@opengovsg/formsg-sdk 7.6.0 → 8.0.1

package/dist/cjs/crypto-base.js

@@ -40,8 +40,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 var tweetnacl_1 = __importDefault(require("tweetnacl"));
-var tweetnacl_util_1 = require("tweetnacl-util");
 var crypto_1 = require("./util/crypto");
+var encoding_1 = require("./util/encoding");
 var CryptoBase = /** @class */ (function () {
     function CryptoBase() {
         var _this = this;
@@ -66,8 +66,8 @@ var CryptoBase = /** @class */ (function () {
                         //! NOTE: submissionPublicKey here is a misnomer as a new keypair is generated per file.
                         // The naming is only retained for backward-compatibility purposes.
                         submissionPublicKey: fileKeypair.publicKey,
-                        nonce: (0, tweetnacl_util_1.encodeBase64)(nonce),
-                        binary: tweetnacl_1.default.box(binary, nonce, (0, tweetnacl_util_1.decodeBase64)(publicKey), (0, tweetnacl_util_1.decodeBase64)(fileKeypair.secretKey)),
+                        nonce: (0, encoding_1.encodeBase64)(nonce),
+                        binary: tweetnacl_1.default.box(binary, nonce, (0, encoding_1.decodeBase64)(publicKey), (0, encoding_1.decodeBase64)(fileKeypair.secretKey)),
                     }];
             });
         }); };
@@ -82,7 +82,7 @@ var CryptoBase = /** @class */ (function () {
         this.decryptFile = function (secretKey_1, _a) { return __awaiter(_this, [secretKey_1, _a], void 0, function (secretKey, _b) {
             var filePublicKey = _b.submissionPublicKey, nonce = _b.nonce, encryptedBinary = _b.binary;
             return __generator(this, function (_c) {
-                return [2 /*return*/, tweetnacl_1.default.box.open(encryptedBinary, (0, tweetnacl_util_1.decodeBase64)(nonce), (0, tweetnacl_util_1.decodeBase64)(filePublicKey), (0, tweetnacl_util_1.decodeBase64)(secretKey))];
+                return [2 /*return*/, tweetnacl_1.default.box.open(encryptedBinary, (0, encoding_1.decodeBase64)(nonce), (0, encoding_1.decodeBase64)(filePublicKey), (0, encoding_1.decodeBase64)(secretKey))];
             });
         }); };
     }

package/dist/cjs/crypto-v3.d.ts

@@ -1,6 +1,6 @@
 import CryptoBase from './crypto-base';
 import { DecryptedContentV3, DecryptParams, DecryptParamsV3, EncryptedContentV3 } from './types';
-import { DecryptedContentV4, FieldResponsesV4, FormFieldMeta } from './types-v4';
+import { DecryptedContentV4, DecryptParamsV4, FieldResponsesV4, FormFieldMeta } from './types-v4';
 /**
  * Checks whether decrypted responses are already in V4 format.
  * V4 entries have a `provenance` object, which V3 entries lack.
@@ -49,7 +49,7 @@ export default class CryptoV3 extends CryptoBase {
      * @returns The decrypted content in V4 format if successful. Else, null will be returned.
      * @throws {MissingPublicKeyError} if a public key is not provided when instantiating this class and is needed for verifying signed content.
      */
-    decryptToV4: (formSecretKey: string, decryptParams: DecryptParamsV3, formFields: Record<string, FormFieldMeta>) => DecryptedContentV4 | null;
+    decryptToV4: (formSecretKey: string, decryptParams: DecryptParamsV4, formFields: Record<string, FormFieldMeta>) => DecryptedContentV4 | null;
     /**
      * Returns true if a pair of public & secret keys are associated with each other
      * @param publicKey The public key to verify against.

package/dist/cjs/crypto-v3.js

@@ -41,8 +41,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isFieldResponsesV4 = isFieldResponsesV4;
-var tweetnacl_util_1 = require("tweetnacl-util");
 var crypto_1 = require("./util/crypto");
+var encoding_1 = require("./util/encoding");
 var validate_1 = require("./util/validate");
 var adapt_v3_to_v4_1 = require("./adapt-v3-to-v4");
 var crypto_base_1 = __importDefault(require("./crypto-base"));
@@ -96,8 +96,8 @@ var CryptoV3 = /** @class */ (function (_super) {
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         _this.encrypt = function (msg, formPublicKey) {
             var submissionKeypair = (0, crypto_1.generateKeypair)();
-            var encryptedSubmissionSecretKey = (0, crypto_1.encryptMessage)((0, tweetnacl_util_1.decodeBase64)(submissionKeypair.secretKey), formPublicKey);
-            var processedMsg = (0, tweetnacl_util_1.decodeUTF8)(JSON.stringify(msg));
+            var encryptedSubmissionSecretKey = (0, crypto_1.encryptMessage)((0, encoding_1.decodeBase64)(submissionKeypair.secretKey), formPublicKey);
+            var processedMsg = (0, encoding_1.decodeUTF8)(JSON.stringify(msg));
             var encryptedContent = (0, crypto_1.encryptMessage)(processedMsg, submissionKeypair.publicKey);
             return {
                 submissionPublicKey: submissionKeypair.publicKey,
@@ -123,7 +123,7 @@ var CryptoV3 = /** @class */ (function (_super) {
                 if (!decryptedContent) {
                     throw new Error('Failed to decrypt content');
                 }
-                var decryptedObject = JSON.parse((0, tweetnacl_util_1.encodeUTF8)(decryptedContent));
+                var decryptedObject = JSON.parse((0, encoding_1.encodeUTF8)(decryptedContent));
                 if (!(0, validate_1.determineIsFormFieldsV3)(decryptedObject)) {
                     throw new Error('Decrypted object does not fit expected shape');
                 }
@@ -179,7 +179,7 @@ var CryptoV3 = /** @class */ (function (_super) {
                 var submissionSecretKey = (0, crypto_1.decryptContent)(formSecretKey, encryptedSubmissionSecretKey);
                 if (submissionSecretKey === null)
                     return null;
-                return _this.decryptFromSubmissionKey((0, tweetnacl_util_1.encodeBase64)(submissionSecretKey), rest);
+                return _this.decryptFromSubmissionKey((0, encoding_1.encodeBase64)(submissionSecretKey), rest);
             }
             catch (err) {
                 if (err instanceof errors_1.MissingPublicKeyError) {
@@ -209,8 +209,16 @@ var CryptoV3 = /** @class */ (function (_super) {
             var responses = isFieldResponsesV4(decrypted.responses)
                 ? backfillMissingQuestions(decrypted.responses, formFields)
                 : (0, adapt_v3_to_v4_1.adaptV3ToV4)(decrypted.responses, { formFields: formFields });
+            var stepToken = undefined;
+            if (decryptParams.encryptedStepToken) {
+                var decryptedStepToken = (0, crypto_1.decryptContent)(formSecretKey, decryptParams.encryptedStepToken);
+                if (decryptedStepToken) {
+                    stepToken = (0, encoding_1.encodeUTF8)(decryptedStepToken);
+                }
+            }
             return {
                 submissionSecretKey: decrypted.submissionSecretKey,
+                stepToken: stepToken,
                 responses: responses,
                 verified: decrypted.verified,
             };

package/dist/cjs/crypto.js

@@ -56,8 +56,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 var axios_1 = __importDefault(require("axios"));
 var tweetnacl_1 = __importDefault(require("tweetnacl"));
-var tweetnacl_util_1 = require("tweetnacl-util");
 var crypto_1 = require("./util/crypto");
+var encoding_1 = require("./util/encoding");
 var validate_1 = require("./util/validate");
 var crypto_base_1 = __importDefault(require("./crypto-base"));
 var errors_1 = require("./errors");
@@ -74,9 +74,9 @@ var Crypto = /** @class */ (function (_super) {
          * @returns The encrypted basestring.
          */
         _this.encrypt = function (msg, encryptionPublicKey, signingPrivateKey) {
-            var processedMsg = (0, tweetnacl_util_1.decodeUTF8)(JSON.stringify(msg));
+            var processedMsg = (0, encoding_1.decodeUTF8)(JSON.stringify(msg));
             if (signingPrivateKey) {
-                processedMsg = tweetnacl_1.default.sign(processedMsg, (0, tweetnacl_util_1.decodeBase64)(signingPrivateKey));
+                processedMsg = tweetnacl_1.default.sign(processedMsg, (0, encoding_1.decodeBase64)(signingPrivateKey));
             }
             return (0, crypto_1.encryptMessage)(processedMsg, encryptionPublicKey);
         };
@@ -99,7 +99,7 @@ var Crypto = /** @class */ (function (_super) {
                 if (!decryptedContent) {
                     throw new Error('Failed to decrypt content');
                 }
-                var decryptedObject = JSON.parse((0, tweetnacl_util_1.encodeUTF8)(decryptedContent));
+                var decryptedObject = JSON.parse((0, encoding_1.encodeUTF8)(decryptedContent));
                 if (!(0, validate_1.determineIsFormFields)(decryptedObject)) {
                     throw new Error('Decrypted object does not fit expected shape');
                 }

package/dist/cjs/index.d.ts

@@ -7,6 +7,7 @@ export { adaptV3ToV4 } from './adapt-v3-to-v4';
 export { adaptV4ToV3 } from './adapt-v4-to-v3';
 export { isFieldResponsesV4 } from './crypto-v3';
 export { ADDRESS_SUBFIELD_KEYS, GENERIC_STRING_FIELD_TYPES, } from './constants-v4';
+export { generateUUID } from './util/crypto';
 export type { DecryptedContent, DecryptedContentV3, DecryptParams, DecryptParamsV3, EncryptedAttachmentContent, EncryptedAttachmentRecords, EncryptedContent, EncryptedContentV3, EncryptedFileContent, FieldType, FormField, FormFieldsV3, Keypair, PackageMode, VerificationOptions, } from './types';
 export type { AdaptV3ToV4Options, AnswerV4, AddressAnswerV4, AttachmentAnswerV4, CheckboxAnswerV4, ChildrenAnswerV4, DecryptedContentV4, FieldResponsesV4, FieldResponseV4, FormFieldMeta, FormFieldV4, FormFieldsV4, RadioAnswerV4, ResponseProvenance, SignatureAnswerV4, StringAnswerV4, TableAnswerV4, VerifiableAnswerV4, } from './types-v4';
 /**

package/dist/cjs/index.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GENERIC_STRING_FIELD_TYPES = exports.ADDRESS_SUBFIELD_KEYS = exports.isFieldResponsesV4 = exports.adaptV4ToV3 = exports.adaptV3ToV4 = void 0;
+exports.generateUUID = exports.GENERIC_STRING_FIELD_TYPES = exports.ADDRESS_SUBFIELD_KEYS = exports.isFieldResponsesV4 = exports.adaptV4ToV3 = exports.adaptV3ToV4 = void 0;
 exports.default = default_1;
 var publicKey_1 = require("./util/publicKey");
 var crypto_1 = __importDefault(require("./crypto"));
@@ -19,6 +19,8 @@ Object.defineProperty(exports, "isFieldResponsesV4", { enumerable: true, get: fu
 var constants_v4_1 = require("./constants-v4");
 Object.defineProperty(exports, "ADDRESS_SUBFIELD_KEYS", { enumerable: true, get: function () { return constants_v4_1.ADDRESS_SUBFIELD_KEYS; } });
 Object.defineProperty(exports, "GENERIC_STRING_FIELD_TYPES", { enumerable: true, get: function () { return constants_v4_1.GENERIC_STRING_FIELD_TYPES; } });
+var crypto_2 = require("./util/crypto");
+Object.defineProperty(exports, "generateUUID", { enumerable: true, get: function () { return crypto_2.generateUUID; } });
 /**
  * Entrypoint into the FormSG SDK
  *

package/dist/cjs/types-v4.d.ts

@@ -1,4 +1,4 @@
-import { FieldType } from './types';
+import { DecryptParamsV3, EncryptedContent, FieldType } from './types';
 export type ResponseProvenance = {
     submittedAt?: string;
     stepNumber?: number;
@@ -140,8 +140,12 @@ export type AdaptV3ToV4Options = {
     /** Form field definitions keyed by field ID, used to populate question text and myInfo. */
     formFields?: Record<string, FormFieldMeta>;
 };
+export interface DecryptParamsV4 extends DecryptParamsV3 {
+    encryptedStepToken?: EncryptedContent;
+}
 export type DecryptedContentV4 = {
     submissionSecretKey: string;
+    stepToken?: string;
     responses: FieldResponsesV4;
     verified?: Record<string, any>;
 };

package/dist/cjs/util/crypto.js

@@ -5,7 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateUUID = exports.convertEncryptedAttachmentToFileContent = exports.areAttachmentFieldIdsValid = exports.verifySignedMessage = exports.decryptContent = exports.encryptMessage = exports.generateKeypair = void 0;
 var tweetnacl_1 = __importDefault(require("tweetnacl"));
-var tweetnacl_util_1 = require("tweetnacl-util");
+var encoding_1 = require("./encoding");
 /**
  * Helper method to generate a new keypair for encryption.
  * @returns The generated keypair.
@@ -13,8 +13,8 @@ var tweetnacl_util_1 = require("tweetnacl-util");
 var generateKeypair = function () {
     var kp = tweetnacl_1.default.box.keyPair();
     return {
-        publicKey: (0, tweetnacl_util_1.encodeBase64)(kp.publicKey),
-        secretKey: (0, tweetnacl_util_1.encodeBase64)(kp.secretKey),
+        publicKey: (0, encoding_1.encodeBase64)(kp.publicKey),
+        secretKey: (0, encoding_1.encodeBase64)(kp.secretKey),
     };
 };
 exports.generateKeypair = generateKeypair;
@@ -28,8 +28,8 @@ exports.generateKeypair = generateKeypair;
 var encryptMessage = function (msg, theirPublicKey) {
     var submissionKeypair = (0, exports.generateKeypair)();
     var nonce = tweetnacl_1.default.randomBytes(24);
-    var encrypted = (0, tweetnacl_util_1.encodeBase64)(tweetnacl_1.default.box(msg, nonce, (0, tweetnacl_util_1.decodeBase64)(theirPublicKey), (0, tweetnacl_util_1.decodeBase64)(submissionKeypair.secretKey)));
-    return "".concat(submissionKeypair.publicKey, ";").concat((0, tweetnacl_util_1.encodeBase64)(nonce), ":").concat(encrypted);
+    var encrypted = (0, encoding_1.encodeBase64)(tweetnacl_1.default.box(msg, nonce, (0, encoding_1.decodeBase64)(theirPublicKey), (0, encoding_1.decodeBase64)(submissionKeypair.secretKey)));
+    return "".concat(submissionKeypair.publicKey, ";").concat((0, encoding_1.encodeBase64)(nonce), ":").concat(encrypted);
 };
 exports.encryptMessage = encryptMessage;
 /**
@@ -41,8 +41,8 @@ exports.encryptMessage = encryptMessage;
 var decryptContent = function (formPrivateKey, encryptedContent) {
     try {
         var _a = encryptedContent.split(';'), submissionPublicKey = _a[0], nonceEncrypted = _a[1];
-        var _b = nonceEncrypted.split(':').map(tweetnacl_util_1.decodeBase64), nonce = _b[0], encrypted = _b[1];
-        return tweetnacl_1.default.box.open(encrypted, nonce, (0, tweetnacl_util_1.decodeBase64)(submissionPublicKey), (0, tweetnacl_util_1.decodeBase64)(formPrivateKey));
+        var _b = nonceEncrypted.split(':').map(encoding_1.decodeBase64), nonce = _b[0], encrypted = _b[1];
+        return tweetnacl_1.default.box.open(encrypted, nonce, (0, encoding_1.decodeBase64)(submissionPublicKey), (0, encoding_1.decodeBase64)(formPrivateKey));
     }
     catch (err) {
         return null;
@@ -57,10 +57,10 @@ exports.decryptContent = decryptContent;
  * @throws {Error} if the message cannot be verified
  */
 var verifySignedMessage = function (msg, publicKey) {
-    var openedMessage = tweetnacl_1.default.sign.open(msg, (0, tweetnacl_util_1.decodeBase64)(publicKey));
+    var openedMessage = tweetnacl_1.default.sign.open(msg, (0, encoding_1.decodeBase64)(publicKey));
     if (!openedMessage)
         throw new Error('Failed to open signed message with given public key');
-    return JSON.parse((0, tweetnacl_util_1.encodeUTF8)(openedMessage));
+    return JSON.parse((0, encoding_1.encodeUTF8)(openedMessage));
 };
 exports.verifySignedMessage = verifySignedMessage;
 /**
@@ -81,7 +81,7 @@ exports.areAttachmentFieldIdsValid = areAttachmentFieldIdsValid;
 var convertEncryptedAttachmentToFileContent = function (encryptedAttachment) { return ({
     submissionPublicKey: encryptedAttachment.encryptedFile.submissionPublicKey,
     nonce: encryptedAttachment.encryptedFile.nonce,
-    binary: (0, tweetnacl_util_1.decodeBase64)(encryptedAttachment.encryptedFile.binary),
+    binary: (0, encoding_1.decodeBase64)(encryptedAttachment.encryptedFile.binary),
 }); };
 exports.convertEncryptedAttachmentToFileContent = convertEncryptedAttachmentToFileContent;
 /**

package/dist/cjs/util/encoding.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Loop-based binary <-> string conversions, replacing tweetnacl-util.
+ *
+ * tweetnacl-util's decodeBase64 validates its input with a regex over the
+ * entire payload; on engines with stack-bound regex backtracking (Hermes,
+ * older JSC/V8) this throws "Maximum call stack size exceeded" for
+ * multi-megabyte attachments. @stablelib decodes in a plain loop.
+ *
+ * Exported names keep tweetnacl-util's convention (decodeUTF8: string ->
+ * bytes, encodeUTF8: bytes -> string), which is the reverse of
+ * @stablelib/utf8's encode/decode naming.
+ */
+export declare const encodeBase64: (arr: Uint8Array) => string;
+export declare const decodeBase64: (s: string) => Uint8Array;
+export declare const decodeUTF8: (s: string) => Uint8Array;
+export declare const encodeUTF8: (arr: Uint8Array) => string;

package/dist/cjs/util/encoding.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encodeUTF8 = exports.decodeUTF8 = exports.decodeBase64 = exports.encodeBase64 = void 0;
+var base64_1 = require("@stablelib/base64");
+var utf8_1 = require("@stablelib/utf8");
+/**
+ * Loop-based binary <-> string conversions, replacing tweetnacl-util.
+ *
+ * tweetnacl-util's decodeBase64 validates its input with a regex over the
+ * entire payload; on engines with stack-bound regex backtracking (Hermes,
+ * older JSC/V8) this throws "Maximum call stack size exceeded" for
+ * multi-megabyte attachments. @stablelib decodes in a plain loop.
+ *
+ * Exported names keep tweetnacl-util's convention (decodeUTF8: string ->
+ * bytes, encodeUTF8: bytes -> string), which is the reverse of
+ * @stablelib/utf8's encode/decode naming.
+ */
+var encodeBase64 = function (arr) { return (0, base64_1.encode)(arr); };
+exports.encodeBase64 = encodeBase64;
+var decodeBase64 = function (s) { return (0, base64_1.decode)(s); };
+exports.decodeBase64 = decodeBase64;
+var decodeUTF8 = function (s) { return (0, utf8_1.encode)(s); };
+exports.decodeUTF8 = decodeUTF8;
+var encodeUTF8 = function (arr) { return (0, utf8_1.decode)(arr); };
+exports.encodeUTF8 = encodeUTF8;

package/dist/cjs/util/signature.js

@@ -36,7 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.sign = sign;
 exports.verify = verify;
 var tweetnacl = __importStar(require("tweetnacl"));
-var tweetnacl_util_1 = require("tweetnacl-util");
+var encoding_1 = require("./encoding");
 /**
  * Returns a signature from a basestring and secret key
  * @param basestring The data you want to sign.
@@ -44,7 +44,7 @@ var tweetnacl_util_1 = require("tweetnacl-util");
  * @return base64 encoded signature
  */
 function sign(basestring, secretKey) {
-    return (0, tweetnacl_util_1.encodeBase64)(tweetnacl.sign.detached((0, tweetnacl_util_1.decodeUTF8)(basestring), (0, tweetnacl_util_1.decodeBase64)(secretKey)));
+    return (0, encoding_1.encodeBase64)(tweetnacl.sign.detached((0, encoding_1.decodeUTF8)(basestring), (0, encoding_1.decodeBase64)(secretKey)));
 }
 /**
  * Verifies a signature against a message and public key
@@ -54,5 +54,5 @@ function sign(basestring, secretKey) {
  * @return True if verification checks out, false otherwise
  */
 function verify(message, signature, publicKey) {
-    return tweetnacl.sign.detached.verify((0, tweetnacl_util_1.decodeUTF8)(message), (0, tweetnacl_util_1.decodeBase64)(signature), (0, tweetnacl_util_1.decodeBase64)(publicKey));
+    return tweetnacl.sign.detached.verify((0, encoding_1.decodeUTF8)(message), (0, encoding_1.decodeBase64)(signature), (0, encoding_1.decodeBase64)(publicKey));
 }

package/dist/cjs/verification/index.js

@@ -8,8 +8,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
  * @author Jean Tan
  */
 var tweetnacl_1 = __importDefault(require("tweetnacl"));
-var tweetnacl_util_1 = require("tweetnacl-util");
 var errors_1 = require("../errors");
+var encoding_1 = require("../util/encoding");
 var parser_1 = require("../util/parser");
 var utils_1 = require("./utils");
 var Verification = /** @class */ (function () {
@@ -45,7 +45,7 @@ var Verification = /** @class */ (function () {
                         answer: answer,
                         time: time,
                     });
-                    return tweetnacl_1.default.sign.detached.verify((0, tweetnacl_util_1.decodeUTF8)(data), (0, tweetnacl_util_1.decodeBase64)(signature), (0, tweetnacl_util_1.decodeBase64)(_this.verificationPublicKey));
+                    return tweetnacl_1.default.sign.detached.verify((0, encoding_1.decodeUTF8)(data), (0, encoding_1.decodeBase64)(signature), (0, encoding_1.decodeBase64)(_this.verificationPublicKey));
                 }
                 else {
                     console.info("Signature was expired for signatureString=\"".concat(signatureString, "\" signatureDate=\"").concat(time, "\" submissionCreatedAt=\"").concat(submissionCreatedAt, "\""));
@@ -70,8 +70,8 @@ var Verification = /** @class */ (function () {
                 answer: answer,
                 time: time,
             });
-            var signature = tweetnacl_1.default.sign.detached((0, tweetnacl_util_1.decodeUTF8)(data), (0, tweetnacl_util_1.decodeBase64)(_this.verificationSecretKey));
-            return "f=".concat(formId, ",v=").concat(transactionId, ",t=").concat(time, ",s=").concat((0, tweetnacl_util_1.encodeBase64)(signature));
+            var signature = tweetnacl_1.default.sign.detached((0, encoding_1.decodeUTF8)(data), (0, encoding_1.decodeBase64)(_this.verificationSecretKey));
+            return "f=".concat(formId, ",v=").concat(transactionId, ",t=").concat(time, ",s=").concat((0, encoding_1.encodeBase64)(signature));
         };
         this.verificationPublicKey = params === null || params === void 0 ? void 0 : params.publicKey;
         this.verificationSecretKey = params === null || params === void 0 ? void 0 : params.secretKey;

package/dist/esm/crypto-base.js

@@ -35,8 +35,8 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
     }
 };
 import nacl from 'tweetnacl';
-import { decodeBase64, encodeBase64 } from 'tweetnacl-util';
 import { generateKeypair } from './util/crypto';
+import { decodeBase64, encodeBase64 } from './util/encoding';
 var CryptoBase = /** @class */ (function () {
     function CryptoBase() {
         var _this = this;

package/dist/esm/crypto-v3.d.ts

@@ -1,6 +1,6 @@
 import CryptoBase from './crypto-base';
 import { DecryptedContentV3, DecryptParams, DecryptParamsV3, EncryptedContentV3 } from './types';
-import { DecryptedContentV4, FieldResponsesV4, FormFieldMeta } from './types-v4';
+import { DecryptedContentV4, DecryptParamsV4, FieldResponsesV4, FormFieldMeta } from './types-v4';
 /**
  * Checks whether decrypted responses are already in V4 format.
  * V4 entries have a `provenance` object, which V3 entries lack.
@@ -49,7 +49,7 @@ export default class CryptoV3 extends CryptoBase {
      * @returns The decrypted content in V4 format if successful. Else, null will be returned.
      * @throws {MissingPublicKeyError} if a public key is not provided when instantiating this class and is needed for verifying signed content.
      */
-    decryptToV4: (formSecretKey: string, decryptParams: DecryptParamsV3, formFields: Record<string, FormFieldMeta>) => DecryptedContentV4 | null;
+    decryptToV4: (formSecretKey: string, decryptParams: DecryptParamsV4, formFields: Record<string, FormFieldMeta>) => DecryptedContentV4 | null;
     /**
      * Returns true if a pair of public & secret keys are associated with each other
      * @param publicKey The public key to verify against.

package/dist/esm/crypto-v3.js

@@ -35,8 +35,8 @@ var __rest = (this && this.__rest) || function (s, e) {
         }
     return t;
 };
-import { decodeBase64, decodeUTF8, encodeBase64, encodeUTF8, } from 'tweetnacl-util';
 import { decryptContent, encryptMessage, generateKeypair, verifySignedMessage, } from './util/crypto';
+import { decodeBase64, decodeUTF8, encodeBase64, encodeUTF8, } from './util/encoding';
 import { determineIsFormFieldsV3 } from './util/validate';
 import { adaptV3ToV4, deriveQuestionFromMeta } from './adapt-v3-to-v4';
 import CryptoBase from './crypto-base';
@@ -203,8 +203,16 @@ var CryptoV3 = /** @class */ (function (_super) {
             var responses = isFieldResponsesV4(decrypted.responses)
                 ? backfillMissingQuestions(decrypted.responses, formFields)
                 : adaptV3ToV4(decrypted.responses, { formFields: formFields });
+            var stepToken = undefined;
+            if (decryptParams.encryptedStepToken) {
+                var decryptedStepToken = decryptContent(formSecretKey, decryptParams.encryptedStepToken);
+                if (decryptedStepToken) {
+                    stepToken = encodeUTF8(decryptedStepToken);
+                }
+            }
             return {
                 submissionSecretKey: decrypted.submissionSecretKey,
+                stepToken: stepToken,
                 responses: responses,
                 verified: decrypted.verified,
             };

package/dist/esm/crypto.js

@@ -51,8 +51,8 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
 };
 import axios from 'axios';
 import nacl from 'tweetnacl';
-import { decodeBase64, decodeUTF8, encodeUTF8 } from 'tweetnacl-util';
 import { areAttachmentFieldIdsValid, convertEncryptedAttachmentToFileContent, decryptContent, encryptMessage, verifySignedMessage, } from './util/crypto';
+import { decodeBase64, decodeUTF8, encodeUTF8 } from './util/encoding';
 import { determineIsFormFields } from './util/validate';
 import CryptoBase from './crypto-base';
 import { AttachmentDecryptionError, MissingPublicKeyError } from './errors';

package/dist/esm/index.d.ts

@@ -7,6 +7,7 @@ export { adaptV3ToV4 } from './adapt-v3-to-v4';
 export { adaptV4ToV3 } from './adapt-v4-to-v3';
 export { isFieldResponsesV4 } from './crypto-v3';
 export { ADDRESS_SUBFIELD_KEYS, GENERIC_STRING_FIELD_TYPES, } from './constants-v4';
+export { generateUUID } from './util/crypto';
 export type { DecryptedContent, DecryptedContentV3, DecryptParams, DecryptParamsV3, EncryptedAttachmentContent, EncryptedAttachmentRecords, EncryptedContent, EncryptedContentV3, EncryptedFileContent, FieldType, FormField, FormFieldsV3, Keypair, PackageMode, VerificationOptions, } from './types';
 export type { AdaptV3ToV4Options, AnswerV4, AddressAnswerV4, AttachmentAnswerV4, CheckboxAnswerV4, ChildrenAnswerV4, DecryptedContentV4, FieldResponsesV4, FieldResponseV4, FormFieldMeta, FormFieldV4, FormFieldsV4, RadioAnswerV4, ResponseProvenance, SignatureAnswerV4, StringAnswerV4, TableAnswerV4, VerifiableAnswerV4, } from './types-v4';
 /**

package/dist/esm/index.js

@@ -7,6 +7,7 @@ export { adaptV3ToV4 } from './adapt-v3-to-v4';
 export { adaptV4ToV3 } from './adapt-v4-to-v3';
 export { isFieldResponsesV4 } from './crypto-v3';
 export { ADDRESS_SUBFIELD_KEYS, GENERIC_STRING_FIELD_TYPES, } from './constants-v4';
+export { generateUUID } from './util/crypto';
 /**
  * Entrypoint into the FormSG SDK
  *

package/dist/esm/types-v4.d.ts

@@ -1,4 +1,4 @@
-import { FieldType } from './types';
+import { DecryptParamsV3, EncryptedContent, FieldType } from './types';
 export type ResponseProvenance = {
     submittedAt?: string;
     stepNumber?: number;
@@ -140,8 +140,12 @@ export type AdaptV3ToV4Options = {
     /** Form field definitions keyed by field ID, used to populate question text and myInfo. */
     formFields?: Record<string, FormFieldMeta>;
 };
+export interface DecryptParamsV4 extends DecryptParamsV3 {
+    encryptedStepToken?: EncryptedContent;
+}
 export type DecryptedContentV4 = {
     submissionSecretKey: string;
+    stepToken?: string;
     responses: FieldResponsesV4;
     verified?: Record<string, any>;
 };

package/dist/esm/util/crypto.js

@@ -1,5 +1,5 @@
 import nacl from 'tweetnacl';
-import { decodeBase64, encodeBase64, encodeUTF8 } from 'tweetnacl-util';
+import { decodeBase64, encodeBase64, encodeUTF8 } from './encoding';
 /**
  * Helper method to generate a new keypair for encryption.
  * @returns The generated keypair.

package/dist/esm/util/encoding.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Loop-based binary <-> string conversions, replacing tweetnacl-util.
+ *
+ * tweetnacl-util's decodeBase64 validates its input with a regex over the
+ * entire payload; on engines with stack-bound regex backtracking (Hermes,
+ * older JSC/V8) this throws "Maximum call stack size exceeded" for
+ * multi-megabyte attachments. @stablelib decodes in a plain loop.
+ *
+ * Exported names keep tweetnacl-util's convention (decodeUTF8: string ->
+ * bytes, encodeUTF8: bytes -> string), which is the reverse of
+ * @stablelib/utf8's encode/decode naming.
+ */
+export declare const encodeBase64: (arr: Uint8Array) => string;
+export declare const decodeBase64: (s: string) => Uint8Array;
+export declare const decodeUTF8: (s: string) => Uint8Array;
+export declare const encodeUTF8: (arr: Uint8Array) => string;

package/dist/esm/util/encoding.js

@@ -0,0 +1,18 @@
+import { decode as base64ToBytes, encode as bytesToBase64, } from '@stablelib/base64';
+import { decode as bytesToUtf8String, encode as utf8StringToBytes, } from '@stablelib/utf8';
+/**
+ * Loop-based binary <-> string conversions, replacing tweetnacl-util.
+ *
+ * tweetnacl-util's decodeBase64 validates its input with a regex over the
+ * entire payload; on engines with stack-bound regex backtracking (Hermes,
+ * older JSC/V8) this throws "Maximum call stack size exceeded" for
+ * multi-megabyte attachments. @stablelib decodes in a plain loop.
+ *
+ * Exported names keep tweetnacl-util's convention (decodeUTF8: string ->
+ * bytes, encodeUTF8: bytes -> string), which is the reverse of
+ * @stablelib/utf8's encode/decode naming.
+ */
+export var encodeBase64 = function (arr) { return bytesToBase64(arr); };
+export var decodeBase64 = function (s) { return base64ToBytes(s); };
+export var decodeUTF8 = function (s) { return utf8StringToBytes(s); };
+export var encodeUTF8 = function (arr) { return bytesToUtf8String(arr); };

package/dist/esm/util/signature.js

@@ -1,5 +1,5 @@
 import * as tweetnacl from 'tweetnacl';
-import { decodeBase64, decodeUTF8, encodeBase64 } from 'tweetnacl-util';
+import { decodeBase64, decodeUTF8, encodeBase64 } from './encoding';
 /**
  * Returns a signature from a basestring and secret key
  * @param basestring The data you want to sign.

package/dist/esm/verification/index.js

@@ -3,8 +3,8 @@
  * @author Jean Tan
  */
 import nacl from 'tweetnacl';
-import { decodeBase64, decodeUTF8, encodeBase64 } from 'tweetnacl-util';
 import { MissingPublicKeyError, MissingSecretKeyError } from '../errors';
+import { decodeBase64, decodeUTF8, encodeBase64 } from '../util/encoding';
 import { parseVerificationSignature } from '../util/parser';
 import { formatToBaseString, isSignatureTimeValid } from './utils';
 var Verification = /** @class */ (function () {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengovsg/formsg-sdk",
-  "version": "7.6.0",
+  "version": "8.0.1",
   "main": "./cjs-entry.cjs",
   "module": "./dist/esm/index.js",
   "types": "./dist/cjs/index.d.ts",
@@ -65,9 +65,10 @@
     "directory": "packages/sdk"
   },
   "dependencies": {
+    "@stablelib/base64": "^1.0.1",
+    "@stablelib/utf8": "^1.0.2",
     "axios": "^1.15.2",
-    "tweetnacl": "^1.0.3",
-    "tweetnacl-util": "^0.15.1"
+    "tweetnacl": "^1.0.3"
   },
   "devDependencies": {
     "@types/jest": "^29.5.8",