@noy-db/shamir 0.8.0-pre.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 vLannaAi
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1 @@
+noy-db — Copyright 2026 vLannaAi

package/README.md

@@ -0,0 +1,35 @@
+# @noy-db/shamir
+
+Shamir Secret Sharing over GF(2^8), byte-wise, plus the share codecs. **Pure math, zero
+dependencies, no hub contract.**
+
+```ts
+import { splitSecret, combineSecret, encodeShareBase32, decodeShareBase32 } from '@noy-db/shamir'
+
+const secret = crypto.getRandomValues(new Uint8Array(32))
+const shares = splitSecret(secret, 2, 3).map(encodeShareBase32)   // any 2 of 3 recombine
+const back = combineSecret([decodeShareBase32(shares[0]!), decodeShareBase32(shares[2]!)])
+```
+
+## Where this sits
+
+This is the primitive. The **unlock method** built on it — `shamirRecoveryProvider()` for
+`createNoydb({ shamirRecovery })`, and `splitKEK` / `combineKEK` over a `CryptoKey` — is
+`@noy-db/on-shamir`, in the `on-*` family. If you are enrolling Shamir recovery on a vault, install
+that; if you are composing threshold sharing into something else, install this.
+
+The split exists so hub's own recovery tests can exercise the real math without depending on a
+package that implements hub's contract (a build cycle), and so `on-shamir` can import that contract
+instead of mirroring it. Same posture as `@noy-db/attestation`.
+
+## Threat model
+
+Protects against up to K−1 colluding share holders (mathematically — fewer than K shares reveal
+zero bits) and loss of up to N−K shares. Does not protect against K colluding holders (the
+threshold contract) or compromise of the machine combining the shares.
+
+## Share format
+
+Base32 string: `SHAMIR_S<x>_K<k>N<n>__<base32 groups>`. Binary: 6-byte header (magic, x, k, n,
+y-length) + y-bytes. JSON: `{ x, y: base64, k, n }`. All three round-trip; `decode*` throws on
+malformed, truncated, or mismatched input.

package/dist/index.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Arithmetic in the Galois field GF(2^8), represented as bytes 0..255.
+ *
+ * Used by Shamir Secret Sharing for byte-wise polynomial operations.
+ * Addition is XOR; multiplication uses precomputed log/exp tables
+ * against the primitive element 0x03 with irreducible polynomial
+ * 0x11b (x^8 + x^4 + x^3 + x + 1 — the AES polynomial).
+ *
+ * Constant-time is NOT a goal here — for secret sharing, the threat
+ * model assumes the combining device is trusted during
+ * reconstruction. If that assumption is wrong, no library-level
+ * constant-time hedge protects the plaintext anyway.
+ */
+/** Addition in GF(2^8) is XOR. */
+declare function gfAdd(a: number, b: number): number;
+/** Multiplication in GF(2^8). Returns 0 if either operand is 0. */
+declare function gfMul(a: number, b: number): number;
+/** Multiplicative inverse in GF(2^8). Throws on 0 (no inverse exists). */
+declare function gfInv(a: number): number;
+/** Division in GF(2^8). Throws on divide-by-zero. */
+declare function gfDiv(a: number, b: number): number;
+/**
+ * Evaluate a polynomial with coefficients `coeffs[0] + coeffs[1]*x + ...`
+ * at point `x` in GF(2^8) via Horner's method.
+ */
+declare function gfPolyEval(coeffs: readonly number[], x: number): number;
+/**
+ * Lagrange interpolation at x=0, given k distinct points `(xi, yi)`.
+ *
+ * Returns the constant term of the unique degree-(k-1) polynomial
+ * through those points — equal to the original secret byte for
+ * Shamir's construction.
+ */
+declare function lagrangeInterpolateAtZero(points: readonly [number, number][]): number;
+
+/**
+ * Shamir Secret Sharing over GF(2^8), byte-wise.
+ *
+ * For each byte of the secret, construct a random polynomial of
+ * degree k-1 whose constant term is the byte. Each share is a value
+ * of that polynomial at a distinct x-coordinate in 1..255. Any K of
+ * the N shares recombines the original bytes via Lagrange interpolation
+ * at x=0.
+ *
+ * x=0 is reserved (it would directly reveal the secret). x-coordinates
+ * are chosen from 1..255 ensuring distinctness.
+ */
+/**
+ * Split a secret into N shares. Any K of them reconstructs the secret;
+ * fewer than K leaks zero bits.
+ *
+ * @param secret - The bytes to share (e.g., a 32-byte KEK).
+ * @param k - Threshold (min shares needed to reconstruct). Must be >= 2.
+ * @param n - Total shares to produce. Must be >= k and <= 255.
+ * @param randomBytes - RNG function returning N random bytes. Defaults to
+ *   `crypto.getRandomValues`. Injectable for deterministic tests.
+ * @returns An array of `n` shares. Each share has an x-coordinate + y-bytes
+ *   parallel to the secret bytes.
+ */
+declare function splitSecret(secret: Uint8Array, k: number, n: number, randomBytes?: (count: number) => Uint8Array): RawShare[];
+/**
+ * Reconstruct a secret from K or more shares.
+ *
+ * Uses the first K shares provided; additional shares are ignored.
+ * Shares must agree on secret length and x-coordinates must be
+ * distinct (checked; throws on mismatch).
+ */
+declare function combineSecret(shares: readonly RawShare[]): Uint8Array;
+/** A raw Shamir share before serialisation. */
+interface RawShare {
+    /** x-coordinate in GF(2^8), 1..255. Zero is disallowed (it would reveal the secret). */
+    readonly x: number;
+    /** y-bytes — one per byte of the secret. */
+    readonly y: Uint8Array;
+    /** Threshold used at split time. */
+    readonly k: number;
+    /** Total shares at split time. */
+    readonly n: number;
+}
+
+/**
+ * Share serialisation — raw bytes, Base32 for printing, and JSON for
+ * structured transport (e.g. storing inside another on-* keyring).
+ *
+ * Binary layout (fixed header + secret-length y-bytes):
+ *
+ * ```
+ *   offset  size  field
+ *   0       1     version (= 1)
+ *   1       1     x-coordinate (1..255)
+ *   2       1     k (threshold)
+ *   3       1     n (total)
+ *   4       2     byteLength (big-endian uint16) — should equal y-length
+ *   6+      L     y-bytes (L = byteLength)
+ * ```
+ *
+ * Base32 adds a 26-character ULID `shareId` prefix + version/k/n
+ * metadata for human-readable diagnostics.
+ */
+
+/** Serialise a raw share into its canonical binary form. */
+declare function encodeShareBytes(share: RawShare): Uint8Array;
+/** Parse binary share bytes back into a structured share. */
+declare function decodeShareBytes(bytes: Uint8Array): RawShare;
+/**
+ * Encode a share as a Base32 string with hyphenated groups of 4.
+ *
+ * Output format: `SHAMIR_S{x}_K{k}N{n}__<base32-groups-of-4>`
+ *
+ * The prefix is not fed into the decoder — it's for eye-readability at a
+ * glance (share-number / threshold / total). The `SHAMIR` tag + `_`
+ * separators are non-Base32 characters (Base32 alphabet is A-Z2-7
+ * only), so the decoder can strip everything up to and including the
+ * last `_` before the payload. The metadata is also encoded in the
+ * share bytes themselves; the prefix is redundant-but-useful.
+ */
+declare function encodeShareBase32(share: RawShare): string;
+/**
+ * Parse a Base32 share string back into a structured share. Tolerates
+ * hyphens, whitespace, lowercase, and the optional prefix produced by
+ * `encodeShareBase32`. The metadata prefix is informational; actual
+ * share data comes from the binary bytes after the last `_`.
+ */
+declare function decodeShareBase32(input: string): RawShare;
+/**
+ * JSON-friendly form for structured storage (e.g. stash inside another
+ * on-* keyring entry, or pass over `postMessage`).
+ */
+interface ShareJSON {
+    readonly v: 1;
+    readonly x: number;
+    readonly k: number;
+    readonly n: number;
+    readonly y: string;
+}
+declare function encodeShareJSON(share: RawShare): ShareJSON;
+declare function decodeShareJSON(json: ShareJSON): RawShare;
+
+export { type RawShare, type ShareJSON, combineSecret, decodeShareBase32, decodeShareBytes, decodeShareJSON, encodeShareBase32, encodeShareBytes, encodeShareJSON, gfAdd, gfDiv, gfInv, gfMul, gfPolyEval, lagrangeInterpolateAtZero, splitSecret };

package/dist/index.js

@@ -0,0 +1,252 @@
+// src/gf256.ts
+var LOG = new Uint8Array(256);
+var EXP = new Uint8Array(256);
+{
+  let x = 1;
+  for (let i = 0; i < 255; i++) {
+    EXP[i] = x;
+    LOG[x] = i;
+    let doubled = x << 1;
+    if (doubled & 256) doubled ^= 283;
+    x = (doubled ^ x) & 255;
+  }
+  EXP[255] = EXP[0];
+}
+function gfAdd(a, b) {
+  return (a ^ b) & 255;
+}
+function gfMul(a, b) {
+  if (a === 0 || b === 0) return 0;
+  const s = (LOG[a] + LOG[b]) % 255;
+  return EXP[s];
+}
+function gfInv(a) {
+  if (a === 0) throw new Error("gf256: no inverse for 0");
+  return EXP[(255 - LOG[a]) % 255];
+}
+function gfDiv(a, b) {
+  if (b === 0) throw new Error("gf256: division by zero");
+  if (a === 0) return 0;
+  const s = (LOG[a] + 255 - LOG[b]) % 255;
+  return EXP[s];
+}
+function gfPolyEval(coeffs, x) {
+  let y = 0;
+  for (let i = coeffs.length - 1; i >= 0; i--) {
+    y = gfAdd(gfMul(y, x), coeffs[i]);
+  }
+  return y;
+}
+function lagrangeInterpolateAtZero(points) {
+  let result = 0;
+  for (let i = 0; i < points.length; i++) {
+    const [xi, yi] = points[i];
+    let numerator = 1;
+    let denominator = 1;
+    for (let j = 0; j < points.length; j++) {
+      if (i === j) continue;
+      const [xj] = points[j];
+      numerator = gfMul(numerator, xj);
+      denominator = gfMul(denominator, gfAdd(xi, xj));
+    }
+    const basis = gfDiv(numerator, denominator);
+    result = gfAdd(result, gfMul(yi, basis));
+  }
+  return result;
+}
+
+// src/shamir.ts
+function splitSecret(secret, k, n, randomBytes = defaultRandomBytes) {
+  assertSplitArgs(k, n, secret.length);
+  const xCoords = pickXCoords(n);
+  const shares = xCoords.map((x) => ({
+    x,
+    y: new Uint8Array(secret.length),
+    k,
+    n
+  }));
+  for (let byteIdx = 0; byteIdx < secret.length; byteIdx++) {
+    const coeffs = [secret[byteIdx]];
+    const rand = randomBytes(k - 1);
+    for (let j = 0; j < k - 1; j++) {
+      coeffs.push(rand[j]);
+    }
+    for (let shareIdx = 0; shareIdx < n; shareIdx++) {
+      shares[shareIdx].y[byteIdx] = gfPolyEval(coeffs, xCoords[shareIdx]);
+    }
+  }
+  return shares;
+}
+function combineSecret(shares) {
+  if (shares.length === 0) {
+    throw new Error("shamir: no shares provided");
+  }
+  const k = shares[0].k;
+  if (shares.length < k) {
+    throw new Error(`shamir: insufficient shares \u2014 need ${k}, got ${shares.length}`);
+  }
+  const byteLength = shares[0].y.length;
+  for (const s of shares) {
+    if (s.y.length !== byteLength) {
+      throw new Error("shamir: share lengths disagree \u2014 incompatible enrollment");
+    }
+  }
+  const selected = shares.slice(0, k);
+  const xs = selected.map((s) => s.x);
+  if (new Set(xs).size !== xs.length) {
+    throw new Error("shamir: duplicate x-coordinates among provided shares");
+  }
+  const secret = new Uint8Array(byteLength);
+  for (let byteIdx = 0; byteIdx < byteLength; byteIdx++) {
+    const points = selected.map((s) => [s.x, s.y[byteIdx]]);
+    secret[byteIdx] = lagrangeInterpolateAtZero(points);
+  }
+  return secret;
+}
+function assertSplitArgs(k, n, secretLen) {
+  if (!Number.isInteger(k) || k < 2) {
+    throw new Error(`shamir: k must be an integer >= 2 (got ${k})`);
+  }
+  if (!Number.isInteger(n) || n < k || n > 255) {
+    throw new Error(`shamir: n must satisfy k <= n <= 255 (got k=${k} n=${n})`);
+  }
+  if (!Number.isInteger(secretLen) || secretLen < 1) {
+    throw new Error(`shamir: secret must be at least 1 byte`);
+  }
+}
+function pickXCoords(n) {
+  const result = [];
+  for (let i = 1; i <= n; i++) result.push(i);
+  return result;
+}
+function defaultRandomBytes(count) {
+  return crypto.getRandomValues(new Uint8Array(count));
+}
+
+// src/share-format.ts
+var SHARE_VERSION = 1;
+var HEADER_LEN = 6;
+var BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+function encodeShareBytes(share) {
+  const bytes = new Uint8Array(HEADER_LEN + share.y.length);
+  bytes[0] = SHARE_VERSION;
+  bytes[1] = share.x;
+  bytes[2] = share.k;
+  bytes[3] = share.n;
+  bytes[4] = share.y.length >>> 8 & 255;
+  bytes[5] = share.y.length & 255;
+  bytes.set(share.y, HEADER_LEN);
+  return bytes;
+}
+function decodeShareBytes(bytes) {
+  if (bytes.length < HEADER_LEN) {
+    throw new Error(`shamir: share bytes too short (${bytes.length} < ${HEADER_LEN})`);
+  }
+  const version = bytes[0];
+  if (version !== SHARE_VERSION) {
+    throw new Error(`shamir: unsupported share version ${version} (expected ${SHARE_VERSION})`);
+  }
+  const x = bytes[1];
+  const k = bytes[2];
+  const n = bytes[3];
+  const byteLength = bytes[4] << 8 | bytes[5];
+  if (bytes.length !== HEADER_LEN + byteLength) {
+    throw new Error(`shamir: share length mismatch \u2014 header says ${byteLength}, got ${bytes.length - HEADER_LEN}`);
+  }
+  if (x === 0) {
+    throw new Error("shamir: share has x=0 \u2014 malformed");
+  }
+  return { x, k, n, y: bytes.slice(HEADER_LEN) };
+}
+function encodeShareBase32(share) {
+  const bytes = encodeShareBytes(share);
+  const chunks = base32Encode(bytes);
+  const grouped = chunks.match(/.{1,4}/g)?.join("-") ?? chunks;
+  return `SHAMIR_S${share.x}_K${share.k}N${share.n}__${grouped}`;
+}
+function decodeShareBase32(input) {
+  const normalised = input.toUpperCase().replace(/[\s-]/g, "");
+  const lastDoubleUnderscore = normalised.lastIndexOf("__");
+  const payload = lastDoubleUnderscore >= 0 ? normalised.slice(lastDoubleUnderscore + 2) : normalised;
+  const stripped = payload.replace(/[^A-Z2-7]/g, "");
+  const bytes = base32Decode(stripped);
+  return decodeShareBytes(bytes);
+}
+function encodeShareJSON(share) {
+  return {
+    v: SHARE_VERSION,
+    x: share.x,
+    k: share.k,
+    n: share.n,
+    y: base64Encode(share.y)
+  };
+}
+function decodeShareJSON(json) {
+  if (json.v !== SHARE_VERSION) {
+    throw new Error(`shamir: unsupported share version ${String(json.v)}`);
+  }
+  return { x: json.x, k: json.k, n: json.n, y: base64Decode(json.y) };
+}
+function base32Encode(bytes) {
+  let bits = 0;
+  let value = 0;
+  let out = "";
+  for (let i = 0; i < bytes.length; i++) {
+    value = value << 8 | bytes[i];
+    bits += 8;
+    while (bits >= 5) {
+      bits -= 5;
+      out += BASE32_ALPHABET[value >>> bits & 31];
+    }
+  }
+  if (bits > 0) {
+    out += BASE32_ALPHABET[value << 5 - bits & 31];
+  }
+  return out;
+}
+function base32Decode(input) {
+  let bits = 0;
+  let value = 0;
+  const out = [];
+  for (const ch of input) {
+    const idx = BASE32_ALPHABET.indexOf(ch);
+    if (idx < 0) {
+      throw new Error(`shamir: invalid Base32 character "${ch}"`);
+    }
+    value = value << 5 | idx;
+    bits += 5;
+    if (bits >= 8) {
+      bits -= 8;
+      out.push(value >>> bits & 255);
+    }
+  }
+  return new Uint8Array(out);
+}
+function base64Encode(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]);
+  return btoa(s);
+}
+function base64Decode(str) {
+  const s = atob(str);
+  const out = new Uint8Array(s.length);
+  for (let i = 0; i < s.length; i++) out[i] = s.charCodeAt(i);
+  return out;
+}
+export {
+  combineSecret,
+  decodeShareBase32,
+  decodeShareBytes,
+  decodeShareJSON,
+  encodeShareBase32,
+  encodeShareBytes,
+  encodeShareJSON,
+  gfAdd,
+  gfDiv,
+  gfInv,
+  gfMul,
+  gfPolyEval,
+  lagrangeInterpolateAtZero,
+  splitSecret
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/gf256.ts","../src/shamir.ts","../src/share-format.ts"],"sourcesContent":["/**\n * Arithmetic in the Galois field GF(2^8), represented as bytes 0..255.\n *\n * Used by Shamir Secret Sharing for byte-wise polynomial operations.\n * Addition is XOR; multiplication uses precomputed log/exp tables\n * against the primitive element 0x03 with irreducible polynomial\n * 0x11b (x^8 + x^4 + x^3 + x + 1 — the AES polynomial).\n *\n * Constant-time is NOT a goal here — for secret sharing, the threat\n * model assumes the combining device is trusted during\n * reconstruction. If that assumption is wrong, no library-level\n * constant-time hedge protects the plaintext anyway.\n */\n\nconst LOG = new Uint8Array(256)\nconst EXP = new Uint8Array(256)\n\n// Build log/exp tables. Primitive element 0x03; reduction polynomial 0x11b.\n// Multiplication by 3 in GF(2^8) is (x << 1) ^ x, with polynomial reduction\n// when the shift carries bit 8.\n{\n  let x = 1\n  for (let i = 0; i < 255; i++) {\n    EXP[i] = x\n    LOG[x] = i\n    // x <- x * 3 in GF(2^8)\n    let doubled = x << 1\n    if (doubled & 0x100) doubled ^= 0x11b\n    x = (doubled ^ x) & 0xff\n  }\n  // EXP cycles with period 255 — EXP[255] = EXP[0] simplifies modulo math.\n  EXP[255] = EXP[0]!\n  // LOG[0] is undefined (log of 0 doesn't exist) — guarded at call sites.\n}\n\n/** Addition in GF(2^8) is XOR. */\nexport function gfAdd(a: number, b: number): number {\n  return (a ^ b) & 0xff\n}\n\n/** Multiplication in GF(2^8). Returns 0 if either operand is 0. */\nexport function gfMul(a: number, b: number): number {\n  if (a === 0 || b === 0) return 0\n  const s = (LOG[a]! + LOG[b]!) % 255\n  return EXP[s]!\n}\n\n/** Multiplicative inverse in GF(2^8). Throws on 0 (no inverse exists). */\nexport function gfInv(a: number): number {\n  if (a === 0) throw new Error('gf256: no inverse for 0')\n  return EXP[(255 - LOG[a]!) % 255]!\n}\n\n/** Division in GF(2^8). Throws on divide-by-zero. */\nexport function gfDiv(a: number, b: number): number {\n  if (b === 0) throw new Error('gf256: division by zero')\n  if (a === 0) return 0\n  const s = (LOG[a]! + 255 - LOG[b]!) % 255\n  return EXP[s]!\n}\n\n/**\n * Evaluate a polynomial with coefficients `coeffs[0] + coeffs[1]*x + ...`\n * at point `x` in GF(2^8) via Horner's method.\n */\nexport function gfPolyEval(coeffs: readonly number[], x: number): number {\n  let y = 0\n  for (let i = coeffs.length - 1; i >= 0; i--) {\n    y = gfAdd(gfMul(y, x), coeffs[i]!)\n  }\n  return y\n}\n\n/**\n * Lagrange interpolation at x=0, given k distinct points `(xi, yi)`.\n *\n * Returns the constant term of the unique degree-(k-1) polynomial\n * through those points — equal to the original secret byte for\n * Shamir's construction.\n */\nexport function lagrangeInterpolateAtZero(points: readonly [number, number][]): number {\n  let result = 0\n  for (let i = 0; i < points.length; i++) {\n    const [xi, yi] = points[i]!\n    // Li(0) = ∏_{j≠i} xj / (xi XOR xj)   (in GF(2^8), -x == x)\n    let numerator = 1\n    let denominator = 1\n    for (let j = 0; j < points.length; j++) {\n      if (i === j) continue\n      const [xj] = points[j]!\n      numerator = gfMul(numerator, xj)\n      denominator = gfMul(denominator, gfAdd(xi, xj))\n    }\n    const basis = gfDiv(numerator, denominator)\n    result = gfAdd(result, gfMul(yi, basis))\n  }\n  return result\n}\n","/**\n * Shamir Secret Sharing over GF(2^8), byte-wise.\n *\n * For each byte of the secret, construct a random polynomial of\n * degree k-1 whose constant term is the byte. Each share is a value\n * of that polynomial at a distinct x-coordinate in 1..255. Any K of\n * the N shares recombines the original bytes via Lagrange interpolation\n * at x=0.\n *\n * x=0 is reserved (it would directly reveal the secret). x-coordinates\n * are chosen from 1..255 ensuring distinctness.\n */\n\nimport { gfPolyEval, lagrangeInterpolateAtZero } from './gf256.js'\n\n/**\n * Split a secret into N shares. Any K of them reconstructs the secret;\n * fewer than K leaks zero bits.\n *\n * @param secret - The bytes to share (e.g., a 32-byte KEK).\n * @param k - Threshold (min shares needed to reconstruct). Must be >= 2.\n * @param n - Total shares to produce. Must be >= k and <= 255.\n * @param randomBytes - RNG function returning N random bytes. Defaults to\n *   `crypto.getRandomValues`. Injectable for deterministic tests.\n * @returns An array of `n` shares. Each share has an x-coordinate + y-bytes\n *   parallel to the secret bytes.\n */\nexport function splitSecret(\n  secret: Uint8Array,\n  k: number,\n  n: number,\n  randomBytes: (count: number) => Uint8Array = defaultRandomBytes,\n): RawShare[] {\n  assertSplitArgs(k, n, secret.length)\n\n  // Choose n distinct x-coordinates in 1..255.\n  const xCoords = pickXCoords(n)\n\n  // For each byte of the secret, build a polynomial of degree k-1 with\n  // the byte as the constant term and random coefficients for x^1..x^(k-1).\n  // Evaluate at each xCoord to get the share's y-byte for that position.\n  const shares: RawShare[] = xCoords.map(x => ({\n    x,\n    y: new Uint8Array(secret.length),\n    k,\n    n,\n  }))\n\n  for (let byteIdx = 0; byteIdx < secret.length; byteIdx++) {\n    const coeffs: number[] = [secret[byteIdx]!]\n    const rand = randomBytes(k - 1)\n    for (let j = 0; j < k - 1; j++) {\n      coeffs.push(rand[j]!)\n    }\n    for (let shareIdx = 0; shareIdx < n; shareIdx++) {\n      shares[shareIdx]!.y[byteIdx] = gfPolyEval(coeffs, xCoords[shareIdx]!)\n    }\n  }\n\n  return shares\n}\n\n/**\n * Reconstruct a secret from K or more shares.\n *\n * Uses the first K shares provided; additional shares are ignored.\n * Shares must agree on secret length and x-coordinates must be\n * distinct (checked; throws on mismatch).\n */\nexport function combineSecret(shares: readonly RawShare[]): Uint8Array {\n  if (shares.length === 0) {\n    throw new Error('shamir: no shares provided')\n  }\n  const k = shares[0]!.k\n  if (shares.length < k) {\n    throw new Error(`shamir: insufficient shares — need ${k}, got ${shares.length}`)\n  }\n  const byteLength = shares[0]!.y.length\n  for (const s of shares) {\n    if (s.y.length !== byteLength) {\n      throw new Error('shamir: share lengths disagree — incompatible enrollment')\n    }\n  }\n  const selected = shares.slice(0, k)\n  const xs = selected.map(s => s.x)\n  if (new Set(xs).size !== xs.length) {\n    throw new Error('shamir: duplicate x-coordinates among provided shares')\n  }\n\n  const secret = new Uint8Array(byteLength)\n  for (let byteIdx = 0; byteIdx < byteLength; byteIdx++) {\n    const points: [number, number][] = selected.map(s => [s.x, s.y[byteIdx]!])\n    secret[byteIdx] = lagrangeInterpolateAtZero(points)\n  }\n  return secret\n}\n\n/** A raw Shamir share before serialisation. */\nexport interface RawShare {\n  /** x-coordinate in GF(2^8), 1..255. Zero is disallowed (it would reveal the secret). */\n  readonly x: number\n  /** y-bytes — one per byte of the secret. */\n  readonly y: Uint8Array\n  /** Threshold used at split time. */\n  readonly k: number\n  /** Total shares at split time. */\n  readonly n: number\n}\n\n// ── internals ──────────────────────────────────────────────────────────\n\nfunction assertSplitArgs(k: number, n: number, secretLen: number): void {\n  if (!Number.isInteger(k) || k < 2) {\n    throw new Error(`shamir: k must be an integer >= 2 (got ${k})`)\n  }\n  if (!Number.isInteger(n) || n < k || n > 255) {\n    throw new Error(`shamir: n must satisfy k <= n <= 255 (got k=${k} n=${n})`)\n  }\n  if (!Number.isInteger(secretLen) || secretLen < 1) {\n    throw new Error(`shamir: secret must be at least 1 byte`)\n  }\n}\n\nfunction pickXCoords(n: number): number[] {\n  // Use 1..n as x-coordinates. Simple, deterministic, well-distributed.\n  // (For applications where share-position anonymity matters, shuffle at\n  // serialisation time; the crypto doesn't care about the labels.)\n  const result: number[] = []\n  for (let i = 1; i <= n; i++) result.push(i)\n  return result\n}\n\nfunction defaultRandomBytes(count: number): Uint8Array {\n  return crypto.getRandomValues(new Uint8Array(count))\n}\n","/**\n * Share serialisation — raw bytes, Base32 for printing, and JSON for\n * structured transport (e.g. storing inside another on-* keyring).\n *\n * Binary layout (fixed header + secret-length y-bytes):\n *\n * ```\n *   offset  size  field\n *   0       1     version (= 1)\n *   1       1     x-coordinate (1..255)\n *   2       1     k (threshold)\n *   3       1     n (total)\n *   4       2     byteLength (big-endian uint16) — should equal y-length\n *   6+      L     y-bytes (L = byteLength)\n * ```\n *\n * Base32 adds a 26-character ULID `shareId` prefix + version/k/n\n * metadata for human-readable diagnostics.\n */\n\nimport type { RawShare } from './shamir.js'\n\nconst SHARE_VERSION = 1\nconst HEADER_LEN = 6\n\n// RFC 4648 Base32 alphabet — no confusing 0/1/8/O/I/L/B pairs.\nconst BASE32_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'\n\n/** Serialise a raw share into its canonical binary form. */\nexport function encodeShareBytes(share: RawShare): Uint8Array {\n  const bytes = new Uint8Array(HEADER_LEN + share.y.length)\n  bytes[0] = SHARE_VERSION\n  bytes[1] = share.x\n  bytes[2] = share.k\n  bytes[3] = share.n\n  bytes[4] = (share.y.length >>> 8) & 0xff\n  bytes[5] = share.y.length & 0xff\n  bytes.set(share.y, HEADER_LEN)\n  return bytes\n}\n\n/** Parse binary share bytes back into a structured share. */\nexport function decodeShareBytes(bytes: Uint8Array): RawShare {\n  if (bytes.length < HEADER_LEN) {\n    throw new Error(`shamir: share bytes too short (${bytes.length} < ${HEADER_LEN})`)\n  }\n  const version = bytes[0]!\n  if (version !== SHARE_VERSION) {\n    throw new Error(`shamir: unsupported share version ${version} (expected ${SHARE_VERSION})`)\n  }\n  const x = bytes[1]!\n  const k = bytes[2]!\n  const n = bytes[3]!\n  const byteLength = (bytes[4]! << 8) | bytes[5]!\n  if (bytes.length !== HEADER_LEN + byteLength) {\n    throw new Error(`shamir: share length mismatch — header says ${byteLength}, got ${bytes.length - HEADER_LEN}`)\n  }\n  if (x === 0) {\n    throw new Error('shamir: share has x=0 — malformed')\n  }\n  return { x, k, n, y: bytes.slice(HEADER_LEN) }\n}\n\n/**\n * Encode a share as a Base32 string with hyphenated groups of 4.\n *\n * Output format: `SHAMIR_S{x}_K{k}N{n}__<base32-groups-of-4>`\n *\n * The prefix is not fed into the decoder — it's for eye-readability at a\n * glance (share-number / threshold / total). The `SHAMIR` tag + `_`\n * separators are non-Base32 characters (Base32 alphabet is A-Z2-7\n * only), so the decoder can strip everything up to and including the\n * last `_` before the payload. The metadata is also encoded in the\n * share bytes themselves; the prefix is redundant-but-useful.\n */\nexport function encodeShareBase32(share: RawShare): string {\n  const bytes = encodeShareBytes(share)\n  const chunks = base32Encode(bytes)\n  const grouped = chunks.match(/.{1,4}/g)?.join('-') ?? chunks\n  return `SHAMIR_S${share.x}_K${share.k}N${share.n}__${grouped}`\n}\n\n/**\n * Parse a Base32 share string back into a structured share. Tolerates\n * hyphens, whitespace, lowercase, and the optional prefix produced by\n * `encodeShareBase32`. The metadata prefix is informational; actual\n * share data comes from the binary bytes after the last `_`.\n */\nexport function decodeShareBase32(input: string): RawShare {\n  // Normalise first: uppercase + remove whitespace/hyphens. Keep `_`\n  // and digits so we can locate the prefix separator.\n  const normalised = input.toUpperCase().replace(/[\\s-]/g, '')\n\n  // If an optional SHAMIR_..._ prefix is present, strip up to the last `__`.\n  const lastDoubleUnderscore = normalised.lastIndexOf('__')\n  const payload = lastDoubleUnderscore >= 0 ? normalised.slice(lastDoubleUnderscore + 2) : normalised\n\n  // Remove any remaining non-Base32 characters (defensive — also handles\n  // cases where prefix metadata leaked into the payload somehow).\n  const stripped = payload.replace(/[^A-Z2-7]/g, '')\n  const bytes = base32Decode(stripped)\n  return decodeShareBytes(bytes)\n}\n\n/**\n * JSON-friendly form for structured storage (e.g. stash inside another\n * on-* keyring entry, or pass over `postMessage`).\n */\nexport interface ShareJSON {\n  readonly v: 1\n  readonly x: number\n  readonly k: number\n  readonly n: number\n  readonly y: string  // Base64\n}\n\nexport function encodeShareJSON(share: RawShare): ShareJSON {\n  return {\n    v: SHARE_VERSION,\n    x: share.x,\n    k: share.k,\n    n: share.n,\n    y: base64Encode(share.y),\n  }\n}\n\nexport function decodeShareJSON(json: ShareJSON): RawShare {\n  if (json.v !== SHARE_VERSION) {\n    throw new Error(`shamir: unsupported share version ${String(json.v)}`)\n  }\n  return { x: json.x, k: json.k, n: json.n, y: base64Decode(json.y) }\n}\n\n// ── Base32 ─────────────────────────────────────────────────────────────\n\nfunction base32Encode(bytes: Uint8Array): string {\n  let bits = 0\n  let value = 0\n  let out = ''\n  for (let i = 0; i < bytes.length; i++) {\n    value = (value << 8) | bytes[i]!\n    bits += 8\n    while (bits >= 5) {\n      bits -= 5\n      out += BASE32_ALPHABET[(value >>> bits) & 0x1f]\n    }\n  }\n  if (bits > 0) {\n    out += BASE32_ALPHABET[(value << (5 - bits)) & 0x1f]\n  }\n  return out\n}\n\nfunction base32Decode(input: string): Uint8Array {\n  let bits = 0\n  let value = 0\n  const out: number[] = []\n  for (const ch of input) {\n    const idx = BASE32_ALPHABET.indexOf(ch)\n    if (idx < 0) {\n      throw new Error(`shamir: invalid Base32 character \"${ch}\"`)\n    }\n    value = (value << 5) | idx\n    bits += 5\n    if (bits >= 8) {\n      bits -= 8\n      out.push((value >>> bits) & 0xff)\n    }\n  }\n  return new Uint8Array(out)\n}\n\n// ── Base64 ─────────────────────────────────────────────────────────────\n\nfunction base64Encode(bytes: Uint8Array): string {\n  let s = ''\n  for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]!)\n  return btoa(s)\n}\n\nfunction base64Decode(str: string): Uint8Array {\n  const s = atob(str)\n  const out = new Uint8Array(s.length)\n  for (let i = 0; i < s.length; i++) out[i] = s.charCodeAt(i)\n  return out\n}\n"],"mappings":";AAcA,IAAM,MAAM,IAAI,WAAW,GAAG;AAC9B,IAAM,MAAM,IAAI,WAAW,GAAG;AAK9B;AACE,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,KAAK,KAAK;AAC5B,QAAI,CAAC,IAAI;AACT,QAAI,CAAC,IAAI;AAET,QAAI,UAAU,KAAK;AACnB,QAAI,UAAU,IAAO,YAAW;AAChC,SAAK,UAAU,KAAK;AAAA,EACtB;AAEA,MAAI,GAAG,IAAI,IAAI,CAAC;AAElB;AAGO,SAAS,MAAM,GAAW,GAAmB;AAClD,UAAQ,IAAI,KAAK;AACnB;AAGO,SAAS,MAAM,GAAW,GAAmB;AAClD,MAAI,MAAM,KAAK,MAAM,EAAG,QAAO;AAC/B,QAAM,KAAK,IAAI,CAAC,IAAK,IAAI,CAAC,KAAM;AAChC,SAAO,IAAI,CAAC;AACd;AAGO,SAAS,MAAM,GAAmB;AACvC,MAAI,MAAM,EAAG,OAAM,IAAI,MAAM,yBAAyB;AACtD,SAAO,KAAK,MAAM,IAAI,CAAC,KAAM,GAAG;AAClC;AAGO,SAAS,MAAM,GAAW,GAAmB;AAClD,MAAI,MAAM,EAAG,OAAM,IAAI,MAAM,yBAAyB;AACtD,MAAI,MAAM,EAAG,QAAO;AACpB,QAAM,KAAK,IAAI,CAAC,IAAK,MAAM,IAAI,CAAC,KAAM;AACtC,SAAO,IAAI,CAAC;AACd;AAMO,SAAS,WAAW,QAA2B,GAAmB;AACvE,MAAI,IAAI;AACR,WAAS,IAAI,OAAO,SAAS,GAAG,KAAK,GAAG,KAAK;AAC3C,QAAI,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAE;AAAA,EACnC;AACA,SAAO;AACT;AASO,SAAS,0BAA0B,QAA6C;AACrF,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC;AAEzB,QAAI,YAAY;AAChB,QAAI,cAAc;AAClB,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAI,MAAM,EAAG;AACb,YAAM,CAAC,EAAE,IAAI,OAAO,CAAC;AACrB,kBAAY,MAAM,WAAW,EAAE;AAC/B,oBAAc,MAAM,aAAa,MAAM,IAAI,EAAE,CAAC;AAAA,IAChD;AACA,UAAM,QAAQ,MAAM,WAAW,WAAW;AAC1C,aAAS,MAAM,QAAQ,MAAM,IAAI,KAAK,CAAC;AAAA,EACzC;AACA,SAAO;AACT;;;ACtEO,SAAS,YACd,QACA,GACA,GACA,cAA6C,oBACjC;AACZ,kBAAgB,GAAG,GAAG,OAAO,MAAM;AAGnC,QAAM,UAAU,YAAY,CAAC;AAK7B,QAAM,SAAqB,QAAQ,IAAI,QAAM;AAAA,IAC3C;AAAA,IACA,GAAG,IAAI,WAAW,OAAO,MAAM;AAAA,IAC/B;AAAA,IACA;AAAA,EACF,EAAE;AAEF,WAAS,UAAU,GAAG,UAAU,OAAO,QAAQ,WAAW;AACxD,UAAM,SAAmB,CAAC,OAAO,OAAO,CAAE;AAC1C,UAAM,OAAO,YAAY,IAAI,CAAC;AAC9B,aAAS,IAAI,GAAG,IAAI,IAAI,GAAG,KAAK;AAC9B,aAAO,KAAK,KAAK,CAAC,CAAE;AAAA,IACtB;AACA,aAAS,WAAW,GAAG,WAAW,GAAG,YAAY;AAC/C,aAAO,QAAQ,EAAG,EAAE,OAAO,IAAI,WAAW,QAAQ,QAAQ,QAAQ,CAAE;AAAA,IACtE;AAAA,EACF;AAEA,SAAO;AACT;AASO,SAAS,cAAc,QAAyC;AACrE,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AACA,QAAM,IAAI,OAAO,CAAC,EAAG;AACrB,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI,MAAM,2CAAsC,CAAC,SAAS,OAAO,MAAM,EAAE;AAAA,EACjF;AACA,QAAM,aAAa,OAAO,CAAC,EAAG,EAAE;AAChC,aAAW,KAAK,QAAQ;AACtB,QAAI,EAAE,EAAE,WAAW,YAAY;AAC7B,YAAM,IAAI,MAAM,+DAA0D;AAAA,IAC5E;AAAA,EACF;AACA,QAAM,WAAW,OAAO,MAAM,GAAG,CAAC;AAClC,QAAM,KAAK,SAAS,IAAI,OAAK,EAAE,CAAC;AAChC,MAAI,IAAI,IAAI,EAAE,EAAE,SAAS,GAAG,QAAQ;AAClC,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AAEA,QAAM,SAAS,IAAI,WAAW,UAAU;AACxC,WAAS,UAAU,GAAG,UAAU,YAAY,WAAW;AACrD,UAAM,SAA6B,SAAS,IAAI,OAAK,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,CAAE,CAAC;AACzE,WAAO,OAAO,IAAI,0BAA0B,MAAM;AAAA,EACpD;AACA,SAAO;AACT;AAgBA,SAAS,gBAAgB,GAAW,GAAW,WAAyB;AACtE,MAAI,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,GAAG;AACjC,UAAM,IAAI,MAAM,0CAA0C,CAAC,GAAG;AAAA,EAChE;AACA,MAAI,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,KAAK,IAAI,KAAK;AAC5C,UAAM,IAAI,MAAM,+CAA+C,CAAC,MAAM,CAAC,GAAG;AAAA,EAC5E;AACA,MAAI,CAAC,OAAO,UAAU,SAAS,KAAK,YAAY,GAAG;AACjD,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AACF;AAEA,SAAS,YAAY,GAAqB;AAIxC,QAAM,SAAmB,CAAC;AAC1B,WAAS,IAAI,GAAG,KAAK,GAAG,IAAK,QAAO,KAAK,CAAC;AAC1C,SAAO;AACT;AAEA,SAAS,mBAAmB,OAA2B;AACrD,SAAO,OAAO,gBAAgB,IAAI,WAAW,KAAK,CAAC;AACrD;;;AChHA,IAAM,gBAAgB;AACtB,IAAM,aAAa;AAGnB,IAAM,kBAAkB;AAGjB,SAAS,iBAAiB,OAA6B;AAC5D,QAAM,QAAQ,IAAI,WAAW,aAAa,MAAM,EAAE,MAAM;AACxD,QAAM,CAAC,IAAI;AACX,QAAM,CAAC,IAAI,MAAM;AACjB,QAAM,CAAC,IAAI,MAAM;AACjB,QAAM,CAAC,IAAI,MAAM;AACjB,QAAM,CAAC,IAAK,MAAM,EAAE,WAAW,IAAK;AACpC,QAAM,CAAC,IAAI,MAAM,EAAE,SAAS;AAC5B,QAAM,IAAI,MAAM,GAAG,UAAU;AAC7B,SAAO;AACT;AAGO,SAAS,iBAAiB,OAA6B;AAC5D,MAAI,MAAM,SAAS,YAAY;AAC7B,UAAM,IAAI,MAAM,kCAAkC,MAAM,MAAM,MAAM,UAAU,GAAG;AAAA,EACnF;AACA,QAAM,UAAU,MAAM,CAAC;AACvB,MAAI,YAAY,eAAe;AAC7B,UAAM,IAAI,MAAM,qCAAqC,OAAO,cAAc,aAAa,GAAG;AAAA,EAC5F;AACA,QAAM,IAAI,MAAM,CAAC;AACjB,QAAM,IAAI,MAAM,CAAC;AACjB,QAAM,IAAI,MAAM,CAAC;AACjB,QAAM,aAAc,MAAM,CAAC,KAAM,IAAK,MAAM,CAAC;AAC7C,MAAI,MAAM,WAAW,aAAa,YAAY;AAC5C,UAAM,IAAI,MAAM,oDAA+C,UAAU,SAAS,MAAM,SAAS,UAAU,EAAE;AAAA,EAC/G;AACA,MAAI,MAAM,GAAG;AACX,UAAM,IAAI,MAAM,wCAAmC;AAAA,EACrD;AACA,SAAO,EAAE,GAAG,GAAG,GAAG,GAAG,MAAM,MAAM,UAAU,EAAE;AAC/C;AAcO,SAAS,kBAAkB,OAAyB;AACzD,QAAM,QAAQ,iBAAiB,KAAK;AACpC,QAAM,SAAS,aAAa,KAAK;AACjC,QAAM,UAAU,OAAO,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK;AACtD,SAAO,WAAW,MAAM,CAAC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,OAAO;AAC9D;AAQO,SAAS,kBAAkB,OAAyB;AAGzD,QAAM,aAAa,MAAM,YAAY,EAAE,QAAQ,UAAU,EAAE;AAG3D,QAAM,uBAAuB,WAAW,YAAY,IAAI;AACxD,QAAM,UAAU,wBAAwB,IAAI,WAAW,MAAM,uBAAuB,CAAC,IAAI;AAIzF,QAAM,WAAW,QAAQ,QAAQ,cAAc,EAAE;AACjD,QAAM,QAAQ,aAAa,QAAQ;AACnC,SAAO,iBAAiB,KAAK;AAC/B;AAcO,SAAS,gBAAgB,OAA4B;AAC1D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,IACT,GAAG,aAAa,MAAM,CAAC;AAAA,EACzB;AACF;AAEO,SAAS,gBAAgB,MAA2B;AACzD,MAAI,KAAK,MAAM,eAAe;AAC5B,UAAM,IAAI,MAAM,qCAAqC,OAAO,KAAK,CAAC,CAAC,EAAE;AAAA,EACvE;AACA,SAAO,EAAE,GAAG,KAAK,GAAG,GAAG,KAAK,GAAG,GAAG,KAAK,GAAG,GAAG,aAAa,KAAK,CAAC,EAAE;AACpE;AAIA,SAAS,aAAa,OAA2B;AAC/C,MAAI,OAAO;AACX,MAAI,QAAQ;AACZ,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,YAAS,SAAS,IAAK,MAAM,CAAC;AAC9B,YAAQ;AACR,WAAO,QAAQ,GAAG;AAChB,cAAQ;AACR,aAAO,gBAAiB,UAAU,OAAQ,EAAI;AAAA,IAChD;AAAA,EACF;AACA,MAAI,OAAO,GAAG;AACZ,WAAO,gBAAiB,SAAU,IAAI,OAAS,EAAI;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAA2B;AAC/C,MAAI,OAAO;AACX,MAAI,QAAQ;AACZ,QAAM,MAAgB,CAAC;AACvB,aAAW,MAAM,OAAO;AACtB,UAAM,MAAM,gBAAgB,QAAQ,EAAE;AACtC,QAAI,MAAM,GAAG;AACX,YAAM,IAAI,MAAM,qCAAqC,EAAE,GAAG;AAAA,IAC5D;AACA,YAAS,SAAS,IAAK;AACvB,YAAQ;AACR,QAAI,QAAQ,GAAG;AACb,cAAQ;AACR,UAAI,KAAM,UAAU,OAAQ,GAAI;AAAA,IAClC;AAAA,EACF;AACA,SAAO,IAAI,WAAW,GAAG;AAC3B;AAIA,SAAS,aAAa,OAA2B;AAC/C,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,MAAK,OAAO,aAAa,MAAM,CAAC,CAAE;AACzE,SAAO,KAAK,CAAC;AACf;AAEA,SAAS,aAAa,KAAyB;AAC7C,QAAM,IAAI,KAAK,GAAG;AAClB,QAAM,MAAM,IAAI,WAAW,EAAE,MAAM;AACnC,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,KAAI,CAAC,IAAI,EAAE,WAAW,CAAC;AAC1D,SAAO;AACT;","names":[]}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@noy-db/shamir",
+  "version": "0.8.0-pre.0",
+  "description": "Shamir Secret Sharing over GF(2^8), byte-wise, plus the share codecs (bytes / base32 / JSON). Pure math, zero dependencies, no hub contract — the primitive @noy-db/on-shamir builds its unlock method on.",
+  "license": "Apache-2.0",
+  "author": "vLannaAi <vicio@lanna.ai>",
+  "homepage": "https://github.com/noy-db/core/tree/main/packages/shamir#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/noy-db/core.git",
+    "directory": "packages/shamir"
+  },
+  "bugs": {
+    "url": "https://github.com/noy-db/core/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "keywords": [
+    "noy-db",
+    "shamir",
+    "secret-sharing",
+    "k-of-n",
+    "threshold",
+    "gf256"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "lint": "eslint src/",
+    "typecheck": "tsc --noEmit"
+  }
+}