@opentdf/sdk 0.1.0-beta.1701

package/dist/types/src/auth/oidc.d.ts

@@ -0,0 +1,104 @@
+import { HttpRequest } from './auth.js';
+/**
+ * Common fields used by all OIDC credentialing flows.
+ */
+export type CommonCredentials = {
+    /** The OIDC client ID used for token issuance and exchange flows */
+    clientId: string;
+    /** The endpoint of the OIDC IdP to authenticate against, ex. 'https://virtru.com/auth' */
+    oidcOrigin: string;
+    /** Whether or not DPoP is enabled. */
+    dpopEnabled?: boolean;
+    /** the client's public key, base64 encoded. Will be bound to the OIDC token. Deprecated. If not set in the constructor, */
+    signingKey?: CryptoKeyPair;
+};
+/**
+ * Information needed for Client Secret OIDC credentialing flow
+ */
+export type ClientSecretCredentials = CommonCredentials & {
+    exchange: 'client';
+    /** The OIDC client secret, used for token issuance and exchange flows */
+    clientSecret: string;
+};
+/**
+ * Information needed for getting new access tokens with a refresh token
+ */
+export type RefreshTokenCredentials = CommonCredentials & {
+    exchange: 'refresh';
+    /** The OIDC refresh token content */
+    refreshToken: string;
+};
+/**
+ * Information needed to exchange a standard or external JWT for a TDF claims
+ * annotated JWT
+ */
+export type ExternalJwtCredentials = CommonCredentials & {
+    exchange: 'external';
+    /** The external JWT used for exchange */
+    externalJwt: string;
+};
+export type OIDCCredentials = ClientSecretCredentials | ExternalJwtCredentials | RefreshTokenCredentials;
+export type AccessTokenResponse = {
+    access_token: string;
+    refresh_token?: string;
+};
+/**
+ * Class that provides OIDC functionality to auth providers, assuming 'enhanced'
+ * tokens and sessions with tdf_claims and either one or both of signing keys
+ * or DPoP.
+ *
+ * Note that this class itself is not a provider - providers implement
+ * `AuthProvider` and make use of this class.
+ *
+ * Both browser and non-browser flows use OIDC, but the supported OIDC auth
+ * mechanisms differ between  public (e.g. browser) clients, and confidential
+ * (e.g. Node) clients.
+ *
+ * The non-browser flow just expects a `clientId` and `clientSecret` to be
+ * provided in the `clientConfig`, and will use that
+ * to grant tokens via the OIDC `clientCredentials` flow.
+ *
+ * For either kind of client, the client's public key must be set in all OIDC
+ * token requests in order to recieve a token with valid TDF claims. The public
+ * key may be passed to this provider's constructor, or supplied
+ * post-construction by calling @see updateClientPublicKey, which forces an
+ * explicit token refresh
+ */
+export declare class AccessToken {
+    config: OIDCCredentials;
+    request?: (input: RequestInfo, init?: RequestInit) => Promise<Response>;
+    data?: AccessTokenResponse;
+    baseUrl: string;
+    signingKey?: CryptoKeyPair;
+    extraHeaders: Record<string, string>;
+    currentAccessToken?: string;
+    constructor(cfg: OIDCCredentials, request?: typeof fetch);
+    /**
+     * https://connect2id.com/products/server/docs/api/userinfo
+     * @param accessToken the current access_token or code
+     * @returns
+     */
+    info(accessToken: string): Promise<unknown>;
+    doPost(url: string, o: Record<string, string>): Promise<Response>;
+    accessTokenLookup(cfg: OIDCCredentials): Promise<any>;
+    /**
+     * Gets an access token; operates lazily/cached, with an optional check for freshness.
+     * @param validate if we should run a inline check against the OIDC 'userinfo' endpoint to make sure any cached access token is still valid
+     * @returns
+     */
+    get(validate?: boolean): Promise<string>;
+    /**
+     * A TDF client MUST call this method whenever the client wants to use a new
+     * ephemeral key set. This updates the keys used to:
+     * or wishes to set the keypair after creating the object.
+     *
+     * Calling this function will trigger a forcible token refresh using the cached refresh token, and contact the auth server.
+     */
+    refreshTokenClaimsWithClientPubkeyIfNeeded(signingKey: CryptoKeyPair): Promise<void>;
+    /**
+     * Converts included refresh token or external JWT for a new one.
+     */
+    exchangeForRefreshToken(): Promise<string>;
+    withCreds(httpReq: HttpRequest): Promise<HttpRequest>;
+}
+//# sourceMappingURL=oidc.d.ts.map

package/dist/types/src/auth/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../../../src/auth/oidc.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAe,MAAM,WAAW,CAAC;AAKrD;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,2HAA2H;IAC3H,UAAU,CAAC,EAAE,aAAa,CAAC;CAC5B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG;IACxD,QAAQ,EAAE,QAAQ,CAAC;IACnB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG;IACxD,QAAQ,EAAE,SAAS,CAAC;IACpB,qCAAqC;IACrC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG;IACvD,QAAQ,EAAE,UAAU,CAAC;IACrB,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GACvB,uBAAuB,GACvB,sBAAsB,GACtB,uBAAuB,CAAC;AAI5B,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,WAAW;IACtB,MAAM,EAAE,eAAe,CAAC;IAExB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAExE,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAE3B,OAAO,EAAE,MAAM,CAAC;IAEhB,UAAU,CAAC,EAAE,aAAa,CAAC;IAE3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM;IAE1C,kBAAkB,CAAC,EAAE,MAAM,CAAC;gBAEhB,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK;IA0BxD;;;;OAIG;IACG,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsB3C,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAqB7C,iBAAiB,CAAC,GAAG,EAAE,eAAe;IAsC5C;;;;OAIG;IACG,GAAG,CAAC,QAAQ,UAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IA0B3C;;;;;;OAMG;IACG,0CAA0C,CAAC,UAAU,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAW1F;;OAEG;IACG,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC;IAwB1C,SAAS,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;CAoB5D"}

package/dist/types/src/auth/providers.d.ts

@@ -0,0 +1,67 @@
+import { ClientSecretCredentials, ExternalJwtCredentials, OIDCCredentials, RefreshTokenCredentials } from './oidc.js';
+import { OIDCClientCredentialsProvider } from './oidc-clientcredentials-provider.js';
+import { OIDCExternalJwtProvider } from './oidc-externaljwt-provider.js';
+import { type AuthProvider } from './auth.js';
+import { OIDCRefreshTokenProvider } from './oidc-refreshtoken-provider.js';
+/**
+ * Creates an OIDC Client Credentials Provider for non-browser contexts.
+ *
+ * Both browser and non-browser flows use OIDC, but the supported OIDC auth mechanisms differ between
+ * public (e.g. browser) clients, and confidential (e.g. Node) clients.
+ *
+ * This provider supports Client Credentials auth, where the client has previously been issued a ClientID and ClientSecret.
+ * Browser contexts should *never* use Client Credentials auth, as ClientSecrets are not secure for public client flows,
+ * and should use one of the other Authorization Code-based OIDC auth mechanisms instead.
+ *
+ * This just expects a clientId and clientSecret to be provided in the clientConfig, and will use that
+ * to grant tokens via the OIDC clientCredentials flow.
+ *
+ * The client's public key must be set in all OIDC token requests in order to recieve a token with valid
+ * Virtru claims. The public key may be passed to this provider's constructor, or supplied post-construction by calling
+ * {@link updateClientPublicKey} which will force an explicit token refresh
+ *
+ */
+export declare const clientSecretAuthProvider: (clientConfig: ClientSecretCredentials) => Promise<OIDCClientCredentialsProvider>;
+/**
+ * Create an OIDC External JWT Provider for browser contexts.
+ *
+ * Both browser and non-browser flows use OIDC, but the supported OIDC auth mechanisms differ between
+ * public (e.g. browser) clients, and confidential (e.g. Node) clients.
+ *
+ * This provider supports External JWT token exchange auth. This flow assumes that the client has previously authenticated
+ * with an external 3rd-party IdP that oidcOrigin has been configured to trust.
+ *
+ * The client can supply this provider with a JWT issued by that trusted 3rd-party IdP, and that JWT will be exchanged
+ * for a tokenset with TDF claims.
+ *
+ * The client's public key must be set in all OIDC token requests in order to recieve a token with valid
+ * Virtru claims. The public key may be passed to this provider's constructor, or supplied post-construction by calling
+ * {@link updateClientPublicKey}, which will force an explicit token refresh.
+ */
+export declare const externalAuthProvider: (clientConfig: ExternalJwtCredentials) => Promise<OIDCExternalJwtProvider>;
+/**
+ * Creates an OIDC Refresh Token Provider for browser and non-browser contexts.
+ *
+ * Both browser and non-browser flows use OIDC, but the supported OIDC auth mechanisms differ between
+ * public (e.g. browser) clients, and confidential (e.g. Node) clients.
+ *
+ * This provider supports Refresh Token auth. This flow assumes the client has already authenticated with the OIDC
+ * IdP using the OIDC flow fo their choice, and can provide a Refresh Token which will be exchanged (along with the client pubkey)
+ * for a new tokenset containing valid TDF claims.
+ *
+ * The client's public key must be set in all OIDC token requests in order to recieve a token with valid
+ * Virtru claims. The public key may be passed to this provider's constructor, or supplied post-construction by calling
+ * {@link updateClientPublicKey} which will force an explicit token refresh
+ */
+export declare const refreshAuthProvider: (clientConfig: RefreshTokenCredentials) => Promise<OIDCRefreshTokenProvider>;
+/**
+ * Generate an auth provder.
+ * @param clientConfig OIDC client credentials
+ * @returns a promise for a new auth provider with the requested excahnge type
+ */
+export declare const clientAuthProvider: (clientConfig: OIDCCredentials) => Promise<AuthProvider>;
+export * from './auth.js';
+export { OIDCClientCredentialsProvider } from './oidc-clientcredentials-provider.js';
+export { OIDCExternalJwtProvider } from './oidc-externaljwt-provider.js';
+export { OIDCRefreshTokenProvider } from './oidc-refreshtoken-provider.js';
+//# sourceMappingURL=providers.d.ts.map

package/dist/types/src/auth/providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../../../src/auth/providers.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,eAAe,EACf,uBAAuB,EACxB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAI3E;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB,iBACrB,uBAAuB,KACpC,QAAQ,6BAA6B,CAMvC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,iBACjB,sBAAsB,KACnC,QAAQ,uBAAuB,CAMjC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mBAAmB,iBAChB,uBAAuB,KACpC,QAAQ,wBAAwB,CAMlC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,iBAAwB,eAAe,KAAG,QAAQ,YAAY,CAqC5F,CAAC;AAEF,cAAc,WAAW,CAAC;AAC1B,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/types/src/encodings/base64.d.ts

@@ -0,0 +1,18 @@
+declare class InvalidCharacterError extends Error {
+    constructor(message?: string);
+}
+declare function encodeFallback(input: string, urlSafe?: boolean): string;
+/**
+ * Encode array buffer to base64 string
+ *
+ * GitHub @niklasvh
+ * Copyright (c) 2012 Niklas von Hertzen
+ * MIT License
+ */
+declare function encodeArrayBuffer(arrayBuffer: ArrayBuffer, urlSafe?: boolean): string;
+declare function decodeFallback(input: string): string;
+declare function decodeArrayBuffer(base64: string): ArrayBuffer;
+declare const decode: typeof decodeFallback;
+declare const encode: typeof encodeFallback;
+export { decode, decodeArrayBuffer, encode, encodeArrayBuffer, InvalidCharacterError };
+//# sourceMappingURL=base64.d.ts.map

package/dist/types/src/encodings/base64.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64.d.ts","sourceRoot":"","sources":["../../../../src/encodings/base64.ts"],"names":[],"mappings":"AA6BA,cAAM,qBAAsB,SAAQ,KAAK;gBAC3B,OAAO,CAAC,EAAE,MAAM;CAI7B;AAID,iBAAS,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CA6BhE;AAED;;;;;;GAMG;AACH,iBAAS,iBAAiB,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CA4B9E;AAED,iBAAS,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAwB7C;AAED,iBAAS,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAsBtD;AAED,QAAA,MAAM,MAAM,uBAAiB,CAAC;AAC9B,QAAA,MAAM,MAAM,uBAAiB,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,CAAC"}

package/dist/types/src/encodings/hex.d.ts

@@ -0,0 +1,5 @@
+export declare function encode(str: string): string;
+export declare function decode(hex: string): string;
+export declare function decodeArrayBuffer(hex: string): ArrayBuffer | never;
+export declare function encodeArrayBuffer(arrayBuffer: ArrayBuffer): string | never;
+//# sourceMappingURL=hex.d.ts.map

package/dist/types/src/encodings/hex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hex.d.ts","sourceRoot":"","sources":["../../../../src/encodings/hex.ts"],"names":[],"mappings":"AAEA,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAa1C;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAa1C;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,KAAK,CAclE;AAED,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,GAAG,KAAK,CAoB1E"}

package/dist/types/src/encodings/index.d.ts

@@ -0,0 +1,3 @@
+export * as base64 from './base64.js';
+export * as hex from './hex.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/src/encodings/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/encodings/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC"}

package/dist/types/src/errors.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Root class for all errors thrown by this library.
+ * This should not be thrown directly, but rather one of its subclasses.
+ */
+export declare class TdfError extends Error {
+    name: string;
+    constructor(message?: string, cause?: Error);
+}
+/**
+ * Errors that indicate the client or method does not have valid options.
+ */
+export declare class ConfigurationError extends TdfError {
+    name: string;
+}
+/**
+ * The assigned data attribute is not in the correct form.
+ */
+export declare class AttributeValidationError extends ConfigurationError {
+    name: string;
+    attribute: unknown;
+    constructor(message: string, attribute: unknown, cause?: Error);
+}
+/**
+ * Errors that indicate the TDF object is corrupt, invalid, or fails validation or decrypt.
+ */
+export declare class InvalidFileError extends TdfError {
+}
+/**
+ * Indicates a decrypt failure, either due to an incorrect key, corrupt ciphertext, or inappropriate key parameters.
+ */
+export declare class DecryptError extends InvalidFileError {
+    name: string;
+}
+export declare class IntegrityError extends InvalidFileError {
+    name: string;
+}
+/**
+ * Thrown when a KAS URL found in one or more required key access objects are not in the list of known and allowed KASes in the client.
+ * This may indicate a malicious file - e.g. an attempt to DDoS a server by listing it as the KAS for many files, or to siphon credentials using a lookalike URL.
+ */
+export declare class UnsafeUrlError extends InvalidFileError {
+    name: string;
+    readonly url: string[];
+    constructor(message: string, ...url: string[]);
+}
+/**
+ * A network error (no response) from rewrap or other endpoint, Possibly fixed by retrying or adjusting your network settings; could indicate network failure.
+ */
+export declare class NetworkError extends TdfError {
+    name: string;
+}
+/**
+ * The service reports an unexpected error on its behalf, or a subcomponent (5xx).
+ */
+export declare class ServiceError extends TdfError {
+    name: string;
+}
+/** Authentication failure (401) */
+export declare class UnauthenticatedError extends TdfError {
+    name: string;
+}
+/** Authorization failure (403) */
+export declare class PermissionDeniedError extends TdfError {
+    name: string;
+}
+/**
+ * Version of file is unsupported, or file uses a feature that is not supported by this version of the library.
+ */
+export declare class UnsupportedFeatureError extends TdfError {
+    name: string;
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/types/src/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/errors.ts"],"names":[],"mappings":"AAiBA;;;GAGG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACxB,IAAI,SAAc;gBAEf,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAO5C;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,QAAQ;IACrC,IAAI,SAAwB;CACtC;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,kBAAkB;IACrD,IAAI,SAA8B;IAC3C,SAAS,EAAE,OAAO,CAAC;gBACP,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,KAAK;CAI/D;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ;CAAG;AAEjD;;GAEG;AACH,qBAAa,YAAa,SAAQ,gBAAgB;IACvC,IAAI,SAAkB;CAChC;AAED,qBAAa,cAAe,SAAQ,gBAAgB;IACzC,IAAI,SAAoB;CAClC;AAED;;;GAGG;AACH,qBAAa,cAAe,SAAQ,gBAAgB;IACzC,IAAI,SAAoB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE;CAK9C;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,QAAQ;IAC/B,IAAI,SAAkB;CAChC;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,QAAQ;IAC/B,IAAI,SAAkB;CAChC;AAED,mCAAmC;AACnC,qBAAa,oBAAqB,SAAQ,QAAQ;IACvC,IAAI,SAA0B;CACxC;AAED,kCAAkC;AAClC,qBAAa,qBAAsB,SAAQ,QAAQ;IACxC,IAAI,SAA2B;CACzC;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,QAAQ;IAC1C,IAAI,SAA6B;CAC3C"}

package/dist/types/src/index.d.ts

@@ -0,0 +1,138 @@
+import { Client, NanoTDF } from './nanotdf/index.js';
+import { TypedArray } from './tdf/index.js';
+import { ClientConfig } from './nanotdf/Client.js';
+export { attributeFQNsAsValues } from './policy/api.js';
+export type EncryptOptions = {
+    ecdsaBinding: boolean;
+};
+/**
+ * NanoTDF SDK Client
+ *
+ * @example
+ * ```
+ * import { clientSecretAuthProvider, NanoTDFClient } from '@opentdf/sdk';
+ *
+ * const OIDC_ENDPOINT = 'http://localhost:65432/auth/realms/opentdf-demo';
+ * const KAS_URL = 'http://localhost:65432/api/kas/';
+ *
+ * const ciphertext = '...';
+ * const client = new NanoTDFClient({
+ *   authProvider: await clientSecretAuthProvider({
+ *     clientId: 'tdf-client',
+ *     clientSecret: '123-456',
+ *     oidcOrigin: OIDC_ENDPOINT,
+ *   }),
+ *   kasEndpoint: KAS_URL
+ *  }
+ * );
+ * client.decrypt(ciphertext)
+ *   .then(plaintext => {
+ *     console.log('Plaintext', plaintext);
+ *   })
+ *   .catch(err => {
+ *     console.error('Some error occurred', err);
+ *   })
+ */
+export declare class NanoTDFClient extends Client {
+    /**
+     * Decrypt ciphertext
+     *
+     * Pass a base64 string, TypedArray, or ArrayBuffer ciphertext and get a promise which resolves plaintext
+     *
+     * @param ciphertext Ciphertext to decrypt
+     */
+    decrypt(ciphertext: string | TypedArray | ArrayBuffer): Promise<ArrayBuffer>;
+    /**
+     * Decrypt ciphertext of the legacy TDF, with the older, smaller i.v. calculation.
+     *
+     * Pass a base64 string, TypedArray, or ArrayBuffer ciphertext and get a promise which resolves plaintext
+     *
+     * @param ciphertext Ciphertext to decrypt
+     */
+    decryptLegacyTDF(ciphertext: string | TypedArray | ArrayBuffer): Promise<ArrayBuffer>;
+    /**
+     * Encrypts the given data using the NanoTDF encryption scheme.
+     *
+     * @param {string | TypedArray | ArrayBuffer} data - The data to be encrypted.
+     * @param {EncryptOptions} [options=defaultOptions] - The encryption options (currently unused).
+     * @returns {Promise<ArrayBuffer>} A promise that resolves to the encrypted data as an ArrayBuffer.
+     * @throws {Error} If the initialization vector is not a number.
+     */
+    encrypt(data: string | TypedArray | ArrayBuffer, options?: EncryptOptions): Promise<ArrayBuffer>;
+}
+export type DatasetConfig = ClientConfig & {
+    maxKeyIterations?: number;
+};
+/**
+ * NanoTDF Dataset SDK Client
+ *
+ *
+ * @example
+ * ```
+ * import { clientSecretAuthProvider, NanoTDFDatasetClient } from '@opentdf/sdk';
+ *
+ * const OIDC_ENDPOINT = 'http://localhost:65432/auth/realms/tdf';
+ * const KAS_URL = 'http://localhost:65432/api/kas/';
+ *
+ * const ciphertext = '...';
+ * const client = new NanoTDFDatasetClient({
+ *   authProvider: await clientSecretAuthProvider({
+ *     clientId: 'tdf-client',
+ *     clientSecret: '123-456',
+ *     exchange: 'client',
+ *     oidcOrigin: OIDC_ENDPOINT,
+ *   }),
+ *   kasEndpoint: KAS_URL,
+ * });
+ * const plaintext = client.decrypt(ciphertext);
+ * console.log('Plaintext', plaintext);
+ * ```
+ */
+export declare class NanoTDFDatasetClient extends Client {
+    static readonly NTDF_MAX_KEY_ITERATIONS = 8388606;
+    private maxKeyIteration;
+    private keyIterationCount;
+    private cachedEphemeralKey?;
+    private unwrappedKey?;
+    private symmetricKey?;
+    private cachedHeader?;
+    private ecdsaBinding;
+    /**
+     * Create new NanoTDF Dataset Client
+     *
+     * The Ephemeral Key Pair can either be provided or will be generate when fetching the entity object. Once set it
+     * cannot be changed. If a new ephemeral key is desired it a new client should be initialized.
+     * There is no performance impact for creating a new client IFF the ephemeral key pair is provided.
+     *
+     * @param clientConfig OIDC client credentials
+     * @param kasUrl Key access service URL
+     * @param ephemeralKeyPair (optional) ephemeral key pair to use
+     * @param maxKeyIterations Max iteration to performe without a key rotation
+     */
+    constructor(opts: DatasetConfig);
+    /**
+     * Encrypt data
+     *
+     * Pass a string, TypedArray, or ArrayBuffer data and get a promise which resolves ciphertext
+     *
+     * @param data to decrypt
+     */
+    encrypt(data: string | TypedArray | ArrayBuffer, options?: EncryptOptions): Promise<ArrayBuffer>;
+    /**
+     * Decrypt ciphertext
+     *
+     * Pass a base64 string, TypedArray, or ArrayBuffer ciphertext and get a promise which resolves plaintext
+     *
+     * @param ciphertext Ciphertext to decrypt
+     */
+    decrypt(ciphertext: string | TypedArray | ArrayBuffer): Promise<ArrayBuffer>;
+    rewrapAndDecrypt(nanotdf: NanoTDF): Promise<ArrayBuffer>;
+    generateIV(): Uint8Array;
+}
+/**
+ * Authorization for connecting authZ tokens to
+ * remote requests.
+ */
+export * as AuthProviders from './auth/providers.js';
+export { version, clientType } from './version.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,OAAO,EAOR,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,UAAU,EAA2B,MAAM,gBAAgB,CAAC;AAErE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAGxD,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC;AAOF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,aAAc,SAAQ,MAAM;IACvC;;;;;;OAMG;IACG,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAyBlF;;;;;;OAMG;IACG,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAsB3F;;;;;;;OAOG;IACG,OAAO,CACX,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,EACvC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,WAAW,CAAC;CAyDxB;AAED,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,oBAAqB,SAAQ,MAAM;IAG9C,MAAM,CAAC,QAAQ,CAAC,uBAAuB,WAAW;IAElD,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,kBAAkB,CAAC,CAAa;IACxC,OAAO,CAAC,YAAY,CAAC,CAAY;IACjC,OAAO,CAAC,YAAY,CAAC,CAAY;IACjC,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,OAAO,CAAC,YAAY,CAAU;IAE9B;;;;;;;;;;;OAWG;gBACS,IAAI,EAAE,aAAa;IAe/B;;;;;;OAMG;IACG,OAAO,CACX,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,EACvC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,WAAW,CAAC;IA+EvB;;;;;;OAMG;IACG,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAuB5E,gBAAgB,CAAC,OAAO,EAAE,OAAO;IAwBvC,UAAU,IAAI,UAAU;CAkCzB;AAED;;;GAGG;AACH,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC"}

package/dist/types/src/nanotdf/Client.d.ts

@@ -0,0 +1,95 @@
+import { type TypedArray } from '../tdf/index.js';
+import { KasPublicKeyInfo, OriginAllowList } from '../access.js';
+import { AuthProvider } from '../auth/providers.js';
+export interface ClientConfig {
+    allowedKases?: string[];
+    ignoreAllowList?: boolean;
+    authProvider: AuthProvider;
+    dpopEnabled?: boolean;
+    dpopKeys?: Promise<CryptoKeyPair>;
+    ephemeralKeyPair?: Promise<CryptoKeyPair>;
+    kasEndpoint: string;
+}
+/**
+ * A Client encapsulates sessions interacting with TDF3 and nanoTDF backends, KAS and any
+ * plugin-based sessions like identity and further attribute control. Most importantly, it is responsible
+ * for local key and token management, including the ephemeral public/private keypairs
+ * used for encrypting and decrypting information.
+ *
+ * @link https://developer.mozilla.org/en-US/docs/Web/API/CryptoKeyPair
+ *
+ * @example
+ * import { Client, clientAuthProvider, decrypt, encrypt } from '@opentdf/sdk/nanotdf`
+ *
+ * const OIDC_ENDPOINT = 'http://localhost:65432/auth/';
+ * const KAS_URL = 'http://localhost:65432/kas';
+ *
+ * let client = new Client(
+ *    await clientAuthProvider({
+ *      clientId: 'tdf-client',
+ *      clientSecret: '123-456',
+ *      oidcOrigin: OIDC_ENDPOINT,
+ *    }),
+ *    KAS_URL
+ *  );
+ *
+ * // t=1
+ * let nanoTDFEncrypted = await encrypt('some string', client.unwrappedKey);
+ * let nanoTDFDecrypted = await decrypt(nanoTDFEncrypted, client.unwrappedKey);
+ * nanoTDFDecrypted.toString() // 'some string'
+ *
+ */
+export default class Client {
+    static readonly KEY_ACCESS_REMOTE = "remote";
+    static readonly KAS_PROTOCOL = "kas";
+    static readonly SDK_INITIAL_RELEASE = "0.0.0";
+    static readonly INITIAL_RELEASE_IV_SIZE = 3;
+    static readonly IV_SIZE = 12;
+    allowedKases: OriginAllowList;
+    protected kasUrl: string;
+    kasPubKey?: KasPublicKeyInfo;
+    readonly authProvider: AuthProvider;
+    readonly dpopEnabled: boolean;
+    dissems: string[];
+    dataAttributes: string[];
+    protected ephemeralKeyPair: Promise<CryptoKeyPair>;
+    protected requestSignerKeyPair: Promise<CryptoKeyPair>;
+    protected iv?: number;
+    /**
+     * Create new NanoTDF Client
+     *
+     * The Ephemeral Key Pair can either be provided or will be generate when fetching the entity object. Once set it
+     * cannot be changed. If a new ephemeral key is desired it a new client should be initialized.
+     * There is no performance impact for creating a new client IFF the ephemeral key pair is provided.
+     */
+    constructor(optsOrOldAuthProvider: AuthProvider | ClientConfig, kasUrl?: string, ephemeralKeyPair?: CryptoKeyPair, dpopEnabled?: boolean);
+    /**
+     * Add attribute to the TDF file/data
+     *
+     * @param attribute The attribute that decides the access control of the TDF.
+     */
+    addAttribute(attribute: string): void;
+    /**
+     * Explicitly get a new Entity Object using the supplied EntityAttributeService.
+     *
+     * This method is expected to be called at least once per encrypt/decrypt cycle. If the entityObject is expired then
+     * this will need to be called again.
+     *
+     * @security the ephemeralKeyPair must be set in the constructor if desired to use here. If this is wished to be changed
+     * then a new client should be initialized.
+     * @performance key pair is generated when the entity object is fetched IFF the ephemeralKeyPair is not set. This will
+     * either be set on the first call or passed in the constructor.
+     */
+    fetchOIDCToken(): Promise<void>;
+    /**
+     * Rewrap key
+     *
+     * @important the `fetchEntityObject` method must be called prior to
+     * @param nanoTdfHeader the full header for the nanotdf
+     * @param kasRewrapUrl key access server's rewrap endpoint
+     * @param magicNumberVersion nanotdf container version
+     * @param clientVersion version of the client, as SemVer
+     */
+    rewrapKey(nanoTdfHeader: TypedArray | ArrayBuffer, kasRewrapUrl: string, magicNumberVersion: TypedArray | ArrayBuffer, clientVersion: string): Promise<CryptoKey>;
+}
+//# sourceMappingURL=Client.d.ts.map

package/dist/types/src/nanotdf/Client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Client.d.ts","sourceRoot":"","sources":["../../../../src/nanotdf/Client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAKlD,OAAO,EAAmB,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,YAAY,EAAgC,MAAM,sBAAsB,CAAC;AAIlF,MAAM,WAAW,YAAY;IAC3B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAClC,gBAAgB,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;CACrB;AAgDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,OAAO,OAAO,MAAM;IACzB,MAAM,CAAC,QAAQ,CAAC,iBAAiB,YAAY;IAC7C,MAAM,CAAC,QAAQ,CAAC,YAAY,SAAS;IACrC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,WAAW;IAC9C,MAAM,CAAC,QAAQ,CAAC,uBAAuB,KAAK;IAC5C,MAAM,CAAC,QAAQ,CAAC,OAAO,MAAM;IAE7B,YAAY,EAAE,eAAe,CAAC;IAK9B,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAM;IACvB,cAAc,EAAE,MAAM,EAAE,CAAM;IAC9B,SAAS,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACnD,SAAS,CAAC,oBAAoB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACvD,SAAS,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;;OAMG;gBAED,qBAAqB,EAAE,YAAY,GAAG,YAAY,EAClD,MAAM,CAAC,EAAE,MAAM,EACf,gBAAgB,CAAC,EAAE,aAAa,EAChC,WAAW,UAAQ;IAkDrB;;;;OAIG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIrC;;;;;;;;;;OAUG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IASrC;;;;;;;;OAQG;IACG,SAAS,CACb,aAAa,EAAE,UAAU,GAAG,WAAW,EACvC,YAAY,EAAE,MAAM,EACpB,kBAAkB,EAAE,UAAU,GAAG,WAAW,EAC5C,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,SAAS,CAAC;CA+HtB"}

package/dist/types/src/nanotdf/NanoTDF.d.ts

@@ -0,0 +1,25 @@
+import { TypedArray } from '../tdf/index.js';
+import Header from './models/Header.js';
+import Payload from './models/Payload.js';
+import Signature from './models/Signature.js';
+import EncodingEnum from './enum/EncodingEnum.js';
+export default class NanoTDF {
+    static Encodings: typeof EncodingEnum;
+    static Header: typeof Header;
+    static Payload: typeof Payload;
+    static Signature: typeof Signature;
+    header: Header;
+    payload: Payload;
+    signature?: Signature;
+    static from(content: TypedArray | ArrayBuffer | string, encoding?: EncodingEnum, legacyTDF?: boolean): NanoTDF;
+    constructor(header: Header, payload: Payload, signature?: Signature);
+    /**
+     * Return the content of nano tdf as binary buffer
+     */
+    toBuffer(): ArrayBuffer;
+    /**
+     * Return the content of nano tdf as base64 string
+     */
+    toBase64(): string;
+}
+//# sourceMappingURL=NanoTDF.d.ts.map

package/dist/types/src/nanotdf/NanoTDF.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NanoTDF.d.ts","sourceRoot":"","sources":["../../../../src/nanotdf/NanoTDF.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,OAAO,MAAM,qBAAqB,CAAC;AAC1C,OAAO,SAAS,MAAM,uBAAuB,CAAC;AAC9C,OAAO,YAAY,MAAM,wBAAwB,CAAC;AAKlD,MAAM,CAAC,OAAO,OAAO,OAAO;IAE1B,MAAM,CAAC,SAAS,EAAE,OAAO,YAAY,CAAgB;IACrD,MAAM,CAAC,MAAM,gBAAU;IACvB,MAAM,CAAC,OAAO,iBAAW;IACzB,MAAM,CAAC,SAAS,mBAAa;IAEtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IAGjB,SAAS,CAAC,EAAE,SAAS,CAAC;IAE7B,MAAM,CAAC,IAAI,CACT,OAAO,EAAE,UAAU,GAAG,WAAW,GAAG,MAAM,EAC1C,QAAQ,CAAC,EAAE,YAAY,EACvB,SAAS,UAAQ,GAChB,OAAO;gBAkDE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,SAAS;IAMnE;;OAEG;IACH,QAAQ,IAAI,WAAW;IA2BvB;;OAEG;IACH,QAAQ,IAAI,MAAM;CAInB"}

package/dist/types/src/nanotdf/browser-entry.d.ts

@@ -0,0 +1,17 @@
+/**
+ * This file is used for:
+ *
+ * - es5 browser version of nanoTDF and add it to the window as NanoTDF
+ *
+ * This is not used for:
+ *
+ * - es6 web development (use node modules)
+ * - node applications
+ */
+import NanoTDF from './NanoTDF.js';
+declare global {
+    interface Window {
+        NanoTDF: typeof NanoTDF;
+    }
+}
+//# sourceMappingURL=browser-entry.d.ts.map

package/dist/types/src/nanotdf/browser-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-entry.d.ts","sourceRoot":"","sources":["../../../../src/nanotdf/browser-entry.ts"],"names":[],"mappings":"AACA;;;;;;;;;GASG;AACH,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,MAAM;QACd,OAAO,EAAE,OAAO,OAAO,CAAC;KACzB;CACF"}

package/dist/types/src/nanotdf/constants.d.ts

@@ -0,0 +1,2 @@
+export declare const GMAC_BINDING_LEN = 8;
+//# sourceMappingURL=constants.d.ts.map

package/dist/types/src/nanotdf/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/nanotdf/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,IAAI,CAAC"}

package/dist/types/src/nanotdf/decrypt.d.ts

@@ -0,0 +1,9 @@
+import type NanoTDF from './NanoTDF.js';
+/**
+ * Decrypt nanotdf with a crypto key
+ *
+ * @param key Crypto key used to decrypt nanotdf
+ * @param nanotdf NanoTDF to decrypt
+ */
+export default function decrypt(key: CryptoKey, nanotdf: NanoTDF): Promise<ArrayBuffer>;
+//# sourceMappingURL=decrypt.d.ts.map

package/dist/types/src/nanotdf/decrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../../../../src/nanotdf/decrypt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,OAAO,MAAM,cAAc,CAAC;AAExC;;;;;GAKG;AACH,wBAA8B,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAS5F"}

package/dist/types/src/nanotdf/encrypt-dataset.d.ts

@@ -0,0 +1,12 @@
+import Header from './models/Header.js';
+import TypedArray from '../tdf/TypedArray.js';
+/**
+ * Encrypt the plain data into nanotdf buffer
+ *
+ * @param symmetricKey Key to encrypt the payload
+ * @param header NanoTDF header
+ * @param iv IV to be used for encrypting the payload
+ * @param data The data to be encrypted
+ */
+export default function encryptDataset(symmetricKey: CryptoKey, header: Header, iv: Uint8Array, data: string | TypedArray | ArrayBuffer): Promise<ArrayBuffer>;
+//# sourceMappingURL=encrypt-dataset.d.ts.map

package/dist/types/src/nanotdf/encrypt-dataset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt-dataset.d.ts","sourceRoot":"","sources":["../../../../src/nanotdf/encrypt-dataset.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAIxC,OAAO,UAAU,MAAM,sBAAsB,CAAC;AAG9C;;;;;;;GAOG;AACH,wBAA8B,cAAc,CAC1C,YAAY,EAAE,SAAS,EACvB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,UAAU,EACd,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,GACtC,OAAO,CAAC,WAAW,CAAC,CA8BtB"}