@sebastienrousseau/crypto-server 0.0.1 → 0.0.8

package/dist/routes/v1/index.d.ts

@@ -0,0 +1,4 @@
+import * as fastify from "fastify";
+declare const _default: (app: fastify.FastifyInstance) => void;
+export default _default;
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/v1/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/v1/index.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;yBAUnB,KAAK,OAAO,CAAC,eAAe,KAAG,IAAI;AAAnD,wBAcE"}

package/dist/routes/v1/index.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const uuid_1 = require("uuid");
+const constants_1 = require("../../config/constants");
+const id = (0, uuid_1.v4)();
+exports.default = (app) => {
+    app.get("/", async () => {
+        return {
+            id: id,
+            title: "Welcome to Crypto Server",
+            description: "Crypto Server is a Fastify web server that exposes easy consumable REST APIs to perform low-level cryptographic operations.",
+            details: "It supports the following cryptographic operations:\n- Digital Signing,\n- Encryption and Decryption,\n- Key Generation,\n- Key Management,\n- Pseudorandom Number Generation,\n- Signature Verification.\n- Development of this server is hosted by GitHub at the following page. Source code is available to everyone under the standard MIT license.",
+            license: "MIT",
+            url: "https://crypto-server.com",
+            version: constants_1.LIB_VERSION,
+        };
+    });
+};
+//# sourceMappingURL=index.js.map

package/dist/routes/v1/revoke.d.ts

@@ -1,4 +1,4 @@
-import * as fastify from 'fastify';
-declare const _default: (app: fastify.FastifyInstance) => void;
+import type { FastifyInstance } from "fastify";
+declare const _default: (app: FastifyInstance) => void;
 export default _default;
 //# sourceMappingURL=revoke.d.ts.map

package/dist/routes/v1/revoke.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"revoke.d.ts","sourceRoot":"","sources":["../../../src/routes/v1/revoke.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;8BAId,QAAQ,eAAe;AAA5C,wBASE"}
+{"version":3,"file":"revoke.d.ts","sourceRoot":"","sources":["../../../src/routes/v1/revoke.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBA8C/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAgCE"}

package/dist/routes/v1/revoke.js

@@ -4,12 +4,64 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const revoke_1 = __importDefault(require("@sebastienrousseau/crypto-lib/dist/lib/revoke"));
+const types_1 = require("../../@types/types");
+const validation_1 = require("../../utils/validation");
+const route_helpers_1 = require("../../utils/route-helpers");
+const revokeSchema = {
+    tags: ["Key Management"],
+    summary: "Revoke a key pair",
+    description: "Revokes the shipped key pair with a reason code (0=unspecified, 1=superseded, 2=compromised, 3=retired). Returns the revoked public key only.",
+    response: {
+        200: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                data: {
+                    type: "object",
+                    additionalProperties: false,
+                    properties: { publicKey: { type: "string" } },
+                },
+            },
+        },
+        400: {
+            type: "object",
+            properties: { error: { type: "string" }, details: { type: "array" } },
+        },
+        401: { type: "object", properties: { error: { type: "string" } } },
+    },
+    body: {
+        type: "object",
+        required: ["passphrase", "flag", "reason"],
+        additionalProperties: false,
+        properties: {
+            passphrase: { type: "string", minLength: 1, maxLength: 1024 },
+            flag: { type: "number", enum: [...types_1.REVOCATION_FLAGS] },
+            reason: { type: "string", minLength: 1, maxLength: 2048 },
+        },
+    },
+};
 exports.default = (app) => {
-    app.get("/v1/revoke", async (request, reply) => {
-        const encryptedData = await (0, revoke_1.default)({
-            passphrase: request.headers["passphrase"],
-        });
-        reply.send({ data: encryptedData });
+    app.post("/v1/revoke", { schema: revokeSchema }, async (request, reply) => {
+        try {
+            const body = request.body;
+            const v = (0, route_helpers_1.collectValidation)({
+                passphrase: (0, validation_1.validateRequiredString)(body.passphrase, "passphrase"),
+                flag: (0, validation_1.validateRequiredNumber)(body.flag, "flag", { min: 0, max: 3 }),
+                reason: (0, validation_1.validateRequiredString)(body.reason, "reason"),
+            }, reply);
+            if (!v)
+                return;
+            const revocationData = await (0, revoke_1.default)({
+                passphrase: v.passphrase,
+                flag: v.flag,
+                reason: v.reason,
+            });
+            return reply.send({ data: { publicKey: revocationData.publicKey } });
+        }
+        catch (error) {
+            request.log.error(error, "Revocation operation failed");
+            return reply.status(500).send({ error: "Revocation failed" });
+        }
     });
 };
 //# sourceMappingURL=revoke.js.map

package/dist/routes/v1/verify.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyInstance } from "fastify";
+declare const _default: (app: FastifyInstance) => void;
+export default _default;
+//# sourceMappingURL=verify.d.ts.map

package/dist/routes/v1/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/routes/v1/verify.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAyC/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAiCE"}

package/dist/routes/v1/verify.js

@@ -0,0 +1,60 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const verify_1 = __importDefault(require("@sebastienrousseau/crypto-lib/dist/lib/verify"));
+const validation_1 = require("../../utils/validation");
+const route_helpers_1 = require("../../utils/route-helpers");
+const verifySchema = {
+    tags: ["Signing"],
+    summary: "Verify a signed message",
+    description: "Verifies a cleartext-signed PGP message against the supplied verification keys.",
+    response: {
+        200: {
+            type: "object",
+            additionalProperties: true,
+            properties: { data: {} },
+        },
+        400: {
+            type: "object",
+            properties: { error: { type: "string" }, details: { type: "array" } },
+        },
+        401: { type: "object", properties: { error: { type: "string" } } },
+    },
+    body: {
+        type: "object",
+        required: ["date", "message", "verificationKeys"],
+        additionalProperties: false,
+        properties: {
+            date: { type: "string", minLength: 1, maxLength: 64 },
+            message: { type: "string", minLength: 1, maxLength: 1024 * 1024 },
+            verificationKeys: { type: "string", minLength: 1, maxLength: 64 * 1024 },
+        },
+    },
+};
+exports.default = (app) => {
+    app.post("/v1/verify", { schema: verifySchema }, async (request, reply) => {
+        try {
+            const body = request.body;
+            const v = (0, route_helpers_1.collectValidation)({
+                date: (0, validation_1.validateDateString)(body.date, "date"),
+                message: (0, validation_1.validateRequiredString)(body.message, "message"),
+                verificationKeys: (0, validation_1.validateBase64)(body.verificationKeys, "verificationKeys"),
+            }, reply);
+            if (!v)
+                return;
+            const verifyData = await (0, verify_1.default)({
+                date: v.date,
+                message: v.message,
+                verificationKeys: v.verificationKeys,
+            });
+            return reply.send({ data: verifyData });
+        }
+        catch (error) {
+            request.log.error(error, "Verification operation failed");
+            return reply.status(500).send({ error: "Verification failed" });
+        }
+    });
+};
+//# sourceMappingURL=verify.js.map

package/dist/routes/v2/algorithms.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyInstance } from "fastify";
+declare const _default: (app: FastifyInstance) => void;
+export default _default;
+//# sourceMappingURL=algorithms.d.ts.map

package/dist/routes/v2/algorithms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"algorithms.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/algorithms.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAI/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAeE"}

package/dist/routes/v2/algorithms.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const modern_1 = require("@sebastienrousseau/crypto-lib/dist/modern");
+exports.default = (app) => {
+    app.get("/v2/algorithms", {
+        schema: {
+            tags: ["Algorithms"],
+            summary: "List supported algorithms",
+            description: "Returns all cryptographic algorithms supported by the v2 API.",
+        },
+    }, async () => {
+        return { data: modern_1.SUPPORTED_ALGORITHMS };
+    });
+};
+//# sourceMappingURL=algorithms.js.map

package/dist/routes/v2/compliance.d.ts

@@ -0,0 +1,31 @@
+import type { FastifyInstance } from "fastify";
+import type { CbomPayload } from "../../enterprise/types";
+export declare function readPackageVersion(dir: string): string;
+export interface InventoryRecord {
+    readonly package: string;
+    readonly version: string;
+    readonly status: "implemented" | "partial" | "placeholder";
+    readonly fipsCompliance: string;
+}
+export interface DoraSelfAssessment {
+    readonly standard: "DORA (EU 2022/2554)";
+    readonly article: "Article 9 & Article 13";
+    readonly status: string;
+    readonly disclaimer: string;
+    readonly quantumResistanceRatio: number;
+    readonly activePrimitivesCount: number;
+    readonly postQuantumPrimitivesCount: number;
+    readonly algorithmDeprecationSchedule: ReadonlyArray<{
+        readonly algorithm: string;
+        readonly category: "symmetric" | "asymmetric";
+        readonly sunsetDate: string;
+        readonly recommendedMigration: string;
+    }>;
+    readonly cryptographicInventory: ReadonlyArray<InventoryRecord>;
+    readonly timestamp: string;
+}
+export declare function buildDoraSelfAssessment(now?: Date): DoraSelfAssessment;
+export declare function buildCbom(now?: Date): CbomPayload;
+declare const _default: (app: FastifyInstance) => void;
+export default _default;
+//# sourceMappingURL=compliance.d.ts.map

package/dist/routes/v2/compliance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/compliance.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAe1D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQtD;AAGD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,aAAa,CAAC;IAE3D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAGD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,4BAA4B,EAAE,aAAa,CAAC;QACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,WAAW,GAAG,YAAY,CAAC;QAC9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;KACvC,CAAC,CAAC;IACH,QAAQ,CAAC,sBAAsB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AA4FD,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,IAAiB,GACrB,kBAAkB,CAmBpB;AA8CD,wBAAgB,SAAS,CAAC,GAAG,GAAE,IAAiB,GAAG,WAAW,CA0B7D;yBAGe,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAyDE"}

package/dist/routes/v2/compliance.js

@@ -0,0 +1,223 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readPackageVersion = readPackageVersion;
+exports.buildDoraSelfAssessment = buildDoraSelfAssessment;
+exports.buildCbom = buildCbom;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const modern_1 = require("@sebastienrousseau/crypto-lib/dist/modern");
+const PACKAGES_ROOT = node_path_1.default.resolve(__dirname, "..", "..", "..", "..");
+function readPackageVersion(dir) {
+    try {
+        const file = node_path_1.default.join(PACKAGES_ROOT, dir, "package.json");
+        return JSON.parse((0, node_fs_1.readFileSync)(file, "utf8"))
+            .version;
+    }
+    catch {
+        return "unknown";
+    }
+}
+const DISCLAIMER = "Self-reported inventory generated by crypto-server. It is not a DORA " +
+    "compliance assessment, audit or certification. Counts are algorithm " +
+    "identifiers listed by crypto-lib's SUPPORTED_ALGORITHMS, not a measure " +
+    "of any deployment. Sunset dates are project recommendations, not " +
+    "regulatory deadlines. No module in this suite is FIPS 140-3 validated.";
+const POST_QUANTUM_ID = /ml-kem|ml-dsa|slh-dsa|fn-dsa/;
+const ALGORITHM_IDS = new Set(Object.values(modern_1.SUPPORTED_ALGORITHMS).flat());
+const POST_QUANTUM_COUNT = [...ALGORITHM_IDS].filter((id) => POST_QUANTUM_ID.test(id)).length;
+const DEPRECATION_SCHEDULE = [
+    {
+        algorithm: "RSA-2048",
+        category: "asymmetric",
+        sunsetDate: "2026-12-31T23:59:59Z",
+        recommendedMigration: "FIPS 203 ML-KEM-768 / FIPS 204 ML-DSA-65",
+    },
+    {
+        algorithm: "ECDSA (secp256r1 / P-256)",
+        category: "asymmetric",
+        sunsetDate: "2027-12-31T23:59:59Z",
+        recommendedMigration: "FIPS 204 ML-DSA-44 / Ed25519-ML-DSA Hybrid",
+    },
+    {
+        algorithm: "Classical X25519 ECDH",
+        category: "asymmetric",
+        sunsetDate: "2030-01-01T00:00:00Z",
+        recommendedMigration: "Hybrid X25519 + ML-KEM-768 (X25519MLKEM768 per RFC 10024 for TLS 1.3)",
+    },
+    {
+        algorithm: "Triple-DES (3DES) & RC4",
+        category: "symmetric",
+        sunsetDate: "Immediate (Deprecated)",
+        recommendedMigration: "AES-256-GCM / ChaCha20-Poly1305",
+    },
+];
+const INVENTORY = [
+    {
+        package: "@sebastienrousseau/crypto-lib",
+        status: "implemented",
+        fipsCompliance: "Implements FIPS 203/204/205 algorithms (ML-KEM, ML-DSA, SLH-DSA) and Falcon (FN-DSA) via @noble/post-quantum; not a validated cryptographic module",
+    },
+    {
+        package: "@sebastienrousseau/crypto-wasm",
+        status: "placeholder",
+        fipsCompliance: "Contains no WebAssembly code; all operations run in JavaScript",
+    },
+    {
+        package: "@sebastienrousseau/crypto-kms",
+        status: "partial",
+        fipsCompliance: "AWS KMS and in-memory local providers; GCP, Azure and Vault providers are stubs; PKCS#11 provider is a software simulation; not FIPS 140 validated",
+    },
+    {
+        package: "@sebastienrousseau/crypto-edge",
+        status: "implemented",
+        fipsCompliance: "Web Crypto API adapter with TextEncoder/TextDecoder and base64 fallbacks; not a validated cryptographic module",
+    },
+    {
+        package: "@sebastienrousseau/crypto-cbom",
+        status: "implemented",
+        fipsCompliance: "Generates CycloneDX 1.6 and SPDX 3.0 CBOM documents",
+    },
+    {
+        package: "@sebastienrousseau/crypto-mcp",
+        status: "implemented",
+        fipsCompliance: "Model Context Protocol server exposing crypto operations",
+    },
+    {
+        package: "@sebastienrousseau/crypto-lsp",
+        status: "implemented",
+        fipsCompliance: "Language server flagging quantum-vulnerable algorithm names with pattern rules",
+    },
+];
+function buildDoraSelfAssessment(now = new Date()) {
+    return {
+        standard: "DORA (EU 2022/2554)",
+        article: "Article 9 & Article 13",
+        status: "Self-assessment (not a compliance verdict)",
+        disclaimer: DISCLAIMER,
+        quantumResistanceRatio: Math.round((POST_QUANTUM_COUNT / ALGORITHM_IDS.size) * 100) / 100,
+        activePrimitivesCount: ALGORITHM_IDS.size,
+        postQuantumPrimitivesCount: POST_QUANTUM_COUNT,
+        algorithmDeprecationSchedule: DEPRECATION_SCHEDULE,
+        cryptographicInventory: INVENTORY.map((record) => ({
+            ...record,
+            version: readPackageVersion(record.package.replace("@sebastienrousseau/", "")),
+        })),
+        timestamp: now.toISOString(),
+    };
+}
+const CBOM_COMPONENTS = [
+    {
+        type: "cryptographic-asset",
+        name: "ML-KEM-768",
+        version: "FIPS-203",
+        properties: [
+            { name: "algorithm-family", value: "Module-Lattice KEM" },
+            { name: "quantum-security-category", value: "3" },
+            { name: "implementation", value: "@noble/post-quantum" },
+        ],
+    },
+    {
+        type: "cryptographic-asset",
+        name: "ML-DSA-65",
+        version: "FIPS-204",
+        properties: [
+            { name: "algorithm-family", value: "Module-Lattice Signatures" },
+            { name: "quantum-security-category", value: "3" },
+            { name: "implementation", value: "@noble/post-quantum" },
+        ],
+    },
+    {
+        type: "cryptographic-asset",
+        name: "SLH-DSA-128s",
+        version: "FIPS-205",
+        properties: [
+            { name: "algorithm-family", value: "Stateless Hash-Based Signatures" },
+            { name: "quantum-security-category", value: "1" },
+            { name: "implementation", value: "@noble/post-quantum" },
+        ],
+    },
+    {
+        type: "cryptographic-asset",
+        name: "Composite-Hybrid-X25519-ML-KEM-768",
+        version: "RFC-10024",
+        properties: [
+            { name: "algorithm-family", value: "Dual Encapsulation Hybrid KEM" },
+            { name: "defense-in-depth", value: "classical-plus-post-quantum" },
+            { name: "implementation", value: "@noble/curves + @noble/post-quantum" },
+        ],
+    },
+];
+function buildCbom(now = new Date()) {
+    const serverVersion = readPackageVersion("crypto-server");
+    return {
+        bomFormat: "CycloneDX",
+        specVersion: "1.6",
+        serialNumber: `urn:uuid:${(0, node_crypto_1.randomUUID)()}`,
+        version: 1,
+        metadata: {
+            timestamp: now.toISOString(),
+            tools: [
+                {
+                    vendor: "Sebastien Rousseau",
+                    name: "@sebastienrousseau/crypto-server",
+                    version: serverVersion,
+                },
+            ],
+            component: {
+                type: "framework",
+                name: "@sebastienrousseau/crypto-server",
+                version: serverVersion,
+                description: "Fastify REST API exposing crypto-lib operations, including post-quantum algorithms",
+            },
+        },
+        components: CBOM_COMPONENTS,
+    };
+}
+exports.default = (app) => {
+    app.get("/v2/compliance/dora", {
+        schema: {
+            tags: ["Compliance"],
+            summary: "DORA cryptographic inventory (self-assessment)",
+            description: "Returns a self-reported cryptographic inventory, post-quantum algorithm counts and recommended sunset dates. It is not a compliance assessment or verdict under Regulation (EU) 2022/2554.",
+            response: {
+                200: {
+                    type: "object",
+                    properties: {
+                        data: {
+                            type: "object",
+                            properties: {
+                                standard: { type: "string" },
+                                article: { type: "string" },
+                                status: { type: "string" },
+                                disclaimer: { type: "string" },
+                                quantumResistanceRatio: { type: "number" },
+                                activePrimitivesCount: { type: "number" },
+                                postQuantumPrimitivesCount: { type: "number" },
+                                algorithmDeprecationSchedule: { type: "array" },
+                                cryptographicInventory: { type: "array" },
+                                timestamp: { type: "string" },
+                            },
+                        },
+                    },
+                },
+            },
+        },
+    }, async () => {
+        return { data: buildDoraSelfAssessment() };
+    });
+    app.get("/v2/compliance/cbom", {
+        schema: {
+            tags: ["Compliance"],
+            summary: "Cryptographic Bill of Materials (CBOM) in CycloneDX 1.6 format",
+            description: "Emits a machine-readable CycloneDX 1.6 CBOM listing the post-quantum algorithms this service implements. It is informational input for CRA and DORA work and does not by itself establish compliance.",
+        },
+    }, async (_request, reply) => {
+        reply.header("Content-Type", "application/vnd.cyclonedx+json; charset=utf-8");
+        return buildCbom();
+    });
+};
+//# sourceMappingURL=compliance.js.map

package/dist/routes/v2/encrypt.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyInstance } from "fastify";
+declare const _default: (app: FastifyInstance) => void;
+export default _default;
+//# sourceMappingURL=encrypt.d.ts.map

package/dist/routes/v2/encrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/encrypt.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBA+C/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBA4BE"}

package/dist/routes/v2/encrypt.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const modern_1 = require("@sebastienrousseau/crypto-lib/dist/modern");
+const route_helpers_1 = require("../../utils/route-helpers");
+const encryptSchema = {
+    tags: ["Modern Encryption"],
+    summary: "Encrypt with XChaCha20-Poly1305",
+    description: "AEAD encryption using XChaCha20-Poly1305. Returns base64(nonce || ciphertext || tag).",
+    body: {
+        type: "object",
+        required: ["key", "plaintext"],
+        additionalProperties: false,
+        properties: {
+            key: {
+                type: "string",
+                minLength: 64,
+                maxLength: 64,
+                description: "256-bit key as hex (64 chars)",
+            },
+            plaintext: { type: "string", minLength: 1, maxLength: 10 * 1024 * 1024 },
+        },
+    },
+};
+const decryptSchema = {
+    tags: ["Modern Encryption"],
+    summary: "Decrypt with XChaCha20-Poly1305",
+    description: "AEAD decryption. Expects base64 blob from the encrypt endpoint.",
+    body: {
+        type: "object",
+        required: ["key", "ciphertext"],
+        additionalProperties: false,
+        properties: {
+            key: { type: "string", minLength: 64, maxLength: 64 },
+            ciphertext: { type: "string", minLength: 1 },
+        },
+    },
+};
+exports.default = (app) => {
+    app.post("/v2/encrypt", { schema: encryptSchema }, async (request, reply) => {
+        try {
+            const { key, plaintext } = request.body;
+            const result = (0, modern_1.aeadEncrypt)({ key, plaintext });
+            return reply.send({ data: result });
+        }
+        catch (error) {
+            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Encryption");
+        }
+    });
+    app.post("/v2/decrypt", { schema: decryptSchema }, async (request, reply) => {
+        try {
+            const { key, ciphertext } = request.body;
+            const plaintext = (0, modern_1.aeadDecrypt)({ key, ciphertext });
+            return reply.send({
+                data: { plaintext: Buffer.from(plaintext).toString("utf8") },
+            });
+        }
+        catch (error) {
+            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Decryption");
+        }
+    });
+};
+//# sourceMappingURL=encrypt.js.map

package/dist/routes/v2/hash.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyInstance } from "fastify";
+declare const _default: (app: FastifyInstance) => void;
+export default _default;
+//# sourceMappingURL=hash.d.ts.map

package/dist/routes/v2/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/hash.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAwB/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAiBE"}

package/dist/routes/v2/hash.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const modern_1 = require("@sebastienrousseau/crypto-lib/dist/modern");
+const route_helpers_1 = require("../../utils/route-helpers");
+const hashSchema = {
+    tags: ["Hashing"],
+    summary: "Compute a cryptographic hash",
+    description: "Compute a hash digest using SHA-2, SHA-3, BLAKE2b, or BLAKE3.",
+    body: {
+        type: "object",
+        required: ["algorithm", "data"],
+        additionalProperties: false,
+        properties: {
+            algorithm: { type: "string", enum: [...modern_1.HASH_ALGORITHMS] },
+            data: { type: "string", minLength: 1, maxLength: 10 * 1024 * 1024 },
+        },
+    },
+};
+exports.default = (app) => {
+    app.post("/v2/hash", { schema: hashSchema }, async (request, reply) => {
+        try {
+            const { algorithm, data } = request.body;
+            const result = (0, modern_1.hash)({
+                algorithm: algorithm,
+                data,
+            });
+            return reply.send({ data: result });
+        }
+        catch (error) {
+            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Hash computation");
+        }
+    });
+};
+//# sourceMappingURL=hash.js.map

package/dist/routes/v2/index.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyInstance } from "fastify";
+declare const _default: (app: FastifyInstance) => void;
+export default _default;
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/v2/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/index.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAqB/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAmBE"}

package/dist/routes/v2/index.js

@@ -0,0 +1,44 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const algorithms_1 = __importDefault(require("./algorithms"));
+const encrypt_1 = __importDefault(require("./encrypt"));
+const hash_1 = __importDefault(require("./hash"));
+const kdf_1 = __importDefault(require("./kdf"));
+const mac_1 = __importDefault(require("./mac"));
+const password_1 = __importDefault(require("./password"));
+const pq_1 = __importDefault(require("./pq"));
+const pq_sign_1 = __importDefault(require("./pq-sign"));
+const pq_hash_sign_1 = __importDefault(require("./pq-hash-sign"));
+const signing_1 = __importDefault(require("./signing"));
+const secretbox_1 = __importDefault(require("./secretbox"));
+const sealedbox_1 = __importDefault(require("./sealedbox"));
+const password_encrypt_1 = __importDefault(require("./password-encrypt"));
+const key_wrap_1 = __importDefault(require("./key-wrap"));
+const keys_1 = __importDefault(require("./keys"));
+const multi_recipient_1 = __importDefault(require("./multi-recipient"));
+const compliance_1 = __importDefault(require("./compliance"));
+const stream_1 = __importDefault(require("./stream"));
+exports.default = (app) => {
+    (0, algorithms_1.default)(app);
+    (0, compliance_1.default)(app);
+    (0, stream_1.default)(app);
+    (0, encrypt_1.default)(app);
+    (0, hash_1.default)(app);
+    (0, kdf_1.default)(app);
+    (0, mac_1.default)(app);
+    (0, password_1.default)(app);
+    (0, pq_1.default)(app);
+    (0, pq_sign_1.default)(app);
+    (0, pq_hash_sign_1.default)(app);
+    (0, signing_1.default)(app);
+    (0, secretbox_1.default)(app);
+    (0, sealedbox_1.default)(app);
+    (0, password_encrypt_1.default)(app);
+    (0, key_wrap_1.default)(app);
+    (0, keys_1.default)(app);
+    (0, multi_recipient_1.default)(app);
+};
+//# sourceMappingURL=index.js.map

package/dist/routes/v2/kdf.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyInstance } from "fastify";
+declare const _default: (app: FastifyInstance) => void;
+export default _default;
+//# sourceMappingURL=kdf.d.ts.map

package/dist/routes/v2/kdf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/kdf.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAuC/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAgCE"}