@vaultsandbox/client 0.9.0 → 0.9.2

package/README.md

@@ -14,36 +14,15 @@
 [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 [![Node.js](https://img.shields.io/badge/node-%3E%3D20.0.0-brightgreen.svg)](https://nodejs.org/)
 
-**Production-like email testing. Self-hosted & secure.**
+**Production-like email testing. Self-hosted and secure.**
 
-The official Node.js SDK for [VaultSandbox Gateway](https://github.com/vaultsandbox/gateway) — a secure, receive-only SMTP server for QA/testing environments. This SDK abstracts encryption complexity, making email testing workflows transparent and effortless.
+The official Node.js SDK for [VaultSandbox Gateway](https://github.com/vaultsandbox/gateway) — a self-hosted SMTP testing platform that replicates real-world email delivery with TLS, authentication, spam analysis, chaos engineering, and zero-knowledge encryption.
 
-Stop mocking your email stack. If your app sends real emails in production, it must send real emails in testing. VaultSandbox provides isolated inboxes that behave exactly like production without exposing a single byte of customer data.
+Stop mocking. Test email like production.
 
-> **Node.js 20+** required. Not intended for browsers or edge runtimes.
+**[See full feature list →](https://github.com/vaultsandbox/gateway)**
 
-## Why VaultSandbox?
-
-| Feature             | Simple Mocks     | Public SaaS  | **VaultSandbox**    |
-| :------------------ | :--------------- | :----------- | :------------------ |
-| **TLS/SSL**         | Ignored/Disabled | Partial      | **Real ACME certs** |
-| **Data Privacy**    | Local only       | Shared cloud | **Private VPC**     |
-| **Inbound Mail**    | Outbound only    | Yes          | **Real MX**         |
-| **Auth (SPF/DKIM)** | None             | Limited      | **Full Validation** |
-| **Crypto**          | Plaintext        | Varies       | **Zero-Knowledge**  |
-
-## Features
-
-- **Quantum-Safe Encryption** — Automatic ML-KEM-768 (Kyber768) key encapsulation + AES-256-GCM encryption
-- **Zero Crypto Knowledge Required** — All cryptographic operations are invisible to the user
-- **Real-Time Email Delivery** — SSE-based delivery with smart polling fallback
-- **Built for CI/CD** — Deterministic tests without sleeps, polling, or flakiness
-- **Full Email Access** — Decrypt and access email content, headers, links, and attachments
-- **Email Authentication** — Built-in SPF/DKIM/DMARC validation helpers
-- **[Spam Analysis](https://vaultsandbox.dev/client-node/concepts/spam-analysis/)** — Rspamd integration for spam scores, classifications, and rule analysis
-- **[Webhooks](https://vaultsandbox.dev/client-node/guides/webhooks/)** — Global and per-inbox HTTP callbacks for email events with filtering and templates
-- **[Chaos Engineering](https://vaultsandbox.dev/client-node/guides/chaos/)** — Per-inbox SMTP failure simulation (latency, drops, errors, greylisting, blackhole)
-- **Type-Safe** — Full TypeScript support with comprehensive type definitions
+> **Node.js 20+** required. Not intended for browsers or edge runtimes.
 
 ## Installation
 
@@ -277,6 +256,45 @@ const subscription = inbox.onNewEmail((email) => {
 // subscription.unsubscribe();
 ```
 
+### Webhooks
+
+Get notified when emails arrive via HTTP webhooks.
+
+```javascript
+const inbox = await client.createInbox();
+
+// Create a webhook
+const webhook = await inbox.createWebhook({
+  url: 'https://your-server.com/webhook',
+  events: ['email.received'],
+  template: 'slack', // Or 'discord', 'teams', 'default'
+});
+
+console.log('Webhook secret:', webhook.secret); // Use for signature verification
+```
+
+### Chaos Engineering
+
+Test your application's resilience by simulating email delivery issues.
+
+```javascript
+const inbox = await client.createInbox();
+
+// Enable latency injection
+await inbox.setChaosConfig({
+  enabled: true,
+  latency: {
+    enabled: true,
+    minDelayMs: 1000,
+    maxDelayMs: 5000,
+    probability: 0.5, // 50% of emails affected
+  },
+});
+
+// Disable when done
+await inbox.disableChaos();
+```
+
 ## API Reference
 
 ### VaultSandboxClient

package/dist/client.d.ts

@@ -47,6 +47,7 @@ export declare class VaultSandboxClient {
     private config;
     private serverPublicKey;
     private encryptionPolicy;
+    private maxTtl;
     private inboxes;
     private strategy;
     /**
@@ -263,6 +264,16 @@ export declare class VaultSandboxClient {
     importInboxFromFile(filePath: string): Promise<Inbox>;
     /**
      * Closes the client, terminates any active connections, and cleans up resources.
+     *
+     * This method performs a graceful shutdown by:
+     * 1. Unsubscribing all inboxes from email notifications
+     * 2. Waiting for pending operations to complete (up to timeout)
+     * 3. Closing the delivery strategy connection
+     * 4. Clearing all tracked inboxes
+     *
+     * @returns A promise that resolves when the client is closed
+     * @example
+     * await client.close();
      */
     close(): Promise<void>;
 }

package/dist/client.js

@@ -64,6 +64,7 @@ export class VaultSandboxClient {
     config;
     serverPublicKey = null;
     encryptionPolicy = null;
+    maxTtl = null;
     inboxes = new Map();
     strategy = null;
     /**
@@ -86,6 +87,7 @@ export class VaultSandboxClient {
         const serverInfo = await this.apiClient.getServerInfo();
         this.serverPublicKey = serverInfo.serverSigPk;
         this.encryptionPolicy = serverInfo.encryptionPolicy;
+        this.maxTtl = serverInfo.maxTtl;
         // Create delivery strategy based on config
         // Note: SSE for email events (/api/events) is always available
         this.strategy = this.createStrategy();
@@ -118,6 +120,7 @@ export class VaultSandboxClient {
                 reconnectInterval: this.config.sseReconnectInterval ?? 5000,
                 maxReconnectAttempts: this.config.sseMaxReconnectAttempts ?? 10,
                 backoffMultiplier: 2,
+                maxCacheSize: this.config.sseMaxCacheSize,
             });
         }
         // Polling strategy (explicit only)
@@ -143,6 +146,18 @@ export class VaultSandboxClient {
      */
     async createInbox(options = {}) {
         await this.ensureInitialized();
+        // Validate TTL if provided
+        if (options.ttl !== undefined) {
+            if (typeof options.ttl !== 'number' || !Number.isInteger(options.ttl)) {
+                throw new Error('TTL must be an integer');
+            }
+            if (options.ttl <= 0) {
+                throw new Error('TTL must be positive');
+            }
+            if (this.maxTtl && options.ttl > this.maxTtl) {
+                throw new Error(`TTL exceeds server maximum of ${this.maxTtl} seconds`);
+            }
+        }
         const useEncryption = this.shouldEncrypt(options);
         // Generate keypair only for encrypted inboxes
         const keypair = useEncryption ? generateKeypair() : null;
@@ -532,12 +547,29 @@ export class VaultSandboxClient {
     }
     /**
      * Closes the client, terminates any active connections, and cleans up resources.
+     *
+     * This method performs a graceful shutdown by:
+     * 1. Unsubscribing all inboxes from email notifications
+     * 2. Waiting for pending operations to complete (up to timeout)
+     * 3. Closing the delivery strategy connection
+     * 4. Clearing all tracked inboxes
+     *
+     * @returns A promise that resolves when the client is closed
+     * @example
+     * await client.close();
      */
     async close() {
+        debug('Closing client');
+        // Unsubscribe all inboxes (synchronous)
+        for (const inbox of this.inboxes.values()) {
+            inbox.unsubscribeAll();
+        }
+        // Close the delivery strategy
         if (this.strategy) {
             this.strategy.close();
         }
         this.inboxes.clear();
+        debug('Client closed successfully');
     }
 }
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,WAAW,MAAM,OAAO,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAClG,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAanE,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAE1B,MAAM,KAAK,GAAG,WAAW,CAAC,qBAAqB,CAAC,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,YAAa,SAAQ,YAAY;IACpC,aAAa,GAAmB,EAAE,CAAC;IAE3C;;;;OAIG;IACH,eAAe,CAAC,YAA0B;QACxC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,WAAW;QACT,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,KAAY,EAAE,KAAa;QACnC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,kBAAkB;IACrB,SAAS,CAAY;IACrB,MAAM,CAAe;IACrB,eAAe,GAAkB,IAAI,CAAC;IACtC,gBAAgB,GAA4B,IAAI,CAAC;IACjD,OAAO,GAAuB,IAAI,GAAG,EAAE,CAAC;IACxC,QAAQ,GAA4B,IAAI,CAAC;IAEjD;;;OAGG;IACH,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QACxD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,WAAW,CAAC;QAC9C,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;QAEpD,2CAA2C;QAC3C,+DAA+D;QAC/D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;IACxC,CAAC;IAED;;;OAGG;IACK,aAAa,CAAC,OAA2B;QAC/C,mDAAmD;QACnD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC,UAAU,KAAK,WAAW,CAAC;QAC5C,CAAC;QACD,qCAAqC;QACrC,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACK,cAAc;QACpB,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;QAEnD,yBAAyB;QACzB,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;YAC3B,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACnD,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE;gBACrC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;gBACpB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,IAAI;gBAC3D,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,uBAAuB,IAAI,EAAE;gBAC/D,iBAAiB,EAAE,CAAC;aACrB,CAAC,CAAC;QACL,CAAC;QAED,mCAAmC;QACnC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAChC,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE;YACzC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,IAAI;YACpD,UAAU,EAAE,KAAK;YACjB,iBAAiB,EAAE,GAAG;YACtB,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,WAAW,CAAC,UAA8B,EAAE;QAChD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAElD,8CAA8C;QAC9C,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAEzD,yBAAyB;QACzB,IAAI,SAAoB,CAAC;QACzB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAC1C,OAAO,EAAE,YAAY,EACrB,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,KAAK,CACd,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kDAAkD;YAClD,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC1D,iEAAiE;gBACjE,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,mBAAmB,CAAC;gBAC5D,MAAM,IAAI,uBAAuB,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,wBAAwB;QACxB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;QAE3F,wBAAwB;QACxB,2EAA2E;QAC3E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,cAAc;QACd,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAE5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,0FAA0F;IAC1F,KAAK,CAAC,gBAAgB;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,YAAoB;QACpC,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa;QACjB,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,OAAgB;QAC7B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,aAAa,CAAC,yDAAyD,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,YAAY,EAAE,CAAC;QAEnC,0BAA0B;QAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC9C,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;OAUG;IACH,WAAW,CAAC,YAA4B;QACtC,yBAAyB;QACzB,MAAM,YAAY,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC;QACjG,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAE7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,YAAY,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,WAAW,CAAC,IAAuB;QACvC,2BAA2B;QAC3B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE3B,kEAAkE;QAClE,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAElC,gCAAgC;QAChC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE7C,6BAA6B;QAC7B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEvC,8BAA8B;QAC9B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAE9B,uBAAuB;QACvB,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE/C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,oEAAoE;QACpE,IAAI,OAAO,GAAmB,IAAI,CAAC;QACnC,wEAAwE;QACxE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,0CAA0C;YAC1C,mFAAmF;YACnF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC/C,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,sBAAsB,CAAC,+CAA+C,CAAC,CAAC;YACpF,CAAC;YAED,wCAAwC;YACxC,mFAAmF;YACnF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,sBAAsB,CAAC,6CAA6C,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE5C,OAAO,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,IAAuB;QAC7C,IAAI,IAAI,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;YACpC,MAAM,IAAI,sBAAsB,CAAC,wBAAwB,IAAI,CAAC,OAAO,cAAc,cAAc,EAAE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,sBAAsB,CAAC,IAAuB;QACpD,mCAAmC;QACnC,MAAM,oBAAoB,GAAgC,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;QAEnH,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBAChG,MAAM,IAAI,sBAAsB,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACxC,iEAAiE;YACjE,MAAM,IAAI,sBAAsB,CAAC,qCAAqC,CAAC,CAAC;QAC1E,CAAC;QAED,oEAAoE;QACpE,oEAAoE;IACtE,CAAC;IAED;;;;;OAKG;IACK,oBAAoB,CAAC,YAAoB;QAC/C,MAAM,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACxD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,sBAAsB,CAAC,6DAA6D,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,SAAiB;QACzC,2FAA2F;QAC3F,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAsB,CAAC,uCAAuC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,uBAAuB,CAAC,WAAmB;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;gBAC7C,MAAM,IAAI,sBAAsB,CAC9B,4CAA4C,qBAAqB,SAAS,OAAO,CAAC,MAAM,EAAE,CAC3F,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAsB;gBAAE,MAAM,KAAK,CAAC;YACzD,MAAM,QAAQ,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnG,MAAM,IAAI,sBAAsB,CAAC,uCAAuC,QAAQ,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,IAAuB;QAChD,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,sBAAsB,CAAC,YAAoB;QACjD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,uBAAuB,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,uBAAuB,CAAC,WAAmB;QACjD,IAAI,WAAW,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YACzC,MAAM,IAAI,sBAAsB,CAAC,4EAA4E,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,qBAAqB,CAAC,IAAuB;QACnD,6FAA6F;QAC7F,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAU,EAAE,QAAQ,CAAC,CAAC;QACrE,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;QAE7D,0DAA0D;QAC1D,MAAM,SAAS,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;QAEvD,OAAO;YACL,SAAS;YACT,SAAS;YACT,YAAY,EAAE,WAAW,CAAC,SAAS,CAAC;SACrC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,kBAAkB,CAAC,SAAiB,EAAE,OAAe;QAC3D,IAAI,CAAC;YACH,OAAO,aAAa,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,sBAAsB,CAAC,iCAAiC,OAAO,MAAM,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,iBAAiB,CAAC,GAAe,EAAE,cAAsB,EAAE,OAAe;QAChF,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YAClC,MAAM,IAAI,sBAAsB,CAAC,WAAW,OAAO,yBAAyB,cAAc,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,cAAc,CAAC,IAAuB;QAC5C,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB,CAAC,SAAoB,EAAE,OAAuB;QACvE,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,SAAS,EACT,OAAO,EACP,IAAI,CAAC,SAAS,EACd,SAAS,CAAC,WAAW,IAAI,0BAA0B,CAAC,IAAI,CACzD,CAAC;QAEF,2EAA2E;QAC3E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,YAA4B,EAAE,QAAgB;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,mBAAmB,CAAC,QAAgB;QACxC,IAAI,IAAuB,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACvD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,sBAAsB,CAC9B,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAC5F,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,WAAW,MAAM,OAAO,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAClG,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAanE,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAE1B,MAAM,KAAK,GAAG,WAAW,CAAC,qBAAqB,CAAC,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,YAAa,SAAQ,YAAY;IACpC,aAAa,GAAmB,EAAE,CAAC;IAE3C;;;;OAIG;IACH,eAAe,CAAC,YAA0B;QACxC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,WAAW;QACT,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,KAAY,EAAE,KAAa;QACnC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,kBAAkB;IACrB,SAAS,CAAY;IACrB,MAAM,CAAe;IACrB,eAAe,GAAkB,IAAI,CAAC;IACtC,gBAAgB,GAA4B,IAAI,CAAC;IACjD,MAAM,GAAkB,IAAI,CAAC;IAC7B,OAAO,GAAuB,IAAI,GAAG,EAAE,CAAC;IACxC,QAAQ,GAA4B,IAAI,CAAC;IAEjD;;;OAGG;IACH,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QACxD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,WAAW,CAAC;QAC9C,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;QACpD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAEhC,2CAA2C;QAC3C,+DAA+D;QAC/D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;IACxC,CAAC;IAED;;;OAGG;IACK,aAAa,CAAC,OAA2B;QAC/C,mDAAmD;QACnD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC,UAAU,KAAK,WAAW,CAAC;QAC5C,CAAC;QACD,qCAAqC;QACrC,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACK,cAAc;QACpB,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;QAEnD,yBAAyB;QACzB,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;YAC3B,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACnD,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE;gBACrC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;gBACpB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,IAAI;gBAC3D,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,uBAAuB,IAAI,EAAE;gBAC/D,iBAAiB,EAAE,CAAC;gBACpB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;aAC1C,CAAC,CAAC;QACL,CAAC;QAED,mCAAmC;QACnC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAChC,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE;YACzC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,IAAI;YACpD,UAAU,EAAE,KAAK;YACjB,iBAAiB,EAAE,GAAG;YACtB,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,WAAW,CAAC,UAA8B,EAAE;QAChD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,2BAA2B;QAC3B,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,MAAM,UAAU,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAElD,8CAA8C;QAC9C,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAEzD,yBAAyB;QACzB,IAAI,SAAoB,CAAC;QACzB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAC1C,OAAO,EAAE,YAAY,EACrB,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,KAAK,CACd,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kDAAkD;YAClD,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC1D,iEAAiE;gBACjE,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,mBAAmB,CAAC;gBAC5D,MAAM,IAAI,uBAAuB,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,wBAAwB;QACxB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;QAE3F,wBAAwB;QACxB,2EAA2E;QAC3E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,cAAc;QACd,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAE5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,0FAA0F;IAC1F,KAAK,CAAC,gBAAgB;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,YAAoB;QACpC,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa;QACjB,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,OAAgB;QAC7B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,aAAa,CAAC,yDAAyD,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,YAAY,EAAE,CAAC;QAEnC,0BAA0B;QAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC9C,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;OAUG;IACH,WAAW,CAAC,YAA4B;QACtC,yBAAyB;QACzB,MAAM,YAAY,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC;QACjG,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAE7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,YAAY,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,WAAW,CAAC,IAAuB;QACvC,2BAA2B;QAC3B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE3B,kEAAkE;QAClE,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAElC,gCAAgC;QAChC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE7C,6BAA6B;QAC7B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEvC,8BAA8B;QAC9B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAE9B,uBAAuB;QACvB,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE/C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,oEAAoE;QACpE,IAAI,OAAO,GAAmB,IAAI,CAAC;QACnC,wEAAwE;QACxE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,0CAA0C;YAC1C,mFAAmF;YACnF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC/C,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,sBAAsB,CAAC,+CAA+C,CAAC,CAAC;YACpF,CAAC;YAED,wCAAwC;YACxC,mFAAmF;YACnF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,sBAAsB,CAAC,6CAA6C,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE5C,OAAO,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,IAAuB;QAC7C,IAAI,IAAI,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;YACpC,MAAM,IAAI,sBAAsB,CAAC,wBAAwB,IAAI,CAAC,OAAO,cAAc,cAAc,EAAE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,sBAAsB,CAAC,IAAuB;QACpD,mCAAmC;QACnC,MAAM,oBAAoB,GAAgC,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;QAEnH,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBAChG,MAAM,IAAI,sBAAsB,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACxC,iEAAiE;YACjE,MAAM,IAAI,sBAAsB,CAAC,qCAAqC,CAAC,CAAC;QAC1E,CAAC;QAED,oEAAoE;QACpE,oEAAoE;IACtE,CAAC;IAED;;;;;OAKG;IACK,oBAAoB,CAAC,YAAoB;QAC/C,MAAM,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACxD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,sBAAsB,CAAC,6DAA6D,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,SAAiB;QACzC,2FAA2F;QAC3F,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAsB,CAAC,uCAAuC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,uBAAuB,CAAC,WAAmB;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;gBAC7C,MAAM,IAAI,sBAAsB,CAC9B,4CAA4C,qBAAqB,SAAS,OAAO,CAAC,MAAM,EAAE,CAC3F,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAsB;gBAAE,MAAM,KAAK,CAAC;YACzD,MAAM,QAAQ,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnG,MAAM,IAAI,sBAAsB,CAAC,uCAAuC,QAAQ,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,IAAuB;QAChD,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,sBAAsB,CAAC,YAAoB;QACjD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,uBAAuB,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,uBAAuB,CAAC,WAAmB;QACjD,IAAI,WAAW,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YACzC,MAAM,IAAI,sBAAsB,CAAC,4EAA4E,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,qBAAqB,CAAC,IAAuB;QACnD,6FAA6F;QAC7F,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAU,EAAE,QAAQ,CAAC,CAAC;QACrE,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;QAE7D,0DAA0D;QAC1D,MAAM,SAAS,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;QAEvD,OAAO;YACL,SAAS;YACT,SAAS;YACT,YAAY,EAAE,WAAW,CAAC,SAAS,CAAC;SACrC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,kBAAkB,CAAC,SAAiB,EAAE,OAAe;QAC3D,IAAI,CAAC;YACH,OAAO,aAAa,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,sBAAsB,CAAC,iCAAiC,OAAO,MAAM,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,iBAAiB,CAAC,GAAe,EAAE,cAAsB,EAAE,OAAe;QAChF,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YAClC,MAAM,IAAI,sBAAsB,CAAC,WAAW,OAAO,yBAAyB,cAAc,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,cAAc,CAAC,IAAuB;QAC5C,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB,CAAC,SAAoB,EAAE,OAAuB;QACvE,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,SAAS,EACT,OAAO,EACP,IAAI,CAAC,SAAS,EACd,SAAS,CAAC,WAAW,IAAI,0BAA0B,CAAC,IAAI,CACzD,CAAC;QAEF,2EAA2E;QAC3E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,YAA4B,EAAE,QAAgB;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,mBAAmB,CAAC,QAAgB;QACxC,IAAI,IAAuB,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACvD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,sBAAsB,CAC9B,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAC5F,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,KAAK;QACT,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAExB,wCAAwC;QACxC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACtC,CAAC;CACF"}

package/dist/crypto/decrypt.d.ts

@@ -3,40 +3,69 @@
  * Based on working reference implementation
  */
 import type { Keypair, EncryptedData } from '../types/index.js';
+/**
+ * Pre-decoded payload fields to avoid redundant base64 decoding.
+ * Used to pass decoded values between validation, signature verification, and decryption.
+ */
+export interface DecodedPayload {
+    ctKem: Uint8Array;
+    nonce: Uint8Array;
+    aad: Uint8Array;
+    ciphertext: Uint8Array;
+    sig: Uint8Array;
+    serverSigPk: Uint8Array;
+}
+/**
+ * Decodes all base64url-encoded fields from the encrypted payload.
+ * Call once and pass the result to validatePayload, verifySignature, and decrypt operations.
+ *
+ * @param encryptedData - The encrypted data from the server
+ * @returns Pre-decoded payload fields
+ * @throws DecryptionError if decoding fails
+ */
+export declare function decodePayload(encryptedData: EncryptedData): DecodedPayload;
 /**
  * Decrypts an encrypted payload using the complete reference implementation flow
  * See vaultsandbox-spec.md Section 8: Decryption Process
  *
  * @param encryptedData - The encrypted data from the server
  * @param keypair - The recipient's keypair
+ * @param expectedServerPublicKey - Optional expected server public key (base64url) for MITM protection
  * @returns The decrypted plaintext as a Uint8Array
  * @throws DecryptionError if decryption fails
+ * @throws SignatureVerificationError if server key doesn't match expected
  */
-export declare function decrypt(encryptedData: EncryptedData, keypair: Keypair): Promise<Uint8Array>;
+export declare function decrypt(encryptedData: EncryptedData, keypair: Keypair, expectedServerPublicKey?: string): Promise<Uint8Array>;
 /**
  * Decrypts and parses email metadata
  *
  * @param encryptedData - The encrypted metadata
  * @param keypair - The recipient's keypair
+ * @param expectedServerPublicKey - Optional expected server public key (base64url) for MITM protection
  * @returns The decrypted metadata as a parsed JSON object
  * @throws DecryptionError if decryption or parsing fails
+ * @throws SignatureVerificationError if server key doesn't match expected
  */
-export declare function decryptMetadata<T = unknown>(encryptedData: EncryptedData, keypair: Keypair): Promise<T>;
+export declare function decryptMetadata<T = unknown>(encryptedData: EncryptedData, keypair: Keypair, expectedServerPublicKey?: string): Promise<T>;
 /**
  * Decrypts and parses email body (parsed content)
  *
  * @param encryptedData - The encrypted parsed content
  * @param keypair - The recipient's keypair
+ * @param expectedServerPublicKey - Optional expected server public key (base64url) for MITM protection
  * @returns The decrypted parsed content as a JSON object
  * @throws DecryptionError if decryption or parsing fails
+ * @throws SignatureVerificationError if server key doesn't match expected
  */
-export declare function decryptParsed<T = unknown>(encryptedData: EncryptedData, keypair: Keypair): Promise<T>;
+export declare function decryptParsed<T = unknown>(encryptedData: EncryptedData, keypair: Keypair, expectedServerPublicKey?: string): Promise<T>;
 /**
  * Decrypts raw email source
  *
  * @param encryptedData - The encrypted raw email
  * @param keypair - The recipient's keypair
+ * @param expectedServerPublicKey - Optional expected server public key (base64url) for MITM protection
  * @returns The decrypted raw email as a string
  * @throws DecryptionError if decryption fails
+ * @throws SignatureVerificationError if server key doesn't match expected
  */
-export declare function decryptRaw(encryptedData: EncryptedData, keypair: Keypair): Promise<string>;
+export declare function decryptRaw(encryptedData: EncryptedData, keypair: Keypair, expectedServerPublicKey?: string): Promise<string>;

package/dist/crypto/decrypt.js

@@ -8,11 +8,38 @@ import { DecryptionError, SignatureVerificationError } from '../types/index.js';
 import { verifySignature } from './signature.js';
 import { deriveKey } from './keypair.js';
 import { HKDF_CONTEXT, PROTOCOL_VERSION, MLKEM_CIPHERTEXT_SIZE, AES_NONCE_SIZE, MLDSA_SIGNATURE_SIZE, MLDSA_PUBLIC_KEY_SIZE, } from './constants.js';
+/**
+ * Decodes all base64url-encoded fields from the encrypted payload.
+ * Call once and pass the result to validatePayload, verifySignature, and decrypt operations.
+ *
+ * @param encryptedData - The encrypted data from the server
+ * @returns Pre-decoded payload fields
+ * @throws DecryptionError if decoding fails
+ */
+export function decodePayload(encryptedData) {
+    try {
+        return {
+            ctKem: fromBase64Url(encryptedData.ct_kem),
+            nonce: fromBase64Url(encryptedData.nonce),
+            aad: fromBase64Url(encryptedData.aad),
+            ciphertext: fromBase64Url(encryptedData.ciphertext),
+            sig: fromBase64Url(encryptedData.sig),
+            serverSigPk: fromBase64Url(encryptedData.server_sig_pk),
+        };
+    }
+    catch (error) {
+        /* istanbul ignore next - defensive for non-Error exceptions */
+        const message = error instanceof Error ? error.message : String(error);
+        throw new DecryptionError(`Failed to decode payload: ${message}`);
+    }
+}
 /**
  * Validates the encrypted payload structure and sizes per spec Section 8.1
+ * @param encryptedData - The encrypted payload metadata
+ * @param decoded - Optional pre-decoded payload fields to avoid redundant decoding
  * @throws DecryptionError if validation fails
  */
-function validatePayload(encryptedData) {
+function validatePayload(encryptedData, decoded) {
     // Step 2: Validate version
     if (encryptedData.v !== PROTOCOL_VERSION) {
         throw new DecryptionError(`Unsupported protocol version: ${encryptedData.v}, expected ${PROTOCOL_VERSION}`);
@@ -31,31 +58,20 @@ function validatePayload(encryptedData) {
     if (algs.kdf !== 'HKDF-SHA-512') {
         throw new DecryptionError(`Unsupported KDF algorithm: ${algs.kdf}`);
     }
-    // Step 4: Validate decoded sizes (decode first, then check)
-    try {
-        const ctKem = fromBase64Url(encryptedData.ct_kem);
-        if (ctKem.length !== MLKEM_CIPHERTEXT_SIZE) {
-            throw new DecryptionError(`Invalid ct_kem size: expected ${MLKEM_CIPHERTEXT_SIZE}, got ${ctKem.length}`);
-        }
-        const nonce = fromBase64Url(encryptedData.nonce);
-        if (nonce.length !== AES_NONCE_SIZE) {
-            throw new DecryptionError(`Invalid nonce size: expected ${AES_NONCE_SIZE}, got ${nonce.length}`);
-        }
-        const sig = fromBase64Url(encryptedData.sig);
-        if (sig.length !== MLDSA_SIGNATURE_SIZE) {
-            throw new DecryptionError(`Invalid signature size: expected ${MLDSA_SIGNATURE_SIZE}, got ${sig.length}`);
-        }
-        const serverSigPk = fromBase64Url(encryptedData.server_sig_pk);
-        if (serverSigPk.length !== MLDSA_PUBLIC_KEY_SIZE) {
-            throw new DecryptionError(`Invalid server public key size: expected ${MLDSA_PUBLIC_KEY_SIZE}, got ${serverSigPk.length}`);
-        }
+    // Step 4: Validate decoded sizes (use pre-decoded values if available)
+    /* istanbul ignore next - decoded is always passed from decrypt(), fallback is defensive */
+    const { ctKem, nonce, sig, serverSigPk } = decoded ?? decodePayload(encryptedData);
+    if (ctKem.length !== MLKEM_CIPHERTEXT_SIZE) {
+        throw new DecryptionError(`Invalid ct_kem size: expected ${MLKEM_CIPHERTEXT_SIZE}, got ${ctKem.length}`);
     }
-    catch (error) {
-        if (error instanceof DecryptionError)
-            throw error;
-        /* istanbul ignore next - defensive for non-Error exceptions */
-        const message = error instanceof Error ? error.message : String(error);
-        throw new DecryptionError(`Failed to decode payload: ${message}`);
+    if (nonce.length !== AES_NONCE_SIZE) {
+        throw new DecryptionError(`Invalid nonce size: expected ${AES_NONCE_SIZE}, got ${nonce.length}`);
+    }
+    if (sig.length !== MLDSA_SIGNATURE_SIZE) {
+        throw new DecryptionError(`Invalid signature size: expected ${MLDSA_SIGNATURE_SIZE}, got ${sig.length}`);
+    }
+    if (serverSigPk.length !== MLDSA_PUBLIC_KEY_SIZE) {
+        throw new DecryptionError(`Invalid server public key size: expected ${MLDSA_PUBLIC_KEY_SIZE}, got ${serverSigPk.length}`);
     }
 }
 /**
@@ -64,20 +80,22 @@ function validatePayload(encryptedData) {
  *
  * @param encryptedData - The encrypted data from the server
  * @param keypair - The recipient's keypair
+ * @param expectedServerPublicKey - Optional expected server public key (base64url) for MITM protection
  * @returns The decrypted plaintext as a Uint8Array
  * @throws DecryptionError if decryption fails
+ * @throws SignatureVerificationError if server key doesn't match expected
  */
-export async function decrypt(encryptedData, keypair) {
+export async function decrypt(encryptedData, keypair, expectedServerPublicKey) {
     try {
-        // Steps 1-4: Parse and validate payload (version, algorithms, sizes)
-        validatePayload(encryptedData);
+        // Step 1: Decode all base64url fields once
+        const decoded = decodePayload(encryptedData);
+        // Steps 2-4: Parse and validate payload (version, algorithms, sizes)
+        validatePayload(encryptedData, decoded);
         // Step 6: SECURITY: Verify signature BEFORE decryption (prevent tampering)
-        verifySignature(encryptedData);
-        // Step 7-9: Decode, decapsulate, derive key, decrypt
-        const ctKem = fromBase64Url(encryptedData.ct_kem);
-        const nonceBytes = fromBase64Url(encryptedData.nonce);
-        const aadBytes = fromBase64Url(encryptedData.aad);
-        const ciphertextBytes = fromBase64Url(encryptedData.ciphertext);
+        // Also validates server public key matches expected if provided (MITM protection)
+        verifySignature(encryptedData, decoded, expectedServerPublicKey);
+        // Step 7-9: Use pre-decoded values for decapsulation, key derivation, and decryption
+        const { ctKem, nonce: nonceBytes, aad: aadBytes, ciphertext: ciphertextBytes } = decoded;
         // 2. KEM Decapsulation to get shared secret
         const sharedSecret = ml_kem768.decapsulate(ctKem, ensureOwnBuffer(keypair.secretKey));
         // 3. Derive AES-256 key using HKDF-SHA-512
@@ -119,11 +137,13 @@ export async function decrypt(encryptedData, keypair) {
  *
  * @param encryptedData - The encrypted metadata
  * @param keypair - The recipient's keypair
+ * @param expectedServerPublicKey - Optional expected server public key (base64url) for MITM protection
  * @returns The decrypted metadata as a parsed JSON object
  * @throws DecryptionError if decryption or parsing fails
+ * @throws SignatureVerificationError if server key doesn't match expected
  */
-export async function decryptMetadata(encryptedData, keypair) {
-    const plaintext = await decrypt(encryptedData, keypair);
+export async function decryptMetadata(encryptedData, keypair, expectedServerPublicKey) {
+    const plaintext = await decrypt(encryptedData, keypair, expectedServerPublicKey);
     try {
         const jsonString = new TextDecoder().decode(plaintext);
         return JSON.parse(jsonString);
@@ -139,22 +159,26 @@ export async function decryptMetadata(encryptedData, keypair) {
  *
  * @param encryptedData - The encrypted parsed content
  * @param keypair - The recipient's keypair
+ * @param expectedServerPublicKey - Optional expected server public key (base64url) for MITM protection
  * @returns The decrypted parsed content as a JSON object
  * @throws DecryptionError if decryption or parsing fails
+ * @throws SignatureVerificationError if server key doesn't match expected
  */
-export async function decryptParsed(encryptedData, keypair) {
-    return decryptMetadata(encryptedData, keypair);
+export async function decryptParsed(encryptedData, keypair, expectedServerPublicKey) {
+    return decryptMetadata(encryptedData, keypair, expectedServerPublicKey);
 }
 /**
  * Decrypts raw email source
  *
  * @param encryptedData - The encrypted raw email
  * @param keypair - The recipient's keypair
+ * @param expectedServerPublicKey - Optional expected server public key (base64url) for MITM protection
  * @returns The decrypted raw email as a string
  * @throws DecryptionError if decryption fails
+ * @throws SignatureVerificationError if server key doesn't match expected
  */
-export async function decryptRaw(encryptedData, keypair) {
-    const plaintext = await decrypt(encryptedData, keypair);
+export async function decryptRaw(encryptedData, keypair, expectedServerPublicKey) {
+    const plaintext = await decrypt(encryptedData, keypair, expectedServerPublicKey);
     try {
         // Decrypted content is a base64-encoded string
         const base64String = new TextDecoder().decode(plaintext);

package/dist/crypto/decrypt.js.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../../src/crypto/decrypt.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAExB;;;GAGG;AACH,SAAS,eAAe,CAAC,aAA4B;IACnD,2BAA2B;IAC3B,IAAI,aAAa,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC;QACzC,MAAM,IAAI,eAAe,CAAC,iCAAiC,aAAa,CAAC,CAAC,cAAc,gBAAgB,EAAE,CAAC,CAAC;IAC9G,CAAC;IAED,8BAA8B;IAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC;IAC/B,IAAI,IAAI,CAAC,GAAG,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,eAAe,CAAC,8BAA8B,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,CAAC,oCAAoC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAChC,MAAM,IAAI,eAAe,CAAC,+BAA+B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,cAAc,EAAE,CAAC;QAChC,MAAM,IAAI,eAAe,CAAC,8BAA8B,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,4DAA4D;IAC5D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;YAC3C,MAAM,IAAI,eAAe,CAAC,iCAAiC,qBAAqB,SAAS,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACpC,MAAM,IAAI,eAAe,CAAC,gCAAgC,cAAc,SAAS,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,MAAM,GAAG,GAAG,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CAAC,oCAAoC,oBAAoB,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAC/D,IAAI,WAAW,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;YACjD,MAAM,IAAI,eAAe,CACvB,4CAA4C,qBAAqB,SAAS,WAAW,CAAC,MAAM,EAAE,CAC/F,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,+DAA+D;QAC/D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,eAAe,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,aAA4B,EAAE,OAAgB;IAC1E,IAAI,CAAC;QACH,qEAAqE;QACrE,eAAe,CAAC,aAAa,CAAC,CAAC;QAE/B,2EAA2E;QAC3E,eAAe,CAAC,aAAa,CAAC,CAAC;QAE/B,qDAAqD;QACrD,MAAM,KAAK,GAAG,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,eAAe,GAAG,aAAa,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAEhE,4CAA4C;QAC5C,MAAM,YAAY,GAAG,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAEtF,2CAA2C;QAC3C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAE5E,8BAA8B;QAC9B,0CAA0C;QAC1C,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,eAAe,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;QAEzD,wFAAwF;QACxF,4FAA4F;QAC5F,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,WAAsC,EACtC,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;QAEF,wFAAwF;QACxF,4FAA4F;QAC5F,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C;YACE,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,UAAqC;YACzC,cAAc,EAAE,QAAmC;YACnD,SAAS,EAAE,GAAG,EAAE,WAAW;SAC5B,EACD,SAAS,EACT,eAA0C,CAC3C,CAAC;QAEF,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4EAA4E;QAC5E,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;YAChD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;YACrC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,+DAA+D;QAC/D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,eAAe,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAc,aAA4B,EAAE,OAAgB;IAC/F,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAM,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+DAA+D;QAC/D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,eAAe,CAAC,uCAAuC,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAc,aAA4B,EAAE,OAAgB;IAC7F,OAAO,eAAe,CAAI,aAAa,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,aAA4B,EAAE,OAAgB;IAC7E,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,+CAA+C;QAC/C,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzD,wDAAwD;QACxD,MAAM,aAAa,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAC/C,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+DAA+D;QAC/D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,eAAe,CAAC,yCAAyC,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC"}
+{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../../src/crypto/decrypt.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAexB;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,aAA4B;IACxD,IAAI,CAAC;QACH,OAAO;YACL,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC;YAC1C,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC;YACzC,GAAG,EAAE,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC;YACrC,UAAU,EAAE,aAAa,CAAC,aAAa,CAAC,UAAU,CAAC;YACnD,GAAG,EAAE,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC;YACrC,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,aAAa,CAAC;SACxD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+DAA+D;QAC/D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,eAAe,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,aAA4B,EAAE,OAAwB;IAC7E,2BAA2B;IAC3B,IAAI,aAAa,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC;QACzC,MAAM,IAAI,eAAe,CAAC,iCAAiC,aAAa,CAAC,CAAC,cAAc,gBAAgB,EAAE,CAAC,CAAC;IAC9G,CAAC;IAED,8BAA8B;IAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC;IAC/B,IAAI,IAAI,CAAC,GAAG,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,eAAe,CAAC,8BAA8B,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,CAAC,oCAAoC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAChC,MAAM,IAAI,eAAe,CAAC,+BAA+B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,cAAc,EAAE,CAAC;QAChC,MAAM,IAAI,eAAe,CAAC,8BAA8B,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,uEAAuE;IACvE,2FAA2F;IAC3F,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,OAAO,IAAI,aAAa,CAAC,aAAa,CAAC,CAAC;IAEnF,IAAI,KAAK,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;QAC3C,MAAM,IAAI,eAAe,CAAC,iCAAiC,qBAAqB,SAAS,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,eAAe,CAAC,gCAAgC,cAAc,SAAS,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACnG,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QACxC,MAAM,IAAI,eAAe,CAAC,oCAAoC,oBAAoB,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACjD,MAAM,IAAI,eAAe,CACvB,4CAA4C,qBAAqB,SAAS,WAAW,CAAC,MAAM,EAAE,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,aAA4B,EAC5B,OAAgB,EAChB,uBAAgC;IAEhC,IAAI,CAAC;QACH,2CAA2C;QAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;QAE7C,qEAAqE;QACrE,eAAe,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAExC,2EAA2E;QAC3E,kFAAkF;QAClF,eAAe,CAAC,aAAa,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;QAEjE,qFAAqF;QACrF,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QAEzF,4CAA4C;QAC5C,MAAM,YAAY,GAAG,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAEtF,2CAA2C;QAC3C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAE5E,8BAA8B;QAC9B,0CAA0C;QAC1C,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,eAAe,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;QAEzD,wFAAwF;QACxF,4FAA4F;QAC5F,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,WAAsC,EACtC,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;QAEF,wFAAwF;QACxF,4FAA4F;QAC5F,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C;YACE,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,UAAqC;YACzC,cAAc,EAAE,QAAmC;YACnD,SAAS,EAAE,GAAG,EAAE,WAAW;SAC5B,EACD,SAAS,EACT,eAA0C,CAC3C,CAAC;QAEF,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4EAA4E;QAC5E,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;YAChD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;YACrC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,+DAA+D;QAC/D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,eAAe,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAA4B,EAC5B,OAAgB,EAChB,uBAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;IACjF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAM,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+DAA+D;QAC/D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,eAAe,CAAC,uCAAuC,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,aAA4B,EAC5B,OAAgB,EAChB,uBAAgC;IAEhC,OAAO,eAAe,CAAI,aAAa,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,aAA4B,EAC5B,OAAgB,EAChB,uBAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;IACjF,IAAI,CAAC;QACH,+CAA+C;QAC/C,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzD,wDAAwD;QACxD,MAAM,aAAa,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAC/C,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+DAA+D;QAC/D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,eAAe,CAAC,yCAAyC,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC"}

package/dist/crypto/signature.d.ts

@@ -3,15 +3,18 @@
  * Based on working reference implementation
  */
 import type { EncryptedData } from '../types/index.js';
+import type { DecodedPayload } from './decrypt.js';
 /**
  * Verifies an ML-DSA-65 signature on encrypted data
  * IMPORTANT: Must be called BEFORE decryption for security
  *
  * @param encryptedData - The encrypted data with signature
+ * @param decoded - Optional pre-decoded payload fields to avoid redundant decoding
+ * @param expectedServerPublicKey - Optional expected server public key (base64url) to validate against
  * @returns True if signature is valid
- * @throws SignatureVerificationError if verification fails
+ * @throws SignatureVerificationError if verification fails or server key doesn't match expected
  */
-export declare function verifySignature(encryptedData: EncryptedData): boolean;
+export declare function verifySignature(encryptedData: EncryptedData, decoded?: DecodedPayload, expectedServerPublicKey?: string): boolean;
 /**
  * Verifies a signature without throwing an error
  *

package/dist/crypto/signature.js

@@ -27,18 +27,25 @@ function buildTranscript(version, algsCiphersuite, ctKem, nonce, aad, ciphertext
  * IMPORTANT: Must be called BEFORE decryption for security
  *
  * @param encryptedData - The encrypted data with signature
+ * @param decoded - Optional pre-decoded payload fields to avoid redundant decoding
+ * @param expectedServerPublicKey - Optional expected server public key (base64url) to validate against
  * @returns True if signature is valid
- * @throws SignatureVerificationError if verification fails
+ * @throws SignatureVerificationError if verification fails or server key doesn't match expected
  */
-export function verifySignature(encryptedData) {
+export function verifySignature(encryptedData, decoded, expectedServerPublicKey) {
     try {
-        // 1. Decode all components
-        const signature = fromBase64Url(encryptedData.sig);
-        const ctKem = fromBase64Url(encryptedData.ct_kem);
-        const nonceBytes = fromBase64Url(encryptedData.nonce);
-        const aadBytes = fromBase64Url(encryptedData.aad);
-        const ciphertextBytes = fromBase64Url(encryptedData.ciphertext);
-        const serverSigPk = fromBase64Url(encryptedData.server_sig_pk);
+        // 0. Validate server public key matches expected (MITM protection)
+        if (expectedServerPublicKey && encryptedData.server_sig_pk !== expectedServerPublicKey) {
+            throw new SignatureVerificationError('Server public key mismatch - possible MITM attack. ' +
+                'The encrypted data was signed by a different server than expected.');
+        }
+        // 1. Use pre-decoded values or decode components
+        const signature = decoded?.sig ?? fromBase64Url(encryptedData.sig);
+        const ctKem = decoded?.ctKem ?? fromBase64Url(encryptedData.ct_kem);
+        const nonceBytes = decoded?.nonce ?? fromBase64Url(encryptedData.nonce);
+        const aadBytes = decoded?.aad ?? fromBase64Url(encryptedData.aad);
+        const ciphertextBytes = decoded?.ciphertext ?? fromBase64Url(encryptedData.ciphertext);
+        const serverSigPk = decoded?.serverSigPk ?? fromBase64Url(encryptedData.server_sig_pk);
         // 2. Build the transcript (exactly as the server did)
         const algsCiphersuite = buildAlgsCiphersuite(encryptedData.algs);
         const transcript = buildTranscript(encryptedData.v, algsCiphersuite, ctKem, nonceBytes, aadBytes, ciphertextBytes, serverSigPk, HKDF_CONTEXT);

package/dist/crypto/signature.js.map

@@ -1 +1 @@
-{"version":3,"file":"signature.js","sourceRoot":"","sources":["../../src/crypto/signature.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAErE;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAA6D;IACzF,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,OAAe,EACf,eAAuB,EACvB,KAAiB,EACjB,KAAiB,EACjB,GAAe,EACf,UAAsB,EACtB,WAAuB,EACvB,OAAe;IAEf,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,OAAO,aAAa,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,aAA4B;IAC1D,IAAI,CAAC;QACH,2BAA2B;QAC3B,MAAM,SAAS,GAAG,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,eAAe,GAAG,aAAa,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,WAAW,GAAG,aAAa,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAE/D,sDAAsD;QACtD,MAAM,eAAe,GAAG,oBAAoB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,eAAe,CAChC,aAAa,CAAC,CAAC,EACf,eAAe,EACf,KAAK,EACL,UAAU,EACV,QAAQ,EACR,eAAe,EACf,WAAW,EACX,YAAY,CACb,CAAC;QAEF,0BAA0B;QAC1B,yEAAyE;QACzE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAC7B,eAAe,CAAC,SAAS,CAAC,EAC1B,eAAe,CAAC,UAAU,CAAC,EAC3B,eAAe,CAAC,WAAW,CAAC,CAC7B,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,0BAA0B,CAAC,uDAAuD,CAAC,CAAC;QAChG,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;YAChD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,+DAA+D;QAC/D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,0BAA0B,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,aAA4B;IAC9D,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,eAAuB;IAC7D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;QACjD,OAAO,SAAS,CAAC,MAAM,KAAK,qBAAqB,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"signature.js","sourceRoot":"","sources":["../../src/crypto/signature.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAIrE;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAA6D;IACzF,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,OAAe,EACf,eAAuB,EACvB,KAAiB,EACjB,KAAiB,EACjB,GAAe,EACf,UAAsB,EACtB,WAAuB,EACvB,OAAe;IAEf,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,OAAO,aAAa,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,aAA4B,EAC5B,OAAwB,EACxB,uBAAgC;IAEhC,IAAI,CAAC;QACH,mEAAmE;QACnE,IAAI,uBAAuB,IAAI,aAAa,CAAC,aAAa,KAAK,uBAAuB,EAAE,CAAC;YACvF,MAAM,IAAI,0BAA0B,CAClC,qDAAqD;gBACnD,oEAAoE,CACvE,CAAC;QACJ,CAAC;QAED,iDAAiD;QACjD,MAAM,SAAS,GAAG,OAAO,EAAE,GAAG,IAAI,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,OAAO,EAAE,KAAK,IAAI,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,OAAO,EAAE,GAAG,IAAI,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAClE,MAAM,eAAe,GAAG,OAAO,EAAE,UAAU,IAAI,aAAa,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACvF,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,aAAa,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAEvF,sDAAsD;QACtD,MAAM,eAAe,GAAG,oBAAoB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,eAAe,CAChC,aAAa,CAAC,CAAC,EACf,eAAe,EACf,KAAK,EACL,UAAU,EACV,QAAQ,EACR,eAAe,EACf,WAAW,EACX,YAAY,CACb,CAAC;QAEF,0BAA0B;QAC1B,yEAAyE;QACzE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAC7B,eAAe,CAAC,SAAS,CAAC,EAC1B,eAAe,CAAC,UAAU,CAAC,EAC3B,eAAe,CAAC,WAAW,CAAC,CAC7B,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,0BAA0B,CAAC,uDAAuD,CAAC,CAAC;QAChG,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;YAChD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,+DAA+D;QAC/D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,0BAA0B,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,aAA4B;IAC9D,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,eAAuB;IAC7D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;QACjD,OAAO,SAAS,CAAC,MAAM,KAAK,qBAAqB,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/email.d.ts

@@ -39,11 +39,12 @@ export declare class Email implements IEmail {
     private emailAddress;
     private apiClient;
     private keypair;
+    private serverPublicKey;
     /**
      * @internal
      * Do not construct this class directly.
      */
-    constructor(emailData: EmailData, metadata: DecryptedMetadata, parsed: DecryptedParsed | null, emailAddress: string, apiClient: ApiClient, keypair: Keypair | null);
+    constructor(emailData: EmailData, metadata: DecryptedMetadata, parsed: DecryptedParsed | null, emailAddress: string, apiClient: ApiClient, keypair: Keypair | null, serverPublicKey?: string | null);
     /**
      * Returns whether the email is classified as spam.
      *

package/dist/email.js

@@ -6,6 +6,7 @@
  */
 import createDebug from 'debug';
 import { decryptRaw } from './crypto/decrypt.js';
+import { DecryptionError } from './types/index.js';
 const debug = createDebug('vaultsandbox:email');
 /**
  * Provides a summary of email authentication results (SPF, DKIM, DMARC).
@@ -110,11 +111,12 @@ export class Email {
     emailAddress;
     apiClient;
     keypair;
+    serverPublicKey;
     /**
      * @internal
      * Do not construct this class directly.
      */
-    constructor(emailData, metadata, parsed, emailAddress, apiClient, keypair) {
+    constructor(emailData, metadata, parsed, emailAddress, apiClient, keypair, serverPublicKey) {
         this.id = emailData.id;
         this.from = metadata.from;
         this.to = Array.isArray(metadata.to) ? metadata.to : [metadata.to].filter(Boolean);
@@ -125,6 +127,7 @@ export class Email {
         this.emailAddress = emailAddress;
         this.apiClient = apiClient;
         this.keypair = keypair;
+        this.serverPublicKey = serverPublicKey ?? null;
         // istanbul ignore next -- this.to is always an array per line 166, else branch is defensive
         debug('Creating email %s from %s to %s', this.id, this.from, Array.isArray(this.to) ? this.to.join(', ') : this.to);
         // If parsed content is available, use it
@@ -209,7 +212,10 @@ export class Email {
         /* istanbul ignore else - defensive for invalid raw email response */
         if (rawEmailData.encryptedRaw) {
             // Encrypted inbox - decrypt the raw content
-            raw = await decryptRaw(rawEmailData.encryptedRaw, this.keypair);
+            if (!this.keypair) {
+                throw new DecryptionError(`Cannot decrypt raw email: no keypair available for ${this.emailAddress}`);
+            }
+            raw = await decryptRaw(rawEmailData.encryptedRaw, this.keypair, this.serverPublicKey ?? undefined);
         }
         else if (rawEmailData.raw) {
             // Plain inbox - decode base64