@sebastienrousseau/crypto-server 0.0.9 → 0.0.25

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (47) hide show
  1. package/dist/config/auth-policy.d.ts.map +1 -1
  2. package/dist/config/auth-policy.js +18 -1
  3. package/dist/config/constants.d.ts.map +1 -1
  4. package/dist/config/constants.js +7 -1
  5. package/dist/lib/key-store.d.ts +8 -1
  6. package/dist/lib/key-store.d.ts.map +1 -1
  7. package/dist/lib/key-store.js +102 -5
  8. package/dist/lib/opaque-store.d.ts +34 -0
  9. package/dist/lib/opaque-store.d.ts.map +1 -0
  10. package/dist/lib/opaque-store.js +72 -0
  11. package/dist/lib/problem.d.ts +1 -0
  12. package/dist/lib/problem.d.ts.map +1 -1
  13. package/dist/lib/problem.js +10 -0
  14. package/dist/routes/v1/decrypt.d.ts.map +1 -1
  15. package/dist/routes/v1/decrypt.js +4 -1
  16. package/dist/routes/v1/verify.d.ts.map +1 -1
  17. package/dist/routes/v1/verify.js +4 -1
  18. package/dist/routes/v2/hpke.d.ts +3 -0
  19. package/dist/routes/v2/hpke.d.ts.map +1 -0
  20. package/dist/routes/v2/hpke.js +168 -0
  21. package/dist/routes/v2/index.d.ts.map +1 -1
  22. package/dist/routes/v2/index.js +6 -0
  23. package/dist/routes/v2/kms.d.ts +7 -0
  24. package/dist/routes/v2/kms.d.ts.map +1 -0
  25. package/dist/routes/v2/kms.js +310 -0
  26. package/dist/routes/v2/mac.d.ts.map +1 -1
  27. package/dist/routes/v2/mac.js +1 -0
  28. package/dist/routes/v2/opaque.d.ts +4 -0
  29. package/dist/routes/v2/opaque.d.ts.map +1 -0
  30. package/dist/routes/v2/opaque.js +174 -0
  31. package/dist/routes/v2/pq-hash-sign.d.ts.map +1 -1
  32. package/dist/routes/v2/pq-hash-sign.js +3 -0
  33. package/dist/routes/v2/pq-sign.d.ts.map +1 -1
  34. package/dist/routes/v2/pq-sign.js +1 -0
  35. package/dist/routes/v2/signing.d.ts.map +1 -1
  36. package/dist/routes/v2/signing.js +1 -0
  37. package/dist/routes/v2/stream-schemas.d.ts +296 -0
  38. package/dist/routes/v2/stream-schemas.d.ts.map +1 -0
  39. package/dist/routes/v2/stream-schemas.js +207 -0
  40. package/dist/routes/v2/stream.d.ts.map +1 -1
  41. package/dist/routes/v2/stream.js +117 -129
  42. package/dist/server.d.ts.map +1 -1
  43. package/dist/server.js +4 -0
  44. package/dist/utils/trace.d.ts +12 -0
  45. package/dist/utils/trace.d.ts.map +1 -0
  46. package/dist/utils/trace.js +62 -0
  47. package/package.json +4 -3
package/dist/routes/v2/stream-schemas.d.ts ADDED
@@ -0,0 +1,296 @@
1
+ export declare const SIGN_SCHEMA: {
2
+ tags: string[];
3
+ summary: string;
4
+ description: string;
5
+ body: {
6
+ type: string;
7
+ required: string[];
8
+ additionalProperties: boolean;
9
+ properties: {
10
+ items: {
11
+ type: string;
12
+ minItems: number;
13
+ maxItems: number;
14
+ items: {
15
+ type: string;
16
+ required: string[];
17
+ additionalProperties: boolean;
18
+ properties: {
19
+ id: {
20
+ type: string;
21
+ };
22
+ message: {
23
+ type: string;
24
+ minLength: number;
25
+ };
26
+ keyId: {
27
+ readonly type: "string";
28
+ readonly pattern: "^k_[A-Za-z0-9_-]{22}$";
29
+ readonly description: "Identifier of a server-held key, returned by a key-generation route.";
30
+ };
31
+ };
32
+ };
33
+ };
34
+ };
35
+ };
36
+ };
37
+ export declare const VERIFY_SCHEMA: {
38
+ tags: string[];
39
+ summary: string;
40
+ description: string;
41
+ body: {
42
+ type: string;
43
+ required: string[];
44
+ additionalProperties: boolean;
45
+ properties: {
46
+ items: {
47
+ type: string;
48
+ minItems: number;
49
+ maxItems: number;
50
+ items: {
51
+ type: string;
52
+ required: string[];
53
+ additionalProperties: boolean;
54
+ properties: {
55
+ id: {
56
+ type: string;
57
+ };
58
+ message: {
59
+ type: string;
60
+ minLength: number;
61
+ };
62
+ signature: {
63
+ type: string;
64
+ minLength: number;
65
+ };
66
+ publicKey: {
67
+ type: string;
68
+ minLength: number;
69
+ maxLength: number;
70
+ };
71
+ };
72
+ };
73
+ };
74
+ };
75
+ };
76
+ };
77
+ export declare const ISO20022_SCHEMA: {
78
+ tags: string[];
79
+ summary: string;
80
+ description: string;
81
+ body: {
82
+ type: string;
83
+ required: string[];
84
+ additionalProperties: boolean;
85
+ properties: {
86
+ trustedKeys: {
87
+ type: string;
88
+ required: string[];
89
+ additionalProperties: boolean;
90
+ properties: {
91
+ classicalPublicKey: {
92
+ type: string;
93
+ minLength: number;
94
+ };
95
+ postQuantumPublicKey: {
96
+ type: string;
97
+ minLength: number;
98
+ };
99
+ };
100
+ };
101
+ envelope: {
102
+ type: string;
103
+ required: string[];
104
+ additionalProperties: boolean;
105
+ properties: {
106
+ messageId: {
107
+ type: string;
108
+ };
109
+ messageType: {
110
+ type: string;
111
+ enum: string[];
112
+ };
113
+ payloadDigest: {
114
+ type: string;
115
+ };
116
+ digestAlgorithm: {
117
+ type: string;
118
+ enum: string[];
119
+ };
120
+ timestamp: {
121
+ type: string;
122
+ };
123
+ classical: {
124
+ type: string;
125
+ required: string[];
126
+ additionalProperties: boolean;
127
+ properties: {
128
+ algorithm: {
129
+ type: string;
130
+ };
131
+ signature: {
132
+ type: string;
133
+ };
134
+ publicKey: {
135
+ type: string;
136
+ };
137
+ };
138
+ };
139
+ postQuantum: {
140
+ type: string;
141
+ required: string[];
142
+ additionalProperties: boolean;
143
+ properties: {
144
+ algorithm: {
145
+ type: string;
146
+ enum: string[];
147
+ };
148
+ signature: {
149
+ type: string;
150
+ };
151
+ publicKey: {
152
+ type: string;
153
+ };
154
+ };
155
+ };
156
+ };
157
+ };
158
+ payload: {};
159
+ };
160
+ };
161
+ };
162
+ export declare const STREAM_PQ_ENCRYPT_SCHEMA: {
163
+ tags: string[];
164
+ summary: string;
165
+ description: string;
166
+ body: {
167
+ type: string;
168
+ required: string[];
169
+ additionalProperties: boolean;
170
+ properties: {
171
+ x25519PublicKey: {
172
+ type: string;
173
+ minLength: number;
174
+ maxLength: number;
175
+ };
176
+ mlKemPublicKey: {
177
+ type: string;
178
+ minLength: number;
179
+ };
180
+ plaintext: {
181
+ type: string;
182
+ minLength: number;
183
+ };
184
+ chunkSize: {
185
+ type: string;
186
+ minimum: number;
187
+ maximum: number;
188
+ };
189
+ };
190
+ };
191
+ };
192
+ export declare const STREAM_PQ_DECRYPT_SCHEMA: {
193
+ tags: string[];
194
+ summary: string;
195
+ description: string;
196
+ body: {
197
+ type: string;
198
+ required: string[];
199
+ additionalProperties: boolean;
200
+ properties: {
201
+ keyId: {
202
+ readonly type: "string";
203
+ readonly pattern: "^k_[A-Za-z0-9_-]{22}$";
204
+ readonly description: "Identifier of a server-held key, returned by a key-generation route.";
205
+ };
206
+ ciphertext: {
207
+ type: string;
208
+ minLength: number;
209
+ };
210
+ chunkSize: {
211
+ type: string;
212
+ minimum: number;
213
+ maximum: number;
214
+ };
215
+ };
216
+ };
217
+ };
218
+ export declare const STREAM_MULTI_PQ_ENCRYPT_SCHEMA: {
219
+ tags: string[];
220
+ summary: string;
221
+ description: string;
222
+ body: {
223
+ type: string;
224
+ required: string[];
225
+ additionalProperties: boolean;
226
+ properties: {
227
+ recipients: {
228
+ type: string;
229
+ minItems: number;
230
+ maxItems: number;
231
+ items: {
232
+ type: string;
233
+ required: string[];
234
+ additionalProperties: boolean;
235
+ properties: {
236
+ recipientId: {
237
+ type: string;
238
+ minLength: number;
239
+ maxLength: number;
240
+ };
241
+ x25519PublicKey: {
242
+ type: string;
243
+ minLength: number;
244
+ maxLength: number;
245
+ };
246
+ mlKemPublicKey: {
247
+ type: string;
248
+ minLength: number;
249
+ };
250
+ };
251
+ };
252
+ };
253
+ plaintext: {
254
+ type: string;
255
+ minLength: number;
256
+ };
257
+ chunkSize: {
258
+ type: string;
259
+ minimum: number;
260
+ maximum: number;
261
+ };
262
+ };
263
+ };
264
+ };
265
+ export declare const STREAM_MULTI_PQ_DECRYPT_SCHEMA: {
266
+ tags: string[];
267
+ summary: string;
268
+ description: string;
269
+ body: {
270
+ type: string;
271
+ required: string[];
272
+ additionalProperties: boolean;
273
+ properties: {
274
+ keyId: {
275
+ readonly type: "string";
276
+ readonly pattern: "^k_[A-Za-z0-9_-]{22}$";
277
+ readonly description: "Identifier of a server-held key, returned by a key-generation route.";
278
+ };
279
+ recipientId: {
280
+ type: string;
281
+ minLength: number;
282
+ maxLength: number;
283
+ };
284
+ ciphertext: {
285
+ type: string;
286
+ minLength: number;
287
+ };
288
+ chunkSize: {
289
+ type: string;
290
+ minimum: number;
291
+ maximum: number;
292
+ };
293
+ };
294
+ };
295
+ };
296
+ //# sourceMappingURL=stream-schemas.d.ts.map
package/dist/routes/v2/stream-schemas.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"stream-schemas.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/stream-schemas.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BvB,CAAC;AAGF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BzB,CAAC;AAGF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuE3B,CAAC;AAGF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgBpC,CAAC;AAGF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;CAepC,CAAC;AAGF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8B1C,CAAC;AAGF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiB1C,CAAC"}
package/dist/routes/v2/stream-schemas.js ADDED
@@ -0,0 +1,207 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.STREAM_MULTI_PQ_DECRYPT_SCHEMA = exports.STREAM_MULTI_PQ_ENCRYPT_SCHEMA = exports.STREAM_PQ_DECRYPT_SCHEMA = exports.STREAM_PQ_ENCRYPT_SCHEMA = exports.ISO20022_SCHEMA = exports.VERIFY_SCHEMA = exports.SIGN_SCHEMA = void 0;
4
+ const keys_1 = require("../../utils/keys");
5
+ exports.SIGN_SCHEMA = {
6
+ tags: ["Streaming"],
7
+ summary: "Batch sign messages with sub-millisecond throughput",
8
+ description: "Process high-throughput batch digital signing operations over multiple payloads.",
9
+ body: {
10
+ type: "object",
11
+ required: ["items"],
12
+ additionalProperties: false,
13
+ properties: {
14
+ items: {
15
+ type: "array",
16
+ minItems: 1,
17
+ maxItems: 1000,
18
+ items: {
19
+ type: "object",
20
+ required: ["id", "message", "keyId"],
21
+ additionalProperties: false,
22
+ properties: {
23
+ id: { type: "string" },
24
+ message: { type: "string", minLength: 1 },
25
+ keyId: keys_1.KEY_ID_SCHEMA,
26
+ },
27
+ },
28
+ },
29
+ },
30
+ },
31
+ };
32
+ exports.VERIFY_SCHEMA = {
33
+ tags: ["Streaming"],
34
+ summary: "Batch verify digital signatures",
35
+ description: "Batch verification pipeline for high-concurrency payment and transaction verification.",
36
+ body: {
37
+ type: "object",
38
+ required: ["items"],
39
+ additionalProperties: false,
40
+ properties: {
41
+ items: {
42
+ type: "array",
43
+ minItems: 1,
44
+ maxItems: 1000,
45
+ items: {
46
+ type: "object",
47
+ required: ["id", "message", "signature", "publicKey"],
48
+ additionalProperties: false,
49
+ properties: {
50
+ id: { type: "string" },
51
+ message: { type: "string", minLength: 1 },
52
+ signature: { type: "string", minLength: 1 },
53
+ publicKey: { type: "string", minLength: 64, maxLength: 64 },
54
+ },
55
+ },
56
+ },
57
+ },
58
+ },
59
+ };
60
+ exports.ISO20022_SCHEMA = {
61
+ tags: ["Wholesale Payments"],
62
+ summary: "Verify ISO 20022 post-quantum dual-signature envelope",
63
+ description: "Validates the payload digest and both the Ed25519 and ML-DSA signatures of a pacs.008, pain.001 or camt.053 envelope. Signatures are checked against trustedKeys, the signer's public keys from the caller's own registry; the public keys inside the envelope are ignored.",
64
+ body: {
65
+ type: "object",
66
+ required: ["envelope", "payload", "trustedKeys"],
67
+ additionalProperties: false,
68
+ properties: {
69
+ trustedKeys: {
70
+ type: "object",
71
+ required: ["classicalPublicKey", "postQuantumPublicKey"],
72
+ additionalProperties: false,
73
+ properties: {
74
+ classicalPublicKey: { type: "string", minLength: 1 },
75
+ postQuantumPublicKey: { type: "string", minLength: 1 },
76
+ },
77
+ },
78
+ envelope: {
79
+ type: "object",
80
+ required: [
81
+ "messageId",
82
+ "messageType",
83
+ "payloadDigest",
84
+ "digestAlgorithm",
85
+ "timestamp",
86
+ "classical",
87
+ "postQuantum",
88
+ ],
89
+ additionalProperties: false,
90
+ properties: {
91
+ messageId: { type: "string" },
92
+ messageType: {
93
+ type: "string",
94
+ enum: ["pacs.008", "pain.001", "camt.053", "generic"],
95
+ },
96
+ payloadDigest: { type: "string" },
97
+ digestAlgorithm: {
98
+ type: "string",
99
+ enum: ["sha256", "sha384", "sha512"],
100
+ },
101
+ timestamp: { type: "string" },
102
+ classical: {
103
+ type: "object",
104
+ required: ["algorithm", "signature", "publicKey"],
105
+ additionalProperties: false,
106
+ properties: {
107
+ algorithm: { type: "string" },
108
+ signature: { type: "string" },
109
+ publicKey: { type: "string" },
110
+ },
111
+ },
112
+ postQuantum: {
113
+ type: "object",
114
+ required: ["algorithm", "signature", "publicKey"],
115
+ additionalProperties: false,
116
+ properties: {
117
+ algorithm: {
118
+ type: "string",
119
+ enum: ["ml-dsa-44", "ml-dsa-65", "ml-dsa-87"],
120
+ },
121
+ signature: { type: "string" },
122
+ publicKey: { type: "string" },
123
+ },
124
+ },
125
+ },
126
+ },
127
+ payload: {},
128
+ },
129
+ },
130
+ };
131
+ exports.STREAM_PQ_ENCRYPT_SCHEMA = {
132
+ tags: ["Streaming"],
133
+ summary: "Encrypt stream with hybrid post-quantum AEAD",
134
+ description: "Encrypts plaintext using chunked hybrid post-quantum STREAM (X25519 + ML-KEM-768 + XChaCha20-Poly1305).",
135
+ body: {
136
+ type: "object",
137
+ required: ["x25519PublicKey", "mlKemPublicKey", "plaintext"],
138
+ additionalProperties: false,
139
+ properties: {
140
+ x25519PublicKey: { type: "string", minLength: 64, maxLength: 64 },
141
+ mlKemPublicKey: { type: "string", minLength: 1 },
142
+ plaintext: { type: "string", minLength: 1 },
143
+ chunkSize: { type: "integer", minimum: 64, maximum: 1048576 },
144
+ },
145
+ },
146
+ };
147
+ exports.STREAM_PQ_DECRYPT_SCHEMA = {
148
+ tags: ["Streaming"],
149
+ summary: "Decrypt stream with server-held hybrid post-quantum key",
150
+ description: "Decrypts hybrid post-quantum STREAM ciphertext using a server-held x25519-ml-kem-768 key.",
151
+ body: {
152
+ type: "object",
153
+ required: ["keyId", "ciphertext"],
154
+ additionalProperties: false,
155
+ properties: {
156
+ keyId: keys_1.KEY_ID_SCHEMA,
157
+ ciphertext: { type: "string", minLength: 1 },
158
+ chunkSize: { type: "integer", minimum: 64, maximum: 1048576 },
159
+ },
160
+ },
161
+ };
162
+ exports.STREAM_MULTI_PQ_ENCRYPT_SCHEMA = {
163
+ tags: ["Streaming"],
164
+ summary: "Encrypt stream for multiple recipients with hybrid post-quantum AEAD",
165
+ description: "Encrypts plaintext for multiple recipients using hybrid post-quantum key encapsulation and chunked AEAD.",
166
+ body: {
167
+ type: "object",
168
+ required: ["recipients", "plaintext"],
169
+ additionalProperties: false,
170
+ properties: {
171
+ recipients: {
172
+ type: "array",
173
+ minItems: 1,
174
+ maxItems: 100,
175
+ items: {
176
+ type: "object",
177
+ required: ["recipientId", "x25519PublicKey", "mlKemPublicKey"],
178
+ additionalProperties: false,
179
+ properties: {
180
+ recipientId: { type: "string", minLength: 1, maxLength: 255 },
181
+ x25519PublicKey: { type: "string", minLength: 64, maxLength: 64 },
182
+ mlKemPublicKey: { type: "string", minLength: 1 },
183
+ },
184
+ },
185
+ },
186
+ plaintext: { type: "string", minLength: 1 },
187
+ chunkSize: { type: "integer", minimum: 1024, maximum: 16777216 },
188
+ },
189
+ },
190
+ };
191
+ exports.STREAM_MULTI_PQ_DECRYPT_SCHEMA = {
192
+ tags: ["Streaming"],
193
+ summary: "Decrypt multi-recipient stream with server-held hybrid post-quantum key",
194
+ description: "Decrypts multi-recipient hybrid post-quantum STREAM ciphertext using a server-held x25519-ml-kem-768 key.",
195
+ body: {
196
+ type: "object",
197
+ required: ["keyId", "ciphertext"],
198
+ additionalProperties: false,
199
+ properties: {
200
+ keyId: keys_1.KEY_ID_SCHEMA,
201
+ recipientId: { type: "string", minLength: 1, maxLength: 255 },
202
+ ciphertext: { type: "string", minLength: 1 },
203
+ chunkSize: { type: "integer", minimum: 1024, maximum: 16777216 },
204
+ },
205
+ },
206
+ };
207
+ //# sourceMappingURL=stream-schemas.js.map
package/dist/routes/v2/stream.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/stream.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;yBAsR/C,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAIE"}
1
+ {"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/stream.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;yBA6U/C,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAQE"}