@sebastienrousseau/crypto-server 0.0.2 → 0.0.8

package/README.md

@@ -1,170 +1,339 @@
-![Banner representing Crypto Service](https://raw.githubusercontent.com/sebastienrousseau/crypto-service/master/assets/crypto-server-logo.svg)
+<!-- SPDX-License-Identifier: Apache-2.0 OR MIT -->
 
-[![Maintained with Lerna](https://img.shields.io/badge/maintained%20with-lerna-blue?style=for-the-badge)](https://lerna.js.org/)
-[![License](https://img.shields.io/badge/License-MIT-green.svg?style=for-the-badge&logo=)](https://opensource.org/licenses/MIT)
-![Made with Love](https://raw.githubusercontent.com/sebastienrousseau/crypto-service/master/assets/made-with-love.svg)
+<p align="center">
+  <img src="https://raw.githubusercontent.com/sebastienrousseau/crypto-service/main/assets/crypto-server-logo.svg" alt="crypto-server logo" width="360" />
+</p>
 
-## Welcome to Crypto Server
+<h1 align="center">@sebastienrousseau/crypto-server</h1>
 
-Crypto Server is a [Fastify][3] web server that exposes easy consumable REST
-APIs to perform low-level cryptographic operations. It is implemented using
-Node.js and relies on [Crypto Lib][2].
+<p align="center">
+  A hardened Fastify REST API for cryptographic operations, with rate limiting, OpenAPI schemas, and post-quantum endpoints.
+</p>
 
-It supports the following cryptographic operations:
+<p align="center">
+  <a href="https://github.com/sebastienrousseau/crypto-service/actions"><img src="https://img.shields.io/github/actions/workflow/status/sebastienrousseau/crypto-service/ci.yml?branch=main&style=for-the-badge&logo=github" alt="Build" /></a>
+  <a href="https://coveralls.io/github/sebastienrousseau/crypto-service?branch=main"><img src="https://img.shields.io/coveralls/github/sebastienrousseau/crypto-service?branch=main&style=for-the-badge" alt="Coverage" /></a>
+  <a href="https://www.npmjs.com/package/@sebastienrousseau/crypto-server"><img src="https://img.shields.io/npm/v/@sebastienrousseau/crypto-server.svg?style=for-the-badge&color=f14041&logo=npm" alt="Registry" /></a>
+  <a href="https://sebastienrousseau.github.io/crypto-service/"><img src="https://img.shields.io/badge/docs-TypeDoc-blue.svg?style=for-the-badge&labelColor=555555&logo=typescript" alt="Docs" /></a>
+  <a href="https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/crypto-service" title="ossf-scorecard"><img src="https://img.shields.io/badge/OpenSSF-Scorecard-blue?style=for-the-badge&logo=openssf" alt="OpenSSF Scorecard" /></a>
+  <a href="https://github.com/sebastienrousseau/crypto-service/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0%20OR%20MIT-blue.svg?style=for-the-badge" alt="License: Apache-2.0 OR MIT" /></a>
+  <a href="https://github.com/sebastienrousseau/crypto-service/blob/main/docs/POLICIES.md"><img src="https://img.shields.io/badge/Node.js-%3E%3D22-93450a.svg?style=for-the-badge&logo=node.js" alt="Node.js 22 or newer" /></a>
+</p>
 
-- Digital Signing,
-- Encryption and Decryption,
-- Key Generation,
-- Key Management,
-- Pseudorandom Number Generation,
-- Signature Verification.
+---
 
-Development of this server is hosted by [GitHub][6] at the [following page][7].
-Source code is available to everyone under the standard [MIT license][8].
+## Contents
 
-## Getting Started
+**Getting started**
 
-Crypto Server is a [Node.js][4] module available through the [npm registry][5].
-Before installing, [download and install Node.js][4]. Node.js 12.20.0 or higher 
-is required.
+- [Install](#install) — installation via pnpm, npm, or yarn
+- [Requirements](#requirements) — runtime floor and environment prerequisites
+- [Quick Start](#quick-start) — minimal working usage sample
 
-Installation is done using either [`npm`][5],
-[`yarn`][9] or [`pnpm`][10] package managers to use Crypto Server with Node.js
-or the Command Line Interface:
+**The Crypto Service ecosystem**
 
-- `npm i @sebastienrousseau/crypto-server`
-- `yarn add @sebastienrousseau/crypto-server`
-- `pnpm add @sebastienrousseau/crypto-server`
+- [The Crypto Service ecosystem](#the-crypto-service-ecosystem) — full 14-package suite overview
 
-## Quick start
+**Package reference**
 
-### Starting the Crypto Server
+- [Reference & Usage](#overview) — features, configuration, and capabilities
+- [Examples](#examples) — runnable sample code
 
-- Open Terminal for Mac or Command Prompt for Windows,
-- Enter one of the following commands to start the Crypto Server:   
+**Operational**
 
-#### NPM
+- [Development](#development) — build, lint, format, and test targets
+- [Security](#security) — vulnerability disclosure and cryptographic invariants
+- [Documentation](#documentation) — TypeDoc API docs and ecosystem guides
+- [Stability guarantees](#stability-guarantees) — SemVer axis and release policy
+- [License](#license)
 
-- `npm run start:server`
+---
 
-#### Yarn
+## Install
 
-- `yarn start:server`
+```bash
+pnpm add @sebastienrousseau/crypto-server
+# or
+npm install @sebastienrousseau/crypto-server
+# or
+yarn add @sebastienrousseau/crypto-server
+```
 
-#### PNPM
+<p align="right"><a href="#contents">Back to Top</a></p>
 
-- `pnpm start:server`
+---
 
-This will start the Crypto Server on your local machine with the following
-environment details:
+## Requirements
 
-- Protocol: http,
-- Hostname: localhost,
-- Port: 3000,
-- IP: 127.0.0.1.
+- **Node.js**: `^22.0.0` or `>=24.0.0` (active and maintenance LTS releases)
+- **Package Manager**: `pnpm >=9` (recommended) or `npm >=10`
+- **TypeScript**: `>=5.0` (when compiling with TypeScript)
 
-The Crypto Server should be listening on
-[http://localhost:3000/](http://localhost:3000/)
+<p align="right"><a href="#contents">Back to Top</a></p>
 
-## What are the Crypto Service APIs?
+---
 
-The Crypto Service APIs give you access to a range of security and encryption
-solutions to perform low-level cryptographic operations, key storage operations,
-protect static data, and securely share secrets.
+## Quick Start
 
-On arrival of a new API request, the Crypto Server performs the request
-operation in the host environment, subsequently the response is transferred back
-to the requesting application. All operations that are performed andd coming
-through the Crypto Server are monitored so statistics can be made and acted upon
+Start the server:
 
-The APIs created with Crypto Server should be used with HTTPS endpoints only in
-a production web server.
+```bash
+npx crypto-server
+# or, from a clone of this repo:
+pnpm --filter @sebastienrousseau/crypto-server start
+```
 
-For greater security, you should choose a minimum Transport Layer Security (TLS)
-protocol version to be enforced for your API Gateway custom domain. Crypto
-Server recommends either a TLS version 1.3 or TLS version 1.3 security policy.
+Hash some data:
 
-### Commands & Options
+```bash
+curl -s -X POST http://localhost:3000/v2/hash \
+  -H "Content-Type: application/json" \
+  -H "x-api-key: your-secret-api-key" \
+  -d '{"algorithm":"sha256","data":"Hello, world!"}' | jq
+```
 
-#### `/generate`
+```json
+{
+  "data": "315f5bdb76d078c43b8ac0064e4a0164612b1fce77c869345bfc94c75894edd3"
+}
+```
 
-This endpoint allows you to create a new Key Pair.
+<p align="right"><a href="#contents">Back to Top</a></p>
 
-|Content-Type|Value|Description|
-|---|---|---|
-|type|rsa|The primary key algorithm type: ECC (default) or RSA. |
-|bits|2048|Number of bits for RSA keys (defaults to 4096 bits). |
-|name|Jane Doe|First name and Last name |
-|email|jane@doe.com|Email address |
-|passphrase|123456789abcdef|The passphrase used to encrypt the private key. |
-|curve|null|Elliptic curve for ECC keys. See Appendix for more detail... |
-|expiration|0|Number of seconds from the key creation time. |
-|format|armored|Format of the output keys e.g. 'armored' | 'object' | 'binary'.|
+---
 
-```shell
-curl --location --request GET 'http://localhost:3000/v1/generate' \
---header 'type: rsa' \
---header 'bits: 2048' \
---header 'name: Jane Doe' \
---header 'email: jane@doe.com' \
---header 'passphrase: 123456789abcdef' \
---header 'curve: null' \
---header 'expiration: 0' \
---header 'format: armored'
-```
+## The Crypto Service ecosystem
 
-#### `/encrypt`
+Crypto Service provides a complete cryptography stack across 14 specialized packages:
 
-This endpoint allows you to encrypt data in a single operation.
+| Package                                                                     | Role            | Description                                                                                                                            |
+| :-------------------------------------------------------------------------- | :-------------- | :------------------------------------------------------------------------------------------------------------------------------------- |
+| [`@sebastienrousseau/crypto-api`](../crypto-api)                            | API Schemas     | Shared TypeScript types and utilities for the Crypto Service Suite, defining the canonical API surface.                                |
+| [`@sebastienrousseau/crypto-cli`](../crypto-cli)                            | Terminal CLI    | An interactive command-line interface for cryptographic operations, supporting both legacy OpenPGP and modern post-quantum algorithms. |
+| [`@sebastienrousseau/crypto-edge`](../crypto-edge)                          | Edge Runtime    | Edge-runtime cryptographic operations using the Web Crypto API, optimized for Cloudflare Workers, Vercel Edge, and Deno.               |
+| [`@sebastienrousseau/crypto-kms`](../crypto-kms)                            | Cloud KMS       | Unified Key Management Service interface for AWS KMS, GCP Cloud KMS, Azure Key Vault, and HashiCorp Vault.                             |
+| [`@sebastienrousseau/crypto-lib`](../crypto-lib)                            | Core Library    | A modern cryptographic library for TypeScript, with post-quantum support, zero unsafe dependencies, and 100% test coverage.            |
+| [`@sebastienrousseau/crypto-middleware`](../crypto-middleware)              | Middleware      | Framework-agnostic cryptographic middleware for Express, Fastify, and Koa applications.                                                |
+| [`@sebastienrousseau/crypto-prisma`](../crypto-prisma)                      | ORM Adapter     | Transparent field-level encryption extension for Prisma Client, using XChaCha20-Poly1305.                                              |
+| [`@sebastienrousseau/crypto-react`](../crypto-react)                        | React Hooks     | React hooks and context provider for client-side cryptographic operations with zero boilerplate.                                       |
+| [`@sebastienrousseau/crypto-sdk`](../crypto-sdk)                            | Client SDK      | A zero-dependency, typed HTTP client for the Crypto Service REST API, with full post-quantum support.                                  |
+| **[`@sebastienrousseau/crypto-server`](../crypto-server)** _(this package)_ | **HTTP API**    | **A hardened Fastify REST API for cryptographic operations, with rate limiting, OpenAPI schemas, and post-quantum endpoints.**         |
+| [`@sebastienrousseau/crypto-testing`](../crypto-testing)                    | Test Support    | Deterministic keys, fast mocks, and test fixtures for crypto-lib                                                                       |
+| [`@sebastienrousseau/crypto-typeorm`](../crypto-typeorm)                    | ORM Adapter     | TypeORM column-level encryption with a single decorator, powered by crypto-lib.                                                        |
+| [`@sebastienrousseau/crypto-vue`](../crypto-vue)                            | Vue Composables | Vue 3 composables for client-side cryptography                                                                                         |
+| [`@sebastienrousseau/crypto-wasm`](../crypto-wasm)                          | Acceleration    | WebAssembly performance accelerator for crypto-lib                                                                                     |
 
-|Content-Type|Value|Description|
-|---|---|---|
-|passphrase|123456789abcdef|Passphrase to encrypt the message.|
-|message|Hello Crypto Service!|Message to be encrypted.|
-|publicKey|{{publicKey}}|A public key.|
-|privateKey|{{privateKey}}|A private key.|
+<p align="right"><a href="#contents">Back to Top</a></p>
 
-```shell
-curl --location --request GET 'http://localhost:3000/v1/encrypt' \
---header 'passphrase: 123456789abcdef' \
---header 'message: Hello Crypto Service!' \
---header 'publicKey: LS0tLS1CRUdJTiBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0tCgp4c0JOQkdLSHhCUUJDQURmS0VyYUVnT1VYZHFKVGVTdnUzb2NPWGg2VytxWllDbndOUFVvRjZpcnREbGUKNzVVYTByYkFUZEsxbXF4S1g0L0hraGhzQllQRXdNRHE0RnVzbkxOK0ZnNVdmdGpSR0M5NmJENnRmbVIzClJZY0p5WTEwTFlDRS9GS21iLzFJRGIrT2RtRk8weEpPSWxaTERSeVJSN0xwUlRDNE1mMkRiaFNheExqcwpZdFVhaFZPcCtNeHBkNmFWektYYUpkVVVmVWRYbVliRnpaM0YzK1RMa01zMFdaY05vRDJ3bWNpSGJVUXIKT1JnRkhoQ0I2dUNLNEs3d2R4OStjTllkTkQyb2t6WjJTdmRVenQ3QUZrajFra05XeVM3VWprWmVEdm9UCmp5dFNpZXFMQWJ3L2NUaXRrTjJ1MlZJU1UxMHEwbFhMSERaWWFXTll1OHRMaHFYM0F4c3FNQ1V0QUJFQgpBQUhORjBwaGJtVWdSRzlsSUR4cVlXNWxRR1J2WlM1amIyMCt3c0NLQkJBQkNBQWRCUUppaDhRVUJBc0oKQndnREZRZ0tCQllBQWdFQ0dRRUNHd01DSGdFQUlRa1E5L09ucUlLaTh2RVdJUVExYXRBVHl5WTZZcDFoCjN6ZjM4NmVvZ3FMeThZeUFDQUNudlF1aFMxeHV2YnhUQVdZcWkrcjNFUkpOSzVINUFkOWpFNERUWUZPTQowcDRuMmJwSlQwa2t1bkMzckp0Z2tQbnRNVFJ6eEJvS0QrcmRIdS9FZno1MjNPMENJbjlCOG8vWWpvencKQVFBMldHLzhIdlRYOU0yZVUzOVM3SkptS1I4aks5TDVtYlduV1I2eEZadExSc0pIT2FzSm50S1BsUkFSCnpXNmwweTNjRzRueFJieHM2QS9tczFjM05seDdodjErN24yaTN6d3l2aE52Rys5Y0F0TlM3L3NkLzExbgpYQUJ0QWt2WjU3SnUwWXBKQ3JuMHhvblJuN0kyQ1lTd1BNVTZKMTFIL2l5eXdTNFB5aHlrV2lHMmhNNC8KM3ZMVDdpQVoxZlhkczk0SDFQTW9zNEZMbU50YkphSC83OXRyRFNpem1zY0ExbG9IUlFSOHVvNElKNkx6CnpzQk5CR0tIeEJRQkNBRHNNblVIWkVydTl5V2ljYjRxajJxWGhuanFSOVZHZVdvaEd1UFNRc2dpLzNRRQp4K3FJSjJFeU1LelQ1aXRYT01tQU1pbk5GRGd3ek1FQ081Nk53TWdWUXJnSm5LdnNGR0gxdVFUb0MzaHcKR1pjUDArUTB0aThPWmFLOUZFbngra1FYNXJjYWRGWTBSOW9KTEFNS1JzOU45YmJ2eU40VzRCMW5weklmClF6NWloMUNIQnRqektpVTdaVzBKM1ZLa285NHp4bGZiZVRKS2ZxWnl4eGtuMVVPZWliWWp4dGYrZXZKaQpPOUZMUGpOcGkwem8zZ3kvQ1Y5UGtDUjA3c295aTVJeVVNNE9CRzBoRFNjV2Z4a0xEc0M0b0tzTjJhaGYKeHovSWc0em9FNUk2L0t5c2U1QW1GaWZSaHhaUnRhY3JyOTBqazc4a2Q1S0p6WXhETXhTK0ZzUUJBQkVCCkFBSEN3SFlFR0FFSUFBa0ZBbUtIeEJRQ0d3d0FJUWtROS9PbnFJS2k4dkVXSVFRMWF0QVR5eVk2WXAxaAozemYzODZlb2dxTHk4WDBTQ0FDY0FFTWQ2c2JvVHVOZlVPb2RaQjdvM25NV2RDMEVja1kzSnhLbFE3b0kKV0hpUTNTdU9ibXduWGhSTHJ4TTZ4ZmtUQ3pYK2FUQ2NCemhlZmFMWVU4R1BsSU00SFRhank0MHVNb2Y2CkV3SnpFenpucjhZRVVmdU1Pd094anFrZHpjK2llbk9lT2V6b2dQeTFieGtZTmpHeHpaTFFUekptMkhXWAowOFlNWWtqMXJNTmg0VGZQMnZaYUFHem5LMHBrb0lHdVBHQTdPTTVpRHFIa3pyeWppWG1pV1VVM1lTcHYKMTV5VkEyQXBxN2o1ZFJWd2d4eFpLS2xhOW5iaXhYUEdhTVFSV0w3RUcxM0pMbTFidVlxUXVsVExyMTNkClByKzR2NStlQ3NEZkRpcU9veFYyU000R0ZxanBaRUFBNEZlZFlTMmx1ZXV3WUdvVnRtT1BOdjViME9iUAo9YTZHRQotLS0tLUVORCBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0tCg==' \
---header 'privateKey: LS0tLS1CRUdJTiBQR1AgUFJJVkFURSBLRVkgQkxPQ0stLS0tLQoKeGNNR0JHS0h4QlFCQ0FEZktFcmFFZ09VWGRxSlRlU3Z1M29jT1hoNlcrcVpZQ253TlBVb0Y2aXJ0RGxlCjc1VWEwcmJBVGRLMW1xeEtYNC9Ia2hoc0JZUEV3TURxNEZ1c25MTitGZzVXZnRqUkdDOTZiRDZ0Zm1SMwpSWWNKeVkxMExZQ0UvRkttYi8xSURiK09kbUZPMHhKT0lsWkxEUnlSUjdMcFJUQzRNZjJEYmhTYXhManMKWXRVYWhWT3ArTXhwZDZhVnpLWGFKZFVVZlVkWG1ZYkZ6WjNGMytUTGtNczBXWmNOb0Qyd21jaUhiVVFyCk9SZ0ZIaENCNnVDSzRLN3dkeDkrY05ZZE5EMm9reloyU3ZkVXp0N0FGa2oxa2tOV3lTN1Vqa1plRHZvVApqeXRTaWVxTEFidy9jVGl0a04ydTJWSVNVMTBxMGxYTEhEWllhV05ZdTh0TGhxWDNBeHNxTUNVdEFCRUIKQUFIK0NRTUlhRCtXMXJEYitZN2cweXB1M2h0UElQSXZUYm15dkNMOUZKVitLZzdrRFZHVG5QR1Q0NGhMCm9GRXZrNEZIeHdjSHp4SytjLzUvQnltM2JqWlMzMStDNTBqbTQvUDYrVGVPWGRXakVBT1JSQUJxb05pRgpVcUcrSWpiZnlvbkFzSEx5aVcrQ1BDczJyVnlJQTRCdGhHWHBtRmtYQnpIYk5QSTE3cThvS2ZBQnViY3oKeVYrbkxzd1g4TC9md1lRcHRmTjZ2ZGVhNjVUMzdOTGYzWGdkU29SVUx5ZnpsK1VSVEE5dW1kNDRHWUQrCk9pZk1hb2tKZ3E4RENMWHk3R2VYeDh1V1Fod1l3N2hYV3JhWXUyU21VdjdDaWxDeG9QRkNORnh6aFdiQgoraHlpbWVZam9KbS9VeEJtbEZZSHY0c3Mrb21NazhQQ2M3L1Z3WEZ5U0xpL2M5Q3ROakVCamJIaGZ6VlEKSVFtSVd2aUhibkwzSVNmdkFvR2tPMHBQMHhmczh3dGx6RVhqRm9aRXlUeW1vOGhROXV4V1BxNVFjSkxrCkZrcmhZcUZqYndIMjc3Szd2K2dESHp2SDlHSnljYlhMZHpyVzNmMERPM1NUNHlrcHFQaWdTeHRiMkE1Tgo1STlIbTZmOFl1KzVUNWlVajFiUVdJOEErR0VkZXI5VTl0RjdpN2QycHB2S2VvL0ZxUU10eUh2Wm0zaG4KNmNQNFpyd09Kdmk5b0lsaVhXdHZySWM0QU5SV0FSSks5WkswTlZsdlZxOGEzR1l6SUY3ODNzeTM5dTZ2ClJCeHI4dll3WC9KSjNPR2tnVWlhVW12czBTNmhxU0d5RkRubi9kbUZ6elBlTzZ5eGl2WkhkeWs5T0pGSAo4N0hMdmF6WFdhWExkbWlPOU1WWFpRYWM3NlI1RTZodTk0U0ZRWjZ3YWRsTGxWeW43V0MzT1BYeHFzOXYKS2hyRzk2TkJqYTl3bnBqSFVLb1NDbG9PQW16UEVKWW54a2xGQXhucWJNQ1lCUGV4bFpqKzNzbVY4RWVmCnpmSHJrOTdFZmNEWHZtQTAwK0RtaXYzbi9hampQUjIyTTh5QVkyRFFlbHM4YThZbU1ZMm5JTldyVUIySgoxa1VJcW5rVVc0SmtwY29OZUlQbUJKVTZRSC9pYm9zVTdicW56OG1EZm9QenAyWjYwZ0ZNUEpjM0hISTUKb2JtSW9TUFJUWG85THBkWjdZRmUzUnZ0cDFKVHgzM3F6UmRLWVc1bElFUnZaU0E4YW1GdVpVQmtiMlV1ClkyOXRQc0xBaWdRUUFRZ0FIUVVDWW9mRUZBUUxDUWNJQXhVSUNnUVdBQUlCQWhrQkFoc0RBaDRCQUNFSgpFUGZ6cDZpQ292THhGaUVFTldyUUU4c21PbUtkWWQ4MzkvT25xSUtpOHZHTWdBZ0FwNzBMb1V0Y2JyMjgKVXdGbUtvdnE5eEVTVFN1UitRSGZZeE9BMDJCVGpOS2VKOW02U1U5SkpMcHd0NnliWUpENTdURTBjOFFhCkNnL3EzUjd2eEg4K2R0enRBaUovUWZLUDJJNk04QUVBTmxodi9CNzAxL1RObmxOL1V1eVNaaWtmSXl2UworWm0xcDFrZXNSV2JTMGJDUnptckNaN1NqNVVRRWMxdXBkTXQzQnVKOFVXOGJPZ1A1ck5YTnpaY2U0YjkKZnU1OW90ODhNcjRUYnh2dlhBTFRVdS83SGY5ZFoxd0FiUUpMMmVleWJ0R0tTUXE1OU1hSjBaK3lOZ21FCnNEekZPaWRkUi80c3NzRXVEOG9jcEZvaHRvVE9QOTd5MCs0Z0dkWDEzYlBlQjlUektMT0JTNWpiV3lXaAovKy9iYXcwb3M1ckhBTlphQjBVRWZMcU9DQ2VpODhmREJnUmloOFFVQVFnQTdESjFCMlJLN3ZjbG9uRysKS285cWw0WjQ2a2ZWUm5scUlScmowa0xJSXY5MEJNZnFpQ2RoTWpDczArWXJWempKZ0RJcHpSUTRNTXpCCkFqdWVqY0RJRlVLNENaeXI3QlJoOWJrRTZBdDRjQm1YRDlQa05MWXZEbVdpdlJSSjhmcEVGK2EzR25SVwpORWZhQ1N3RENrYlBUZlcyNzhqZUZ1QWRaNmN5SDBNK1lvZFFod2JZOHlvbE8yVnRDZDFTcEtQZU04WlgKMjNreVNuNm1jc2NaSjlWRG5vbTJJOGJYL25yeVlqdlJTejR6YVl0TTZONE12d2xmVDVBa2RPN0tNb3VTCk1sRE9EZ1J0SVEwbkZuOFpDdzdBdUtDckRkbW9YOGMveUlPTTZCT1NPdnlzckh1UUpoWW4wWWNXVWJXbgpLNi9kSTVPL0pIZVNpYzJNUXpNVXZoYkVBUUFSQVFBQi9na0RDSHVaSUcyc3YvenM0SEhaWEpoMFdKa2kKWitkbjFqYUw3RXowdjVuRzBTWDh6cjFaYWwxU2ZmZFNHcDRFampSbEdNRVdhK25pdkhIQW1QcWdXN0JTCldJdmhYNWN6VTQ0NU1ZOG1TOXFjOGRZT1VMa0FOVUhoTzFtZlZ1U2d6RHdPZUl3eTg4NlkydnVLWnJ1UgpsVm1wZjJ2L1lVdDBDNzNkdTVpZ1hoQmlMMVhJbS93MHFwL2FZN1NmRmNUeEJ2UTVjL1BrSUtmZ2pJeDYKOStRejJ4ZllYSnk5M0Z4MjF0MVMwUFFvRHdTcFZvVjdkc1lRS3ZhMWcyRGNpTmM4UW1TYTV1QlN5ckZ4CjJNaG5MdTY4eTg5SnFNNEgzWjBvUTg2RGhxREE0eWFWaFlnRk1qQ0RSRVJRVXFhb1dBWWJqcHQyVHpHWQphb0tZUVI1VGprbDd1VnFQSlZia3BQbFZXdnJNNDVQblpxSkpjSWdlNmIvVHhoNkE5WWVRaTRtVi9LS3MKS1ZqUWd5OXFUT2V3cmZGNERiODVXdjRiekhEckZyR3hGbVNZTWVPY1h2ZVl0TGZPVlM5RmpiQ1pJZ0U1ClBRaUtXWDNzeXViVHg2eEw1aGUxUVl0SUdoaUJmZS9TV3Z0WUoxZlJUT3Y1MFBkM3JRSjB4ZVJmQ2hONgpQbkQ3ZzBGQ2xIeFJvc1k4dld5ZXNUenVpdUMxTWhPTzlqaGNwVGZpR05wU0dpNjdUNlIzcjVmdTNtSmEKb1UrcGlRSGVDaGhjSjRIeFZkQ24rQ05QS1VqQ3N0RnY0MndvRlMvOHZJeksvZkswZjQzVlRERWtVeUtPClUxUWZiNWRianNrYWpTY3NKd09FYklaeFdySkVDcUtPd2RRaHVMakpnLzNlQldtZUh3NCtWeGJsTFo5MQpvVFZWN1B0MjlqUm50WDN4VXl4d2pSVHVVK0toZ3pVSTFySFAzNCt0NTFoYVR1WmlWbTZFaU1MNUxJTkcKenFvbGgwc0pUcW9JZ1BKNTZtQmFieFcxUmtUMCthWEVXWlY4b0RoK0xoY2d0VGoyd201bXgwUnBmZCswCkJGWmQvTE9EaDBrTGF6ZW14TkRReU5MWVRTbXQwK3hqcUIvUnFlVEZkZ0U3dSthMTFTZm1MejJRaDRBVApvRU5qVS9YREFoWERkQlQ0TkhqOGxtbGxWV0RueGJ4b2xPOE9hWGhVREVsOTBCKzN0S2EyY3d4WnI2ckQKZWNMQWRnUVlBUWdBQ1FVQ1lvZkVGQUliREFBaENSRDM4NmVvZ3FMeThSWWhCRFZxMEJQTEpqcGluV0hmCk4vZnpwNmlDb3ZMeGZSSUlBSndBUXgzcXh1aE80MTlRNmgxa0h1amVjeFowTFFSeVJqY25FcVZEdWdoWQplSkRkSzQ1dWJDZGVGRXV2RXpyRitSTUxOZjVwTUp3SE9GNTlvdGhUd1krVWd6Z2ROcVBMalM0eWgvb1QKQW5NVFBPZXZ4Z1JSKzR3N0E3R09xUjNOejZKNmM1NDU3T2lBL0xWdkdSZzJNYkhOa3RCUE1tYllkWmZUCnhneGlTUFdzdzJIaE44L2E5bG9BYk9jclNtU2dnYTQ4WURzNHptSU9vZVRPdktPSmVhSlpSVGRoS20vWApuSlVEWUNtcnVQbDFGWENESEZrb3FWcjJkdUxGYzhab3hCRll2c1FiWGNrdWJWdTVpcEM2Vk11dlhkMCsKdjdpL241NEt3TjhPS282akZYWkl6Z1lXcU9sa1FBRGdWNTFoTGFXNTY3QmdhaFcyWTQ4Mi9sdlE1czg9Cj1rTjFICi0tLS0tRU5EIFBHUCBQUklWQVRFIEtFWSBCTE9DSy0tLS0tCg=='
+---
+
+## Overview
+
+Crypto Server is built on **Fastify 4.x** with a layered middleware
+stack:
+
+```
+Request
+  -> @fastify/helmet (security headers)
+  -> @fastify/cors
+  -> @fastify/rate-limit
+  -> @fastify/compress
+  -> Authentication (x-api-key / JWT Bearer)
+  -> Route handler
+  -> Response
 ```
 
-#### `/decrypt`
+### Route versioning
+
+| Prefix                        | Status         | Notes                                                                         |
+| :---------------------------- | :------------- | :---------------------------------------------------------------------------- |
+| `/v1/*`                       | **Deprecated** | Legacy PGP-based endpoints. Emit `Deprecation`, `Sunset`, and `Link` headers. |
+| `/v2/*`                       | **Current**    | Modern endpoints using `@noble/*` primitives and post-quantum algorithms.     |
+| `/live`, `/ready`, `/metrics` | Stable         | Infrastructure probes (no auth required).                                     |
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+## API Routes
+
+All v2 endpoints accept and return `application/json`. Authenticated
+requests must include an `x-api-key` header (or
+`Authorization: Bearer <jwt>`).
+
+| Method | Path                          | Description                                                  |
+| :----- | :---------------------------- | :----------------------------------------------------------- |
+| `POST` | `/v2/hash`                    | Compute a cryptographic hash (SHA-2, SHA-3, BLAKE2b, BLAKE3) |
+| `POST` | `/v2/encrypt`                 | AEAD encryption with XChaCha20-Poly1305                      |
+| `POST` | `/v2/decrypt`                 | AEAD decryption with XChaCha20-Poly1305                      |
+| `POST` | `/v2/sign`                    | Create a digital signature                                   |
+| `POST` | `/v2/verify`                  | Verify a digital signature                                   |
+| `POST` | `/v2/kdf`                     | Derive a key (scrypt, HKDF-SHA256, PBKDF2-SHA256)            |
+| `POST` | `/v2/hmac`                    | Compute an HMAC                                              |
+| `POST` | `/v2/hmac/verify`             | Verify an HMAC in constant time                              |
+| `POST` | `/v2/password/hash`           | Hash a password with Argon2id                                |
+| `POST` | `/v2/password/verify`         | Verify a password against an Argon2id hash                   |
+| `POST` | `/v2/password/encrypt`        | Encrypt with password (Argon2id + XChaCha20-Poly1305)        |
+| `POST` | `/v2/password/decrypt`        | Decrypt with password                                        |
+| `POST` | `/v2/keys/generate`           | Generate a key pair for any supported algorithm              |
+| `POST` | `/v2/keys/wrap`               | Wrap a key with AES-KW or AES-KWP                            |
+| `POST` | `/v2/keys/unwrap`             | Unwrap a key                                                 |
+| `POST` | `/v2/secretbox/seal`          | Encrypt with XChaCha20-Poly1305 (secretbox)                  |
+| `POST` | `/v2/secretbox/open`          | Decrypt a secretbox ciphertext                               |
+| `POST` | `/v2/sealedbox/seal`          | Anonymous public-key encryption (X25519)                     |
+| `POST` | `/v2/sealedbox/open`          | Decrypt an anonymous sealed box                              |
+| `POST` | `/v2/sealedbox/seal-pq`       | Post-quantum sealed box (X25519 + ML-KEM-768)                |
+| `POST` | `/v2/sealedbox/open-pq`       | Decrypt a post-quantum sealed box                            |
+| `POST` | `/v2/multi-recipient/encrypt` | Encrypt for multiple recipients                              |
+| `POST` | `/v2/pq/keygen`               | Generate an ML-KEM-768 key pair (FIPS 203)                   |
+| `POST` | `/v2/pq/encapsulate`          | Encapsulate a shared secret with ML-KEM-768                  |
+| `POST` | `/v2/pq/decapsulate`          | Decapsulate and recover the shared secret                    |
+| `POST` | `/v2/pq/hybrid/keygen`        | Generate a hybrid X25519 + ML-KEM-768 key pair               |
+| `POST` | `/v2/pq/hybrid/encapsulate`   | Hybrid encapsulation                                         |
+| `POST` | `/v2/pq/hybrid/decapsulate`   | Hybrid decapsulation                                         |
+| `POST` | `/v2/pq/dsa/keygen`           | Generate an ML-DSA key pair (FIPS 204)                       |
+| `POST` | `/v2/pq/dsa/sign`             | Sign with ML-DSA                                             |
+| `POST` | `/v2/pq/dsa/verify`           | Verify an ML-DSA signature                                   |
+| `POST` | `/v2/pq/slh-dsa/keygen`       | Generate an SLH-DSA key pair (FIPS 205)                      |
+| `POST` | `/v2/pq/slh-dsa/sign`         | Sign with SLH-DSA                                            |
+| `POST` | `/v2/pq/slh-dsa/verify`       | Verify an SLH-DSA signature                                  |
+| `GET`  | `/v2/algorithms`              | List all supported algorithms                                |
+| `GET`  | `/live`                       | Liveness probe (Kubernetes)                                  |
+| `GET`  | `/ready`                      | Readiness probe (Kubernetes)                                 |
+| `GET`  | `/metrics`                    | Prometheus-compatible metrics                                |
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+## Authentication
+
+The server supports two authentication modes:
+
+1. **API Key** -- set `CRYPTO_API_KEY` and pass it as the `x-api-key`
+   header.
+2. **JWT Bearer** -- set `JWT_SECRET` and pass
+   `Authorization: Bearer <token>`.
+
+If neither variable is set, all requests are allowed (development
+mode).
+
+```bash
+# API key
+curl -H "x-api-key: your-secret-api-key" ...
+
+# JWT Bearer
+curl -H "Authorization: Bearer eyJhbGciOi..." ...
+```
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+## Configuration
+
+| Variable              | Default       | Description                                        |
+| :-------------------- | :------------ | :------------------------------------------------- |
+| `PORT`                | `3000`        | TCP port to listen on                              |
+| `HOST`                | `localhost`   | Bind address                                       |
+| `PROTOCOL`            | `http`        | `http` or `https`                                  |
+| `NODE_ENV`            | `development` | `development`, `production`, or `test`             |
+| `LOG_LEVEL`           | `info`        | `error`, `warn`, `info`, or `debug`                |
+| `CRYPTO_API_KEY`      | --            | Static API key for `x-api-key` authentication      |
+| `JWT_SECRET`          | --            | HMAC secret for HS256 JWT validation               |
+| `CORS_ORIGIN`         | --            | Comma-separated allowed origins (empty = disabled) |
+| `TRUSTED_PROXY_CIDRS` | --            | Comma-separated trusted proxy CIDRs                |
+| `CRYPTO_KEY_DIR`      | --            | Directory for key storage                          |
+| `CRYPTO_KEY_OUT_DIR`  | --            | Directory for key output                           |
+| `SHUTDOWN_TIMEOUT_MS` | `30000`       | Graceful shutdown timeout in milliseconds          |
 
-This endpoint allows you to decrypt data in a single operation.
+<p align="right"><a href="#contents">Back to Top</a></p>
 
-|Content-Type|Value|Description|
-|---|---|---|
-|passphrase|123456789abcdef|Passphrase to decrypt the message.|
-|message|{{data}}|Message to be decrypted.|
+## Examples
+
+All examples are self-contained TypeScript files in the `examples/`
+directory. Each uses `fetch` to call the server. Run any example
+with:
+
+```bash
+# Start the server in one terminal:
+pnpm --filter @sebastienrousseau/crypto-server start
+
+# Run an example in another:
+npx ts-node examples/<name>.ts
+```
 
-```shell
-curl --location --request GET 'http://localhost:3000/v1/decrypt' \
---header 'passphrase: 123456789abcdef' \
---header 'message: LS0tLS1CRUdJTiBQR1AgTUVTU0FHRS0tLS0tCgp3Y0ZNQXpMNWFTdVU0RWM4QVJBQWtnUUVEMVNwaTN5MmRrME1kbHQwYmtsMEdIWEoxbytxZHdzeWxZdlIKcjVycGVydXVmeWd3V0JTR1p6UHNSMG51MFg4SWxIQ0hYR2pha0N2WFVhMEZHTFNHR2pqRHdZQmViZjAvCitIVE51K1BMYzRvVmlvMXAwZEZraFFuOVVHSG82b1NVQmNqcmdsWTlsTW4ySzg3RVp2M1BUZ2k3aGtiMwpOWVhFazl5dWdLalVGU1RtMERDdGdpNkt2YUpycURpZStLbnJxSVNrckpxS0I0T1FuOUlNQk1UY3kxVEgKQld2QStyQ2llSFBNRHIrNFRwbTU5cFgxQUhCb0xPRm9WK1c1YlJoNEY5VHVxNzRaMW9pV2cyUFFEM252CjFtdnlZN1VIdEVuczBFbzYvWFRTQnZzNndQdFBJT2FoWGlTSC9UYmNod1RNTjlBZ1NSa3YzeEpWcGhjSgpPaGRGaFNMQ1dSUlR5UGxlUWpNeEoyemwwRm1JM2IrZnNYUkZlKzRCRjhiQjl6MUV4Nk9KOE1raG9yOFYKN3B5ZHR2UUVBVFlXMHVEc3pNb09UNHhqYnUvL29ESk45dnRINnBTY1hnQ3o2MGI4TTdHaXl6VGFoV3FLCmsvSklVWHJORjB2cjk3RWVnRGs3VXNFV3Y4MFhYdkg3dEtVTFNQcnRSTmxnbytqSjk5SzBmcm9iK1QxQwpIcVp4UzdpZCsxaTJOOHhQcUZnd2lDeHhXS1dMTGllQW1GRVVuQ3NXYUR0b05OZUhYbkJyLzk5b25PZGoKd0pWT0krQS9uZlU5bXh2ZGFnWlNqWnlMQ0ZDa1REQ05GeWxKL0dmUnZIWndBNGsya0ZqZXUvQWhQa0Y5Ck1EQktZdmNSWFJudklLOW5STHhIYjZKMUpoS3ppbnFpbHgrZmpQak9kdVRTd2NzQnlicThXenRPbmpscwp3WkZZVU9uQjdsQ0N4d3lxc3hqNlBQdkpLODFTOTBhaElQMkNUVVVsWWlMWTRSa05qRjlwNnArSXZoVW4KeFB3UXFwSU03V2ZpckZOM0tJT3QrOWpyazE3YStFVWtOelBuNm5jMHdobTUzWDFtaWhHOEJPYXc5UFgwCmlSWHZuTTlEL0dkWHI4ZTNhWDFRTnBXOVVlKzZ5c1NqZi85bEs5MVo5aTl4eUpmSW51eS9EdXpjSGtYawpTa1Z5VjRablE3MCsrY0JvN1JaYUkzZ3Zuak9HYkF2Z3dVakJIYUoyL0Vqd0oyd1FESm9lbkVYdUFEeTcKOHhLRWk2V2p3V1lBUXVlUmh1cGdhYmJIcVFGazltTWhHSGcvMlpkNkViMTYyTmVYeTU2RkYrK1lWSm5jCnJrSVN5bkFmdWJSc1hmZXUxYS9TWWJvR2h0cTNheWQ3VTM3YVpCUmtuclFieldxYituV2YvRk54YkRvRAprTkpsV1BDSHZBeHhNRTd3U2gxRkZQNmtCL24yVWxTV1JNUWZwY25hbzFFUW9QUGdQcWtDcm9vSXh4WVMKWEsySlEzOWtucmpmY053bEJZYlVkZnlNaVlSRi84cHJxT25YU242czJDTUN6WjAzamlNeEpYYmFDS0N6CnNqVXpmMDVMTnJ5V01nR0dmQWFRcWZhN3NYM3NtL3VjL09IV25paFpVaWsrVlZQbzNPVGE1NG0vRnd2YgpjQmxseFV6UHVYSzg3NG1lQVNPanRZc2luOUQzVnNIWVdHa0g5azJ6eFgyZEU1cTZUeGxUaU9FOWx0UHUKRWxmWXloU1dtMXJYVUxDZmprYkE2TjlSSEFMR0VNU0Uwa3p1QXpGZmh0OFlpVkhxcHZULytrWjF1azA3ClZLejhnS09UQllMNG84ZWt6V2ZJZ2N3MThkcmZ4SThIUHQ1cUtEZzJpUUM3M1BBS1gxaEJxVHp4LzJSbAptS2FBeFZ5NW1yanVwWmV3RnpMc2tiYlRhYWszd0Y2eHZVWktFNmFHdFRFcnZIVWJlL0xoL00zajVBQTQKUGRZQSs3djZMd3BTcGRVYTRQK2xKb0d0SVQremRQTXF2TE1Od3lyYk9nSWVveEZXZHNxQk9qM1kwNk0xCmhJUk9IamRnVG9yUUhvOD0KPTh4MUMKLS0tLS1FTkQgUEdQIE1FU1NBR0UtLS0tLQo='
+| Category        | Example                                         | Purpose                                  |
+| :-------------- | :---------------------------------------------- | :--------------------------------------- |
+| Algorithms      | [algorithms.ts](examples/algorithms.ts)         | List supported algorithms                |
+| Encryption      | [encrypt.ts](examples/encrypt.ts)               | Encrypt and decrypt via v2 endpoints     |
+| Hashing         | [hash.ts](examples/hash.ts)                     | Hash data via POST /v2/hash              |
+| HMAC            | [hmac.ts](examples/hmac.ts)                     | HMAC compute and verify                  |
+| KDF             | [kdf.ts](examples/kdf.ts)                       | Key derivation                           |
+| Key Generation  | [keygen.ts](examples/keygen.ts)                 | Generate keys via POST /v2/keys/generate |
+| Key Wrap        | [keywrap.ts](examples/keywrap.ts)               | AES key wrapping and unwrapping          |
+| Passwords       | [password.ts](examples/password.ts)             | Password hash and verify                 |
+| PW Encrypt      | [pwencrypt.ts](examples/pwencrypt.ts)           | Password-based encryption and decryption |
+| PQ KEM          | [pqkem.ts](examples/pqkem.ts)                   | Post-quantum KEM operations              |
+| PQ Sign         | [pqsign.ts](examples/pqsign.ts)                 | Post-quantum ML-DSA signing              |
+| PQ Hash Sign    | [pqhashsign.ts](examples/pqhashsign.ts)         | Post-quantum SLH-DSA signing             |
+| Probes          | [probes.ts](examples/probes.ts)                 | Health and readiness checks              |
+| Multi-Recipient | [multirecipient.ts](examples/multirecipient.ts) | Multi-recipient encryption               |
+| Sealed Box      | [sealedbox.ts](examples/sealedbox.ts)           | Sealed box operations                    |
+| Secretbox       | [secretbox.ts](examples/secretbox.ts)           | Secretbox seal and open                  |
+| Signing         | [sign.ts](examples/sign.ts)                     | Sign and verify via v2 endpoints         |
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Development
+
+```bash
+pnpm --filter @sebastienrousseau/crypto-server run build
+pnpm --filter @sebastienrousseau/crypto-server run test
+pnpm --filter @sebastienrousseau/crypto-server run lint
+pnpm --filter @sebastienrousseau/crypto-server run format
 ```
 
-## Contributing to Crypto Server
+All 18 packages in the Crypto Service workspace maintain a **100% coverage floor** across statements, branches, functions, and lines.
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Security
+
+Report vulnerabilities privately via [GitHub Security Advisories](https://github.com/sebastienrousseau/crypto-service/security/advisories) or according to [`SECURITY.md`](../../SECURITY.md). Never report security issues publicly.
+
+Cryptographic operations use the `@noble/*` libraries, Node.js `crypto` and OpenPGP.js. `@noble/post-quantum` has not been independently audited and does not guarantee constant-time execution, and no module in this suite is FIPS 140-3 validated. Key zeroization is limited: JavaScript strings and garbage-collected buffers cannot be reliably wiped. See [`SECURITY.md`](../../SECURITY.md).
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Documentation
+
+- [Full Suite Documentation](https://sebastienrousseau.github.io/crypto-service/)
+- [API Reference (TypeDoc)](https://sebastienrousseau.github.io/crypto-service/)
+- [Developer Guide](../../DEVELOPMENT.md)
+- [Security Policy](../../SECURITY.md)
+- [Architecture & Design](../../ARCHITECTURE.md)
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Stability guarantees
+
+Versions advance strictly one step at a time on the `0.0.x` line (`v0.0.1` → `v0.0.2` → `v0.0.3` ... → `v0.0.999` → `v0.1.0`). Work for every release iteration begins on a dedicated `feat/v<version>` branch.
+
+All 18 packages in the workspace move in lockstep. Public API signatures, cipher output formats, and serialization schemas are strictly versioned. Breaking changes to serialized formats or algorithm defaults are considered major breaking changes. Minimum toolchain upgrades (e.g. Node.js LTS floor) are governed by [POLICIES.md](../../docs/POLICIES.md).
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
 
-Contributions to Crypto Server are welcomed and encouraged! Please see our 
-[Contributing Guidelines][1] for further details on the process for submitting
-pull requests to us.
+## License
 
-## Appendix
+Dual-licensed under [Apache 2.0](https://www.apache.org/licenses/LICENSE-2.0) or [MIT](https://opensource.org/licenses/MIT), at your option.
 
-*Elliptic curve for ECC keys: curve25519, p256, p384, p521, secp256k1,
-brainpoolP256r1,brainpoolP384r1, or brainpoolP512r1.*
+Copyright (c) 2022-2026 Sebastien Rousseau and The Crypto Service Suite contributors.
 
-[1]: https://github.com/sebastienrousseau/crypto-server/blob/master/.github/CONTRIBUTING.md
-[2]: https://github.com/sebastienrousseau/crypto-service/tree/main/packages/crypto-lib
-[3]: https://www.fastify.io
-[4]: https://nodejs.org/en/
-[5]: https://www.npmjs.com/
-[6]: https://github.com
-[7]: https://github.com/sebastienrousseau/crypto-server
-[8]: https://github.com/sebastienrousseau/crypto-server/blob/main/LICENSE
-[9]: https://yarnpkg.com/getting-started
-[10]: https://pnpm.io/motivation
+<p align="right"><a href="#contents">Back to Top</a></p>

package/dist/@types/types.d.ts

@@ -1,21 +1,41 @@
-export declare type IQuerystring = {
-    username: string;
-    password: string;
-};
-export declare type IHeadersKeyBody = {
-    type: string;
-    bits: string;
+export declare const KEY_TYPES: readonly ["ecc", "rsa"];
+export type KeyType = (typeof KEY_TYPES)[number];
+export declare const CURVE_TYPES: readonly ["curve25519", "ed25519", "p256", "p384", "p521", "secp256k1", "brainpoolP256r1", "brainpoolP384r1", "brainpoolP512r1"];
+export type CurveType = (typeof CURVE_TYPES)[number];
+export declare const FORMAT_TYPES: readonly ["armored", "binary", "object"];
+export type FormatType = (typeof FORMAT_TYPES)[number];
+export declare const REVOCATION_FLAGS: readonly [0, 1, 2, 3];
+export type RevocationFlag = (typeof REVOCATION_FLAGS)[number];
+export interface IBodyGenerate {
     name: string;
     email: string;
+    type: KeyType;
+    passphrase: string;
+    rsaBits?: number;
+    curve: CurveType;
+    keyExpirationTime?: number;
+    format: FormatType;
+}
+export interface IBodyEncrypt {
+    passphrase: string;
+    message: string;
+    publicKey: string;
+    privateKey?: string;
+}
+export interface IBodyDecrypt {
     passphrase: string;
-    curve: string;
-    expiration: string;
-    format: string;
     message: string;
-    sign: string;
-};
-export declare type IHeadersBody = {
+    publicKey: string;
+    privateKey: string;
+}
+export interface IBodyRevoke {
     passphrase: string;
+    flag: number;
+    reason: string;
+}
+export interface IBodyVerify {
+    date: string;
     message: string;
-};
+    verificationKeys: string;
+}
 //# sourceMappingURL=types.d.ts.map

package/dist/@types/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/@types/types.ts"],"names":[],"mappings":"AAAA,oBAAY,YAAY,GAAG;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,oBAAY,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,oBAAY,YAAY,GAAG;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/@types/types.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,SAAS,yBAA0B,CAAC;AAEjD,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAKjD,eAAO,MAAM,WAAW,kIAUd,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAKrD,eAAO,MAAM,YAAY,0CAA2C,CAAC;AAErE,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAKvD,eAAO,MAAM,gBAAgB,uBAAwB,CAAC;AAEtD,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAiB/D,MAAM,WAAW,aAAa;IAE5B,IAAI,EAAE,MAAM,CAAC;IAEb,KAAK,EAAE,MAAM,CAAC;IAEd,IAAI,EAAE,OAAO,CAAC;IAEd,UAAU,EAAE,MAAM,CAAC;IAEnB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,KAAK,EAAE,SAAS,CAAC;IAEjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,MAAM,EAAE,UAAU,CAAC;CACpB;AAcD,MAAM,WAAW,YAAY;IAE3B,UAAU,EAAE,MAAM,CAAC;IAEnB,OAAO,EAAE,MAAM,CAAC;IAEhB,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAeD,MAAM,WAAW,YAAY;IAE3B,UAAU,EAAE,MAAM,CAAC;IAEnB,OAAO,EAAE,MAAM,CAAC;IAEhB,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC;CACpB;AAcD,MAAM,WAAW,WAAW;IAE1B,UAAU,EAAE,MAAM,CAAC;IAEnB,IAAI,EAAE,MAAM,CAAC;IAEb,MAAM,EAAE,MAAM,CAAC;CAChB;AAcD,MAAM,WAAW,WAAW;IAE1B,IAAI,EAAE,MAAM,CAAC;IAEb,OAAO,EAAE,MAAM,CAAC;IAEhB,gBAAgB,EAAE,MAAM,CAAC;CAC1B"}

package/dist/@types/types.js

@@ -1,3 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.REVOCATION_FLAGS = exports.FORMAT_TYPES = exports.CURVE_TYPES = exports.KEY_TYPES = void 0;
+exports.KEY_TYPES = ["ecc", "rsa"];
+exports.CURVE_TYPES = [
+    "curve25519",
+    "ed25519",
+    "p256",
+    "p384",
+    "p521",
+    "secp256k1",
+    "brainpoolP256r1",
+    "brainpoolP384r1",
+    "brainpoolP512r1",
+];
+exports.FORMAT_TYPES = ["armored", "binary", "object"];
+exports.REVOCATION_FLAGS = [0, 1, 2, 3];
 //# sourceMappingURL=types.js.map

package/dist/config/auth-policy.d.ts

@@ -0,0 +1,2 @@
+export declare function authConfigError(env: NodeJS.ProcessEnv): string | null;
+//# sourceMappingURL=auth-policy.d.ts.map

package/dist/config/auth-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-policy.d.ts","sourceRoot":"","sources":["../../src/config/auth-policy.ts"],"names":[],"mappings":"AAsBA,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,IAAI,CAcrE"}

package/dist/config/auth-policy.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authConfigError = authConfigError;
+const MIN_JWT_SECRET_BYTES = 32;
+function authConfigError(env) {
+    const jwtSecret = env["JWT_SECRET"];
+    if (jwtSecret && Buffer.byteLength(jwtSecret) < MIN_JWT_SECRET_BYTES) {
+        return `JWT_SECRET must be at least ${MIN_JWT_SECRET_BYTES} bytes`;
+    }
+    const hasCredential = Boolean(env["CRYPTO_API_KEY"] || jwtSecret);
+    if (env["NODE_ENV"] === "production" &&
+        !hasCredential &&
+        env["ALLOW_ANONYMOUS"] !== "1") {
+        return "Production requires CRYPTO_API_KEY or JWT_SECRET (or ALLOW_ANONYMOUS=1 behind an authenticating gateway)";
+    }
+    return null;
+}
+//# sourceMappingURL=auth-policy.js.map