,KAAK;GAC/C,OAAO;EACT;CACF;CAEA,MAAM,kBAAmD;EACvD,OAAO;GACL,gBAAgB;GAChB,gBAAgB;GAChB,kBAAkB;GAClB,kBAAkB;GAClB,iBAAiB;GACjB,SAAS;GACT,cAAc;GACd,eAAe;GACf,eAAe;GACf,oBAAoB;GACpB,qBAAqB;GACrB,sBAAsB;EACxB;CACF;AACF"}

package/dist/chunks/{node-Bg7R5Icq.js → node-9IJG40yb.js}

@@ -1,4 +1,5 @@
-import { c as KeyError, d as SignatureError, i as EncryptError, r as DecryptError, s as InvalidKeyError, t as BaseEncryption } from "./base-qiu-WiZ0.js";
+import { n as DecryptError, o as InvalidKeyError, r as EncryptError, s as KeyError, u as SignatureError } from "./errors-Q_wX_NMz.js";
+import { t as BaseEncryption } from "./base-COUQhj5x.js";
 import * as crypto from "node:crypto";
 //#region src/adapters/node.ts
 /**
@@ -418,4 +419,4 @@ var NodeCryptoEncryption = class extends BaseEncryption {
 //#endregion
 export { NodeCryptoEncryption };
 
-//# sourceMappingURL=node-Bg7R5Icq.js.map
+//# sourceMappingURL=node-9IJG40yb.js.map