@sebastienrousseau/crypto-lib 0.0.2 → 0.0.7

package/dist/registry.d.ts

@@ -0,0 +1,20 @@
+export type AlgorithmCategory = "encryption" | "hash" | "kdf" | "mac" | "signing" | "key-exchange" | "kem";
+export type SecurityLevel = 1 | 2 | 3 | 5;
+export type AlgorithmStatus = "recommended" | "acceptable" | "deprecated" | "experimental";
+export interface AlgorithmInfo {
+    id: string;
+    name: string;
+    category: AlgorithmCategory;
+    securityLevel: SecurityLevel;
+    status: AlgorithmStatus;
+    standard?: string | undefined;
+    aliases?: string[] | undefined;
+}
+export declare function getAlgorithm(idOrAlias: string): AlgorithmInfo | undefined;
+export declare function listAlgorithms(filters?: {
+    category?: AlgorithmCategory | undefined;
+    status?: AlgorithmStatus | undefined;
+}): AlgorithmInfo[];
+export declare function recommended(category?: AlgorithmCategory): AlgorithmInfo[];
+export declare function isDeprecated(idOrAlias: string): boolean;
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,iBAAiB,GAC3B,YAAY,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,cAAc,GAAG,KAAK,CAAC;AAG7E,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAG1C,MAAM,MAAM,eAAe,GACzB,aAAa,GAAG,YAAY,GAAG,YAAY,GAAG,cAAc,CAAC;AAG/D,MAAM,WAAW,aAAa;IAE5B,EAAE,EAAE,MAAM,CAAC;IAEX,IAAI,EAAE,MAAM,CAAC;IAEb,QAAQ,EAAE,iBAAiB,CAAC;IAE5B,aAAa,EAAE,aAAa,CAAC;IAE7B,MAAM,EAAE,eAAe,CAAC;IAExB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE9B,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAChC;AAqYD,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAGzE;AAKD,wBAAgB,cAAc,CAAC,OAAO,CAAC,EAAE;IACvC,QAAQ,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACzC,MAAM,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;CACtC,GAAG,aAAa,EAAE,CASlB;AAKD,wBAAgB,WAAW,CAAC,QAAQ,CAAC,EAAE,iBAAiB,GAAG,aAAa,EAAE,CAQzE;AAKD,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAGvD"}

package/dist/registry.js

@@ -0,0 +1,399 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAlgorithm = getAlgorithm;
+exports.listAlgorithms = listAlgorithms;
+exports.recommended = recommended;
+exports.isDeprecated = isDeprecated;
+const REGISTRY = [
+    {
+        id: "xchacha20-poly1305",
+        name: "XChaCha20-Poly1305",
+        category: "encryption",
+        securityLevel: 1,
+        status: "recommended",
+        standard: "draft-irtf-cfrg-xchacha",
+    },
+    {
+        id: "aes-256-gcm",
+        name: "AES-256-GCM",
+        category: "encryption",
+        securityLevel: 1,
+        status: "recommended",
+        standard: "NIST SP 800-38D",
+        aliases: ["aes256gcm"],
+    },
+    {
+        id: "aes-128-gcm",
+        name: "AES-128-GCM",
+        category: "encryption",
+        securityLevel: 1,
+        status: "acceptable",
+        standard: "NIST SP 800-38D",
+        aliases: ["aes128gcm"],
+    },
+    {
+        id: "aes-256-gcm-siv",
+        name: "AES-256-GCM-SIV",
+        category: "encryption",
+        securityLevel: 1,
+        status: "recommended",
+        standard: "RFC 8452",
+        aliases: ["aes256gcmsiv"],
+    },
+    {
+        id: "aes-128-gcm-siv",
+        name: "AES-128-GCM-SIV",
+        category: "encryption",
+        securityLevel: 1,
+        status: "acceptable",
+        standard: "RFC 8452",
+    },
+    {
+        id: "sha256",
+        name: "SHA-256",
+        category: "hash",
+        securityLevel: 1,
+        status: "recommended",
+        standard: "FIPS 180-4",
+    },
+    {
+        id: "sha384",
+        name: "SHA-384",
+        category: "hash",
+        securityLevel: 1,
+        status: "recommended",
+        standard: "FIPS 180-4",
+    },
+    {
+        id: "sha512",
+        name: "SHA-512",
+        category: "hash",
+        securityLevel: 1,
+        status: "recommended",
+        standard: "FIPS 180-4",
+    },
+    {
+        id: "sha3-256",
+        name: "SHA3-256",
+        category: "hash",
+        securityLevel: 1,
+        status: "recommended",
+        standard: "FIPS 202",
+    },
+    {
+        id: "sha3-512",
+        name: "SHA3-512",
+        category: "hash",
+        securityLevel: 1,
+        status: "recommended",
+        standard: "FIPS 202",
+    },
+    {
+        id: "blake2b",
+        name: "BLAKE2b",
+        category: "hash",
+        securityLevel: 1,
+        status: "acceptable",
+        standard: "RFC 7693",
+    },
+    {
+        id: "blake3",
+        name: "BLAKE3",
+        category: "hash",
+        securityLevel: 1,
+        status: "acceptable",
+    },
+    {
+        id: "argon2id",
+        name: "Argon2id",
+        category: "kdf",
+        securityLevel: 1,
+        status: "recommended",
+        standard: "RFC 9106",
+    },
+    {
+        id: "hkdf-sha256",
+        name: "HKDF-SHA256",
+        category: "kdf",
+        securityLevel: 1,
+        status: "recommended",
+        standard: "RFC 5869",
+    },
+    {
+        id: "scrypt",
+        name: "scrypt",
+        category: "kdf",
+        securityLevel: 1,
+        status: "acceptable",
+        standard: "RFC 7914",
+    },
+    {
+        id: "pbkdf2-sha256",
+        name: "PBKDF2-SHA256",
+        category: "kdf",
+        securityLevel: 1,
+        status: "deprecated",
+        standard: "RFC 8018",
+    },
+    {
+        id: "hmac-sha256",
+        name: "HMAC-SHA256",
+        category: "mac",
+        securityLevel: 1,
+        status: "recommended",
+        standard: "RFC 2104",
+    },
+    {
+        id: "hmac-sha384",
+        name: "HMAC-SHA384",
+        category: "mac",
+        securityLevel: 1,
+        status: "recommended",
+    },
+    {
+        id: "hmac-sha512",
+        name: "HMAC-SHA512",
+        category: "mac",
+        securityLevel: 1,
+        status: "recommended",
+    },
+    {
+        id: "hmac-sha3-256",
+        name: "HMAC-SHA3-256",
+        category: "mac",
+        securityLevel: 1,
+        status: "recommended",
+    },
+    {
+        id: "hmac-sha3-512",
+        name: "HMAC-SHA3-512",
+        category: "mac",
+        securityLevel: 1,
+        status: "recommended",
+    },
+    {
+        id: "kmac-128",
+        name: "KMAC-128",
+        category: "mac",
+        securityLevel: 1,
+        status: "recommended",
+        standard: "NIST SP 800-185",
+    },
+    {
+        id: "kmac-256",
+        name: "KMAC-256",
+        category: "mac",
+        securityLevel: 1,
+        status: "recommended",
+        standard: "NIST SP 800-185",
+    },
+    {
+        id: "ed25519",
+        name: "Ed25519",
+        category: "signing",
+        securityLevel: 1,
+        status: "recommended",
+        standard: "RFC 8032",
+    },
+    {
+        id: "ed448",
+        name: "Ed448",
+        category: "signing",
+        securityLevel: 2,
+        status: "recommended",
+        standard: "RFC 8032",
+    },
+    {
+        id: "ecdsa-p256",
+        name: "ECDSA P-256",
+        category: "signing",
+        securityLevel: 1,
+        status: "acceptable",
+        standard: "FIPS 186-5",
+    },
+    {
+        id: "ecdsa-p384",
+        name: "ECDSA P-384",
+        category: "signing",
+        securityLevel: 2,
+        status: "acceptable",
+        standard: "FIPS 186-5",
+    },
+    {
+        id: "ml-dsa-44",
+        name: "ML-DSA-44",
+        category: "signing",
+        securityLevel: 2,
+        status: "recommended",
+        standard: "FIPS 204",
+    },
+    {
+        id: "ml-dsa-65",
+        name: "ML-DSA-65",
+        category: "signing",
+        securityLevel: 3,
+        status: "recommended",
+        standard: "FIPS 204",
+    },
+    {
+        id: "ml-dsa-87",
+        name: "ML-DSA-87",
+        category: "signing",
+        securityLevel: 5,
+        status: "recommended",
+        standard: "FIPS 204",
+    },
+    {
+        id: "slh-dsa-shake-256s",
+        name: "SLH-DSA-SHAKE-256s",
+        category: "signing",
+        securityLevel: 5,
+        status: "recommended",
+        standard: "FIPS 205",
+    },
+    {
+        id: "slh-dsa-shake-128f",
+        name: "SLH-DSA-SHAKE-128f",
+        category: "signing",
+        securityLevel: 1,
+        status: "acceptable",
+        standard: "FIPS 205",
+    },
+    {
+        id: "schnorr",
+        name: "Schnorr (BIP-340)",
+        category: "signing",
+        securityLevel: 1,
+        status: "acceptable",
+        standard: "BIP-340",
+        aliases: ["bip340", "schnorr-secp256k1"],
+    },
+    {
+        id: "x25519",
+        name: "X25519",
+        category: "key-exchange",
+        securityLevel: 1,
+        status: "recommended",
+        standard: "RFC 7748",
+    },
+    {
+        id: "x448",
+        name: "X448",
+        category: "key-exchange",
+        securityLevel: 2,
+        status: "recommended",
+        standard: "RFC 7748",
+    },
+    {
+        id: "ecdh-p256",
+        name: "ECDH P-256",
+        category: "key-exchange",
+        securityLevel: 1,
+        status: "acceptable",
+    },
+    {
+        id: "ecdh-p384",
+        name: "ECDH P-384",
+        category: "key-exchange",
+        securityLevel: 2,
+        status: "acceptable",
+    },
+    {
+        id: "ml-kem-512",
+        name: "ML-KEM-512",
+        category: "kem",
+        securityLevel: 1,
+        status: "acceptable",
+        standard: "FIPS 203",
+    },
+    {
+        id: "ml-kem-768",
+        name: "ML-KEM-768",
+        category: "kem",
+        securityLevel: 3,
+        status: "recommended",
+        standard: "FIPS 203",
+    },
+    {
+        id: "ml-kem-1024",
+        name: "ML-KEM-1024",
+        category: "kem",
+        securityLevel: 5,
+        status: "recommended",
+        standard: "FIPS 203",
+    },
+    {
+        id: "x25519-ml-kem-768",
+        name: "X25519+ML-KEM-768 Hybrid",
+        category: "kem",
+        securityLevel: 3,
+        status: "recommended",
+    },
+    {
+        id: "x25519-ml-kem-512",
+        name: "X25519+ML-KEM-512 Hybrid",
+        category: "kem",
+        securityLevel: 1,
+        status: "acceptable",
+    },
+    {
+        id: "x25519-ml-kem-1024",
+        name: "X25519+ML-KEM-1024 Hybrid",
+        category: "kem",
+        securityLevel: 5,
+        status: "recommended",
+    },
+    {
+        id: "p256-ml-kem-768",
+        name: "P-256+ML-KEM-768 Hybrid",
+        category: "kem",
+        securityLevel: 3,
+        status: "recommended",
+        standard: "IETF draft-ietf-tls-ecdhe-mlkem",
+    },
+    {
+        id: "x448-ml-kem-1024",
+        name: "X448+ML-KEM-1024 Hybrid",
+        category: "kem",
+        securityLevel: 5,
+        status: "recommended",
+    },
+];
+const aliasMap = new Map();
+const idMap = new Map();
+for (const algo of REGISTRY) {
+    idMap.set(algo.id, algo);
+    if (algo.aliases) {
+        for (const alias of algo.aliases) {
+            aliasMap.set(alias, algo.id);
+        }
+    }
+}
+function getAlgorithm(idOrAlias) {
+    const resolved = aliasMap.get(idOrAlias) ?? idOrAlias;
+    return idMap.get(resolved);
+}
+function listAlgorithms(filters) {
+    let result = REGISTRY;
+    if (filters?.category) {
+        result = result.filter((a) => a.category === filters.category);
+    }
+    if (filters?.status) {
+        result = result.filter((a) => a.status === filters.status);
+    }
+    return result;
+}
+function recommended(category) {
+    const filters = {
+        status: "recommended",
+    };
+    if (category) {
+        filters.category = category;
+    }
+    return listAlgorithms(filters);
+}
+function isDeprecated(idOrAlias) {
+    const algo = getAlgorithm(idOrAlias);
+    return algo?.status === "deprecated";
+}
+//# sourceMappingURL=registry.js.map

package/dist/streaming/index.d.ts

@@ -0,0 +1,7 @@
+export { createHasher, STREAM_HASH_ALGORITHMS } from "./stream-hash";
+export type { StreamingHasher, StreamHashAlgorithm } from "./stream-hash";
+export { streamEncrypt, streamDecrypt } from "./stream-aead";
+export type { StreamEncryptOptions, StreamEncryptResult, StreamDecryptOptions, } from "./stream-aead";
+export { createEncryptStream, createDecryptStream, createHashStream, WEB_STREAM_HASH_ALGORITHMS, } from "./web-streams";
+export type { WebStreamHashAlgorithm, HashStreamResult, EncryptStreamOptions, DecryptStreamOptions, CryptoTransformStream, } from "./web-streams";
+//# sourceMappingURL=index.d.ts.map

package/dist/streaming/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/streaming/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAErE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAE1E,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE7D,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,eAAe,CAAC"}

package/dist/streaming/index.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WEB_STREAM_HASH_ALGORITHMS = exports.createHashStream = exports.createDecryptStream = exports.createEncryptStream = exports.streamDecrypt = exports.streamEncrypt = exports.STREAM_HASH_ALGORITHMS = exports.createHasher = void 0;
+var stream_hash_1 = require("./stream-hash");
+Object.defineProperty(exports, "createHasher", { enumerable: true, get: function () { return stream_hash_1.createHasher; } });
+Object.defineProperty(exports, "STREAM_HASH_ALGORITHMS", { enumerable: true, get: function () { return stream_hash_1.STREAM_HASH_ALGORITHMS; } });
+var stream_aead_1 = require("./stream-aead");
+Object.defineProperty(exports, "streamEncrypt", { enumerable: true, get: function () { return stream_aead_1.streamEncrypt; } });
+Object.defineProperty(exports, "streamDecrypt", { enumerable: true, get: function () { return stream_aead_1.streamDecrypt; } });
+var web_streams_1 = require("./web-streams");
+Object.defineProperty(exports, "createEncryptStream", { enumerable: true, get: function () { return web_streams_1.createEncryptStream; } });
+Object.defineProperty(exports, "createDecryptStream", { enumerable: true, get: function () { return web_streams_1.createDecryptStream; } });
+Object.defineProperty(exports, "createHashStream", { enumerable: true, get: function () { return web_streams_1.createHashStream; } });
+Object.defineProperty(exports, "WEB_STREAM_HASH_ALGORITHMS", { enumerable: true, get: function () { return web_streams_1.WEB_STREAM_HASH_ALGORITHMS; } });
+//# sourceMappingURL=index.js.map

package/dist/streaming/stream-aead.d.ts

@@ -0,0 +1,17 @@
+export interface StreamEncryptOptions {
+    key: string | Uint8Array;
+    plaintext: Uint8Array;
+    chunkSize?: number;
+}
+export interface StreamEncryptResult {
+    ciphertext: Uint8Array;
+    algorithm: "xchacha20-poly1305-stream";
+}
+export interface StreamDecryptOptions {
+    key: string | Uint8Array;
+    ciphertext: Uint8Array;
+    chunkSize?: number;
+}
+export declare function streamEncrypt(options: StreamEncryptOptions): StreamEncryptResult;
+export declare function streamDecrypt(options: StreamDecryptOptions): Uint8Array;
+//# sourceMappingURL=stream-aead.d.ts.map

package/dist/streaming/stream-aead.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-aead.d.ts","sourceRoot":"","sources":["../../src/streaming/stream-aead.ts"],"names":[],"mappings":"AAkEA,MAAM,WAAW,oBAAoB;IAEnC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC;IAEzB,SAAS,EAAE,UAAU,CAAC;IAEtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAGD,MAAM,WAAW,mBAAmB;IAElC,UAAU,EAAE,UAAU,CAAC;IAEvB,SAAS,EAAE,2BAA2B,CAAC;CACxC;AAGD,MAAM,WAAW,oBAAoB;IAEnC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC;IAEzB,UAAU,EAAE,UAAU,CAAC;IAEvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA2BD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,oBAAoB,GAC5B,mBAAmB,CA8CrB;AAsCD,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,UAAU,CAwDvE"}

package/dist/streaming/stream-aead.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.streamEncrypt = streamEncrypt;
+exports.streamDecrypt = streamDecrypt;
+const chacha_js_1 = require("@noble/ciphers/chacha.js");
+const utils_js_1 = require("@noble/ciphers/utils.js");
+const NONCE_LEN = 24;
+const TAG_LEN = 16;
+const DEFAULT_CHUNK_SIZE = 64 * 1024;
+const CHUNK_TAG_MESSAGE = 0x00;
+const CHUNK_TAG_FINAL = 0x01;
+function deriveChunkNonce(baseNonce, counter, tag) {
+    const nonce = new Uint8Array(baseNonce);
+    const view = new DataView(nonce.buffer, nonce.byteOffset, nonce.byteLength);
+    const low = counter & 0xffffffff;
+    const high = (counter / 0x100000000) | 0;
+    view.setUint32(nonce.length - 8, view.getUint32(nonce.length - 8) ^ low, true);
+    view.setUint32(nonce.length - 4, view.getUint32(nonce.length - 4) ^ high, true);
+    nonce[0] = nonce[0] ^ tag;
+    return nonce;
+}
+const HEX_RE = /^[0-9a-fA-F]*$/;
+function toKey(key) {
+    if (key instanceof Uint8Array) {
+        if (key.length !== 32) {
+            throw new Error(`Key must be 32 bytes, got ${key.length}`);
+        }
+        return key;
+    }
+    if (!HEX_RE.test(key))
+        throw new Error("Invalid hex key");
+    const buf = Buffer.from(key, "hex");
+    if (buf.length !== 32) {
+        throw new Error(`Key must be 32 bytes (256 bits), got ${buf.length}`);
+    }
+    return buf;
+}
+function streamEncrypt(options) {
+    const key = toKey(options.key);
+    const chunkSize = options.chunkSize ?? DEFAULT_CHUNK_SIZE;
+    const plaintext = options.plaintext;
+    const baseNonce = (0, utils_js_1.randomBytes)(NONCE_LEN);
+    const numFullChunks = Math.floor(plaintext.length / chunkSize);
+    const lastChunkLen = plaintext.length - numFullChunks * chunkSize;
+    const hasExtraChunk = lastChunkLen > 0 || plaintext.length === 0;
+    const totalChunks = hasExtraChunk ? numFullChunks + 1 : numFullChunks;
+    let outputSize = NONCE_LEN;
+    for (let i = 0; i < totalChunks; i++) {
+        const ptLen = i < numFullChunks ? chunkSize : lastChunkLen > 0 ? lastChunkLen : 0;
+        outputSize += 1 + ptLen + TAG_LEN;
+    }
+    const output = new Uint8Array(outputSize);
+    output.set(baseNonce);
+    let offset = NONCE_LEN;
+    for (let i = 0; i < totalChunks; i++) {
+        const isFinal = i === totalChunks - 1;
+        const chunkTag = isFinal ? CHUNK_TAG_FINAL : CHUNK_TAG_MESSAGE;
+        const start = i * chunkSize;
+        const end = isFinal ? plaintext.length : start + chunkSize;
+        const chunk = plaintext.subarray(start, end);
+        const nonce = deriveChunkNonce(baseNonce, i, chunkTag);
+        const cipher = (0, chacha_js_1.xchacha20poly1305)(key, nonce);
+        const encrypted = cipher.encrypt(chunk);
+        output[offset] = chunkTag;
+        offset += 1;
+        output.set(encrypted, offset);
+        offset += encrypted.length;
+    }
+    return {
+        ciphertext: output,
+        algorithm: "xchacha20-poly1305-stream",
+    };
+}
+function readChunkHeader(ciphertext, offset, chunkSize) {
+    const chunkTag = ciphertext[offset];
+    if (chunkTag !== CHUNK_TAG_MESSAGE && chunkTag !== CHUNK_TAG_FINAL) {
+        throw new Error(`Invalid chunk tag: 0x${chunkTag.toString(16)}`);
+    }
+    const isFinal = chunkTag === CHUNK_TAG_FINAL;
+    const start = offset + 1;
+    const encLen = isFinal ? ciphertext.length - start : chunkSize + TAG_LEN;
+    if (start + encLen > ciphertext.length) {
+        throw new Error("Ciphertext truncated — incomplete chunk");
+    }
+    return { chunkTag, isFinal, encLen };
+}
+function streamDecrypt(options) {
+    const key = toKey(options.key);
+    const chunkSize = options.chunkSize ?? DEFAULT_CHUNK_SIZE;
+    const ciphertext = options.ciphertext;
+    if (ciphertext.length < NONCE_LEN + 1 + TAG_LEN) {
+        throw new Error("Ciphertext too short — missing header or chunk data");
+    }
+    const baseNonce = ciphertext.subarray(0, NONCE_LEN);
+    let offset = NONCE_LEN;
+    const plaintextChunks = [];
+    let totalPtLen = 0;
+    let sawFinal = false;
+    while (offset < ciphertext.length) {
+        const { chunkTag, isFinal, encLen } = readChunkHeader(ciphertext, offset, chunkSize);
+        offset += 1;
+        const chunkIdx = plaintextChunks.length;
+        const nonce = deriveChunkNonce(baseNonce, chunkIdx, chunkTag);
+        const cipher = (0, chacha_js_1.xchacha20poly1305)(key, nonce);
+        const decrypted = cipher.decrypt(ciphertext.subarray(offset, offset + encLen));
+        plaintextChunks.push(decrypted);
+        totalPtLen += decrypted.length;
+        offset += encLen;
+        if (isFinal) {
+            sawFinal = true;
+            break;
+        }
+    }
+    if (!sawFinal) {
+        throw new Error("Ciphertext truncated — final chunk missing");
+    }
+    const result = new Uint8Array(totalPtLen);
+    let pos = 0;
+    for (const chunk of plaintextChunks) {
+        result.set(chunk, pos);
+        pos += chunk.length;
+    }
+    return result;
+}
+//# sourceMappingURL=stream-aead.js.map

package/dist/streaming/stream-hash.d.ts

@@ -0,0 +1,9 @@
+export declare const STREAM_HASH_ALGORITHMS: readonly ["sha256", "sha384", "sha512", "sha3-256", "sha3-512", "blake2b", "blake3"];
+export type StreamHashAlgorithm = (typeof STREAM_HASH_ALGORITHMS)[number];
+export interface StreamingHasher {
+    update(data: string | Uint8Array): StreamingHasher;
+    digest(): string;
+    digestBytes(): Uint8Array;
+}
+export declare function createHasher(algorithm: StreamHashAlgorithm): StreamingHasher;
+//# sourceMappingURL=stream-hash.d.ts.map

package/dist/streaming/stream-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-hash.d.ts","sourceRoot":"","sources":["../../src/streaming/stream-hash.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,sBAAsB,sFAQzB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAoB1E,MAAM,WAAW,eAAe;IAE9B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,eAAe,CAAC;IAEnD,MAAM,IAAI,MAAM,CAAC;IAEjB,WAAW,IAAI,UAAU,CAAC;CAC3B;AAYD,wBAAgB,YAAY,CAAC,SAAS,EAAE,mBAAmB,GAAG,eAAe,CAwB5E"}

package/dist/streaming/stream-hash.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STREAM_HASH_ALGORITHMS = void 0;
+exports.createHasher = createHasher;
+const sha2_js_1 = require("@noble/hashes/sha2.js");
+const sha3_js_1 = require("@noble/hashes/sha3.js");
+const blake2_js_1 = require("@noble/hashes/blake2.js");
+const blake3_js_1 = require("@noble/hashes/blake3.js");
+exports.STREAM_HASH_ALGORITHMS = [
+    "sha256",
+    "sha384",
+    "sha512",
+    "sha3-256",
+    "sha3-512",
+    "blake2b",
+    "blake3",
+];
+const factories = {
+    sha256: () => sha2_js_1.sha256.create(),
+    sha384: () => sha2_js_1.sha384.create(),
+    sha512: () => sha2_js_1.sha512.create(),
+    "sha3-256": () => sha3_js_1.sha3_256.create(),
+    "sha3-512": () => sha3_js_1.sha3_512.create(),
+    blake2b: () => blake2_js_1.blake2b.create(),
+    blake3: () => blake3_js_1.blake3.create(),
+};
+function createHasher(algorithm) {
+    const factory = factories[algorithm];
+    if (!factory) {
+        throw new Error(`Unsupported streaming hash algorithm: ${algorithm}`);
+    }
+    const inner = factory();
+    let finalized = false;
+    return {
+        update(data) {
+            if (finalized)
+                throw new Error("Hasher already finalized");
+            const bytes = typeof data === "string" ? Buffer.from(data, "utf8") : data;
+            inner.update(bytes);
+            return this;
+        },
+        digest() {
+            finalized = true;
+            return Buffer.from(inner.digest()).toString("hex");
+        },
+        digestBytes() {
+            finalized = true;
+            return inner.digest();
+        },
+    };
+}
+//# sourceMappingURL=stream-hash.js.map

package/dist/streaming/web-streams.d.ts

@@ -0,0 +1,17 @@
+export type CryptoTransformStream<I, O> = import("stream/web").TransformStream<I, O>;
+export type WebStreamHashAlgorithm = "sha256" | "sha512" | "sha3-256" | "sha3-512" | "blake3";
+export declare const WEB_STREAM_HASH_ALGORITHMS: readonly WebStreamHashAlgorithm[];
+export interface HashStreamResult {
+    digest: string;
+    algorithm: WebStreamHashAlgorithm;
+}
+export interface EncryptStreamOptions {
+    key: string | Uint8Array;
+}
+export interface DecryptStreamOptions {
+    key: string | Uint8Array;
+}
+export declare function createEncryptStream(options: EncryptStreamOptions): CryptoTransformStream<Uint8Array, Uint8Array>;
+export declare function createDecryptStream(options: DecryptStreamOptions): CryptoTransformStream<Uint8Array, Uint8Array>;
+export declare function createHashStream(algorithm: WebStreamHashAlgorithm): CryptoTransformStream<Uint8Array, HashStreamResult>;
+//# sourceMappingURL=web-streams.d.ts.map

package/dist/streaming/web-streams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-streams.d.ts","sourceRoot":"","sources":["../../src/streaming/web-streams.ts"],"names":[],"mappings":"AA6BA,MAAM,MAAM,qBAAqB,CAAC,CAAC,EAAE,CAAC,IAAI,OAAO,YAAY,EAAE,eAAe,CAC5E,CAAC,EACD,CAAC,CACF,CAAC;AAMF,MAAM,MAAM,sBAAsB,GAChC,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;AAY3D,eAAO,MAAM,0BAA0B,EAAE,SAAS,sBAAsB,EAM9D,CAAC;AAUX,MAAM,WAAW,gBAAgB;IAE/B,MAAM,EAAE,MAAM,CAAC;IAEf,SAAS,EAAE,sBAAsB,CAAC;CACnC;AAUD,MAAM,WAAW,oBAAoB;IAEnC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC;CAC1B;AAUD,MAAM,WAAW,oBAAoB;IAEnC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC;CAC1B;AAkDD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,oBAAoB,GAC5B,qBAAqB,CAAC,UAAU,EAAE,UAAU,CAAC,CA8B/C;AAoBD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,oBAAoB,GAC5B,qBAAqB,CAAC,UAAU,EAAE,UAAU,CAAC,CA8B/C;AAuBD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,sBAAsB,GAChC,qBAAqB,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAgBrD"}