@syldel/crypto-utils 1.0.2 → 1.1.0

package/LICENSE.MD

@@ -1,5 +1,5 @@
-Copyright (c) 2026, Syl-Studio Inc. c/o Syl. D.
-
-Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
-
+Copyright (c) 2026, Syl-Studio Inc. c/o Syl. D.
+
+Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
+
 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

package/README.md

@@ -1,60 +1,86 @@
 # @syldel/crypto-utils
 
-A lightweight, universal, and dependency-safe cryptographic toolkit for Node.js, Web browsers, and Mobile frameworks (Ionic/Capacitor).
+A robust, high-performance cryptographic toolkit for Node.js and NestJS applications. This package prioritizes security by leveraging Node's native crypto module (OpenSSL) for maximum protection of sensitive data and private keys.
 
-## 🚀 Features
- - **Universal Compatibility**: Works everywhere (Node, Angular, React, Ionic, NestJS).
+## 🚀 Key Features
+- **Native Security**: Built on top of Node.js crypto (OpenSSL) for hardware-accelerated encryption.
 
-- **Zero Node-only Dependencies**: Replaced native crypto and Buffer with cross-platform alternatives.
+- **AES-256-GCM**: Industry-standard authenticated encryption (AEAD) to ensure both confidentiality and data integrity.
 
-- **AES-256-GCM**: Secure authenticated encryption with integrity verification.
+- **Lightweight JWT**: Pure implementation for signing and verifying tokens without heavy dependencies.
 
-- **Pure JWT**: Sign and verify JSON Web Tokens without heavy libraries.
+- **Standardized Error Handling**: Harmonized error messages ("Decryption failed") for better security and predictable testing.
 
 ## 🛠 Usage
 
-### AES-GCM Encryption (Universal)
-Uses node-forge for authenticated encryption. It ensures that if the data is tampered with, decryption will fail.
+### AES-256-GCM (Authenticated Encryption)
+Designed for high-security environments. It automatically handles Initialization Vectors (IV) and Authentication Tags.
 
 ```ts
 import { AesGcmUtil } from '@syldel/crypto-utils';
 
-const key = "your-64-char-hex-key...";
-const message = "Hello World";
+const keyHex = "0123456789abcdef..."; // 64 hex characters (32 bytes)
+const message = "Sensitive data";
 
 // Encrypt
-const encrypted = AesGcmUtil.encrypt(message, key);
-console.log(encrypted); // { data: '...', iv: '...', tag: '...' }
+const encrypted = AesGcmUtil.encrypt(message, keyHex);
+// Returns: { data: '...', iv: '...', tag: '...' }
 
 // Decrypt
-const original = AesGcmUtil.decrypt(encrypted, key);
+try {
+  const original = AesGcmUtil.decrypt(encrypted, keyHex);
+} catch (error) {
+  // "Invalid key: …" if the key is missing, not hex or not 32 bytes (a config error)
+  // "Decryption failed" for anything wrong with the payload, or the wrong key
+}
 ```
 
-### JWT Utilities
-Lightweight JWT implementation using crypto-js.
+### Pure JWT Utilities
+A lightweight way to handle JWTs in your NestJS guards or services.
 
 ```ts
 import { PureJwtUtil } from '@syldel/crypto-utils';
 
-const secret = "my-super-secret";
-const payload = { sub: "123", role: "admin" };
+const secret = "your-secure-secret";
+const payload = { sub: "user_123", role: "admin" };
 
-// Sign
+// Sign a token
 const token = PureJwtUtil.sign(payload, secret);
 
-// Verify
+// Verify and decode
 try {
-  const decoded = PureJwtUtil.verify(token, secret);
+  const decoded = PureJwtUtil.verify<MyUserType>(token, secret);
 } catch (err) {
-  console.error("Invalid or expired token");
+  // Handles "Token expired" or "Invalid signature"
 }
 ```
 
-### 🔒 Security Principles
+## 🔒 Security & Performance
+
+- **Zero External Crypto Libs**: By using native Node.js APIs, this package minimizes the attack surface and dependency supply chain risks.
+
+- **Side-Channel Protection**: JWT signatures are compared with `crypto.timingSafeEqual`, in constant time.
+
+- **GCM Integrity**: Unlike AES-CTR or CBC, AES-GCM ensures that any single-bit modification to the encrypted data will be detected during decryption.
+
+### ⚠️ What is refused, and why
 
-- **Integrity First**: Using AES-GCM (via Node-Forge) ensures that any modification to the ciphertext or the tag results in a decryption error, preventing "padding oracle" and bit-flipping attacks.
+- `AesGcmUtil.decrypt` requires a full 16-byte tag and a 12-byte IV. Without this, Node accepts tags down to 4 bytes, and a random forged tag would pass with a 1 in 2^32 chance instead of 2^128.
+- Every hex input (key, data, IV, tag) is decoded strictly: a stray character fails instead of being silently cut off.
+- `decrypt` refuses a ciphertext above `AesGcmUtil.MAX_CIPHERTEXT_BYTES` (1 MiB) before decoding it.
+- A missing, non-hex or wrongly sized key throws `Invalid key: …`, never `Decryption failed`: it is a configuration error, and blaming the payload sent the search the wrong way. The message never quotes the key. Everything wrong with the payload stays a single generic `Decryption failed`, so an attacker learns nothing about which check failed.
+- `PureJwtUtil.verify` only accepts `alg: "HS256"`, a JSON object payload, a numeric `exp`, and the canonical base64url spelling of the signature.
+- Both `sign` and `verify` refuse an empty or missing secret: HMAC happily signs with an empty key, which anyone can guess.
+- `nbf`, `iat`, `aud` and `iss` are **not** checked: callers that rely on them must check them themselves.
 
-- **Isomorphic Helpers**: Custom EncodingHelper uses standard Web APIs (atob/btoa) to handle Base64URL without needing the Node.js Buffer object.
+
+## 🧪 Testing
+
+Full test suite with 100% coverage on core crypto logic.
+
+```bash
+npm run test
+```
 
 ## 👨‍💻 Développement
 

package/dist/aes-gcm.util.d.ts

@@ -4,6 +4,36 @@ export interface EncryptedData {
     tag: string;
 }
 export declare class AesGcmUtil {
-    static encrypt(text: string, keyHex: string): EncryptedData;
-    static decrypt(payload: EncryptedData, keyHex: string): string;
+    private static readonly ALGORITHM;
+    private static readonly KEY_BYTES;
+    private static readonly IV_BYTES;
+    private static readonly TAG_BYTES;
+    /**
+     * Largest ciphertext `decrypt` accepts, in bytes (1 MiB). Checked on the hex
+     * string before any decoding: without it, a payload of hundreds of MB was
+     * decoded in full before GCM refused it. Our largest real payload is an
+     * agent key, 66 characters.
+     */
+    static readonly MAX_CIPHERTEXT_BYTES: number;
+    /**
+     * Une clé invalide est une erreur de configuration de l'appelant, pas une
+     * entrée d'attaquant : elle se nomme au lieu de se fondre dans « Decryption
+     * failed », qui accusait le chiffré quand le secret manquait dans l'env.
+     * Le message ne cite jamais la clé.
+     */
+    private static validateKey;
+    /**
+     * Strict hex decoding. Buffer.from(hex) stops at the first invalid character
+     * without a word: a damaged field was read half-way, and a key followed by
+     * junk ("<64 hex>zz") was accepted as its first 32 bytes.
+     */
+    private static hexToBuffer;
+    /**
+     * Encrypts text using native Node.js crypto (AES-256-GCM)
+     */
+    static encrypt(text: string, key: Buffer | string): EncryptedData;
+    /**
+     * Decrypts a payload using native Node.js crypto (AES-256-GCM)
+     */
+    static decrypt(payload: EncryptedData, key: Buffer | string): string;
 }

package/dist/aes-gcm.util.js

@@ -1,41 +1,137 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AesGcmUtil = void 0;
-const node_forge_1 = __importDefault(require("node-forge"));
+const crypto = __importStar(require("crypto"));
 class AesGcmUtil {
-    static encrypt(text, keyHex) {
-        const key = node_forge_1.default.util.hexToBytes(keyHex);
-        const iv = node_forge_1.default.random.getBytesSync(12); // IV standard GCM = 12 octets
-        const cipher = node_forge_1.default.cipher.createCipher('AES-GCM', key);
-        cipher.start({ iv: iv });
-        cipher.update(node_forge_1.default.util.createBuffer(node_forge_1.default.util.encodeUtf8(text)));
-        cipher.finish();
-        return {
-            data: node_forge_1.default.util.bytesToHex(cipher.output.getBytes()),
-            iv: node_forge_1.default.util.bytesToHex(iv),
-            tag: node_forge_1.default.util.bytesToHex(cipher.mode.tag.getBytes()),
-        };
+    /**
+     * Une clé invalide est une erreur de configuration de l'appelant, pas une
+     * entrée d'attaquant : elle se nomme au lieu de se fondre dans « Decryption
+     * failed », qui accusait le chiffré quand le secret manquait dans l'env.
+     * Le message ne cite jamais la clé.
+     */
+    static validateKey(key) {
+        if (key === undefined || key === null || key.length === 0) {
+            throw new Error('Invalid key: missing or empty (is the secret configured?)');
+        }
+        let encryptionKey;
+        try {
+            encryptionKey = typeof key === 'string' ? this.hexToBuffer(key) : key;
+        }
+        catch {
+            throw new Error('Invalid key: not a hex string');
+        }
+        if (!Buffer.isBuffer(encryptionKey) || encryptionKey.length !== this.KEY_BYTES) {
+            throw new Error('Invalid key: must be 32 bytes (64 hex characters)');
+        }
+        return encryptionKey;
     }
-    static decrypt(payload, keyHex) {
-        const key = node_forge_1.default.util.hexToBytes(keyHex);
-        const iv = node_forge_1.default.util.hexToBytes(payload.iv);
-        const tag = node_forge_1.default.util.hexToBytes(payload.tag);
-        const ciphertext = node_forge_1.default.util.hexToBytes(payload.data);
-        const decipher = node_forge_1.default.cipher.createDecipher('AES-GCM', key);
-        decipher.start({
-            iv: iv,
-            tag: node_forge_1.default.util.createBuffer(tag),
-        });
-        decipher.update(node_forge_1.default.util.createBuffer(ciphertext));
-        // finish() renvoie 'false' si le tag est invalide (données corrompues ou mauvaise clé)
-        const authenticated = decipher.finish();
-        if (!authenticated) {
-            throw new Error('Decryption failed: authentication failed (bad key or corrupted data)');
-        }
-        return node_forge_1.default.util.decodeUtf8(decipher.output.getBytes());
+    /**
+     * Strict hex decoding. Buffer.from(hex) stops at the first invalid character
+     * without a word: a damaged field was read half-way, and a key followed by
+     * junk ("<64 hex>zz") was accepted as its first 32 bytes.
+     */
+    static hexToBuffer(hex, expectedBytes) {
+        if (typeof hex !== 'string' || hex.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex)) {
+            throw new Error('Invalid hex string');
+        }
+        const buffer = Buffer.from(hex, 'hex');
+        if (expectedBytes !== undefined && buffer.length !== expectedBytes) {
+            throw new Error(`Expected ${expectedBytes} bytes, got ${buffer.length}`);
+        }
+        return buffer;
+    }
+    /**
+     * Encrypts text using native Node.js crypto (AES-256-GCM)
+     */
+    static encrypt(text, key) {
+        const encryptionKey = this.validateKey(key);
+        try {
+            const iv = crypto.randomBytes(this.IV_BYTES);
+            const cipher = crypto.createCipheriv(this.ALGORITHM, encryptionKey, iv, {
+                authTagLength: this.TAG_BYTES,
+            });
+            let encrypted = cipher.update(text, 'utf8', 'hex');
+            encrypted += cipher.final('hex');
+            return {
+                data: encrypted,
+                iv: iv.toString('hex'),
+                tag: cipher.getAuthTag().toString('hex'),
+            };
+        }
+        catch {
+            throw new Error('Encryption failed');
+        }
+    }
+    /**
+     * Decrypts a payload using native Node.js crypto (AES-256-GCM)
+     */
+    static decrypt(payload, key) {
+        const encryptionKey = this.validateKey(key);
+        try {
+            if (typeof payload.data !== 'string' || payload.data.length > 2 * this.MAX_CIPHERTEXT_BYTES) {
+                throw new Error('Ciphertext missing or above the size limit');
+            }
+            const iv = this.hexToBuffer(payload.iv, this.IV_BYTES);
+            const tag = this.hexToBuffer(payload.tag, this.TAG_BYTES);
+            const data = this.hexToBuffer(payload.data);
+            // Sans `authTagLength`, Node accepte un tag de 4 à 16 octets : mesuré sur
+            // la 1.0.3, un tag tronqué à 4 octets déchiffrait, et un tag forgé au
+            // hasard passait avec une chance sur 2^32 au lieu de 2^128.
+            const decipher = crypto.createDecipheriv(this.ALGORITHM, encryptionKey, iv, {
+                authTagLength: this.TAG_BYTES,
+            });
+            decipher.setAuthTag(tag);
+            let decrypted = decipher.update(data, undefined, 'utf8');
+            decrypted += decipher.final('utf8');
+            return decrypted;
+        }
+        catch {
+            throw new Error('Decryption failed');
+        }
     }
 }
 exports.AesGcmUtil = AesGcmUtil;
+AesGcmUtil.ALGORITHM = 'aes-256-gcm';
+AesGcmUtil.KEY_BYTES = 32;
+AesGcmUtil.IV_BYTES = 12;
+AesGcmUtil.TAG_BYTES = 16;
+/**
+ * Largest ciphertext `decrypt` accepts, in bytes (1 MiB). Checked on the hex
+ * string before any decoding: without it, a payload of hundreds of MB was
+ * decoded in full before GCM refused it. Our largest real payload is an
+ * agent key, 66 characters.
+ */
+AesGcmUtil.MAX_CIPHERTEXT_BYTES = 1024 * 1024;

package/dist/jwt.util.d.ts

@@ -1,4 +1,10 @@
 export declare class PureJwtUtil {
-    static sign(payload: Record<string, any>, secret: string): string;
+    /**
+     * Verifies a JWT's signature and expiration, then returns the decoded payload.
+     */
     static verify<T extends object>(token: string, secret: string): T;
+    /**
+     * Signs a payload and returns a compact JWT string.
+     */
+    static sign(payload: Record<string, any>, secret: string): string;
 }

package/dist/jwt.util.js

@@ -1,34 +1,117 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PureJwtUtil = void 0;
-const crypto_js_1 = __importDefault(require("crypto-js"));
-const encoding_helper_1 = require("./encoding.helper");
+const crypto = __importStar(require("crypto"));
 class PureJwtUtil {
-    static sign(payload, secret) {
-        const header = { alg: 'HS256', typ: 'JWT' };
-        const encodedHeader = encoding_helper_1.EncodingHelper.objToBase64Url(header);
-        const encodedPayload = encoding_helper_1.EncodingHelper.objToBase64Url(payload);
-        const signature = crypto_js_1.default.HmacSHA256(`${encodedHeader}.${encodedPayload}`, secret);
-        // Conversion du WordArray CryptoJS en Base64URL
-        const encodedSignature = encoding_helper_1.EncodingHelper.toBase64Url(signature.toString(crypto_js_1.default.enc.Base64));
-        return `${encodedHeader}.${encodedPayload}.${encodedSignature}`;
-    }
+    /**
+     * Verifies a JWT's signature and expiration, then returns the decoded payload.
+     */
     static verify(token, secret) {
-        const [headerB64, payloadB64, signatureB64] = token.split('.');
-        if (!signatureB64)
+        assertSecret(secret);
+        const parts = token.split('.');
+        if (parts.length !== 3)
             throw new Error('Invalid token format');
-        const expectedSignature = encoding_helper_1.EncodingHelper.toBase64Url(crypto_js_1.default.HmacSHA256(`${headerB64}.${payloadB64}`, secret).toString(crypto_js_1.default.enc.Base64));
-        if (signatureB64 !== expectedSignature) {
+        const [headerB64, payloadB64, signatureB64] = parts;
+        const dataToVerify = `${headerB64}.${payloadB64}`;
+        const expected = crypto.createHmac('sha256', secret).update(dataToVerify).digest();
+        const received = Buffer.from(signatureB64, 'base64url');
+        // Comparaison en temps constant : `!==` s'arrête au premier caractère
+        // différent, et le temps de réponse renseigne sur la signature attendue.
+        // timingSafeEqual lance sur deux longueurs différentes, d'où le test avant.
+        // Le décodage base64url est tolérant : plusieurs écritures donnent les mêmes
+        // octets. Seule la forme canonique est admise, comme avec l'ancien `!==`.
+        if (received.toString('base64url') !== signatureB64 ||
+            received.length !== expected.length ||
+            !crypto.timingSafeEqual(received, expected)) {
             throw new Error('Invalid signature');
         }
-        const payload = JSON.parse(encoding_helper_1.EncodingHelper.fromBase64(payloadB64.replace(/-/g, '+').replace(/_/g, '/')));
-        if (payload.exp && Date.now() >= payload.exp * 1000) {
-            throw new Error('Token expired');
+        // L'en-tête n'était jamais lu : un jeton annonçant « none » ou un autre
+        // algorithme passait du moment que sa signature HS256 était juste.
+        const header = parseJsonObject(headerB64, 'Invalid token header');
+        if (header.alg !== 'HS256') {
+            throw new Error('Unsupported algorithm');
+        }
+        const payload = parseJsonObject(payloadB64, 'Invalid token payload');
+        // Un `exp` non numérique était ignoré : le jeton n'expirait jamais.
+        if (payload.exp !== undefined) {
+            if (typeof payload.exp !== 'number' || !Number.isFinite(payload.exp)) {
+                throw new Error('Invalid token payload');
+            }
+            if (Date.now() >= payload.exp * 1000) {
+                throw new Error('Token expired');
+            }
         }
         return payload;
     }
+    /**
+     * Signs a payload and returns a compact JWT string.
+     */
+    static sign(payload, secret) {
+        assertSecret(secret);
+        const header = { alg: 'HS256', typ: 'JWT' };
+        const encode = (obj) => Buffer.from(JSON.stringify(obj)).toString('base64url');
+        const encodedHeader = encode(header);
+        const encodedPayload = encode(payload);
+        const signature = crypto
+            .createHmac('sha256', secret)
+            .update(`${encodedHeader}.${encodedPayload}`)
+            .digest('base64url');
+        return `${encodedHeader}.${encodedPayload}.${signature}`;
+    }
 }
 exports.PureJwtUtil = PureJwtUtil;
+/**
+ * createHmac signe avec une chaîne vide (mesuré sur le bot le 2026-10-06) : la
+ * signature attendue devient calculable par quiconque devine le secret vide.
+ */
+function assertSecret(secret) {
+    if (typeof secret !== 'string' || secret.length === 0) {
+        throw new Error('Invalid secret: a non-empty string is required');
+    }
+}
+function parseJsonObject(segment, error) {
+    let value;
+    try {
+        value = JSON.parse(Buffer.from(segment, 'base64url').toString('utf8'));
+    }
+    catch {
+        throw new Error(error);
+    }
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new Error(error);
+    }
+    return value;
+}

package/package.json

@@ -1,55 +1,58 @@
-{
-  "name": "@syldel/crypto-utils",
-  "version": "1.0.2",
-  "description": "Lightweight JWT and AES-256-GCM utilities",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "files": [
-    "dist"
-  ],
-  "scripts": {
-    "lint": "eslint .",
-    "lint:fix": "eslint . --fix",
-    "clean": "rm -rf dist",
-    "build": "npm run lint && npm run clean && tsc -p tsconfig.json",
-    "test": "jest",
-    "test:watch": "jest --watch",
-    "prepublishOnly": "npm run build",
-    "release": "npm run build && npm version patch && npm publish"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "keywords": [
-    "jwt",
-    "aes",
-    "crypto",
-    "security",
-    "nestjs"
-  ],
-  "author": "Syl. D.",
-  "license": "ISC",
-  "devDependencies": {
-    "@eslint/js": "^10.0.1",
-    "@types/crypto-js": "^4.2.2",
-    "@types/jest": "^30.0.0",
-    "@types/node-forge": "^1.3.14",
-    "eslint": "^10.0.1",
-    "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-jsonc": "^3.0.0",
-    "eslint-plugin-prettier": "^5.5.5",
-    "jest": "^30.2.0",
-    "jsonc-eslint-parser": "^3.1.0",
-    "prettier": "^3.8.1",
-    "ts-jest": "^29.4.6",
-    "typescript": "^5.9.3",
-    "typescript-eslint": "^8.56.0"
-  },
-  "overrides": {
-    "minimatch": "^10.2.1"
-  },
-  "dependencies": {
-    "crypto-js": "^4.2.0",
-    "node-forge": "^1.3.3"
-  }
-}
+{
+  "name": "@syldel/crypto-utils",
+  "version": "1.1.0",
+  "description": "Lightweight JWT and AES-256-GCM utilities",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Syldel/crypto-utils.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Syldel/crypto-utils/issues"
+  },
+  "homepage": "https://github.com/Syldel/crypto-utils#readme",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "clean": "rm -rf dist",
+    "build": "npm run lint && npm run clean && tsc -p tsconfig.json",
+    "test": "jest",
+    "test:watch": "jest --watch",
+    "prepublishOnly": "npm run build",
+    "release": "npm run build && npm version patch && npm publish"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "jwt",
+    "aes",
+    "crypto",
+    "security",
+    "nestjs"
+  ],
+  "author": "Syl. D.",
+  "license": "ISC",
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^20.19.43",
+    "eslint": "^10.0.1",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-jsonc": "^3.0.0",
+    "eslint-plugin-prettier": "^5.5.5",
+    "jest": "^30.2.0",
+    "jsonc-eslint-parser": "^3.1.0",
+    "prettier": "^3.8.1",
+    "ts-jest": "^29.4.6",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.56.0"
+  },
+  "overrides": {
+    "minimatch": "^10.2.1"
+  }
+}

package/dist/encoding.helper.d.ts

@@ -1,9 +0,0 @@
-/**
- * Encode et décode en Base64URL sans dépendance à Buffer (Universal JS)
- */
-export declare const EncodingHelper: {
-    toBase64: (str: string) => string;
-    fromBase64: (base64: string) => string;
-    toBase64Url: (base64: string) => string;
-    objToBase64Url: (obj: object) => string;
-};

package/dist/encoding.helper.js

@@ -1,25 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.EncodingHelper = void 0;
-/**
- * Encode et décode en Base64URL sans dépendance à Buffer (Universal JS)
- */
-exports.EncodingHelper = {
-    // Texte -> Base64
-    toBase64: (str) => {
-        return btoa(unescape(encodeURIComponent(str)));
-    },
-    // Base64 -> Texte
-    fromBase64: (base64) => {
-        return decodeURIComponent(escape(atob(base64)));
-    },
-    // Base64 -> Base64URL (pour JWT)
-    toBase64Url: (base64) => {
-        return base64.replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
-    },
-    // Object -> Base64URL
-    objToBase64Url: (obj) => {
-        const str = JSON.stringify(obj);
-        return exports.EncodingHelper.toBase64Url(exports.EncodingHelper.toBase64(str));
-    },
-};