@happyvertical/encryption 0.111.5 → 0.111.7

package/dist/vault-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-snapshot.js","names":[],"sources":["../src/vault-snapshot.ts"],"sourcesContent":["import { randomBytes, timingSafeEqual } from 'node:crypto';\nimport { deflateSync, type Inflate, inflateSync } from 'node:zlib';\nimport nacl from 'tweetnacl';\nimport {\n  DecryptError,\n  FormatError,\n  InvalidKeyError,\n  KeyNotFoundError,\n} from './shared/errors.js';\n\nconst MAGIC = Buffer.from('HVSE');\nconst VERSION = 1;\nconst ALGORITHM = 1; // XSalsa20-Poly1305 secretbox\nconst KEY_ID_OFFSET = 7;\nconst NONCE_OFFSET = KEY_ID_OFFSET + 16;\nconst HEADER_BYTES = NONCE_OFFSET + nacl.secretbox.nonceLength;\nconst MAX_ID_BYTES = 255;\nconst MIN_CONTEXT_BYTES = 12; // two length bytes, two nonempty IDs, uint64 sequence\nconst MAX_CONTEXT_BYTES = 2 + 2 * MAX_ID_BYTES + 8;\nconst MAX_SNAPSHOT_BYTES = 8 * 1024 * 1024;\nconst MAX_ENCODED_BYTES = MAX_SNAPSHOT_BYTES + 64 * 1024;\nconst MAX_ENVELOPE_BYTES =\n  2 * HEADER_BYTES +\n  nacl.secretbox.overheadLength +\n  MAX_CONTEXT_BYTES +\n  MAX_ENCODED_BYTES;\nconst MAX_SEQUENCE = (1n << 64n) - 1n;\n\nexport interface VaultSnapshotContext {\n  accountId: string;\n  deviceId: string;\n  sequence: bigint;\n}\n\nexport interface SealVaultSnapshotOptions {\n  key: Uint8Array;\n  /** Opaque 16-byte identifier represented by 32 lowercase hex digits. */\n  keyId: string;\n  context: VaultSnapshotContext;\n  compression?: 'none' | 'zlib';\n}\n\nexport interface OpenVaultSnapshotOptions {\n  /** Trusted restore context, supplied independently of the envelope. */\n  context: VaultSnapshotContext;\n  /** Called once with the untrusted key ID, scoped by the caller to this account. */\n  resolveKey: (keyId: string) => Uint8Array | undefined;\n}\n\nfunction encodeId(id: string): Buffer {\n  if (typeof id !== 'string' || id.length === 0 || id.length > MAX_ID_BYTES) {\n    throw new FormatError('Invalid vault snapshot context ID');\n  }\n  const bytes = Buffer.from(id, 'utf8');\n  if (bytes.length > MAX_ID_BYTES || bytes.toString('utf8') !== id) {\n    throw new FormatError('Invalid vault snapshot context ID');\n  }\n  return bytes;\n}\n\nfunction encodeContext(context: VaultSnapshotContext): Buffer {\n  const { accountId, deviceId, sequence } = context;\n  const account = encodeId(accountId);\n  const device = encodeId(deviceId);\n  if (\n    typeof sequence !== 'bigint' ||\n    sequence < 0n ||\n    sequence > MAX_SEQUENCE\n  ) {\n    throw new FormatError('Invalid vault snapshot sequence');\n  }\n  const counter = Buffer.alloc(8);\n  counter.writeBigUInt64BE(sequence);\n  return Buffer.concat([\n    Buffer.of(account.length),\n    account,\n    Buffer.of(device.length),\n    device,\n    counter,\n  ]);\n}\n\nfunction checkKey(key: Uint8Array): void {\n  if (!(key instanceof Uint8Array) || key.length !== nacl.secretbox.keyLength) {\n    throw new InvalidKeyError('Vault snapshot key must be 32 bytes');\n  }\n}\n\n/** Seal a bounded snapshot with a fresh cryptographically random nonce. */\nexport function sealVaultSnapshot(\n  snapshot: Uint8Array,\n  options: SealVaultSnapshotOptions,\n): Uint8Array {\n  const { key, keyId, context, compression = 'none' } = options;\n  checkKey(key);\n  if (\n    !(snapshot instanceof Uint8Array) ||\n    snapshot.length > MAX_SNAPSHOT_BYTES\n  ) {\n    throw new FormatError('Invalid vault snapshot size');\n  }\n  if (\n    typeof keyId !== 'string' ||\n    keyId.length !== 32 ||\n    /[^0-9a-f]/.test(keyId)\n  ) {\n    throw new FormatError('Invalid vault snapshot key ID');\n  }\n  if (compression !== 'none' && compression !== 'zlib') {\n    throw new FormatError('Unsupported vault snapshot compression');\n  }\n  const contextBytes = encodeContext(context);\n  const nonce = randomBytes(nacl.secretbox.nonceLength);\n  const header = Buffer.concat([\n    MAGIC,\n    Buffer.of(VERSION, ALGORITHM, compression === 'zlib' ? 1 : 0),\n    Buffer.from(keyId, 'hex'),\n    nonce,\n  ]);\n  const payload =\n    compression === 'zlib'\n      ? deflateSync(snapshot, { maxOutputLength: MAX_ENCODED_BYTES })\n      : snapshot;\n  // Secretbox has no AAD. Its authenticated plaintext starts with an exact\n  // copy of the wire header followed by the private context.\n  const message = Buffer.concat([header, contextBytes, payload]);\n  return Buffer.concat([header, nacl.secretbox(message, nonce, key)]);\n}\n\n/** Authenticate the header and context before decoding any snapshot bytes. */\nexport function openVaultSnapshot(\n  envelope: Uint8Array,\n  { context, resolveKey }: OpenVaultSnapshotOptions,\n): Uint8Array {\n  const minBytes =\n    2 * HEADER_BYTES + MIN_CONTEXT_BYTES + nacl.secretbox.overheadLength;\n  if (\n    !(envelope instanceof Uint8Array) ||\n    envelope.length < minBytes ||\n    envelope.length > MAX_ENVELOPE_BYTES\n  ) {\n    throw new FormatError('Invalid vault snapshot envelope size');\n  }\n  // Keep the same bytes across the caller's lookup, even if it mutates the input.\n  const bytes = Buffer.from(envelope);\n  if (\n    !bytes.subarray(0, MAGIC.length).equals(MAGIC) ||\n    bytes[4] !== VERSION ||\n    bytes[5] !== ALGORITHM ||\n    (bytes[6] !== 0 && bytes[6] !== 1)\n  ) {\n    throw new FormatError('Unsupported vault snapshot header');\n  }\n\n  const prefix = Buffer.concat([\n    bytes.subarray(0, HEADER_BYTES),\n    encodeContext(context),\n  ]);\n  const payloadLength =\n    bytes.length - HEADER_BYTES - nacl.secretbox.overheadLength - prefix.length;\n  const compressed = bytes[6] === 1;\n  if (\n    payloadLength < 0 ||\n    payloadLength > (compressed ? MAX_ENCODED_BYTES : MAX_SNAPSHOT_BYTES)\n  ) {\n    throw new FormatError('Invalid vault snapshot payload size');\n  }\n\n  const keyId = bytes.toString('hex', KEY_ID_OFFSET, NONCE_OFFSET);\n  const key = resolveKey(keyId);\n  if (key === undefined) {\n    throw new KeyNotFoundError('Vault snapshot key not found', keyId);\n  }\n  checkKey(key);\n  const nonce = bytes.subarray(NONCE_OFFSET, HEADER_BYTES);\n  const message = nacl.secretbox.open(bytes.subarray(HEADER_BYTES), nonce, key);\n  if (\n    !message ||\n    !timingSafeEqual(prefix, message.subarray(0, prefix.length))\n  ) {\n    throw new DecryptError('Vault snapshot authentication failed');\n  }\n\n  const payload = message.subarray(prefix.length);\n  if (!compressed) {\n    return payload.slice();\n  }\n  try {\n    // Node returns the engine when info is true, but its types omit that overload.\n    const result = inflateSync(payload, {\n      info: true,\n      maxOutputLength: MAX_SNAPSHOT_BYTES,\n    }) as unknown as { buffer: Buffer; engine: Inflate };\n    if (result.engine.bytesWritten === payload.length) {\n      return result.buffer;\n    }\n  } catch {\n    // Treat all zlib failures, including the output cap, as invalid payloads.\n  }\n  throw new DecryptError('Invalid vault snapshot compression payload');\n}\n"],"mappings":";;;;;AAUA,IAAM,QAAQ,OAAO,KAAK,MAAM;AAChC,IAAM,UAAU;AAChB,IAAM,YAAY;AAClB,IAAM,gBAAgB;AACtB,IAAM,eAAe;AACrB,IAAM,eAAe,eAAe,KAAK,UAAU;AACnD,IAAM,eAAe;AACrB,IAAM,oBAAoB;AAC1B,IAAM,oBAAoB;AAC1B,IAAM,qBAAqB,IAAI,OAAO;AACtC,IAAM,oBAAoB;AAC1B,IAAM,qBACJ,IAAI,eACJ,KAAK,UAAU,iBACf,oBACA;AACF,IAAM,gBAAgB,MAAM,OAAO;AAuBnC,SAAS,SAAS,IAAoB;CACpC,IAAI,OAAO,OAAO,YAAY,GAAG,WAAW,KAAK,GAAG,SAAS,cAC3D,MAAM,IAAI,YAAY,mCAAmC;CAE3D,MAAM,QAAQ,OAAO,KAAK,IAAI,MAAM;CACpC,IAAI,MAAM,SAAS,gBAAgB,MAAM,SAAS,MAAM,MAAM,IAC5D,MAAM,IAAI,YAAY,mCAAmC;CAE3D,OAAO;AACT;AAEA,SAAS,cAAc,SAAuC;CAC5D,MAAM,EAAE,WAAW,UAAU,aAAa;CAC1C,MAAM,UAAU,SAAS,SAAS;CAClC,MAAM,SAAS,SAAS,QAAQ;CAChC,IACE,OAAO,aAAa,YACpB,WAAW,MACX,WAAW,cAEX,MAAM,IAAI,YAAY,iCAAiC;CAEzD,MAAM,UAAU,OAAO,MAAM,CAAC;CAC9B,QAAQ,iBAAiB,QAAQ;CACjC,OAAO,OAAO,OAAO;EACnB,OAAO,GAAG,QAAQ,MAAM;EACxB;EACA,OAAO,GAAG,OAAO,MAAM;EACvB;EACA;CACF,CAAC;AACH;AAEA,SAAS,SAAS,KAAuB;CACvC,IAAI,EAAE,eAAe,eAAe,IAAI,WAAW,KAAK,UAAU,WAChE,MAAM,IAAI,gBAAgB,qCAAqC;AAEnE;;AAGA,SAAgB,kBACd,UACA,SACY;CACZ,MAAM,EAAE,KAAK,OAAO,SAAS,cAAc,WAAW;CACtD,SAAS,GAAG;CACZ,IACE,EAAE,oBAAoB,eACtB,SAAS,SAAS,oBAElB,MAAM,IAAI,YAAY,6BAA6B;CAErD,IACE,OAAO,UAAU,YACjB,MAAM,WAAW,MACjB,YAAY,KAAK,KAAK,GAEtB,MAAM,IAAI,YAAY,+BAA+B;CAEvD,IAAI,gBAAgB,UAAU,gBAAgB,QAC5C,MAAM,IAAI,YAAY,wCAAwC;CAEhE,MAAM,eAAe,cAAc,OAAO;CAC1C,MAAM,QAAQ,YAAY,KAAK,UAAU,WAAW;CACpD,MAAM,SAAS,OAAO,OAAO;EAC3B;EACA,OAAO,GAAG,SAAS,WAAW,gBAAgB,SAAS,IAAI,CAAC;EAC5D,OAAO,KAAK,OAAO,KAAK;EACxB;CACF,CAAC;CACD,MAAM,UACJ,gBAAgB,SACZ,YAAY,UAAU,EAAE,iBAAiB,kBAAkB,CAAC,IAC5D;CAGN,MAAM,UAAU,OAAO,OAAO;EAAC;EAAQ;EAAc;CAAO,CAAC;CAC7D,OAAO,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU,SAAS,OAAO,GAAG,CAAC,CAAC;AACpE;;AAGA,SAAgB,kBACd,UACA,EAAE,SAAS,cACC;CACZ,MAAM,WACJ,IAAI,eAAe,oBAAoB,KAAK,UAAU;CACxD,IACE,EAAE,oBAAoB,eACtB,SAAS,SAAS,YAClB,SAAS,SAAS,oBAElB,MAAM,IAAI,YAAY,sCAAsC;CAG9D,MAAM,QAAQ,OAAO,KAAK,QAAQ;CAClC,IACE,CAAC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,CAAC,OAAO,KAAK,KAC7C,MAAM,OAAO,WACb,MAAM,OAAO,aACZ,MAAM,OAAO,KAAK,MAAM,OAAO,GAEhC,MAAM,IAAI,YAAY,mCAAmC;CAG3D,MAAM,SAAS,OAAO,OAAO,CAC3B,MAAM,SAAS,GAAG,YAAY,GAC9B,cAAc,OAAO,CACvB,CAAC;CACD,MAAM,gBACJ,MAAM,SAAS,eAAe,KAAK,UAAU,iBAAiB,OAAO;CACvE,MAAM,aAAa,MAAM,OAAO;CAChC,IACE,gBAAgB,KAChB,iBAAiB,aAAa,oBAAoB,qBAElD,MAAM,IAAI,YAAY,qCAAqC;CAG7D,MAAM,QAAQ,MAAM,SAAS,OAAO,eAAe,YAAY;CAC/D,MAAM,MAAM,WAAW,KAAK;CAC5B,IAAI,QAAQ,KAAA,GACV,MAAM,IAAI,iBAAiB,gCAAgC,KAAK;CAElE,SAAS,GAAG;CACZ,MAAM,QAAQ,MAAM,SAAS,cAAc,YAAY;CACvD,MAAM,UAAU,KAAK,UAAU,KAAK,MAAM,SAAS,YAAY,GAAG,OAAO,GAAG;CAC5E,IACE,CAAC,WACD,CAAC,gBAAgB,QAAQ,QAAQ,SAAS,GAAG,OAAO,MAAM,CAAC,GAE3D,MAAM,IAAI,aAAa,sCAAsC;CAG/D,MAAM,UAAU,QAAQ,SAAS,OAAO,MAAM;CAC9C,IAAI,CAAC,YACH,OAAO,QAAQ,MAAM;CAEvB,IAAI;EAEF,MAAM,SAAS,YAAY,SAAS;GAClC,MAAM;GACN,iBAAiB;EACnB,CAAC;EACD,IAAI,OAAO,OAAO,iBAAiB,QAAQ,QACzC,OAAO,OAAO;CAElB,QAAQ,CAER;CACA,MAAM,IAAI,aAAa,4CAA4C;AACrE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/encryption",
-  "version": "0.111.5",
+  "version": "0.111.7",
   "description": "Unified encryption and cryptography operations with adapter-based architecture",
   "type": "module",
   "main": "./dist/index.js",
@@ -10,6 +10,10 @@
     ".": {
       "import": "./dist/index.js",
       "types": "./dist/index.d.ts"
+    },
+    "./vault-snapshot": {
+      "types": "./dist/vault-snapshot.d.ts",
+      "import": "./dist/vault-snapshot.js"
     }
   },
   "bin": {
@@ -18,6 +22,7 @@
   "files": [
     "dist",
     "README.md",
+    "vault-snapshot-v1-vectors.json",
     "LICENSE",
     "AGENT.md",
     "metadata.json"
@@ -27,8 +32,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@happyvertical/logger": "0.111.5",
-    "@happyvertical/utils": "0.111.5",
+    "@happyvertical/logger": "0.111.7",
+    "@happyvertical/utils": "0.111.7",
     "@openpgp/web-stream-tools": "^0.3.1",
     "openpgp": "^6.3.0",
     "tweetnacl": "^1.0.3",

package/vault-snapshot-v1-vectors.json

@@ -0,0 +1,23 @@
+{
+  "keyHex": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+  "keyIdHex": "101112131415161718191a1b1c1d1e1f",
+  "accountId": "acct-雪",
+  "deviceId": "dev-🦊",
+  "sequenceHex": "fedcba9876543210",
+  "contextHex": "08616363742de99baa086465762df09fa68afedcba9876543210",
+  "snapshotHex": "7661756c7420736e617073686f74007661756c7420736e617073686f74ff",
+  "vectors": [
+    {
+      "compression": "none",
+      "nonceHex": "202122232425262728292a2b2c2d2e2f3031323334353637",
+      "payloadHex": "7661756c7420736e617073686f74007661756c7420736e617073686f74ff",
+      "envelopeHex": "48565345010100101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f30313233343536375b3ad7d1fb2c53611f8d45a9ab0bbe8db90f1ee04c265a861827467a195ea0eca0a8a697ec073c549d5410b6e73d8bd59e21fbefd68756ff925c60bfc0eb495ad2b5c9bd25df6f55a13f1aedb4e9d3a722b1c37bcee4a0140be2060e6da001ce2aeb33c8f7f724439d090c7ba9fac657b41d368052e45b"
+    },
+    {
+      "compression": "zlib",
+      "nonceHex": "38393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f",
+      "payloadHex": "789c2b4b2ccd295128ce4b2c28cec82f612843e1fe0700b7b70c78",
+      "envelopeHex": "48565345010101101112131415161718191a1b1c1d1e1f38393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f953c50fbe98c0ecda057cb6574e636529889eb9bfd52165c0298992e4d1fb15ddbac4618ce2af7df0a1b2ecc5c76ae6b2aaf5e404d54412cec1b219180fa30b01aef204d2e8edcd37a9044d8f7b937a1860baaa65bcbf834dd4024dc03e87d8e402455397053cae304681f596d870d1c2642b4b3"
+    }
+  ]
+}

package/dist/chunks/base-qiu-WiZ0.js

@@ -1,239 +0,0 @@
-import { readFile, writeFile } from "node:fs/promises";
-//#region src/shared/errors.ts
-/**
-* Base error class for all encryption errors
-*/
-var EncryptionError = class extends Error {
-	code;
-	adapter;
-	cause;
-	timestamp;
-	constructor(message, code, adapter, cause) {
-		super(message);
-		this.name = "EncryptionError";
-		this.code = code;
-		this.adapter = adapter;
-		this.cause = cause;
-		this.timestamp = /* @__PURE__ */ new Date();
-		if (Error.captureStackTrace) Error.captureStackTrace(this, this.constructor);
-	}
-	/**
-	* Convert error to JSON for logging/serialization
-	*/
-	toJSON() {
-		return {
-			name: this.name,
-			message: this.message,
-			code: this.code,
-			adapter: this.adapter,
-			timestamp: this.timestamp.toISOString(),
-			stack: this.stack,
-			cause: this.cause
-		};
-	}
-};
-/**
-* Key-related errors
-*/
-var KeyError = class extends EncryptionError {
-	constructor(message, adapter, cause) {
-		super(message, "KEY_ERROR", adapter, cause);
-		this.name = "KeyError";
-	}
-};
-/**
-* Invalid key format or content
-*/
-var InvalidKeyError = class extends EncryptionError {
-	constructor(message, adapter, cause) {
-		super(message, "INVALID_KEY", adapter, cause);
-		this.name = "InvalidKeyError";
-	}
-};
-/**
-* Key not found error
-*/
-var KeyNotFoundError = class extends EncryptionError {
-	keyId;
-	constructor(message, keyId, adapter) {
-		super(message, "KEY_NOT_FOUND", adapter);
-		this.name = "KeyNotFoundError";
-		this.keyId = keyId;
-	}
-	toJSON() {
-		return {
-			...super.toJSON(),
-			keyId: this.keyId
-		};
-	}
-};
-/**
-* Passphrase-related errors
-*/
-var PassphraseError = class extends EncryptionError {
-	constructor(message, adapter, cause) {
-		super(message, "PASSPHRASE_ERROR", adapter, cause);
-		this.name = "PassphraseError";
-	}
-};
-/**
-* Encryption operation errors
-*/
-var EncryptError = class extends EncryptionError {
-	constructor(message, adapter, cause) {
-		super(message, "ENCRYPT_ERROR", adapter, cause);
-		this.name = "EncryptError";
-	}
-};
-/**
-* Decryption operation errors
-*/
-var DecryptError = class extends EncryptionError {
-	constructor(message, adapter, cause) {
-		super(message, "DECRYPT_ERROR", adapter, cause);
-		this.name = "DecryptError";
-	}
-};
-/**
-* Signature operation errors
-*/
-var SignatureError = class extends EncryptionError {
-	constructor(message, adapter, cause) {
-		super(message, "SIGNATURE_ERROR", adapter, cause);
-		this.name = "SignatureError";
-	}
-};
-/**
-* Verification operation errors
-*/
-var VerificationError = class extends EncryptionError {
-	constructor(message, adapter, cause) {
-		super(message, "VERIFICATION_ERROR", adapter, cause);
-		this.name = "VerificationError";
-	}
-};
-/**
-* Format-related errors
-*/
-var FormatError = class extends EncryptionError {
-	constructor(message, adapter, cause) {
-		super(message, "FORMAT_ERROR", adapter, cause);
-		this.name = "FormatError";
-	}
-};
-/**
-* Algorithm-related errors
-*/
-var AlgorithmError = class extends EncryptionError {
-	algorithm;
-	constructor(message, algorithm, adapter) {
-		super(message, "ALGORITHM_ERROR", adapter);
-		this.name = "AlgorithmError";
-		this.algorithm = algorithm;
-	}
-	toJSON() {
-		return {
-			...super.toJSON(),
-			algorithm: this.algorithm
-		};
-	}
-};
-//#endregion
-//#region src/shared/base.ts
-/**
-* Base adapter class that provides common functionality for all encryption adapters
-*/
-var BaseEncryption = class {
-	adapterType;
-	debug;
-	constructor(adapterType, debug = false) {
-		this.adapterType = adapterType;
-		this.debug = debug;
-	}
-	/**
-	* Get the adapter type
-	*/
-	getAdapter() {
-		return this.adapterType;
-	}
-	/**
-	* Log debug messages if debug mode is enabled
-	*/
-	log(message, ...args) {
-		if (this.debug) console.log(`[${this.adapterType}] ${message}`, ...args);
-	}
-	/**
-	* Validate that a key is provided
-	*/
-	validateKey(key, keyType) {
-		if (!key) throw new KeyError(`${keyType} key is required but was not provided`, this.adapterType);
-		if (typeof key === "string" && key.trim().length === 0) throw new InvalidKeyError(`${keyType} key cannot be empty`, this.adapterType);
-		if (Buffer.isBuffer(key) && key.length === 0) throw new InvalidKeyError(`${keyType} key cannot be empty`, this.adapterType);
-		if (key instanceof Uint8Array && key.length === 0) throw new InvalidKeyError(`${keyType} key cannot be empty`, this.adapterType);
-	}
-	/**
-	* Validate encryption options
-	*/
-	validateEncryptOptions(options) {
-		if (!options) return;
-		if (options.encoding && ![
-			"base64",
-			"hex",
-			"utf8"
-		].includes(options.encoding)) throw new Error(`Invalid encoding: ${options.encoding}. Must be 'base64', 'hex', or 'utf8'`);
-	}
-	/**
-	* Validate decryption options
-	*/
-	validateDecryptOptions(options) {
-		if (!options) return;
-		if (options.encoding && ![
-			"base64",
-			"hex",
-			"utf8"
-		].includes(options.encoding)) throw new Error(`Invalid encoding: ${options.encoding}. Must be 'base64', 'hex', or 'utf8'`);
-	}
-	/**
-	* Convert Buffer to string based on encoding
-	*/
-	bufferToString(buffer, encoding = "base64") {
-		return buffer.toString(encoding);
-	}
-	/**
-	* Convert string to Buffer based on encoding
-	*/
-	stringToBuffer(str, encoding = "base64") {
-		return Buffer.from(str, encoding);
-	}
-	/**
-	* Wrap errors with adapter context
-	*/
-	wrapError(error, operation) {
-		if (error instanceof Error) return error;
-		return /* @__PURE__ */ new Error(`${operation} failed in ${this.adapterType} adapter: ${String(error)}`);
-	}
-	async encryptFile(inputPath, outputPath, options) {
-		try {
-			this.log(`Encrypting file: ${inputPath} -> ${outputPath}`);
-			const input = await readFile(inputPath);
-			await writeFile(outputPath, await this.encryptBuffer(input, options));
-			this.log(`File encrypted successfully: ${outputPath}`);
-		} catch (error) {
-			throw new EncryptError(`Failed to encrypt file: ${error.message}`, this.adapterType, error);
-		}
-	}
-	async decryptFile(inputPath, outputPath, options) {
-		try {
-			this.log(`Decrypting file: ${inputPath} -> ${outputPath}`);
-			const input = await readFile(inputPath);
-			await writeFile(outputPath, await this.decryptBuffer(input, options));
-			this.log(`File decrypted successfully: ${outputPath}`);
-		} catch (error) {
-			throw new DecryptError(`Failed to decrypt file: ${error.message}`, this.adapterType, error);
-		}
-	}
-};
-//#endregion
-export { EncryptionError as a, KeyError as c, SignatureError as d, VerificationError as f, EncryptError as i, KeyNotFoundError as l, AlgorithmError as n, FormatError as o, DecryptError as r, InvalidKeyError as s, BaseEncryption as t, PassphraseError as u };
-
-//# sourceMappingURL=base-qiu-WiZ0.js.map

package/dist/chunks/base-qiu-WiZ0.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"base-qiu-WiZ0.js","names":[],"sources":["../../src/shared/errors.ts","../../src/shared/base.ts"],"sourcesContent":["/**\n * Base error class for all encryption errors\n */\nexport class EncryptionError extends Error {\n  public readonly code: string;\n  public readonly adapter?: string;\n  public readonly cause?: unknown;\n  public readonly timestamp: Date;\n\n  constructor(\n    message: string,\n    code: string,\n    adapter?: string,\n    cause?: unknown,\n  ) {\n    super(message);\n    this.name = 'EncryptionError';\n    this.code = code;\n    this.adapter = adapter;\n    this.cause = cause;\n    this.timestamp = new Date();\n\n    // Maintains proper stack trace for where error was thrown (only available on V8)\n    if (Error.captureStackTrace) {\n      Error.captureStackTrace(this, this.constructor);\n    }\n  }\n\n  /**\n   * Convert error to JSON for logging/serialization\n   */\n  toJSON(): Record<string, unknown> {\n    return {\n      name: this.name,\n      message: this.message,\n      code: this.code,\n      adapter: this.adapter,\n      timestamp: this.timestamp.toISOString(),\n      stack: this.stack,\n      cause: this.cause,\n    };\n  }\n}\n\n/**\n * Key-related errors\n */\nexport class KeyError extends EncryptionError {\n  constructor(message: string, adapter?: string, cause?: unknown) {\n    super(message, 'KEY_ERROR', adapter, cause);\n    this.name = 'KeyError';\n  }\n}\n\n/**\n * Invalid key format or content\n */\nexport class InvalidKeyError extends EncryptionError {\n  constructor(message: string, adapter?: string, cause?: unknown) {\n    super(message, 'INVALID_KEY', adapter, cause);\n    this.name = 'InvalidKeyError';\n  }\n}\n\n/**\n * Key not found error\n */\nexport class KeyNotFoundError extends EncryptionError {\n  public readonly keyId?: string;\n\n  constructor(message: string, keyId?: string, adapter?: string) {\n    super(message, 'KEY_NOT_FOUND', adapter);\n    this.name = 'KeyNotFoundError';\n    this.keyId = keyId;\n  }\n\n  override toJSON(): Record<string, unknown> {\n    return {\n      ...super.toJSON(),\n      keyId: this.keyId,\n    };\n  }\n}\n\n/**\n * Passphrase-related errors\n */\nexport class PassphraseError extends EncryptionError {\n  constructor(message: string, adapter?: string, cause?: unknown) {\n    super(message, 'PASSPHRASE_ERROR', adapter, cause);\n    this.name = 'PassphraseError';\n  }\n}\n\n/**\n * Encryption operation errors\n */\nexport class EncryptError extends EncryptionError {\n  constructor(message: string, adapter?: string, cause?: unknown) {\n    super(message, 'ENCRYPT_ERROR', adapter, cause);\n    this.name = 'EncryptError';\n  }\n}\n\n/**\n * Decryption operation errors\n */\nexport class DecryptError extends EncryptionError {\n  constructor(message: string, adapter?: string, cause?: unknown) {\n    super(message, 'DECRYPT_ERROR', adapter, cause);\n    this.name = 'DecryptError';\n  }\n}\n\n/**\n * Signature operation errors\n */\nexport class SignatureError extends EncryptionError {\n  constructor(message: string, adapter?: string, cause?: unknown) {\n    super(message, 'SIGNATURE_ERROR', adapter, cause);\n    this.name = 'SignatureError';\n  }\n}\n\n/**\n * Verification operation errors\n */\nexport class VerificationError extends EncryptionError {\n  constructor(message: string, adapter?: string, cause?: unknown) {\n    super(message, 'VERIFICATION_ERROR', adapter, cause);\n    this.name = 'VerificationError';\n  }\n}\n\n/**\n * Format-related errors\n */\nexport class FormatError extends EncryptionError {\n  constructor(message: string, adapter?: string, cause?: unknown) {\n    super(message, 'FORMAT_ERROR', adapter, cause);\n    this.name = 'FormatError';\n  }\n}\n\n/**\n * Algorithm-related errors\n */\nexport class AlgorithmError extends EncryptionError {\n  public readonly algorithm?: string;\n\n  constructor(message: string, algorithm?: string, adapter?: string) {\n    super(message, 'ALGORITHM_ERROR', adapter);\n    this.name = 'AlgorithmError';\n    this.algorithm = algorithm;\n  }\n\n  override toJSON(): Record<string, unknown> {\n    return {\n      ...super.toJSON(),\n      algorithm: this.algorithm,\n    };\n  }\n}\n","import { readFile, writeFile } from 'node:fs/promises';\nimport type { Transform } from 'node:stream';\nimport {\n  DecryptError,\n  EncryptError,\n  InvalidKeyError,\n  KeyError,\n} from './errors.js';\nimport type {\n  AdapterType,\n  DecryptEmailOptions,\n  DecryptedEmail,\n  DecryptOptions,\n  EmailMessage,\n  EncryptEmailOptions,\n  Encryption,\n  EncryptionCapabilities,\n  EncryptOptions,\n  ExportKeyOptions,\n  ImportKeyOptions,\n  Key,\n  KeyPair,\n  KeyPairOptions,\n  SignEmailOptions,\n  SignOptions,\n  VerificationResult,\n  VerifyEmailOptions,\n  VerifyOptions,\n} from './types.js';\n\n/**\n * Base adapter class that provides common functionality for all encryption adapters\n */\nexport abstract class BaseEncryption implements Encryption {\n  protected readonly adapterType: AdapterType;\n  protected readonly debug: boolean;\n\n  constructor(adapterType: AdapterType, debug = false) {\n    this.adapterType = adapterType;\n    this.debug = debug;\n  }\n\n  /**\n   * Get the adapter type\n   */\n  getAdapter(): AdapterType {\n    return this.adapterType;\n  }\n\n  /**\n   * Log debug messages if debug mode is enabled\n   */\n  protected log(message: string, ...args: unknown[]): void {\n    if (this.debug) {\n      console.log(`[${this.adapterType}] ${message}`, ...args);\n    }\n  }\n\n  /**\n   * Validate that a key is provided\n   */\n  protected validateKey(\n    key: string | Buffer | Uint8Array | undefined,\n    keyType: 'public' | 'private',\n  ): void {\n    if (!key) {\n      throw new KeyError(\n        `${keyType} key is required but was not provided`,\n        this.adapterType,\n      );\n    }\n\n    if (typeof key === 'string' && key.trim().length === 0) {\n      throw new InvalidKeyError(\n        `${keyType} key cannot be empty`,\n        this.adapterType,\n      );\n    }\n\n    if (Buffer.isBuffer(key) && key.length === 0) {\n      throw new InvalidKeyError(\n        `${keyType} key cannot be empty`,\n        this.adapterType,\n      );\n    }\n\n    if (key instanceof Uint8Array && key.length === 0) {\n      throw new InvalidKeyError(\n        `${keyType} key cannot be empty`,\n        this.adapterType,\n      );\n    }\n  }\n\n  /**\n   * Validate encryption options\n   */\n  protected validateEncryptOptions(options?: EncryptOptions): void {\n    // Base validation - adapters can override\n    if (!options) return;\n\n    // Validate encoding if provided\n    if (\n      options.encoding &&\n      !['base64', 'hex', 'utf8'].includes(options.encoding)\n    ) {\n      throw new Error(\n        `Invalid encoding: ${options.encoding}. Must be 'base64', 'hex', or 'utf8'`,\n      );\n    }\n  }\n\n  /**\n   * Validate decryption options\n   */\n  protected validateDecryptOptions(options?: DecryptOptions): void {\n    // Base validation - adapters can override\n    if (!options) return;\n\n    // Validate encoding if provided\n    if (\n      options.encoding &&\n      !['base64', 'hex', 'utf8'].includes(options.encoding)\n    ) {\n      throw new Error(\n        `Invalid encoding: ${options.encoding}. Must be 'base64', 'hex', or 'utf8'`,\n      );\n    }\n  }\n\n  /**\n   * Convert Buffer to string based on encoding\n   */\n  protected bufferToString(\n    buffer: Buffer,\n    encoding: 'base64' | 'hex' | 'utf8' = 'base64',\n  ): string {\n    return buffer.toString(encoding);\n  }\n\n  /**\n   * Convert string to Buffer based on encoding\n   */\n  protected stringToBuffer(\n    str: string,\n    encoding: 'base64' | 'hex' | 'utf8' = 'base64',\n  ): Buffer {\n    return Buffer.from(str, encoding);\n  }\n\n  /**\n   * Wrap errors with adapter context\n   */\n  protected wrapError(error: unknown, operation: string): Error {\n    if (error instanceof Error) {\n      return error;\n    }\n    return new Error(\n      `${operation} failed in ${this.adapterType} adapter: ${String(error)}`,\n    );\n  }\n\n  // =============================================================================\n  // Text operations (must be implemented by adapters)\n  // =============================================================================\n\n  abstract encryptText(text: string, options?: EncryptOptions): Promise<string>;\n\n  abstract decryptText(\n    encrypted: string,\n    options?: DecryptOptions,\n  ): Promise<string>;\n\n  // =============================================================================\n  // File operations (default implementation using text/buffer methods)\n  // =============================================================================\n\n  async encryptFile(\n    inputPath: string,\n    outputPath: string,\n    options?: EncryptOptions,\n  ): Promise<void> {\n    try {\n      this.log(`Encrypting file: ${inputPath} -> ${outputPath}`);\n\n      // Read input file\n      const input = await readFile(inputPath);\n\n      // Encrypt buffer\n      const encrypted = await this.encryptBuffer(input, options);\n\n      // Write output file\n      await writeFile(outputPath, encrypted);\n\n      this.log(`File encrypted successfully: ${outputPath}`);\n    } catch (error) {\n      throw new EncryptError(\n        `Failed to encrypt file: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  async decryptFile(\n    inputPath: string,\n    outputPath: string,\n    options?: DecryptOptions,\n  ): Promise<void> {\n    try {\n      this.log(`Decrypting file: ${inputPath} -> ${outputPath}`);\n\n      // Read input file\n      const input = await readFile(inputPath);\n\n      // Decrypt buffer\n      const decrypted = await this.decryptBuffer(input, options);\n\n      // Write output file\n      await writeFile(outputPath, decrypted);\n\n      this.log(`File decrypted successfully: ${outputPath}`);\n    } catch (error) {\n      throw new DecryptError(\n        `Failed to decrypt file: ${(error as Error).message}`,\n        this.adapterType,\n        error,\n      );\n    }\n  }\n\n  // =============================================================================\n  // Buffer operations (must be implemented by adapters)\n  // =============================================================================\n\n  abstract encryptBuffer(\n    buffer: Buffer,\n    options?: EncryptOptions,\n  ): Promise<Buffer>;\n\n  abstract decryptBuffer(\n    buffer: Buffer,\n    options?: DecryptOptions,\n  ): Promise<Buffer>;\n\n  // =============================================================================\n  // Stream operations (optional - not implemented by default)\n  // =============================================================================\n\n  encryptStream?(options?: EncryptOptions): Transform;\n\n  decryptStream?(options?: DecryptOptions): Transform;\n\n  // =============================================================================\n  // Email operations (optional - mainly PGP)\n  // =============================================================================\n\n  encryptEmail?(\n    message: EmailMessage,\n    options?: EncryptEmailOptions,\n  ): Promise<EmailMessage>;\n\n  decryptEmail?(\n    message: EmailMessage,\n    options?: DecryptEmailOptions,\n  ): Promise<DecryptedEmail>;\n\n  signEmail?(\n    message: EmailMessage,\n    options?: SignEmailOptions,\n  ): Promise<EmailMessage>;\n\n  verifyEmail?(\n    message: EmailMessage,\n    options?: VerifyEmailOptions,\n  ): Promise<VerificationResult>;\n\n  // =============================================================================\n  // Signing operations (optional - mainly PGP)\n  // =============================================================================\n\n  sign?(data: string | Buffer, options?: SignOptions): Promise<string | Buffer>;\n\n  verify?(\n    data: string | Buffer,\n    signature: string | Buffer,\n    options?: VerifyOptions,\n  ): Promise<boolean>;\n\n  // =============================================================================\n  // Key management (must be implemented by adapters)\n  // =============================================================================\n\n  abstract generateKeyPair(options?: KeyPairOptions): Promise<KeyPair>;\n\n  abstract importKey(\n    key: string | Buffer,\n    options?: ImportKeyOptions,\n  ): Promise<Key>;\n\n  abstract exportKey(\n    key: Key,\n    options?: ExportKeyOptions,\n  ): Promise<string | Buffer>;\n\n  // =============================================================================\n  // Adapter capabilities (must be implemented by adapters)\n  // =============================================================================\n\n  abstract getCapabilities(): Promise<EncryptionCapabilities>;\n}\n"],"mappings":";;;;;AAGA,IAAa,kBAAb,cAAqC,MAAM;CACzC;CACA;CACA;CACA;CAEA,YACE,SACA,MACA,SACA,OACA;EACA,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,UAAU;EACf,KAAK,QAAQ;EACb,KAAK,4BAAY,IAAI,KAAK;EAG1B,IAAI,MAAM,mBACR,MAAM,kBAAkB,MAAM,KAAK,WAAW;CAElD;;;;CAKA,SAAkC;EAChC,OAAO;GACL,MAAM,KAAK;GACX,SAAS,KAAK;GACd,MAAM,KAAK;GACX,SAAS,KAAK;GACd,WAAW,KAAK,UAAU,YAAY;GACtC,OAAO,KAAK;GACZ,OAAO,KAAK;EACd;CACF;AACF;;;;AAKA,IAAa,WAAb,cAA8B,gBAAgB;CAC5C,YAAY,SAAiB,SAAkB,OAAiB;EAC9D,MAAM,SAAS,aAAa,SAAS,KAAK;EAC1C,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,kBAAb,cAAqC,gBAAgB;CACnD,YAAY,SAAiB,SAAkB,OAAiB;EAC9D,MAAM,SAAS,eAAe,SAAS,KAAK;EAC5C,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,mBAAb,cAAsC,gBAAgB;CACpD;CAEA,YAAY,SAAiB,OAAgB,SAAkB;EAC7D,MAAM,SAAS,iBAAiB,OAAO;EACvC,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;CAEA,SAA2C;EACzC,OAAO;GACL,GAAG,MAAM,OAAO;GAChB,OAAO,KAAK;EACd;CACF;AACF;;;;AAKA,IAAa,kBAAb,cAAqC,gBAAgB;CACnD,YAAY,SAAiB,SAAkB,OAAiB;EAC9D,MAAM,SAAS,oBAAoB,SAAS,KAAK;EACjD,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,eAAb,cAAkC,gBAAgB;CAChD,YAAY,SAAiB,SAAkB,OAAiB;EAC9D,MAAM,SAAS,iBAAiB,SAAS,KAAK;EAC9C,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,eAAb,cAAkC,gBAAgB;CAChD,YAAY,SAAiB,SAAkB,OAAiB;EAC9D,MAAM,SAAS,iBAAiB,SAAS,KAAK;EAC9C,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,iBAAb,cAAoC,gBAAgB;CAClD,YAAY,SAAiB,SAAkB,OAAiB;EAC9D,MAAM,SAAS,mBAAmB,SAAS,KAAK;EAChD,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,oBAAb,cAAuC,gBAAgB;CACrD,YAAY,SAAiB,SAAkB,OAAiB;EAC9D,MAAM,SAAS,sBAAsB,SAAS,KAAK;EACnD,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,cAAb,cAAiC,gBAAgB;CAC/C,YAAY,SAAiB,SAAkB,OAAiB;EAC9D,MAAM,SAAS,gBAAgB,SAAS,KAAK;EAC7C,KAAK,OAAO;CACd;AACF;;;;AAKA,IAAa,iBAAb,cAAoC,gBAAgB;CAClD;CAEA,YAAY,SAAiB,WAAoB,SAAkB;EACjE,MAAM,SAAS,mBAAmB,OAAO;EACzC,KAAK,OAAO;EACZ,KAAK,YAAY;CACnB;CAEA,SAA2C;EACzC,OAAO;GACL,GAAG,MAAM,OAAO;GAChB,WAAW,KAAK;EAClB;CACF;AACF;;;;;;ACjIA,IAAsB,iBAAtB,MAA2D;CACzD;CACA;CAEA,YAAY,aAA0B,QAAQ,OAAO;EACnD,KAAK,cAAc;EACnB,KAAK,QAAQ;CACf;;;;CAKA,aAA0B;EACxB,OAAO,KAAK;CACd;;;;CAKA,IAAc,SAAiB,GAAG,MAAuB;EACvD,IAAI,KAAK,OACP,QAAQ,IAAI,IAAI,KAAK,YAAY,IAAI,WAAW,GAAG,IAAI;CAE3D;;;;CAKA,YACE,KACA,SACM;EACN,IAAI,CAAC,KACH,MAAM,IAAI,SACR,GAAG,QAAQ,wCACX,KAAK,WACP;EAGF,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,CAAC,CAAC,WAAW,GACnD,MAAM,IAAI,gBACR,GAAG,QAAQ,uBACX,KAAK,WACP;EAGF,IAAI,OAAO,SAAS,GAAG,KAAK,IAAI,WAAW,GACzC,MAAM,IAAI,gBACR,GAAG,QAAQ,uBACX,KAAK,WACP;EAGF,IAAI,eAAe,cAAc,IAAI,WAAW,GAC9C,MAAM,IAAI,gBACR,GAAG,QAAQ,uBACX,KAAK,WACP;CAEJ;;;;CAKA,uBAAiC,SAAgC;EAE/D,IAAI,CAAC,SAAS;EAGd,IACE,QAAQ,YACR,CAAC;GAAC;GAAU;GAAO;EAAM,CAAC,CAAC,SAAS,QAAQ,QAAQ,GAEpD,MAAM,IAAI,MACR,qBAAqB,QAAQ,SAAS,qCACxC;CAEJ;;;;CAKA,uBAAiC,SAAgC;EAE/D,IAAI,CAAC,SAAS;EAGd,IACE,QAAQ,YACR,CAAC;GAAC;GAAU;GAAO;EAAM,CAAC,CAAC,SAAS,QAAQ,QAAQ,GAEpD,MAAM,IAAI,MACR,qBAAqB,QAAQ,SAAS,qCACxC;CAEJ;;;;CAKA,eACE,QACA,WAAsC,UAC9B;EACR,OAAO,OAAO,SAAS,QAAQ;CACjC;;;;CAKA,eACE,KACA,WAAsC,UAC9B;EACR,OAAO,OAAO,KAAK,KAAK,QAAQ;CAClC;;;;CAKA,UAAoB,OAAgB,WAA0B;EAC5D,IAAI,iBAAiB,OACnB,OAAO;EAET,uBAAO,IAAI,MACT,GAAG,UAAU,aAAa,KAAK,YAAY,YAAY,OAAO,KAAK,GACrE;CACF;CAiBA,MAAM,YACJ,WACA,YACA,SACe;EACf,IAAI;GACF,KAAK,IAAI,oBAAoB,UAAU,MAAM,YAAY;GAGzD,MAAM,QAAQ,MAAM,SAAS,SAAS;GAMtC,MAAM,UAAU,YAAY,MAHJ,KAAK,cAAc,OAAO,OAAO,CAGpB;GAErC,KAAK,IAAI,gCAAgC,YAAY;EACvD,SAAS,OAAO;GACd,MAAM,IAAI,aACR,2BAA4B,MAAgB,WAC5C,KAAK,aACL,KACF;EACF;CACF;CAEA,MAAM,YACJ,WACA,YACA,SACe;EACf,IAAI;GACF,KAAK,IAAI,oBAAoB,UAAU,MAAM,YAAY;GAGzD,MAAM,QAAQ,MAAM,SAAS,SAAS;GAMtC,MAAM,UAAU,YAAY,MAHJ,KAAK,cAAc,OAAO,OAAO,CAGpB;GAErC,KAAK,IAAI,gCAAgC,YAAY;EACvD,SAAS,OAAO;GACd,MAAM,IAAI,aACR,2BAA4B,MAAgB,WAC5C,KAAK,aACL,KACF;EACF;CACF;AAiFF"}