@suveren/gateway 0.40.0 → 0.41.1

package/node_modules/@hap/core/node_modules/@hpke/core/esm/src/cipherSuiteNative.d.ts

@@ -0,0 +1,145 @@
+import type { AeadInterface, KdfInterface, KemInterface, RecipientContextParams, SenderContextParams } from "@hpke/common";
+import { NativeAlgorithm } from "@hpke/common";
+import type { CipherSuiteParams } from "./interfaces/cipherSuiteParams.js";
+import type { RecipientContext, SenderContext } from "./interfaces/encryptionContext.js";
+import type { CipherSuiteSealResponse } from "./interfaces/responses.js";
+/**
+ * The Hybrid Public Key Encryption (HPKE) ciphersuite,
+ * which is implemented using only
+ * {@link https://www.w3.org/TR/WebCryptoAPI/ | Web Cryptography API}.
+ *
+ * This is the super class of {@link CipherSuite} and the same as
+ * {@link https://jsr.io/@hpke/core/doc/~/CipherSuite | @hpke/core#CipherSuite} as follows:
+ * which supports only the ciphersuites that can be implemented on the native
+ * {@link https://www.w3.org/TR/WebCryptoAPI/ | Web Cryptography API}.
+ * Therefore, the following cryptographic algorithms are not supported for now:
+ *   - DHKEM(X25519, HKDF-SHA256)
+ *   - DHKEM(X448, HKDF-SHA512)
+ *   - ChaCha20Poly1305
+ *
+ * In addtion, the HKDF functions contained in this class can only derive
+ * keys of the same length as the `hashSize`.
+ *
+ * If you want to use the unsupported cryptographic algorithms
+ * above or derive keys longer than the `hashSize`,
+ * please use {@link CipherSuite}.
+ *
+ * This class provides following functions:
+ *
+ * - Creates encryption contexts both for senders and recipients.
+ *   - {@link createSenderContext}
+ *   - {@link createRecipientContext}
+ * - Provides single-shot encryption API.
+ *   - {@link seal}
+ *   - {@link open}
+ *
+ * The calling of the constructor of this class is the starting
+ * point for HPKE operations for both senders and recipients.
+ *
+ * @example Use only ciphersuites supported by Web Cryptography API.
+ *
+ * ```ts
+ * import {
+ *   Aes128Gcm,
+ *   DhkemP256HkdfSha256,
+ *   HkdfSha256,
+ *   CipherSuite,
+ * } from "@hpke/core";
+ *
+ * const suite = new CipherSuite({
+ *   kem: new DhkemP256HkdfSha256(),
+ *   kdf: new HkdfSha256(),
+ *   aead: new Aes128Gcm(),
+ * });
+ * ```
+ *
+ * @example Use a ciphersuite which is currently not supported by Web Cryptography API.
+ *
+ * ```ts
+ * import { Aes128Gcm, HkdfSha256, CipherSuite } from "@hpke/core";
+ * // Use an extension module.
+ * import { DhkemX25519HkdfSha256 } from "@hpke/dhkem-x25519";
+ *
+ * const suite = new CipherSuite({
+ *   kem: new DhkemX25519HkdfSha256(),
+ *   kdf: new HkdfSha256(),
+ *   aead: new Aes128Gcm(),
+ * });
+ * ```
+ */
+export declare class CipherSuiteNative extends NativeAlgorithm {
+    protected _kem: KemInterface;
+    private _kdf;
+    private _aead;
+    private _suiteId;
+    /**
+     * @param params A set of parameters for building a cipher suite.
+     *
+     * If the error occurred, throws {@link InvalidParamError}.
+     *
+     * @throws {@link InvalidParamError}
+     */
+    constructor(params: CipherSuiteParams);
+    /**
+     * Gets the KEM context of the ciphersuite.
+     */
+    get kem(): KemInterface;
+    /**
+     * Gets the KDF context of the ciphersuite.
+     */
+    get kdf(): KdfInterface;
+    /**
+     * Gets the AEAD context of the ciphersuite.
+     */
+    get aead(): AeadInterface;
+    /**
+     * Creates an encryption context for a sender.
+     *
+     * If the error occurred, throws {@link DecapError} | {@link ValidationError}.
+     *
+     * @param params A set of parameters for the sender encryption context.
+     * @returns A sender encryption context.
+     * @throws {@link EncapError}, {@link ValidationError}
+     */
+    createSenderContext(params: SenderContextParams): Promise<SenderContext>;
+    /**
+     * Creates an encryption context for a recipient.
+     *
+     * If the error occurred, throws {@link DecapError}
+     * | {@link DeserializeError} | {@link ValidationError}.
+     *
+     * @param params A set of parameters for the recipient encryption context.
+     * @returns A recipient encryption context.
+     * @throws {@link DecapError}, {@link DeserializeError}, {@link ValidationError}
+     */
+    createRecipientContext(params: RecipientContextParams): Promise<RecipientContext>;
+    /**
+     * Encrypts a message to a recipient.
+     *
+     * If the error occurred, throws `EncapError` | `MessageLimitReachedError` | `SealError` | `ValidationError`.
+     *
+     * @param params A set of parameters for building a sender encryption context.
+     * @param pt A plain text as bytes to be encrypted.
+     * @param aad Additional authenticated data as bytes fed by an application.
+     * @returns A cipher text and an encapsulated key as bytes.
+     * @throws {@link EncapError}, {@link MessageLimitReachedError}, {@link SealError}, {@link ValidationError}
+     */
+    seal(params: SenderContextParams, pt: ArrayBufferLike | ArrayBufferView, aad?: ArrayBufferLike | ArrayBufferView): Promise<CipherSuiteSealResponse>;
+    /**
+     * Decrypts a message from a sender.
+     *
+     * If the error occurred, throws `DecapError` | `DeserializeError` | `OpenError` | `ValidationError`.
+     *
+     * @param params A set of parameters for building a recipient encryption context.
+     * @param ct An encrypted text as bytes to be decrypted.
+     * @param aad Additional authenticated data as bytes fed by an application.
+     * @returns A decrypted plain text as bytes.
+     * @throws {@link DecapError}, {@link DeserializeError}, {@link OpenError}, {@link ValidationError}
+     */
+    open(params: RecipientContextParams, ct: ArrayBufferLike | ArrayBufferView, aad?: ArrayBufferLike | ArrayBufferView): Promise<ArrayBuffer>;
+    private _keySchedule;
+    private _keyScheduleS;
+    private _keyScheduleR;
+    private _validateInputLength;
+}
+//# sourceMappingURL=cipherSuiteNative.d.ts.map

package/node_modules/@hap/core/node_modules/@hpke/core/esm/src/cipherSuiteNative.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cipherSuiteNative.d.ts","sourceRoot":"","sources":["../../src/src/cipherSuiteNative.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,YAAY,EACZ,YAAY,EAEZ,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EASL,eAAe,EAEhB,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,KAAK,EACV,gBAAgB,EAChB,aAAa,EACd,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAoCzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,qBAAa,iBAAkB,SAAQ,eAAe;IACpD,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAe;IAC3B,OAAO,CAAC,KAAK,CAAgB;IAC7B,OAAO,CAAC,QAAQ,CAAa;IAE7B;;;;;;OAMG;gBACS,MAAM,EAAE,iBAAiB;IA4BrC;;OAEG;IACH,IAAW,GAAG,IAAI,YAAY,CAE7B;IAED;;OAEG;IACH,IAAW,GAAG,IAAI,YAAY,CAE7B;IAED;;OAEG;IACH,IAAW,IAAI,IAAI,aAAa,CAE/B;IAED;;;;;;;;OAQG;IACU,mBAAmB,CAC9B,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC;IAgBzB;;;;;;;;;OASG;IACU,sBAAsB,CACjC,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,gBAAgB,CAAC;IAgB5B;;;;;;;;;;OAUG;IACU,IAAI,CACf,MAAM,EAAE,mBAAmB,EAC3B,EAAE,EAAE,eAAe,GAAG,eAAe,EACrC,GAAG,GAAE,eAAe,GAAG,eAA6C,GACnE,OAAO,CAAC,uBAAuB,CAAC;IAQnC;;;;;;;;;;OAUG;IACU,IAAI,CACf,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,eAAe,GAAG,eAAe,EACrC,GAAG,GAAE,eAAe,GAAG,eAA6C,GACnE,OAAO,CAAC,WAAW,CAAC;YAoBT,YAAY;YAqFZ,aAAa;YAuBb,aAAa;IAgB3B,OAAO,CAAC,oBAAoB;CAsB7B"}

package/node_modules/@hap/core/node_modules/@hpke/core/esm/src/cipherSuiteNative.js

@@ -0,0 +1,326 @@
+import { AeadId, EMPTY, i2Osp, INFO_LENGTH_LIMIT, INPUT_LENGTH_LIMIT, InvalidParamError, MINIMUM_PSK_LENGTH, Mode, NativeAlgorithm, toUint8Array, } from "@hpke/common";
+import { RecipientExporterContextImpl, SenderExporterContextImpl, } from "./exporterContext.js";
+import { RecipientContextImpl } from "./recipientContext.js";
+import { SenderContextImpl } from "./senderContext.js";
+// b"base_nonce"
+// deno-fmt-ignore
+const LABEL_BASE_NONCE = new Uint8Array([
+    98, 97, 115, 101, 95, 110, 111, 110, 99, 101,
+]);
+// b"exp"
+const LABEL_EXP = new Uint8Array([101, 120, 112]);
+// b"info_hash"
+// deno-fmt-ignore
+const LABEL_INFO_HASH = new Uint8Array([
+    105, 110, 102, 111, 95, 104, 97, 115, 104,
+]);
+// b"key"
+const LABEL_KEY = new Uint8Array([107, 101, 121]);
+// b"psk_id_hash"
+// deno-fmt-ignore
+const LABEL_PSK_ID_HASH = new Uint8Array([
+    112, 115, 107, 95, 105, 100, 95, 104, 97, 115, 104,
+]);
+// b"secret"
+const LABEL_SECRET = new Uint8Array([115, 101, 99, 114, 101, 116]);
+// b"HPKE"
+// deno-fmt-ignore
+const SUITE_ID_HEADER_HPKE = new Uint8Array([
+    72, 80, 75, 69, 0, 0, 0, 0, 0, 0,
+]);
+/**
+ * The Hybrid Public Key Encryption (HPKE) ciphersuite,
+ * which is implemented using only
+ * {@link https://www.w3.org/TR/WebCryptoAPI/ | Web Cryptography API}.
+ *
+ * This is the super class of {@link CipherSuite} and the same as
+ * {@link https://jsr.io/@hpke/core/doc/~/CipherSuite | @hpke/core#CipherSuite} as follows:
+ * which supports only the ciphersuites that can be implemented on the native
+ * {@link https://www.w3.org/TR/WebCryptoAPI/ | Web Cryptography API}.
+ * Therefore, the following cryptographic algorithms are not supported for now:
+ *   - DHKEM(X25519, HKDF-SHA256)
+ *   - DHKEM(X448, HKDF-SHA512)
+ *   - ChaCha20Poly1305
+ *
+ * In addtion, the HKDF functions contained in this class can only derive
+ * keys of the same length as the `hashSize`.
+ *
+ * If you want to use the unsupported cryptographic algorithms
+ * above or derive keys longer than the `hashSize`,
+ * please use {@link CipherSuite}.
+ *
+ * This class provides following functions:
+ *
+ * - Creates encryption contexts both for senders and recipients.
+ *   - {@link createSenderContext}
+ *   - {@link createRecipientContext}
+ * - Provides single-shot encryption API.
+ *   - {@link seal}
+ *   - {@link open}
+ *
+ * The calling of the constructor of this class is the starting
+ * point for HPKE operations for both senders and recipients.
+ *
+ * @example Use only ciphersuites supported by Web Cryptography API.
+ *
+ * ```ts
+ * import {
+ *   Aes128Gcm,
+ *   DhkemP256HkdfSha256,
+ *   HkdfSha256,
+ *   CipherSuite,
+ * } from "@hpke/core";
+ *
+ * const suite = new CipherSuite({
+ *   kem: new DhkemP256HkdfSha256(),
+ *   kdf: new HkdfSha256(),
+ *   aead: new Aes128Gcm(),
+ * });
+ * ```
+ *
+ * @example Use a ciphersuite which is currently not supported by Web Cryptography API.
+ *
+ * ```ts
+ * import { Aes128Gcm, HkdfSha256, CipherSuite } from "@hpke/core";
+ * // Use an extension module.
+ * import { DhkemX25519HkdfSha256 } from "@hpke/dhkem-x25519";
+ *
+ * const suite = new CipherSuite({
+ *   kem: new DhkemX25519HkdfSha256(),
+ *   kdf: new HkdfSha256(),
+ *   aead: new Aes128Gcm(),
+ * });
+ * ```
+ */
+export class CipherSuiteNative extends NativeAlgorithm {
+    /**
+     * @param params A set of parameters for building a cipher suite.
+     *
+     * If the error occurred, throws {@link InvalidParamError}.
+     *
+     * @throws {@link InvalidParamError}
+     */
+    constructor(params) {
+        super();
+        Object.defineProperty(this, "_kem", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "_kdf", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "_aead", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "_suiteId", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        // KEM
+        if (typeof params.kem === "number") {
+            throw new InvalidParamError("KemId cannot be used");
+        }
+        this._kem = params.kem;
+        // KDF
+        if (typeof params.kdf === "number") {
+            throw new InvalidParamError("KdfId cannot be used");
+        }
+        this._kdf = params.kdf;
+        // AEAD
+        if (typeof params.aead === "number") {
+            throw new InvalidParamError("AeadId cannot be used");
+        }
+        this._aead = params.aead;
+        this._suiteId = new Uint8Array(SUITE_ID_HEADER_HPKE);
+        this._suiteId.set(i2Osp(this._kem.id, 2), 4);
+        this._suiteId.set(i2Osp(this._kdf.id, 2), 6);
+        this._suiteId.set(i2Osp(this._aead.id, 2), 8);
+        this._kdf.init(this._suiteId);
+    }
+    /**
+     * Gets the KEM context of the ciphersuite.
+     */
+    get kem() {
+        return this._kem;
+    }
+    /**
+     * Gets the KDF context of the ciphersuite.
+     */
+    get kdf() {
+        return this._kdf;
+    }
+    /**
+     * Gets the AEAD context of the ciphersuite.
+     */
+    get aead() {
+        return this._aead;
+    }
+    /**
+     * Creates an encryption context for a sender.
+     *
+     * If the error occurred, throws {@link DecapError} | {@link ValidationError}.
+     *
+     * @param params A set of parameters for the sender encryption context.
+     * @returns A sender encryption context.
+     * @throws {@link EncapError}, {@link ValidationError}
+     */
+    async createSenderContext(params) {
+        this._validateInputLength(params);
+        await this._setup();
+        const dh = await this._kem.encap(params);
+        let mode;
+        if (params.psk !== undefined) {
+            mode = params.senderKey !== undefined ? Mode.AuthPsk : Mode.Psk;
+        }
+        else {
+            mode = params.senderKey !== undefined ? Mode.Auth : Mode.Base;
+        }
+        return await this._keyScheduleS(mode, dh.sharedSecret, dh.enc, params);
+    }
+    /**
+     * Creates an encryption context for a recipient.
+     *
+     * If the error occurred, throws {@link DecapError}
+     * | {@link DeserializeError} | {@link ValidationError}.
+     *
+     * @param params A set of parameters for the recipient encryption context.
+     * @returns A recipient encryption context.
+     * @throws {@link DecapError}, {@link DeserializeError}, {@link ValidationError}
+     */
+    async createRecipientContext(params) {
+        this._validateInputLength(params);
+        await this._setup();
+        const sharedSecret = await this._kem.decap(params);
+        let mode;
+        if (params.psk !== undefined) {
+            mode = params.senderPublicKey !== undefined ? Mode.AuthPsk : Mode.Psk;
+        }
+        else {
+            mode = params.senderPublicKey !== undefined ? Mode.Auth : Mode.Base;
+        }
+        return await this._keyScheduleR(mode, sharedSecret, params);
+    }
+    /**
+     * Encrypts a message to a recipient.
+     *
+     * If the error occurred, throws `EncapError` | `MessageLimitReachedError` | `SealError` | `ValidationError`.
+     *
+     * @param params A set of parameters for building a sender encryption context.
+     * @param pt A plain text as bytes to be encrypted.
+     * @param aad Additional authenticated data as bytes fed by an application.
+     * @returns A cipher text and an encapsulated key as bytes.
+     * @throws {@link EncapError}, {@link MessageLimitReachedError}, {@link SealError}, {@link ValidationError}
+     */
+    async seal(params, pt, aad = EMPTY.buffer) {
+        const ctx = await this.createSenderContext(params);
+        return {
+            ct: await ctx.seal(pt, aad),
+            enc: ctx.enc,
+        };
+    }
+    /**
+     * Decrypts a message from a sender.
+     *
+     * If the error occurred, throws `DecapError` | `DeserializeError` | `OpenError` | `ValidationError`.
+     *
+     * @param params A set of parameters for building a recipient encryption context.
+     * @param ct An encrypted text as bytes to be decrypted.
+     * @param aad Additional authenticated data as bytes fed by an application.
+     * @returns A decrypted plain text as bytes.
+     * @throws {@link DecapError}, {@link DeserializeError}, {@link OpenError}, {@link ValidationError}
+     */
+    async open(params, ct, aad = EMPTY.buffer) {
+        const ctx = await this.createRecipientContext(params);
+        return await ctx.open(ct, aad);
+    }
+    // private verifyPskInputs(mode: Mode, params: KeyScheduleParams) {
+    //   const gotPsk = (params.psk !== undefined);
+    //   const gotPskId = (params.psk !== undefined && params.psk.id.byteLength > 0);
+    //   if (gotPsk !== gotPskId) {
+    //     throw new Error('Inconsistent PSK inputs');
+    //   }
+    //   if (gotPsk && (mode === Mode.Base || mode === Mode.Auth)) {
+    //     throw new Error('PSK input provided when not needed');
+    //   }
+    //   if (!gotPsk && (mode === Mode.Psk || mode === Mode.AuthPsk)) {
+    //     throw new Error('Missing required PSK input');
+    //   }
+    //   return;
+    // }
+    async _keySchedule(mode, sharedSecret, params) {
+        // Currently, there is no point in executing this function
+        // because this hpke library does not allow users to explicitly specify the mode.
+        //
+        // this.verifyPskInputs(mode, params);
+        const pskId = params.psk === undefined
+            ? EMPTY
+            : toUint8Array(params.psk.id);
+        const pskIdHash = await this._kdf.labeledExtract(EMPTY, LABEL_PSK_ID_HASH, pskId);
+        const info = params.info === undefined ? EMPTY : toUint8Array(params.info);
+        const infoHash = await this._kdf.labeledExtract(EMPTY, LABEL_INFO_HASH, info);
+        const keyScheduleContext = new Uint8Array(1 + pskIdHash.byteLength + infoHash.byteLength);
+        keyScheduleContext.set(new Uint8Array([mode]), 0);
+        keyScheduleContext.set(new Uint8Array(pskIdHash), 1);
+        keyScheduleContext.set(new Uint8Array(infoHash), 1 + pskIdHash.byteLength);
+        const psk = params.psk === undefined ? EMPTY : toUint8Array(params.psk.key);
+        const ikm = this._kdf.buildLabeledIkm(LABEL_SECRET, psk);
+        const exporterSecretInfo = this._kdf.buildLabeledInfo(LABEL_EXP, keyScheduleContext, this._kdf.hashSize);
+        const exporterSecret = await this._kdf.extractAndExpand(sharedSecret, ikm, exporterSecretInfo, this._kdf.hashSize);
+        if (this._aead.id === AeadId.ExportOnly) {
+            return { aead: this._aead, exporterSecret: exporterSecret };
+        }
+        const keyInfo = this._kdf.buildLabeledInfo(LABEL_KEY, keyScheduleContext, this._aead.keySize);
+        const key = await this._kdf.extractAndExpand(sharedSecret, ikm, keyInfo, this._aead.keySize);
+        const baseNonceInfo = this._kdf.buildLabeledInfo(LABEL_BASE_NONCE, keyScheduleContext, this._aead.nonceSize);
+        const baseNonce = await this._kdf.extractAndExpand(sharedSecret, ikm, baseNonceInfo, this._aead.nonceSize);
+        return {
+            aead: this._aead,
+            exporterSecret: exporterSecret,
+            key: key,
+            baseNonce: new Uint8Array(baseNonce),
+            seq: 0,
+        };
+    }
+    async _keyScheduleS(mode, sharedSecret, enc, params) {
+        const res = await this._keySchedule(mode, sharedSecret, params);
+        if (res.key === undefined) {
+            return new SenderExporterContextImpl(this._api, this._kdf, res.exporterSecret, enc);
+        }
+        return new SenderContextImpl(this._api, this._kdf, res, enc);
+    }
+    async _keyScheduleR(mode, sharedSecret, params) {
+        const res = await this._keySchedule(mode, sharedSecret, params);
+        if (res.key === undefined) {
+            return new RecipientExporterContextImpl(this._api, this._kdf, res.exporterSecret);
+        }
+        return new RecipientContextImpl(this._api, this._kdf, res);
+    }
+    _validateInputLength(params) {
+        if (params.info !== undefined &&
+            params.info.byteLength > INFO_LENGTH_LIMIT) {
+            throw new InvalidParamError("Too long info");
+        }
+        if (params.psk !== undefined) {
+            if (params.psk.key.byteLength < MINIMUM_PSK_LENGTH) {
+                throw new InvalidParamError(`PSK must have at least ${MINIMUM_PSK_LENGTH} bytes`);
+            }
+            if (params.psk.key.byteLength > INPUT_LENGTH_LIMIT) {
+                throw new InvalidParamError("Too long psk.key");
+            }
+            if (params.psk.id.byteLength > INPUT_LENGTH_LIMIT) {
+                throw new InvalidParamError("Too long psk.id");
+            }
+        }
+        return;
+    }
+}

package/node_modules/@hap/core/node_modules/@hpke/core/esm/src/encryptionContext.d.ts

@@ -0,0 +1,15 @@
+import type { AeadInterface, KdfInterface } from "@hpke/common";
+import type { AeadParams } from "./interfaces/aeadParams.js";
+import type { KeyInfo } from "./interfaces/keyInfo.js";
+import { ExporterContextImpl } from "./exporterContext.js";
+export declare class EncryptionContextImpl extends ExporterContextImpl {
+    protected _aead: AeadInterface;
+    protected _nK: number;
+    protected _nN: number;
+    protected _nT: number;
+    protected _ctx: KeyInfo;
+    constructor(api: SubtleCrypto, kdf: KdfInterface, params: AeadParams);
+    protected computeNonce(k: KeyInfo): ArrayBuffer;
+    protected incrementSeq(k: KeyInfo): void;
+}
+//# sourceMappingURL=encryptionContext.d.ts.map

package/node_modules/@hap/core/node_modules/@hpke/core/esm/src/encryptionContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryptionContext.d.ts","sourceRoot":"","sources":["../../src/src/encryptionContext.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGhE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,qBAAa,qBAAsB,SAAQ,mBAAmB;IAE5D,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC;IAE/B,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC;IAEtB,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC;IAEtB,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC;IAEtB,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC;gBAEZ,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU;IAsBpE,SAAS,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,WAAW;IAK/C,SAAS,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO;CAQlC"}

package/node_modules/@hap/core/node_modules/@hpke/core/esm/src/encryptionContext.js

@@ -0,0 +1,68 @@
+import { i2Osp, MessageLimitReachedError, xor } from "@hpke/common";
+import { ExporterContextImpl } from "./exporterContext.js";
+export class EncryptionContextImpl extends ExporterContextImpl {
+    constructor(api, kdf, params) {
+        super(api, kdf, params.exporterSecret);
+        // AEAD id.
+        Object.defineProperty(this, "_aead", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        // The length in bytes of a key for the algorithm.
+        Object.defineProperty(this, "_nK", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        // The length in bytes of a nonce for the algorithm.
+        Object.defineProperty(this, "_nN", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        // The length in bytes of an authentication tag for the algorithm.
+        Object.defineProperty(this, "_nT", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        // The end-to-end encryption key information.
+        Object.defineProperty(this, "_ctx", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        if (params.key === undefined || params.baseNonce === undefined ||
+            params.seq === undefined) {
+            throw new Error("Required parameters are missing");
+        }
+        this._aead = params.aead;
+        this._nK = this._aead.keySize;
+        this._nN = this._aead.nonceSize;
+        this._nT = this._aead.tagSize;
+        const key = this._aead.createEncryptionContext(params.key);
+        this._ctx = {
+            key: key,
+            baseNonce: params.baseNonce,
+            seq: params.seq,
+        };
+    }
+    computeNonce(k) {
+        const seqBytes = i2Osp(k.seq, k.baseNonce.byteLength);
+        return xor(k.baseNonce, seqBytes).buffer;
+    }
+    incrementSeq(k) {
+        // if (this.seq >= (1 << (8 * this.baseNonce.byteLength)) - 1) {
+        if (k.seq > Number.MAX_SAFE_INTEGER) {
+            throw new MessageLimitReachedError("Message limit reached");
+        }
+        k.seq += 1;
+        return;
+    }
+}

package/node_modules/@hap/core/node_modules/@hpke/core/esm/src/exporterContext.d.ts

@@ -0,0 +1,19 @@
+import type { KdfInterface } from "@hpke/common";
+import type { Encapsulator } from "./interfaces/encapsulator.js";
+import type { EncryptionContext } from "./interfaces/encryptionContext.js";
+export declare class ExporterContextImpl implements EncryptionContext {
+    protected _api: SubtleCrypto;
+    protected readonly exporterSecret: ArrayBuffer;
+    private _kdf;
+    constructor(api: SubtleCrypto, kdf: KdfInterface, exporterSecret: ArrayBuffer);
+    seal(_data: ArrayBufferLike | ArrayBufferView, _aad: ArrayBufferLike | ArrayBufferView): Promise<ArrayBuffer>;
+    open(_data: ArrayBufferLike | ArrayBufferView, _aad: ArrayBufferLike | ArrayBufferView): Promise<ArrayBuffer>;
+    export(exporterContext: ArrayBufferLike | ArrayBufferView, len: number): Promise<ArrayBuffer>;
+}
+export declare class RecipientExporterContextImpl extends ExporterContextImpl {
+}
+export declare class SenderExporterContextImpl extends ExporterContextImpl implements Encapsulator {
+    readonly enc: ArrayBuffer;
+    constructor(api: SubtleCrypto, kdf: KdfInterface, exporterSecret: ArrayBuffer, enc: ArrayBuffer);
+}
+//# sourceMappingURL=exporterContext.d.ts.map

package/node_modules/@hap/core/node_modules/@hpke/core/esm/src/exporterContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exporterContext.d.ts","sourceRoot":"","sources":["../../src/src/exporterContext.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAQjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAO3E,qBAAa,mBAAoB,YAAW,iBAAiB;IAC3D,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC;IAC7B,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;IAC/C,OAAO,CAAC,IAAI,CAAe;gBAGzB,GAAG,EAAE,YAAY,EACjB,GAAG,EAAE,YAAY,EACjB,cAAc,EAAE,WAAW;IAOhB,IAAI,CACf,KAAK,EAAE,eAAe,GAAG,eAAe,EACxC,IAAI,EAAE,eAAe,GAAG,eAAe,GACtC,OAAO,CAAC,WAAW,CAAC;IAIV,IAAI,CACf,KAAK,EAAE,eAAe,GAAG,eAAe,EACxC,IAAI,EAAE,eAAe,GAAG,eAAe,GACtC,OAAO,CAAC,WAAW,CAAC;IAIV,MAAM,CACjB,eAAe,EAAE,eAAe,GAAG,eAAe,EAClD,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,WAAW,CAAC;CAgBxB;AAED,qBAAa,4BAA6B,SAAQ,mBAAmB;CAAG;AAExE,qBAAa,yBAA0B,SAAQ,mBAC7C,YAAW,YAAY;IACvB,SAAgB,GAAG,EAAE,WAAW,CAAC;gBAG/B,GAAG,EAAE,YAAY,EACjB,GAAG,EAAE,YAAY,EACjB,cAAc,EAAE,WAAW,EAC3B,GAAG,EAAE,WAAW;CAMnB"}

package/node_modules/@hap/core/node_modules/@hpke/core/esm/src/exporterContext.js

@@ -0,0 +1,62 @@
+import { ExportError, INPUT_LENGTH_LIMIT, InvalidParamError, toArrayBuffer, } from "@hpke/common";
+import { emitNotSupported } from "./utils/emitNotSupported.js";
+// b"sec"
+const LABEL_SEC = new Uint8Array([115, 101, 99]);
+export class ExporterContextImpl {
+    constructor(api, kdf, exporterSecret) {
+        Object.defineProperty(this, "_api", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "exporterSecret", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "_kdf", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this._api = api;
+        this._kdf = kdf;
+        this.exporterSecret = exporterSecret;
+    }
+    async seal(_data, _aad) {
+        return await emitNotSupported();
+    }
+    async open(_data, _aad) {
+        return await emitNotSupported();
+    }
+    async export(exporterContext, len) {
+        const rawExporterContext = toArrayBuffer(exporterContext);
+        if (rawExporterContext.byteLength > INPUT_LENGTH_LIMIT) {
+            throw new InvalidParamError("Too long exporter context");
+        }
+        try {
+            return await this._kdf.labeledExpand(this.exporterSecret, LABEL_SEC, new Uint8Array(rawExporterContext), len);
+        }
+        catch (e) {
+            throw new ExportError(e);
+        }
+    }
+}
+export class RecipientExporterContextImpl extends ExporterContextImpl {
+}
+export class SenderExporterContextImpl extends ExporterContextImpl {
+    constructor(api, kdf, exporterSecret, enc) {
+        super(api, kdf, exporterSecret);
+        Object.defineProperty(this, "enc", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.enc = enc;
+        return;
+    }
+}

package/node_modules/@hap/core/node_modules/@hpke/core/esm/src/interfaces/aeadParams.d.ts

@@ -0,0 +1,17 @@
+import type { AeadInterface } from "@hpke/common";
+/**
+ * The AEAD parameters for building a encryption context.
+ */
+export interface AeadParams {
+    /** The Aead indentifier. */
+    aead: AeadInterface;
+    /** A secret used for the secret export interface. */
+    exporterSecret: ArrayBuffer;
+    /** A secret key. */
+    key?: ArrayBuffer;
+    /** A base nonce. */
+    baseNonce?: Uint8Array;
+    /** A sequence number. */
+    seq?: number;
+}
+//# sourceMappingURL=aeadParams.d.ts.map

package/node_modules/@hap/core/node_modules/@hpke/core/esm/src/interfaces/aeadParams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aeadParams.d.ts","sourceRoot":"","sources":["../../../src/src/interfaces/aeadParams.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,4BAA4B;IAC5B,IAAI,EAAE,aAAa,CAAC;IAEpB,qDAAqD;IACrD,cAAc,EAAE,WAAW,CAAC;IAE5B,oBAAoB;IACpB,GAAG,CAAC,EAAE,WAAW,CAAC;IAElB,oBAAoB;IACpB,SAAS,CAAC,EAAE,UAAU,CAAC;IAEvB,yBAAyB;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd"}

package/node_modules/@hap/core/node_modules/@hpke/core/esm/src/interfaces/aeadParams.js

@@ -0,0 +1 @@
+export {};