@sebastienrousseau/crypto-lib 0.0.3 → 0.0.8

package/dist/lib/session.js

@@ -15,56 +15,41 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.session = void 0;
 const openpgp = __importStar(require("openpgp"));
-const args = process.argv.slice(2);
 const session = async (data) => {
-    const publicKeyBase64 = data.publicKey;
-    const publicKeyBuffer = Buffer.from(publicKeyBase64, "base64");
-    const publicKey = publicKeyBuffer.toString("utf-8");
-    const EncryptSessionKeyOptions = {
-        encryptionKeys: await openpgp.readKey({
-            armoredKey: publicKey,
-        }),
-        format: "armored",
-        wildcard: true,
-        date: new Date(),
-        encryptionUserIDs: [{ name: data.name, email: data.email }],
-    };
-    const sessionKey = await openpgp.generateSessionKey(EncryptSessionKeyOptions && {
-        encryptionKeys: await openpgp.readKey({
-            armoredKey: publicKey,
-        }),
+    const publicKeyArmored = Buffer.from(data.publicKey, "base64").toString("latin1");
+    const encryptionKey = await openpgp.readKey({ armoredKey: publicKeyArmored });
+    return openpgp.generateSessionKey({
+        encryptionKeys: encryptionKey,
         date: new Date(),
         encryptionUserIDs: [{ name: data.name, email: data.email }],
         config: {
             preferredHashAlgorithm: 8,
             preferredSymmetricAlgorithm: 9,
             preferredCompressionAlgorithm: 1,
-            checksumRequired: true,
             minRSABits: 2048,
-            passwordCollisionCheck: true,
         },
     });
-    console.log(sessionKey);
-    return sessionKey;
 };
 exports.session = session;
-if (args instanceof Array && args.length) {
-    const data = {
-        email: args[1],
-        name: args[3],
-        publicKey: args[5],
-    };
-    (0, exports.session)(data);
-}
 exports.default = exports.session;
 //# sourceMappingURL=session.js.map

package/dist/lib/sign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/lib/sign.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAC;AA0CxC,eAAO,MAAM,IAAI,SAAgB,MAAM,QAAQ,oBAmC9C,CAAC;AAaF,eAAe,IAAI,CAAC"}
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/lib/sign.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAC;AAiBxC,eAAO,MAAM,IAAI,GAAU,MAAM,KAAK,CAAC,QAAQ,KAAG,OAAO,CAAC,MAAM,CA6B/D,CAAC;AAGF,eAAe,IAAI,CAAC"}

package/dist/lib/sign.js

@@ -15,56 +15,49 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sign = void 0;
 const promises_1 = require("fs/promises");
-const key = __importStar(require("../key/key"));
+const path = __importStar(require("path"));
 const openpgp = __importStar(require("openpgp"));
-const args = process.argv.slice(2);
+const keystore_1 = require("../key/keystore");
 const sign = async (data) => {
-    const passphrase = data.passphrase;
-    const message = data.message;
-    const detached = data.detached;
-    const unsignedMessage = await openpgp.createCleartextMessage({
-        text: message,
-    });
-    const privateKeyRead = await openpgp.decryptKey({
-        privateKey: await openpgp.readPrivateKey({
-            armoredKey: key.PrivateKey,
-        }),
-        passphrase,
-    });
-    const signOptions = {
-        detached: detached,
-        message: unsignedMessage,
-        signingKeys: privateKeyRead,
-    };
-    const signed = await openpgp.sign(signOptions && {
-        message: unsignedMessage,
-        signingKeys: privateKeyRead,
-    });
-    console.log(signed);
-    const signedMsg = await (0, promises_1.writeFile)("./src/data/signed.sig", Buffer.from(signed.toString()).toString("base64"));
-    signedMsg;
+    const { passphrase, message, detached } = data;
+    const { privateKeyArmored } = await (0, keystore_1.loadKeystore)();
+    const privateKey = await (0, keystore_1.unlockPrivateKey)(privateKeyArmored, passphrase);
+    const signed = detached
+        ? await openpgp.sign({
+            message: await openpgp.createMessage({ text: message }),
+            signingKeys: privateKey,
+            detached: true,
+        })
+        : await openpgp.sign({
+            message: await openpgp.createCleartextMessage({ text: message }),
+            signingKeys: privateKey,
+        });
+    const sigDir = process.env["CRYPTO_DATA_DIR"];
+    if (sigDir) {
+        await (0, promises_1.writeFile)(path.join(sigDir, "signed.sig"), signed, "utf8");
+    }
     return signed;
 };
 exports.sign = sign;
-if (args instanceof Array && args.length) {
-    const data = {
-        passphrase: args[1],
-        message: args[3],
-        detached: Boolean(args[5]),
-        publicKey: args[7],
-        privateKey: args[9],
-    };
-    (0, exports.sign)(data);
-}
 exports.default = exports.sign;
 //# sourceMappingURL=sign.js.map

package/dist/lib/verify.d.ts

@@ -1,7 +1,5 @@
 import * as openpgp from "openpgp";
 import * as types from "../types/types";
-export declare const verify: (data: types.dataVerify) => Promise<openpgp.VerifyMessageResult & {
-    data: openpgp.WebStream<string>;
-}>;
+export declare const verify: (data: types.dataVerify) => Promise<openpgp.VerifyMessageResult<GenericWebStream<T>>>;
 export default verify;
 //# sourceMappingURL=verify.d.ts.map

package/dist/lib/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/lib/verify.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAC;AAiBxC,eAAO,MAAM,MAAM,SAAgB,MAAM,UAAU;;EA0BlD,CAAC;AAUF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/lib/verify.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAC;AAgBxC,eAAO,MAAM,MAAM,GAAU,MAAM,KAAK,CAAC,UAAU,8DAalD,CAAC;AAGF,eAAe,MAAM,CAAC"}

package/dist/lib/verify.js

@@ -15,43 +15,38 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.verify = void 0;
-const fs_1 = require("fs");
 const openpgp = __importStar(require("openpgp"));
-const args = process.argv.slice(2);
 const verify = async (data) => {
-    const message = data.message;
-    const detachedSignatureBase64 = (0, fs_1.readFileSync)(process.cwd() + "/src/data/detached.sig");
-    const detachedSignature = Buffer.from(detachedSignatureBase64.toString(), "base64").toString("utf-8");
-    const publicKey = Buffer.from(data.publicKey.toString(), "base64").toString("utf-8");
-    const signature = await openpgp.readSignature({
-        armoredSignature: String(detachedSignature),
-    });
-    const verified = await openpgp.verify({
+    const { message, verificationKeys, date } = data;
+    const keyInput = Array.isArray(verificationKeys)
+        ? verificationKeys[0]
+        : verificationKeys;
+    const publicKey = Buffer.from(keyInput, "base64").toString("latin1");
+    return openpgp.verify({
         message: await openpgp.createMessage({ text: message }),
-        signature,
-        verificationKeys: await openpgp.readKey({
-            armoredKey: publicKey,
-        }),
+        verificationKeys: await openpgp.readKey({ armoredKey: publicKey }),
+        date,
     });
-    console.log(verified);
-    return verified;
 };
 exports.verify = verify;
-if (args instanceof Array && args.length) {
-    const data = {
-        message: args[1],
-        publicKey: args[3],
-    };
-    (0, exports.verify)(data);
-}
 exports.default = exports.verify;
 //# sourceMappingURL=verify.js.map

package/dist/modern/aead.d.ts

@@ -0,0 +1,17 @@
+export interface AeadEncryptResult {
+    ciphertext: string;
+    algorithm: "xchacha20-poly1305";
+}
+export interface AeadEncryptOptions {
+    key: string | Uint8Array;
+    plaintext: string | Uint8Array;
+    aad?: Uint8Array;
+}
+export interface AeadDecryptOptions {
+    key: string | Uint8Array;
+    ciphertext: string;
+    aad?: Uint8Array;
+}
+export declare function aeadEncrypt(options: AeadEncryptOptions): AeadEncryptResult;
+export declare function aeadDecrypt(options: AeadDecryptOptions): Uint8Array;
+//# sourceMappingURL=aead.d.ts.map

package/dist/modern/aead.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aead.d.ts","sourceRoot":"","sources":["../../src/modern/aead.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,iBAAiB;IAEhC,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,oBAAoB,CAAC;CACjC;AAGD,MAAM,WAAW,kBAAkB;IAEjC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC;IAEzB,SAAS,EAAE,MAAM,GAAG,UAAU,CAAC;IAE/B,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB;AAGD,MAAM,WAAW,kBAAkB;IAEjC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC;IAEzB,UAAU,EAAE,MAAM,CAAC;IAEnB,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB;AA4BD,wBAAgB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,iBAAiB,CAqB1E;AAOD,wBAAgB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,UAAU,CAgBnE"}

package/dist/modern/aead.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.aeadEncrypt = aeadEncrypt;
+exports.aeadDecrypt = aeadDecrypt;
+const chacha_js_1 = require("@noble/ciphers/chacha.js");
+const utils_js_1 = require("@noble/ciphers/utils.js");
+const HEX_RE = /^[0-9a-fA-F]*$/;
+function toBytes(input, encoding = "utf8") {
+    if (input instanceof Uint8Array)
+        return input;
+    if (encoding === "hex") {
+        if (!HEX_RE.test(input)) {
+            throw new Error("Invalid hex string");
+        }
+        return Buffer.from(input, "hex");
+    }
+    return Buffer.from(input, "utf8");
+}
+const NONCE_LENGTH = 24;
+function aeadEncrypt(options) {
+    const key = toBytes(options.key, "hex");
+    if (key.length !== 32) {
+        throw new Error(`Key must be 32 bytes (256 bits), got ${key.length}`);
+    }
+    const plaintext = toBytes(options.plaintext, "utf8");
+    const nonce = (0, utils_js_1.randomBytes)(NONCE_LENGTH);
+    const cipher = (0, chacha_js_1.xchacha20poly1305)(key, nonce, options.aad);
+    const sealed = cipher.encrypt(plaintext);
+    const combined = new Uint8Array(NONCE_LENGTH + sealed.length);
+    combined.set(nonce);
+    combined.set(sealed, NONCE_LENGTH);
+    return {
+        ciphertext: Buffer.from(combined).toString("base64"),
+        algorithm: "xchacha20-poly1305",
+    };
+}
+function aeadDecrypt(options) {
+    const key = toBytes(options.key, "hex");
+    if (key.length !== 32) {
+        throw new Error(`Key must be 32 bytes (256 bits), got ${key.length}`);
+    }
+    const combined = Buffer.from(options.ciphertext, "base64");
+    if (combined.length < NONCE_LENGTH + 16) {
+        throw new Error("Ciphertext too short — missing nonce or auth tag");
+    }
+    const nonce = combined.subarray(0, NONCE_LENGTH);
+    const sealed = combined.subarray(NONCE_LENGTH);
+    const cipher = (0, chacha_js_1.xchacha20poly1305)(key, nonce, options.aad);
+    return cipher.decrypt(sealed);
+}
+//# sourceMappingURL=aead.js.map

package/dist/modern/aes.d.ts

@@ -0,0 +1,35 @@
+export interface AesGcmEncryptOptions {
+    key: string | Uint8Array;
+    plaintext: string | Uint8Array;
+    aad?: Uint8Array;
+}
+export type AesGcmAlgorithm = "aes-256-gcm" | "aes-128-gcm";
+export type AesGcmSivAlgorithm = "aes-256-gcm-siv" | "aes-128-gcm-siv";
+export interface AesGcmEncryptResult {
+    ciphertext: string;
+    algorithm: AesGcmAlgorithm;
+}
+export interface AesGcmSivEncryptOptions {
+    key: string | Uint8Array;
+    plaintext: string | Uint8Array;
+    aad?: Uint8Array;
+}
+export interface AesGcmSivEncryptResult {
+    ciphertext: string;
+    algorithm: AesGcmSivAlgorithm;
+}
+export interface AesGcmSivDecryptOptions {
+    key: string | Uint8Array;
+    ciphertext: string;
+    aad?: Uint8Array;
+}
+export interface AesGcmDecryptOptions {
+    key: string | Uint8Array;
+    ciphertext: string;
+    aad?: Uint8Array;
+}
+export declare function aesGcmEncrypt(options: AesGcmEncryptOptions): AesGcmEncryptResult;
+export declare function aesGcmDecrypt(options: AesGcmDecryptOptions): Uint8Array;
+export declare function aesGcmSivEncrypt(options: AesGcmSivEncryptOptions): AesGcmSivEncryptResult;
+export declare function aesGcmSivDecrypt(options: AesGcmSivDecryptOptions): Uint8Array;
+//# sourceMappingURL=aes.d.ts.map

package/dist/modern/aes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aes.d.ts","sourceRoot":"","sources":["../../src/modern/aes.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,oBAAoB;IAEnC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC;IAEzB,SAAS,EAAE,MAAM,GAAG,UAAU,CAAC;IAE/B,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB;AAGD,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,aAAa,CAAC;AAE5D,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,iBAAiB,CAAC;AAGvE,MAAM,WAAW,mBAAmB;IAElC,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,eAAe,CAAC;CAC5B;AAGD,MAAM,WAAW,uBAAuB;IAEtC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC;IAEzB,SAAS,EAAE,MAAM,GAAG,UAAU,CAAC;IAE/B,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB;AAGD,MAAM,WAAW,sBAAsB;IAErC,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,kBAAkB,CAAC;CAC/B;AAGD,MAAM,WAAW,uBAAuB;IAEtC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC;IAEzB,UAAU,EAAE,MAAM,CAAC;IAEnB,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB;AAGD,MAAM,WAAW,oBAAoB;IAEnC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC;IAEzB,UAAU,EAAE,MAAM,CAAC;IAEnB,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB;AAoED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,oBAAoB,GAC5B,mBAAmB,CAcrB;AAOD,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,UAAU,CAKvE;AAaD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,sBAAsB,CAcxB;AAOD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,UAAU,CAK7E"}

package/dist/modern/aes.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.aesGcmEncrypt = aesGcmEncrypt;
+exports.aesGcmDecrypt = aesGcmDecrypt;
+exports.aesGcmSivEncrypt = aesGcmSivEncrypt;
+exports.aesGcmSivDecrypt = aesGcmSivDecrypt;
+const aes_js_1 = require("@noble/ciphers/aes.js");
+const utils_js_1 = require("@noble/ciphers/utils.js");
+const HEX_RE = /^[0-9a-fA-F]*$/;
+function toBytes(input, encoding = "utf8") {
+    if (input instanceof Uint8Array)
+        return input;
+    if (encoding === "hex") {
+        if (!HEX_RE.test(input)) {
+            throw new Error("Invalid hex string");
+        }
+        return Buffer.from(input, "hex");
+    }
+    return Buffer.from(input, "utf8");
+}
+const NONCE_LENGTH = 12;
+const TAG_LENGTH = 16;
+function validateAesKey(rawKey) {
+    const key = toBytes(rawKey, "hex");
+    if (key.length !== 16 && key.length !== 32) {
+        throw new Error(`Key must be 16 bytes (128 bits) or 32 bytes (256 bits), got ${key.length}`);
+    }
+    return key;
+}
+function packNonceAndSealed(nonce, sealed) {
+    const combined = new Uint8Array(NONCE_LENGTH + sealed.length);
+    combined.set(nonce);
+    combined.set(sealed, NONCE_LENGTH);
+    return Buffer.from(combined).toString("base64");
+}
+function unpackNonceAndSealed(ciphertext) {
+    const combined = Buffer.from(ciphertext, "base64");
+    if (combined.length < NONCE_LENGTH + TAG_LENGTH) {
+        throw new Error("Ciphertext too short — missing nonce or auth tag");
+    }
+    return {
+        nonce: combined.subarray(0, NONCE_LENGTH),
+        sealed: combined.subarray(NONCE_LENGTH),
+    };
+}
+function aesGcmEncrypt(options) {
+    const key = validateAesKey(options.key);
+    const plaintext = toBytes(options.plaintext, "utf8");
+    const nonce = (0, utils_js_1.randomBytes)(NONCE_LENGTH);
+    const cipher = (0, aes_js_1.gcm)(key, nonce, options.aad);
+    const sealed = cipher.encrypt(plaintext);
+    const algorithm = key.length === 32 ? "aes-256-gcm" : "aes-128-gcm";
+    return {
+        ciphertext: packNonceAndSealed(nonce, sealed),
+        algorithm,
+    };
+}
+function aesGcmDecrypt(options) {
+    const key = validateAesKey(options.key);
+    const { nonce, sealed } = unpackNonceAndSealed(options.ciphertext);
+    const cipher = (0, aes_js_1.gcm)(key, nonce, options.aad);
+    return cipher.decrypt(sealed);
+}
+function aesGcmSivEncrypt(options) {
+    const key = validateAesKey(options.key);
+    const plaintext = toBytes(options.plaintext, "utf8");
+    const nonce = (0, utils_js_1.randomBytes)(NONCE_LENGTH);
+    const cipher = (0, aes_js_1.gcmsiv)(key, nonce, options.aad);
+    const sealed = cipher.encrypt(plaintext);
+    const algorithm = key.length === 32 ? "aes-256-gcm-siv" : "aes-128-gcm-siv";
+    return {
+        ciphertext: packNonceAndSealed(nonce, sealed),
+        algorithm,
+    };
+}
+function aesGcmSivDecrypt(options) {
+    const key = validateAesKey(options.key);
+    const { nonce, sealed } = unpackNonceAndSealed(options.ciphertext);
+    const cipher = (0, aes_js_1.gcmsiv)(key, nonce, options.aad);
+    return cipher.decrypt(sealed);
+}
+//# sourceMappingURL=aes.js.map

package/dist/modern/cost-limits.d.ts

@@ -0,0 +1,11 @@
+export declare const MAX_ARGON2_TIME = 10;
+export declare const MAX_ARGON2_MEMORY = 262144;
+export declare const MAX_ARGON2_PARALLELISM = 8;
+export declare const MAX_SCRYPT_N = 131072;
+export declare const MAX_SCRYPT_R = 8;
+export declare const MAX_SCRYPT_P = 4;
+export declare const MAX_PBKDF2_ITERATIONS = 1000000;
+export declare function checkArgon2Costs(t: number, m: number, p: number): void;
+export declare function checkScryptCosts(N: number, r: number, p: number): void;
+export declare function checkPbkdf2Iterations(iterations: number): void;
+//# sourceMappingURL=cost-limits.d.ts.map

package/dist/modern/cost-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-limits.d.ts","sourceRoot":"","sources":["../../src/modern/cost-limits.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,eAAO,MAAM,iBAAiB,SAAS,CAAC;AAExC,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,eAAO,MAAM,YAAY,SAAS,CAAC;AAEnC,eAAO,MAAM,YAAY,IAAI,CAAC;AAE9B,eAAO,MAAM,YAAY,IAAI,CAAC;AAE9B,eAAO,MAAM,qBAAqB,UAAY,CAAC;AAU/C,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAItE;AAGD,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAOtE;AAGD,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAE9D"}

package/dist/modern/cost-limits.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_PBKDF2_ITERATIONS = exports.MAX_SCRYPT_P = exports.MAX_SCRYPT_R = exports.MAX_SCRYPT_N = exports.MAX_ARGON2_PARALLELISM = exports.MAX_ARGON2_MEMORY = exports.MAX_ARGON2_TIME = void 0;
+exports.checkArgon2Costs = checkArgon2Costs;
+exports.checkScryptCosts = checkScryptCosts;
+exports.checkPbkdf2Iterations = checkPbkdf2Iterations;
+exports.MAX_ARGON2_TIME = 10;
+exports.MAX_ARGON2_MEMORY = 262144;
+exports.MAX_ARGON2_PARALLELISM = 8;
+exports.MAX_SCRYPT_N = 131072;
+exports.MAX_SCRYPT_R = 8;
+exports.MAX_SCRYPT_P = 4;
+exports.MAX_PBKDF2_ITERATIONS = 1_000_000;
+function checkRange(name, value, min, max) {
+    if (!Number.isInteger(value) || value < min || value > max) {
+        throw new Error(`${name} must be an integer ${min}–${max}, got ${value}`);
+    }
+}
+function checkArgon2Costs(t, m, p) {
+    checkRange("Argon2 time cost", t, 1, exports.MAX_ARGON2_TIME);
+    checkRange("Argon2 parallelism", p, 1, exports.MAX_ARGON2_PARALLELISM);
+    checkRange("Argon2 memory cost (KiB)", m, 8 * p, exports.MAX_ARGON2_MEMORY);
+}
+function checkScryptCosts(N, r, p) {
+    checkRange("scrypt N", N, 2, exports.MAX_SCRYPT_N);
+    if ((N & (N - 1)) !== 0) {
+        throw new Error(`scrypt N must be a power of two, got ${N}`);
+    }
+    checkRange("scrypt r", r, 1, exports.MAX_SCRYPT_R);
+    checkRange("scrypt p", p, 1, exports.MAX_SCRYPT_P);
+}
+function checkPbkdf2Iterations(iterations) {
+    checkRange("PBKDF2 iterations", iterations, 1, exports.MAX_PBKDF2_ITERATIONS);
+}
+//# sourceMappingURL=cost-limits.js.map

package/dist/modern/curves.d.ts

@@ -0,0 +1,86 @@
+export interface P256KeyPair {
+    privateKey: string;
+    publicKey: string;
+    algorithm: "ecdsa-p256";
+}
+export interface P256SignResult {
+    signature: string;
+    algorithm: "ecdsa-p256";
+}
+export interface P256VerifyResult {
+    valid: boolean;
+    algorithm: "ecdsa-p256";
+}
+export interface P384KeyPair {
+    privateKey: string;
+    publicKey: string;
+    algorithm: "ecdsa-p384";
+}
+export interface P384SignResult {
+    signature: string;
+    algorithm: "ecdsa-p384";
+}
+export interface P384VerifyResult {
+    valid: boolean;
+    algorithm: "ecdsa-p384";
+}
+export interface Ed448KeyPair {
+    privateKey: string;
+    publicKey: string;
+    algorithm: "ed448";
+}
+export interface Ed448SignResult {
+    signature: string;
+    algorithm: "ed448";
+}
+export interface Ed448VerifyResult {
+    valid: boolean;
+    algorithm: "ed448";
+}
+export interface X448KeyPair {
+    privateKey: string;
+    publicKey: string;
+    algorithm: "x448";
+}
+export interface X448ExchangeResult {
+    sharedSecret: string;
+    algorithm: "x448";
+}
+export interface EcdhP256Result {
+    sharedSecret: string;
+    algorithm: "ecdh-p256";
+}
+export interface EcdhP384Result {
+    sharedSecret: string;
+    algorithm: "ecdh-p384";
+}
+export interface SchnorrKeyPair {
+    privateKey: string;
+    publicKey: string;
+    algorithm: "schnorr";
+}
+export interface SchnorrSignResult {
+    signature: string;
+    algorithm: "schnorr";
+}
+export interface SchnorrVerifyResult {
+    valid: boolean;
+    algorithm: "schnorr";
+}
+export declare function generateP256KeyPair(): P256KeyPair;
+export declare function p256Sign(privateKeyHex: string, message: string | Uint8Array): P256SignResult;
+export declare function p256Verify(publicKeyHex: string, message: string | Uint8Array, signatureHex: string): P256VerifyResult;
+export declare function generateP384KeyPair(): P384KeyPair;
+export declare function p384Sign(privateKeyHex: string, message: string | Uint8Array): P384SignResult;
+export declare function p384Verify(publicKeyHex: string, message: string | Uint8Array, signatureHex: string): P384VerifyResult;
+export declare function generateEd448KeyPair(): Ed448KeyPair;
+export declare function ed448Sign(privateKeyHex: string, message: string | Uint8Array): Ed448SignResult;
+export declare function ed448Verify(publicKeyHex: string, message: string | Uint8Array, signatureHex: string): Ed448VerifyResult;
+export declare function generateX448KeyPair(): X448KeyPair;
+export declare function x448Exchange(privateKeyHex: string, theirPublicKeyHex: string): X448ExchangeResult;
+export declare function ecdhP256(privateKeyHex: string, theirPublicKeyHex: string): EcdhP256Result;
+export declare function ecdhP384(privateKeyHex: string, theirPublicKeyHex: string): EcdhP384Result;
+export declare function generateSchnorrKeyPair(): SchnorrKeyPair;
+export declare function schnorrSign(privateKeyHex: string, message: string | Uint8Array): SchnorrSignResult;
+export declare function schnorrVerify(publicKeyHex: string, message: string | Uint8Array, signatureHex: string): SchnorrVerifyResult;
+//# sourceMappingURL=curves.d.ts.map

package/dist/modern/curves.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"curves.d.ts","sourceRoot":"","sources":["../../src/modern/curves.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,WAAW;IAE1B,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,YAAY,CAAC;CACzB;AAGD,MAAM,WAAW,cAAc;IAE7B,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,YAAY,CAAC;CACzB;AAGD,MAAM,WAAW,gBAAgB;IAE/B,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,YAAY,CAAC;CACzB;AAGD,MAAM,WAAW,WAAW;IAE1B,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,YAAY,CAAC;CACzB;AAGD,MAAM,WAAW,cAAc;IAE7B,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,YAAY,CAAC;CACzB;AAGD,MAAM,WAAW,gBAAgB;IAE/B,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,YAAY,CAAC;CACzB;AAGD,MAAM,WAAW,YAAY;IAE3B,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,OAAO,CAAC;CACpB;AAGD,MAAM,WAAW,eAAe;IAE9B,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,OAAO,CAAC;CACpB;AAGD,MAAM,WAAW,iBAAiB;IAEhC,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,OAAO,CAAC;CACpB;AAGD,MAAM,WAAW,WAAW;IAE1B,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,kBAAkB;IAEjC,YAAY,EAAE,MAAM,CAAC;IAErB,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,cAAc;IAE7B,YAAY,EAAE,MAAM,CAAC;IAErB,SAAS,EAAE,WAAW,CAAC;CACxB;AAGD,MAAM,WAAW,cAAc;IAE7B,YAAY,EAAE,MAAM,CAAC;IAErB,SAAS,EAAE,WAAW,CAAC;CACxB;AAGD,MAAM,WAAW,cAAc;IAE7B,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,SAAS,CAAC;CACtB;AAGD,MAAM,WAAW,iBAAiB;IAEhC,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,SAAS,CAAC;CACtB;AAGD,MAAM,WAAW,mBAAmB;IAElC,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,SAAS,CAAC;CACtB;AA0BD,wBAAgB,mBAAmB,IAAI,WAAW,CASjD;AAKD,wBAAgB,QAAQ,CACtB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GAAG,UAAU,GAC3B,cAAc,CAShB;AAKD,wBAAgB,UAAU,CACxB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GAAG,UAAU,EAC5B,YAAY,EAAE,MAAM,GACnB,gBAAgB,CAOlB;AAOD,wBAAgB,mBAAmB,IAAI,WAAW,CASjD;AAKD,wBAAgB,QAAQ,CACtB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GAAG,UAAU,GAC3B,cAAc,CAShB;AAKD,wBAAgB,UAAU,CACxB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GAAG,UAAU,EAC5B,YAAY,EAAE,MAAM,GACnB,gBAAgB,CAOlB;AAOD,wBAAgB,oBAAoB,IAAI,YAAY,CASnD;AAKD,wBAAgB,SAAS,CACvB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GAAG,UAAU,GAC3B,eAAe,CASjB;AAKD,wBAAgB,WAAW,CACzB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GAAG,UAAU,EAC5B,YAAY,EAAE,MAAM,GACnB,iBAAiB,CAOnB;AAOD,wBAAgB,mBAAmB,IAAI,WAAW,CASjD;AASD,wBAAgB,YAAY,CAC1B,aAAa,EAAE,MAAM,EACrB,iBAAiB,EAAE,MAAM,GACxB,kBAAkB,CASpB;AAUD,wBAAgB,QAAQ,CACtB,aAAa,EAAE,MAAM,EACrB,iBAAiB,EAAE,MAAM,GACxB,cAAc,CAShB;AAQD,wBAAgB,QAAQ,CACtB,aAAa,EAAE,MAAM,EACrB,iBAAiB,EAAE,MAAM,GACxB,cAAc,CAShB;AAOD,wBAAgB,sBAAsB,IAAI,cAAc,CASvD;AAKD,wBAAgB,WAAW,CACzB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GAAG,UAAU,GAC3B,iBAAiB,CASnB;AAKD,wBAAgB,aAAa,CAC3B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GAAG,UAAU,EAC5B,YAAY,EAAE,MAAM,GACnB,mBAAmB,CAOrB"}