@sebastienrousseau/crypto-lib 0.0.8 → 0.0.9

package/dist/bin/cryptolib.d.ts

@@ -11,15 +11,6 @@ export declare function session(data: dataSessionKey): Promise<import("openpgp")
 export declare function revoke(data: dataRevoke): Promise<ArmoredKeyResult>;
 export declare function sign(data: dataSign): Promise<string>;
 export declare function verify(data: dataVerify): Promise<import("openpgp").VerifyMessageResult<GenericWebStream<T>>>;
-declare const _default: {
-    decrypt: typeof decrypt;
-    encrypt: typeof encrypt;
-    generate: typeof generate;
-    reformat: typeof reformat;
-    revoke: typeof revoke;
-    session: typeof session;
-    sign: typeof sign;
-    verify: typeof verify;
-};
-export default _default;
+export { loadKeystore } from "../key/keystore";
+export type { Keystore } from "../key/keystore";
 //# sourceMappingURL=cryptolib.d.ts.map

package/dist/bin/cryptolib.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cryptolib.d.ts","sourceRoot":"","sources":["../../src/bin/cryptolib.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,cAAc,EACd,QAAQ,EACR,UAAU,EACX,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAkB3D,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW;;;GAG9C;AAkBD,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,mBAG9C;AAwBD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,mBAGhD;AAGD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAG5E;AAoBD,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,yCAGjD;AAgBD,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAGxE;AAiBD,wBAAsB,IAAI,CAAC,IAAI,EAAE,QAAQ,mBAGxC;AAiBD,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,uEAG5C;;;;;;;;;;;AAOD,wBAiBE"}
+{"version":3,"file":"cryptolib.d.ts","sourceRoot":"","sources":["../../src/bin/cryptolib.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,cAAc,EACd,QAAQ,EACR,UAAU,EACX,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAkB3D,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW;;;GAG9C;AAkBD,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,mBAG9C;AAwBD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,mBAGhD;AAGD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAG5E;AAoBD,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,yCAGjD;AAgBD,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAGxE;AAiBD,wBAAsB,IAAI,CAAC,IAAI,EAAE,QAAQ,mBAGxC;AAiBD,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,uEAG5C;AAOD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/bin/cryptolib.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadKeystore = void 0;
 exports.decrypt = decrypt;
 exports.encrypt = encrypt;
 exports.generate = generate;
@@ -74,14 +75,6 @@ async function verify(data) {
     const verify = await key.verify.default(data);
     return verify;
 }
-exports.default = {
-    decrypt,
-    encrypt,
-    generate,
-    reformat,
-    revoke,
-    session,
-    sign,
-    verify,
-};
+var keystore_1 = require("../key/keystore");
+Object.defineProperty(exports, "loadKeystore", { enumerable: true, get: function () { return keystore_1.loadKeystore; } });
 //# sourceMappingURL=cryptolib.js.map

package/dist/index.d.ts

@@ -1,5 +1,4 @@
-import CryptoLib from "./bin/cryptolib";
-export default CryptoLib;
+export * as pgp from "./bin/cryptolib";
 export * from "./modern";
 export * from "./high-level";
 export * from "./keys";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,SAAS,MAAM,iBAAiB,CAAC;AAGxC,eAAe,SAAS,CAAC;AAGzB,cAAc,UAAU,CAAC;AAGzB,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,cAAc,aAAa,CAAC;AAG5B,OAAO,KAAK,SAAS,MAAM,aAAa,CAAC;AACzC,cAAc,sBAAsB,CAAC;AAGrC,OAAO,KAAK,MAAM,MAAM,UAAU,CAAC;AAGnC,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,YAAY,EACV,aAAa,EACb,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAGlB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,WAAW,EACX,YAAY,GACb,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAGxD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAGvC,cAAc,UAAU,CAAC;AAGzB,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,cAAc,aAAa,CAAC;AAG5B,OAAO,KAAK,SAAS,MAAM,aAAa,CAAC;AACzC,cAAc,sBAAsB,CAAC;AAGrC,OAAO,KAAK,MAAM,MAAM,UAAU,CAAC;AAGnC,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,YAAY,EACV,aAAa,EACb,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAGlB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,WAAW,EACX,YAAY,GACb,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAGxD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -15,9 +15,6 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
 var __importStar = (this && this.__importStar) || (function () {
     var ownKeys = function(o) {
         ownKeys = Object.getOwnPropertyNames || function (o) {
@@ -35,13 +32,12 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.wipeMemory = exports.SecureBuffer = exports.timingSafeEqual = exports.CryptoErrorCode = exports.CryptoError = exports.isDeprecated = exports.recommended = exports.listAlgorithms = exports.getAlgorithm = exports.crypto = exports.tokens = exports.protocols = void 0;
-const cryptolib_1 = __importDefault(require("./bin/cryptolib"));
-exports.default = cryptolib_1.default;
+exports.wipeMemory = exports.SecureBuffer = exports.timingSafeEqual = exports.CryptoErrorCode = exports.CryptoError = exports.isDeprecated = exports.recommended = exports.listAlgorithms = exports.getAlgorithm = exports.crypto = exports.tokens = exports.protocols = exports.pgp = void 0;
+exports.pgp = __importStar(require("./bin/cryptolib"));
 __exportStar(require("./modern"), exports);
 __exportStar(require("./high-level"), exports);
 __exportStar(require("./keys"), exports);

package/dist/keys/keygen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keygen.d.ts","sourceRoot":"","sources":["../../src/keys/keygen.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,cAAc,mJAajB,CAAC;AAGX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAG3D,MAAM,WAAW,WAAW;IAE1B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzB,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;IAEhC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAGD,MAAM,WAAW,gBAAgB;IAE/B,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,YAAY,CAAC;IAExB,GAAG,EAAE,MAAM,CAAC;IAEZ,QAAQ,EAAE,WAAW,CAAC;CACvB;AAuBD,wBAAgB,eAAe,CAC7B,SAAS,EAAE,YAAY,EACvB,QAAQ,GAAE,WAAgB,GACzB,gBAAgB,CAkGlB"}
+{"version":3,"file":"keygen.d.ts","sourceRoot":"","sources":["../../src/keys/keygen.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,cAAc,mJAajB,CAAC;AAGX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAG3D,MAAM,WAAW,WAAW;IAE1B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzB,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;IAEhC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAGD,MAAM,WAAW,gBAAgB;IAE/B,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,YAAY,CAAC;IAExB,GAAG,EAAE,MAAM,CAAC;IAEZ,QAAQ,EAAE,WAAW,CAAC;CACvB;AAsDD,wBAAgB,eAAe,CAC7B,SAAS,EAAE,YAAY,EACvB,QAAQ,GAAE,WAAgB,GACzB,gBAAgB,CAiBlB"}

package/dist/keys/keygen.js

@@ -31,91 +31,27 @@ function generateKid(publicKey) {
     const digest = (0, sha2_js_1.sha256)(publicKey);
     return (0, serialize_1.bytesToBase64url)(digest.subarray(0, 16));
 }
+const fromSecret = (privateKey, derive) => ({ publicKey: derive(privateKey), privateKey });
+const fromPq = (kp) => ({ publicKey: kp.publicKey, privateKey: kp.secretKey });
+const KEYGEN = {
+    ed25519: () => fromSecret(ed25519_js_1.ed25519.utils.randomSecretKey(), ed25519_js_1.ed25519.getPublicKey),
+    x25519: () => fromSecret((0, utils_js_1.randomBytes)(32), ed25519_js_1.x25519.getPublicKey),
+    ed448: () => fromSecret(ed448_js_1.ed448.utils.randomSecretKey(), ed448_js_1.ed448.getPublicKey),
+    x448: () => fromSecret((0, utils_js_1.randomBytes)(56), ed448_js_1.x448.getPublicKey),
+    p256: () => fromSecret(nist_js_1.p256.utils.randomSecretKey(), nist_js_1.p256.getPublicKey),
+    p384: () => fromSecret(nist_js_1.p384.utils.randomSecretKey(), nist_js_1.p384.getPublicKey),
+    "ml-kem-512": () => fromPq(ml_kem_js_1.ml_kem512.keygen()),
+    "ml-kem-768": () => fromPq(ml_kem_js_1.ml_kem768.keygen()),
+    "ml-kem-1024": () => fromPq(ml_kem_js_1.ml_kem1024.keygen()),
+    "ml-dsa-44": () => fromPq(ml_dsa_js_1.ml_dsa44.keygen()),
+    "ml-dsa-65": () => fromPq(ml_dsa_js_1.ml_dsa65.keygen()),
+    "ml-dsa-87": () => fromPq(ml_dsa_js_1.ml_dsa87.keygen()),
+};
 function generateKeyPair(algorithm, metadata = {}) {
-    let publicKey;
-    let privateKey;
-    switch (algorithm) {
-        case "ed25519": {
-            const priv = ed25519_js_1.ed25519.utils.randomSecretKey();
-            const pub = ed25519_js_1.ed25519.getPublicKey(priv);
-            privateKey = priv;
-            publicKey = pub;
-            break;
-        }
-        case "x25519": {
-            const priv = (0, utils_js_1.randomBytes)(32);
-            const pub = ed25519_js_1.x25519.getPublicKey(priv);
-            privateKey = priv;
-            publicKey = pub;
-            break;
-        }
-        case "ed448": {
-            const priv = ed448_js_1.ed448.utils.randomSecretKey();
-            const pub = ed448_js_1.ed448.getPublicKey(priv);
-            privateKey = priv;
-            publicKey = pub;
-            break;
-        }
-        case "x448": {
-            const priv = (0, utils_js_1.randomBytes)(56);
-            const pub = ed448_js_1.x448.getPublicKey(priv);
-            privateKey = priv;
-            publicKey = pub;
-            break;
-        }
-        case "p256": {
-            const priv = nist_js_1.p256.utils.randomSecretKey();
-            const pub = nist_js_1.p256.getPublicKey(priv);
-            privateKey = priv;
-            publicKey = pub;
-            break;
-        }
-        case "p384": {
-            const priv = nist_js_1.p384.utils.randomSecretKey();
-            const pub = nist_js_1.p384.getPublicKey(priv);
-            privateKey = priv;
-            publicKey = pub;
-            break;
-        }
-        case "ml-kem-512": {
-            const kp = ml_kem_js_1.ml_kem512.keygen();
-            publicKey = kp.publicKey;
-            privateKey = kp.secretKey;
-            break;
-        }
-        case "ml-kem-768": {
-            const kp = ml_kem_js_1.ml_kem768.keygen();
-            publicKey = kp.publicKey;
-            privateKey = kp.secretKey;
-            break;
-        }
-        case "ml-kem-1024": {
-            const kp = ml_kem_js_1.ml_kem1024.keygen();
-            publicKey = kp.publicKey;
-            privateKey = kp.secretKey;
-            break;
-        }
-        case "ml-dsa-44": {
-            const kp = ml_dsa_js_1.ml_dsa44.keygen();
-            publicKey = kp.publicKey;
-            privateKey = kp.secretKey;
-            break;
-        }
-        case "ml-dsa-65": {
-            const kp = ml_dsa_js_1.ml_dsa65.keygen();
-            publicKey = kp.publicKey;
-            privateKey = kp.secretKey;
-            break;
-        }
-        case "ml-dsa-87": {
-            const kp = ml_dsa_js_1.ml_dsa87.keygen();
-            publicKey = kp.publicKey;
-            privateKey = kp.secretKey;
-            break;
-        }
-        default:
-            throw new Error(`Unsupported algorithm: ${algorithm}. Supported: ${exports.KEY_ALGORITHMS.join(", ")}`);
+    if (!Object.hasOwn(KEYGEN, algorithm)) {
+        throw new Error(`Unsupported algorithm: ${algorithm}. Supported: ${exports.KEY_ALGORITHMS.join(", ")}`);
     }
+    const { publicKey, privateKey } = KEYGEN[algorithm]();
     const kid = metadata.kid ?? generateKid(publicKey);
     return {
         publicKey: toHex(publicKey),

package/dist/tokens/paseto.d.ts

@@ -30,6 +30,7 @@ export interface PasetoPayload {
     footer?: string;
 }
 export declare function pae(...pieces: Uint8Array[]): Uint8Array;
+export declare function localEncryptWithNonce(opts: PasetoLocalEncryptOptions, nonce: Uint8Array): PasetoToken;
 declare function localEncrypt(opts: PasetoLocalEncryptOptions): PasetoToken;
 declare function localDecrypt(opts: PasetoLocalDecryptOptions): PasetoPayload;
 declare function publicSign(opts: PasetoPublicSignOptions): PasetoToken;

package/dist/tokens/paseto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paseto.d.ts","sourceRoot":"","sources":["../../src/tokens/paseto.ts"],"names":[],"mappings":"AAqDA,MAAM,WAAW,yBAAyB;IAExC,GAAG,EAAE,MAAM,CAAC;IAEZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,yBAAyB;IAExC,GAAG,EAAE,MAAM,CAAC;IAEZ,KAAK,EAAE,MAAM,CAAC;IAEd,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,uBAAuB;IAEtC,SAAS,EAAE,MAAM,CAAC;IAElB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,yBAAyB;IAExC,SAAS,EAAE,MAAM,CAAC;IAElB,KAAK,EAAE,MAAM,CAAC;IAEd,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,WAAW;IAE1B,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,WAAW,aAAa;IAE5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkBD,wBAAgB,GAAG,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAoBvD;AAoCD,iBAAS,YAAY,CAAC,IAAI,EAAE,yBAAyB,GAAG,WAAW,CA+ClE;AAeD,iBAAS,YAAY,CAAC,IAAI,EAAE,yBAAyB,GAAG,aAAa,CA4DpE;AAiBD,iBAAS,UAAU,CAAC,IAAI,EAAE,uBAAuB,GAAG,WAAW,CA8B9D;AAcD,iBAAS,YAAY,CAAC,IAAI,EAAE,yBAAyB,GAAG,aAAa,CAkDpE;AAaD,eAAO,MAAM,OAAO;;;CAKV,CAAC;AAWX,eAAO,MAAM,QAAQ;;;CAKX,CAAC"}
+{"version":3,"file":"paseto.d.ts","sourceRoot":"","sources":["../../src/tokens/paseto.ts"],"names":[],"mappings":"AAyDA,MAAM,WAAW,yBAAyB;IAExC,GAAG,EAAE,MAAM,CAAC;IAEZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,yBAAyB;IAExC,GAAG,EAAE,MAAM,CAAC;IAEZ,KAAK,EAAE,MAAM,CAAC;IAEd,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,uBAAuB;IAEtC,SAAS,EAAE,MAAM,CAAC;IAElB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,yBAAyB;IAExC,SAAS,EAAE,MAAM,CAAC;IAElB,KAAK,EAAE,MAAM,CAAC;IAEd,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,WAAW;IAE1B,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,WAAW,aAAa;IAE5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkBD,wBAAgB,GAAG,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAoBvD;AA+FD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,yBAAyB,EAC/B,KAAK,EAAE,UAAU,GAChB,WAAW,CA2Bb;AAiBD,iBAAS,YAAY,CAAC,IAAI,EAAE,yBAAyB,GAAG,WAAW,CAElE;AAyBD,iBAAS,YAAY,CAAC,IAAI,EAAE,yBAAyB,GAAG,aAAa,CAqCpE;AAiBD,iBAAS,UAAU,CAAC,IAAI,EAAE,uBAAuB,GAAG,WAAW,CA8B9D;AAcD,iBAAS,YAAY,CAAC,IAAI,EAAE,yBAAyB,GAAG,aAAa,CA0CpE;AAaD,eAAO,MAAM,OAAO;;;CAKV,CAAC;AAWX,eAAO,MAAM,QAAQ;;;CAKX,CAAC"}

package/dist/tokens/paseto.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.v4public = exports.v4local = void 0;
 exports.pae = pae;
+exports.localEncryptWithNonce = localEncryptWithNonce;
 const chacha_js_1 = require("@noble/ciphers/chacha.js");
 const utils_js_1 = require("@noble/ciphers/utils.js");
 const ed25519_js_1 = require("@noble/curves/ed25519.js");
@@ -10,8 +11,10 @@ const V4_LOCAL_HEADER = "v4.local.";
 const V4_PUBLIC_HEADER = "v4.public.";
 const NONCE_LEN = 32;
 const EK_LEN = 32;
-const N3_LEN = 24;
+const N2_LEN = 24;
+const TAG_LEN = 32;
 const SIG_LEN = 64;
+const BASE64URL_RE = /^[A-Za-z0-9_-]*$/;
 const HEX_RE = /^[0-9a-fA-F]*$/;
 function pae(...pieces) {
     const le64 = (n) => {
@@ -43,88 +46,90 @@ function toBase64url(buf) {
     return Buffer.from(buf).toString("base64url");
 }
 function fromBase64url(s) {
-    const padded = s.replace(/-/g, "+").replace(/_/g, "/");
-    return Buffer.from(padded, "base64");
+    const bytes = Buffer.from(s, "base64url");
+    if (!BASE64URL_RE.test(s) || bytes.toString("base64url") !== s) {
+        throw new Error("Invalid base64url encoding");
+    }
+    return bytes;
 }
 const encoder = new TextEncoder();
-function localEncrypt(opts) {
-    const { key, payload, footer = "", implicit = "" } = opts;
+function localKey(key) {
     const keyBytes = hexToBytes(key);
     if (keyBytes.length !== 32) {
         throw new Error(`Key must be 32 bytes, got ${keyBytes.length}`);
     }
-    const header = encoder.encode(V4_LOCAL_HEADER);
-    const message = encoder.encode(JSON.stringify(payload));
+    return keyBytes;
+}
+function deriveFromNonce(key, info, nonce, dkLen) {
+    const label = encoder.encode(info);
+    const msg = new Uint8Array(label.length + nonce.length);
+    msg.set(label);
+    msg.set(nonce, label.length);
+    return (0, blake2_js_1.blake2b)(msg, { key, dkLen });
+}
+function localSubkeys(key, nonce) {
+    const tmp = deriveFromNonce(key, "paseto-encryption-key", nonce, EK_LEN + N2_LEN);
+    return {
+        ek: tmp.subarray(0, EK_LEN),
+        n2: tmp.subarray(EK_LEN),
+        ak: deriveFromNonce(key, "paseto-auth-key-for-aead", nonce, TAG_LEN),
+    };
+}
+function localTag(ak, nonce, ciphertext, footer, implicit) {
+    const preAuth = pae(encoder.encode(V4_LOCAL_HEADER), nonce, ciphertext, footer, implicit);
+    return (0, blake2_js_1.blake2b)(preAuth, { key: ak, dkLen: TAG_LEN });
+}
+function localEncryptWithNonce(opts, nonce) {
+    const { key, payload, footer = "", implicit = "" } = opts;
+    const keyBytes = localKey(key);
+    if (nonce.length !== NONCE_LEN) {
+        throw new Error(`Nonce must be ${NONCE_LEN} bytes, got ${nonce.length}`);
+    }
     const footerBytes = encoder.encode(footer);
-    const implicitBytes = encoder.encode(implicit);
-    const randomN = (0, utils_js_1.randomBytes)(NONCE_LEN);
-    const nonce = (0, blake2_js_1.blake2b)(message, { key: randomN, dkLen: NONCE_LEN });
-    const ekInput = new Uint8Array(keyBytes.length + 16);
-    ekInput.set(keyBytes);
-    ekInput.set(nonce.subarray(0, 16), keyBytes.length);
-    const derived = (0, blake2_js_1.blake2b)(encoder.encode("paseto-encryption-key"), {
-        key: ekInput,
-        dkLen: EK_LEN + N3_LEN,
-    });
-    const ek = derived.subarray(0, EK_LEN);
-    const n3 = derived.subarray(EK_LEN, EK_LEN + N3_LEN);
-    const aad = pae(header, nonce, footerBytes, implicitBytes);
-    const cipher = (0, chacha_js_1.xchacha20poly1305)(ek, n3, aad);
-    const ciphertext = cipher.encrypt(message);
-    const body = new Uint8Array(NONCE_LEN + ciphertext.length);
+    const { ek, n2, ak } = localSubkeys(keyBytes, nonce);
+    const ciphertext = (0, chacha_js_1.xchacha20)(ek, n2, encoder.encode(JSON.stringify(payload)));
+    const tag = localTag(ak, nonce, ciphertext, footerBytes, encoder.encode(implicit));
+    const body = new Uint8Array(NONCE_LEN + ciphertext.length + TAG_LEN);
     body.set(nonce);
     body.set(ciphertext, NONCE_LEN);
+    body.set(tag, NONCE_LEN + ciphertext.length);
     let token = V4_LOCAL_HEADER + toBase64url(body);
     if (footer) {
         token += "." + toBase64url(footerBytes);
     }
     return { token };
 }
+function localEncrypt(opts) {
+    return localEncryptWithNonce(opts, (0, utils_js_1.randomBytes)(NONCE_LEN));
+}
+function assertFooter(footerB64, footer) {
+    const expected = encoder.encode(footer);
+    if (!(0, utils_js_1.equalBytes)(fromBase64url(footerB64), expected)) {
+        throw new Error("Footer mismatch");
+    }
+}
 function localDecrypt(opts) {
     const { key, token, footer = "", implicit = "" } = opts;
-    const keyBytes = hexToBytes(key);
-    if (keyBytes.length !== 32) {
-        throw new Error(`Key must be 32 bytes, got ${keyBytes.length}`);
-    }
+    const keyBytes = localKey(key);
     if (!token.startsWith(V4_LOCAL_HEADER)) {
         throw new Error(`Invalid token header: expected "${V4_LOCAL_HEADER}"`);
     }
-    const withoutHeader = token.slice(V4_LOCAL_HEADER.length);
-    const parts = withoutHeader.split(".");
-    const bodyB64 = parts[0];
-    const footerB64 = parts[1] ?? "";
-    const footerBytes = encoder.encode(footer);
-    if (footerB64) {
-        const tokenFooter = fromBase64url(footerB64);
-        if (Buffer.from(tokenFooter).toString("utf8") !== footer) {
-            throw new Error("Footer mismatch");
-        }
-    }
-    else if (footer) {
-        throw new Error("Footer mismatch");
-    }
-    const body = fromBase64url(bodyB64);
-    if (body.length < NONCE_LEN + 16) {
+    const parts = token.slice(V4_LOCAL_HEADER.length).split(".");
+    assertFooter(parts[1] ?? "", footer);
+    const body = fromBase64url(parts[0]);
+    if (body.length < NONCE_LEN + TAG_LEN) {
         throw new Error("Token body too short");
     }
-    const header = encoder.encode(V4_LOCAL_HEADER);
-    const implicitBytes = encoder.encode(implicit);
     const nonce = body.subarray(0, NONCE_LEN);
-    const ciphertext = body.subarray(NONCE_LEN);
-    const ekInput = new Uint8Array(keyBytes.length + 16);
-    ekInput.set(keyBytes);
-    ekInput.set(nonce.subarray(0, 16), keyBytes.length);
-    const derived = (0, blake2_js_1.blake2b)(encoder.encode("paseto-encryption-key"), {
-        key: ekInput,
-        dkLen: EK_LEN + N3_LEN,
-    });
-    const ek = derived.subarray(0, EK_LEN);
-    const n3 = derived.subarray(EK_LEN, EK_LEN + N3_LEN);
-    const aad = pae(header, nonce, footerBytes, implicitBytes);
-    const cipher = (0, chacha_js_1.xchacha20poly1305)(ek, n3, aad);
-    const plaintext = cipher.decrypt(ciphertext);
-    const payloadStr = Buffer.from(plaintext).toString("utf8");
-    const payload = JSON.parse(payloadStr);
+    const ciphertext = body.subarray(NONCE_LEN, body.length - TAG_LEN);
+    const tag = body.subarray(body.length - TAG_LEN);
+    const { ek, n2, ak } = localSubkeys(keyBytes, nonce);
+    const expected = localTag(ak, nonce, ciphertext, encoder.encode(footer), encoder.encode(implicit));
+    if (!(0, utils_js_1.equalBytes)(tag, expected)) {
+        throw new Error("Invalid token: authentication failed");
+    }
+    const plaintext = (0, chacha_js_1.xchacha20)(ek, n2, ciphertext);
+    const payload = JSON.parse(Buffer.from(plaintext).toString("utf8"));
     return { payload, ...(footer ? { footer } : {}) };
 }
 function publicSign(opts) {
@@ -162,16 +167,8 @@ function publicVerify(opts) {
     const parts = withoutHeader.split(".");
     const bodyB64 = parts[0];
     const footerB64 = parts[1] ?? "";
+    assertFooter(footerB64, footer);
     const footerBytes = encoder.encode(footer);
-    if (footerB64) {
-        const tokenFooter = fromBase64url(footerB64);
-        if (Buffer.from(tokenFooter).toString("utf8") !== footer) {
-            throw new Error("Footer mismatch");
-        }
-    }
-    else if (footer) {
-        throw new Error("Footer mismatch");
-    }
     const body = fromBase64url(bodyB64);
     if (body.length < SIG_LEN) {
         throw new Error("Token body too short");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/crypto-lib",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "description": "Crypto Lib is a powerful intuitive cryptographic JavaScript library that encapsulates common algorithms, functions and provides an interface for low-level cryptographic operations.",
   "author": "Sebastien Rousseau <sebastienrousseau@users.noreply.github.com>",
   "license": "MIT OR Apache-2.0",
@@ -16,12 +16,86 @@
   "engines": {
     "node": ">=22.0.0"
   },
+  "type": "commonjs",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
-  "sideEffects": false,
-  "bin": {
-    "cryptolib": "./dist/index.js"
+  "typesVersions": {
+    "*": {
+      "modern": [
+        "./dist/modern/index.d.ts"
+      ],
+      "high-level": [
+        "./dist/high-level/index.d.ts"
+      ],
+      "keys": [
+        "./dist/keys/index.d.ts"
+      ],
+      "streaming": [
+        "./dist/streaming/index.d.ts"
+      ],
+      "protocols": [
+        "./dist/protocols/index.d.ts"
+      ],
+      "tokens": [
+        "./dist/tokens/index.d.ts"
+      ],
+      "accel": [
+        "./dist/accel/index.d.ts"
+      ],
+      "pgp": [
+        "./dist/bin/cryptolib.d.ts"
+      ]
+    }
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "require": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./modern": {
+      "types": "./dist/modern/index.d.ts",
+      "require": "./dist/modern/index.js",
+      "default": "./dist/modern/index.js"
+    },
+    "./high-level": {
+      "types": "./dist/high-level/index.d.ts",
+      "require": "./dist/high-level/index.js",
+      "default": "./dist/high-level/index.js"
+    },
+    "./keys": {
+      "types": "./dist/keys/index.d.ts",
+      "require": "./dist/keys/index.js",
+      "default": "./dist/keys/index.js"
+    },
+    "./streaming": {
+      "types": "./dist/streaming/index.d.ts",
+      "require": "./dist/streaming/index.js",
+      "default": "./dist/streaming/index.js"
+    },
+    "./protocols": {
+      "types": "./dist/protocols/index.d.ts",
+      "require": "./dist/protocols/index.js",
+      "default": "./dist/protocols/index.js"
+    },
+    "./tokens": {
+      "types": "./dist/tokens/index.d.ts",
+      "require": "./dist/tokens/index.js",
+      "default": "./dist/tokens/index.js"
+    },
+    "./accel": {
+      "types": "./dist/accel/index.d.ts",
+      "require": "./dist/accel/index.js",
+      "default": "./dist/accel/index.js"
+    },
+    "./pgp": {
+      "types": "./dist/bin/cryptolib.d.ts",
+      "require": "./dist/bin/cryptolib.js",
+      "default": "./dist/bin/cryptolib.js"
+    },
+    "./package.json": "./package.json"
   },
+  "sideEffects": false,
   "files": [
     "dist/**/*.js",
     "dist/**/*.d.ts",
@@ -36,15 +110,16 @@
     "openpgp": "^6.3.1"
   },
   "devDependencies": {
-    "@types/chai": "^4.3.7",
+    "@types/chai": "^5.2.3",
     "@types/chai-as-promised": "^8.0.2",
-    "@types/mocha": "^10.0.2",
+    "@types/mocha": "^10.0.10",
     "@types/node": "^26.6.3",
     "c8": "^12.0.0",
-    "chai": "^4.5.0",
-    "chai-as-promised": "^7.1.2",
-    "mocha": "^10.8.2",
-    "prettier": "^3.9.8",
+    "chai": "^6.3.0",
+    "chai-as-promised": "^8.0.2",
+    "fast-check": "^4.10.2",
+    "mocha": "^12.0.3",
+    "prettier": "^3.9.9",
     "rimraf": "^6.1.3",
     "ts-node": "^10.9.2",
     "typedoc": "^0.28.20",
@@ -66,8 +141,8 @@
   "scripts": {
     "build": "tsc --build tsconfig.json",
     "clean": "rimraf ./coverage ./dist ./docs",
-    "lint": "eslint --ext .ts src __tests__",
-    "lint:fix": "eslint --cache --fix --ext .ts src __tests__",
+    "lint": "eslint src __tests__",
+    "lint:fix": "eslint --cache --fix src __tests__",
     "format": "prettier --write src/**/*.ts",
     "format:check": "prettier --check \"src/**/*.ts\"",
     "start": "node dist/index.js",