@owlmeans/basic-keys 0.1.16 → 0.1.17

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/basic-keys",
-  "version": "0.1.16",
-  "generatedAt": "2026-08-14T10:14:48.846Z",
+  "version": "0.1.17",
+  "generatedAt": "2026-08-15T13:01:19.926Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/basic-keys/SKILL.md

@@ -8,18 +8,18 @@ user-invocable: false
 # @owlmeans/basic-keys
 
 **Layer:** Core
-**Install:** `"@owlmeans/basic-keys": "^0.1.16"` in `dependencies`
+**Install:** `"@owlmeans/basic-keys": "^0.1.17"` in `dependencies`
 
 ## Key Exports
 
 | Export | Description |
 |--------|-------------|
-| `KeyPair` types | Public/private key pair shape |
-| `keypair` factory | Generate or load Ed25519 keypairs |
-| `KeyModel` | Sign/verify helpers |
-| Constants | Curve names, key encodings |
+| `makeKeyPairModel(input?)` | The one factory — returns a `KeyPairModel` |
+| `KeyPair` | Key pair shape: `{ privateKey, publicKey, address, type }`, keys base64 |
+| `KeyPairModel` | `sign` / `verify` / `encrypt` / `decrypt` / `dcrpt` / `export*` |
+| `KeyType` | `ED25519` (`'ed25519'`, signing) and `XCHACHA` (`'xchacha'`, encryption) |
+| `fromPubKey`, `matchAddress` | Verify-only model from a public key; address check |
 | `auth` exports | Auth plugin built on keypair signatures |
-| Plugins | Pluggable signature verification |
 
 ## Subpath Exports
 
@@ -28,15 +28,51 @@ user-invocable: false
 
 ## Usage
 
+`makeKeyPairModel` takes **one** argument. Pass a `KeyType` string to generate a fresh pair of that
+type, a `"<type>:<base64key>"` string (or bare base64, implying ed25519) to load one, or a
+`KeyPair` object. There is no separate type parameter.
+
 ```typescript
-import { keypair, KeyModel } from '@owlmeans/basic-keys'
+import { makeKeyPairModel, KeyType } from '@owlmeans/basic-keys'
+
+const signer = makeKeyPairModel(KeyType.ED25519)   // generate
+const signature = await signer.sign(payload)        // objects are canonicalized first
+const ok = await signer.verify(payload, signature)
 
-const kp = keypair.generate()
-const signature = KeyModel.sign(kp.privateKey, message)
-const ok = KeyModel.verify(kp.publicKey, message, signature)
+const cipher = makeKeyPairModel(KeyType.XCHACHA)
+const secret = await cipher.decrypt(await cipher.encrypt('message'))
 ```
 
+`ed25519` throws `ed25519:encryption-support` on `encrypt` — signing and encryption are separate
+key types, never the same model.
+
+## Errors
+
+Plain `Error` with a `basic.keys:<code>` message — this package does **not** use
+`@owlmeans/error`, so do not add that dependency.
+
+| Code | Raised when |
+|------|-------------|
+| `basic.keys:missing-keypair` | model has no key pair |
+| `basic.keys:unknown-type` | key type is absent or has no plugin |
+| `basic.keys:sign-data-type` | data is neither string, object, nor `Uint8Array` |
+| `basic.keys:decrypt-not-utf8` | plaintext is not valid UTF-8 (see below) |
+
+## `@scure/base` v2 — strict `utf8`
+
+The repo is on `@scure/base` **v2**, whose `utf8` coder is strict: `encode` runs
+`TextDecoder('utf-8', { ignoreBOM: true, fatal: true })` and throws on invalid bytes instead of
+substituting `U+FFFD`, and `decode` rejects non-well-formed strings. `decrypt` therefore wraps its
+`utf8.encode` call and rethrows as `basic.keys:decrypt-not-utf8`. Use `dcrpt` when the plaintext is
+binary — it returns raw `Uint8Array` and never touches the utf8 coder.
+
+In practice a wrong key fails earlier: xchacha20-poly1305 is authenticated, so it throws
+`invalid tag` before any decoding happens. The guard covers the binary-plaintext case.
+
+Callers that tolerate undecryptable values must catch — e.g. `@owlmeans/mongo` and
+`@owlmeans/postgres` use `key.decrypt(value).catch(() => value)` for their encrypted-field paths.
+
 ## Depends On
 
-- `@owlmeans/basic-envelope` — wraps signed payloads
-- `@noble/curves`, `@noble/hashes`, `@scure/base`, `@scure/bip39` (peer/runtime crypto)
+- `@owlmeans/auth` — credential types for the auth helpers
+- `@noble/curves`, `@noble/ciphers`, `@noble/hashes`, `@scure/base` (v2), `canonicalize`

package/build/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AAGhI,eAAO,MAAM,mBAAmB,GAAU,CAAC,SAAS,EAAE,GAAG,SAAS,EAChE,MAAM,uBAAuB,EAC7B,OAAO,CAAC,EACR,QAAQ,YAAY,GAAG,aAAa,KACnC,OAAO,CAAC,eAAe,CAiBzB,CAAA;AAED,eAAO,MAAM,qBAAqB,GAAU,CAAC,SAAS,EAAE,GAAG,SAAS,EAClE,MAAM,eAAe,EACrB,WAAW,YAAY,GAAG,eAAe,KACxC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,CA6BpC,CAAA"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AAGhI,eAAO,MAAM,mBAAmB,GAAU,CAAC,SAAS,EAAE,GAAG,SAAS,QAC1D,uBAAuB,SACtB,CAAC,UACA,YAAY,GAAG,aAAa,KACnC,OAAO,CAAC,eAAe,CAiBzB,CAAA;AAED,eAAO,MAAM,qBAAqB,GAAU,CAAC,SAAS,EAAE,GAAG,SAAS,QAC5D,eAAe,aACV,YAAY,GAAG,eAAe,KACxC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,CA6BpC,CAAA"}

package/build/helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAW,YAAY,EAAE,MAAM,YAAY,CAAA;AAGvD,eAAO,MAAM,UAAU,GAAI,QAAQ,MAAM,EAAE,OAAO,MAAM,KAAG,YAiB1D,CAAA;AAED,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,EAAE,QAAQ,MAAM,KAAG,OACf,CAAA"}
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAW,YAAY,EAAE,MAAM,YAAY,CAAA;AAGvD,eAAO,MAAM,UAAU,WAAY,MAAM,SAAS,MAAM,KAAG,YAiB1D,CAAA;AAED,eAAO,MAAM,YAAY,YAAa,MAAM,UAAU,MAAM,KAAG,OACf,CAAA"}

package/build/keypair.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keypair.d.ts","sourceRoot":"","sources":["../src/keypair.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAMzC,eAAO,MAAM,cAAc,GAAI,QAAQ,OAAO,GAAG,MAAM,KAAG,OAqCzD,CAAA"}
+{"version":3,"file":"keypair.d.ts","sourceRoot":"","sources":["../src/keypair.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAMzC,eAAO,MAAM,cAAc,WAAY,OAAO,GAAG,MAAM,KAAG,OAqCzD,CAAA"}

package/build/model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgB,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAMjE,eAAO,MAAM,gBAAgB,EAAE,iBA0G9B,CAAA"}
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgB,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAMjE,eAAO,MAAM,gBAAgB,EAAE,iBAmH9B,CAAA"}

package/build/model.js

@@ -55,7 +55,17 @@ export const makeKeyPairModel = input => {
             }
             return base64urlnopad.encode(plugins[_model.keyPair.type].encrypt(data, prepareKey(_model.keyPair.publicKey)));
         },
-        decrypt: async (data) => utf8.encode(await _model.dcrpt(data)),
+        decrypt: async (data) => {
+            const plain = await _model.dcrpt(data);
+            try {
+                // @scure/base v2 decodes utf8 with { fatal: true } — a wrong key or a
+                // binary payload throws here instead of yielding replacement characters.
+                return utf8.encode(plain);
+            }
+            catch {
+                throw new Error('basic.keys:decrypt-not-utf8');
+            }
+        },
         dcrpt: async (data) => {
             data = data instanceof Uint8Array ? data : base64urlnopad.decode(data);
             assertType(_model.keyPair?.type);

package/build/model.js.map

@@ -1 +1 @@
-{"version":3,"file":"model.js","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,MAAM,CAAC,MAAM,gBAAgB,GAAsB,KAAK,CAAC,EAAE;IACzD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IAErC,MAAM,MAAM,GAAiB;QAC3B,OAAO;QAEP,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACnB,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;YACxB,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEhC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;YAC1C,CAAC;YAED,OAAO,cAAc,CAAC,MAAM,CAC1B,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAC/B,IAAkB,EAClB,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CACtC,CACF,CAAA;QACH,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;YAChC,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;YACxB,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAChC,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAE5C,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CACxC,IAAkB,EAClB,GAAG,EACH,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CACrC,CAAA;QACH,CAAC;QAED,MAAM,EAAE,GAAG,EAAE;YACX,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEhC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAA;QAC9D,CAAC;QAED,YAAY,EAAE,GAAG,EAAE;YACjB,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEhC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAA;QAC7D,CAAC;QAED,aAAa,EAAE,GAAG,EAAE;YAClB,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEhC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;QAC3D,CAAC;QAED,OAAO,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;YACpB,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;YACxB,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEhC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,cAAc,CAAC,MAAM,CAC1B,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAClC,IAAkB,EAClB,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CACrC,CACF,CAAA;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE5D,KAAK,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;YAClB,IAAI,GAAG,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,IAAc,CAAC,CAAA;YAChF,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEhC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CACzC,IAAkB,EAClB,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CACtC,CAAA;QACH,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,MAAM,CAAC,MAAM,gBAAgB,GAAsB,KAAK,CAAC,EAAE;IACzD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IAErC,MAAM,MAAM,GAAiB;QAC3B,OAAO;QAEP,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACnB,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;YACxB,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEhC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;YAC1C,CAAC;YAED,OAAO,cAAc,CAAC,MAAM,CAC1B,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAC/B,IAAkB,EAClB,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CACtC,CACF,CAAA;QACH,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;YAChC,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;YACxB,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAChC,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAE5C,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CACxC,IAAkB,EAClB,GAAG,EACH,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CACrC,CAAA;QACH,CAAC;QAED,MAAM,EAAE,GAAG,EAAE;YACX,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEhC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAA;QAC9D,CAAC;QAED,YAAY,EAAE,GAAG,EAAE;YACjB,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEhC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAA;QAC7D,CAAC;QAED,aAAa,EAAE,GAAG,EAAE;YAClB,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEhC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;QAC3D,CAAC;QAED,OAAO,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;YACpB,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;YACxB,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEhC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,cAAc,CAAC,MAAM,CAC1B,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAClC,IAAkB,EAClB,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CACrC,CACF,CAAA;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;YACpB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACtC,IAAI,CAAC;gBACH,sEAAsE;gBACtE,yEAAyE;gBACzE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;YAChD,CAAC;QACH,CAAC;QAED,KAAK,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;YAClB,IAAI,GAAG,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,IAAc,CAAC,CAAA;YAChF,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEhC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CACzC,IAAkB,EAClB,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CACtC,CAAA;QACH,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/build/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,SAAS,GAAI,WAAW,UAAU,KAAG,UACP,CAAA;AAE3C,eAAO,MAAM,UAAU,GAAI,KAAK,MAAM,KAAG,UACrB,CAAA;AAEpB,eAAO,MAAM,WAAW,GAAI,MAAM,OAAO,KAAG,UAiB3C,CAAA;AAED,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,KAAG,IAI1C,CAAA"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,SAAS,cAAe,UAAU,KAAG,UACP,CAAA;AAE3C,eAAO,MAAM,UAAU,QAAS,MAAM,KAAG,UACrB,CAAA;AAEpB,eAAO,MAAM,WAAW,SAAU,OAAO,KAAG,UAiB3C,CAAA;AAED,eAAO,MAAM,UAAU,UAAW,MAAM,KAAG,IAI1C,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/basic-keys",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -40,17 +40,17 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.16",
+    "@owlmeans/test-auth": "^0.1.17",
     "@types/bun": "^1.3.14",
     "nodemon": "^3.1.14",
-    "typescript": "^6.0.3"
+    "typescript": "^7.0.2"
   },
   "dependencies": {
     "@noble/ciphers": "^1.2.1",
     "@noble/curves": "^1.6.0",
     "@noble/hashes": "^1.5.0",
-    "@owlmeans/auth": "^0.1.16",
-    "@scure/base": "^1.1.9",
+    "@owlmeans/auth": "^0.1.17",
+    "@scure/base": "^2.3.0",
     "canonicalize": "^2.0.0"
   },
   "publishConfig": {

package/src/model.ts

@@ -92,7 +92,16 @@ export const makeKeyPairModel: KeyPairModelMaker = input => {
       )
     },
 
-    decrypt: async data => utf8.encode(await _model.dcrpt(data)),
+    decrypt: async data => {
+      const plain = await _model.dcrpt(data)
+      try {
+        // @scure/base v2 decodes utf8 with { fatal: true } — a wrong key or a
+        // binary payload throws here instead of yielding replacement characters.
+        return utf8.encode(plain)
+      } catch {
+        throw new Error('basic.keys:decrypt-not-utf8')
+      }
+    },
 
     dcrpt: async data => {
       data = data instanceof Uint8Array ? data : base64urlnopad.decode(data as string)