@sdxc/crypto 0.0.0-pre.1

package/dist/seal.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Authenticated symmetric encryption for values that must be read back.
+ *
+ * AES-GCM with a fresh random IV per call, wrapped in a versioned envelope so a
+ * future algorithm change never requires guessing the format of stored data. This
+ * is the third option beside plaintext and irreversible hashes.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import type { Result } from "@sdxc/result";
+import { CryptoError } from "./errors.js";
+/**
+ * Imports raw base64url key material as an AES-GCM key.
+ *
+ * The key is imported as non-extractable, so a leaked reference cannot be turned
+ * back into bytes. Generate material with `randomToken({ bytes: 32 })`.
+ *
+ * @param raw Base64url-encoded key of 16, 24, or 32 bytes.
+ * @returns The key, or why the material was rejected.
+ * @example
+ * let key = await importKey(env.SEAL_KEY);
+ */
+export declare function importKey(raw: string): Promise<Result<CryptoKey, CryptoError>>;
+/**
+ * Encrypts a string into a self-describing envelope.
+ *
+ * The IV is random per call, so sealing the same plaintext twice yields
+ * different envelopes; hash a value with `sha256` before storing it for lookup.
+ *
+ * @param key AES-GCM key from `importKey`.
+ * @param plaintext Value to encrypt.
+ * @returns Envelope shaped `v1.<iv>.<ciphertext>`, or why encryption failed.
+ * @example
+ * let sealed = await seal(key, refreshToken);
+ */
+export declare function seal(key: CryptoKey, plaintext: string): Promise<Result<string, CryptoError>>;
+/**
+ * Decrypts an envelope produced by `seal`.
+ *
+ * A wrong key and a tampered ciphertext raise the same `DecryptionError`,
+ * revealing only that decryption failed and nothing about which part changed.
+ *
+ * @param key AES-GCM key from `importKey`.
+ * @param sealed Envelope shaped `v1.<iv>.<ciphertext>`.
+ * @returns The original plaintext, or why it could not be recovered.
+ * @example
+ * let opened = await open(key, stored.sealedToken);
+ */
+export declare function open(key: CryptoKey, sealed: string): Promise<Result<string, CryptoError>>;

package/dist/seal.js

@@ -0,0 +1,114 @@
+/**
+ * Authenticated symmetric encryption for values that must be read back.
+ *
+ * AES-GCM with a fresh random IV per call, wrapped in a versioned envelope so a
+ * future algorithm change never requires guessing the format of stored data. This
+ * is the third option beside plaintext and irreversible hashes.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import { failure, isFailure, success } from "@sdxc/result";
+import { Base64Url } from "./encoding.js";
+import { CryptoError, DecryptionError, InvalidEnvelopeError, InvalidKeyError } from "./errors.js";
+import { toBytes, toText } from "./lib/bytes.js";
+import { randomBytes } from "./random.js";
+/** Cipher used by the `v1` envelope. */
+const SEAL_ALGORITHM = "AES-GCM";
+/** Version tag written by `seal` and required by `open`. */
+const SEAL_VERSION = "v1";
+/** IV length in bytes; 96 bits is the size AES-GCM is specified for. */
+const SEAL_IV_BYTES = 12;
+/** Separator between envelope fields, outside the base64url alphabet. */
+const SEAL_SEPARATOR = ".";
+/** Number of fields in the envelope: version, IV, ciphertext. */
+const SEAL_FIELDS = 3;
+/** AES key sizes WebCrypto accepts, in bytes. */
+const SEAL_KEY_BYTES = [16, 24, 32];
+/**
+ * Imports raw base64url key material as an AES-GCM key.
+ *
+ * The key is imported as non-extractable, so a leaked reference cannot be turned
+ * back into bytes. Generate material with `randomToken({ bytes: 32 })`.
+ *
+ * @param raw Base64url-encoded key of 16, 24, or 32 bytes.
+ * @returns The key, or why the material was rejected.
+ * @example
+ * let key = await importKey(env.SEAL_KEY);
+ */
+export async function importKey(raw) {
+    let material = Base64Url.decode(raw);
+    if (isFailure(material))
+        return material;
+    if (!SEAL_KEY_BYTES.includes(material.data.length)) {
+        return failure(new InvalidKeyError("expected 16, 24, or 32 bytes of AES key material"));
+    }
+    try {
+        let key = await crypto.subtle.importKey("raw", material.data, SEAL_ALGORITHM, false, [
+            "encrypt",
+            "decrypt",
+        ]);
+        return success(key);
+    }
+    catch {
+        return failure(new InvalidKeyError("the runtime rejected the key material"));
+    }
+}
+/**
+ * Encrypts a string into a self-describing envelope.
+ *
+ * The IV is random per call, so sealing the same plaintext twice yields
+ * different envelopes; hash a value with `sha256` before storing it for lookup.
+ *
+ * @param key AES-GCM key from `importKey`.
+ * @param plaintext Value to encrypt.
+ * @returns Envelope shaped `v1.<iv>.<ciphertext>`, or why encryption failed.
+ * @example
+ * let sealed = await seal(key, refreshToken);
+ */
+export async function seal(key, plaintext) {
+    let iv = randomBytes(SEAL_IV_BYTES);
+    try {
+        let ciphertext = await crypto.subtle.encrypt({ name: SEAL_ALGORITHM, iv }, key, toBytes(plaintext));
+        let fields = [SEAL_VERSION, Base64Url.encode(iv), Base64Url.encode(new Uint8Array(ciphertext))];
+        return success(fields.join(SEAL_SEPARATOR));
+    }
+    catch {
+        return failure(new CryptoError("Encryption failed"));
+    }
+}
+/**
+ * Decrypts an envelope produced by `seal`.
+ *
+ * A wrong key and a tampered ciphertext raise the same `DecryptionError`,
+ * revealing only that decryption failed and nothing about which part changed.
+ *
+ * @param key AES-GCM key from `importKey`.
+ * @param sealed Envelope shaped `v1.<iv>.<ciphertext>`.
+ * @returns The original plaintext, or why it could not be recovered.
+ * @example
+ * let opened = await open(key, stored.sealedToken);
+ */
+export async function open(key, sealed) {
+    let fields = sealed.split(SEAL_SEPARATOR);
+    if (fields.length !== SEAL_FIELDS)
+        return failure(new InvalidEnvelopeError("unexpected format"));
+    let [version = "", encodedIv = "", encodedCiphertext = ""] = fields;
+    if (version !== SEAL_VERSION)
+        return failure(new InvalidEnvelopeError("unsupported version"));
+    let iv = Base64Url.decode(encodedIv);
+    if (isFailure(iv) || iv.data.length !== SEAL_IV_BYTES) {
+        return failure(new InvalidEnvelopeError("unreadable initialization vector"));
+    }
+    let ciphertext = Base64Url.decode(encodedCiphertext);
+    if (isFailure(ciphertext) || ciphertext.data.length === 0) {
+        return failure(new InvalidEnvelopeError("unreadable ciphertext"));
+    }
+    try {
+        let plaintext = await crypto.subtle.decrypt({ name: SEAL_ALGORITHM, iv: iv.data }, key, ciphertext.data);
+        return success(toText(new Uint8Array(plaintext)));
+    }
+    catch {
+        return failure(new DecryptionError());
+    }
+}

package/dist/timing-safe-equal.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Constant-time byte comparison for secrets, signatures, and one-time codes.
+ *
+ * Comparing sensitive values with `===` or a loop that returns early leaks how
+ * many leading bytes matched, which is enough to forge a signature one byte at a
+ * time; this exists so no module in the repository needs `node:crypto` for it.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import type { BinaryLike } from "./lib/bytes.js";
+/**
+ * Compares two values byte for byte without an early exit.
+ *
+ * The running time depends only on the length of the inputs; length leaks but
+ * byte content stays protected. Strings compare as their UTF-8 bytes.
+ *
+ * @param left First value, typically the expected one.
+ * @param right Second value, typically the one supplied by a caller.
+ * @returns Whether both values contain exactly the same bytes.
+ * @example
+ * if (!timingSafeEqual(expectedSignature, providedSignature)) return reject();
+ */
+export declare function timingSafeEqual(left: BinaryLike, right: BinaryLike): boolean;

package/dist/timing-safe-equal.js

@@ -0,0 +1,34 @@
+/**
+ * Constant-time byte comparison for secrets, signatures, and one-time codes.
+ *
+ * Comparing sensitive values with `===` or a loop that returns early leaks how
+ * many leading bytes matched, which is enough to forge a signature one byte at a
+ * time; this exists so no module in the repository needs `node:crypto` for it.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import { toBytes } from "./lib/bytes.js";
+/**
+ * Compares two values byte for byte without an early exit.
+ *
+ * The running time depends only on the length of the inputs; length leaks but
+ * byte content stays protected. Strings compare as their UTF-8 bytes.
+ *
+ * @param left First value, typically the expected one.
+ * @param right Second value, typically the one supplied by a caller.
+ * @returns Whether both values contain exactly the same bytes.
+ * @example
+ * if (!timingSafeEqual(expectedSignature, providedSignature)) return reject();
+ */
+export function timingSafeEqual(left, right) {
+    let a = toBytes(left);
+    let b = toBytes(right);
+    if (a.length === 0 || b.length === 0)
+        return a.length === b.length;
+    let mismatch = a.length ^ b.length;
+    for (let index = 0; index < a.length; index++) {
+        mismatch |= (a[index] ?? 0) ^ (b[index % b.length] ?? 0);
+    }
+    return mismatch === 0;
+}

package/dist/totp.d.ts

@@ -0,0 +1,147 @@
+/**
+ * Time-based one-time passwords, RFC 6238 over the package's HMAC primitive.
+ *
+ * Second-factor enrollment and verification need three things that are easy to
+ * get subtly wrong: a base32 shared secret, the dynamic truncation of a MAC over
+ * the current time step, and a drift window that still compares in constant time.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import type { Result } from "@sdxc/result";
+import { CryptoError } from "./errors.js";
+/** Hash functions RFC 6238 allows for TOTP. */
+declare const SUPPORTED_ALGORITHMS: readonly ["SHA-1", "SHA-256", "SHA-512"];
+/**
+ * Types for the `totp` operations.
+ */
+export declare namespace totp {
+    /** Hash function inside the HMAC a code is derived from. */
+    type Algorithm = (typeof SUPPORTED_ALGORITHMS)[number];
+    /** Shared secret size. */
+    interface SecretOptions {
+        /**
+         * Secret size in bytes.
+         * @default 20
+         */
+        bytes?: number;
+    }
+    /** Parameters that must agree between the generator and the verifier. */
+    interface CodeOptions {
+        /**
+         * Point in time to generate for, as a `Date` or epoch milliseconds.
+         * @default Date.now()
+         */
+        at?: Date | number;
+        /**
+         * Time step in seconds.
+         * @default 30
+         */
+        step?: number;
+        /**
+         * Digits in the code.
+         * @default 6
+         */
+        digits?: number;
+        /**
+         * Hash function to key.
+         * @default "SHA-1"
+         */
+        algorithm?: Algorithm;
+    }
+    /** Verification parameters, including how much clock drift to accept. */
+    interface VerifyOptions extends CodeOptions {
+        /**
+         * Steps accepted on either side of the current one.
+         * @default 1
+         */
+        window?: number;
+    }
+    /** Enrollment URI fields shown by an authenticator app. */
+    interface UriOptions {
+        /** Service name shown as the account issuer. */
+        issuer: string;
+        /** Account identifier, usually an email address or username. */
+        account: string;
+        /**
+         * Digits in the code.
+         * @default 6
+         */
+        digits?: number;
+        /**
+         * Time step in seconds.
+         * @default 30
+         */
+        step?: number;
+        /**
+         * Hash function to key.
+         * @default "SHA-1"
+         */
+        algorithm?: Algorithm;
+    }
+}
+/**
+ * Generates a random base32 shared secret ready for enrollment.
+ *
+ * The result is unpadded uppercase base32 because that is the only encoding
+ * authenticator apps accept in a QR code or a typed setup key.
+ *
+ * @param options Secret size.
+ * @returns Base32 secret to store for the account and show once during enrollment.
+ * @throws {RangeError} If `options.bytes` is not an integer the runtime can fill.
+ * @example
+ * let secret = totp.generateSecret(); // "JBSWY3DPEHPK3PXP..."
+ */
+declare function generateSecret(options?: totp.SecretOptions): string;
+/**
+ * Generates the code for a secret at a point in time.
+ *
+ * @param secret Base32 shared secret.
+ * @param options Time, step, digits, and hash function.
+ * @returns The current code, or why it could not be derived.
+ * @example
+ * let code = await totp.code(secret, { at: new Date("2026-01-01T00:00:00Z") });
+ */
+declare function generateCode(secret: string, options?: totp.CodeOptions): Promise<Result<string, CryptoError>>;
+/**
+ * Checks a submitted code against the current step and the drift window.
+ *
+ * Every step in the window is compared in constant time even after a match,
+ * so timing never reveals which step matched.
+ *
+ * @param secret Base32 shared secret.
+ * @param code Code submitted by the user.
+ * @param options Time, step, digits, hash function, and drift window.
+ * @returns Whether the code is valid, or why it could not be checked.
+ * @example
+ * let ok = await totp.verify(secret, form.code, { window: 1 });
+ */
+declare function verifyCode(secret: string, code: string, options?: totp.VerifyOptions): Promise<Result<boolean, CryptoError>>;
+/**
+ * Builds the `otpauth://` URI an authenticator app scans during enrollment.
+ *
+ * The issuer appears both in the label and as a query parameter, which is what
+ * apps need to group and name the entry consistently.
+ *
+ * @param secret Base32 shared secret.
+ * @param options Issuer, account, and the parameters the app must mirror.
+ * @returns URI to render as a QR code or offer as a manual setup link.
+ * @example
+ * totp.uri(secret, { issuer: "Acme", account: "ada@example.com" });
+ */
+declare function buildUri(secret: string, options: totp.UriOptions): string;
+/**
+ * RFC 6238 one-time passwords: secrets, codes, verification, and enrollment URIs.
+ *
+ * @example
+ * let secret = totp.generateSecret();
+ * let uri = totp.uri(secret, { issuer: "Acme", account: "ada@example.com" });
+ * let ok = await totp.verify(secret, submittedCode, { window: 1 });
+ */
+export declare const totp: {
+    generateSecret: typeof generateSecret;
+    code: typeof generateCode;
+    verify: typeof verifyCode;
+    uri: typeof buildUri;
+};
+export {};

package/dist/totp.js

@@ -0,0 +1,213 @@
+/**
+ * Time-based one-time passwords, RFC 6238 over the package's HMAC primitive.
+ *
+ * Second-factor enrollment and verification need three things that are easy to
+ * get subtly wrong: a base32 shared secret, the dynamic truncation of a MAC over
+ * the current time step, and a drift window that still compares in constant time.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import { failure, isFailure, success } from "@sdxc/result";
+import { CryptoError } from "./errors.js";
+import { hmac } from "./hmac.js";
+import { decode as decodeBase32, encode as encodeBase32 } from "./lib/base32.js";
+import { randomBytes } from "./random.js";
+import { timingSafeEqual } from "./timing-safe-equal.js";
+/** Hash functions RFC 6238 allows for TOTP. */
+const SUPPORTED_ALGORITHMS = ["SHA-1", "SHA-256", "SHA-512"];
+/** Default time step in seconds, as authenticator apps assume. */
+const DEFAULT_STEP_SECONDS = 30;
+/** Default number of digits in a generated code. */
+const DEFAULT_DIGITS = 6;
+/** Default hash, kept at SHA-1 because that is what enrollment apps support. */
+const DEFAULT_ALGORITHM = "SHA-1";
+/** Default number of steps accepted on either side of the current one. */
+const DEFAULT_WINDOW = 1;
+/** Default shared secret size in bytes, the 160 bits RFC 4226 recommends. */
+const DEFAULT_SECRET_BYTES = 20;
+/** Dynamic truncation keeps 31 bits, so ten digits is the most it can express. */
+const MAX_DIGITS = 10;
+/** Width of the big-endian counter the MAC is computed over. */
+const COUNTER_BYTES = 8;
+/** Milliseconds per second, for turning a timestamp into a step counter. */
+const MS_PER_SECOND = 1000;
+/** A submitted code must be digits only, so a formatted string never matches. */
+const DIGITS_PATTERN = /^\d+$/;
+/**
+ * Applies defaults and rejects parameters that cannot produce a valid code.
+ *
+ * Bad parameters are a caller mistake, so resolution surfaces a `Failure`
+ * naming the problem for the caller to fix.
+ *
+ * @param options Caller-supplied parameters.
+ * @returns Resolved parameters, or the reason they are unusable.
+ */
+function resolve(options) {
+    let digits = options.digits ?? DEFAULT_DIGITS;
+    if (!Number.isInteger(digits) || digits < 1 || digits > MAX_DIGITS) {
+        return failure(new CryptoError(`TOTP digits must be an integer between 1 and ${MAX_DIGITS}`));
+    }
+    let step = options.step ?? DEFAULT_STEP_SECONDS;
+    if (!Number.isInteger(step) || step < 1) {
+        return failure(new CryptoError("TOTP step must be a positive whole number of seconds"));
+    }
+    let algorithm = options.algorithm ?? DEFAULT_ALGORITHM;
+    if (!SUPPORTED_ALGORITHMS.includes(algorithm)) {
+        return failure(new CryptoError("TOTP algorithm must be SHA-1, SHA-256, or SHA-512"));
+    }
+    return success({ digits, step, algorithm });
+}
+/**
+ * Converts a moment in time into the RFC 6238 step counter.
+ *
+ * @param at `Date`, epoch milliseconds, or nothing for the current time.
+ * @param step Time step in seconds.
+ * @returns Number of whole steps elapsed since the Unix epoch.
+ */
+function counterFor(at, step) {
+    let milliseconds = at instanceof Date ? at.getTime() : (at ?? Date.now());
+    return Math.floor(milliseconds / MS_PER_SECOND / step);
+}
+/**
+ * Encodes a step counter as the 8-byte big-endian block the MAC covers.
+ *
+ * @param counter Step counter, which must not be negative.
+ * @returns Eight bytes in network order.
+ */
+function counterBlock(counter) {
+    let block = new Uint8Array(COUNTER_BYTES);
+    new DataView(block.buffer).setBigUint64(0, BigInt(counter));
+    return block;
+}
+/**
+ * Derives the code for one specific step counter, applying RFC 4226 dynamic
+ * truncation: the top bit of the selected MAC window is cleared so the
+ * value stays positive before reducing modulo `10 ** digits`.
+ *
+ * @param key Decoded shared secret.
+ * @param counter Step counter to derive for.
+ * @param parameters Resolved digits and hash function.
+ * @returns The code as a zero-padded string, or why it could not be derived.
+ */
+async function codeFor(key, counter, parameters) {
+    let mac = await hmac.sign(key, counterBlock(counter), { hash: parameters.algorithm });
+    if (isFailure(mac))
+        return mac;
+    let bytes = mac.data;
+    let offset = (bytes[bytes.length - 1] ?? 0) & 0x0f;
+    let value = (((bytes[offset] ?? 0) & 0x7f) << 24) |
+        ((bytes[offset + 1] ?? 0) << 16) |
+        ((bytes[offset + 2] ?? 0) << 8) |
+        (bytes[offset + 3] ?? 0);
+    return success(String(value % 10 ** parameters.digits).padStart(parameters.digits, "0"));
+}
+/**
+ * Generates a random base32 shared secret ready for enrollment.
+ *
+ * The result is unpadded uppercase base32 because that is the only encoding
+ * authenticator apps accept in a QR code or a typed setup key.
+ *
+ * @param options Secret size.
+ * @returns Base32 secret to store for the account and show once during enrollment.
+ * @throws {RangeError} If `options.bytes` is not an integer the runtime can fill.
+ * @example
+ * let secret = totp.generateSecret(); // "JBSWY3DPEHPK3PXP..."
+ */
+function generateSecret(options = {}) {
+    return encodeBase32(randomBytes(options.bytes ?? DEFAULT_SECRET_BYTES));
+}
+/**
+ * Generates the code for a secret at a point in time.
+ *
+ * @param secret Base32 shared secret.
+ * @param options Time, step, digits, and hash function.
+ * @returns The current code, or why it could not be derived.
+ * @example
+ * let code = await totp.code(secret, { at: new Date("2026-01-01T00:00:00Z") });
+ */
+async function generateCode(secret, options = {}) {
+    let parameters = resolve(options);
+    if (isFailure(parameters))
+        return parameters;
+    let key = decodeBase32(secret);
+    if (isFailure(key))
+        return key;
+    return codeFor(key.data, counterFor(options.at, parameters.data.step), parameters.data);
+}
+/**
+ * Checks a submitted code against the current step and the drift window.
+ *
+ * Every step in the window is compared in constant time even after a match,
+ * so timing never reveals which step matched.
+ *
+ * @param secret Base32 shared secret.
+ * @param code Code submitted by the user.
+ * @param options Time, step, digits, hash function, and drift window.
+ * @returns Whether the code is valid, or why it could not be checked.
+ * @example
+ * let ok = await totp.verify(secret, form.code, { window: 1 });
+ */
+async function verifyCode(secret, code, options = {}) {
+    let parameters = resolve(options);
+    if (isFailure(parameters))
+        return parameters;
+    let window = options.window ?? DEFAULT_WINDOW;
+    if (!Number.isInteger(window) || window < 0) {
+        return failure(new CryptoError("TOTP window must be a non-negative whole number of steps"));
+    }
+    let key = decodeBase32(secret);
+    if (isFailure(key))
+        return key;
+    if (!DIGITS_PATTERN.test(code) || code.length !== parameters.data.digits)
+        return success(false);
+    let counter = counterFor(options.at, parameters.data.step);
+    let matched = false;
+    for (let offset = -window; offset <= window; offset++) {
+        if (counter + offset < 0)
+            continue;
+        let expected = await codeFor(key.data, counter + offset, parameters.data);
+        if (isFailure(expected))
+            return expected;
+        if (timingSafeEqual(expected.data, code))
+            matched = true;
+    }
+    return success(matched);
+}
+/**
+ * Builds the `otpauth://` URI an authenticator app scans during enrollment.
+ *
+ * The issuer appears both in the label and as a query parameter, which is what
+ * apps need to group and name the entry consistently.
+ *
+ * @param secret Base32 shared secret.
+ * @param options Issuer, account, and the parameters the app must mirror.
+ * @returns URI to render as a QR code or offer as a manual setup link.
+ * @example
+ * totp.uri(secret, { issuer: "Acme", account: "ada@example.com" });
+ */
+function buildUri(secret, options) {
+    let label = `${encodeURIComponent(options.issuer)}:${encodeURIComponent(options.account)}`;
+    let query = new URLSearchParams({
+        secret,
+        issuer: options.issuer,
+        algorithm: (options.algorithm ?? DEFAULT_ALGORITHM).replace("-", ""),
+        digits: String(options.digits ?? DEFAULT_DIGITS),
+        period: String(options.step ?? DEFAULT_STEP_SECONDS),
+    });
+    return `otpauth://totp/${label}?${query.toString().replaceAll("+", "%20")}`;
+}
+/**
+ * RFC 6238 one-time passwords: secrets, codes, verification, and enrollment URIs.
+ *
+ * @example
+ * let secret = totp.generateSecret();
+ * let uri = totp.uri(secret, { issuer: "Acme", account: "ada@example.com" });
+ * let ok = await totp.verify(secret, submittedCode, { window: 1 });
+ */
+export const totp = {
+    generateSecret,
+    code: generateCode,
+    verify: verifyCode,
+    uri: buildUri,
+};

package/package.json

@@ -0,0 +1,22 @@
+{
+	"name": "@sdxc/crypto",
+	"version": "0.0.0-pre.1",
+	"description": "WebCrypto primitives: hashing, HMAC, passwords, TOTP, AES-GCM",
+	"license": "MIT",
+	"type": "module",
+	"exports": {
+		".": "./dist/index.js"
+	},
+	"dependencies": {
+		"@sdxc/result": "0.0.0-pre.1"
+	},
+	"gitHead": "bbc1db99f3fcc3c903251a70582c6b0cf8e808cb",
+	"publishConfig": {
+		"access": "public"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/sergiodxa/monorepo.git",
+		"directory": "packages/crypto"
+	}
+}