@thenewlabs/entangle-crypto 1.0.0

package/dist/index.d.ts

@@ -0,0 +1,29 @@
+export interface DerivedKeys {
+    K_enc: Uint8Array;
+    K_auth: Uint8Array;
+}
+export declare function initCrypto(): Promise<void>;
+export declare function extractSaltFromCapId(capId: string): Uint8Array;
+export declare function generateCapId(): {
+    capId: string;
+    saltCap: Uint8Array;
+};
+export declare function generateSecret(): string;
+export declare function deriveKeys(S: Uint8Array | string, saltCap: Uint8Array): Promise<DerivedKeys>;
+export interface AeadEncResult {
+    nonce: Uint8Array;
+    cipher: Uint8Array;
+}
+export declare function aeadEncrypt(K_enc: Uint8Array, type: number, ctr: number, plaintext: any): AeadEncResult;
+export declare function aeadDecrypt(K_enc: Uint8Array, type: number, nonce: Uint8Array, cipher: Uint8Array): {
+    ctr: number;
+    msg: any;
+};
+export declare function computeHmac(K_auth: Uint8Array, data: Uint8Array): Uint8Array;
+export declare function verifyHmac(K_auth: Uint8Array, data: Uint8Array, mac: Uint8Array): boolean;
+export declare function sha256Hex(text: string): string;
+export declare function base64UrlEncode(data: Uint8Array): string;
+export declare function base64UrlDecode(str: string): Uint8Array;
+export declare function hashPolicy(policy: any): string;
+export * from './stream-crypto.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE,UAAU,CAAC;CACpB;AAID,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAKhD;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAY9D;AAED,wBAAgB,aAAa,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAUtE;AAED,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAED,wBAAsB,UAAU,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CA0BlG;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,wBAAgB,WAAW,CACzB,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,GAAG,GACb,aAAa,CAcf;AAED,wBAAgB,WAAW,CACzB,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,UAAU,GACjB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAA;CAAE,CAa3B;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,UAAU,CAE5E;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAGzF;AAGD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO9C;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAUxD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAcvD;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,GAAG,GAAG,MAAM,CAI9C;AAED,cAAc,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,115 @@
+import sodium from 'libsodium-wrappers-sumo';
+import { hkdf } from '@noble/hashes/hkdf';
+import { sha256 } from '@noble/hashes/sha256';
+import { hmac } from '@noble/hashes/hmac';
+import { encode, decode } from 'cborg';
+import { CRYPTO_PARAMS } from '@thenewlabs/entangle-protocol';
+let sodiumReady = false;
+export async function initCrypto() {
+    if (!sodiumReady) {
+        await sodium.ready;
+        sodiumReady = true;
+    }
+}
+export function extractSaltFromCapId(capId) {
+    let decoded;
+    try {
+        decoded = base64UrlDecode(capId);
+    }
+    catch (error) {
+        throw new Error('Invalid capId length');
+    }
+    if (decoded.length !== CRYPTO_PARAMS.SALT_CAP_BYTES + CRYPTO_PARAMS.CAP_RAND_BYTES) {
+        throw new Error('Invalid capId length');
+    }
+    return decoded.slice(0, CRYPTO_PARAMS.SALT_CAP_BYTES);
+}
+export function generateCapId() {
+    const saltCap = sodium.randombytes_buf(CRYPTO_PARAMS.SALT_CAP_BYTES);
+    const capRand = sodium.randombytes_buf(CRYPTO_PARAMS.CAP_RAND_BYTES);
+    const combined = new Uint8Array(CRYPTO_PARAMS.SALT_CAP_BYTES + CRYPTO_PARAMS.CAP_RAND_BYTES);
+    combined.set(saltCap, 0);
+    combined.set(capRand, CRYPTO_PARAMS.SALT_CAP_BYTES);
+    return {
+        capId: base64UrlEncode(combined),
+        saltCap,
+    };
+}
+export function generateSecret() {
+    const secret = sodium.randombytes_buf(32);
+    return base64UrlEncode(secret);
+}
+export async function deriveKeys(S, saltCap) {
+    await initCrypto();
+    const secretBytes = typeof S === 'string' ? base64UrlDecode(S) : S;
+    const K_raw = sodium.crypto_pwhash(32, secretBytes, saltCap, sodium.crypto_pwhash_OPSLIMIT_INTERACTIVE, sodium.crypto_pwhash_MEMLIMIT_INTERACTIVE, sodium.crypto_pwhash_ALG_ARGON2ID13);
+    const derived = hkdf(sha256, K_raw, new Uint8Array(0), new TextEncoder().encode('entangle-capability'), 64);
+    return {
+        K_enc: derived.slice(0, 32),
+        K_auth: derived.slice(32, 64),
+    };
+}
+export function aeadEncrypt(K_enc, type, ctr, plaintext) {
+    const nonce = sodium.randombytes_buf(CRYPTO_PARAMS.NONCE_BYTES);
+    const aad = encode({ type });
+    const pt = encode({ ctr, msg: plaintext });
+    const cipher = sodium.crypto_aead_xchacha20poly1305_ietf_encrypt(pt, aad, null, nonce, K_enc);
+    return { nonce, cipher };
+}
+export function aeadDecrypt(K_enc, type, nonce, cipher) {
+    const aad = encode({ type });
+    const pt = sodium.crypto_aead_xchacha20poly1305_ietf_decrypt(null, cipher, aad, nonce, K_enc);
+    const decoded = decode(pt);
+    return decoded;
+}
+export function computeHmac(K_auth, data) {
+    return hmac(sha256, K_auth, data);
+}
+export function verifyHmac(K_auth, data, mac) {
+    const computed = computeHmac(K_auth, data);
+    return sodium.compare(computed, mac) === 0;
+}
+// Convenience: SHA-256 of UTF-8 string, returned as lowercase hex
+export function sha256Hex(text) {
+    const bytes = new TextEncoder().encode(text);
+    const hash = sha256(bytes);
+    let hex = '';
+    // Iterate without indexed access to satisfy noUncheckedIndexedAccess
+    for (const b of hash)
+        hex += b.toString(16).padStart(2, '0');
+    return hex;
+}
+export function base64UrlEncode(data) {
+    // Use Node Buffer when available to avoid relying on btoa (not in Node)
+    let base64;
+    if (typeof Buffer !== 'undefined' && typeof Buffer.from === 'function') {
+        base64 = Buffer.from(data).toString('base64');
+    }
+    else {
+        // Browser fallback
+        base64 = btoa(String.fromCharCode(...data));
+    }
+    return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}
+export function base64UrlDecode(str) {
+    let base64 = str.replace(/-/g, '+').replace(/_/g, '/');
+    while (base64.length % 4) {
+        base64 += '=';
+    }
+    if (typeof Buffer !== 'undefined' && typeof Buffer.from === 'function') {
+        return new Uint8Array(Buffer.from(base64, 'base64'));
+    }
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+export function hashPolicy(policy) {
+    const encoded = encode(policy);
+    const hash = sha256(encoded);
+    return base64UrlEncode(hash);
+}
+export * from './stream-crypto.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,yBAAyB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAO9D,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,KAAK,CAAC;QACnB,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC,cAAc,GAAG,aAAa,CAAC,cAAc,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,aAAa,CAAC,cAAc,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;IAC7F,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACpD,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC;QAChC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAC1C,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAsB,EAAE,OAAmB;IAC1E,MAAM,UAAU,EAAE,CAAC;IAEnB,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnE,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAChC,EAAE,EACF,WAAW,EACX,OAAO,EACP,MAAM,CAAC,kCAAkC,EACzC,MAAM,CAAC,kCAAkC,EACzC,MAAM,CAAC,4BAA4B,CACpC,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,CAClB,MAAM,EACN,KAAK,EACL,IAAI,UAAU,CAAC,CAAC,CAAC,EACjB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAC/C,EAAE,CACH,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;KAC9B,CAAC;AACJ,CAAC;AAOD,MAAM,UAAU,WAAW,CACzB,KAAiB,EACjB,IAAY,EACZ,GAAW,EACX,SAAc;IAEd,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,CAAC,0CAA0C,CAC9D,EAAE,EACF,GAAG,EACH,IAAI,EACJ,KAAK,EACL,KAAK,CACN,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,KAAiB,EACjB,IAAY,EACZ,KAAiB,EACjB,MAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7B,MAAM,EAAE,GAAG,MAAM,CAAC,0CAA0C,CAC1D,IAAI,EACJ,MAAM,EACN,GAAG,EACH,KAAK,EACL,KAAK,CACN,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAA8B,CAAC;IACxD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAkB,EAAE,IAAgB;IAC9D,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAkB,EAAE,IAAgB,EAAE,GAAe;IAC9E,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,qEAAqE;IACrE,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAgB;IAC9C,wEAAwE;IACxE,IAAI,MAAc,CAAC;IACnB,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACvE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,mBAAmB;QACnB,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACvE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAW;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,cAAc,oBAAoB,CAAC"}

package/dist/index.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.test.d.ts.map

package/dist/index.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.d.ts","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":""}

package/dist/index.test.js

@@ -0,0 +1,167 @@
+import { describe, it, expect, beforeAll } from 'vitest';
+import { initCrypto, generateCapId, generateSecret, extractSaltFromCapId, deriveKeys, aeadEncrypt, aeadDecrypt, computeHmac, verifyHmac, base64UrlEncode, base64UrlDecode, hashPolicy, } from './index.js';
+describe('Crypto Package', () => {
+    beforeAll(async () => {
+        await initCrypto();
+    });
+    describe('CapId generation', () => {
+        it('should generate valid capId with embedded salt', () => {
+            const { capId, saltCap } = generateCapId();
+            expect(capId).toBeTruthy();
+            expect(saltCap).toHaveLength(16);
+            const extracted = extractSaltFromCapId(capId);
+            expect(extracted).toEqual(saltCap);
+        });
+        it('should generate unique capIds', () => {
+            const cap1 = generateCapId();
+            const cap2 = generateCapId();
+            expect(cap1.capId).not.toEqual(cap2.capId);
+            expect(cap1.saltCap).not.toEqual(cap2.saltCap);
+        });
+        it('should fail on invalid capId length', () => {
+            expect(() => extractSaltFromCapId('short')).toThrow('Invalid capId length');
+        });
+    });
+    describe('Secret generation', () => {
+        it('should generate base64url encoded secrets', () => {
+            const secret = generateSecret();
+            expect(secret).toBeTruthy();
+            expect(secret).toMatch(/^[A-Za-z0-9_-]+$/);
+            const decoded = base64UrlDecode(secret);
+            expect(decoded).toHaveLength(32);
+        });
+    });
+    describe('Key derivation', () => {
+        it('should derive consistent keys from same inputs', async () => {
+            const secret = generateSecret();
+            const { saltCap } = generateCapId();
+            const keys1 = await deriveKeys(secret, saltCap);
+            const keys2 = await deriveKeys(secret, saltCap);
+            expect(keys1.K_enc).toEqual(keys2.K_enc);
+            expect(keys1.K_auth).toEqual(keys2.K_auth);
+        });
+        it('should derive different keys from different secrets', async () => {
+            const secret1 = generateSecret();
+            const secret2 = generateSecret();
+            const { saltCap } = generateCapId();
+            const keys1 = await deriveKeys(secret1, saltCap);
+            const keys2 = await deriveKeys(secret2, saltCap);
+            expect(keys1.K_enc).not.toEqual(keys2.K_enc);
+            expect(keys1.K_auth).not.toEqual(keys2.K_auth);
+        });
+        it('should derive different keys from different salts', async () => {
+            const secret = generateSecret();
+            const { saltCap: salt1 } = generateCapId();
+            const { saltCap: salt2 } = generateCapId();
+            const keys1 = await deriveKeys(secret, salt1);
+            const keys2 = await deriveKeys(secret, salt2);
+            expect(keys1.K_enc).not.toEqual(keys2.K_enc);
+        });
+    });
+    describe('AEAD encryption', () => {
+        it('should encrypt and decrypt successfully', async () => {
+            const secret = generateSecret();
+            const { saltCap } = generateCapId();
+            const keys = await deriveKeys(secret, saltCap);
+            const plaintext = { test: 'data', number: 42 };
+            const type = 0x10;
+            const ctr = 1;
+            const { nonce, cipher } = aeadEncrypt(keys.K_enc, type, ctr, plaintext);
+            expect(nonce).toHaveLength(24);
+            expect(cipher).toBeTruthy();
+            const decrypted = aeadDecrypt(keys.K_enc, type, nonce, cipher);
+            expect(decrypted.ctr).toEqual(ctr);
+            expect(decrypted.msg).toEqual(plaintext);
+        });
+        it('should fail decryption with wrong key', async () => {
+            const secret1 = generateSecret();
+            const secret2 = generateSecret();
+            const { saltCap } = generateCapId();
+            const keys1 = await deriveKeys(secret1, saltCap);
+            const keys2 = await deriveKeys(secret2, saltCap);
+            const plaintext = { test: 'data' };
+            const { nonce, cipher } = aeadEncrypt(keys1.K_enc, 0x10, 1, plaintext);
+            expect(() => aeadDecrypt(keys2.K_enc, 0x10, nonce, cipher)).toThrow();
+        });
+        it('should fail decryption with wrong type', async () => {
+            const secret = generateSecret();
+            const { saltCap } = generateCapId();
+            const keys = await deriveKeys(secret, saltCap);
+            const plaintext = { test: 'data' };
+            const { nonce, cipher } = aeadEncrypt(keys.K_enc, 0x10, 1, plaintext);
+            expect(() => aeadDecrypt(keys.K_enc, 0x11, nonce, cipher)).toThrow();
+        });
+        it('should fail decryption with tampered cipher', async () => {
+            const secret = generateSecret();
+            const { saltCap } = generateCapId();
+            const keys = await deriveKeys(secret, saltCap);
+            const plaintext = { test: 'data' };
+            const { nonce, cipher } = aeadEncrypt(keys.K_enc, 0x10, 1, plaintext);
+            cipher[0] ^= 0xFF; // Tamper with first byte
+            expect(() => aeadDecrypt(keys.K_enc, 0x10, nonce, cipher)).toThrow();
+        });
+    });
+    describe('HMAC', () => {
+        it('should compute and verify HMAC', async () => {
+            const secret = generateSecret();
+            const { saltCap } = generateCapId();
+            const keys = await deriveKeys(secret, saltCap);
+            const data = new TextEncoder().encode('test message');
+            const mac = computeHmac(keys.K_auth, data);
+            expect(mac).toHaveLength(32);
+            expect(verifyHmac(keys.K_auth, data, mac)).toBe(true);
+        });
+        it('should fail verification with wrong key', async () => {
+            const secret1 = generateSecret();
+            const secret2 = generateSecret();
+            const { saltCap } = generateCapId();
+            const keys1 = await deriveKeys(secret1, saltCap);
+            const keys2 = await deriveKeys(secret2, saltCap);
+            const data = new TextEncoder().encode('test message');
+            const mac = computeHmac(keys1.K_auth, data);
+            expect(verifyHmac(keys2.K_auth, data, mac)).toBe(false);
+        });
+        it('should fail verification with tampered data', async () => {
+            const secret = generateSecret();
+            const { saltCap } = generateCapId();
+            const keys = await deriveKeys(secret, saltCap);
+            const data1 = new TextEncoder().encode('test message');
+            const data2 = new TextEncoder().encode('test message!');
+            const mac = computeHmac(keys.K_auth, data1);
+            expect(verifyHmac(keys.K_auth, data2, mac)).toBe(false);
+        });
+    });
+    describe('Base64URL encoding', () => {
+        it('should encode and decode correctly', () => {
+            const data = new Uint8Array([1, 2, 3, 255, 0, 128]);
+            const encoded = base64UrlEncode(data);
+            expect(encoded).not.toContain('+');
+            expect(encoded).not.toContain('/');
+            expect(encoded).not.toContain('=');
+            const decoded = base64UrlDecode(encoded);
+            expect(decoded).toEqual(data);
+        });
+        it('should handle empty data', () => {
+            const data = new Uint8Array(0);
+            const encoded = base64UrlEncode(data);
+            const decoded = base64UrlDecode(encoded);
+            expect(decoded).toEqual(data);
+        });
+    });
+    describe('Policy hashing', () => {
+        it('should hash policy consistently', () => {
+            const policy = { singleRun: true };
+            const hash1 = hashPolicy(policy);
+            const hash2 = hashPolicy(policy);
+            expect(hash1).toEqual(hash2);
+        });
+        it('should produce different hashes for different policies', () => {
+            const policy1 = { singleRun: true };
+            const policy2 = { singleRun: false };
+            const hash1 = hashPolicy(policy1);
+            const hash2 = hashPolicy(policy2);
+            expect(hash1).not.toEqual(hash2);
+        });
+    });
+});
+//# sourceMappingURL=index.test.js.map

package/dist/index.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EACL,UAAU,EACV,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,UAAU,EACV,WAAW,EACX,WAAW,EACX,WAAW,EACX,UAAU,EACV,eAAe,EACf,eAAe,EACf,UAAU,GACX,MAAM,YAAY,CAAC;AAEpB,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YAE3C,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAEjC,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;YAE7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAEhC,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;YAE3C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YAEpC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAEhD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;YACnE,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;YACjC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YAEpC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAEjD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,aAAa,EAAE,CAAC;YAC3C,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,aAAa,EAAE,CAAC;YAE3C,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAE9C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAE/C,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,IAAI,CAAC;YAClB,MAAM,GAAG,GAAG,CAAC,CAAC;YAEd,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAExE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAE/D,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;YACjC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YAEpC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAEjD,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACnC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;YAEvE,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACxE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAE/C,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACnC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;YAEtE,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAE/C,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACnC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;YAEtE,MAAM,CAAC,CAAC,CAAE,IAAI,IAAI,CAAC,CAAC,yBAAyB;YAE7C,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE;QACpB,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAE/C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAE3C,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC7B,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;YACjC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YAEpC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAEjD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAE5C,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAE/C,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAE5C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YAEtC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAEnC,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;YAClC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YAEzC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAEnC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAEjC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAErC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YAElC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/stream-crypto.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Stream-aware AEAD encryption that handles counters separately
+ */
+export declare function streamAeadEncrypt(K_enc: Uint8Array, plaintext: Uint8Array, aad: Uint8Array): Promise<Uint8Array>;
+/**
+ * Stream-aware AEAD decryption that handles counters separately
+ */
+export declare function streamAeadDecrypt(K_enc: Uint8Array, payload: Uint8Array, aad: Uint8Array): Promise<Uint8Array>;
+//# sourceMappingURL=stream-crypto.d.ts.map

package/dist/stream-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-crypto.d.ts","sourceRoot":"","sources":["../src/stream-crypto.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,UAAU,EACrB,GAAG,EAAE,UAAU,GACd,OAAO,CAAC,UAAU,CAAC,CAmBrB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,UAAU,GACd,OAAO,CAAC,UAAU,CAAC,CA2BrB"}

package/dist/stream-crypto.js

@@ -0,0 +1,38 @@
+import sodium from 'libsodium-wrappers-sumo';
+import { CRYPTO_PARAMS } from '@thenewlabs/entangle-protocol';
+/**
+ * Stream-aware AEAD encryption that handles counters separately
+ */
+export async function streamAeadEncrypt(K_enc, plaintext, aad) {
+    await sodium.ready;
+    const nonce = sodium.randombytes_buf(CRYPTO_PARAMS.NONCE_BYTES);
+    const cipher = sodium.crypto_aead_xchacha20poly1305_ietf_encrypt(plaintext, aad, null, nonce, K_enc);
+    // Combine nonce and cipher for transport
+    const result = new Uint8Array(nonce.length + cipher.length);
+    result.set(nonce, 0);
+    result.set(cipher, nonce.length);
+    return result;
+}
+/**
+ * Stream-aware AEAD decryption that handles counters separately
+ */
+export async function streamAeadDecrypt(K_enc, payload, aad) {
+    await sodium.ready;
+    const minLength = CRYPTO_PARAMS.NONCE_BYTES + sodium.crypto_aead_xchacha20poly1305_ietf_ABYTES;
+    if (payload.length < minLength) {
+        throw new Error(`Payload too short: expected at least ${minLength} bytes, got ${payload.length}`);
+    }
+    const nonce = payload.slice(0, CRYPTO_PARAMS.NONCE_BYTES);
+    const cipher = payload.slice(CRYPTO_PARAMS.NONCE_BYTES);
+    try {
+        // NOTE: libsodium-wrappers signature is (nsec, cipher, aad, nonce, key)
+        // Keep it consistent with aeadDecrypt in index.ts
+        const plaintext = sodium.crypto_aead_xchacha20poly1305_ietf_decrypt(null, cipher, aad, nonce, K_enc);
+        return plaintext;
+    }
+    catch (e) {
+        // Add more context to the error
+        throw new Error(`streamAeadDecrypt failed: ${e.message || e}. Payload length: ${payload.length}, Nonce length: ${nonce.length}, Cipher length: ${cipher.length}, Key length: ${K_enc.length}, AAD length: ${aad.length}`);
+    }
+}
+//# sourceMappingURL=stream-crypto.js.map

package/dist/stream-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-crypto.js","sourceRoot":"","sources":["../src/stream-crypto.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,yBAAyB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAE9D;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAiB,EACjB,SAAqB,EACrB,GAAe;IAEf,MAAM,MAAM,CAAC,KAAK,CAAC;IAEnB,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;IAEhE,MAAM,MAAM,GAAG,MAAM,CAAC,0CAA0C,CAC9D,SAAS,EACT,GAAG,EACH,IAAI,EACJ,KAAK,EACL,KAAK,CACN,CAAC;IAEF,yCAAyC;IACzC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAiB,EACjB,OAAmB,EACnB,GAAe;IAEf,MAAM,MAAM,CAAC,KAAK,CAAC;IAEnB,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,GAAG,MAAM,CAAC,yCAAyC,CAAC;IAC/F,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,wCAAwC,SAAS,eAAe,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;IAExD,IAAI,CAAC;QACH,wEAAwE;QACxE,kDAAkD;QAClD,MAAM,SAAS,GAAG,MAAM,CAAC,0CAA0C,CACjE,IAAI,EACJ,MAAM,EACN,GAAG,EACH,KAAK,EACL,KAAK,CACN,CAAC;QAEF,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,gCAAgC;QAChC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,OAAO,IAAI,CAAC,qBAAqB,OAAO,CAAC,MAAM,mBAAmB,KAAK,CAAC,MAAM,oBAAoB,MAAM,CAAC,MAAM,iBAAiB,KAAK,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5N,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "@thenewlabs/entangle-crypto",
+  "version": "1.0.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@noble/hashes": "^1.8.0",
+    "@thenewlabs/entangle-protocol": "^1.0.0",
+    "cborg": "^4.5.8",
+    "libsodium-wrappers-sumo": "^0.8.4"
+  },
+  "devDependencies": {
+    "@types/libsodium-wrappers-sumo": "^0.8.2",
+    "@types/node": "^20.19.43",
+    "typescript": "^5.9.3"
+  },
+  "files": [
+    "dist"
+  ]
+}