@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/data/blobs/encryptedBlobEnvelope.js

@@ -0,0 +1,229 @@
+import { base64ToBytes, bytesToBase64 } from "../../internal/encoding/index.js";
+import { isPlainObject } from "../../internal/validators/isPlainObject.js";
+import { readExactBlobBytes, } from "../blobContracts.js";
+import { readRecordSafeByteLength, readRecordSafePositiveInteger, readRecordString, } from "../recordReaders.js";
+export const ENCRYPTED_BLOB_STORE_FORMAT = "tearleads.local-blob-store.encrypted";
+export const ENCRYPTED_BLOB_STORE_VERSION = 2;
+export const ENCRYPTED_BLOB_CHUNK_SIZE = 5 * 1024 * 1024;
+export const AES_GCM_TAG_BYTES = 16;
+const AES_GCM_IV_BYTES = 12;
+const DEFAULT_KDF_ITERATIONS = 310_000;
+const MAX_HEADER_BYTES = 64 * 1024;
+const MAGIC_BYTES = new TextEncoder().encode("tearleads.local-blob-store.encrypted.v2");
+const HEADER_LENGTH_BYTES = 4;
+const TEXT_DECODER = new TextDecoder("utf-8", { fatal: true });
+const TEXT_ENCODER = new TextEncoder();
+export function asBlobBytes(bytes) {
+    if (!(bytes.buffer instanceof ArrayBuffer)) {
+        throw new Error("Encrypted blob store bytes must be ArrayBuffer-backed.");
+    }
+    return new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+}
+function readRecord(value, label) {
+    if (!isPlainObject(value)) {
+        throw new Error(`${label} must be an object.`);
+    }
+    return value;
+}
+export function readBase64Bytes(value, key, label) {
+    const encoded = readRecordString(value, key, label);
+    try {
+        return asBlobBytes(base64ToBytes(encoded));
+    }
+    catch {
+        throw new Error(`${label}.${key} must be base64.`);
+    }
+}
+export function normalizeCipher(cipher) {
+    if (cipher === undefined || cipher === "aes-256-gcm") {
+        return "aes-256-gcm";
+    }
+    throw new Error(`Unsupported encrypted blob store cipher: ${cipher}`);
+}
+export function normalizeKdfIterations(iterations) {
+    if (iterations === undefined) {
+        return DEFAULT_KDF_ITERATIONS;
+    }
+    if (!Number.isSafeInteger(iterations) || iterations <= 0) {
+        throw new Error("Encrypted blob store KDF iterations must be a positive integer.");
+    }
+    return iterations;
+}
+export function assertNamespace(namespace) {
+    if (namespace.length === 0) {
+        throw new Error("Encrypted blob store namespace must be non-empty.");
+    }
+}
+export function createAesGcmIv() {
+    return crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES));
+}
+export function createKeyDerivationEnvelope(input) {
+    const salt = TEXT_ENCODER.encode(`tearleads.local-opfs-blob-store.v2.${input.cipher}.${input.namespace}`);
+    return {
+        name: "pbkdf2-sha256",
+        iterations: input.iterations,
+        salt: bytesToBase64(salt),
+    };
+}
+function readKeyDerivationEnvelope(value) {
+    if (value === null || value === undefined) {
+        return null;
+    }
+    const record = readRecord(value, "Encrypted blob store keyDerivation");
+    if (readRecordString(record, "name", "Encrypted blob store keyDerivation") !==
+        "pbkdf2-sha256") {
+        throw new Error("Encrypted blob store key derivation is unsupported.");
+    }
+    if (readBase64Bytes(record, "salt", "Encrypted blob store keyDerivation")
+        .byteLength === 0) {
+        throw new Error("Encrypted blob store key derivation salt is empty.");
+    }
+    return {
+        name: "pbkdf2-sha256",
+        iterations: readRecordSafePositiveInteger(record, "iterations", "Encrypted blob store keyDerivation"),
+        salt: readRecordString(record, "salt", "Encrypted blob store keyDerivation"),
+    };
+}
+function parseHeader(headerBytes) {
+    let parsed;
+    try {
+        parsed = JSON.parse(TEXT_DECODER.decode(headerBytes));
+    }
+    catch {
+        throw new Error("Encrypted blob store header is invalid JSON.");
+    }
+    const label = "Encrypted blob store header";
+    const record = readRecord(parsed, label);
+    if (readRecordString(record, "format", label) !== ENCRYPTED_BLOB_STORE_FORMAT) {
+        throw new Error("Encrypted blob store payload format is invalid.");
+    }
+    if (readRecordSafePositiveInteger(record, "version", label) !== 2) {
+        throw new Error("Encrypted blob store payload version is invalid.");
+    }
+    const chunkSize = readRecordSafePositiveInteger(record, "chunkSize", label);
+    if (chunkSize !== ENCRYPTED_BLOB_CHUNK_SIZE) {
+        throw new Error("Encrypted blob store payload chunk size is invalid.");
+    }
+    const plaintextByteLength = readRecordSafeByteLength(record, "plaintextByteLength", label);
+    const chunkCount = readRecordSafePositiveInteger(record, "chunkCount", label);
+    if (chunkCount !== getChunkCount(plaintextByteLength)) {
+        throw new Error("Encrypted blob store payload chunk count is invalid.");
+    }
+    const iv = readBase64Bytes(record, "iv", label);
+    if (iv.byteLength !== AES_GCM_IV_BYTES) {
+        throw new Error("Encrypted blob store payload IV is invalid.");
+    }
+    const { keyDerivation } = record;
+    return {
+        envelope: {
+            chunkCount,
+            chunkSize,
+            cipher: normalizeCipher(readRecordString(record, "cipher", label)),
+            format: ENCRYPTED_BLOB_STORE_FORMAT,
+            iv: readRecordString(record, "iv", label),
+            keyDerivation: readKeyDerivationEnvelope(keyDerivation),
+            plaintextByteLength,
+            version: ENCRYPTED_BLOB_STORE_VERSION,
+        },
+        iv,
+    };
+}
+export function getChunkCount(plaintextByteLength) {
+    if (!Number.isSafeInteger(plaintextByteLength) || plaintextByteLength < 0) {
+        throw new Error("Encrypted blob store byte length is invalid.");
+    }
+    return Math.max(1, Math.ceil(plaintextByteLength / ENCRYPTED_BLOB_CHUNK_SIZE));
+}
+export function getChunkPlaintextByteLength(plaintextByteLength, chunkIndex) {
+    const chunkCount = getChunkCount(plaintextByteLength);
+    if (!Number.isSafeInteger(chunkIndex) ||
+        chunkIndex < 0 ||
+        chunkIndex >= chunkCount) {
+        throw new Error("Encrypted blob store chunk index is invalid.");
+    }
+    if (chunkIndex < chunkCount - 1) {
+        return ENCRYPTED_BLOB_CHUNK_SIZE;
+    }
+    return plaintextByteLength - chunkIndex * ENCRYPTED_BLOB_CHUNK_SIZE;
+}
+export function serializeEncryptedBlobEnvelope(envelope) {
+    const headerBytes = TEXT_ENCODER.encode(JSON.stringify(envelope));
+    if (headerBytes.byteLength > MAX_HEADER_BYTES) {
+        throw new Error("Encrypted blob store header is too large.");
+    }
+    const prefixBytes = new Uint8Array(MAGIC_BYTES.byteLength + HEADER_LENGTH_BYTES + headerBytes.byteLength);
+    prefixBytes.set(MAGIC_BYTES);
+    new DataView(prefixBytes.buffer).setUint32(MAGIC_BYTES.byteLength, headerBytes.byteLength);
+    prefixBytes.set(headerBytes, MAGIC_BYTES.byteLength + HEADER_LENGTH_BYTES);
+    return { headerBytes, prefixBytes };
+}
+function equalBytes(left, right) {
+    return (left.byteLength === right.byteLength && left.every((v, i) => v === right[i]));
+}
+export async function readEncryptedBlobEnvelope(source) {
+    const fixedPrefixLength = MAGIC_BYTES.byteLength + HEADER_LENGTH_BYTES;
+    if (source.byteLength < fixedPrefixLength) {
+        throw new Error("Encrypted blob store payload is too short.");
+    }
+    const fixedPrefix = await readExactBlobBytes(source, 0, fixedPrefixLength);
+    if (!equalBytes(fixedPrefix.subarray(0, MAGIC_BYTES.byteLength), MAGIC_BYTES)) {
+        throw new Error("Encrypted blob store payload format is invalid.");
+    }
+    const headerByteLength = new DataView(fixedPrefix.buffer, fixedPrefix.byteOffset, fixedPrefix.byteLength).getUint32(MAGIC_BYTES.byteLength);
+    if (headerByteLength === 0 || headerByteLength > MAX_HEADER_BYTES) {
+        throw new Error("Encrypted blob store header length is invalid.");
+    }
+    const prefixByteLength = fixedPrefixLength + headerByteLength;
+    if (source.byteLength < prefixByteLength) {
+        throw new Error("Encrypted blob store payload is truncated.");
+    }
+    const headerBytes = await readExactBlobBytes(source, fixedPrefixLength, headerByteLength);
+    const { envelope, iv } = parseHeader(headerBytes);
+    const encryptedByteLength = prefixByteLength +
+        envelope.plaintextByteLength +
+        envelope.chunkCount * AES_GCM_TAG_BYTES;
+    if (!Number.isSafeInteger(encryptedByteLength) ||
+        source.byteLength !== encryptedByteLength) {
+        throw new Error("Encrypted blob store payload length is invalid.");
+    }
+    return {
+        encryptedByteLength,
+        envelope,
+        headerBytes,
+        iv,
+        prefixByteLength,
+    };
+}
+function writeLengthPrefixedText(target, offset, value) {
+    const bytes = TEXT_ENCODER.encode(value);
+    new DataView(target.buffer).setUint32(offset, bytes.byteLength);
+    target.set(bytes, offset + 4);
+    return offset + 4 + bytes.byteLength;
+}
+export function chunkAdditionalData(input) {
+    const namespaceBytes = TEXT_ENCODER.encode(input.namespace);
+    const storageKeyBytes = TEXT_ENCODER.encode(input.storageKey);
+    const bytes = new Uint8Array(4 +
+        namespaceBytes.byteLength +
+        4 +
+        storageKeyBytes.byteLength +
+        4 +
+        input.headerBytes.byteLength);
+    let offset = writeLengthPrefixedText(bytes, 0, input.namespace);
+    offset = writeLengthPrefixedText(bytes, offset, input.storageKey);
+    new DataView(bytes.buffer).setUint32(offset, input.chunkIndex);
+    bytes.set(input.headerBytes, offset + 4);
+    return bytes;
+}
+export function deriveChunkIv(baseIv, chunkIndex) {
+    if (!Number.isSafeInteger(chunkIndex) ||
+        chunkIndex < 0 ||
+        chunkIndex > 0xffff_ffff) {
+        throw new Error("Encrypted blob store chunk index exceeds the IV domain.");
+    }
+    const iv = baseIv.slice();
+    const view = new DataView(iv.buffer, iv.byteOffset, iv.byteLength);
+    view.setUint32(8, view.getUint32(8) ^ chunkIndex);
+    return iv;
+}
+//# sourceMappingURL=encryptedBlobEnvelope.js.map

package/data/blobs/encryptedBlobEnvelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryptedBlobEnvelope.js","sourceRoot":"","sources":["encryptedBlobEnvelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAGL,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AA6B1B,MAAM,CAAC,MAAM,2BAA2B,GACtC,sCAAsC,CAAC;AACzC,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAC9C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACzD,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,sBAAsB,GAAG,OAAO,CAAC;AACvC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAC1C,yCAAyC,CAC1C,CAAC;AACF,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,YAAY,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/D,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC;AAEvC,MAAM,UAAU,WAAW,CAAC,KAAiB;IAC3C,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,WAAW,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa;IAC/C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,KAA8B,EAC9B,GAAW,EACX,KAAa;IAEb,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,GAAG,kBAAkB,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,MAA0B;IAE1B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QACrD,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,UAA8B;IACnE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAI3C;IACC,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAC9B,sCAAsC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CACxE,CAAC;IACF,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAc;IAEd,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IACvE,IACE,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,oCAAoC,CAAC;QACtE,eAAe,EACf,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IACE,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,oCAAoC,CAAC;SAClE,UAAU,KAAK,CAAC,EACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,6BAA6B,CACvC,MAAM,EACN,YAAY,EACZ,oCAAoC,CACrC;QACD,IAAI,EAAE,gBAAgB,CACpB,MAAM,EACN,MAAM,EACN,oCAAoC,CACrC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,WAAsB;IAIzC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,6BAA6B,CAAC;IAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzC,IACE,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,2BAA2B,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,6BAA6B,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,SAAS,GAAG,6BAA6B,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAC5E,IAAI,SAAS,KAAK,yBAAyB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,mBAAmB,GAAG,wBAAwB,CAClD,MAAM,EACN,qBAAqB,EACrB,KAAK,CACN,CAAC;IACF,MAAM,UAAU,GAAG,6BAA6B,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IAC9E,IAAI,UAAU,KAAK,aAAa,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,EAAE,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IACjC,OAAO;QACL,QAAQ,EAAE;YACR,UAAU;YACV,SAAS;YACT,MAAM,EAAE,eAAe,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAClE,MAAM,EAAE,2BAA2B;YACnC,EAAE,EAAE,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC;YACzC,aAAa,EAAE,yBAAyB,CAAC,aAAa,CAAC;YACvD,mBAAmB;YACnB,OAAO,EAAE,4BAA4B;SACtC;QACD,EAAE;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,mBAA2B;IACvD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CACb,CAAC,EACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,GAAG,yBAAyB,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,mBAA2B,EAC3B,UAAkB;IAElB,MAAM,UAAU,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAC;IACtD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;QACjC,UAAU,GAAG,CAAC;QACd,UAAU,IAAI,UAAU,EACxB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,UAAU,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,OAAO,mBAAmB,GAAG,UAAU,GAAG,yBAAyB,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,QAA+B;IAE/B,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClE,IAAI,WAAW,CAAC,UAAU,GAAG,gBAAgB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,UAAU,CAChC,WAAW,CAAC,UAAU,GAAG,mBAAmB,GAAG,WAAW,CAAC,UAAU,CACtE,CAAC;IACF,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7B,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,SAAS,CACxC,WAAW,CAAC,UAAU,EACtB,WAAW,CAAC,UAAU,CACvB,CAAC;IACF,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,UAAU,GAAG,mBAAmB,CAAC,CAAC;IAC3E,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,IAAgB,EAAE,KAAiB;IACrD,OAAO,CACL,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAsB;IAEtB,MAAM,iBAAiB,GAAG,WAAW,CAAC,UAAU,GAAG,mBAAmB,CAAC;IACvE,IAAI,MAAM,CAAC,UAAU,GAAG,iBAAiB,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC3E,IACE,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAI,QAAQ,CACnC,WAAW,CAAC,MAAM,EAClB,WAAW,CAAC,UAAU,EACtB,WAAW,CAAC,UAAU,CACvB,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,gBAAgB,KAAK,CAAC,IAAI,gBAAgB,GAAG,gBAAgB,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,gBAAgB,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;IAC9D,IAAI,MAAM,CAAC,UAAU,GAAG,gBAAgB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAC1C,MAAM,EACN,iBAAiB,EACjB,gBAAgB,CACjB,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,mBAAmB,GACvB,gBAAgB;QAChB,QAAQ,CAAC,mBAAmB;QAC5B,QAAQ,CAAC,UAAU,GAAG,iBAAiB,CAAC;IAC1C,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC;QAC1C,MAAM,CAAC,UAAU,KAAK,mBAAmB,EACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,mBAAmB;QACnB,QAAQ;QACR,WAAW;QACX,EAAE;QACF,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAkB,EAClB,MAAc,EACd,KAAa;IAEb,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAKnC;IACC,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAI,UAAU,CAC1B,CAAC;QACC,cAAc,CAAC,UAAU;QACzB,CAAC;QACD,eAAe,CAAC,UAAU;QAC1B,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,UAAU,CAC/B,CAAC;IACF,IAAI,MAAM,GAAG,uBAAuB,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,MAAM,GAAG,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/D,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,MAAiB,EACjB,UAAkB;IAElB,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;QACjC,UAAU,GAAG,CAAC;QACd,UAAU,GAAG,WAAW,EACxB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;IACnE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;IAClD,OAAO,EAAE,CAAC;AACZ,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport { isPlainObject } from \"@tearleads/validators/isPlainObject\";\nimport {\n  type BlobByteSource,\n  type BlobBytes,\n  readExactBlobBytes,\n} from \"../blobContracts\";\nimport {\n  readRecordSafeByteLength,\n  readRecordSafePositiveInteger,\n  readRecordString,\n} from \"../recordReaders\";\n\nexport type EncryptedBlobStoreCipher = \"aes-256-gcm\";\n\nexport interface KeyDerivationEnvelope {\n  name: \"pbkdf2-sha256\";\n  iterations: number;\n  salt: string;\n}\n\nexport interface EncryptedBlobEnvelope {\n  chunkCount: number;\n  chunkSize: number;\n  cipher: EncryptedBlobStoreCipher;\n  format: typeof ENCRYPTED_BLOB_STORE_FORMAT;\n  iv: string;\n  keyDerivation: KeyDerivationEnvelope | null;\n  plaintextByteLength: number;\n  version: typeof ENCRYPTED_BLOB_STORE_VERSION;\n}\n\nexport interface ParsedEncryptedBlobEnvelope {\n  encryptedByteLength: number;\n  envelope: EncryptedBlobEnvelope;\n  headerBytes: BlobBytes;\n  iv: BlobBytes;\n  prefixByteLength: number;\n}\n\nexport const ENCRYPTED_BLOB_STORE_FORMAT =\n  \"tearleads.local-blob-store.encrypted\";\nexport const ENCRYPTED_BLOB_STORE_VERSION = 2;\nexport const ENCRYPTED_BLOB_CHUNK_SIZE = 5 * 1024 * 1024;\nexport const AES_GCM_TAG_BYTES = 16;\n\nconst AES_GCM_IV_BYTES = 12;\nconst DEFAULT_KDF_ITERATIONS = 310_000;\nconst MAX_HEADER_BYTES = 64 * 1024;\nconst MAGIC_BYTES = new TextEncoder().encode(\n  \"tearleads.local-blob-store.encrypted.v2\",\n);\nconst HEADER_LENGTH_BYTES = 4;\nconst TEXT_DECODER = new TextDecoder(\"utf-8\", { fatal: true });\nconst TEXT_ENCODER = new TextEncoder();\n\nexport function asBlobBytes(bytes: Uint8Array): BlobBytes {\n  if (!(bytes.buffer instanceof ArrayBuffer)) {\n    throw new Error(\"Encrypted blob store bytes must be ArrayBuffer-backed.\");\n  }\n  return new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength);\n}\n\nfunction readRecord(value: unknown, label: string): Record<string, unknown> {\n  if (!isPlainObject(value)) {\n    throw new Error(`${label} must be an object.`);\n  }\n  return value;\n}\n\nexport function readBase64Bytes(\n  value: Record<string, unknown>,\n  key: string,\n  label: string,\n): BlobBytes {\n  const encoded = readRecordString(value, key, label);\n  try {\n    return asBlobBytes(base64ToBytes(encoded));\n  } catch {\n    throw new Error(`${label}.${key} must be base64.`);\n  }\n}\n\nexport function normalizeCipher(\n  cipher: string | undefined,\n): EncryptedBlobStoreCipher {\n  if (cipher === undefined || cipher === \"aes-256-gcm\") {\n    return \"aes-256-gcm\";\n  }\n  throw new Error(`Unsupported encrypted blob store cipher: ${cipher}`);\n}\n\nexport function normalizeKdfIterations(iterations: number | undefined): number {\n  if (iterations === undefined) {\n    return DEFAULT_KDF_ITERATIONS;\n  }\n  if (!Number.isSafeInteger(iterations) || iterations <= 0) {\n    throw new Error(\n      \"Encrypted blob store KDF iterations must be a positive integer.\",\n    );\n  }\n  return iterations;\n}\n\nexport function assertNamespace(namespace: string): void {\n  if (namespace.length === 0) {\n    throw new Error(\"Encrypted blob store namespace must be non-empty.\");\n  }\n}\n\nexport function createAesGcmIv(): BlobBytes {\n  return crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES));\n}\n\nexport function createKeyDerivationEnvelope(input: {\n  cipher: EncryptedBlobStoreCipher;\n  iterations: number;\n  namespace: string;\n}): KeyDerivationEnvelope {\n  const salt = TEXT_ENCODER.encode(\n    `tearleads.local-opfs-blob-store.v2.${input.cipher}.${input.namespace}`,\n  );\n  return {\n    name: \"pbkdf2-sha256\",\n    iterations: input.iterations,\n    salt: bytesToBase64(salt),\n  };\n}\n\nfunction readKeyDerivationEnvelope(\n  value: unknown,\n): KeyDerivationEnvelope | null {\n  if (value === null || value === undefined) {\n    return null;\n  }\n  const record = readRecord(value, \"Encrypted blob store keyDerivation\");\n  if (\n    readRecordString(record, \"name\", \"Encrypted blob store keyDerivation\") !==\n    \"pbkdf2-sha256\"\n  ) {\n    throw new Error(\"Encrypted blob store key derivation is unsupported.\");\n  }\n  if (\n    readBase64Bytes(record, \"salt\", \"Encrypted blob store keyDerivation\")\n      .byteLength === 0\n  ) {\n    throw new Error(\"Encrypted blob store key derivation salt is empty.\");\n  }\n  return {\n    name: \"pbkdf2-sha256\",\n    iterations: readRecordSafePositiveInteger(\n      record,\n      \"iterations\",\n      \"Encrypted blob store keyDerivation\",\n    ),\n    salt: readRecordString(\n      record,\n      \"salt\",\n      \"Encrypted blob store keyDerivation\",\n    ),\n  };\n}\n\nfunction parseHeader(headerBytes: BlobBytes): {\n  envelope: EncryptedBlobEnvelope;\n  iv: BlobBytes;\n} {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(TEXT_DECODER.decode(headerBytes));\n  } catch {\n    throw new Error(\"Encrypted blob store header is invalid JSON.\");\n  }\n  const label = \"Encrypted blob store header\";\n  const record = readRecord(parsed, label);\n  if (\n    readRecordString(record, \"format\", label) !== ENCRYPTED_BLOB_STORE_FORMAT\n  ) {\n    throw new Error(\"Encrypted blob store payload format is invalid.\");\n  }\n  if (readRecordSafePositiveInteger(record, \"version\", label) !== 2) {\n    throw new Error(\"Encrypted blob store payload version is invalid.\");\n  }\n  const chunkSize = readRecordSafePositiveInteger(record, \"chunkSize\", label);\n  if (chunkSize !== ENCRYPTED_BLOB_CHUNK_SIZE) {\n    throw new Error(\"Encrypted blob store payload chunk size is invalid.\");\n  }\n  const plaintextByteLength = readRecordSafeByteLength(\n    record,\n    \"plaintextByteLength\",\n    label,\n  );\n  const chunkCount = readRecordSafePositiveInteger(record, \"chunkCount\", label);\n  if (chunkCount !== getChunkCount(plaintextByteLength)) {\n    throw new Error(\"Encrypted blob store payload chunk count is invalid.\");\n  }\n  const iv = readBase64Bytes(record, \"iv\", label);\n  if (iv.byteLength !== AES_GCM_IV_BYTES) {\n    throw new Error(\"Encrypted blob store payload IV is invalid.\");\n  }\n  const { keyDerivation } = record;\n  return {\n    envelope: {\n      chunkCount,\n      chunkSize,\n      cipher: normalizeCipher(readRecordString(record, \"cipher\", label)),\n      format: ENCRYPTED_BLOB_STORE_FORMAT,\n      iv: readRecordString(record, \"iv\", label),\n      keyDerivation: readKeyDerivationEnvelope(keyDerivation),\n      plaintextByteLength,\n      version: ENCRYPTED_BLOB_STORE_VERSION,\n    },\n    iv,\n  };\n}\n\nexport function getChunkCount(plaintextByteLength: number): number {\n  if (!Number.isSafeInteger(plaintextByteLength) || plaintextByteLength < 0) {\n    throw new Error(\"Encrypted blob store byte length is invalid.\");\n  }\n  return Math.max(\n    1,\n    Math.ceil(plaintextByteLength / ENCRYPTED_BLOB_CHUNK_SIZE),\n  );\n}\n\nexport function getChunkPlaintextByteLength(\n  plaintextByteLength: number,\n  chunkIndex: number,\n): number {\n  const chunkCount = getChunkCount(plaintextByteLength);\n  if (\n    !Number.isSafeInteger(chunkIndex) ||\n    chunkIndex < 0 ||\n    chunkIndex >= chunkCount\n  ) {\n    throw new Error(\"Encrypted blob store chunk index is invalid.\");\n  }\n  if (chunkIndex < chunkCount - 1) {\n    return ENCRYPTED_BLOB_CHUNK_SIZE;\n  }\n  return plaintextByteLength - chunkIndex * ENCRYPTED_BLOB_CHUNK_SIZE;\n}\n\nexport function serializeEncryptedBlobEnvelope(\n  envelope: EncryptedBlobEnvelope,\n): { headerBytes: BlobBytes; prefixBytes: BlobBytes } {\n  const headerBytes = TEXT_ENCODER.encode(JSON.stringify(envelope));\n  if (headerBytes.byteLength > MAX_HEADER_BYTES) {\n    throw new Error(\"Encrypted blob store header is too large.\");\n  }\n  const prefixBytes = new Uint8Array(\n    MAGIC_BYTES.byteLength + HEADER_LENGTH_BYTES + headerBytes.byteLength,\n  );\n  prefixBytes.set(MAGIC_BYTES);\n  new DataView(prefixBytes.buffer).setUint32(\n    MAGIC_BYTES.byteLength,\n    headerBytes.byteLength,\n  );\n  prefixBytes.set(headerBytes, MAGIC_BYTES.byteLength + HEADER_LENGTH_BYTES);\n  return { headerBytes, prefixBytes };\n}\n\nfunction equalBytes(left: Uint8Array, right: Uint8Array): boolean {\n  return (\n    left.byteLength === right.byteLength && left.every((v, i) => v === right[i])\n  );\n}\n\nexport async function readEncryptedBlobEnvelope(\n  source: BlobByteSource,\n): Promise<ParsedEncryptedBlobEnvelope> {\n  const fixedPrefixLength = MAGIC_BYTES.byteLength + HEADER_LENGTH_BYTES;\n  if (source.byteLength < fixedPrefixLength) {\n    throw new Error(\"Encrypted blob store payload is too short.\");\n  }\n  const fixedPrefix = await readExactBlobBytes(source, 0, fixedPrefixLength);\n  if (\n    !equalBytes(fixedPrefix.subarray(0, MAGIC_BYTES.byteLength), MAGIC_BYTES)\n  ) {\n    throw new Error(\"Encrypted blob store payload format is invalid.\");\n  }\n  const headerByteLength = new DataView(\n    fixedPrefix.buffer,\n    fixedPrefix.byteOffset,\n    fixedPrefix.byteLength,\n  ).getUint32(MAGIC_BYTES.byteLength);\n  if (headerByteLength === 0 || headerByteLength > MAX_HEADER_BYTES) {\n    throw new Error(\"Encrypted blob store header length is invalid.\");\n  }\n  const prefixByteLength = fixedPrefixLength + headerByteLength;\n  if (source.byteLength < prefixByteLength) {\n    throw new Error(\"Encrypted blob store payload is truncated.\");\n  }\n  const headerBytes = await readExactBlobBytes(\n    source,\n    fixedPrefixLength,\n    headerByteLength,\n  );\n  const { envelope, iv } = parseHeader(headerBytes);\n  const encryptedByteLength =\n    prefixByteLength +\n    envelope.plaintextByteLength +\n    envelope.chunkCount * AES_GCM_TAG_BYTES;\n  if (\n    !Number.isSafeInteger(encryptedByteLength) ||\n    source.byteLength !== encryptedByteLength\n  ) {\n    throw new Error(\"Encrypted blob store payload length is invalid.\");\n  }\n  return {\n    encryptedByteLength,\n    envelope,\n    headerBytes,\n    iv,\n    prefixByteLength,\n  };\n}\n\nfunction writeLengthPrefixedText(\n  target: Uint8Array,\n  offset: number,\n  value: string,\n): number {\n  const bytes = TEXT_ENCODER.encode(value);\n  new DataView(target.buffer).setUint32(offset, bytes.byteLength);\n  target.set(bytes, offset + 4);\n  return offset + 4 + bytes.byteLength;\n}\n\nexport function chunkAdditionalData(input: {\n  chunkIndex: number;\n  headerBytes: BlobBytes;\n  namespace: string;\n  storageKey: string;\n}): BlobBytes {\n  const namespaceBytes = TEXT_ENCODER.encode(input.namespace);\n  const storageKeyBytes = TEXT_ENCODER.encode(input.storageKey);\n  const bytes = new Uint8Array(\n    4 +\n      namespaceBytes.byteLength +\n      4 +\n      storageKeyBytes.byteLength +\n      4 +\n      input.headerBytes.byteLength,\n  );\n  let offset = writeLengthPrefixedText(bytes, 0, input.namespace);\n  offset = writeLengthPrefixedText(bytes, offset, input.storageKey);\n  new DataView(bytes.buffer).setUint32(offset, input.chunkIndex);\n  bytes.set(input.headerBytes, offset + 4);\n  return bytes;\n}\n\nexport function deriveChunkIv(\n  baseIv: BlobBytes,\n  chunkIndex: number,\n): BlobBytes {\n  if (\n    !Number.isSafeInteger(chunkIndex) ||\n    chunkIndex < 0 ||\n    chunkIndex > 0xffff_ffff\n  ) {\n    throw new Error(\"Encrypted blob store chunk index exceeds the IV domain.\");\n  }\n  const iv = baseIv.slice();\n  const view = new DataView(iv.buffer, iv.byteOffset, iv.byteLength);\n  view.setUint32(8, view.getUint32(8) ^ chunkIndex);\n  return iv;\n}\n"]}

package/data/blobs/encryptedBlobStore.d.ts

@@ -0,0 +1,15 @@
+import { type BlobStore } from "../blobContracts.js";
+import { type EncryptedBlobStoreCipher } from "./encryptedBlobEnvelope.js";
+export type { EncryptedBlobStoreCipher };
+export type EncryptedBlobStoreKey = string | Uint8Array | CryptoKey;
+export interface EncryptedBlobStoreOptions {
+    cipher?: EncryptedBlobStoreCipher | undefined;
+    kdfIterations?: number | undefined;
+    key: EncryptedBlobStoreKey;
+}
+export interface WrapEncryptedBlobStoreOptions extends EncryptedBlobStoreOptions {
+    namespace: string;
+}
+export declare function wrapEncryptedBlobStore(store: BlobStore, options: WrapEncryptedBlobStoreOptions): BlobStore;
+export declare function createEncryptedBlobStore(namespace: string, options: EncryptedBlobStoreOptions): BlobStore;
+export declare function createLazyEncryptedBlobStore(namespace: string, keyProvider: () => Promise<EncryptedBlobStoreKey>): BlobStore;

package/data/blobs/encryptedBlobStore.js

@@ -0,0 +1,216 @@
+import { bytesToBase64 } from "../../internal/encoding/index.js";
+import { createBlobByteSource, readBlobByteSource, } from "../blobContracts.js";
+import { createDecryptedBlobByteSource, createEncryptedBlobByteSource, } from "./encryptedBlobByteSource.js";
+import { asBlobBytes, assertNamespace, createAesGcmIv, createKeyDerivationEnvelope, ENCRYPTED_BLOB_CHUNK_SIZE, ENCRYPTED_BLOB_STORE_FORMAT, ENCRYPTED_BLOB_STORE_VERSION, getChunkCount, normalizeCipher, normalizeKdfIterations, readBase64Bytes, readEncryptedBlobEnvelope, serializeEncryptedBlobEnvelope, } from "./encryptedBlobEnvelope.js";
+import { createOpfsBlobStore, isOpfsBlobStoreSupported } from "./opfsBlobStore.js";
+const AES_256_KEY_BYTES = 32;
+const TEXT_ENCODER = new TextEncoder();
+function isCryptoKey(value) {
+    return typeof CryptoKey !== "undefined" && value instanceof CryptoKey;
+}
+function assertCryptoKey(key) {
+    if (key.type !== "secret" || key.algorithm.name !== "AES-GCM") {
+        throw new Error("Encrypted blob store CryptoKey must be an AES-GCM secret.");
+    }
+    if (!key.usages.includes("encrypt") || !key.usages.includes("decrypt")) {
+        throw new Error("Encrypted blob store CryptoKey must allow encrypt and decrypt.");
+    }
+}
+async function importRawAesKey(key) {
+    if (key.byteLength !== AES_256_KEY_BYTES) {
+        throw new Error("Encrypted blob store AES-256-GCM key must be 32 bytes.");
+    }
+    return crypto.subtle.importKey("raw", asBlobBytes(key), "AES-GCM", false, [
+        "encrypt",
+        "decrypt",
+    ]);
+}
+class EncryptedBlobStore {
+    innerStore;
+    cipher;
+    derivedKeyByEnvelope = new Map();
+    kdfIterations;
+    namespace;
+    passphraseMaterialPromise;
+    rawKeyPromise;
+    constructor(innerStore, options) {
+        this.innerStore = innerStore;
+        if (!options || !("key" in options)) {
+            throw new Error("Encrypted blob store key is required.");
+        }
+        assertNamespace(options.namespace);
+        this.namespace = options.namespace;
+        this.cipher = normalizeCipher(options.cipher);
+        this.kdfIterations = normalizeKdfIterations(options.kdfIterations);
+        if (typeof options.key === "string") {
+            if (options.key.length === 0) {
+                throw new Error("Encrypted blob store key must be non-empty.");
+            }
+            this.rawKeyPromise = null;
+            this.passphraseMaterialPromise = crypto.subtle.importKey("raw", TEXT_ENCODER.encode(options.key), "PBKDF2", false, ["deriveKey"]);
+            return;
+        }
+        this.passphraseMaterialPromise = null;
+        if (isCryptoKey(options.key)) {
+            assertCryptoKey(options.key);
+            this.rawKeyPromise = Promise.resolve(options.key);
+            return;
+        }
+        if (!(options.key instanceof Uint8Array)) {
+            throw new Error("Encrypted blob store key must be a string, Uint8Array, or CryptoKey.");
+        }
+        this.rawKeyPromise = importRawAesKey(options.key);
+    }
+    async deleteBytes(storageKey) {
+        await this.innerStore.deleteBytes(storageKey);
+    }
+    async openByteSource(storageKey) {
+        const encryptedSource = await this.innerStore.openByteSource(storageKey);
+        if (!encryptedSource) {
+            return null;
+        }
+        const parsed = await readEncryptedBlobEnvelope(encryptedSource);
+        const key = await this.getCipherKey(parsed.envelope.keyDerivation);
+        return createDecryptedBlobByteSource({
+            encryptedSource,
+            headerBytes: parsed.headerBytes,
+            iv: parsed.iv,
+            key,
+            namespace: this.namespace,
+            parsed,
+            storageKey,
+        });
+    }
+    async readBytes(storageKey) {
+        const source = await this.openByteSource(storageKey);
+        return source ? readBlobByteSource(source) : null;
+    }
+    async writeByteSource(storageKey, source) {
+        const keyDerivation = this.createKeyDerivationEnvelope();
+        const key = await this.getCipherKey(keyDerivation);
+        const iv = createAesGcmIv();
+        const envelope = {
+            chunkCount: getChunkCount(source.byteLength),
+            chunkSize: ENCRYPTED_BLOB_CHUNK_SIZE,
+            cipher: this.cipher,
+            format: ENCRYPTED_BLOB_STORE_FORMAT,
+            iv: bytesToBase64(iv),
+            keyDerivation,
+            plaintextByteLength: source.byteLength,
+            version: ENCRYPTED_BLOB_STORE_VERSION,
+        };
+        const { headerBytes, prefixBytes } = serializeEncryptedBlobEnvelope(envelope);
+        await this.innerStore.writeByteSource(storageKey, createEncryptedBlobByteSource({
+            envelope,
+            headerBytes,
+            iv,
+            key,
+            namespace: this.namespace,
+            plaintextSource: source,
+            prefixBytes,
+            storageKey,
+        }));
+    }
+    async writeBytes(storageKey, bytes) {
+        await this.writeByteSource(storageKey, createBlobByteSource(bytes));
+    }
+    createKeyDerivationEnvelope() {
+        if (!this.passphraseMaterialPromise) {
+            return null;
+        }
+        return createKeyDerivationEnvelope({
+            cipher: this.cipher,
+            iterations: this.kdfIterations,
+            namespace: this.namespace,
+        });
+    }
+    async getCipherKey(keyDerivation) {
+        if (!keyDerivation) {
+            if (!this.rawKeyPromise) {
+                throw new Error("Encrypted blob store payload was not written with passphrase key derivation.");
+            }
+            return this.rawKeyPromise;
+        }
+        if (!this.passphraseMaterialPromise) {
+            throw new Error("Encrypted blob store payload requires a passphrase key.");
+        }
+        const cacheKey = JSON.stringify(keyDerivation);
+        let derivedKeyPromise = this.derivedKeyByEnvelope.get(cacheKey);
+        if (!derivedKeyPromise) {
+            derivedKeyPromise = this.derivePassphraseKey(keyDerivation);
+            derivedKeyPromise.catch(() => {
+                if (this.derivedKeyByEnvelope.get(cacheKey) === derivedKeyPromise) {
+                    this.derivedKeyByEnvelope.delete(cacheKey);
+                }
+            });
+            this.derivedKeyByEnvelope.set(cacheKey, derivedKeyPromise);
+        }
+        return derivedKeyPromise;
+    }
+    async derivePassphraseKey(keyDerivation) {
+        const passphraseMaterial = await this.passphraseMaterialPromise;
+        if (!passphraseMaterial) {
+            throw new Error("Encrypted blob store passphrase material is missing.");
+        }
+        return crypto.subtle.deriveKey({
+            name: "PBKDF2",
+            hash: "SHA-256",
+            iterations: keyDerivation.iterations,
+            salt: readBase64Bytes({ salt: keyDerivation.salt }, "salt", "Encrypted blob store keyDerivation"),
+        }, passphraseMaterial, {
+            name: "AES-GCM",
+            length: 256,
+        }, false, ["encrypt", "decrypt"]);
+    }
+}
+export function wrapEncryptedBlobStore(store, options) {
+    return new EncryptedBlobStore(store, options);
+}
+export function createEncryptedBlobStore(namespace, options) {
+    if (!isOpfsBlobStoreSupported()) {
+        throw new Error("OPFS blob store is not supported.");
+    }
+    return wrapEncryptedBlobStore(createOpfsBlobStore(namespace), {
+        ...options,
+        namespace,
+    });
+}
+export function createLazyEncryptedBlobStore(namespace, keyProvider) {
+    let innerStorePromise = null;
+    function getStore() {
+        if (!innerStorePromise) {
+            innerStorePromise = (async () => {
+                const key = await keyProvider();
+                return createEncryptedBlobStore(namespace, { key });
+            })().catch((error) => {
+                // Run cleanup after assignment, even if keyProvider throws synchronously.
+                innerStorePromise = null;
+                throw error;
+            });
+        }
+        return innerStorePromise;
+    }
+    return {
+        deleteBytes: async (storageKey) => {
+            const store = await getStore();
+            return store.deleteBytes(storageKey);
+        },
+        openByteSource: async (storageKey) => {
+            const store = await getStore();
+            return store.openByteSource(storageKey);
+        },
+        readBytes: async (storageKey) => {
+            const store = await getStore();
+            return store.readBytes(storageKey);
+        },
+        writeByteSource: async (storageKey, source) => {
+            const store = await getStore();
+            return store.writeByteSource(storageKey, source);
+        },
+        writeBytes: async (storageKey, bytes) => {
+            const store = await getStore();
+            return store.writeBytes(storageKey, bytes);
+        },
+    };
+}
+//# sourceMappingURL=encryptedBlobStore.js.map

package/data/blobs/encryptedBlobStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryptedBlobStore.js","sourceRoot":"","sources":["encryptedBlobStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAIL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,4BAA4B,EAG5B,aAAa,EAEb,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAgBhF,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC;AAEvC,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,SAAS,KAAK,WAAW,IAAI,KAAK,YAAY,SAAS,CAAC;AACxE,CAAC;AAED,SAAS,eAAe,CAAC,GAAc;IACrC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAe;IAC5C,IAAI,GAAG,CAAC,UAAU,KAAK,iBAAiB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE;QACxE,SAAS;QACT,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,MAAM,kBAAkB;IASH;IARF,MAAM,CAA2B;IACjC,oBAAoB,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC7D,aAAa,CAAS;IACtB,SAAS,CAAS;IAClB,yBAAyB,CAA4B;IACrD,aAAa,CAA4B;IAE1D,YACmB,UAAqB,EACtC,OAAsC;QADrB,eAAU,GAAV,UAAU,CAAW;QAGtC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,sBAAsB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAEnE,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,IAAI,CAAC,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CACtD,KAAK,EACL,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAChC,QAAQ,EACR,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC;QACtC,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,YAAY,UAAU,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,UAAkB;QAClC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,UAAkB;QACrC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACzE,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,eAAe,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACnE,OAAO,6BAA6B,CAAC;YACnC,eAAe;YACf,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,GAAG;YACH,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM;YACN,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,UAAkB,EAClB,MAAsB;QAEtB,MAAM,aAAa,GAAG,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAA0B;YACtC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC;YAC5C,SAAS,EAAE,yBAAyB;YACpC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,2BAA2B;YACnC,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;YACrB,aAAa;YACb,mBAAmB,EAAE,MAAM,CAAC,UAAU;YACtC,OAAO,EAAE,4BAA4B;SACtC,CAAC;QACF,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAChC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CACnC,UAAU,EACV,6BAA6B,CAAC;YAC5B,QAAQ;YACR,WAAW;YACX,EAAE;YACF,GAAG;YACH,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,eAAe,EAAE,MAAM;YACvB,WAAW;YACX,UAAU;SACX,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,KAAgB;QACnD,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,CAAC;IAEO,2BAA2B;QACjC,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,2BAA2B,CAAC;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,aAAa;YAC9B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,aAA2C;QAE3C,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC,aAAa,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC/C,IAAI,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;YAC5D,iBAAiB,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC3B,IAAI,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,iBAAiB,EAAE,CAAC;oBAClE,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,aAAoC;QAEpC,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC;QAChE,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;YACE,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,aAAa,CAAC,UAAU;YACpC,IAAI,EAAE,eAAe,CACnB,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,EAC5B,MAAM,EACN,oCAAoC,CACrC;SACF,EACD,kBAAkB,EAClB;YACE,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,GAAG;SACZ,EACD,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAgB,EAChB,OAAsC;IAEtC,OAAO,IAAI,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,SAAiB,EACjB,OAAkC;IAElC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,sBAAsB,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE;QAC5D,GAAG,OAAO;QACV,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,SAAiB,EACjB,WAAiD;IAEjD,IAAI,iBAAiB,GAA8B,IAAI,CAAC;IAExD,SAAS,QAAQ;QACf,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC9B,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE,CAAC;gBAChC,OAAO,wBAAwB,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACtD,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC5B,0EAA0E;gBAC1E,iBAAiB,GAAG,IAAI,CAAC;gBACzB,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,OAAO;QACL,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACvC,CAAC;QACD,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;YACnC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;QACD,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;YAC9B,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QACD,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE;YAC5C,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE;YACtC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { bytesToBase64 } from \"@tearleads/encoding\";\nimport {\n  type BlobByteSource,\n  type BlobBytes,\n  type BlobStore,\n  createBlobByteSource,\n  readBlobByteSource,\n} from \"../blobContracts\";\nimport {\n  createDecryptedBlobByteSource,\n  createEncryptedBlobByteSource,\n} from \"./encryptedBlobByteSource\";\nimport {\n  asBlobBytes,\n  assertNamespace,\n  createAesGcmIv,\n  createKeyDerivationEnvelope,\n  ENCRYPTED_BLOB_CHUNK_SIZE,\n  ENCRYPTED_BLOB_STORE_FORMAT,\n  ENCRYPTED_BLOB_STORE_VERSION,\n  type EncryptedBlobEnvelope,\n  type EncryptedBlobStoreCipher,\n  getChunkCount,\n  type KeyDerivationEnvelope,\n  normalizeCipher,\n  normalizeKdfIterations,\n  readBase64Bytes,\n  readEncryptedBlobEnvelope,\n  serializeEncryptedBlobEnvelope,\n} from \"./encryptedBlobEnvelope\";\nimport { createOpfsBlobStore, isOpfsBlobStoreSupported } from \"./opfsBlobStore\";\n\nexport type { EncryptedBlobStoreCipher };\nexport type EncryptedBlobStoreKey = string | Uint8Array | CryptoKey;\n\nexport interface EncryptedBlobStoreOptions {\n  cipher?: EncryptedBlobStoreCipher | undefined;\n  kdfIterations?: number | undefined;\n  key: EncryptedBlobStoreKey;\n}\n\nexport interface WrapEncryptedBlobStoreOptions\n  extends EncryptedBlobStoreOptions {\n  namespace: string;\n}\n\nconst AES_256_KEY_BYTES = 32;\nconst TEXT_ENCODER = new TextEncoder();\n\nfunction isCryptoKey(value: unknown): value is CryptoKey {\n  return typeof CryptoKey !== \"undefined\" && value instanceof CryptoKey;\n}\n\nfunction assertCryptoKey(key: CryptoKey): void {\n  if (key.type !== \"secret\" || key.algorithm.name !== \"AES-GCM\") {\n    throw new Error(\n      \"Encrypted blob store CryptoKey must be an AES-GCM secret.\",\n    );\n  }\n  if (!key.usages.includes(\"encrypt\") || !key.usages.includes(\"decrypt\")) {\n    throw new Error(\n      \"Encrypted blob store CryptoKey must allow encrypt and decrypt.\",\n    );\n  }\n}\n\nasync function importRawAesKey(key: Uint8Array): Promise<CryptoKey> {\n  if (key.byteLength !== AES_256_KEY_BYTES) {\n    throw new Error(\"Encrypted blob store AES-256-GCM key must be 32 bytes.\");\n  }\n\n  return crypto.subtle.importKey(\"raw\", asBlobBytes(key), \"AES-GCM\", false, [\n    \"encrypt\",\n    \"decrypt\",\n  ]);\n}\n\nclass EncryptedBlobStore implements BlobStore {\n  private readonly cipher: EncryptedBlobStoreCipher;\n  private readonly derivedKeyByEnvelope = new Map<string, Promise<CryptoKey>>();\n  private readonly kdfIterations: number;\n  private readonly namespace: string;\n  private readonly passphraseMaterialPromise: Promise<CryptoKey> | null;\n  private readonly rawKeyPromise: Promise<CryptoKey> | null;\n\n  constructor(\n    private readonly innerStore: BlobStore,\n    options: WrapEncryptedBlobStoreOptions,\n  ) {\n    if (!options || !(\"key\" in options)) {\n      throw new Error(\"Encrypted blob store key is required.\");\n    }\n    assertNamespace(options.namespace);\n    this.namespace = options.namespace;\n    this.cipher = normalizeCipher(options.cipher);\n    this.kdfIterations = normalizeKdfIterations(options.kdfIterations);\n\n    if (typeof options.key === \"string\") {\n      if (options.key.length === 0) {\n        throw new Error(\"Encrypted blob store key must be non-empty.\");\n      }\n      this.rawKeyPromise = null;\n      this.passphraseMaterialPromise = crypto.subtle.importKey(\n        \"raw\",\n        TEXT_ENCODER.encode(options.key),\n        \"PBKDF2\",\n        false,\n        [\"deriveKey\"],\n      );\n      return;\n    }\n\n    this.passphraseMaterialPromise = null;\n    if (isCryptoKey(options.key)) {\n      assertCryptoKey(options.key);\n      this.rawKeyPromise = Promise.resolve(options.key);\n      return;\n    }\n\n    if (!(options.key instanceof Uint8Array)) {\n      throw new Error(\n        \"Encrypted blob store key must be a string, Uint8Array, or CryptoKey.\",\n      );\n    }\n\n    this.rawKeyPromise = importRawAesKey(options.key);\n  }\n\n  async deleteBytes(storageKey: string): Promise<void> {\n    await this.innerStore.deleteBytes(storageKey);\n  }\n\n  async openByteSource(storageKey: string): Promise<BlobByteSource | null> {\n    const encryptedSource = await this.innerStore.openByteSource(storageKey);\n    if (!encryptedSource) {\n      return null;\n    }\n\n    const parsed = await readEncryptedBlobEnvelope(encryptedSource);\n    const key = await this.getCipherKey(parsed.envelope.keyDerivation);\n    return createDecryptedBlobByteSource({\n      encryptedSource,\n      headerBytes: parsed.headerBytes,\n      iv: parsed.iv,\n      key,\n      namespace: this.namespace,\n      parsed,\n      storageKey,\n    });\n  }\n\n  async readBytes(storageKey: string): Promise<BlobBytes | null> {\n    const source = await this.openByteSource(storageKey);\n    return source ? readBlobByteSource(source) : null;\n  }\n\n  async writeByteSource(\n    storageKey: string,\n    source: BlobByteSource,\n  ): Promise<void> {\n    const keyDerivation = this.createKeyDerivationEnvelope();\n    const key = await this.getCipherKey(keyDerivation);\n    const iv = createAesGcmIv();\n    const envelope: EncryptedBlobEnvelope = {\n      chunkCount: getChunkCount(source.byteLength),\n      chunkSize: ENCRYPTED_BLOB_CHUNK_SIZE,\n      cipher: this.cipher,\n      format: ENCRYPTED_BLOB_STORE_FORMAT,\n      iv: bytesToBase64(iv),\n      keyDerivation,\n      plaintextByteLength: source.byteLength,\n      version: ENCRYPTED_BLOB_STORE_VERSION,\n    };\n    const { headerBytes, prefixBytes } =\n      serializeEncryptedBlobEnvelope(envelope);\n    await this.innerStore.writeByteSource(\n      storageKey,\n      createEncryptedBlobByteSource({\n        envelope,\n        headerBytes,\n        iv,\n        key,\n        namespace: this.namespace,\n        plaintextSource: source,\n        prefixBytes,\n        storageKey,\n      }),\n    );\n  }\n\n  async writeBytes(storageKey: string, bytes: BlobBytes): Promise<void> {\n    await this.writeByteSource(storageKey, createBlobByteSource(bytes));\n  }\n\n  private createKeyDerivationEnvelope(): KeyDerivationEnvelope | null {\n    if (!this.passphraseMaterialPromise) {\n      return null;\n    }\n\n    return createKeyDerivationEnvelope({\n      cipher: this.cipher,\n      iterations: this.kdfIterations,\n      namespace: this.namespace,\n    });\n  }\n\n  private async getCipherKey(\n    keyDerivation: KeyDerivationEnvelope | null,\n  ): Promise<CryptoKey> {\n    if (!keyDerivation) {\n      if (!this.rawKeyPromise) {\n        throw new Error(\n          \"Encrypted blob store payload was not written with passphrase key derivation.\",\n        );\n      }\n\n      return this.rawKeyPromise;\n    }\n\n    if (!this.passphraseMaterialPromise) {\n      throw new Error(\n        \"Encrypted blob store payload requires a passphrase key.\",\n      );\n    }\n\n    const cacheKey = JSON.stringify(keyDerivation);\n    let derivedKeyPromise = this.derivedKeyByEnvelope.get(cacheKey);\n    if (!derivedKeyPromise) {\n      derivedKeyPromise = this.derivePassphraseKey(keyDerivation);\n      derivedKeyPromise.catch(() => {\n        if (this.derivedKeyByEnvelope.get(cacheKey) === derivedKeyPromise) {\n          this.derivedKeyByEnvelope.delete(cacheKey);\n        }\n      });\n      this.derivedKeyByEnvelope.set(cacheKey, derivedKeyPromise);\n    }\n\n    return derivedKeyPromise;\n  }\n\n  private async derivePassphraseKey(\n    keyDerivation: KeyDerivationEnvelope,\n  ): Promise<CryptoKey> {\n    const passphraseMaterial = await this.passphraseMaterialPromise;\n    if (!passphraseMaterial) {\n      throw new Error(\"Encrypted blob store passphrase material is missing.\");\n    }\n\n    return crypto.subtle.deriveKey(\n      {\n        name: \"PBKDF2\",\n        hash: \"SHA-256\",\n        iterations: keyDerivation.iterations,\n        salt: readBase64Bytes(\n          { salt: keyDerivation.salt },\n          \"salt\",\n          \"Encrypted blob store keyDerivation\",\n        ),\n      },\n      passphraseMaterial,\n      {\n        name: \"AES-GCM\",\n        length: 256,\n      },\n      false,\n      [\"encrypt\", \"decrypt\"],\n    );\n  }\n}\n\nexport function wrapEncryptedBlobStore(\n  store: BlobStore,\n  options: WrapEncryptedBlobStoreOptions,\n): BlobStore {\n  return new EncryptedBlobStore(store, options);\n}\n\nexport function createEncryptedBlobStore(\n  namespace: string,\n  options: EncryptedBlobStoreOptions,\n): BlobStore {\n  if (!isOpfsBlobStoreSupported()) {\n    throw new Error(\"OPFS blob store is not supported.\");\n  }\n\n  return wrapEncryptedBlobStore(createOpfsBlobStore(namespace), {\n    ...options,\n    namespace,\n  });\n}\n\nexport function createLazyEncryptedBlobStore(\n  namespace: string,\n  keyProvider: () => Promise<EncryptedBlobStoreKey>,\n): BlobStore {\n  let innerStorePromise: Promise<BlobStore> | null = null;\n\n  function getStore(): Promise<BlobStore> {\n    if (!innerStorePromise) {\n      innerStorePromise = (async () => {\n        const key = await keyProvider();\n        return createEncryptedBlobStore(namespace, { key });\n      })().catch((error: unknown) => {\n        // Run cleanup after assignment, even if keyProvider throws synchronously.\n        innerStorePromise = null;\n        throw error;\n      });\n    }\n\n    return innerStorePromise;\n  }\n\n  return {\n    deleteBytes: async (storageKey) => {\n      const store = await getStore();\n      return store.deleteBytes(storageKey);\n    },\n    openByteSource: async (storageKey) => {\n      const store = await getStore();\n      return store.openByteSource(storageKey);\n    },\n    readBytes: async (storageKey) => {\n      const store = await getStore();\n      return store.readBytes(storageKey);\n    },\n    writeByteSource: async (storageKey, source) => {\n      const store = await getStore();\n      return store.writeByteSource(storageKey, source);\n    },\n    writeBytes: async (storageKey, bytes) => {\n      const store = await getStore();\n      return store.writeBytes(storageKey, bytes);\n    },\n  };\n}\n"]}

package/data/blobs/memoryBlobStore.d.ts

@@ -0,0 +1,2 @@
+import { type BlobStore } from "../blobContracts.js";
+export declare function createMemoryBlobStore(): BlobStore;

package/data/blobs/memoryBlobStore.js

@@ -0,0 +1,25 @@
+import { createBlobByteSource, readBlobByteSource, } from "../blobContracts.js";
+class MemoryBlobStore {
+    bytesByKey = new Map();
+    async deleteBytes(storageKey) {
+        this.bytesByKey.delete(storageKey);
+    }
+    async openByteSource(storageKey) {
+        const bytes = this.bytesByKey.get(storageKey);
+        return bytes ? createBlobByteSource(bytes) : null;
+    }
+    async readBytes(storageKey) {
+        const source = await this.openByteSource(storageKey);
+        return source ? readBlobByteSource(source) : null;
+    }
+    async writeByteSource(storageKey, source) {
+        this.bytesByKey.set(storageKey, await readBlobByteSource(source));
+    }
+    async writeBytes(storageKey, bytes) {
+        await this.writeByteSource(storageKey, createBlobByteSource(bytes));
+    }
+}
+export function createMemoryBlobStore() {
+    return new MemoryBlobStore();
+}
+//# sourceMappingURL=memoryBlobStore.js.map

package/data/blobs/memoryBlobStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memoryBlobStore.js","sourceRoot":"","sources":["memoryBlobStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,eAAe;IACF,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE3D,KAAK,CAAC,WAAW,CAAC,UAAkB;QAClC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,UAAkB;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,MAAsB;QAC9D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,KAAgB;QACnD,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,IAAI,eAAe,EAAE,CAAC;AAC/B,CAAC","sourcesContent":["import {\n  type BlobByteSource,\n  type BlobBytes,\n  type BlobStore,\n  createBlobByteSource,\n  readBlobByteSource,\n} from \"../blobContracts\";\n\nclass MemoryBlobStore implements BlobStore {\n  private readonly bytesByKey = new Map<string, BlobBytes>();\n\n  async deleteBytes(storageKey: string) {\n    this.bytesByKey.delete(storageKey);\n  }\n\n  async openByteSource(storageKey: string) {\n    const bytes = this.bytesByKey.get(storageKey);\n    return bytes ? createBlobByteSource(bytes) : null;\n  }\n\n  async readBytes(storageKey: string) {\n    const source = await this.openByteSource(storageKey);\n    return source ? readBlobByteSource(source) : null;\n  }\n\n  async writeByteSource(storageKey: string, source: BlobByteSource) {\n    this.bytesByKey.set(storageKey, await readBlobByteSource(source));\n  }\n\n  async writeBytes(storageKey: string, bytes: BlobBytes) {\n    await this.writeByteSource(storageKey, createBlobByteSource(bytes));\n  }\n}\n\nexport function createMemoryBlobStore(): BlobStore {\n  return new MemoryBlobStore();\n}\n"]}

package/data/blobs/opfsBlobStore.d.ts

@@ -0,0 +1,10 @@
+import { type BlobStore } from "../blobContracts.js";
+export declare function isOpfsBlobStoreSupported(): boolean;
+export declare function createOpfsBlobStore(namespace: string): BlobStore;
+/**
+ * Permanently remove the OPFS directory backing a namespace's blob store
+ * (`tearleads/<namespace>`), discarding every stored blob for that namespace.
+ * Used to forget local data on logout. No-op when OPFS is unavailable or the
+ * directory was never created; never throws on a missing directory.
+ */
+export declare function purgeOpfsBlobStore(namespace: string): Promise<void>;