@otplib/plugin-base32-scure 13.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gerald Yeo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,229 @@
+# @otplib/plugin-base32-scure
+
+Base32 encoding/decoding plugin for otplib using the audited `@scure/base` library.
+
+## Installation
+
+```bash
+npm install @otplib/plugin-base32-scure
+pnpm add @otplib/plugin-base32-scure
+yarn add @otplib/plugin-base32-scure
+```
+
+## Overview
+
+This plugin provides Base32 encoding and decoding using `@scure/base`, a cryptographic library from the authors of `noble-ciphers`. It offers excellent performance, extensive auditing, and comprehensive TypeScript support.
+
+## Usage
+
+### Basic Usage
+
+```typescript
+import { generateSecret, generate } from "otplib";
+import { ScureBase32Plugin } from "@otplib/plugin-base32-scure";
+import { NodeCryptoPlugin } from "@otplib/plugin-crypto-node";
+
+const base32 = new ScureBase32Plugin();
+const crypto = new NodeCryptoPlugin();
+
+// Generate a secret
+const secret = generateSecret({ crypto, base32 });
+
+// Generate a token
+const token = await generate({
+  secret,
+  crypto,
+  base32,
+});
+```
+
+### Encoding and Decoding
+
+```typescript
+import { ScureBase32Plugin } from "@otplib/plugin-base32-scure";
+
+const base32 = new ScureBase32Plugin();
+
+// Encode binary data to Base32
+const data = new Uint8Array([1, 2, 3, 4, 5]);
+const encoded = base32.encode(data, { padding: true });
+// Output: "AEBAGBAF"
+
+// Decode Base32 string to binary
+const decoded = base32.decode("AEBAGBAF");
+// Output: Uint8Array [1, 2, 3, 4, 5]
+```
+
+### With Custom Options
+
+```typescript
+import { ScureBase32Plugin } from "@otplib/plugin-base32-scure";
+
+const base32 = new ScureBase32Plugin();
+
+// Encode without padding
+const encoded = base32.encode(data, { padding: false });
+// Output: "AEBAGBAF"
+
+// Decode handles both padded and unpadded strings
+const decoded1 = base32.decode("AEBAGBAF===="); // With padding
+const decoded2 = base32.decode("AEBAGBAF"); // Without padding
+```
+
+## When to Use
+
+Use this plugin when:
+
+- You want an audited, security-focused implementation
+- Performance is critical
+- You need comprehensive input validation
+- You're building security-critical applications
+- You prefer libraries with active maintenance and security audits
+
+## Platform Support
+
+Works in all environments:
+
+- Node.js (all versions)
+- Browsers (Chrome, Firefox, Safari, Edge)
+- Edge runtimes (Cloudflare Workers, Vercel Edge)
+- Deno
+- Bun
+
+## Examples
+
+### TOTP with Scure Base32
+
+```typescript
+import { generateSecret, generate } from "otplib";
+import { ScureBase32Plugin } from "@otplib/plugin-base32-scure";
+import { NodeCryptoPlugin } from "@otplib/plugin-crypto-node";
+
+const base32 = new ScureBase32Plugin();
+const crypto = new NodeCryptoPlugin();
+
+const secret = generateSecret({ crypto, base32 });
+console.log(secret); // Base32-encoded secret
+
+const token = await generate({ secret, crypto, base32 });
+console.log(token); // 6-digit token
+```
+
+### Web Environment
+
+```typescript
+import { generateSecret, generate } from "otplib";
+import { ScureBase32Plugin } from "@otplib/plugin-base32-scure";
+import { WebCryptoPlugin } from "@otplib/plugin-crypto-web";
+
+const base32 = new ScureBase32Plugin();
+const crypto = new WebCryptoPlugin();
+
+const secret = await generateSecret({ crypto, base32 });
+const token = await generate({ secret, crypto, base32 });
+```
+
+### Manual Secret Generation
+
+```typescript
+import { ScureBase32Plugin } from "@otplib/plugin-base32-scure";
+import { NodeCryptoPlugin } from "@otplib/plugin-crypto-node";
+
+const base32 = new ScureBase32Plugin();
+const crypto = new NodeCryptoPlugin();
+
+// Generate random secret
+const secretBytes = crypto.randomBytes(20);
+const secret = base32.encode(secretBytes, { padding: false });
+
+console.log(secret); // Base32 secret for TOTP
+```
+
+### Edge Runtime (Cloudflare Worker)
+
+```typescript
+import { ScureBase32Plugin } from "@otplib/plugin-base32-scure";
+import { WebCryptoPlugin } from "@otplib/plugin-crypto-web";
+
+export default {
+  async fetch(request) {
+    const base32 = new ScureBase32Plugin();
+    const crypto = new WebCryptoPlugin();
+
+    // Generate secret
+    const secretBytes = await crypto.randomBytes(20);
+    const secret = base32.encode(secretBytes, { padding: false });
+
+    return new Response(JSON.stringify({ secret }));
+  },
+};
+```
+
+## Advanced Usage
+
+### Custom Validation
+
+```typescript
+import { ScureBase32Plugin } from "@otplib/plugin-base32-scure";
+
+const base32 = new ScureBase32Plugin();
+
+function validateAndDecode(input: string): Uint8Array | null {
+  try {
+    // @scure/base validates:
+    // - Character set (A-Z, 2-7)
+    // - Length (must be multiple of 8 with padding, or correct without)
+    // - Padding (if present, must be correct)
+    return base32.decode(input);
+  } catch (error) {
+    console.error("Invalid Base32:", error.message);
+    return null;
+  }
+}
+
+const valid = validateAndDecode("JBSWY3DPEHPK3PXP");
+const invalid = validateAndDecode("invalid@base32!");
+```
+
+### Integration with Other Libraries
+
+```typescript
+import { ScureBase32Plugin } from "@otplib/plugin-base32-scure";
+import { base32 as scureBase32 } from "@scure/base";
+
+const plugin = new ScureBase32Plugin();
+
+// Use plugin's convenience methods
+const encoded = plugin.encode(data);
+
+// Or use @scure/base directly for advanced options
+const encoded = scureBase32.encode(data, { padding: false });
+```
+
+## Dependencies
+
+```json
+{
+  "dependencies": {
+    "@scure/base": "^1.1.0"
+  }
+}
+```
+
+## Related Packages
+
+- `@scure/base` - Audited encoding/decoding library
+- `@otplib/core` - Core types and interfaces
+- `@otplib/plugin-crypto-node` - Node.js crypto plugin
+- `@otplib/plugin-crypto-web` - Web Crypto API plugin
+
+## Documentation
+
+Full documentation available at [otplib.yeojz.dev](https://otplib.yeojz.dev):
+
+- [Getting Started Guide](https://otplib.yeojz.dev/guide/getting-started)
+- [API Reference](https://otplib.yeojz.dev/api/)
+
+## License
+
+[MIT](./LICENSE) © 2026 Gerald Yeo

package/dist/index.cjs

@@ -0,0 +1,2 @@
+"use strict";var a=Object.defineProperty;var d=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var p=Object.prototype.hasOwnProperty;var l=(o,e)=>{for(var r in e)a(o,r,{get:e[r],enumerable:!0})},m=(o,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let t of i(e))!p.call(o,t)&&t!==r&&a(o,t,{get:()=>e[t],enumerable:!(n=d(e,t))||n.enumerable});return o};var g=o=>m(a({},"__esModule",{value:!0}),o);var B={};l(B,{ScureBase32Plugin:()=>s,base32:()=>f,default:()=>u});module.exports=g(B);var c=require("@scure/base"),s=class{name="scure";encode(e,r={}){let{padding:n=!1}=r,t=c.base32.encode(e);return n?t:t.replace(/=+$/,"")}decode(e){try{let r=e.toUpperCase(),n=r.padEnd(Math.ceil(r.length/8)*8,"=");return c.base32.decode(n)}catch(r){throw r instanceof Error?new Error(`Invalid Base32 string: ${r.message}`):new Error("Invalid Base32 string")}}},f=Object.freeze(new s),u=s;0&&(module.exports={ScureBase32Plugin,base32});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * @otplib/plugin-base32-scure\n *\n * Base32 plugin for otplib using @scure/base.\n * Works universally across all JavaScript runtimes.\n */\n\nimport { base32 as scureBase32 } from \"@scure/base\";\n\nimport type { Base32EncodeOptions } from \"@otplib/core\";\nimport type { Base32Plugin } from \"@otplib/core\";\n\n/**\n * Scure Base32 plugin\n *\n * This implementation uses @scure/base for Base32 encoding/decoding.\n * @scure/base is a modern, audited cryptography library with zero dependencies.\n *\n * @example\n * ```ts\n * import { ScureBase32Plugin } from '@otplib/plugin-base32-scure';\n *\n * const plugin = new ScureBase32Plugin();\n * const encoded = plugin.encode(data);\n * const decoded = plugin.decode(encoded);\n * ```\n */\nexport class ScureBase32Plugin implements Base32Plugin {\n  readonly name = \"scure\";\n\n  /**\n   * Encode binary data to Base32 string\n   *\n   * @param data - Uint8Array to encode\n   * @param options - Encoding options\n   * @returns Base32 encoded string\n   */\n  encode(data: Uint8Array, options: Base32EncodeOptions = {}): string {\n    const { padding = false } = options;\n\n    const encoded = scureBase32.encode(data);\n    return padding ? encoded : encoded.replace(/=+$/, \"\");\n  }\n\n  /**\n   * Decode Base32 string to binary data\n   *\n   * @param str - Base32 string to decode\n   * @returns Decoded Uint8Array\n   * @throws {Error} If string contains invalid characters\n   */\n  decode(str: string): Uint8Array {\n    try {\n      const uppercased = str.toUpperCase();\n      const padded = uppercased.padEnd(Math.ceil(uppercased.length / 8) * 8, \"=\");\n      return scureBase32.decode(padded);\n    } catch (error) {\n      if (error instanceof Error) {\n        throw new Error(`Invalid Base32 string: ${error.message}`);\n      }\n      throw new Error(\"Invalid Base32 string\");\n    }\n  }\n}\n\n/**\n * Default singleton instance for convenience\n *\n * @example\n * ```ts\n * import { base32 } from '@otplib/plugin-base32-scure';\n *\n * const encoded = base32.encode(data);\n * ```\n */\nexport const base32: Base32Plugin = Object.freeze(new ScureBase32Plugin());\n\nexport default ScureBase32Plugin;\n"],"mappings":"yaAAA,IAAAA,EAAA,GAAAC,EAAAD,EAAA,uBAAAE,EAAA,WAAAC,EAAA,YAAAC,IAAA,eAAAC,EAAAL,GAOA,IAAAM,EAAsC,uBAoBzBJ,EAAN,KAAgD,CAC5C,KAAO,QAShB,OAAOK,EAAkBC,EAA+B,CAAC,EAAW,CAClE,GAAM,CAAE,QAAAC,EAAU,EAAM,EAAID,EAEtBE,EAAU,EAAAC,OAAY,OAAOJ,CAAI,EACvC,OAAOE,EAAUC,EAAUA,EAAQ,QAAQ,MAAO,EAAE,CACtD,CASA,OAAOE,EAAyB,CAC9B,GAAI,CACF,IAAMC,EAAaD,EAAI,YAAY,EAC7BE,EAASD,EAAW,OAAO,KAAK,KAAKA,EAAW,OAAS,CAAC,EAAI,EAAG,GAAG,EAC1E,OAAO,EAAAF,OAAY,OAAOG,CAAM,CAClC,OAASC,EAAO,CACd,MAAIA,aAAiB,MACb,IAAI,MAAM,0BAA0BA,EAAM,OAAO,EAAE,EAErD,IAAI,MAAM,uBAAuB,CACzC,CACF,CACF,EAYaZ,EAAuB,OAAO,OAAO,IAAID,CAAmB,EAElEE,EAAQF","names":["index_exports","__export","ScureBase32Plugin","base32","index_default","__toCommonJS","import_base","data","options","padding","encoded","scureBase32","str","uppercased","padded","error"]}

package/dist/index.d.cts

@@ -0,0 +1,56 @@
+import { Base32Plugin, Base32EncodeOptions } from '@otplib/core';
+
+/**
+ * @otplib/plugin-base32-scure
+ *
+ * Base32 plugin for otplib using @scure/base.
+ * Works universally across all JavaScript runtimes.
+ */
+
+/**
+ * Scure Base32 plugin
+ *
+ * This implementation uses @scure/base for Base32 encoding/decoding.
+ * @scure/base is a modern, audited cryptography library with zero dependencies.
+ *
+ * @example
+ * ```ts
+ * import { ScureBase32Plugin } from '@otplib/plugin-base32-scure';
+ *
+ * const plugin = new ScureBase32Plugin();
+ * const encoded = plugin.encode(data);
+ * const decoded = plugin.decode(encoded);
+ * ```
+ */
+declare class ScureBase32Plugin implements Base32Plugin {
+    readonly name = "scure";
+    /**
+     * Encode binary data to Base32 string
+     *
+     * @param data - Uint8Array to encode
+     * @param options - Encoding options
+     * @returns Base32 encoded string
+     */
+    encode(data: Uint8Array, options?: Base32EncodeOptions): string;
+    /**
+     * Decode Base32 string to binary data
+     *
+     * @param str - Base32 string to decode
+     * @returns Decoded Uint8Array
+     * @throws {Error} If string contains invalid characters
+     */
+    decode(str: string): Uint8Array;
+}
+/**
+ * Default singleton instance for convenience
+ *
+ * @example
+ * ```ts
+ * import { base32 } from '@otplib/plugin-base32-scure';
+ *
+ * const encoded = base32.encode(data);
+ * ```
+ */
+declare const base32: Base32Plugin;
+
+export { ScureBase32Plugin, base32, ScureBase32Plugin as default };

package/dist/index.d.ts

@@ -0,0 +1,56 @@
+import { Base32Plugin, Base32EncodeOptions } from '@otplib/core';
+
+/**
+ * @otplib/plugin-base32-scure
+ *
+ * Base32 plugin for otplib using @scure/base.
+ * Works universally across all JavaScript runtimes.
+ */
+
+/**
+ * Scure Base32 plugin
+ *
+ * This implementation uses @scure/base for Base32 encoding/decoding.
+ * @scure/base is a modern, audited cryptography library with zero dependencies.
+ *
+ * @example
+ * ```ts
+ * import { ScureBase32Plugin } from '@otplib/plugin-base32-scure';
+ *
+ * const plugin = new ScureBase32Plugin();
+ * const encoded = plugin.encode(data);
+ * const decoded = plugin.decode(encoded);
+ * ```
+ */
+declare class ScureBase32Plugin implements Base32Plugin {
+    readonly name = "scure";
+    /**
+     * Encode binary data to Base32 string
+     *
+     * @param data - Uint8Array to encode
+     * @param options - Encoding options
+     * @returns Base32 encoded string
+     */
+    encode(data: Uint8Array, options?: Base32EncodeOptions): string;
+    /**
+     * Decode Base32 string to binary data
+     *
+     * @param str - Base32 string to decode
+     * @returns Decoded Uint8Array
+     * @throws {Error} If string contains invalid characters
+     */
+    decode(str: string): Uint8Array;
+}
+/**
+ * Default singleton instance for convenience
+ *
+ * @example
+ * ```ts
+ * import { base32 } from '@otplib/plugin-base32-scure';
+ *
+ * const encoded = base32.encode(data);
+ * ```
+ */
+declare const base32: Base32Plugin;
+
+export { ScureBase32Plugin, base32, ScureBase32Plugin as default };

package/dist/index.js

@@ -0,0 +1,2 @@
+import{base32 as s}from"@scure/base";var r=class{name="scure";encode(o,e={}){let{padding:t=!1}=e,n=s.encode(o);return t?n:n.replace(/=+$/,"")}decode(o){try{let e=o.toUpperCase(),t=e.padEnd(Math.ceil(e.length/8)*8,"=");return s.decode(t)}catch(e){throw e instanceof Error?new Error(`Invalid Base32 string: ${e.message}`):new Error("Invalid Base32 string")}}},d=Object.freeze(new r),i=r;export{r as ScureBase32Plugin,d as base32,i as default};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * @otplib/plugin-base32-scure\n *\n * Base32 plugin for otplib using @scure/base.\n * Works universally across all JavaScript runtimes.\n */\n\nimport { base32 as scureBase32 } from \"@scure/base\";\n\nimport type { Base32EncodeOptions } from \"@otplib/core\";\nimport type { Base32Plugin } from \"@otplib/core\";\n\n/**\n * Scure Base32 plugin\n *\n * This implementation uses @scure/base for Base32 encoding/decoding.\n * @scure/base is a modern, audited cryptography library with zero dependencies.\n *\n * @example\n * ```ts\n * import { ScureBase32Plugin } from '@otplib/plugin-base32-scure';\n *\n * const plugin = new ScureBase32Plugin();\n * const encoded = plugin.encode(data);\n * const decoded = plugin.decode(encoded);\n * ```\n */\nexport class ScureBase32Plugin implements Base32Plugin {\n  readonly name = \"scure\";\n\n  /**\n   * Encode binary data to Base32 string\n   *\n   * @param data - Uint8Array to encode\n   * @param options - Encoding options\n   * @returns Base32 encoded string\n   */\n  encode(data: Uint8Array, options: Base32EncodeOptions = {}): string {\n    const { padding = false } = options;\n\n    const encoded = scureBase32.encode(data);\n    return padding ? encoded : encoded.replace(/=+$/, \"\");\n  }\n\n  /**\n   * Decode Base32 string to binary data\n   *\n   * @param str - Base32 string to decode\n   * @returns Decoded Uint8Array\n   * @throws {Error} If string contains invalid characters\n   */\n  decode(str: string): Uint8Array {\n    try {\n      const uppercased = str.toUpperCase();\n      const padded = uppercased.padEnd(Math.ceil(uppercased.length / 8) * 8, \"=\");\n      return scureBase32.decode(padded);\n    } catch (error) {\n      if (error instanceof Error) {\n        throw new Error(`Invalid Base32 string: ${error.message}`);\n      }\n      throw new Error(\"Invalid Base32 string\");\n    }\n  }\n}\n\n/**\n * Default singleton instance for convenience\n *\n * @example\n * ```ts\n * import { base32 } from '@otplib/plugin-base32-scure';\n *\n * const encoded = base32.encode(data);\n * ```\n */\nexport const base32: Base32Plugin = Object.freeze(new ScureBase32Plugin());\n\nexport default ScureBase32Plugin;\n"],"mappings":"AAOA,OAAS,UAAUA,MAAmB,cAoB/B,IAAMC,EAAN,KAAgD,CAC5C,KAAO,QAShB,OAAOC,EAAkBC,EAA+B,CAAC,EAAW,CAClE,GAAM,CAAE,QAAAC,EAAU,EAAM,EAAID,EAEtBE,EAAUL,EAAY,OAAOE,CAAI,EACvC,OAAOE,EAAUC,EAAUA,EAAQ,QAAQ,MAAO,EAAE,CACtD,CASA,OAAOC,EAAyB,CAC9B,GAAI,CACF,IAAMC,EAAaD,EAAI,YAAY,EAC7BE,EAASD,EAAW,OAAO,KAAK,KAAKA,EAAW,OAAS,CAAC,EAAI,EAAG,GAAG,EAC1E,OAAOP,EAAY,OAAOQ,CAAM,CAClC,OAASC,EAAO,CACd,MAAIA,aAAiB,MACb,IAAI,MAAM,0BAA0BA,EAAM,OAAO,EAAE,EAErD,IAAI,MAAM,uBAAuB,CACzC,CACF,CACF,EAYaC,EAAuB,OAAO,OAAO,IAAIT,CAAmB,EAElEU,EAAQV","names":["scureBase32","ScureBase32Plugin","data","options","padding","encoded","str","uppercased","padded","error","base32","index_default"]}

package/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "@otplib/plugin-base32-scure",
+  "version": "13.0.0",
+  "description": "Base32 plugin for otplib using @scure/base",
+  "license": "MIT",
+  "author": "Gerald Yeo <support@yeojz.dev>",
+  "homepage": "https://otplib.yeojz.dev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/yeojz/otplib.git",
+    "directory": "packages/plugin-base32-scure"
+  },
+  "bugs": {
+    "url": "https://github.com/yeojz/otplib/issues"
+  },
+  "keywords": [
+    "otp",
+    "base32",
+    "encoding",
+    "plugin"
+  ],
+  "sideEffects": false,
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "@scure/base": "^1.1.7",
+    "@otplib/core": "13.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.0.3",
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.16"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest",
+    "test:ci": "vitest run --coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src/",
+    "clean": "rm -rf dist .tsbuildinfo"
+  }
+}