@sebastienrousseau/crypto-middleware 0.0.9 → 0.0.25

package/dist/common.d.ts

@@ -1,6 +1,8 @@
 import { JwtPayload, MiddlewareConfig } from "./types";
 export declare function encryptPayload(key: string, data: unknown): string;
 export declare function decryptPayload(key: string, sealed: string): unknown;
+export declare function encryptPqPayload(recipientX25519Public: string, recipientMlKemPublic: string, data: unknown, chunkSize?: number): string;
+export declare function decryptPqPayload(recipientX25519Secret: string, recipientMlKemSecret: string, sealed: string, chunkSize?: number): unknown;
 export declare function verifyHmacSignature(hmacKey: string, body: string, signature: string): boolean;
 export interface JwtVerifyOptions {
     issuer?: string | undefined;

package/dist/common.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../src/common.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAyB,UAAU,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAgB9E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAIjE;AAgBD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAYnE;AAsBD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB,OAAO,CA4BT;AAWD,MAAM,WAAW,gBAAgB;IAK/B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAM5B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAiHD,wBAAgB,SAAS,CACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,gBAAqB,GAC7B,UAAU,CAcZ;AAUD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,gBAAgB,EACxB,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,UAAU,CAcZ;AAUD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACtD,IAAI,EAAE,OAAO,GACZ,IAAI,CAcN;AAoBD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAYlE"}
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../src/common.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAyB,UAAU,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAgB9E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAIjE;AAgBD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAYnE;AAYD,wBAAgB,gBAAgB,CAC9B,qBAAqB,EAAE,MAAM,EAC7B,oBAAoB,EAAE,MAAM,EAC5B,IAAI,EAAE,OAAO,EACb,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAUR;AAYD,wBAAgB,gBAAgB,CAC9B,qBAAqB,EAAE,MAAM,EAC7B,oBAAoB,EAAE,MAAM,EAC5B,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAmBT;AAsBD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB,OAAO,CA4BT;AAWD,MAAM,WAAW,gBAAgB;IAK/B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAM5B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAiHD,wBAAgB,SAAS,CACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,gBAAqB,GAC7B,UAAU,CAcZ;AAUD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,gBAAgB,EACxB,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,UAAU,CAcZ;AAUD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACtD,IAAI,EAAE,OAAO,GACZ,IAAI,CAcN;AAoBD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAYlE"}

package/dist/common.js

@@ -2,12 +2,15 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.encryptPayload = encryptPayload;
 exports.decryptPayload = decryptPayload;
+exports.encryptPqPayload = encryptPqPayload;
+exports.decryptPqPayload = decryptPqPayload;
 exports.verifyHmacSignature = verifyHmacSignature;
 exports.verifyJwt = verifyJwt;
 exports.verifyBearerJwt = verifyBearerJwt;
 exports.verifyRequestSignature = verifyRequestSignature;
 exports.matchRoute = matchRoute;
 const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const streaming_1 = require("@sebastienrousseau/crypto-lib/streaming");
 const types_1 = require("./types");
 function encryptPayload(key, data) {
     const plaintext = typeof data === "string" ? data : JSON.stringify(data);
@@ -24,6 +27,34 @@ function decryptPayload(key, sealed) {
         throw new types_1.CryptoMiddlewareError(`Decryption failed: ${err.message}`, 400, "DECRYPTION_FAILED");
     }
 }
+function encryptPqPayload(recipientX25519Public, recipientMlKemPublic, data, chunkSize) {
+    const plaintext = typeof data === "string" ? data : JSON.stringify(data);
+    const ptBytes = Buffer.from(plaintext, "utf8");
+    const res = (0, streaming_1.streamPqEncrypt)({
+        recipientX25519Public,
+        recipientMlKemPublic,
+        plaintext: ptBytes,
+        ...(chunkSize !== undefined ? { chunkSize } : {}),
+    });
+    return Buffer.from(res.ciphertext).toString("base64");
+}
+function decryptPqPayload(recipientX25519Secret, recipientMlKemSecret, sealed, chunkSize) {
+    try {
+        const ctBytes = Buffer.from(sealed, "base64");
+        const decrypted = (0, streaming_1.streamPqDecrypt)({
+            recipientX25519Secret,
+            recipientMlKemSecret,
+            ciphertext: ctBytes,
+            ...(chunkSize !== undefined ? { chunkSize } : {}),
+        });
+        const plaintext = Buffer.from(decrypted).toString("utf8");
+        (0, crypto_lib_1.wipeMemory)(decrypted);
+        return JSON.parse(plaintext);
+    }
+    catch (err) {
+        throw new types_1.CryptoMiddlewareError(`PQ decryption failed: ${err.message}`, 400, "DECRYPTION_FAILED");
+    }
+}
 function verifyHmacSignature(hmacKey, body, signature) {
     if (!signature) {
         throw new types_1.CryptoMiddlewareError("Missing signature header", 401, "MISSING_SIGNATURE");

package/dist/express.d.ts

@@ -1,4 +1,5 @@
 import type { Request, Response, NextFunction } from "express";
-import { MiddlewareConfig } from "./types";
+import { MiddlewareConfig, PqStreamPluginConfig } from "./types";
 export declare function createCryptoMiddleware(config: MiddlewareConfig): (req: Request, res: Response, next: NextFunction) => void;
+export declare function createPqStreamMiddleware(config: PqStreamPluginConfig): (req: Request, res: Response, next: NextFunction) => void;
 //# sourceMappingURL=express.d.ts.map

package/dist/express.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAyB,MAAM,SAAS,CAAC;AAwFlE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,IAK3D,KAAK,OAAO,EACZ,KAAK,QAAQ,EACb,MAAM,YAAY,KACjB,IAAI,CAqBR"}
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EACL,gBAAgB,EAEhB,oBAAoB,EACrB,MAAM,SAAS,CAAC;AAwIjB,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,IAK3D,KAAK,OAAO,EACZ,KAAK,QAAQ,EACb,MAAM,YAAY,KACjB,IAAI,CAqBR;AAQD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,SAhC5D,OAAO,OACP,QAAQ,QACP,YAAY,KACjB,IAAI,CAiDR"}

package/dist/express.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createCryptoMiddleware = createCryptoMiddleware;
+exports.createPqStreamMiddleware = createPqStreamMiddleware;
 const types_1 = require("./types");
 const common_1 = require("./common");
 function requireKey(config, operation) {
@@ -23,6 +24,31 @@ function encryptJsonResponses(config, res) {
         return originalJson({ encrypted: sealed });
     };
 }
+function decryptPqBody(config, req) {
+    const xSecret = config.pqKeys?.recipientX25519Secret;
+    const kemSecret = config.pqKeys?.recipientMlKemSecret;
+    if (!xSecret || !kemSecret) {
+        throw new types_1.CryptoMiddlewareError("recipientX25519Secret and recipientMlKemSecret are required for pq-decrypt-request operation", 500, "MISSING_CONFIG");
+    }
+    if (req.body && typeof req.body === "object" && "encrypted" in req.body) {
+        req.body = (0, common_1.decryptPqPayload)(xSecret, kemSecret, req.body.encrypted, config.chunkSize);
+    }
+}
+function encryptPqJsonResponses(config, res) {
+    const xPublic = config.pqKeys?.recipientX25519Public;
+    const kemPublic = config.pqKeys?.recipientMlKemPublic;
+    if (!xPublic || !kemPublic) {
+        throw new types_1.CryptoMiddlewareError("recipientX25519Public and recipientMlKemPublic are required for pq-encrypt-response operation", 500, "MISSING_CONFIG");
+    }
+    const originalJson = res.json.bind(res);
+    res.json = function encryptedPqJson(body) {
+        const sealed = (0, common_1.encryptPqPayload)(xPublic, kemPublic, body, config.chunkSize);
+        return originalJson({
+            encrypted: sealed,
+            algorithm: "X25519-ML-KEM-768-XChaCha20-Poly1305",
+        });
+    };
+}
 function applyOperations(config, operations, req, res) {
     if (operations.includes("verify-jwt")) {
         req.jwtPayload = (0, common_1.verifyBearerJwt)(config, req.headers.authorization);
@@ -32,9 +58,14 @@ function applyOperations(config, operations, req, res) {
     }
     if (operations.includes("decrypt-request"))
         decryptBody(config, req);
+    if (operations.includes("pq-decrypt-request"))
+        decryptPqBody(config, req);
     if (operations.includes("encrypt-response")) {
         encryptJsonResponses(config, res);
     }
+    if (operations.includes("pq-encrypt-response")) {
+        encryptPqJsonResponses(config, res);
+    }
 }
 function createCryptoMiddleware(config) {
     const operations = config.operations ?? [];
@@ -60,4 +91,21 @@ function createCryptoMiddleware(config) {
         }
     };
 }
+function createPqStreamMiddleware(config) {
+    const operations = [];
+    if (config.recipientKeys.recipientX25519Secret &&
+        config.recipientKeys.recipientMlKemSecret) {
+        operations.push("pq-decrypt-request");
+    }
+    if (config.recipientKeys.recipientX25519Public &&
+        config.recipientKeys.recipientMlKemPublic) {
+        operations.push("pq-encrypt-response");
+    }
+    return createCryptoMiddleware({
+        pqKeys: config.recipientKeys,
+        ...(config.routes !== undefined ? { routes: config.routes } : {}),
+        ...(config.chunkSize !== undefined ? { chunkSize: config.chunkSize } : {}),
+        operations,
+    });
+}
 //# sourceMappingURL=express.js.map

package/dist/fastify.d.ts

@@ -1,6 +1,8 @@
 import type { FastifyInstance } from "fastify";
-import { MiddlewareConfig } from "./types";
+import { MiddlewareConfig, PqStreamPluginConfig } from "./types";
 declare function cryptoPluginImpl(fastify: FastifyInstance, opts: MiddlewareConfig): Promise<void>;
 export declare const cryptoPlugin: typeof cryptoPluginImpl;
+declare function pqStreamPluginImpl(fastify: FastifyInstance, opts: PqStreamPluginConfig): Promise<void>;
+export declare const pqStreamPlugin: typeof pqStreamPluginImpl;
 export {};
 //# sourceMappingURL=fastify.d.ts.map

package/dist/fastify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fastify.d.ts","sourceRoot":"","sources":["../src/fastify.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAE7E,OAAO,EAAE,gBAAgB,EAAyB,MAAM,SAAS,CAAC;AA8HlE,iBAAe,gBAAgB,CAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAgBf;AAGD,eAAO,MAAM,YAAY,yBAGvB,CAAC"}
+{"version":3,"file":"fastify.d.ts","sourceRoot":"","sources":["../src/fastify.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAE7E,OAAO,EACL,gBAAgB,EAEhB,oBAAoB,EACrB,MAAM,SAAS,CAAC;AAoMjB,iBAAe,gBAAgB,CAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAGD,eAAO,MAAM,YAAY,yBAGvB,CAAC;AAGH,iBAAe,kBAAkB,CAC/B,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,IAAI,CAAC,CAmBf;AAGD,eAAO,MAAM,cAAc,2BAGzB,CAAC"}

package/dist/fastify.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.cryptoPlugin = void 0;
+exports.pqStreamPlugin = exports.cryptoPlugin = void 0;
 const fastify_plugin_1 = __importDefault(require("fastify-plugin"));
 const types_1 = require("./types");
 const common_1 = require("./common");
@@ -70,6 +70,49 @@ function registerEncryption(fastify, opts, routes) {
         return payload;
     });
 }
+function registerPqDecryption(fastify, opts, routes) {
+    fastify.addHook("preHandler", async (request, reply) => {
+        if (!(0, common_1.matchRoute)(request.url, routes))
+            return;
+        const xSecret = opts.pqKeys?.recipientX25519Secret;
+        const kemSecret = opts.pqKeys?.recipientMlKemSecret;
+        if (!xSecret || !kemSecret) {
+            reply.code(500).send({
+                error: "recipientX25519Secret and recipientMlKemSecret are required for pq-decrypt-request operation",
+                code: "MISSING_CONFIG",
+            });
+            return;
+        }
+        try {
+            const body = request.body;
+            if (body && typeof body === "object" && "encrypted" in body) {
+                request.body =
+                    (0, common_1.decryptPqPayload)(xSecret, kemSecret, body.encrypted, opts.chunkSize);
+            }
+        }
+        catch (err) {
+            sendMiddlewareError(reply, err);
+        }
+    });
+}
+function registerPqEncryption(fastify, opts, routes) {
+    fastify.addHook("preSerialization", async (request, _reply, payload) => {
+        if (!(0, common_1.matchRoute)(request.url, routes))
+            return payload;
+        const xPublic = opts.pqKeys?.recipientX25519Public;
+        const kemPublic = opts.pqKeys?.recipientMlKemPublic;
+        if (!xPublic || !kemPublic)
+            return payload;
+        if (payload !== null && typeof payload === "object") {
+            const sealed = (0, common_1.encryptPqPayload)(xPublic, kemPublic, payload, opts.chunkSize);
+            return {
+                encrypted: sealed,
+                algorithm: "X25519-ML-KEM-768-XChaCha20-Poly1305",
+            };
+        }
+        return payload;
+    });
+}
 async function cryptoPluginImpl(fastify, opts) {
     const operations = opts.operations ?? [];
     const routes = opts.routes ?? [];
@@ -77,12 +120,38 @@ async function cryptoPluginImpl(fastify, opts) {
     if (operations.includes("decrypt-request")) {
         registerDecryption(fastify, opts, routes);
     }
+    if (operations.includes("pq-decrypt-request")) {
+        registerPqDecryption(fastify, opts, routes);
+    }
     if (operations.includes("encrypt-response")) {
         registerEncryption(fastify, opts, routes);
     }
+    if (operations.includes("pq-encrypt-response")) {
+        registerPqEncryption(fastify, opts, routes);
+    }
 }
 exports.cryptoPlugin = (0, fastify_plugin_1.default)(cryptoPluginImpl, {
     name: "crypto-middleware",
     fastify: "4.x || 5.x",
 });
+async function pqStreamPluginImpl(fastify, opts) {
+    const routes = opts.routes ?? [];
+    const { recipientKeys, chunkSize } = opts;
+    const config = {
+        pqKeys: recipientKeys,
+        ...(chunkSize !== undefined ? { chunkSize } : {}),
+    };
+    if (recipientKeys.recipientX25519Secret &&
+        recipientKeys.recipientMlKemSecret) {
+        registerPqDecryption(fastify, config, routes);
+    }
+    if (recipientKeys.recipientX25519Public &&
+        recipientKeys.recipientMlKemPublic) {
+        registerPqEncryption(fastify, config, routes);
+    }
+}
+exports.pqStreamPlugin = (0, fastify_plugin_1.default)(pqStreamPluginImpl, {
+    name: "crypto-middleware-pq-stream",
+    fastify: "4.x || 5.x",
+});
 //# sourceMappingURL=fastify.js.map

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-export type { MiddlewareConfig, JwtPayload } from "./types";
+export type { MiddlewareConfig, JwtPayload, PqKeysConfig, PqStreamPluginConfig, } from "./types";
 export { CryptoMiddlewareError } from "./types";
 export type { JwtVerifyOptions } from "./common";
-export { encryptPayload, decryptPayload, verifyHmacSignature, verifyJwt, matchRoute, } from "./common";
-export { createCryptoMiddleware } from "./express";
-export { cryptoPlugin } from "./fastify";
+export { encryptPayload, decryptPayload, encryptPqPayload, decryptPqPayload, verifyHmacSignature, verifyJwt, matchRoute, } from "./common";
+export { createCryptoMiddleware, createPqStreamMiddleware } from "./express";
+export { cryptoPlugin, pqStreamPlugin } from "./fastify";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAChD,YAAY,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAGjD,OAAO,EACL,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,SAAS,EACT,UAAU,GACX,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAGnD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,YAAY,EACV,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,GACrB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAChD,YAAY,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAGjD,OAAO,EACL,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,SAAS,EACT,UAAU,GACX,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAG7E,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -1,16 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.cryptoPlugin = exports.createCryptoMiddleware = exports.matchRoute = exports.verifyJwt = exports.verifyHmacSignature = exports.decryptPayload = exports.encryptPayload = exports.CryptoMiddlewareError = void 0;
+exports.pqStreamPlugin = exports.cryptoPlugin = exports.createPqStreamMiddleware = exports.createCryptoMiddleware = exports.matchRoute = exports.verifyJwt = exports.verifyHmacSignature = exports.decryptPqPayload = exports.encryptPqPayload = exports.decryptPayload = exports.encryptPayload = exports.CryptoMiddlewareError = void 0;
 var types_1 = require("./types");
 Object.defineProperty(exports, "CryptoMiddlewareError", { enumerable: true, get: function () { return types_1.CryptoMiddlewareError; } });
 var common_1 = require("./common");
 Object.defineProperty(exports, "encryptPayload", { enumerable: true, get: function () { return common_1.encryptPayload; } });
 Object.defineProperty(exports, "decryptPayload", { enumerable: true, get: function () { return common_1.decryptPayload; } });
+Object.defineProperty(exports, "encryptPqPayload", { enumerable: true, get: function () { return common_1.encryptPqPayload; } });
+Object.defineProperty(exports, "decryptPqPayload", { enumerable: true, get: function () { return common_1.decryptPqPayload; } });
 Object.defineProperty(exports, "verifyHmacSignature", { enumerable: true, get: function () { return common_1.verifyHmacSignature; } });
 Object.defineProperty(exports, "verifyJwt", { enumerable: true, get: function () { return common_1.verifyJwt; } });
 Object.defineProperty(exports, "matchRoute", { enumerable: true, get: function () { return common_1.matchRoute; } });
 var express_1 = require("./express");
 Object.defineProperty(exports, "createCryptoMiddleware", { enumerable: true, get: function () { return express_1.createCryptoMiddleware; } });
+Object.defineProperty(exports, "createPqStreamMiddleware", { enumerable: true, get: function () { return express_1.createPqStreamMiddleware; } });
 var fastify_1 = require("./fastify");
 Object.defineProperty(exports, "cryptoPlugin", { enumerable: true, get: function () { return fastify_1.cryptoPlugin; } });
+Object.defineProperty(exports, "pqStreamPlugin", { enumerable: true, get: function () { return fastify_1.pqStreamPlugin; } });
 //# sourceMappingURL=index.js.map

package/dist/types.d.ts

@@ -1,11 +1,24 @@
+export interface PqKeysConfig {
+    recipientX25519Secret?: string | undefined;
+    recipientMlKemSecret?: string | undefined;
+    recipientX25519Public?: string | undefined;
+    recipientMlKemPublic?: string | undefined;
+}
+export interface PqStreamPluginConfig {
+    recipientKeys: PqKeysConfig;
+    routes?: string[] | undefined;
+    chunkSize?: number | undefined;
+}
 export interface MiddlewareConfig {
-    key?: string;
-    routes?: string[];
-    operations?: Array<"decrypt-request" | "encrypt-response" | "verify-signature" | "verify-jwt">;
+    key?: string | undefined;
+    routes?: string[] | undefined;
+    operations?: Array<"decrypt-request" | "encrypt-response" | "verify-signature" | "verify-jwt" | "pq-decrypt-request" | "pq-encrypt-response">;
     hmacKey?: string;
     jwtSecret?: string;
     jwtIssuer?: string;
     jwtAudience?: string;
+    pqKeys?: PqKeysConfig | undefined;
+    chunkSize?: number | undefined;
 }
 export interface JwtPayload {
     sub?: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,gBAAgB;IAE/B,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB,UAAU,CAAC,EAAE,KAAK,CAChB,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,GAAG,YAAY,CAC3E,CAAC;IAEF,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAcD,MAAM,WAAW,UAAU;IAEzB,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAKxB,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAUD,qBAAa,qBAAsB,SAAQ,KAAK;IAE9C,SAAgB,UAAU,EAAE,MAAM,CAAC;IAEnC,SAAgB,IAAI,EAAE,MAAM,CAAC;gBAGjB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAM9D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,YAAY;IAE3B,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE3C,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1C,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE3C,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAKD,MAAM,WAAW,oBAAoB;IAEnC,aAAa,EAAE,YAAY,CAAC;IAE5B,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAE9B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAE/B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzB,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAE9B,UAAU,CAAC,EAAE,KAAK,CACd,iBAAiB,GACjB,kBAAkB,GAClB,kBAAkB,GAClB,YAAY,GACZ,oBAAoB,GACpB,qBAAqB,CACxB,CAAC;IAEF,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAElC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAcD,MAAM,WAAW,UAAU;IAEzB,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAKxB,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAUD,qBAAa,qBAAsB,SAAQ,KAAK;IAE9C,SAAgB,UAAU,EAAE,MAAM,CAAC;IAEnC,SAAgB,IAAI,EAAE,MAAM,CAAC;gBAGjB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAM9D"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/crypto-middleware",
-  "version": "0.0.9",
+  "version": "0.0.25",
   "description": "Plug-and-play cryptographic middleware for Express and Fastify -- auto-decrypt requests, verify signatures, and encrypt responses.",
   "author": "Sebastien Rousseau <sebastienrousseau@users.noreply.github.com>",
   "license": "MIT OR Apache-2.0",
@@ -35,7 +35,7 @@
   ],
   "dependencies": {
     "fastify-plugin": "^6.0.0",
-    "@sebastienrousseau/crypto-lib": "0.0.9"
+    "@sebastienrousseau/crypto-lib": "0.0.25"
   },
   "peerDependencies": {
     "express": "^5.2.1",
@@ -50,7 +50,7 @@
     }
   },
   "devDependencies": {
-    "@sebastienrousseau/mocha-config": "^0.0.5",
+    "@sebastienrousseau/mocha-config": "^0.0.7",
     "@types/chai": "^5.2.3",
     "@types/chai-as-promised": "^8.0.2",
     "@types/express": "^5.0.6",