@virtru/dsp-sdk 0.4.0 → 0.5.0

package/lib-commonjs/src/lib/fips-crypto-service.js

@@ -0,0 +1,57 @@
+"use strict";
+/*
+ * Copyright (c) Virtru Corporation.  All rights reserved.
+ *
+ * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FipsCryptoService = exports.exportPrivateKeyPem = exports.importPrivateKey = exports.unwrapSymmetricKey = exports.unwrapPrivateKey = exports.unwrapPublicKey = exports.wrapKeyPair = exports.wrapSymmetricKey = exports.wrapPrivateKey = exports.wrapPublicKey = exports.initializeFipsCrypto = void 0;
+const singlecontainer_1 = require("@opentdf/sdk/singlecontainer");
+var primitives_1 = require("./fips-crypto/primitives");
+Object.defineProperty(exports, "initializeFipsCrypto", { enumerable: true, get: function () { return primitives_1.initializeFipsCrypto; } });
+var keys_1 = require("./fips-crypto/keys");
+Object.defineProperty(exports, "wrapPublicKey", { enumerable: true, get: function () { return keys_1.wrapPublicKey; } });
+Object.defineProperty(exports, "wrapPrivateKey", { enumerable: true, get: function () { return keys_1.wrapPrivateKey; } });
+Object.defineProperty(exports, "wrapSymmetricKey", { enumerable: true, get: function () { return keys_1.wrapSymmetricKey; } });
+Object.defineProperty(exports, "wrapKeyPair", { enumerable: true, get: function () { return keys_1.wrapKeyPair; } });
+Object.defineProperty(exports, "unwrapPublicKey", { enumerable: true, get: function () { return keys_1.unwrapPublicKey; } });
+Object.defineProperty(exports, "unwrapPrivateKey", { enumerable: true, get: function () { return keys_1.unwrapPrivateKey; } });
+Object.defineProperty(exports, "unwrapSymmetricKey", { enumerable: true, get: function () { return keys_1.unwrapSymmetricKey; } });
+const primitives_2 = require("./fips-crypto/primitives");
+const symmetric_1 = require("./fips-crypto/symmetric");
+const asymmetric_1 = require("./fips-crypto/asymmetric");
+const key_format_1 = require("./fips-crypto/key-format");
+var key_format_2 = require("./fips-crypto/key-format");
+Object.defineProperty(exports, "importPrivateKey", { enumerable: true, get: function () { return key_format_2.importPrivateKey; } });
+Object.defineProperty(exports, "exportPrivateKeyPem", { enumerable: true, get: function () { return key_format_2.exportPrivateKeyPem; } });
+// ─── FipsCryptoService ────────────────────────────────────────────────────────
+exports.FipsCryptoService = {
+    name: 'FipsCryptoService',
+    method: 'http://www.w3.org/2001/04/xmlenc#aes256-cbc',
+    decrypt: symmetric_1.decrypt,
+    decryptWithPrivateKey: asymmetric_1.decryptWithPrivateKey,
+    encrypt: symmetric_1.encrypt,
+    encryptWithPublicKey: asymmetric_1.encryptWithPublicKey,
+    generateKey: symmetric_1.generateKey,
+    generateKeyPair: asymmetric_1.generateKeyPair,
+    generateSigningKeyPair: asymmetric_1.generateSigningKeyPair,
+    randomBytes: primitives_2.randomBytes,
+    sign: asymmetric_1.sign,
+    verify: asymmetric_1.verify,
+    hmac: symmetric_1.hmac,
+    verifyHmac: symmetric_1.verifyHmac,
+    digest: primitives_2.digest,
+    generateECKeyPair: asymmetric_1.generateECKeyPair,
+    deriveKeyFromECDH: asymmetric_1.deriveKeyFromECDH,
+    importPublicKey: key_format_1.importPublicKey,
+    importPrivateKey: key_format_1.importPrivateKey,
+    exportPublicKeyPem: key_format_1.exportPublicKeyPem,
+    exportPrivateKeyPem: key_format_1.exportPrivateKeyPem,
+    exportPublicKeyJwk: key_format_1.exportPublicKeyJwk,
+    parsePublicKeyPem: key_format_1.parsePublicKeyPem,
+    extractPublicKeyPem: key_format_1.extractPublicKeyPem,
+    jwkToPublicKeyPem: key_format_1.jwkToPublicKeyPem,
+    importSymmetricKey: symmetric_1.importSymmetricKey,
+    splitSymmetricKey: symmetric_1.splitSymmetricKey,
+    mergeSymmetricKeys: symmetric_1.mergeSymmetricKeys,
+};

package/lib-commonjs/src/lib/utils.js

@@ -13,6 +13,7 @@ exports.getUserEntitlements = getUserEntitlements;
 exports.getTrustedCertificates = getTrustedCertificates;
 exports.validateJWSCertificateChain = validateJWSCertificateChain;
 const sdk_1 = require("@opentdf/sdk");
+const singlecontainer_1 = require("@opentdf/sdk/singlecontainer");
 const platform_1 = require("@opentdf/sdk/platform");
 const common_pb_js_1 = require("@opentdf/sdk/platform/common/common_pb.js");
 const asn1js = require("asn1js");
@@ -30,7 +31,7 @@ const client_1 = require("./client");
  * @param authProvider - An instance of `AuthProvider` used to generate authentication credentials.
  * @returns An `Interceptor` function that modifies requests to include authentication headers.
  */
-function createAuthInterceptor(authProvider) {
+function createAuthInterceptor(authProvider, _cryptoService) {
     return (next) => async (req) => {
         const url = new URL(req.url);
         const pathOnly = url.pathname;
@@ -76,6 +77,7 @@ async function createOpenTDFClient(options) {
             noVerify: true,
         },
         disableDPoP: true,
+        cryptoService: options.cryptoService,
     });
 }
 const getObligations = async (ciphertext, options) => {
@@ -102,6 +104,7 @@ async function getUserEntitlements(options) {
     const authProvider = await createAuthProvider({
         oidc: options.oidc,
         refreshToken: options.refreshToken,
+        cryptoService: options.cryptoService,
     });
     const accessToken = await authProvider.oidcAuth.get();
     const userEntitlementsResponse = await fetch(`${options.platformEndpoint}/shared/entitlements`, {
@@ -185,17 +188,13 @@ async function getCertificatesForNamespace(dspClient, namespaceId) {
  * ```
  */
 async function getTrustedCertificates(options) {
-    function generateSigningKeyPair() {
-        return crypto.subtle.generateKey({
-            name: 'ECDSA',
-            namedCurve: 'P-256',
-        }, true, ['sign', 'verify']);
-    }
+    const cs = options.cryptoService ?? singlecontainer_1.WebCryptoService;
     const authProvider = await createAuthProvider({
         oidc: options.oidc,
         refreshToken: options.refreshToken,
+        cryptoService: options.cryptoService,
     });
-    await authProvider.updateClientPublicKey(await generateSigningKeyPair());
+    await authProvider.updateClientPublicKey(await cs.generateSigningKeyPair());
     // Create both clients
     const platform = new platform_1.PlatformClient({
         authProvider,
@@ -311,7 +310,7 @@ function pemToArrayBuffer(pem) {
  * }
  * ```
  */
-async function validateJWSCertificateChain(x5c, trustedRootCertificates) {
+async function validateJWSCertificateChain(x5c, trustedRootCertificates, _cryptoService) {
     const warnings = [];
     try {
         // Validate inputs

package/lib-commonjs/tests/fips-crypto.unit.test.js

@@ -0,0 +1,260 @@
+"use strict";
+/*
+ * Copyright (c) Virtru Corporation.  All rights reserved.
+ *
+ * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const singlecontainer_1 = require("@opentdf/sdk/singlecontainer");
+const fips_crypto_service_1 = require("../src/lib/fips-crypto-service");
+(0, vitest_1.describe)('FIPS CryptoService - Methods', () => {
+    // RSA key slots are finite in the WASM keystore. Each describe group that
+    // uses RSA keys creates ONE shared key pair in beforeAll and releases it in
+    // afterAll so slots are reclaimed before the next group starts.
+    (0, vitest_1.describe)('sign and verify (asymmetric)', () => {
+        let keyPair;
+        (0, vitest_1.beforeAll)(async () => {
+            keyPair = await fips_crypto_service_1.FipsCryptoService.generateSigningKeyPair();
+        }, 60000);
+        (0, vitest_1.afterAll)(() => {
+            (0, fips_crypto_service_1.unwrapPublicKey)(keyPair.publicKey).release();
+        });
+        (0, vitest_1.test)('should sign and verify with RS256', async () => {
+            const data = new Uint8Array([1, 2, 3, 4, 5]);
+            const signature = await fips_crypto_service_1.FipsCryptoService.sign(data, keyPair.privateKey, 'RS256');
+            const isValid = await fips_crypto_service_1.FipsCryptoService.verify(data, signature, keyPair.publicKey, 'RS256');
+            (0, vitest_1.expect)(isValid).toBe(true);
+        });
+        (0, vitest_1.test)('should reject tampered data', async () => {
+            const data = new Uint8Array([1, 2, 3, 4, 5]);
+            const signature = await fips_crypto_service_1.FipsCryptoService.sign(data, keyPair.privateKey, 'RS256');
+            const tamperedData = new Uint8Array([1, 2, 3, 4, 6]);
+            const isValid = await fips_crypto_service_1.FipsCryptoService.verify(tamperedData, signature, keyPair.publicKey, 'RS256');
+            (0, vitest_1.expect)(isValid).toBe(false);
+        });
+        (0, vitest_1.test)('should throw error for ES256 (EC not supported)', async () => {
+            await (0, vitest_1.expect)(fips_crypto_service_1.FipsCryptoService.sign(new Uint8Array([1, 2, 3, 4]), keyPair.privateKey, 'ES256')).rejects.toThrow('not supported in FIPS mode');
+        });
+        (0, vitest_1.test)('encryption key pair (RSA-OAEP) should not be usable for signing', async () => {
+            // Catches algorithm mismatch: if generateKeyPair() incorrectly used
+            // RSASSA-PKCS1-v1_5 params, signing would succeed here instead of throwing.
+            const encKeyPair = await fips_crypto_service_1.FipsCryptoService.generateKeyPair();
+            await (0, vitest_1.expect)(fips_crypto_service_1.FipsCryptoService.sign(new Uint8Array([1, 2, 3]), encKeyPair.privateKey, 'RS256')).rejects.toThrow();
+            (0, fips_crypto_service_1.unwrapPublicKey)(encKeyPair.publicKey).release();
+            (0, fips_crypto_service_1.unwrapPrivateKey)(encKeyPair.privateKey).release();
+        });
+    });
+    (0, vitest_1.describe)('hmac and verifyHmac', () => {
+        (0, vitest_1.test)('should compute and verify HMAC-SHA256', async () => {
+            const crypto = fips_crypto_service_1.FipsCryptoService;
+            const keyBytes = await crypto.randomBytes(32);
+            const symKey = await crypto.importSymmetricKey(keyBytes);
+            const data = new Uint8Array([1, 2, 3, 4, 5]);
+            const signature = await crypto.hmac(data, symKey);
+            const isValid = await crypto.verifyHmac(data, signature, symKey);
+            (0, vitest_1.expect)(isValid).toBe(true);
+        });
+        (0, vitest_1.test)('should reject invalid signature', async () => {
+            const crypto = fips_crypto_service_1.FipsCryptoService;
+            const symKey = await crypto.generateKey(32);
+            const data = new Uint8Array([1, 2, 3, 4]);
+            const signature = await crypto.hmac(data, symKey);
+            signature[0] ^= 1; // Flip a bit
+            const isValid = await crypto.verifyHmac(data, signature, symKey);
+            (0, vitest_1.expect)(isValid).toBe(false);
+        });
+        (0, vitest_1.test)('should reject signature with wrong key', async () => {
+            const crypto = fips_crypto_service_1.FipsCryptoService;
+            const symKey1 = await crypto.importSymmetricKey(await crypto.randomBytes(32));
+            const symKey2 = await crypto.importSymmetricKey(await crypto.randomBytes(32));
+            const data = new Uint8Array([1, 2, 3, 4]);
+            const signature = await crypto.hmac(data, symKey1);
+            const isValid = await crypto.verifyHmac(data, signature, symKey2);
+            (0, vitest_1.expect)(isValid).toBe(false);
+        });
+    });
+    (0, vitest_1.describe)('digest', () => {
+        (0, vitest_1.test)('should compute SHA-256 hash', async () => {
+            const data = new Uint8Array([1, 2, 3, 4]);
+            const hash = await fips_crypto_service_1.FipsCryptoService.digest('SHA-256', data);
+            (0, vitest_1.expect)(hash).toBeInstanceOf(Uint8Array);
+            (0, vitest_1.expect)(hash.byteLength).toBe(32);
+        });
+        (0, vitest_1.test)('should produce consistent hashes', async () => {
+            const data = new Uint8Array([1, 2, 3, 4]);
+            const hash1 = await fips_crypto_service_1.FipsCryptoService.digest('SHA-256', data);
+            const hash2 = await fips_crypto_service_1.FipsCryptoService.digest('SHA-256', data);
+            (0, vitest_1.expect)(hash1).toEqual(hash2);
+        });
+        (0, vitest_1.test)('should throw error for SHA-384 (not supported)', async () => {
+            await (0, vitest_1.expect)(fips_crypto_service_1.FipsCryptoService.digest('SHA-384', new Uint8Array([1, 2, 3, 4]))).rejects.toThrow('not supported in FIPS mode');
+        });
+    });
+    (0, vitest_1.describe)('EC placeholder methods', () => {
+        (0, vitest_1.test)('should throw error for generateECKeyPair', async () => {
+            await (0, vitest_1.expect)(fips_crypto_service_1.FipsCryptoService.generateECKeyPair()).rejects.toThrow('not supported in FIPS mode');
+        });
+        (0, vitest_1.test)('should throw error for deriveKeyFromECDH', async () => {
+            await (0, vitest_1.expect)(fips_crypto_service_1.FipsCryptoService.deriveKeyFromECDH({}, {}, {
+                hash: 'SHA-256',
+                salt: new Uint8Array(),
+            })).rejects.toThrow('not supported in FIPS mode');
+        });
+    });
+    (0, vitest_1.describe)('exportPublicKeyPem', () => {
+        let keyPair;
+        (0, vitest_1.beforeAll)(async () => {
+            keyPair = await fips_crypto_service_1.FipsCryptoService.generateKeyPair();
+        }, 60000);
+        (0, vitest_1.afterAll)(() => {
+            (0, fips_crypto_service_1.unwrapPublicKey)(keyPair.publicKey).release();
+        });
+        (0, vitest_1.test)('should export generated public key to PEM', async () => {
+            const pem = await fips_crypto_service_1.FipsCryptoService.exportPublicKeyPem(keyPair.publicKey);
+            (0, vitest_1.expect)(pem).toContain('-----BEGIN PUBLIC KEY-----');
+            (0, vitest_1.expect)(pem).toContain('-----END PUBLIC KEY-----');
+        });
+    });
+    (0, vitest_1.describe)('importPublicKey', () => {
+        let keyPair;
+        let importedKey;
+        (0, vitest_1.beforeAll)(async () => {
+            const crypto = fips_crypto_service_1.FipsCryptoService;
+            keyPair = await crypto.generateKeyPair(2048);
+            const pem = await crypto.exportPublicKeyPem(keyPair.publicKey);
+            importedKey = await crypto.importPublicKey(pem, { usage: 'encrypt' });
+        }, 60000);
+        (0, vitest_1.afterAll)(() => {
+            (0, fips_crypto_service_1.unwrapPublicKey)(keyPair.publicKey).release();
+            (0, fips_crypto_service_1.unwrapPublicKey)(importedKey).release();
+        });
+        (0, vitest_1.test)('should import PEM and detect RSA-2048', () => {
+            (0, vitest_1.expect)(importedKey.algorithm).toBe('rsa:2048');
+        });
+    });
+    (0, vitest_1.describe)('exportPublicKeyJwk', () => {
+        let keyPair;
+        (0, vitest_1.beforeAll)(async () => {
+            keyPair = await fips_crypto_service_1.FipsCryptoService.generateKeyPair(2048);
+        }, 60000);
+        (0, vitest_1.afterAll)(() => {
+            (0, fips_crypto_service_1.unwrapPublicKey)(keyPair.publicKey).release();
+        });
+        (0, vitest_1.test)('should export public key to JWK', async () => {
+            const jwk = await fips_crypto_service_1.FipsCryptoService.exportPublicKeyJwk(keyPair.publicKey);
+            (0, vitest_1.expect)(jwk.kty).toBe('RSA');
+            (0, vitest_1.expect)(jwk.n).toBeDefined();
+            (0, vitest_1.expect)(jwk.e).toBeDefined();
+            (0, vitest_1.expect)(typeof jwk.n).toBe('string');
+            (0, vitest_1.expect)(typeof jwk.e).toBe('string');
+        });
+        (0, vitest_1.test)('should produce a JWK that round-trips back to SPKI', async () => {
+            const jwk = await fips_crypto_service_1.FipsCryptoService.exportPublicKeyJwk(keyPair.publicKey);
+            const webKey = await globalThis.crypto.subtle.importKey('jwk', jwk, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, true, ['verify']);
+            const spki = await globalThis.crypto.subtle.exportKey('spki', webKey);
+            (0, vitest_1.expect)(spki.byteLength).toBeGreaterThan(0);
+        });
+    });
+    (0, vitest_1.describe)('encrypt and decrypt (symmetric AES-GCM)', () => {
+        (0, vitest_1.test)('should round-trip encrypt/decrypt', async () => {
+            const key = await fips_crypto_service_1.FipsCryptoService.generateKey();
+            const iv = singlecontainer_1.Binary.fromArrayBuffer((await fips_crypto_service_1.FipsCryptoService.randomBytes(12)).buffer);
+            const plaintext = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]);
+            const { payload: cipher, authTag } = await fips_crypto_service_1.FipsCryptoService.encrypt(singlecontainer_1.Binary.fromArrayBuffer(plaintext.buffer), key, iv);
+            const { payload: recovered } = await fips_crypto_service_1.FipsCryptoService.decrypt(cipher, key, iv, undefined, authTag);
+            (0, vitest_1.expect)(new Uint8Array(recovered.asArrayBuffer())).toEqual(plaintext);
+        });
+        (0, vitest_1.test)('should produce different ciphertext for different IVs', async () => {
+            const key = await fips_crypto_service_1.FipsCryptoService.generateKey();
+            const plaintext = singlecontainer_1.Binary.fromArrayBuffer(new Uint8Array([1, 2, 3, 4]).buffer);
+            const iv1 = singlecontainer_1.Binary.fromArrayBuffer((await fips_crypto_service_1.FipsCryptoService.randomBytes(12)).buffer);
+            const iv2 = singlecontainer_1.Binary.fromArrayBuffer((await fips_crypto_service_1.FipsCryptoService.randomBytes(12)).buffer);
+            const { payload: cipher1 } = await fips_crypto_service_1.FipsCryptoService.encrypt(plaintext, key, iv1);
+            const { payload: cipher2 } = await fips_crypto_service_1.FipsCryptoService.encrypt(plaintext, key, iv2);
+            (0, vitest_1.expect)(new Uint8Array(cipher1.asArrayBuffer())).not.toEqual(new Uint8Array(cipher2.asArrayBuffer()));
+        });
+    });
+    (0, vitest_1.describe)('encryptWithPublicKey and decryptWithPrivateKey (RSA-OAEP)', () => {
+        let keyPair;
+        (0, vitest_1.beforeAll)(async () => {
+            keyPair = await fips_crypto_service_1.FipsCryptoService.generateKeyPair();
+        }, 60000);
+        (0, vitest_1.afterAll)(() => {
+            (0, fips_crypto_service_1.unwrapPublicKey)(keyPair.publicKey).release();
+        });
+        (0, vitest_1.test)('should round-trip RSA encrypt/decrypt', async () => {
+            const plaintext = new Uint8Array([10, 20, 30, 40, 50]);
+            const encrypted = await fips_crypto_service_1.FipsCryptoService.encryptWithPublicKey(singlecontainer_1.Binary.fromArrayBuffer(plaintext.buffer), keyPair.publicKey);
+            const decrypted = await fips_crypto_service_1.FipsCryptoService.decryptWithPrivateKey(encrypted, keyPair.privateKey);
+            (0, vitest_1.expect)(new Uint8Array(decrypted.asArrayBuffer())).toEqual(plaintext);
+        });
+        (0, vitest_1.test)('should produce different ciphertext each call (RSA-OAEP is randomized)', async () => {
+            const payload = singlecontainer_1.Binary.fromArrayBuffer(new Uint8Array([1, 2, 3]).buffer);
+            const enc1 = await fips_crypto_service_1.FipsCryptoService.encryptWithPublicKey(payload, keyPair.publicKey);
+            const enc2 = await fips_crypto_service_1.FipsCryptoService.encryptWithPublicKey(payload, keyPair.publicKey);
+            (0, vitest_1.expect)(new Uint8Array(enc1.asArrayBuffer())).not.toEqual(new Uint8Array(enc2.asArrayBuffer()));
+        });
+        (0, vitest_1.test)('signing key pair (RSASSA-PKCS1-v1_5) should not be usable for encryption', async () => {
+            // Catches algorithm mismatch: if generateSigningKeyPair() incorrectly used
+            // RSA-OAEP params, encryption would succeed here instead of throwing.
+            const signingKp = await fips_crypto_service_1.FipsCryptoService.generateSigningKeyPair();
+            await (0, vitest_1.expect)(fips_crypto_service_1.FipsCryptoService.encryptWithPublicKey(singlecontainer_1.Binary.fromArrayBuffer(new Uint8Array([1, 2, 3]).buffer), signingKp.publicKey)).rejects.toThrow();
+            (0, fips_crypto_service_1.unwrapPublicKey)(signingKp.publicKey).release();
+            (0, fips_crypto_service_1.unwrapPrivateKey)(signingKp.privateKey).release();
+        });
+    });
+    (0, vitest_1.describe)('importPrivateKey and exportPrivateKeyPem', () => {
+        let privKey;
+        (0, vitest_1.beforeAll)(async () => {
+            const kp = await globalThis.crypto.subtle.generateKey({
+                name: 'RSASSA-PKCS1-v1_5',
+                modulusLength: 2048,
+                publicExponent: new Uint8Array([1, 0, 1]),
+                hash: 'SHA-256',
+            }, true, ['sign', 'verify']);
+            const pkcs8 = await globalThis.crypto.subtle.exportKey('pkcs8', kp.privateKey);
+            const b64 = btoa(String.fromCharCode(...new Uint8Array(pkcs8)));
+            const pem = `-----BEGIN PRIVATE KEY-----\n${b64
+                .match(/.{1,64}/g)
+                .join('\n')}\n-----END PRIVATE KEY-----`;
+            privKey = await (0, fips_crypto_service_1.importPrivateKey)(pem, {
+                usage: 'sign',
+                extractable: true,
+            });
+        }, 60000);
+        (0, vitest_1.afterAll)(() => {
+            (0, fips_crypto_service_1.unwrapPrivateKey)(privKey).release();
+        });
+        (0, vitest_1.test)('should import PKCS#8 PEM private key', () => {
+            (0, vitest_1.expect)(privKey.algorithm).toBe('rsa:2048');
+        });
+        (0, vitest_1.test)('should export imported private key back to PEM', async () => {
+            const exported = await (0, fips_crypto_service_1.exportPrivateKeyPem)(privKey);
+            (0, vitest_1.expect)(exported).toContain('-----BEGIN PRIVATE KEY-----');
+            (0, vitest_1.expect)(exported).toContain('-----END PRIVATE KEY-----');
+        });
+    });
+    (0, vitest_1.describe)('splitSymmetricKey and mergeSymmetricKeys', () => {
+        (0, vitest_1.test)('splitSymmetricKey with 1 share returns the same key (single-KAS identity)', async () => {
+            const key = await fips_crypto_service_1.FipsCryptoService.generateKey();
+            const shares = await fips_crypto_service_1.FipsCryptoService.splitSymmetricKey(key, 1);
+            (0, vitest_1.expect)(shares).toHaveLength(1);
+            (0, vitest_1.expect)(shares[0]).toBe(key);
+        });
+        (0, vitest_1.test)('mergeSymmetricKeys with 1 share returns the same key (single-KAS identity)', async () => {
+            const key = await fips_crypto_service_1.FipsCryptoService.generateKey();
+            const merged = await fips_crypto_service_1.FipsCryptoService.mergeSymmetricKeys([key]);
+            (0, vitest_1.expect)(merged).toBe(key);
+        });
+        (0, vitest_1.test)('splitSymmetricKey with 2 shares throws (multi-KAS not yet supported)', async () => {
+            const key = await fips_crypto_service_1.FipsCryptoService.generateKey();
+            await (0, vitest_1.expect)(fips_crypto_service_1.FipsCryptoService.splitSymmetricKey(key, 2)).rejects.toThrow('not yet supported in FIPS mode');
+        });
+        (0, vitest_1.test)('mergeSymmetricKeys with 2 shares throws (multi-KAS not yet supported)', async () => {
+            const key1 = await fips_crypto_service_1.FipsCryptoService.generateKey();
+            const key2 = await fips_crypto_service_1.FipsCryptoService.generateKey();
+            await (0, vitest_1.expect)(fips_crypto_service_1.FipsCryptoService.mergeSymmetricKeys([key1, key2])).rejects.toThrow('not yet supported in FIPS mode');
+        });
+    });
+});

package/lib-commonjs/tests/setup-unit.js

@@ -0,0 +1,72 @@
+"use strict";
+/*
+ * Copyright (c) Virtru Corporation.  All rights reserved.
+ *
+ * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const buffer_1 = require("buffer");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const node_util_1 = require("node:util");
+globalThis.Buffer = buffer_1.Buffer;
+if (!globalThis.TextEncoder) {
+    globalThis.TextEncoder = node_util_1.TextEncoder;
+}
+if (!globalThis.TextDecoder) {
+    globalThis.TextDecoder = node_util_1.TextDecoder;
+}
+if (typeof window !== 'undefined' && !window.Module) {
+    window.Module = {};
+}
+// Prefer the copied local WASM artifact used by package scripts.
+const copiedWasmFilePath = node_path_1.default.resolve(process.cwd(), 'public/virtru.wasm');
+// Fallback for direct local runs when copy-wasm has not been executed.
+const sourceWasmFilePath = node_path_1.default.resolve(process.cwd(), '../fips-crypto-js/src/utils/virtru.wasm');
+let resolvedWasmFilePath = copiedWasmFilePath;
+try {
+    await (0, promises_1.access)(copiedWasmFilePath);
+}
+catch {
+    resolvedWasmFilePath = sourceWasmFilePath;
+}
+const originalFetch = globalThis.fetch;
+globalThis.fetch = async function (input, init) {
+    const url = typeof input === 'string'
+        ? input
+        : input instanceof URL
+            ? input.href
+            : input.url;
+    if (url && url.includes('virtru.wasm')) {
+        const wasmBytes = await (0, promises_1.readFile)(resolvedWasmFilePath);
+        return new Response(wasmBytes, {
+            status: 200,
+            headers: {
+                'content-type': 'application/wasm',
+            },
+        });
+    }
+    return originalFetch(input, init);
+};
+await Promise.resolve().then(() => require('@virtru-private/fips-crypto-js'));
+const isFipsReady = (candidate) => {
+    return (!!candidate &&
+        typeof candidate === 'object' &&
+        'isInitialized' in candidate &&
+        candidate.isInitialized === true &&
+        'generateKey' in candidate &&
+        typeof candidate.generateKey === 'function');
+};
+if (!isFipsReady(window.VirtruFipsWasmLib)) {
+    await new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => reject(new Error('Timeout waiting for VirtruCrypto WASM initialization in unit setup.')), 10000);
+        const onReady = () => {
+            clearTimeout(timeout);
+            resolve();
+        };
+        window.addEventListener('wasmReady', onReady, { once: true });
+    });
+}
+if (!isFipsReady(window.VirtruFipsWasmLib)) {
+    throw new Error('VirtruCrypto was loaded but not initialized in unit setup.');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@virtru/dsp-sdk",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "license": "SEE LICENSE IN LICENSE",
   "main": "dist/src/index.js",
   "exports": {
@@ -20,8 +20,11 @@
   },
   "devDependencies": {
     "@eslint/js": "~9.39.2",
+    "@rushstack/heft": "^1.1.14",
+    "@rushstack/heft-web-rig": "^1.3.0",
     "@types/node": "^22.0.0",
     "@vitest/browser": "~3.1.3",
+    "buffer": "^6.0.3",
     "eslint": "^9.17.0",
     "eslint-plugin-prettier": "^5.2.1",
     "globals": "^16.3.0",
@@ -32,15 +35,14 @@
     "typescript-eslint": "^8.39.1",
     "vite": "^5.4.21",
     "vite-plugin-dts": "^4.5.4",
-    "vitest": "~3.1.3"
+    "vitest": "~3.1.3",
+    "@virtru-private/fips-crypto-js": "0.3.0"
   },
   "dependencies": {
     "@bufbuild/protobuf": "^2.7.0",
     "@connectrpc/connect": "~2.0.2",
     "@connectrpc/connect-web": "~2.0.2",
-    "@opentdf/sdk": "0.9.0-rc.82",
-    "@rushstack/heft": "^1.1.14",
-    "@rushstack/heft-web-rig": "^1.3.0",
+    "@opentdf/sdk": "0.10.0-rc.97",
     "asn1js": "^3.0.5",
     "pkijs": "^3.0.19"
   },
@@ -48,9 +50,12 @@
     "build": "heft build --clean",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
-    "test": "vitest --run",
+    "test": "npm run test:unit",
+    "test:unit": "npm run build-fips-crypto && npm run copy-wasm && npx vitest --run --config vitest.config.ts",
     "update-protos": "./update-protos.sh",
+    "build-fips-crypto": "npm run build --prefix ../fips-crypto-js",
+    "copy-wasm": "mkdir -p public && cp ../fips-crypto-js/src/utils/virtru.wasm public/virtru.wasm",
     "_phase:build": "heft build --clean",
-    "_phase:test": "npm run test && heft test"
+    "_phase:test": "npm run build-fips-crypto && npm run copy-wasm && npm run test:unit && heft test"
   }
 }