@sebastienrousseau/crypto-sdk 0.0.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/LICENSE +8 -0
  2. package/README.md +277 -0
  3. package/dist/index.d.ts +341 -0
  4. package/dist/index.d.ts.map +1 -0
  5. package/dist/index.js +245 -0
  6. package/package.json +60 -0
package/LICENSE ADDED
@@ -0,0 +1,8 @@
1
+ This project is dual-licensed under either of:
2
+
3
+ * Apache License, Version 2.0 — see LICENSE-APACHE
4
+ * MIT license — see LICENSE-MIT
5
+
6
+ at your option.
7
+
8
+ SPDX-License-Identifier: Apache-2.0 OR MIT
package/README.md ADDED
@@ -0,0 +1,277 @@
1
+ <!-- SPDX-License-Identifier: Apache-2.0 OR MIT -->
2
+
3
+ <p align="center">
4
+ <img src="https://raw.githubusercontent.com/sebastienrousseau/crypto-service/main/assets/crypto-sdk-logo.svg" alt="crypto-sdk logo" width="360" />
5
+ </p>
6
+
7
+ <h1 align="center">@sebastienrousseau/crypto-sdk</h1>
8
+
9
+ <p align="center">
10
+ A zero-dependency, typed HTTP client for the Crypto Service REST API, with full post-quantum support.
11
+ </p>
12
+
13
+ <p align="center">
14
+ <a href="https://github.com/sebastienrousseau/crypto-service/actions"><img src="https://img.shields.io/github/actions/workflow/status/sebastienrousseau/crypto-service/ci.yml?branch=main&style=for-the-badge&logo=github" alt="Build" /></a>
15
+ <a href="https://coveralls.io/github/sebastienrousseau/crypto-service?branch=main"><img src="https://img.shields.io/coveralls/github/sebastienrousseau/crypto-service?branch=main&style=for-the-badge" alt="Coverage" /></a>
16
+ <a href="https://www.npmjs.com/package/@sebastienrousseau/crypto-sdk"><img src="https://img.shields.io/npm/v/@sebastienrousseau/crypto-sdk.svg?style=for-the-badge&color=f14041&logo=npm" alt="Registry" /></a>
17
+ <a href="https://sebastienrousseau.github.io/crypto-service/"><img src="https://img.shields.io/badge/docs-TypeDoc-blue.svg?style=for-the-badge&labelColor=555555&logo=typescript" alt="Docs" /></a>
18
+ <a href="https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/crypto-service" title="ossf-scorecard"><img src="https://img.shields.io/badge/OpenSSF-Scorecard-blue?style=for-the-badge&logo=openssf" alt="OpenSSF Scorecard" /></a>
19
+ <a href="https://github.com/sebastienrousseau/crypto-service/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0%20OR%20MIT-blue.svg?style=for-the-badge" alt="License: Apache-2.0 OR MIT" /></a>
20
+ <a href="https://github.com/sebastienrousseau/crypto-service/blob/main/docs/POLICIES.md"><img src="https://img.shields.io/badge/Node.js-%3E%3D22-93450a.svg?style=for-the-badge&logo=node.js" alt="Node.js 22 or newer" /></a>
21
+ </p>
22
+
23
+ ---
24
+
25
+ ## Contents
26
+
27
+ **Getting started**
28
+
29
+ - [Install](#install) — installation via pnpm, npm, or yarn
30
+ - [Requirements](#requirements) — runtime floor and environment prerequisites
31
+ - [Quick Start](#quick-start) — minimal working usage sample
32
+
33
+ **The Crypto Service ecosystem**
34
+
35
+ - [The Crypto Service ecosystem](#the-crypto-service-ecosystem) — full 14-package suite overview
36
+
37
+ **Package reference**
38
+
39
+ - [Reference & Usage](#overview) — features, configuration, and capabilities
40
+ - [Examples](#examples) — runnable sample code
41
+
42
+ **Operational**
43
+
44
+ - [Development](#development) — build, lint, format, and test targets
45
+ - [Security](#security) — vulnerability disclosure and cryptographic invariants
46
+ - [Documentation](#documentation) — TypeDoc API docs and ecosystem guides
47
+ - [Stability guarantees](#stability-guarantees) — SemVer axis and release policy
48
+ - [License](#license)
49
+
50
+ ---
51
+
52
+ ## Install
53
+
54
+ ```bash
55
+ pnpm add @sebastienrousseau/crypto-sdk
56
+ # or
57
+ npm install @sebastienrousseau/crypto-sdk
58
+ # or
59
+ yarn add @sebastienrousseau/crypto-sdk
60
+ ```
61
+
62
+ <p align="right"><a href="#contents">Back to Top</a></p>
63
+
64
+ ---
65
+
66
+ ## Requirements
67
+
68
+ - **Node.js**: `^22.0.0` or `>=24.0.0` (active and maintenance LTS releases)
69
+ - **Package Manager**: `pnpm >=9` (recommended) or `npm >=10`
70
+ - **TypeScript**: `>=5.0` (when compiling with TypeScript)
71
+
72
+ <p align="right"><a href="#contents">Back to Top</a></p>
73
+
74
+ ---
75
+
76
+ ## Quick Start
77
+
78
+ ```ts
79
+ import { CryptoClient } from "@sebastienrousseau/crypto-sdk";
80
+
81
+ const client = new CryptoClient({
82
+ baseUrl: "http://localhost:3000",
83
+ });
84
+
85
+ const { data } = await client.hash({ algorithm: "sha256", data: "hello" });
86
+ console.log(data.digest);
87
+ ```
88
+
89
+ `CryptoClient` accepts two optional authentication mechanisms:
90
+
91
+ | Option | Header sent | Description |
92
+ | :------- | :------------------------------ | :--------------- |
93
+ | `apiKey` | `x-api-key: <value>` | Static API key |
94
+ | `token` | `Authorization: Bearer <value>` | JWT bearer token |
95
+
96
+ Failed requests throw a `CryptoApiError`:
97
+
98
+ ```ts
99
+ import { CryptoClient, CryptoApiError } from "@sebastienrousseau/crypto-sdk";
100
+
101
+ try {
102
+ await client.hash({ algorithm: "invalid", data: "test" });
103
+ } catch (err) {
104
+ if (err instanceof CryptoApiError) {
105
+ console.error(err.status); // HTTP status code (e.g. 400)
106
+ console.error(err.body.error); // Error message from the server
107
+ }
108
+ }
109
+ ```
110
+
111
+ <p align="right"><a href="#contents">Back to Top</a></p>
112
+
113
+ ---
114
+
115
+ ## The Crypto Service ecosystem
116
+
117
+ Crypto Service provides a complete cryptography stack across 14 specialized packages:
118
+
119
+ | Package | Role | Description |
120
+ | :-------------------------------------------------------------------- | :-------------- | :------------------------------------------------------------------------------------------------------------------------------------- |
121
+ | [`@sebastienrousseau/crypto-api`](../crypto-api) | API Schemas | Shared TypeScript types and utilities for the Crypto Service Suite, defining the canonical API surface. |
122
+ | [`@sebastienrousseau/crypto-cli`](../crypto-cli) | Terminal CLI | An interactive command-line interface for cryptographic operations, supporting both legacy OpenPGP and modern post-quantum algorithms. |
123
+ | [`@sebastienrousseau/crypto-edge`](../crypto-edge) | Edge Runtime | Edge-runtime cryptographic operations using the Web Crypto API, optimized for Cloudflare Workers, Vercel Edge, and Deno. |
124
+ | [`@sebastienrousseau/crypto-kms`](../crypto-kms) | Cloud KMS | Unified Key Management Service interface for AWS KMS, GCP Cloud KMS, Azure Key Vault, and HashiCorp Vault. |
125
+ | [`@sebastienrousseau/crypto-lib`](../crypto-lib) | Core Library | A modern cryptographic library for TypeScript, with post-quantum support, zero unsafe dependencies, and 100% test coverage. |
126
+ | [`@sebastienrousseau/crypto-middleware`](../crypto-middleware) | Middleware | Framework-agnostic cryptographic middleware for Express, Fastify, and Koa applications. |
127
+ | [`@sebastienrousseau/crypto-prisma`](../crypto-prisma) | ORM Adapter | Transparent field-level encryption extension for Prisma Client, using XChaCha20-Poly1305. |
128
+ | [`@sebastienrousseau/crypto-react`](../crypto-react) | React Hooks | React hooks and context provider for client-side cryptographic operations with zero boilerplate. |
129
+ | **[`@sebastienrousseau/crypto-sdk`](../crypto-sdk)** _(this package)_ | **Client SDK** | **A zero-dependency, typed HTTP client for the Crypto Service REST API, with full post-quantum support.** |
130
+ | [`@sebastienrousseau/crypto-server`](../crypto-server) | HTTP API | A hardened Fastify REST API for cryptographic operations, with rate limiting, OpenAPI schemas, and post-quantum endpoints. |
131
+ | [`@sebastienrousseau/crypto-testing`](../crypto-testing) | Test Support | Deterministic keys, fast mocks, and test fixtures for crypto-lib |
132
+ | [`@sebastienrousseau/crypto-typeorm`](../crypto-typeorm) | ORM Adapter | TypeORM column-level encryption with a single decorator, powered by crypto-lib. |
133
+ | [`@sebastienrousseau/crypto-vue`](../crypto-vue) | Vue Composables | Vue 3 composables for client-side cryptography |
134
+ | [`@sebastienrousseau/crypto-wasm`](../crypto-wasm) | Acceleration | WebAssembly performance accelerator for crypto-lib |
135
+
136
+ <p align="right"><a href="#contents">Back to Top</a></p>
137
+
138
+ ---
139
+
140
+ ## Overview
141
+
142
+ crypto-sdk is a typed HTTP client that wraps the Crypto Service REST
143
+ API. It uses the global `fetch` API (no runtime dependencies) and
144
+ provides strongly-typed methods for every v2 endpoint -- hashing,
145
+ encryption, signing, key derivation, password hashing, key
146
+ management, sealed boxes, secretboxes, and post-quantum KEM and
147
+ signature operations.
148
+
149
+ <p align="right"><a href="#contents">Back to Top</a></p>
150
+
151
+ ## API Reference
152
+
153
+ Every method returns `Promise<ApiResponse<T>>` where
154
+ `ApiResponse<T>` is `{ data: T }`.
155
+
156
+ | Method | Endpoint | Description |
157
+ | :----------------------- | :------------------------------- | :---------------------------------------- |
158
+ | `hash(body)` | `POST /v2/hash` | Compute a cryptographic hash |
159
+ | `encrypt(body)` | `POST /v2/encrypt` | Encrypt plaintext |
160
+ | `decrypt(body)` | `POST /v2/decrypt` | Decrypt ciphertext |
161
+ | `sign(body)` | `POST /v2/sign` | Sign a message |
162
+ | `verify(body)` | `POST /v2/verify` | Verify a signature |
163
+ | `kdf(body)` | `POST /v2/kdf` | Derive a key |
164
+ | `mac(body)` | `POST /v2/hmac` | Compute a MAC |
165
+ | `macVerify(body)` | `POST /v2/hmac/verify` | Verify a MAC |
166
+ | `passwordHash(body)` | `POST /v2/password/hash` | Hash a password |
167
+ | `passwordVerify(body)` | `POST /v2/password/verify` | Verify a password hash |
168
+ | `passwordEncrypt(body)` | `POST /v2/password/encrypt` | Encrypt data with a password |
169
+ | `passwordDecrypt(body)` | `POST /v2/password/decrypt` | Decrypt password-encrypted data |
170
+ | `generateKeyPair(body?)` | `POST /v2/keys/generate` | Generate a key pair |
171
+ | `keyWrap(body)` | `POST /v2/keys/wrap` | Wrap a key |
172
+ | `keyUnwrap(body)` | `POST /v2/keys/unwrap` | Unwrap a wrapped key |
173
+ | `secretboxSeal(body)` | `POST /v2/secretbox/seal` | Seal plaintext with a symmetric key |
174
+ | `secretboxOpen(body)` | `POST /v2/secretbox/open` | Open a sealed secretbox |
175
+ | `sealedboxSeal(body)` | `POST /v2/sealedbox/seal` | Seal plaintext for a recipient public key |
176
+ | `sealedboxOpen(body)` | `POST /v2/sealedbox/open` | Open a sealed box |
177
+ | `pqGenerateKeyPair()` | `POST /v2/pq/hybrid/keygen` | Generate a hybrid key pair |
178
+ | `pqEncapsulate(body)` | `POST /v2/pq/hybrid/encapsulate` | Encapsulate a shared secret |
179
+ | `pqDecapsulate(body)` | `POST /v2/pq/hybrid/decapsulate` | Decapsulate a shared secret |
180
+ | `pqSignKeygen(body)` | `POST /v2/pq/dsa/keygen` | Generate an ML-DSA key pair |
181
+ | `pqSign(body)` | `POST /v2/pq/dsa/sign` | Sign with ML-DSA |
182
+ | `pqVerify(body)` | `POST /v2/pq/dsa/verify` | Verify an ML-DSA signature |
183
+ | `pqHashSignKeygen(body)` | `POST /v2/pq/hash-sign/keygen` | Generate an SLH-DSA key pair |
184
+ | `pqHashSign(body)` | `POST /v2/pq/hash-sign/sign` | Sign with SLH-DSA |
185
+ | `pqHashVerify(body)` | `POST /v2/pq/hash-sign/verify` | Verify an SLH-DSA signature |
186
+ | `algorithms()` | `GET /v2/algorithms` | List all supported algorithms |
187
+ | `health()` | `GET /health` | Server health check |
188
+
189
+ <p align="right"><a href="#contents">Back to Top</a></p>
190
+
191
+ ## Examples
192
+
193
+ All examples are self-contained TypeScript files in the `examples/`
194
+ directory. Each requires the crypto-server running on
195
+ `http://localhost:3000` (override via `CRYPTO_SERVER_URL`).
196
+
197
+ ```bash
198
+ npx ts-node examples/<name>.ts
199
+ ```
200
+
201
+ | Category | Example | Purpose |
202
+ | :----------- | :-------------------------------------- | :------------------------------------- |
203
+ | Algorithms | [algorithms.ts](examples/algorithms.ts) | List all supported algorithms |
204
+ | Encryption | [encrypt.ts](examples/encrypt.ts) | AES-256-GCM encrypt and decrypt |
205
+ | Hashing | [hash.ts](examples/hash.ts) | Compute SHA-256 and BLAKE2b digests |
206
+ | KDF | [kdf.ts](examples/kdf.ts) | Key derivation with HKDF-SHA256 |
207
+ | Key Gen | [keygen.ts](examples/keygen.ts) | Generate key pairs |
208
+ | Key Wrap | [keywrap.ts](examples/keywrap.ts) | AES key wrapping and unwrapping |
209
+ | MAC | [mac.ts](examples/mac.ts) | HMAC-SHA256 compute and verify |
210
+ | Passwords | [password.ts](examples/password.ts) | Argon2 hashing and password encryption |
211
+ | PQ KEM | [pqkem.ts](examples/pqkem.ts) | Hybrid X25519 + ML-KEM key exchange |
212
+ | PQ Sign | [pqsign.ts](examples/pqsign.ts) | ML-DSA post-quantum signing |
213
+ | PQ Hash Sign | [pqhashsign.ts](examples/pqhashsign.ts) | SLH-DSA post-quantum signing |
214
+ | Sealed Box | [sealedbox.ts](examples/sealedbox.ts) | Anonymous public-key encryption |
215
+ | Secretbox | [secretbox.ts](examples/secretbox.ts) | Symmetric authenticated encryption |
216
+ | Signing | [sign.ts](examples/sign.ts) | Ed25519 signing and verification |
217
+
218
+ <p align="right"><a href="#contents">Back to Top</a></p>
219
+
220
+ <p align="right"><a href="#contents">Back to Top</a></p>
221
+
222
+ ---
223
+
224
+ ## Development
225
+
226
+ ```bash
227
+ pnpm --filter @sebastienrousseau/crypto-sdk run build
228
+ pnpm --filter @sebastienrousseau/crypto-sdk run test
229
+ pnpm --filter @sebastienrousseau/crypto-sdk run lint
230
+ pnpm --filter @sebastienrousseau/crypto-sdk run format
231
+ ```
232
+
233
+ All 18 packages in the Crypto Service workspace maintain a **100% coverage floor** across statements, branches, functions, and lines.
234
+
235
+ <p align="right"><a href="#contents">Back to Top</a></p>
236
+
237
+ ---
238
+
239
+ ## Security
240
+
241
+ Report vulnerabilities privately via [GitHub Security Advisories](https://github.com/sebastienrousseau/crypto-service/security/advisories) or according to [`SECURITY.md`](../../SECURITY.md). Never report security issues publicly.
242
+
243
+ Cryptographic operations use the `@noble/*` libraries, Node.js `crypto` and OpenPGP.js. `@noble/post-quantum` has not been independently audited and does not guarantee constant-time execution, and no module in this suite is FIPS 140-3 validated. Key zeroization is limited: JavaScript strings and garbage-collected buffers cannot be reliably wiped. See [`SECURITY.md`](../../SECURITY.md).
244
+
245
+ <p align="right"><a href="#contents">Back to Top</a></p>
246
+
247
+ ---
248
+
249
+ ## Documentation
250
+
251
+ - [Full Suite Documentation](https://sebastienrousseau.github.io/crypto-service/)
252
+ - [API Reference (TypeDoc)](https://sebastienrousseau.github.io/crypto-service/)
253
+ - [Developer Guide](../../DEVELOPMENT.md)
254
+ - [Security Policy](../../SECURITY.md)
255
+ - [Architecture & Design](../../ARCHITECTURE.md)
256
+
257
+ <p align="right"><a href="#contents">Back to Top</a></p>
258
+
259
+ ---
260
+
261
+ ## Stability guarantees
262
+
263
+ Versions advance strictly one step at a time on the `0.0.x` line (`v0.0.1` → `v0.0.2` → `v0.0.3` ... → `v0.0.999` → `v0.1.0`). Work for every release iteration begins on a dedicated `feat/v<version>` branch.
264
+
265
+ All 18 packages in the workspace move in lockstep. Public API signatures, cipher output formats, and serialization schemas are strictly versioned. Breaking changes to serialized formats or algorithm defaults are considered major breaking changes. Minimum toolchain upgrades (e.g. Node.js LTS floor) are governed by [POLICIES.md](../../docs/POLICIES.md).
266
+
267
+ <p align="right"><a href="#contents">Back to Top</a></p>
268
+
269
+ ---
270
+
271
+ ## License
272
+
273
+ Dual-licensed under [Apache 2.0](https://www.apache.org/licenses/LICENSE-2.0) or [MIT](https://opensource.org/licenses/MIT), at your option.
274
+
275
+ Copyright (c) 2022-2026 Sebastien Rousseau and The Crypto Service Suite contributors.
276
+
277
+ <p align="right"><a href="#contents">Back to Top</a></p>
package/dist/index.d.ts ADDED
@@ -0,0 +1,341 @@
1
+ export interface ClientOptions {
2
+ baseUrl: string;
3
+ apiKey?: string;
4
+ token?: string;
5
+ fetch?: typeof globalThis.fetch;
6
+ }
7
+ export interface ApiResponse<T> {
8
+ data: T;
9
+ }
10
+ export interface ApiError {
11
+ error: string;
12
+ details?: Array<{
13
+ field: string;
14
+ message: string;
15
+ }>;
16
+ }
17
+ export interface HashResult {
18
+ digest: string;
19
+ algorithm: string;
20
+ length: number;
21
+ }
22
+ export interface AeadResult {
23
+ ciphertext: string;
24
+ algorithm: string;
25
+ }
26
+ export interface KdfResult {
27
+ derivedKey: string;
28
+ salt: string;
29
+ algorithm: string;
30
+ keyLength: number;
31
+ }
32
+ export interface Ed25519KeyPair {
33
+ privateKey: string;
34
+ publicKey: string;
35
+ }
36
+ export interface SignResult {
37
+ signature: string;
38
+ algorithm: string;
39
+ }
40
+ export interface VerifyResult {
41
+ valid: boolean;
42
+ algorithm: string;
43
+ }
44
+ export interface HybridKeyPair {
45
+ x25519PrivateKey: string;
46
+ x25519PublicKey: string;
47
+ mlKemPublicKey: string;
48
+ mlKemSecretKey: string;
49
+ algorithm: string;
50
+ }
51
+ export interface HybridEncapsulateResult {
52
+ x25519EphemeralPublic: string;
53
+ mlKemCiphertext: string;
54
+ sharedSecret: string;
55
+ algorithm: string;
56
+ }
57
+ export interface MlDsaKeyPair {
58
+ publicKey: string;
59
+ secretKey: string;
60
+ algorithm: string;
61
+ }
62
+ export interface MlDsaSignResult {
63
+ signature: string;
64
+ algorithm: string;
65
+ }
66
+ export interface MlDsaVerifyResult {
67
+ valid: boolean;
68
+ algorithm: string;
69
+ }
70
+ export interface SlhDsaKeyPair {
71
+ publicKey: string;
72
+ secretKey: string;
73
+ algorithm: string;
74
+ }
75
+ export interface SlhDsaSignResult {
76
+ signature: string;
77
+ algorithm: string;
78
+ }
79
+ export interface SlhDsaVerifyResult {
80
+ valid: boolean;
81
+ algorithm: string;
82
+ }
83
+ export interface SecretboxSealResult {
84
+ sealed: string;
85
+ }
86
+ export interface SealedboxSealResult {
87
+ sealed: string;
88
+ ephemeralPublicKey: string;
89
+ }
90
+ export interface PasswordEncryptResult {
91
+ ciphertext: string;
92
+ }
93
+ export interface KeyWrapResult {
94
+ wrappedKey: string;
95
+ }
96
+ export interface KeyGenerateResult {
97
+ publicKey: string;
98
+ privateKey: string;
99
+ algorithm: string;
100
+ kid: string;
101
+ }
102
+ export interface DoraComplianceScorecard {
103
+ standard: string;
104
+ article: string;
105
+ status: string;
106
+ disclaimer: string;
107
+ quantumResistanceRatio: number;
108
+ activePrimitivesCount: number;
109
+ postQuantumPrimitivesCount: number;
110
+ algorithmDeprecationSchedule: Array<{
111
+ algorithm: string;
112
+ category: string;
113
+ sunsetDate: string;
114
+ recommendedMigration: string;
115
+ }>;
116
+ cryptographicInventory: Array<{
117
+ package: string;
118
+ version: string;
119
+ status: string;
120
+ fipsCompliance: string;
121
+ }>;
122
+ timestamp: string;
123
+ }
124
+ export interface CbomExportPayload {
125
+ bomFormat: string;
126
+ specVersion: string;
127
+ serialNumber: string;
128
+ version: number;
129
+ metadata: Record<string, unknown>;
130
+ components: Array<Record<string, unknown>>;
131
+ }
132
+ export interface AlgorithmNegotiationOptions {
133
+ maxPayloadBytes?: number;
134
+ securityCategoryMin?: 1 | 3 | 5;
135
+ requireHybrid?: boolean;
136
+ clientSupportedAlgorithms?: string[];
137
+ }
138
+ export interface AlgorithmNegotiationResult {
139
+ selectedAlgorithm: string;
140
+ cipherCategory: "lattice-kem" | "hybrid-kem" | "classical-ecdh";
141
+ securityCategory: 1 | 3 | 5;
142
+ isHybrid: boolean;
143
+ publicKeyBytes: number;
144
+ ciphertextBytes: number;
145
+ totalPayloadOverhead: number;
146
+ fitsWithinMtu: boolean;
147
+ fallbackChain: string[];
148
+ compliancePosture: {
149
+ standard: string;
150
+ doraArticle13Compliant: boolean;
151
+ fipsStandard: string;
152
+ };
153
+ }
154
+ export interface MacResult {
155
+ mac: string;
156
+ algorithm: string;
157
+ }
158
+ export interface PasswordHashResult {
159
+ hash: string;
160
+ salt: string;
161
+ params: {
162
+ t: number;
163
+ m: number;
164
+ p: number;
165
+ };
166
+ algorithm: string;
167
+ phc: string;
168
+ }
169
+ export declare class CryptoClient {
170
+ private baseUrl;
171
+ private headers;
172
+ private fetchFn;
173
+ constructor(options: ClientOptions);
174
+ private request;
175
+ encrypt(params: {
176
+ key: string;
177
+ plaintext: string;
178
+ }): Promise<ApiResponse<AeadResult>>;
179
+ decrypt(params: {
180
+ key: string;
181
+ ciphertext: string;
182
+ }): Promise<ApiResponse<{
183
+ plaintext: string;
184
+ }>>;
185
+ hash(params: {
186
+ algorithm: string;
187
+ data: string;
188
+ }): Promise<ApiResponse<HashResult>>;
189
+ kdf(params: {
190
+ algorithm: string;
191
+ password: string;
192
+ salt?: string;
193
+ keyLength?: number;
194
+ params?: Record<string, unknown>;
195
+ }): Promise<ApiResponse<KdfResult>>;
196
+ mac(params: {
197
+ algorithm: string;
198
+ key: string;
199
+ data: string;
200
+ }): Promise<ApiResponse<MacResult>>;
201
+ macVerify(params: {
202
+ algorithm: string;
203
+ key: string;
204
+ data: string;
205
+ mac: string;
206
+ }): Promise<ApiResponse<{
207
+ valid: boolean;
208
+ }>>;
209
+ passwordHash(params: {
210
+ password: string;
211
+ variant?: string;
212
+ timeCost?: number;
213
+ memoryCost?: number;
214
+ parallelism?: number;
215
+ }): Promise<ApiResponse<PasswordHashResult>>;
216
+ passwordVerify(params: {
217
+ password: string;
218
+ hash: string;
219
+ salt: string;
220
+ params: {
221
+ t: number;
222
+ m: number;
223
+ p: number;
224
+ };
225
+ variant?: string;
226
+ }): Promise<ApiResponse<{
227
+ valid: boolean;
228
+ }>>;
229
+ generateKeyPair(params?: {
230
+ algorithm?: string;
231
+ metadata?: Record<string, string>;
232
+ }): Promise<ApiResponse<KeyGenerateResult>>;
233
+ sign(params: {
234
+ privateKey: string;
235
+ message: string;
236
+ }): Promise<ApiResponse<SignResult>>;
237
+ verify(params: {
238
+ publicKey: string;
239
+ message: string;
240
+ signature: string;
241
+ }): Promise<ApiResponse<VerifyResult>>;
242
+ pqGenerateKeyPair(): Promise<ApiResponse<HybridKeyPair>>;
243
+ pqEncapsulate(params: {
244
+ x25519PublicKey: string;
245
+ mlKemPublicKey: string;
246
+ }): Promise<ApiResponse<HybridEncapsulateResult>>;
247
+ pqDecapsulate(params: {
248
+ x25519PrivateKey: string;
249
+ mlKemSecretKey: string;
250
+ x25519EphemeralPublic: string;
251
+ mlKemCiphertext: string;
252
+ }): Promise<ApiResponse<{
253
+ sharedSecret: string;
254
+ algorithm: string;
255
+ }>>;
256
+ pqSign(params: {
257
+ level: 44 | 65 | 87;
258
+ secretKey: string;
259
+ message: string;
260
+ }): Promise<ApiResponse<MlDsaSignResult>>;
261
+ pqVerify(params: {
262
+ level: 44 | 65 | 87;
263
+ publicKey: string;
264
+ message: string;
265
+ signature: string;
266
+ }): Promise<ApiResponse<MlDsaVerifyResult>>;
267
+ pqSignKeygen(params: {
268
+ level: 44 | 65 | 87;
269
+ }): Promise<ApiResponse<MlDsaKeyPair>>;
270
+ pqHashSign(params: {
271
+ variant: string;
272
+ secretKey: string;
273
+ message: string;
274
+ }): Promise<ApiResponse<SlhDsaSignResult>>;
275
+ pqHashVerify(params: {
276
+ variant: string;
277
+ publicKey: string;
278
+ message: string;
279
+ signature: string;
280
+ }): Promise<ApiResponse<SlhDsaVerifyResult>>;
281
+ pqHashSignKeygen(params: {
282
+ variant: string;
283
+ }): Promise<ApiResponse<SlhDsaKeyPair>>;
284
+ secretboxSeal(params: {
285
+ key: string;
286
+ plaintext: string;
287
+ aad?: string;
288
+ }): Promise<ApiResponse<SecretboxSealResult>>;
289
+ secretboxOpen(params: {
290
+ key: string;
291
+ ciphertext: string;
292
+ aad?: string;
293
+ }): Promise<ApiResponse<{
294
+ plaintext: string;
295
+ }>>;
296
+ sealedboxSeal(params: {
297
+ recipientPublicKey: string;
298
+ plaintext: string;
299
+ }): Promise<ApiResponse<SealedboxSealResult>>;
300
+ sealedboxOpen(params: {
301
+ recipientSecretKey: string;
302
+ sealed: string;
303
+ }): Promise<ApiResponse<{
304
+ plaintext: string;
305
+ }>>;
306
+ passwordEncrypt(params: {
307
+ password: string;
308
+ plaintext: string;
309
+ }): Promise<ApiResponse<PasswordEncryptResult>>;
310
+ passwordDecrypt(params: {
311
+ password: string;
312
+ ciphertext: string;
313
+ }): Promise<ApiResponse<{
314
+ plaintext: string;
315
+ }>>;
316
+ keyWrap(params: {
317
+ kek: string;
318
+ keyToWrap: string;
319
+ algorithm?: "aes-kw" | "aes-kwp";
320
+ }): Promise<ApiResponse<KeyWrapResult>>;
321
+ keyUnwrap(params: {
322
+ kek: string;
323
+ wrappedKey: string;
324
+ algorithm?: "aes-kw" | "aes-kwp";
325
+ }): Promise<ApiResponse<{
326
+ key: string;
327
+ }>>;
328
+ getDoraCompliance(): Promise<ApiResponse<DoraComplianceScorecard>>;
329
+ getCbom(): Promise<ApiResponse<CbomExportPayload>>;
330
+ negotiateAlgorithm(options?: AlgorithmNegotiationOptions): AlgorithmNegotiationResult;
331
+ algorithms(): Promise<ApiResponse<Record<string, string[]>>>;
332
+ health(): Promise<{
333
+ statusCode: number;
334
+ }>;
335
+ }
336
+ export declare class CryptoApiError extends Error {
337
+ readonly status: number;
338
+ readonly body: ApiError;
339
+ constructor(status: number, body: ApiError);
340
+ }
341
+ //# sourceMappingURL=index.d.ts.map
package/dist/index.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,aAAa;IAE5B,OAAO,EAAE,MAAM,CAAC;IAEhB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC;AAWD,MAAM,WAAW,WAAW,CAAC,CAAC;IAE5B,IAAI,EAAE,CAAC,CAAC;CACT;AAeD,MAAM,WAAW,QAAQ;IAEvB,KAAK,EAAE,MAAM,CAAC;IAEd,OAAO,CAAC,EAAE,KAAK,CAAC;QAEd,KAAK,EAAE,MAAM,CAAC;QAEd,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAcD,MAAM,WAAW,UAAU;IAEzB,MAAM,EAAE,MAAM,CAAC;IAEf,SAAS,EAAE,MAAM,CAAC;IAElB,MAAM,EAAE,MAAM,CAAC;CAChB;AAYD,MAAM,WAAW,UAAU;IAEzB,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAYD,MAAM,WAAW,SAAS;IAExB,UAAU,EAAE,MAAM,CAAC;IAEnB,IAAI,EAAE,MAAM,CAAC;IAEb,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;CACnB;AAWD,MAAM,WAAW,cAAc;IAE7B,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAYD,MAAM,WAAW,UAAU;IAEzB,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;CACnB;AAYD,MAAM,WAAW,YAAY;IAE3B,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,MAAM,CAAC;CACnB;AAYD,MAAM,WAAW,aAAa;IAE5B,gBAAgB,EAAE,MAAM,CAAC;IAEzB,eAAe,EAAE,MAAM,CAAC;IAExB,cAAc,EAAE,MAAM,CAAC;IAEvB,cAAc,EAAE,MAAM,CAAC;IAEvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAeD,MAAM,WAAW,uBAAuB;IAEtC,qBAAqB,EAAE,MAAM,CAAC;IAE9B,eAAe,EAAE,MAAM,CAAC;IAExB,YAAY,EAAE,MAAM,CAAC;IAErB,SAAS,EAAE,MAAM,CAAC;CACnB;AAYD,MAAM,WAAW,YAAY;IAE3B,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;CACnB;AAYD,MAAM,WAAW,eAAe;IAE9B,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;CACnB;AAYD,MAAM,WAAW,iBAAiB;IAEhC,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,MAAM,CAAC;CACnB;AAYD,MAAM,WAAW,aAAa;IAE5B,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;CACnB;AAYD,MAAM,WAAW,gBAAgB;IAE/B,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;CACnB;AAYD,MAAM,WAAW,kBAAkB;IAEjC,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,MAAM,CAAC;CACnB;AAYD,MAAM,WAAW,mBAAmB;IAElC,MAAM,EAAE,MAAM,CAAC;CAChB;AAYD,MAAM,WAAW,mBAAmB;IAElC,MAAM,EAAE,MAAM,CAAC;IAEf,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAYD,MAAM,WAAW,qBAAqB;IAEpC,UAAU,EAAE,MAAM,CAAC;CACpB;AAYD,MAAM,WAAW,aAAa;IAE5B,UAAU,EAAE,MAAM,CAAC;CACpB;AAYD,MAAM,WAAW,iBAAiB;IAEhC,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAElB,GAAG,EAAE,MAAM,CAAC;CACb;AAMD,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,EAAE,MAAM,CAAC;IAEjB,OAAO,EAAE,MAAM,CAAC;IAEhB,MAAM,EAAE,MAAM,CAAC;IAEf,UAAU,EAAE,MAAM,CAAC;IAEnB,sBAAsB,EAAE,MAAM,CAAC;IAE/B,qBAAqB,EAAE,MAAM,CAAC;IAE9B,0BAA0B,EAAE,MAAM,CAAC;IAEnC,4BAA4B,EAAE,KAAK,CAAC;QAClC,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,oBAAoB,EAAE,MAAM,CAAC;KAC9B,CAAC,CAAC;IAEH,sBAAsB,EAAE,KAAK,CAAC;QAC5B,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC,CAAC;IAEH,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,iBAAiB;IAEhC,SAAS,EAAE,MAAM,CAAC;IAElB,WAAW,EAAE,MAAM,CAAC;IAEpB,YAAY,EAAE,MAAM,CAAC;IAErB,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAElC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC5C;AAGD,MAAM,WAAW,2BAA2B;IAE1C,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,mBAAmB,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEhC,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAC;CACtC;AAGD,MAAM,WAAW,0BAA0B;IAEzC,iBAAiB,EAAE,MAAM,CAAC;IAE1B,cAAc,EAAE,aAAa,GAAG,YAAY,GAAG,gBAAgB,CAAC;IAEhE,gBAAgB,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAE5B,QAAQ,EAAE,OAAO,CAAC;IAElB,cAAc,EAAE,MAAM,CAAC;IAEvB,eAAe,EAAE,MAAM,CAAC;IAExB,oBAAoB,EAAE,MAAM,CAAC;IAE7B,aAAa,EAAE,OAAO,CAAC;IAEvB,aAAa,EAAE,MAAM,EAAE,CAAC;IAExB,iBAAiB,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,sBAAsB,EAAE,OAAO,CAAC;QAChC,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAYD,MAAM,WAAW,SAAS;IAExB,GAAG,EAAE,MAAM,CAAC;IAEZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAaD,MAAM,WAAW,kBAAkB;IAEjC,IAAI,EAAE,MAAM,CAAC;IAEb,IAAI,EAAE,MAAM,CAAC;IAEb,MAAM,EAAE;QAEN,CAAC,EAAE,MAAM,CAAC;QAEV,CAAC,EAAE,MAAM,CAAC;QAEV,CAAC,EAAE,MAAM,CAAC;KACX,CAAC;IAEF,SAAS,EAAE,MAAM,CAAC;IAElB,GAAG,EAAE,MAAM,CAAC;CACb;AAYD,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,OAAO,CAAyB;IACxC,OAAO,CAAC,OAAO,CAA0B;gBAE7B,OAAO,EAAE,aAAa;YAapB,OAAO;IAwBf,OAAO,CAAC,MAAM,EAAE;QACpB,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAK9B,OAAO,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CACjE,WAAW,CAAC;QAEV,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH;IAOK,IAAI,CAAC,MAAM,EAAE;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAO9B,GAAG,CAAC,MAAM,EAAE;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAO7B,GAAG,CAAC,MAAM,EAAE;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAK7B,SAAS,CAAC,MAAM,EAAE;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;KACb,GAAG,OAAO,CACT,WAAW,CAAC;QAEV,KAAK,EAAE,OAAO,CAAC;KAChB,CAAC,CACH;IAOK,YAAY,CAAC,MAAM,EAAE;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAKtC,cAAc,CAAC,MAAM,EAAE;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE;YAAE,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CACT,WAAW,CAAC;QAEV,KAAK,EAAE,OAAO,CAAC;KAChB,CAAC,CACH;IAOK,eAAe,CAAC,MAAM,CAAC,EAAE;QAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACnC,GAAG,OAAO,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IASrC,IAAI,CAAC,MAAM,EAAE;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAK9B,MAAM,CAAC,MAAM,EAAE;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAOhC,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IAKxD,aAAa,CAAC,MAAM,EAAE;QAC1B,eAAe,EAAE,MAAM,CAAC;QACxB,cAAc,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IAK3C,aAAa,CAAC,MAAM,EAAE;QAC1B,gBAAgB,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC;QACvB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,eAAe,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CACT,WAAW,CAAC;QAEV,YAAY,EAAE,MAAM,CAAC;QAErB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH;IAOK,MAAM,CAAC,MAAM,EAAE;QACnB,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;IAKnC,QAAQ,CAAC,MAAM,EAAE;QACrB,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAKrC,YAAY,CAAC,MAAM,EAAE;QACzB,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;KACrB,GAAG,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAOhC,UAAU,CAAC,MAAM,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAKpC,YAAY,CAAC,MAAM,EAAE;QACzB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAKtC,gBAAgB,CAAC,MAAM,EAAE;QAC7B,OAAO,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IAOjC,aAAa,CAAC,MAAM,EAAE;QAC1B,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAKvC,aAAa,CAAC,MAAM,EAAE;QAC1B,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;QACnB,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CACT,WAAW,CAAC;QAEV,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH;IAOK,aAAa,CAAC,MAAM,EAAE;QAC1B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAKvC,aAAa,CAAC,MAAM,EAAE;QAC1B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CACT,WAAW,CAAC;QAEV,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH;IAOK,eAAe,CAAC,MAAM,EAAE;QAC5B,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAKzC,eAAe,CAAC,MAAM,EAAE;QAC5B,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CACT,WAAW,CAAC;QAEV,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH;IAOK,OAAO,CAAC,MAAM,EAAE;QACpB,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;KAClC,GAAG,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IAKjC,SAAS,CAAC,MAAM,EAAE;QACtB,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;KAClC,GAAG,OAAO,CACT,WAAW,CAAC;QAEV,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CACH;IAOK,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IAKlE,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAUxD,kBAAkB,CAChB,OAAO,GAAE,2BAAgC,GACxC,0BAA0B;IAyHvB,UAAU,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAK5D,MAAM,IAAI,OAAO,CAAC;QAEtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CAIH;AAgBD,qBAAa,cAAe,SAAQ,KAAK;IAEvC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAE/B,SAAgB,IAAI,EAAE,QAAQ,CAAC;gBAEnB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ;CAM3C"}
package/dist/index.js ADDED
@@ -0,0 +1,245 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.CryptoApiError = exports.CryptoClient = void 0;
4
+ class CryptoClient {
5
+ baseUrl;
6
+ headers;
7
+ fetchFn;
8
+ constructor(options) {
9
+ this.baseUrl = options.baseUrl.replace(/\/$/, "");
10
+ this.fetchFn = options.fetch ?? globalThis.fetch;
11
+ this.headers = { "Content-Type": "application/json" };
12
+ if (options.apiKey) {
13
+ this.headers["x-api-key"] = options.apiKey;
14
+ }
15
+ if (options.token) {
16
+ this.headers["Authorization"] = `Bearer ${options.token}`;
17
+ }
18
+ }
19
+ async request(method, path, body) {
20
+ const init = {
21
+ method,
22
+ headers: this.headers,
23
+ };
24
+ if (body) {
25
+ init.body = JSON.stringify(body);
26
+ }
27
+ const res = await this.fetchFn(`${this.baseUrl}${path}`, init);
28
+ const json = await res.json();
29
+ if (!res.ok) {
30
+ throw new CryptoApiError(res.status, json);
31
+ }
32
+ return json;
33
+ }
34
+ async encrypt(params) {
35
+ return this.request("POST", "/v2/encrypt", params);
36
+ }
37
+ async decrypt(params) {
38
+ return this.request("POST", "/v2/decrypt", params);
39
+ }
40
+ async hash(params) {
41
+ return this.request("POST", "/v2/hash", params);
42
+ }
43
+ async kdf(params) {
44
+ return this.request("POST", "/v2/kdf", params);
45
+ }
46
+ async mac(params) {
47
+ return this.request("POST", "/v2/hmac", params);
48
+ }
49
+ async macVerify(params) {
50
+ return this.request("POST", "/v2/hmac/verify", params);
51
+ }
52
+ async passwordHash(params) {
53
+ return this.request("POST", "/v2/password/hash", params);
54
+ }
55
+ async passwordVerify(params) {
56
+ return this.request("POST", "/v2/password/verify", params);
57
+ }
58
+ async generateKeyPair(params) {
59
+ return this.request("POST", "/v2/keys/generate", params ?? { algorithm: "ed25519" });
60
+ }
61
+ async sign(params) {
62
+ return this.request("POST", "/v2/sign", params);
63
+ }
64
+ async verify(params) {
65
+ return this.request("POST", "/v2/verify", params);
66
+ }
67
+ async pqGenerateKeyPair() {
68
+ return this.request("POST", "/v2/pq/hybrid/keygen", {});
69
+ }
70
+ async pqEncapsulate(params) {
71
+ return this.request("POST", "/v2/pq/hybrid/encapsulate", params);
72
+ }
73
+ async pqDecapsulate(params) {
74
+ return this.request("POST", "/v2/pq/hybrid/decapsulate", params);
75
+ }
76
+ async pqSign(params) {
77
+ return this.request("POST", "/v2/pq/dsa/sign", params);
78
+ }
79
+ async pqVerify(params) {
80
+ return this.request("POST", "/v2/pq/dsa/verify", params);
81
+ }
82
+ async pqSignKeygen(params) {
83
+ return this.request("POST", "/v2/pq/dsa/keygen", params);
84
+ }
85
+ async pqHashSign(params) {
86
+ return this.request("POST", "/v2/pq/hash-sign/sign", params);
87
+ }
88
+ async pqHashVerify(params) {
89
+ return this.request("POST", "/v2/pq/hash-sign/verify", params);
90
+ }
91
+ async pqHashSignKeygen(params) {
92
+ return this.request("POST", "/v2/pq/hash-sign/keygen", params);
93
+ }
94
+ async secretboxSeal(params) {
95
+ return this.request("POST", "/v2/secretbox/seal", params);
96
+ }
97
+ async secretboxOpen(params) {
98
+ return this.request("POST", "/v2/secretbox/open", params);
99
+ }
100
+ async sealedboxSeal(params) {
101
+ return this.request("POST", "/v2/sealedbox/seal", params);
102
+ }
103
+ async sealedboxOpen(params) {
104
+ return this.request("POST", "/v2/sealedbox/open", params);
105
+ }
106
+ async passwordEncrypt(params) {
107
+ return this.request("POST", "/v2/password/encrypt", params);
108
+ }
109
+ async passwordDecrypt(params) {
110
+ return this.request("POST", "/v2/password/decrypt", params);
111
+ }
112
+ async keyWrap(params) {
113
+ return this.request("POST", "/v2/keys/wrap", params);
114
+ }
115
+ async keyUnwrap(params) {
116
+ return this.request("POST", "/v2/keys/unwrap", params);
117
+ }
118
+ async getDoraCompliance() {
119
+ return this.request("GET", "/v2/compliance/dora");
120
+ }
121
+ async getCbom() {
122
+ return this.request("GET", "/v2/compliance/cbom");
123
+ }
124
+ negotiateAlgorithm(options = {}) {
125
+ const minCategory = options.securityCategoryMin ?? 1;
126
+ const requireHybrid = options.requireHybrid ?? false;
127
+ const maxBytes = options.maxPayloadBytes ?? Infinity;
128
+ const clientAlgos = options.clientSupportedAlgorithms;
129
+ const catalog = [
130
+ {
131
+ name: "x448-mlkem1024",
132
+ category: "hybrid-kem",
133
+ level: 5,
134
+ isHybrid: true,
135
+ pk: 1624,
136
+ ct: 1624,
137
+ fips: "FIPS 203 + RFC 7748",
138
+ },
139
+ {
140
+ name: "ml-kem-1024",
141
+ category: "lattice-kem",
142
+ level: 5,
143
+ isHybrid: false,
144
+ pk: 1568,
145
+ ct: 1568,
146
+ fips: "FIPS 203",
147
+ },
148
+ {
149
+ name: "x25519-mlkem768",
150
+ category: "hybrid-kem",
151
+ level: 3,
152
+ isHybrid: true,
153
+ pk: 1216,
154
+ ct: 1120,
155
+ fips: "FIPS 203 + X25519 hybrid",
156
+ },
157
+ {
158
+ name: "ml-kem-768",
159
+ category: "lattice-kem",
160
+ level: 3,
161
+ isHybrid: false,
162
+ pk: 1184,
163
+ ct: 1088,
164
+ fips: "FIPS 203",
165
+ },
166
+ {
167
+ name: "x25519-mlkem512",
168
+ category: "hybrid-kem",
169
+ level: 1,
170
+ isHybrid: true,
171
+ pk: 832,
172
+ ct: 800,
173
+ fips: "FIPS 203 + X25519 hybrid",
174
+ },
175
+ {
176
+ name: "ml-kem-512",
177
+ category: "lattice-kem",
178
+ level: 1,
179
+ isHybrid: false,
180
+ pk: 800,
181
+ ct: 768,
182
+ fips: "FIPS 203",
183
+ },
184
+ {
185
+ name: "x25519",
186
+ category: "classical-ecdh",
187
+ level: 1,
188
+ isHybrid: false,
189
+ pk: 32,
190
+ ct: 32,
191
+ fips: "RFC 7748 (Legacy)",
192
+ },
193
+ ];
194
+ const fallbackChain = catalog.map((c) => c.name);
195
+ const eligible = catalog.filter((candidate) => {
196
+ if (candidate.level < minCategory)
197
+ return false;
198
+ if (requireHybrid && !candidate.isHybrid)
199
+ return false;
200
+ if (clientAlgos && !clientAlgos.includes(candidate.name))
201
+ return false;
202
+ return true;
203
+ });
204
+ const selected = eligible.find((c) => c.ct <= maxBytes) ??
205
+ eligible[0] ??
206
+ catalog[catalog.length - 1];
207
+ const fitsWithinMtu = selected.ct <= maxBytes;
208
+ return {
209
+ selectedAlgorithm: selected.name,
210
+ cipherCategory: selected.category,
211
+ securityCategory: selected.level,
212
+ isHybrid: selected.isHybrid,
213
+ publicKeyBytes: selected.pk,
214
+ ciphertextBytes: selected.ct,
215
+ totalPayloadOverhead: selected.pk + selected.ct,
216
+ fitsWithinMtu,
217
+ fallbackChain,
218
+ compliancePosture: {
219
+ standard: "NIST Post-Quantum Cryptography Standardization",
220
+ doraArticle13Compliant: selected.level >= 3 || selected.isHybrid,
221
+ fipsStandard: selected.fips,
222
+ },
223
+ };
224
+ }
225
+ async algorithms() {
226
+ return this.request("GET", "/v2/algorithms");
227
+ }
228
+ async health() {
229
+ const res = await this.fetchFn(`${this.baseUrl}/health`);
230
+ return res.json();
231
+ }
232
+ }
233
+ exports.CryptoClient = CryptoClient;
234
+ class CryptoApiError extends Error {
235
+ status;
236
+ body;
237
+ constructor(status, body) {
238
+ super(`API Error ${status}: ${body.error}`);
239
+ this.name = "CryptoApiError";
240
+ this.status = status;
241
+ this.body = body;
242
+ }
243
+ }
244
+ exports.CryptoApiError = CryptoApiError;
245
+ //# sourceMappingURL=index.js.map
package/package.json ADDED
@@ -0,0 +1,60 @@
1
+ {
2
+ "name": "@sebastienrousseau/crypto-sdk",
3
+ "version": "0.0.8",
4
+ "description": "Type-safe TypeScript client for the Crypto Service Suite v2 API. Zero dependencies, fetch-based.",
5
+ "author": "Sebastien Rousseau <sebastienrousseau@users.noreply.github.com>",
6
+ "license": "MIT OR Apache-2.0",
7
+ "engines": {
8
+ "node": ">=22.0.0"
9
+ },
10
+ "main": "./dist/index.js",
11
+ "types": "./dist/index.d.ts",
12
+ "sideEffects": false,
13
+ "exports": {
14
+ ".": {
15
+ "types": "./dist/index.d.ts",
16
+ "require": "./dist/index.js",
17
+ "import": "./dist/index.js"
18
+ }
19
+ },
20
+ "files": [
21
+ "dist/**/*.js",
22
+ "dist/**/*.d.ts",
23
+ "dist/**/*.d.ts.map"
24
+ ],
25
+ "devDependencies": {
26
+ "@sebastienrousseau/mocha-config": "^0.0.5",
27
+ "@types/chai": "^4.3.7",
28
+ "@types/chai-as-promised": "^8.0.2",
29
+ "@types/mocha": "^10.0.2",
30
+ "@types/node": "^26.6.3",
31
+ "c8": "^12.0.0",
32
+ "chai": "^4.5.0",
33
+ "chai-as-promised": "^7.1.2",
34
+ "mocha": "^10.8.2",
35
+ "rimraf": "^6.1.3",
36
+ "ts-node": "^10.9.2",
37
+ "typedoc": "^0.28.20",
38
+ "typescript": "~5.9.3"
39
+ },
40
+ "homepage": "https://github.com/sebastienrousseau/crypto-service/tree/main/packages/crypto-sdk",
41
+ "repository": {
42
+ "type": "git",
43
+ "url": "git+https://github.com/sebastienrousseau/crypto-service.git",
44
+ "directory": "packages/crypto-sdk"
45
+ },
46
+ "publishConfig": {
47
+ "access": "public"
48
+ },
49
+ "private": false,
50
+ "scripts": {
51
+ "build": "tsc --build tsconfig.json",
52
+ "clean": "rimraf ./coverage ./dist ./docs",
53
+ "test": "c8 --check-coverage --lines 100 --branches 100 --functions 100 --reporter=lcov --reporter=text mocha --config=.mocharc.cjs",
54
+ "docs": "typedoc",
55
+ "lint": "eslint --ext .ts src __tests__",
56
+ "lint:fix": "eslint --cache --fix --ext .ts src __tests__",
57
+ "format": "prettier --write src/**/*.ts",
58
+ "format:check": "prettier --check \"src/**/*.ts\""
59
+ }
60
+ }