@hawcx/oauth-client 0.2.0 → 5.1.0

package/dist/client-assertion.d.ts

@@ -0,0 +1,45 @@
+import type { KeyObject } from 'node:crypto';
+import { type JWK } from 'jose';
+/** RFC 7523 §2.2 assertion type for the `private_key_jwt` method. */
+export declare const CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+export declare class ClientAssertionSigner {
+    private readonly importKeyFn;
+    private readonly kid;
+    private readonly lifetimeSeconds;
+    /** Lazily-imported signing key, memoised across sign() calls. */
+    private keyPromise?;
+    private constructor();
+    /**
+     * Build a signer from an Ed25519 *private* JWK (RFC 8037):
+     * `{ kty: 'OKP', crv: 'Ed25519', d, x, kid }`. The `kid` is read from the
+     * JWK. This is the canonical Hawcx key format (what the admin console
+     * generates/downloads). Accepts either a JWK object or its JSON string.
+     */
+    static ed25519FromJwk(privateJwk: JWK | string): ClientAssertionSigner;
+    /**
+     * Build a signer from a PKCS#8 PEM-encoded Ed25519 private key plus its `kid`.
+     * The key type is validated (must be Ed25519) on first use.
+     */
+    static ed25519FromPem(pkcs8Pem: string, kid: string): ClientAssertionSigner;
+    /**
+     * Build a signer from an already-loaded Ed25519 private `KeyObject`
+     * (e.g. from `crypto.createPrivateKey(...)`) plus its `kid`.
+     */
+    static ed25519(privateKey: KeyObject, kid: string): ClientAssertionSigner;
+    /**
+     * Return a copy of this signer using `seconds` as the assertion lifetime
+     * (iat→exp). Clamped to [1, 120] (the OP maximum). Defaults to 60; most
+     * callers never need this.
+     */
+    withLifetimeSeconds(seconds: number): ClientAssertionSigner;
+    private importKey;
+    /**
+     * Build and Ed25519-sign the `client_assertion` JWT for one token exchange.
+     *
+     * @param clientId - becomes `iss` and `sub` (RFC 7523 §3)
+     * @param audience - the OP's token endpoint, exactly as advertised in
+     *   discovery (the OP pins `aud` to that string)
+     */
+    sign(clientId: string, audience: string): Promise<string>;
+}
+//# sourceMappingURL=client-assertion.d.ts.map

package/dist/client-assertion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-assertion.d.ts","sourceRoot":"","sources":["../src/client-assertion.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAmC,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAKjE,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,2DACwB,CAAC;AAK3D,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,iEAAiE;IACjE,OAAO,CAAC,UAAU,CAAC,CAAuB;IAE1C,OAAO;IAUP;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,GAAG,MAAM,GAAG,qBAAqB;IA0BtE;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,qBAAqB;IAkB3E;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,qBAAqB;IAazE;;;;OAIG;IACH,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB;IAK3D,OAAO,CAAC,SAAS;IAYjB;;;;;;OAMG;IACG,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAYhE"}

package/dist/client-assertion.js

@@ -0,0 +1,141 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientAssertionSigner = exports.CLIENT_ASSERTION_TYPE = void 0;
+/**
+ * RFC 7523 / OIDC Core §9 `client_assertion` signer for the
+ * `private_key_jwt` token-endpoint authentication method.
+ *
+ * EdDSA over Ed25519 is the only algorithm the Hawcx OP accepts at the token
+ * endpoint, so it is the only one supported here. Obtain an instance via
+ * {@link ClientAssertionSigner.ed25519FromJwk} (or `ed25519FromPem` /
+ * `ed25519`) and attach it with `HawcxOAuth.withClientAssertion(signer)`.
+ *
+ * @beta This `private_key_jwt` surface is experimental and may change before
+ *   it is marked stable.
+ */
+const node_crypto_1 = require("node:crypto");
+const jose_1 = require("jose");
+/** RFC 7523 §2.2 assertion type for the `private_key_jwt` method. */
+exports.CLIENT_ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
+const DEFAULT_LIFETIME_SECONDS = 60;
+const MAX_LIFETIME_SECONDS = 120; // OP cap (ASSERTION_MAX_TTL_SECONDS)
+class ClientAssertionSigner {
+    constructor(importKeyFn, kid, lifetimeSeconds) {
+        this.importKeyFn = importKeyFn;
+        this.kid = kid;
+        this.lifetimeSeconds = lifetimeSeconds;
+    }
+    /**
+     * Build a signer from an Ed25519 *private* JWK (RFC 8037):
+     * `{ kty: 'OKP', crv: 'Ed25519', d, x, kid }`. The `kid` is read from the
+     * JWK. This is the canonical Hawcx key format (what the admin console
+     * generates/downloads). Accepts either a JWK object or its JSON string.
+     */
+    static ed25519FromJwk(privateJwk) {
+        let jwk;
+        if (typeof privateJwk === 'string') {
+            try {
+                jwk = JSON.parse(privateJwk);
+            }
+            catch (err) {
+                throw new Error(`private JWK is not valid JSON: ${String(err)}`);
+            }
+        }
+        else {
+            jwk = privateJwk;
+        }
+        if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519') {
+            throw new Error(`client assertion key must be an Ed25519 OKP JWK (got kty=${String(jwk.kty)}, crv=${String(jwk.crv)})`);
+        }
+        if (typeof jwk.d !== 'string' || jwk.d.length === 0) {
+            throw new Error("client assertion JWK has no 'd' (not a private key)");
+        }
+        if (typeof jwk.kid !== 'string' || jwk.kid.length === 0) {
+            throw new Error("client assertion JWK is missing 'kid'");
+        }
+        const kid = jwk.kid;
+        return new ClientAssertionSigner(() => (0, jose_1.importJWK)(jwk, 'EdDSA'), kid, DEFAULT_LIFETIME_SECONDS);
+    }
+    /**
+     * Build a signer from a PKCS#8 PEM-encoded Ed25519 private key plus its `kid`.
+     * The key type is validated (must be Ed25519) on first use.
+     */
+    static ed25519FromPem(pkcs8Pem, kid) {
+        if (!kid)
+            throw new Error('kid is required');
+        return new ClientAssertionSigner(async () => {
+            let key;
+            try {
+                key = await (0, jose_1.importPKCS8)(pkcs8Pem, 'EdDSA');
+            }
+            catch (err) {
+                throw new Error(`not a valid PKCS#8 PEM private key: ${String(err)}`);
+            }
+            assertEd25519(key);
+            return key;
+        }, kid, DEFAULT_LIFETIME_SECONDS);
+    }
+    /**
+     * Build a signer from an already-loaded Ed25519 private `KeyObject`
+     * (e.g. from `crypto.createPrivateKey(...)`) plus its `kid`.
+     */
+    static ed25519(privateKey, kid) {
+        if (!kid)
+            throw new Error('kid is required');
+        if (privateKey.asymmetricKeyType !== 'ed25519') {
+            throw new Error(`private key must be Ed25519 (got ${String(privateKey.asymmetricKeyType)})`);
+        }
+        // Round-trip through a JWK so the key flows through jose's own importJWK
+        // rather than an unchecked cast into jose's KeyLike union.
+        const jwk = privateKey.export({ format: 'jwk' });
+        return new ClientAssertionSigner(() => (0, jose_1.importJWK)(jwk, 'EdDSA'), kid, DEFAULT_LIFETIME_SECONDS);
+    }
+    /**
+     * Return a copy of this signer using `seconds` as the assertion lifetime
+     * (iat→exp). Clamped to [1, 120] (the OP maximum). Defaults to 60; most
+     * callers never need this.
+     */
+    withLifetimeSeconds(seconds) {
+        const clamped = Math.max(1, Math.min(MAX_LIFETIME_SECONDS, Math.floor(seconds)));
+        return new ClientAssertionSigner(this.importKeyFn, this.kid, clamped);
+    }
+    importKey() {
+        if (!this.keyPromise) {
+            // Don't memoise a rejection — a transient/structural import failure must
+            // not permanently poison the signer. Reset so the next sign() retries.
+            this.keyPromise = this.importKeyFn().catch((err) => {
+                this.keyPromise = undefined;
+                throw err;
+            });
+        }
+        return this.keyPromise;
+    }
+    /**
+     * Build and Ed25519-sign the `client_assertion` JWT for one token exchange.
+     *
+     * @param clientId - becomes `iss` and `sub` (RFC 7523 §3)
+     * @param audience - the OP's token endpoint, exactly as advertised in
+     *   discovery (the OP pins `aud` to that string)
+     */
+    async sign(clientId, audience) {
+        const key = await this.importKey();
+        return new jose_1.SignJWT({})
+            .setProtectedHeader({ alg: 'EdDSA', typ: 'JWT', kid: this.kid })
+            .setIssuer(clientId)
+            .setSubject(clientId)
+            .setAudience(audience)
+            .setIssuedAt()
+            .setExpirationTime(`${this.lifetimeSeconds}s`)
+            .setJti((0, node_crypto_1.randomUUID)())
+            .sign(key);
+    }
+}
+exports.ClientAssertionSigner = ClientAssertionSigner;
+function assertEd25519(key) {
+    // Node's importPKCS8 yields a KeyObject; reject non-Ed25519 with a clean message.
+    const type = key.asymmetricKeyType;
+    if (type !== undefined && type !== 'ed25519') {
+        throw new Error(`PEM key is not Ed25519 (got ${String(type)})`);
+    }
+}
+//# sourceMappingURL=client-assertion.js.map

package/dist/client-assertion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-assertion.js","sourceRoot":"","sources":["../src/client-assertion.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;GAWG;AACH,6CAAyC;AAEzC,+BAAiE;AAKjE,qEAAqE;AACxD,QAAA,qBAAqB,GAChC,wDAAwD,CAAC;AAE3D,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,oBAAoB,GAAG,GAAG,CAAC,CAAC,qCAAqC;AAEvE,MAAa,qBAAqB;IAOhC,YACE,WAAuC,EACvC,GAAW,EACX,eAAuB;QAEvB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,UAAwB;QAC5C,IAAI,GAAQ,CAAC;QACb,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAQ,CAAC;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,UAAU,CAAC;QACnB,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,4DAA4D,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CACvG,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,CAAC,IAAA,gBAAS,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACjG,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,QAAgB,EAAE,GAAW;QACjD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC7C,OAAO,IAAI,qBAAqB,CAC9B,KAAK,IAAI,EAAE;YACT,IAAI,GAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAA,kBAAW,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,aAAa,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO,GAAG,CAAC;QACb,CAAC,EACD,GAAG,EACH,wBAAwB,CACzB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,UAAqB,EAAE,GAAW;QAC/C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAC5E,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,2DAA2D;QAC3D,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAQ,CAAC;QACxD,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,CAAC,IAAA,gBAAS,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACjG,CAAC;IAED;;;;OAIG;IACH,mBAAmB,CAAC,OAAe;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,yEAAyE;YACzE,uEAAuE;YACvE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBAC1D,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;gBAC5B,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,QAAgB;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,OAAO,IAAI,cAAO,CAAC,EAAE,CAAC;aACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aAC/D,SAAS,CAAC,QAAQ,CAAC;aACnB,UAAU,CAAC,QAAQ,CAAC;aACpB,WAAW,CAAC,QAAQ,CAAC;aACrB,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,IAAI,CAAC,eAAe,GAAG,CAAC;aAC7C,MAAM,CAAC,IAAA,wBAAU,GAAE,CAAC;aACpB,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;CACF;AAjID,sDAiIC;AAED,SAAS,aAAa,CAAC,GAAgB;IACrC,kFAAkF;IAClF,MAAM,IAAI,GAAI,GAA0B,CAAC,iBAAiB,CAAC;IAC3D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;AACH,CAAC"}

package/dist/delegation/credentials.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Credential blob parsing for HAWCX_SECRET_KEY
+ *
+ * Format: hwx_sk_v1_<base64url(JSON)>
+ *
+ * JSON payload:
+ * {
+ *   "v": 1,
+ *   "alg": "ed25519+x25519",
+ *   "kid": "cust_abc123",
+ *   "ed_priv": "<32-byte-base64url>",
+ *   "x_priv": "<32-byte-base64url>",
+ *   "h_ed_pub": "<32-byte-base64url>",
+ *   "h_x_pub": "<32-byte-base64url>",
+ *   "hkid": "hwx_2025_01"
+ * }
+ */
+/**
+ * Raw credential blob structure (as stored in the base64url JSON)
+ */
+export interface HawcxCredentialBlob {
+    /** Version number (must be 1) */
+    v: number;
+    /** Algorithm identifier (must be "ed25519+x25519") */
+    alg: string;
+    /** Customer key ID */
+    kid: string;
+    /** Customer Ed25519 private key (32 bytes, base64url) */
+    ed_priv: string;
+    /** Customer X25519 private key (32 bytes, base64url) */
+    x_priv: string;
+    /** Hawcx Ed25519 public key (32 bytes, base64url) */
+    h_ed_pub: string;
+    /** Hawcx X25519 public key (32 bytes, base64url) */
+    h_x_pub: string;
+    /** Hawcx key ID (for key rotation) */
+    hkid: string;
+}
+/**
+ * Parsed credentials ready for use with crypto classes
+ */
+export interface ParsedCredentials {
+    /** Customer key ID */
+    kid: string;
+    /** Hawcx key ID */
+    hkid: string;
+    /** Customer Ed25519 private key (PEM format) */
+    signingKeyPem: string;
+    /** Hawcx Ed25519 public key (PEM format) */
+    verifyKeyPem: string;
+    /** Hawcx X25519 public key (PEM format) - for encrypting requests */
+    encryptKeyPem: string;
+    /** Customer X25519 private key (PEM format) - for decrypting responses */
+    decryptKeyPem: string;
+}
+/**
+ * Parse a HAWCX_SECRET_KEY credential string into usable key material.
+ *
+ * @param secretKey - The full credential string (hwx_sk_v1_<base64url>)
+ * @returns Parsed credentials with PEM-formatted keys
+ * @throws DelegationCryptoError if parsing fails
+ *
+ * @example
+ * ```typescript
+ * const creds = parseHawcxSecretKey(process.env.HAWCX_SECRET_KEY!);
+ * const signer = new Ed25519Signer(creds.signingKeyPem, creds.kid);
+ * const encryptor = new EciesX25519Encryptor(creds.encryptKeyPem);
+ * ```
+ */
+export declare function parseHawcxSecretKey(secretKey: string): ParsedCredentials;
+/**
+ * Generate a credential blob (for dashboard/admin tooling).
+ * This is typically called server-side when provisioning a new customer.
+ *
+ * @param options - Key generation options
+ * @returns The full credential string (hwx_sk_v1_<base64url>)
+ */
+export declare function generateCredentialBlob(options: {
+    /** Customer key ID */
+    kid: string;
+    /** Hawcx key ID */
+    hkid: string;
+    /** Customer Ed25519 private key (raw 32 bytes) */
+    edPrivate: Buffer;
+    /** Customer X25519 private key (raw 32 bytes) */
+    xPrivate: Buffer;
+    /** Hawcx Ed25519 public key (raw 32 bytes) */
+    hawcxEdPublic: Buffer;
+    /** Hawcx X25519 public key (raw 32 bytes) */
+    hawcxXPublic: Buffer;
+}): string;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/delegation/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/delegation/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAkDH;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,iCAAiC;IACjC,CAAC,EAAE,MAAM,CAAC;IACV,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ,sBAAsB;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,sBAAsB;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;CACvB;AA8DD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,CA2ExE;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,sBAAsB;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CA6BT"}

package/dist/delegation/credentials.js

@@ -0,0 +1,215 @@
+"use strict";
+/**
+ * Credential blob parsing for HAWCX_SECRET_KEY
+ *
+ * Format: hwx_sk_v1_<base64url(JSON)>
+ *
+ * JSON payload:
+ * {
+ *   "v": 1,
+ *   "alg": "ed25519+x25519",
+ *   "kid": "cust_abc123",
+ *   "ed_priv": "<32-byte-base64url>",
+ *   "x_priv": "<32-byte-base64url>",
+ *   "h_ed_pub": "<32-byte-base64url>",
+ *   "h_x_pub": "<32-byte-base64url>",
+ *   "hkid": "hwx_2025_01"
+ * }
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseHawcxSecretKey = parseHawcxSecretKey;
+exports.generateCredentialBlob = generateCredentialBlob;
+const exceptions_1 = require("./exceptions");
+// -------- Constants --------
+const CREDENTIAL_PREFIX = 'hwx_sk_v1_';
+const EXPECTED_VERSION = 1;
+const EXPECTED_ALG = 'ed25519+x25519';
+const RAW_KEY_LENGTH = 32;
+// DER headers for key wrapping
+// Ed25519 private key PKCS8 header (14 bytes) + 2 bytes length prefix for the key
+const ED25519_PKCS8_HEADER = Buffer.from([
+    0x30, 0x2e, // SEQUENCE, 46 bytes
+    0x02, 0x01, 0x00, // INTEGER 0 (version)
+    0x30, 0x05, // SEQUENCE, 5 bytes (algorithm identifier)
+    0x06, 0x03, 0x2b, 0x65, 0x70, // OID 1.3.101.112 (Ed25519)
+    0x04, 0x22, // OCTET STRING, 34 bytes
+    0x04, 0x20, // OCTET STRING, 32 bytes (the actual key)
+]);
+// Ed25519 public key SPKI header (12 bytes)
+const ED25519_SPKI_HEADER = Buffer.from([
+    0x30, 0x2a, // SEQUENCE, 42 bytes
+    0x30, 0x05, // SEQUENCE, 5 bytes (algorithm identifier)
+    0x06, 0x03, 0x2b, 0x65, 0x70, // OID 1.3.101.112 (Ed25519)
+    0x03, 0x21, 0x00, // BIT STRING, 33 bytes (with 0 unused bits)
+]);
+// X25519 private key PKCS8 header
+const X25519_PKCS8_HEADER = Buffer.from([
+    0x30, 0x2e, // SEQUENCE, 46 bytes
+    0x02, 0x01, 0x00, // INTEGER 0 (version)
+    0x30, 0x05, // SEQUENCE, 5 bytes (algorithm identifier)
+    0x06, 0x03, 0x2b, 0x65, 0x6e, // OID 1.3.101.110 (X25519)
+    0x04, 0x22, // OCTET STRING, 34 bytes
+    0x04, 0x20, // OCTET STRING, 32 bytes (the actual key)
+]);
+// X25519 public key SPKI header
+const X25519_SPKI_HEADER = Buffer.from([
+    0x30, 0x2a, // SEQUENCE, 42 bytes
+    0x30, 0x05, // SEQUENCE, 5 bytes (algorithm identifier)
+    0x06, 0x03, 0x2b, 0x65, 0x6e, // OID 1.3.101.110 (X25519)
+    0x03, 0x21, 0x00, // BIT STRING, 33 bytes (with 0 unused bits)
+]);
+// -------- Key Conversion Helpers --------
+/**
+ * Convert raw 32-byte Ed25519 private key to PEM format
+ */
+function ed25519PrivateToPem(rawKey) {
+    if (rawKey.length !== RAW_KEY_LENGTH) {
+        throw new exceptions_1.DelegationCryptoError(`Ed25519 private key must be ${RAW_KEY_LENGTH} bytes, got ${rawKey.length}`);
+    }
+    const der = Buffer.concat([ED25519_PKCS8_HEADER, rawKey]);
+    const b64 = der.toString('base64');
+    return `-----BEGIN PRIVATE KEY-----\n${b64.match(/.{1,64}/g)?.join('\n')}\n-----END PRIVATE KEY-----`;
+}
+/**
+ * Convert raw 32-byte Ed25519 public key to PEM format
+ */
+function ed25519PublicToPem(rawKey) {
+    if (rawKey.length !== RAW_KEY_LENGTH) {
+        throw new exceptions_1.DelegationCryptoError(`Ed25519 public key must be ${RAW_KEY_LENGTH} bytes, got ${rawKey.length}`);
+    }
+    const der = Buffer.concat([ED25519_SPKI_HEADER, rawKey]);
+    const b64 = der.toString('base64');
+    return `-----BEGIN PUBLIC KEY-----\n${b64.match(/.{1,64}/g)?.join('\n')}\n-----END PUBLIC KEY-----`;
+}
+/**
+ * Convert raw 32-byte X25519 private key to PEM format
+ */
+function x25519PrivateToPem(rawKey) {
+    if (rawKey.length !== RAW_KEY_LENGTH) {
+        throw new exceptions_1.DelegationCryptoError(`X25519 private key must be ${RAW_KEY_LENGTH} bytes, got ${rawKey.length}`);
+    }
+    const der = Buffer.concat([X25519_PKCS8_HEADER, rawKey]);
+    const b64 = der.toString('base64');
+    return `-----BEGIN PRIVATE KEY-----\n${b64.match(/.{1,64}/g)?.join('\n')}\n-----END PRIVATE KEY-----`;
+}
+/**
+ * Convert raw 32-byte X25519 public key to PEM format
+ */
+function x25519PublicToPem(rawKey) {
+    if (rawKey.length !== RAW_KEY_LENGTH) {
+        throw new exceptions_1.DelegationCryptoError(`X25519 public key must be ${RAW_KEY_LENGTH} bytes, got ${rawKey.length}`);
+    }
+    const der = Buffer.concat([X25519_SPKI_HEADER, rawKey]);
+    const b64 = der.toString('base64');
+    return `-----BEGIN PUBLIC KEY-----\n${b64.match(/.{1,64}/g)?.join('\n')}\n-----END PUBLIC KEY-----`;
+}
+// -------- Main Parser --------
+/**
+ * Parse a HAWCX_SECRET_KEY credential string into usable key material.
+ *
+ * @param secretKey - The full credential string (hwx_sk_v1_<base64url>)
+ * @returns Parsed credentials with PEM-formatted keys
+ * @throws DelegationCryptoError if parsing fails
+ *
+ * @example
+ * ```typescript
+ * const creds = parseHawcxSecretKey(process.env.HAWCX_SECRET_KEY!);
+ * const signer = new Ed25519Signer(creds.signingKeyPem, creds.kid);
+ * const encryptor = new EciesX25519Encryptor(creds.encryptKeyPem);
+ * ```
+ */
+function parseHawcxSecretKey(secretKey) {
+    // Validate prefix
+    if (!secretKey.startsWith(CREDENTIAL_PREFIX)) {
+        throw new exceptions_1.DelegationCryptoError(`Invalid credential format: must start with '${CREDENTIAL_PREFIX}'`);
+    }
+    // Extract and decode payload
+    const payloadB64 = secretKey.slice(CREDENTIAL_PREFIX.length);
+    let blob;
+    try {
+        const payloadJson = Buffer.from(payloadB64, 'base64url').toString('utf-8');
+        blob = JSON.parse(payloadJson);
+    }
+    catch (error) {
+        throw new exceptions_1.DelegationCryptoError('Invalid credential format: failed to decode payload', {
+            cause: error,
+        });
+    }
+    // Validate version
+    if (blob.v !== EXPECTED_VERSION) {
+        throw new exceptions_1.DelegationCryptoError(`Unsupported credential version: ${blob.v} (expected ${EXPECTED_VERSION})`);
+    }
+    // Validate algorithm
+    if (blob.alg !== EXPECTED_ALG) {
+        throw new exceptions_1.DelegationCryptoError(`Unsupported credential algorithm: ${blob.alg} (expected ${EXPECTED_ALG})`);
+    }
+    // Validate required fields
+    const requiredFields = [
+        'kid',
+        'ed_priv',
+        'x_priv',
+        'h_ed_pub',
+        'h_x_pub',
+        'hkid',
+    ];
+    for (const field of requiredFields) {
+        if (!blob[field]) {
+            throw new exceptions_1.DelegationCryptoError(`Missing required field: ${field}`);
+        }
+    }
+    // Decode and validate key lengths
+    let edPrivRaw;
+    let xPrivRaw;
+    let hEdPubRaw;
+    let hXPubRaw;
+    try {
+        edPrivRaw = Buffer.from(blob.ed_priv, 'base64url');
+        xPrivRaw = Buffer.from(blob.x_priv, 'base64url');
+        hEdPubRaw = Buffer.from(blob.h_ed_pub, 'base64url');
+        hXPubRaw = Buffer.from(blob.h_x_pub, 'base64url');
+    }
+    catch (error) {
+        throw new exceptions_1.DelegationCryptoError('Invalid base64url in credential keys', { cause: error });
+    }
+    // Convert to PEM format
+    return {
+        kid: blob.kid,
+        hkid: blob.hkid,
+        signingKeyPem: ed25519PrivateToPem(edPrivRaw),
+        verifyKeyPem: ed25519PublicToPem(hEdPubRaw),
+        encryptKeyPem: x25519PublicToPem(hXPubRaw),
+        decryptKeyPem: x25519PrivateToPem(xPrivRaw),
+    };
+}
+/**
+ * Generate a credential blob (for dashboard/admin tooling).
+ * This is typically called server-side when provisioning a new customer.
+ *
+ * @param options - Key generation options
+ * @returns The full credential string (hwx_sk_v1_<base64url>)
+ */
+function generateCredentialBlob(options) {
+    const validateLen = (label, value) => {
+        if (value.length !== RAW_KEY_LENGTH) {
+            throw new exceptions_1.DelegationCryptoError(`${label} must be ${RAW_KEY_LENGTH} bytes, got ${value.length}`);
+        }
+    };
+    validateLen('edPrivate', options.edPrivate);
+    validateLen('xPrivate', options.xPrivate);
+    validateLen('hawcxEdPublic', options.hawcxEdPublic);
+    validateLen('hawcxXPublic', options.hawcxXPublic);
+    const blob = {
+        v: EXPECTED_VERSION,
+        alg: EXPECTED_ALG,
+        kid: options.kid,
+        ed_priv: options.edPrivate.toString('base64url'),
+        x_priv: options.xPrivate.toString('base64url'),
+        h_ed_pub: options.hawcxEdPublic.toString('base64url'),
+        h_x_pub: options.hawcxXPublic.toString('base64url'),
+        hkid: options.hkid,
+    };
+    const payloadJson = JSON.stringify(blob);
+    const payloadB64 = Buffer.from(payloadJson).toString('base64url');
+    return `${CREDENTIAL_PREFIX}${payloadB64}`;
+}
+//# sourceMappingURL=credentials.js.map

package/dist/delegation/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/delegation/credentials.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;AAoKH,kDA2EC;AASD,wDA0CC;AAhSD,6CAAqD;AAErD,8BAA8B;AAE9B,MAAM,iBAAiB,GAAG,YAAY,CAAC;AACvC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,YAAY,GAAG,gBAAgB,CAAC;AACtC,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,+BAA+B;AAC/B,kFAAkF;AAClF,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC;IACvC,IAAI,EAAE,IAAI,EAAE,qBAAqB;IACjC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB;IACxC,IAAI,EAAE,IAAI,EAAE,2CAA2C;IACvD,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,4BAA4B;IAC1D,IAAI,EAAE,IAAI,EAAE,yBAAyB;IACrC,IAAI,EAAE,IAAI,EAAE,0CAA0C;CACvD,CAAC,CAAC;AAEH,4CAA4C;AAC5C,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC;IACtC,IAAI,EAAE,IAAI,EAAE,qBAAqB;IACjC,IAAI,EAAE,IAAI,EAAE,2CAA2C;IACvD,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,4BAA4B;IAC1D,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,4CAA4C;CAC/D,CAAC,CAAC;AAEH,kCAAkC;AAClC,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC;IACtC,IAAI,EAAE,IAAI,EAAE,qBAAqB;IACjC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB;IACxC,IAAI,EAAE,IAAI,EAAE,2CAA2C;IACvD,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,2BAA2B;IACzD,IAAI,EAAE,IAAI,EAAE,yBAAyB;IACrC,IAAI,EAAE,IAAI,EAAE,0CAA0C;CACvD,CAAC,CAAC;AAEH,gCAAgC;AAChC,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC;IACrC,IAAI,EAAE,IAAI,EAAE,qBAAqB;IACjC,IAAI,EAAE,IAAI,EAAE,2CAA2C;IACvD,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,2BAA2B;IACzD,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,4CAA4C;CAC/D,CAAC,CAAC;AA4CH,2CAA2C;AAE3C;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAc;IACzC,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,kCAAqB,CAC7B,+BAA+B,cAAc,eAAe,MAAM,CAAC,MAAM,EAAE,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,gCAAgC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC;AACxG,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,kCAAqB,CAC7B,8BAA8B,cAAc,eAAe,MAAM,CAAC,MAAM,EAAE,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,+BAA+B,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC;AACtG,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,kCAAqB,CAC7B,8BAA8B,cAAc,eAAe,MAAM,CAAC,MAAM,EAAE,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,gCAAgC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC;AACxG,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAc;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,kCAAqB,CAC7B,6BAA6B,cAAc,eAAe,MAAM,CAAC,MAAM,EAAE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,+BAA+B,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC;AACtG,CAAC;AAED,gCAAgC;AAEhC;;;;;;;;;;;;;GAaG;AACH,SAAgB,mBAAmB,CAAC,SAAiB;IACnD,kBAAkB;IAClB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,kCAAqB,CAC7B,+CAA+C,iBAAiB,GAAG,CACpE,CAAC;IACJ,CAAC;IAED,6BAA6B;IAC7B,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,IAAyB,CAAC;IAE9B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kCAAqB,CAAC,qDAAqD,EAAE;YACrF,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB;IACnB,IAAI,IAAI,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,kCAAqB,CAC7B,mCAAmC,IAAI,CAAC,CAAC,cAAc,gBAAgB,GAAG,CAC3E,CAAC;IACJ,CAAC;IAED,qBAAqB;IACrB,IAAI,IAAI,CAAC,GAAG,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,kCAAqB,CAC7B,qCAAqC,IAAI,CAAC,GAAG,cAAc,YAAY,GAAG,CAC3E,CAAC;IACJ,CAAC;IAED,2BAA2B;IAC3B,MAAM,cAAc,GAAkC;QACpD,KAAK;QACL,SAAS;QACT,QAAQ;QACR,UAAU;QACV,SAAS;QACT,MAAM;KACP,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,kCAAqB,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,IAAI,SAAiB,CAAC;IACtB,IAAI,QAAgB,CAAC;IACrB,IAAI,SAAiB,CAAC;IACtB,IAAI,QAAgB,CAAC;IAErB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACnD,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACjD,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACpD,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kCAAqB,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,wBAAwB;IACxB,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,aAAa,EAAE,mBAAmB,CAAC,SAAS,CAAC;QAC7C,YAAY,EAAE,kBAAkB,CAAC,SAAS,CAAC;QAC3C,aAAa,EAAE,iBAAiB,CAAC,QAAQ,CAAC;QAC1C,aAAa,EAAE,kBAAkB,CAAC,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,sBAAsB,CAAC,OAatC;IACC,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE;QACnD,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACpC,MAAM,IAAI,kCAAqB,CAC7B,GAAG,KAAK,YAAY,cAAc,eAAe,KAAK,CAAC,MAAM,EAAE,CAChE,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,WAAW,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACpD,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAElD,MAAM,IAAI,GAAwB;QAChC,CAAC,EAAE,gBAAgB;QACnB,GAAG,EAAE,YAAY;QACjB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;QAChD,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC9C,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;QACrD,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;QACnD,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC;IAEF,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAElE,OAAO,GAAG,iBAAiB,GAAG,UAAU,EAAE,CAAC;AAC7C,CAAC"}

package/dist/delegation/crypto.d.ts

@@ -56,7 +56,7 @@ export declare class EciesX25519Encryptor {
     /**
      * Encrypt plaintext using ECIES
      */
-    encrypt(plaintext: Buffer): Buffer;
+    encrypt(plaintext: Buffer): Promise<Buffer>;
 }
 /**
  * ECIES decryptor using X25519 + AES-GCM
@@ -67,6 +67,6 @@ export declare class EciesX25519Decryptor {
     /**
      * Decrypt ECIES envelope
      */
-    decrypt(envelopeJson: Buffer): Buffer;
+    decrypt(envelopeJson: Buffer): Promise<Buffer>;
 }
 //# sourceMappingURL=crypto.d.ts.map

package/dist/delegation/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/delegation/crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH;;GAEG;AACH,wBAAgB,IAAI,IAAI,MAAM,CAE7B;AAkBD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,EAAE,CAAmB;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAa;gBAEnB,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM;IAoB5C;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,UAAU;CAanD;AAED;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,EAAE,CAAmB;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAoB;gBAE1B,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM;IAoB5C;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,UAAU;CAiBnD;AAED;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,OAAO,CAAgC;gBAEnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAmB3C;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI;CAwClF;AAID;;GAEG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,aAAa,CAAS;gBAElB,UAAU,EAAE,MAAM;IAqB9B;;OAEG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;CAiDnC;AAED;;GAEG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,EAAE,CAAmB;gBAEjB,OAAO,EAAE,MAAM;IAkB3B;;OAEG;IACH,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;CA+CtC"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/delegation/crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH;;GAEG;AACH,wBAAgB,IAAI,IAAI,MAAM,CAE7B;AAuDD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,EAAE,CAAmB;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAa;gBAEnB,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM;IAoB5C;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,UAAU;CAanD;AAED;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,EAAE,CAAmB;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAoB;gBAE1B,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM;IAoB5C;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,UAAU;CAiBnD;AAED;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,OAAO,CAAgC;gBAEnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAmB3C;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI;CAwClF;AAID;;GAEG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,aAAa,CAAmB;gBAE5B,UAAU,EAAE,MAAM;IAoB9B;;OAEG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CA0ClD;AAED;;GAEG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,EAAE,CAAmB;gBAEjB,OAAO,EAAE,MAAM;IAkB3B;;OAEG;IACG,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAqDrD"}