@venizia/ignis-helpers 0.2.0-2 → 0.2.0-21

package/dist/esm/modules/crypto/algorithms/aes-legacy.algorithm.js

@@ -4,6 +4,11 @@ import fs from 'node:fs';
 import { DEFAULT_PAD_END } from '../common/index.js';
 import { BaseCryptoAlgorithm } from './base.algorithm.js';
 const DEFAULT_LENGTH = 16;
+/**
+ * Frozen back-compat format - keys come from `normalizeSecretKeyLegacy` (padEnd/truncate), never
+ * PBKDF2. `kdfSalt`/`kdfIterations` are deliberately absent from `IAESExtraOptions`: there is no
+ * salt to override, so the option would type-check and silently do nothing.
+ */
 export class LegacyAES extends BaseCryptoAlgorithm {
     constructor(opts) {
         super({ scope: LegacyAES.name, ...opts });

package/dist/esm/modules/crypto/algorithms/aes-legacy.algorithm.js.map

@@ -1 +1 @@
-{"version":3,"file":"aes-legacy.algorithm.js","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/aes-legacy.algorithm.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,gBAAgB,CAAC;AACrC,OAAO,CAAC,MAAM,aAAa,CAAC;AAC5B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,cAAc,GAAG,EAAE,CAAC;AAS1B,MAAM,OAAO,SAAU,SAAQ,mBAQ9B;IACC,YAAY,IAAqC;QAC/C,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,SAA2B;QAC9C,OAAO,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,CAAC,IAAkE;QACxE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACjC,MAAM,EACJ,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,EAClC,aAAa,GAAG,OAAO,EACvB,cAAc,GAAG,QAAQ,EACzB,OAAO,GAAG,IAAI,GACf,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAEpB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC;gBAC9C,MAAM;gBACN,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE;aACnC,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YAE5E,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YACnB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YACzD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;YAEnC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;gBACvB,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,MAAM;gBACR,CAAC;gBACD,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,KAAK,CAAC,IAAI,CAAE,MAAsB,CAAC,UAAU,EAAE,CAAC,CAAC;oBACjD,MAAM;gBACR,CAAC;YACH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAExB,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,KAAK,CAAC;YACd,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,WAAW,CAAC,IAA8C;QACxD,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,CAAC,IAAkE;QACxE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACjC,MAAM,EAAE,aAAa,GAAG,QAAQ,EAAE,cAAc,GAAG,OAAO,EAAE,OAAO,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAE/F,IAAI,CAAC;YACH,MAAM,EAAE,GACN,IAAI,CAAC,IAAI,EAAE,EAAE;gBACb,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,cAAc,CAAC;gBAC/D,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;YAClC,IAAI,YAAY,GAAG,EAAE,CAAC,MAAM,CAAC;YAE7B,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC;gBAC9C,MAAM;gBACN,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE;aACnC,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YAEhF,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;gBACvB,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,MAAM;gBACR,CAAC;gBACD,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,QAAQ,CAC1D,EAAE,CAAC,MAAM,EACT,EAAE,CAAC,MAAM,GAAG,cAAc,CAC3B,CAAC;oBACF,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;oBAC9B,QAA0B,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;oBAChD,MAAM;gBACR,CAAC;YACH,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAC5E,cAAc,CACf,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,KAAK,CAAC;YACd,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,WAAW,CAAC,IAA8C;QACxD,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,wBAAwB,CAAC,IAAyD;QACxF,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,EAAE,GAAG,IAAI,CAAC;QAE1D,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;CACF"}
+{"version":3,"file":"aes-legacy.algorithm.js","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/aes-legacy.algorithm.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,gBAAgB,CAAC;AACrC,OAAO,CAAC,MAAM,aAAa,CAAC;AAC5B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,cAAc,GAAG,EAAE,CAAC;AAS1B;;;;GAIG;AACH,MAAM,OAAO,SAAU,SAAQ,mBAQ9B;IACC,YAAY,IAAqC;QAC/C,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,SAA2B;QAC9C,OAAO,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,CAAC,IAAkE;QACxE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACjC,MAAM,EACJ,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,EAClC,aAAa,GAAG,OAAO,EACvB,cAAc,GAAG,QAAQ,EACzB,OAAO,GAAG,IAAI,GACf,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAEpB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC;gBAC9C,MAAM;gBACN,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE;aACnC,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YAE5E,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YACnB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YACzD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;YAEnC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;gBACvB,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,MAAM;gBACR,CAAC;gBACD,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,KAAK,CAAC,IAAI,CAAE,MAAsB,CAAC,UAAU,EAAE,CAAC,CAAC;oBACjD,MAAM;gBACR,CAAC;YACH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAExB,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,KAAK,CAAC;YACd,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,WAAW,CAAC,IAA8C;QACxD,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,CAAC,IAAkE;QACxE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACjC,MAAM,EAAE,aAAa,GAAG,QAAQ,EAAE,cAAc,GAAG,OAAO,EAAE,OAAO,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAE/F,IAAI,CAAC;YACH,MAAM,EAAE,GACN,IAAI,CAAC,IAAI,EAAE,EAAE;gBACb,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,cAAc,CAAC;gBAC/D,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;YAClC,IAAI,YAAY,GAAG,EAAE,CAAC,MAAM,CAAC;YAE7B,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC;gBAC9C,MAAM;gBACN,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE;aACnC,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YAEhF,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;gBACvB,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,MAAM;gBACR,CAAC;gBACD,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,QAAQ,CAC1D,EAAE,CAAC,MAAM,EACT,EAAE,CAAC,MAAM,GAAG,cAAc,CAC3B,CAAC;oBACF,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;oBAC9B,QAA0B,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;oBAChD,MAAM;gBACR,CAAC;YACH,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAC5E,cAAc,CACf,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,KAAK,CAAC;YACd,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,WAAW,CAAC,IAA8C;QACxD,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,wBAAwB,CAAC,IAAyD;QACxF,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,EAAE,GAAG,IAAI,CAAC;QAE1D,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;CACF"}

package/dist/esm/modules/crypto/algorithms/aes.algorithm.d.ts

@@ -1,9 +1,12 @@
-import C from 'node:crypto';
 import { BaseCryptoAlgorithm } from './base.algorithm.js';
 interface IAESDecryptOptions {
-    inputEncoding?: C.Encoding;
-    outputEncoding?: C.Encoding;
+    inputEncoding?: BufferEncoding;
+    outputEncoding?: BufferEncoding;
     doThrow?: boolean;
+    /** Per-deployment PBKDF2 salt override. Must be supplied identically on encrypt and decrypt; omit for the shipped default. */
+    kdfSalt?: string;
+    /** PBKDF2 iteration count override. Must be supplied identically on encrypt and decrypt; omit for the shipped default. */
+    kdfIterations?: number;
 }
 /** `iv` is encrypt-only: the envelope carries the IV, so decrypt reads it from there and a supplied one would be silently ignored. */
 interface IAESExtraOptions extends IAESDecryptOptions {
@@ -20,11 +23,20 @@ export declare class AES extends BaseCryptoAlgorithm<AESAlgorithmType, string, s
         algorithm: AESAlgorithmType;
     });
     static withAlgorithm(algorithm: AESAlgorithmType): AES;
-    protected resolveEncryptKey(secret: TAESSecret): {
+    protected resolveEncryptKey(opts: {
+        secret: TAESSecret;
+        kdfSalt?: string;
+        kdfIterations?: number;
+    }): {
         id: string;
         key: Buffer;
     };
-    protected resolveDecryptKey(secret: TAESSecret, id: string): Buffer;
+    protected resolveDecryptKey(opts: {
+        secret: TAESSecret;
+        id: string;
+        kdfSalt?: string;
+        kdfIterations?: number;
+    }): Buffer;
     encrypt(opts: {
         message: string;
         secret: TAESSecret;

package/dist/esm/modules/crypto/algorithms/aes.algorithm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aes.algorithm.d.ts","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/aes.algorithm.ts"],"names":[],"mappings":"AACA,OAAO,CAAC,MAAM,aAAa,CAAC;AAG5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAMvD,UAAU,kBAAkB;IAC1B,aAAa,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;IAC3B,cAAc,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,sIAAsI;AACtI,UAAU,gBAAiB,SAAQ,kBAAkB;IACnD,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,gBAAgB,EAAE,CAAC;AAErD,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,aAAa,CAAC;AAE7D,qBAAa,GAAI,SAAQ,mBAAmB,CAC1C,gBAAgB,EAChB,MAAM,EACN,MAAM,EACN,UAAU,EACV,MAAM,EACN,MAAM,EACN,gBAAgB,CACjB;gBACa,IAAI,EAAE;QAAE,SAAS,EAAE,gBAAgB,CAAA;KAAE;IAIjD,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,gBAAgB;IAIhD,SAAS,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IAc5E,SAAS,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM;IAwBnE,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAC;QAAC,IAAI,CAAC,EAAE,gBAAgB,CAAA;KAAE;IA+C9E,WAAW,CAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,GAAG,MAAM;IAavE,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAC;QAAC,IAAI,CAAC,EAAE,kBAAkB,CAAA;KAAE;IAiDhF,WAAW,CAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE;CAY/D"}
+{"version":3,"file":"aes.algorithm.d.ts","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/aes.algorithm.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAMvD,UAAU,kBAAkB;IAC1B,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8HAA8H;IAC9H,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0HAA0H;IAC1H,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,sIAAsI;AACtI,UAAU,gBAAiB,SAAQ,kBAAkB;IACnD,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,gBAAgB,EAAE,CAAC;AAErD,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,aAAa,CAAC;AAE7D,qBAAa,GAAI,SAAQ,mBAAmB,CAC1C,gBAAgB,EAChB,MAAM,EACN,MAAM,EACN,UAAU,EACV,MAAM,EACN,MAAM,EACN,gBAAgB,CACjB;gBACa,IAAI,EAAE;QAAE,SAAS,EAAE,gBAAgB,CAAA;KAAE;IAIjD,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,gBAAgB;IAIhD,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE;QAChC,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IAiB/B,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE;QAChC,MAAM,EAAE,UAAU,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC;QACX,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,MAAM;IAyBV,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAC;QAAC,IAAI,CAAC,EAAE,gBAAgB,CAAA;KAAE;IAiD9E,WAAW,CAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,GAAG,MAAM;IAavE,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAC;QAAC,IAAI,CAAC,EAAE,kBAAkB,CAAA;KAAE;IAuDhF,WAAW,CAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE;CAY/D"}

package/dist/esm/modules/crypto/algorithms/aes.algorithm.js

@@ -1,7 +1,7 @@
 import isEmpty from 'lodash/isEmpty';
 import C from 'node:crypto';
 import fs from 'node:fs';
-import { getError } from '../../../modules/error/index.js';
+import { getError } from '../../error/index.js';
 import { BaseCryptoAlgorithm } from './base.algorithm.js';
 const DEFAULT_LENGTH = 16;
 const CIPHERTEXT_VERSION = 0x01;
@@ -13,7 +13,8 @@ export class AES extends BaseCryptoAlgorithm {
     static withAlgorithm(algorithm) {
         return new AES({ algorithm });
     }
-    resolveEncryptKey(secret) {
+    resolveEncryptKey(opts) {
+        const { secret, kdfSalt, kdfIterations } = opts;
         const entry = Array.isArray(secret) ? secret[0] : { id: DEFAULT_KEY_ID, secret };
         if (!entry || isEmpty(entry.secret)) {
             throw getError({ message: '[AES][resolveEncryptKey] Missing secret or empty keyring' });
@@ -21,13 +22,16 @@ export class AES extends BaseCryptoAlgorithm {
         const key = this.normalizeSecretKey({
             secret: entry.secret,
             length: this.getAlgorithmKeySize(),
+            kdfSalt,
+            kdfIterations,
         });
         return { id: entry.id, key };
     }
-    resolveDecryptKey(secret, id) {
+    resolveDecryptKey(opts) {
+        const { secret, id, kdfSalt, kdfIterations } = opts;
         const length = this.getAlgorithmKeySize();
         if (!Array.isArray(secret)) {
-            return this.normalizeSecretKey({ secret, length });
+            return this.normalizeSecretKey({ secret, length, kdfSalt, kdfIterations });
         }
         const entry = secret.find(e => e.id === id);
         if (!entry) {
@@ -41,13 +45,13 @@ export class AES extends BaseCryptoAlgorithm {
                 message: `[AES][resolveDecryptKey] Keyring entry for key id "${id}" has an empty secret`,
             });
         }
-        return this.normalizeSecretKey({ secret: entry.secret, length });
+        return this.normalizeSecretKey({ secret: entry.secret, length, kdfSalt, kdfIterations });
     }
     encrypt(opts) {
         const { message, secret } = opts;
-        const { iv = C.randomBytes(DEFAULT_LENGTH), inputEncoding = 'utf-8', outputEncoding = 'base64', doThrow = true, } = opts.opts ?? {};
+        const { iv = C.randomBytes(DEFAULT_LENGTH), inputEncoding = 'utf-8', outputEncoding = 'base64', doThrow = true, kdfSalt, kdfIterations, } = opts.opts ?? {};
         try {
-            const { id, key } = this.resolveEncryptKey(secret);
+            const { id, key } = this.resolveEncryptKey({ secret, kdfSalt, kdfIterations });
             const idBuffer = Buffer.from(id, 'utf-8');
             if (idBuffer.length > 0xff) {
                 throw getError({ message: '[AES][encrypt] Key id too long (max 255 bytes)' });
@@ -90,7 +94,7 @@ export class AES extends BaseCryptoAlgorithm {
     }
     decrypt(opts) {
         const { message, secret } = opts;
-        const { inputEncoding = 'base64', outputEncoding = 'utf-8', doThrow = true } = opts.opts ?? {};
+        const { inputEncoding = 'base64', outputEncoding = 'utf-8', doThrow = true, kdfSalt, kdfIterations, } = opts.opts ?? {};
         try {
             const raw = Buffer.from(message, inputEncoding);
             const version = raw[0];
@@ -103,7 +107,7 @@ export class AES extends BaseCryptoAlgorithm {
             cursor += idLength;
             const iv = raw.subarray(cursor, cursor + DEFAULT_LENGTH);
             cursor += DEFAULT_LENGTH;
-            const key = this.resolveDecryptKey(secret, id);
+            const key = this.resolveDecryptKey({ secret, id, kdfSalt, kdfIterations });
             const decipher = C.createDecipheriv(this.algorithm, key, iv);
             switch (this.algorithm) {
                 case 'aes-256-cbc': {

package/dist/esm/modules/crypto/algorithms/aes.algorithm.js.map

@@ -1 +1 @@
-{"version":3,"file":"aes.algorithm.js","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/aes.algorithm.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,gBAAgB,CAAC;AACrC,OAAO,CAAC,MAAM,aAAa,CAAC;AAC5B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,cAAc,GAAG,GAAG,CAAC;AAsB3B,MAAM,OAAO,GAAI,SAAQ,mBAQxB;IACC,YAAY,IAAqC;QAC/C,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,SAA2B;QAC9C,OAAO,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAChC,CAAC;IAES,iBAAiB,CAAC,MAAkB;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;QAEjF,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE;SACnC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;IAC/B,CAAC;IAES,iBAAiB,CAAC,MAAkB,EAAE,EAAU;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAE1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,yEAAyE,EAAE,GAAG;aACxF,CAAC,CAAC;QACL,CAAC;QAED,kIAAkI;QAClI,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,sDAAsD,EAAE,uBAAuB;aACzF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,CAAC,IAAsE;QAC5E,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACjC,MAAM,EACJ,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,EAClC,aAAa,GAAG,OAAO,EACvB,cAAc,GAAG,QAAQ,EACzB,OAAO,GAAG,IAAI,GACf,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAEpB,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC1C,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;gBAC3B,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,MAAM,GAAG,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAEzD,qFAAqF;YACrF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAErC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YACzD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;YAEnC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;gBACvB,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,MAAM;gBACR,CAAC;gBACD,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,KAAK,CAAC,IAAI,CAAE,MAAsB,CAAC,UAAU,EAAE,CAAC,CAAC;oBACjD,MAAM;gBACR,CAAC;YACH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAExB,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,KAAK,CAAC;YACd,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,WAAW,CAAC,IAAkD;QAC5D,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,CAAC,IAAwE;QAC9E,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACjC,MAAM,EAAE,aAAa,GAAG,QAAQ,EAAE,cAAc,GAAG,OAAO,EAAE,OAAO,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAE/F,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YAEhD,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,OAAO,KAAK,kBAAkB,EAAE,CAAC;gBACnC,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,kDAAkD,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YAED,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,MAAM,GAAG,CAAC,CAAC;YAEf,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,IAAI,QAAQ,CAAC;YAEnB,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAAC,CAAC;YACzD,MAAM,IAAI,cAAc,CAAC;YAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAE7D,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;gBACvB,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,MAAM;gBACR,CAAC;gBACD,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAAC,CAAC;oBAC9D,MAAM,IAAI,cAAc,CAAC;oBACxB,QAA0B,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;oBAChD,MAAM;gBACR,CAAC;YACH,CAAC;YAED,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAC5E,cAAc,CACf,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,KAAK,CAAC;YACd,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,WAAW,CAAC,IAAkD;QAC5D,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}
+{"version":3,"file":"aes.algorithm.js","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/aes.algorithm.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,gBAAgB,CAAC;AACrC,OAAO,CAAC,MAAM,aAAa,CAAC;AAC5B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,cAAc,GAAG,GAAG,CAAC;AA0B3B,MAAM,OAAO,GAAI,SAAQ,mBAQxB;IACC,YAAY,IAAqC;QAC/C,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,SAA2B;QAC9C,OAAO,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAChC,CAAC;IAES,iBAAiB,CAAC,IAI3B;QACC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QAChD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;QAEjF,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE;YAClC,OAAO;YACP,aAAa;SACd,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;IAC/B,CAAC;IAES,iBAAiB,CAAC,IAK3B;QACC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAE1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,yEAAyE,EAAE,GAAG;aACxF,CAAC,CAAC;QACL,CAAC;QAED,kIAAkI;QAClI,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,sDAAsD,EAAE,uBAAuB;aACzF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO,CAAC,IAAsE;QAC5E,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACjC,MAAM,EACJ,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,EAClC,aAAa,GAAG,OAAO,EACvB,cAAc,GAAG,QAAQ,EACzB,OAAO,GAAG,IAAI,EACd,OAAO,EACP,aAAa,GACd,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAEpB,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC1C,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;gBAC3B,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,MAAM,GAAG,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAEzD,qFAAqF;YACrF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAErC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YACzD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;YAEnC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;gBACvB,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,MAAM;gBACR,CAAC;gBACD,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,KAAK,CAAC,IAAI,CAAE,MAAsB,CAAC,UAAU,EAAE,CAAC,CAAC;oBACjD,MAAM;gBACR,CAAC;YACH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAExB,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,KAAK,CAAC;YACd,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,WAAW,CAAC,IAAkD;QAC5D,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,CAAC,IAAwE;QAC9E,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACjC,MAAM,EACJ,aAAa,GAAG,QAAQ,EACxB,cAAc,GAAG,OAAO,EACxB,OAAO,GAAG,IAAI,EACd,OAAO,EACP,aAAa,GACd,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAEpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YAEhD,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,OAAO,KAAK,kBAAkB,EAAE,CAAC;gBACnC,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,kDAAkD,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YAED,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,MAAM,GAAG,CAAC,CAAC;YAEf,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,IAAI,QAAQ,CAAC;YAEnB,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAAC,CAAC;YACzD,MAAM,IAAI,cAAc,CAAC;YAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;YAC3E,MAAM,QAAQ,GAAG,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAE7D,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;gBACvB,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,MAAM;gBACR,CAAC;gBACD,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAAC,CAAC;oBAC9D,MAAM,IAAI,cAAc,CAAC;oBACxB,QAA0B,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;oBAChD,MAAM;gBACR,CAAC;YACH,CAAC;YAED,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAC5E,cAAc,CACf,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,KAAK,CAAC;YACd,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,WAAW,CAAC,IAAkD;QAC5D,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/esm/modules/crypto/algorithms/base.algorithm.d.ts

@@ -1,4 +1,4 @@
-import { BaseHelper } from '../../../modules/base.js';
+import { BaseHelper } from '../../base.js';
 import { ICryptoAlgorithm } from '../common/index.js';
 export declare abstract class AbstractCryptoAlgorithm<AlgorithmType extends string, EncryptInputType = unknown, DecryptInputType = unknown, SecretKeyType = unknown, EncryptReturnType = unknown, DecryptReturnType = unknown, ExtraOptions = unknown> extends BaseHelper implements ICryptoAlgorithm<AlgorithmType, EncryptInputType, DecryptInputType, SecretKeyType, EncryptReturnType, DecryptReturnType, ExtraOptions> {
     algorithm: AlgorithmType;
@@ -21,10 +21,15 @@ export declare abstract class BaseCryptoAlgorithm<AlgorithmType extends string,
     validateAlgorithmName(opts: {
         algorithm: AlgorithmType;
     }): void;
+    /** Omit `kdfSalt`/`kdfIterations` for the shipped default (byte-identical to every prior release). Supplying either requires supplying the same value again on decrypt. */
     normalizeSecretKey(opts: {
         secret: string;
         length: number;
+        kdfSalt?: string;
+        kdfIterations?: number;
     }): Buffer;
+    /** Rejects a `kdfSalt` short enough to look configured while giving up most of the protection a salt exists for (NIST SP 800-132: 128-bit minimum). */
+    private validateKdfSalt;
     getAlgorithmKeySize(): number;
 }
 //# sourceMappingURL=base.algorithm.d.ts.map

package/dist/esm/modules/crypto/algorithms/base.algorithm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.algorithm.d.ts","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/base.algorithm.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAG5C,OAAO,EAKL,gBAAgB,EACjB,MAAM,WAAW,CAAC;AAInB,8BAAsB,uBAAuB,CAC3C,aAAa,SAAS,MAAM,EAC5B,gBAAgB,GAAG,OAAO,EAC1B,gBAAgB,GAAG,OAAO,EAC1B,aAAa,GAAG,OAAO,EACvB,iBAAiB,GAAG,OAAO,EAC3B,iBAAiB,GAAG,OAAO,EAC3B,YAAY,GAAG,OAAO,CAEtB,SAAQ,UACR,YACE,gBAAgB,CACd,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,CACb;IAEH,SAAS,EAAE,aAAa,CAAC;IAEzB,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE;QACrB,OAAO,EAAE,gBAAgB,CAAC;QAC1B,MAAM,EAAE,aAAa,CAAC;QACtB,IAAI,CAAC,EAAE,YAAY,CAAC;KACrB,GAAG,iBAAiB;IAErB,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE;QACrB,OAAO,EAAE,gBAAgB,CAAC;QAC1B,MAAM,EAAE,aAAa,CAAC;QACtB,IAAI,CAAC,EAAE,YAAY,CAAC;KACrB,GAAG,iBAAiB;CACtB;AAED,8BAAsB,mBAAmB,CACvC,aAAa,SAAS,MAAM,EAC5B,gBAAgB,GAAG,OAAO,EAC1B,gBAAgB,GAAG,OAAO,EAC1B,aAAa,GAAG,OAAO,EACvB,iBAAiB,GAAG,OAAO,EAC3B,iBAAiB,GAAG,OAAO,EAC3B,YAAY,GAAG,OAAO,CACtB,SAAQ,uBAAuB,CAC/B,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,CACb;gBACa,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,aAAa,CAAA;KAAE;IAU7D,qBAAqB,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,aAAa,CAAA;KAAE;IAUxD,kBAAkB,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAoBpE,mBAAmB;CAIpB"}
+{"version":3,"file":"base.algorithm.d.ts","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/base.algorithm.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAG5C,OAAO,EAKL,gBAAgB,EAEjB,MAAM,WAAW,CAAC;AAInB,8BAAsB,uBAAuB,CAC3C,aAAa,SAAS,MAAM,EAC5B,gBAAgB,GAAG,OAAO,EAC1B,gBAAgB,GAAG,OAAO,EAC1B,aAAa,GAAG,OAAO,EACvB,iBAAiB,GAAG,OAAO,EAC3B,iBAAiB,GAAG,OAAO,EAC3B,YAAY,GAAG,OAAO,CAEtB,SAAQ,UACR,YACE,gBAAgB,CACd,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,CACb;IAEH,SAAS,EAAE,aAAa,CAAC;IAEzB,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE;QACrB,OAAO,EAAE,gBAAgB,CAAC;QAC1B,MAAM,EAAE,aAAa,CAAC;QACtB,IAAI,CAAC,EAAE,YAAY,CAAC;KACrB,GAAG,iBAAiB;IAErB,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE;QACrB,OAAO,EAAE,gBAAgB,CAAC;QAC1B,MAAM,EAAE,aAAa,CAAC;QACtB,IAAI,CAAC,EAAE,YAAY,CAAC;KACrB,GAAG,iBAAiB;CACtB;AAED,8BAAsB,mBAAmB,CACvC,aAAa,SAAS,MAAM,EAC5B,gBAAgB,GAAG,OAAO,EAC1B,gBAAgB,GAAG,OAAO,EAC1B,aAAa,GAAG,OAAO,EACvB,iBAAiB,GAAG,OAAO,EAC3B,iBAAiB,GAAG,OAAO,EAC3B,YAAY,GAAG,OAAO,CACtB,SAAQ,uBAAuB,CAC/B,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,CACb;gBACa,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,aAAa,CAAA;KAAE;IAU7D,qBAAqB,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,aAAa,CAAA;KAAE;IAUxD,2KAA2K;IAC3K,kBAAkB,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,MAAM;IAqBV,uJAAuJ;IACvJ,OAAO,CAAC,eAAe;IAWvB,mBAAmB;CAIpB"}

package/dist/esm/modules/crypto/algorithms/base.algorithm.js

@@ -1,8 +1,8 @@
 import C from 'node:crypto';
-import { BaseHelper } from '../../../modules/base.js';
-import { getError } from '../../../modules/error/index.js';
+import { BaseHelper } from '../../base.js';
+import { getError } from '../../error/index.js';
 import { int } from '../../../utilities/index.js';
-import { DEFAULT_CIPHER_BITS, DEFAULT_KDF_DIGEST, DEFAULT_KDF_ITERATIONS, DEFAULT_KDF_SALT, } from '../common/index.js';
+import { DEFAULT_CIPHER_BITS, DEFAULT_KDF_DIGEST, DEFAULT_KDF_ITERATIONS, DEFAULT_KDF_SALT, MINIMUM_KDF_SALT_BYTES, } from '../common/index.js';
 const DERIVED_KEY_CACHE = new Map();
 export class AbstractCryptoAlgorithm extends BaseHelper {
 }
@@ -23,17 +23,33 @@ export class BaseCryptoAlgorithm extends AbstractCryptoAlgorithm {
             });
         }
     }
+    /** Omit `kdfSalt`/`kdfIterations` for the shipped default (byte-identical to every prior release). Supplying either requires supplying the same value again on decrypt. */
     normalizeSecretKey(opts) {
-        const { secret, length } = opts;
-        const cacheKey = `${DEFAULT_KDF_DIGEST}:${DEFAULT_KDF_ITERATIONS}:${length}:${secret}`;
+        const { secret, length, kdfSalt, kdfIterations } = opts;
+        if (kdfSalt !== undefined) {
+            this.validateKdfSalt({ kdfSalt });
+        }
+        const salt = kdfSalt ?? DEFAULT_KDF_SALT;
+        const iterations = kdfIterations ?? DEFAULT_KDF_ITERATIONS;
+        const cacheKey = `${DEFAULT_KDF_DIGEST}:${iterations}:${length}:${salt}:${secret}`;
         const cached = DERIVED_KEY_CACHE.get(cacheKey);
         if (cached) {
             return cached;
         }
-        const key = C.pbkdf2Sync(secret, DEFAULT_KDF_SALT, DEFAULT_KDF_ITERATIONS, length, DEFAULT_KDF_DIGEST);
+        const key = C.pbkdf2Sync(secret, salt, iterations, length, DEFAULT_KDF_DIGEST);
         DERIVED_KEY_CACHE.set(cacheKey, key);
         return key;
     }
+    /** Rejects a `kdfSalt` short enough to look configured while giving up most of the protection a salt exists for (NIST SP 800-132: 128-bit minimum). */
+    validateKdfSalt(opts) {
+        const { kdfSalt } = opts;
+        const byteLength = Buffer.byteLength(kdfSalt, 'utf-8');
+        if (byteLength < MINIMUM_KDF_SALT_BYTES) {
+            throw getError({
+                message: `[BaseCryptoAlgorithm][validateKdfSalt] kdfSalt must be at least ${MINIMUM_KDF_SALT_BYTES} bytes, got ${byteLength}`,
+            });
+        }
+    }
     getAlgorithmKeySize() {
         const b = int(this.algorithm?.split('-')?.[1] ?? DEFAULT_CIPHER_BITS);
         return int(b / 8);

package/dist/esm/modules/crypto/algorithms/base.algorithm.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.algorithm.js","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/base.algorithm.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,aAAa,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AAEnB,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEpD,MAAM,OAAgB,uBASpB,SAAQ,UAAU;CAyBnB;AAED,MAAM,OAAgB,mBAQpB,SAAQ,uBAQT;IACC,YAAY,IAAiD;QAC3D,KAAK,CAAC;YACJ,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,IAAI;YAC/D,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAE1D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,qBAAqB,CAAC,IAAkC;QACtD,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAE3B,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,+DAA+D,SAAS,EAAE;aACpF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,IAAwC;QACzD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEhC,MAAM,QAAQ,GAAG,GAAG,kBAAkB,IAAI,sBAAsB,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACvF,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CACtB,MAAM,EACN,gBAAgB,EAChB,sBAAsB,EACtB,MAAM,EACN,kBAAkB,CACnB,CAAC;QACF,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,mBAAmB;QACjB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC;QACtE,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpB,CAAC;CACF"}
+{"version":3,"file":"base.algorithm.js","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/base.algorithm.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,aAAa,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAEhB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AAEnB,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEpD,MAAM,OAAgB,uBASpB,SAAQ,UAAU;CAyBnB;AAED,MAAM,OAAgB,mBAQpB,SAAQ,uBAQT;IACC,YAAY,IAAiD;QAC3D,KAAK,CAAC;YACJ,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,IAAI;YAC/D,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAE1D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,qBAAqB,CAAC,IAAkC;QACtD,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAE3B,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,+DAA+D,SAAS,EAAE;aACpF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,2KAA2K;IAC3K,kBAAkB,CAAC,IAKlB;QACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QAExD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,IAAI,gBAAgB,CAAC;QACzC,MAAM,UAAU,GAAG,aAAa,IAAI,sBAAsB,CAAC;QAE3D,MAAM,QAAQ,GAAG,GAAG,kBAAkB,IAAI,UAAU,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;QACnF,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAC/E,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,uJAAuJ;IAC/I,eAAe,CAAC,IAAyB;QAC/C,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEvD,IAAI,UAAU,GAAG,sBAAsB,EAAE,CAAC;YACxC,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,mEAAmE,sBAAsB,eAAe,UAAU,EAAE;aAC9H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,mBAAmB;QACjB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC;QACtE,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpB,CAAC;CACF"}

package/dist/esm/modules/crypto/algorithms/ecdh.algorithm.js

@@ -1,4 +1,4 @@
-import { getError } from '../../../modules/error/index.js';
+import { getError } from '../../error/index.js';
 import { AbstractCryptoAlgorithm } from './base.algorithm.js';
 const CURVE = { name: 'ECDH', namedCurve: 'P-256' };
 const CIPHER = 'AES-GCM';

package/dist/esm/modules/crypto/algorithms/hash.algorithm.d.ts

@@ -0,0 +1,34 @@
+import { BaseHelper } from '../../base.js';
+import { THashAlgorithm, THashOutputEncoding } from '../common/index.js';
+interface IHashExtraOptions {
+    outputEncoding?: THashOutputEncoding;
+}
+/**
+ * One-way message digests and keyed HMACs. Unlike `AES`/`RSA` this has no `decrypt` - a digest
+ * cannot be reversed, so `digest`/`hmac` are the only operations, not `ICryptoAlgorithm`.
+ */
+export declare class Hash extends BaseHelper {
+    algorithm: THashAlgorithm;
+    constructor(opts: {
+        algorithm: THashAlgorithm;
+    });
+    /** Memoized - `BaseHelper`'s constructor resolves a logger on every allocation (~50ns), and downstream token code calls `withAlgorithm` per request. */
+    private static readonly instances;
+    static withAlgorithm(algorithm: THashAlgorithm): Hash;
+    validateAlgorithmName(opts: {
+        algorithm: THashAlgorithm;
+    }): void;
+    /** Plain digest, no secret. MD5/SHA1 are broken/weak - see {@link HashAlgorithms} - never use for security decisions. */
+    digest(opts: {
+        message: string;
+        opts?: IHashExtraOptions;
+    }): string;
+    /** Keyed HMAC. `secret` is mandatory and validated non-empty so a request for an HMAC never silently degrades into an unkeyed digest. */
+    hmac(opts: {
+        message: string;
+        secret: string;
+        opts?: IHashExtraOptions;
+    }): string;
+}
+export {};
+//# sourceMappingURL=hash.algorithm.d.ts.map

package/dist/esm/modules/crypto/algorithms/hash.algorithm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.algorithm.d.ts","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/hash.algorithm.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,OAAO,EAGL,cAAc,EACd,mBAAmB,EACpB,MAAM,WAAW,CAAC;AAEnB,UAAU,iBAAiB;IACzB,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC;AAED;;;GAGG;AACH,qBAAa,IAAK,SAAQ,UAAU;IAClC,SAAS,EAAE,cAAc,CAAC;gBAEd,IAAI,EAAE;QAAE,SAAS,EAAE,cAAc,CAAA;KAAE;IAO/C,wJAAwJ;IACxJ,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAmC;IAEpE,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,cAAc;IAY9C,qBAAqB,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,cAAc,CAAA;KAAE;IAUzD,yHAAyH;IACzH,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,iBAAiB,CAAA;KAAE,GAAG,MAAM;IAOnE,yIAAyI;IACzI,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,iBAAiB,CAAA;KAAE,GAAG,MAAM;CAYlF"}

package/dist/esm/modules/crypto/algorithms/hash.algorithm.js

@@ -0,0 +1,52 @@
+import C from 'node:crypto';
+import { BaseHelper } from '../../base.js';
+import { getError } from '../../error/index.js';
+import { DEFAULT_HASH_OUTPUT_ENCODING, HashAlgorithms, } from '../common/index.js';
+/**
+ * One-way message digests and keyed HMACs. Unlike `AES`/`RSA` this has no `decrypt` - a digest
+ * cannot be reversed, so `digest`/`hmac` are the only operations, not `ICryptoAlgorithm`.
+ */
+export class Hash extends BaseHelper {
+    constructor(opts) {
+        super({ scope: Hash.name, identifier: opts.algorithm });
+        this.validateAlgorithmName({ algorithm: opts.algorithm });
+        this.algorithm = opts.algorithm;
+    }
+    /** Memoized - `BaseHelper`'s constructor resolves a logger on every allocation (~50ns), and downstream token code calls `withAlgorithm` per request. */
+    static { this.instances = new Map(); }
+    static withAlgorithm(algorithm) {
+        const cached = Hash.instances.get(algorithm);
+        if (cached) {
+            return cached;
+        }
+        const created = new Hash({ algorithm });
+        Hash.instances.set(algorithm, created);
+        return created;
+    }
+    validateAlgorithmName(opts) {
+        const { algorithm } = opts;
+        if (!algorithm || !HashAlgorithms.isValid(algorithm)) {
+            throw getError({
+                message: `[Hash][validateAlgorithmName] Invalid algorithm name | algorithm: ${algorithm}`,
+            });
+        }
+    }
+    /** Plain digest, no secret. MD5/SHA1 are broken/weak - see {@link HashAlgorithms} - never use for security decisions. */
+    digest(opts) {
+        const { message } = opts;
+        const { outputEncoding = DEFAULT_HASH_OUTPUT_ENCODING } = opts.opts ?? {};
+        return C.createHash(this.algorithm).update(message).digest(outputEncoding);
+    }
+    /** Keyed HMAC. `secret` is mandatory and validated non-empty so a request for an HMAC never silently degrades into an unkeyed digest. */
+    hmac(opts) {
+        const { message, secret } = opts;
+        const { outputEncoding = DEFAULT_HASH_OUTPUT_ENCODING } = opts.opts ?? {};
+        if (!secret) {
+            throw getError({
+                message: `[Hash][hmac] Missing secret for HMAC-${this.algorithm.toUpperCase()}`,
+            });
+        }
+        return C.createHmac(this.algorithm, secret).update(message).digest(outputEncoding);
+    }
+}
+//# sourceMappingURL=hash.algorithm.js.map

package/dist/esm/modules/crypto/algorithms/hash.algorithm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.algorithm.js","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/hash.algorithm.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,aAAa,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EACL,4BAA4B,EAC5B,cAAc,GAGf,MAAM,WAAW,CAAC;AAMnB;;;GAGG;AACH,MAAM,OAAO,IAAK,SAAQ,UAAU;IAGlC,YAAY,IAAmC;QAC7C,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAE1D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,wJAAwJ;aAChI,cAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEpE,MAAM,CAAC,aAAa,CAAC,SAAyB;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEvC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,qBAAqB,CAAC,IAAmC;QACvD,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAE3B,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,qEAAqE,SAAS,EAAE;aAC1F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,yHAAyH;IACzH,MAAM,CAAC,IAAmD;QACxD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QACzB,MAAM,EAAE,cAAc,GAAG,4BAA4B,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAE1E,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC7E,CAAC;IAED,yIAAyI;IACzI,IAAI,CAAC,IAAmE;QACtE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACjC,MAAM,EAAE,cAAc,GAAG,4BAA4B,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAE1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,wCAAwC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE;aAChF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACrF,CAAC"}

package/dist/esm/modules/crypto/algorithms/index.d.ts

@@ -2,5 +2,6 @@ export * from './base.algorithm.js';
 export * from './aes.algorithm.js';
 export * from './aes-legacy.algorithm.js';
 export * from './ecdh.algorithm.js';
+export * from './hash.algorithm.js';
 export * from './rsa.algorithm.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/modules/crypto/algorithms/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AAEjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AAEjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC"}

package/dist/esm/modules/crypto/algorithms/index.js

@@ -2,5 +2,6 @@ export * from './base.algorithm.js';
 export * from './aes.algorithm.js';
 export * from './aes-legacy.algorithm.js';
 export * from './ecdh.algorithm.js';
+export * from './hash.algorithm.js';
 export * from './rsa.algorithm.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/modules/crypto/algorithms/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AAEjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AAEjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC"}

package/dist/esm/modules/crypto/algorithms/rsa.algorithm.d.ts

@@ -1,11 +1,10 @@
-import C from 'node:crypto';
 import { BaseCryptoAlgorithm } from './base.algorithm.js';
 interface IRSAExtraOptions {
     inputEncoding?: {
-        key: C.Encoding;
-        message: C.Encoding;
+        key: BufferEncoding;
+        message: BufferEncoding;
     };
-    outputEncoding?: C.Encoding;
+    outputEncoding?: BufferEncoding;
     doThrow?: boolean;
 }
 export type RSAAlgorithmType = 'rsa';
@@ -14,6 +13,10 @@ export declare class RSA extends BaseCryptoAlgorithm<RSAAlgorithmType, string, s
         algorithm: RSAAlgorithmType;
     });
     static withAlgorithm(): RSA;
+    /**
+     * Rejects a modulus below `MINIMUM_RSA_MODULUS_BITS` rather than generating it - a weak key still
+     * works, signs, and verifies, so this is the only point where the size is ever checked.
+     */
     generateDERKeyPair(opts?: {
         modulus: number;
     }): {

package/dist/esm/modules/crypto/algorithms/rsa.algorithm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rsa.algorithm.d.ts","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/rsa.algorithm.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,aAAa,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,UAAU,gBAAgB;IACxB,aAAa,CAAC,EAAE;QAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC;QAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAA;KAAE,CAAC;IACzD,cAAc,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAErC,qBAAa,GAAI,SAAQ,mBAAmB,CAC1C,gBAAgB,EAChB,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,gBAAgB,CACjB;gBACa,IAAI,EAAE;QAAE,SAAS,EAAE,gBAAgB,CAAA;KAAE;IAIjD,MAAM,CAAC,aAAa;IAIpB,kBAAkB,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE;;;;IAW7C,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,gBAAgB,CAAA;KAAE;IAyB1E,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,gBAAgB,CAAA;KAAE;CAwB3E"}
+{"version":3,"file":"rsa.algorithm.d.ts","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/rsa.algorithm.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,UAAU,gBAAgB;IACxB,aAAa,CAAC,EAAE;QAAE,GAAG,EAAE,cAAc,CAAC;QAAC,OAAO,EAAE,cAAc,CAAA;KAAE,CAAC;IACjE,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAErC,qBAAa,GAAI,SAAQ,mBAAmB,CAC1C,gBAAgB,EAChB,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,MAAM,EACN,gBAAgB,CACjB;gBACa,IAAI,EAAE;QAAE,SAAS,EAAE,gBAAgB,CAAA;KAAE;IAIjD,MAAM,CAAC,aAAa;IAIpB;;;OAGG;IACH,kBAAkB,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE;;;;IAmB7C,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,gBAAgB,CAAA;KAAE;IAyB1E,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,gBAAgB,CAAA;KAAE;CAwB3E"}

package/dist/esm/modules/crypto/algorithms/rsa.algorithm.js

@@ -1,4 +1,6 @@
 import C from 'node:crypto';
+import { getError } from '../../error/index.js';
+import { MINIMUM_RSA_MODULUS_BITS } from '../common/constants.js';
 import { BaseCryptoAlgorithm } from './base.algorithm.js';
 export class RSA extends BaseCryptoAlgorithm {
     constructor(opts) {
@@ -7,9 +9,19 @@ export class RSA extends BaseCryptoAlgorithm {
     static withAlgorithm() {
         return new RSA({ algorithm: 'rsa' });
     }
+    /**
+     * Rejects a modulus below `MINIMUM_RSA_MODULUS_BITS` rather than generating it - a weak key still
+     * works, signs, and verifies, so this is the only point where the size is ever checked.
+     */
     generateDERKeyPair(opts) {
+        const modulus = opts?.modulus ?? MINIMUM_RSA_MODULUS_BITS;
+        if (modulus < MINIMUM_RSA_MODULUS_BITS) {
+            throw getError({
+                message: `[RSA][generateDERKeyPair] Modulus ${modulus} is below the ${MINIMUM_RSA_MODULUS_BITS}-bit minimum`,
+            });
+        }
         const keys = C.generateKeyPairSync('rsa', {
-            modulusLength: opts?.modulus ?? 2048,
+            modulusLength: modulus,
         });
         return {
             publicKey: keys.publicKey.export({ type: 'spki', format: 'der' }),

package/dist/esm/modules/crypto/algorithms/rsa.algorithm.js.map

@@ -1 +1 @@
-{"version":3,"file":"rsa.algorithm.js","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/rsa.algorithm.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,aAAa,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAUvD,MAAM,OAAO,GAAI,SAAQ,mBAQxB;IACC,YAAY,IAAqC;QAC/C,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,aAAa;QAClB,OAAO,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,kBAAkB,CAAC,IAA0B;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE;YACxC,aAAa,EAAE,IAAI,EAAE,OAAO,IAAI,IAAI;SACrC,CAAC,CAAC;QAEH,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACjE,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACrE,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,IAAkE;QACxE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACzC,MAAM,EACJ,aAAa,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EACnD,cAAc,GAAG,QAAQ,EACzB,OAAO,GAAG,IAAI,GACf,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAEpB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,CAAC,eAAe,CAAC;gBAC1B,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC;gBAC3C,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3E,OAAO,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,KAAK,CAAC;YACd,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAkE;QACxE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAC1C,MAAM,EACJ,aAAa,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EACpD,cAAc,GAAG,OAAO,EACxB,OAAO,GAAG,IAAI,GACf,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAEpB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC;gBAC3B,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC;gBAC5C,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,OAAO;aACd,CAAC,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5E,OAAO,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,KAAK,CAAC;YACd,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"rsa.algorithm.js","sourceRoot":"","sources":["../../../../../src/modules/crypto/algorithms/rsa.algorithm.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,aAAa,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAUvD,MAAM,OAAO,GAAI,SAAQ,mBAQxB;IACC,YAAY,IAAqC;QAC/C,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,aAAa;QAClB,OAAO,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,IAA0B;QAC3C,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,wBAAwB,CAAC;QAE1D,IAAI,OAAO,GAAG,wBAAwB,EAAE,CAAC;YACvC,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,qCAAqC,OAAO,iBAAiB,wBAAwB,cAAc;aAC7G,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE;YACxC,aAAa,EAAE,OAAO;SACvB,CAAC,CAAC;QAEH,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACjE,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACrE,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,IAAkE;QACxE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACzC,MAAM,EACJ,aAAa,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EACnD,cAAc,GAAG,QAAQ,EACzB,OAAO,GAAG,IAAI,GACf,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAEpB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,CAAC,eAAe,CAAC;gBAC1B,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC;gBAC3C,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3E,OAAO,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,KAAK,CAAC;YACd,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAkE;QACxE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAC1C,MAAM,EACJ,aAAa,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EACpD,cAAc,GAAG,OAAO,EACxB,OAAO,GAAG,IAAI,GACf,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAEpB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC;gBAC3B,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC;gBAC5C,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,OAAO;aACd,CAAC,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5E,OAAO,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,KAAK,CAAC;YACd,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;CACF"}

package/dist/esm/modules/crypto/common/constants.d.ts

@@ -1,11 +1,38 @@
+import type { TConstValue } from '../../../common/index.js';
 export declare const DEFAULT_CIPHER_BITS = 256;
+/** Legacy padEnd key-stretching char, no longer used - keys now derive via PBKDF2 (`DEFAULT_KDF_*`). Kept only so existing imports do not break. */
+export declare const DEFAULT_PAD_END: string;
 /**
- * @deprecated Legacy padEnd key-stretching char. No longer used for key derivation —
- * keys are now derived via PBKDF2 (see `DEFAULT_KDF_*`). Kept only so existing imports
- * do not break.
+ * Public and identical across every deployment, so it stops a bare dictionary attack but not a
+ * table precomputed against this value - pass `kdfSalt` for per-deployment isolation. Never
+ * change this: every ciphertext already encrypted under it becomes undecryptable.
  */
-export declare const DEFAULT_PAD_END: string;
 export declare const DEFAULT_KDF_SALT = "ignis-kdf-salt-v1";
 export declare const DEFAULT_KDF_ITERATIONS = 100000;
 export declare const DEFAULT_KDF_DIGEST = "sha256";
+/** NIST SP 800-132 minimum recommended salt size (128 bits) for a caller-supplied `kdfSalt`. */
+export declare const MINIMUM_KDF_SALT_BYTES = 16;
+/** NIST SP 800-57 Part 1 floor for RSA past 2030. */
+export declare const MINIMUM_RSA_MODULUS_BITS = 2048;
+export declare class HashAlgorithms {
+    /** Cryptographically broken - kept only for wire-protocol compatibility (VNPay checksums); never use for security decisions. */
+    static readonly MD5 = "md5";
+    /** Cryptographically weak - kept for wire-protocol compatibility with legacy integrations; never use for security decisions. */
+    static readonly SHA1 = "sha1";
+    static readonly SHA256 = "sha256";
+    static readonly SHA384 = "sha384";
+    static readonly SHA512 = "sha512";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(value: string): value is THashAlgorithm;
+}
+export type THashAlgorithm = TConstValue<typeof HashAlgorithms>;
+export declare class HashOutputEncodings {
+    static readonly HEX = "hex";
+    static readonly BASE64 = "base64";
+    static readonly BASE64URL = "base64url";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(value: string): value is THashOutputEncoding;
+}
+export type THashOutputEncoding = TConstValue<typeof HashOutputEncodings>;
+export declare const DEFAULT_HASH_OUTPUT_ENCODING: THashOutputEncoding;
 //# sourceMappingURL=constants.d.ts.map

package/dist/esm/modules/crypto/common/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../src/modules/crypto/common/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,eAAe,QAAoB,CAAC;AAEjD,eAAO,MAAM,gBAAgB,sBAAsB,CAAC;AACpD,eAAO,MAAM,sBAAsB,SAAU,CAAC;AAC9C,eAAO,MAAM,kBAAkB,WAAW,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../src/modules/crypto/common/constants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC,oJAAoJ;AACpJ,eAAO,MAAM,eAAe,QAAoB,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,sBAAsB,CAAC;AACpD,eAAO,MAAM,sBAAsB,SAAU,CAAC;AAC9C,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAE3C,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC,qDAAqD;AACrD,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C,qBAAa,cAAc;IACzB,gIAAgI;IAChI,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAE5B,gIAAgI;IAChI,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAE9B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAElC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAMvB;IAEH,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,cAAc;CAGvD;AAED,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,cAAc,CAAC,CAAC;AAEhE,qBAAa,mBAAmB;IAC9B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,SAAS,eAAe;IAExC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAA4D;IAEtF,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,mBAAmB;CAG5D;AAED,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE1E,eAAO,MAAM,4BAA4B,EAAE,mBAA6C,CAAC"}

package/dist/esm/modules/crypto/common/constants.js

@@ -1,11 +1,45 @@
 export const DEFAULT_CIPHER_BITS = 256;
+/** Legacy padEnd key-stretching char, no longer used - keys now derive via PBKDF2 (`DEFAULT_KDF_*`). Kept only so existing imports do not break. */
+export const DEFAULT_PAD_END = (0x00).toString();
 /**
- * @deprecated Legacy padEnd key-stretching char. No longer used for key derivation —
- * keys are now derived via PBKDF2 (see `DEFAULT_KDF_*`). Kept only so existing imports
- * do not break.
+ * Public and identical across every deployment, so it stops a bare dictionary attack but not a
+ * table precomputed against this value - pass `kdfSalt` for per-deployment isolation. Never
+ * change this: every ciphertext already encrypted under it becomes undecryptable.
  */
-export const DEFAULT_PAD_END = (0x00).toString();
 export const DEFAULT_KDF_SALT = 'ignis-kdf-salt-v1';
 export const DEFAULT_KDF_ITERATIONS = 100_000;
 export const DEFAULT_KDF_DIGEST = 'sha256';
+/** NIST SP 800-132 minimum recommended salt size (128 bits) for a caller-supplied `kdfSalt`. */
+export const MINIMUM_KDF_SALT_BYTES = 16;
+/** NIST SP 800-57 Part 1 floor for RSA past 2030. */
+export const MINIMUM_RSA_MODULUS_BITS = 2048;
+export class HashAlgorithms {
+    /** Cryptographically broken - kept only for wire-protocol compatibility (VNPay checksums); never use for security decisions. */
+    static { this.MD5 = 'md5'; }
+    /** Cryptographically weak - kept for wire-protocol compatibility with legacy integrations; never use for security decisions. */
+    static { this.SHA1 = 'sha1'; }
+    static { this.SHA256 = 'sha256'; }
+    static { this.SHA384 = 'sha384'; }
+    static { this.SHA512 = 'sha512'; }
+    static { this.SCHEME_SET = new Set([
+        this.MD5,
+        this.SHA1,
+        this.SHA256,
+        this.SHA384,
+        this.SHA512,
+    ]); }
+    static isValid(value) {
+        return this.SCHEME_SET.has(value);
+    }
+}
+export class HashOutputEncodings {
+    static { this.HEX = 'hex'; }
+    static { this.BASE64 = 'base64'; }
+    static { this.BASE64URL = 'base64url'; }
+    static { this.SCHEME_SET = new Set([this.HEX, this.BASE64, this.BASE64URL]); }
+    static isValid(value) {
+        return this.SCHEME_SET.has(value);
+    }
+}
+export const DEFAULT_HASH_OUTPUT_ENCODING = HashOutputEncodings.HEX;
 //# sourceMappingURL=constants.js.map

package/dist/esm/modules/crypto/common/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../../src/modules/crypto/common/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;AAEjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AACpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAC9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../../src/modules/crypto/common/constants.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC,oJAAoJ;AACpJ,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AACpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAC9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAE3C,gGAAgG;AAChG,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC,qDAAqD;AACrD,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C,MAAM,OAAO,cAAc;IACzB,gIAAgI;aAChH,QAAG,GAAG,KAAK,CAAC;IAE5B,gIAAgI;aAChH,SAAI,GAAG,MAAM,CAAC;aAEd,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAClB,WAAM,GAAG,QAAQ,CAAC;aAElB,eAAU,GAAG,IAAI,GAAG,CAAS;QAC3C,IAAI,CAAC,GAAG;QACR,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM;KACZ,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,mBAAmB;aACd,QAAG,GAAG,KAAK,CAAC;aACZ,WAAM,GAAG,QAAQ,CAAC;aAClB,cAAS,GAAG,WAAW,CAAC;aAExB,eAAU,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAEtF,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,CAAC,MAAM,4BAA4B,GAAwB,mBAAmB,CAAC,GAAG,CAAC"}