@virtru/dsp-sdk 0.5.0 → 0.7.0

package/CHANGELOG.md

@@ -1,6 +1,20 @@
 # Change Log - @virtru/dsp-sdk
 
-This log was last generated on Thu, 12 Mar 2026 16:58:37 GMT and should not be manually modified.
+This log was last generated on Mon, 20 Apr 2026 14:09:22 GMT and should not be manually modified.
+
+## 0.7.0
+Mon, 20 Apr 2026 14:09:22 GMT
+
+### Minor changes
+
+- update vite and related dependencies to specific versions
+
+## 0.6.0
+Thu, 12 Mar 2026 20:33:42 GMT
+
+### Minor changes
+
+- expose fipsCryptoService implementation, useFips option
 
 ## 0.5.0
 Thu, 12 Mar 2026 16:58:37 GMT

package/README.md

@@ -79,16 +79,96 @@ console.log(decrypted); // "hello world"
 
 ```
 
+### FIPS Mode
+
+The SDK supports FIPS 140-2 compliant cryptography using a validated BoringSSL WASM module. To enable FIPS mode:
+
+```typescript
+import { AuthProviders, DSP } from '@virtru/dsp-sdk';
+import { FipsCryptoService } from '@virtru/dsp-sdk/fips';
+
+// Create auth provider with FIPS crypto service
+const authProvider = await AuthProviders.clientSecretAuthProvider(
+  {
+    clientId: 'your-client-id',
+    clientSecret: 'your-client-secret',
+    oidcOrigin: 'https://oidc-endpoint',
+    exchange: 'client',
+  },
+  FipsCryptoService  // Use FIPS-validated crypto
+);
+
+// Initialize DSP with FIPS mode enabled
+const dsp = new DSP({
+  authProvider,
+  platformUrl: 'https://dsp-platform-url',
+  useFips: true,  // Enables FIPS mode
+});
+
+// Check if FIPS is enabled
+console.log('FIPS enabled:', dsp.fipsEnabled);  // true
+```
+
+When FIPS mode is enabled, TDF3/ZTDF cryptographic operations (encryption, decryption, signing, key generation) use the FIPS-validated BoringSSL WASM module instead of Web Crypto API (`crypto.subtle`). NanoTDF operations are not covered by FIPS mode and continue to use `crypto.subtle`.
+
+**Note:** FIPS mode only supports RSA keys; EC (Elliptic Curve) operations are not available in FIPS mode.
+
 Refer to the API documentation for a complete list of available methods and configuration options.
 
 ## Testing
 
-This section is intended for repository maintainers and contributors. To verify the integrity of the SDK and ensure all features work as expected, run the test suite using the following command:
+This section is intended for repository maintainers and contributors.
+
+The test setup is split into:
+- **Unit tests** (`test:unit`): run in Vitest `jsdom` mode and do **not** require Playwright.
+- **Integration/browser tests** (`test:integration`): run in Chromium via Playwright.
+
+To run the unit suite:
+
+```bash
+pnpm run build-fips-crypto
+pnpm run copy-wasm
+pnpm test:unit
+```
+
+To run the browser/integration suite:
+
+```bash
+pnpm test:integration
+```
+
+To run both:
 
 ```bash
 pnpm test
 ```
 
+### Integration Tests
+
+Integration tests verify end-to-end encrypt/decrypt operations against a live DSP server, including FIPS mode compliance testing.
+
+**Required environment variables:**
+```bash
+export DSP_PLATFORM_URL="http://localhost:8080"      # DSP platform URL
+export CLIENT_ID="your-client-id"                    # OAuth client ID
+export CLIENT_SECRET="your-client-secret"            # OAuth client secret
+export OIDC_ENDPOINT="http://localhost:8888/auth/realms/opentdf"  # OIDC endpoint
+```
+
+**Run integration tests:**
+```bash
+pnpm run build-fips-crypto
+pnpm run copy-wasm
+pnpm test:integration
+```
+
+**Run all tests (unit + integration):**
+```bash
+pnpm test
+```
+
+Integration tests include FIPS compliance verification to ensure `crypto.subtle` is not used when FIPS mode is enabled (validating that only FIPS-certified BoringSSL WASM is used for cryptographic operations).
+
 
 ### Linting
 
@@ -165,5 +245,3 @@ You only need to regenerate the code when:
 - Proto dependencies are updated
 
 After regenerating, commit the updated files in `src/gen/` to version control.
-
-

package/dist/src/fips.d.ts

@@ -0,0 +1,7 @@
+/**
+ * FIPS entrypoint — only import this if @virtru-private/fips-crypto-js is installed.
+ *
+ * @example
+ * import { FipsCryptoService, initializeFipsCrypto } from '@virtru/dsp-sdk/fips';
+ */
+export { FipsCryptoService, initializeFipsCrypto, } from './lib/fips-crypto-service';

package/dist/src/fips.js

@@ -0,0 +1,12 @@
+/*
+ * Copyright (c) Virtru Corporation.  All rights reserved.
+ *
+ * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
+ */
+/**
+ * FIPS entrypoint — only import this if @virtru-private/fips-crypto-js is installed.
+ *
+ * @example
+ * import { FipsCryptoService, initializeFipsCrypto } from '@virtru/dsp-sdk/fips';
+ */
+export { FipsCryptoService, initializeFipsCrypto, } from './lib/fips-crypto-service';

package/dist/src/lib/dsp.d.ts

@@ -1,4 +1,4 @@
-import { OpenTDF, type OpenTDFOptions } from '@opentdf/sdk';
+import { OpenTDF, type OpenTDFOptions, type CryptoService } from '@opentdf/sdk';
 import { type PlatformServices } from '@opentdf/sdk/platform';
 import { type DSPClientServicesV1, type DSPClientServicesV2 } from './client';
 import type { Interceptor } from '@connectrpc/connect';
@@ -7,8 +7,24 @@ export type DSPServicesV2 = DSPClientServicesV2;
 export interface DSPOptions extends OpenTDFOptions {
     platformUrl: string;
     interceptors?: Interceptor[];
+    /**
+     * Enable FIPS 140-2 compliant cryptography for TDF3/ZTDF operations.
+     * When true, uses @virtru-private/fips-mode for encryption/decryption.
+     * Requires @virtru-private/fips-crypto-js WASM module to be loaded.
+     *
+     * Note: NanoTDF operations are NOT affected by this flag and will
+     * continue to use native crypto.subtle (not FIPS-compliant).
+     */
+    useFips?: boolean;
+    /**
+     * Optional: Provide a custom CryptoService implementation for TDF3/ZTDF.
+     * If provided, this takes precedence over useFips flag.
+     * NanoTDF operations are not affected.
+     */
+    cryptoService?: CryptoService;
 }
 export declare class DSP extends OpenTDF {
+    readonly fipsEnabled: boolean;
     readonly services: {
         v1: DSPServicesV1;
         v2: DSPServicesV2;

package/dist/src/lib/dsp.js

@@ -3,21 +3,44 @@
  *
  * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
  */
-import { OpenTDF } from '@opentdf/sdk';
+import { OpenTDF, } from '@opentdf/sdk';
 import { PlatformClient } from '@opentdf/sdk/platform';
 import { DSPClient, } from './client';
+import { FipsCryptoService, initializeFipsCrypto } from './fips-crypto-service';
 export class DSP extends OpenTDF {
     constructor(options) {
-        super(options);
+        // Validate required options first
+        if (!options.platformUrl) {
+            throw new Error('platformUrl is required for DSP client');
+        }
+        // Configure FIPS crypto service for TDF3/ZTDF
+        const configuredOptions = { ...options };
+        if (options.useFips && options.cryptoService) {
+            console.warn('[DSP] Both useFips and cryptoService are set. useFips will be ignored — the provided cryptoService will be used.');
+        }
+        if (options.cryptoService) {
+            configuredOptions.cryptoService = options.cryptoService;
+        }
+        else if (options.useFips) {
+            initializeFipsCrypto();
+            configuredOptions.cryptoService = FipsCryptoService;
+        }
+        // Pass configured options to OpenTDF
+        super(configuredOptions);
+        Object.defineProperty(this, "fipsEnabled", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         Object.defineProperty(this, "services", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: void 0
         });
-        if (!options.platformUrl) {
-            throw new Error('platformUrl is required for DSP client');
-        }
+        this.fipsEnabled = configuredOptions.cryptoService === FipsCryptoService;
+        // Setup DSP and Platform clients
         const dspClient = new DSPClient({
             platformUrl: options.platformUrl,
             interceptors: options.interceptors,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@virtru/dsp-sdk",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "license": "SEE LICENSE IN LICENSE",
   "main": "dist/src/index.js",
   "exports": {
@@ -9,12 +9,24 @@
       "import": "./dist/src/index.js",
       "require": "./dist-commonjs/src/index.js"
     },
+    "./fips": {
+      "types": "./dist/src/fips.d.ts",
+      "import": "./dist/src/fips.js",
+      "require": "./dist-commonjs/src/fips.js"
+    },
     "./platform/*": {
       "types": "./dist/src/gen/*.d.ts",
       "import": "./dist/src/gen/*.js",
       "require": "./dist-commonjs/src/gen/*.js"
     }
   },
+  "files": [
+    "dist/src/**",
+    "dist-commonjs/src/**",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
   "engines": {
     "node": ">=18.0.0"
   },
@@ -33,10 +45,10 @@
     "playwright": "^1.52.0",
     "typescript": "5.8.2",
     "typescript-eslint": "^8.39.1",
-    "vite": "^5.4.21",
+    "vite": "8.0.8",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "~3.1.3",
-    "@virtru-private/fips-crypto-js": "0.3.0"
+    "@virtru-private/fips-crypto-js": "0.4.0"
   },
   "dependencies": {
     "@bufbuild/protobuf": "^2.7.0",
@@ -46,12 +58,21 @@
     "asn1js": "^3.0.5",
     "pkijs": "^3.0.19"
   },
+  "peerDependencies": {
+    "@virtru-private/fips-crypto-js": "0.4.0"
+  },
+  "peerDependenciesMeta": {
+    "@virtru-private/fips-crypto-js": {
+      "optional": true
+    }
+  },
   "scripts": {
     "build": "heft build --clean",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
-    "test": "npm run test:unit",
+    "test": "npm run test:unit && npm run test:integration",
     "test:unit": "npm run build-fips-crypto && npm run copy-wasm && npx vitest --run --config vitest.config.ts",
+    "test:integration": "npm run build-fips-crypto && npm run copy-wasm && npx vitest --run --config vitest.integration.config.ts",
     "update-protos": "./update-protos.sh",
     "build-fips-crypto": "npm run build --prefix ../fips-crypto-js",
     "copy-wasm": "mkdir -p public && cp ../fips-crypto-js/src/utils/virtru.wasm public/virtru.wasm",

package/.prettierrc

@@ -1,3 +0,0 @@
-{
-  "singleQuote": true
-}

package/.rush/temp/chunked-rush-logs/dsp-sdk._phase_build.chunks.jsonl

@@ -1,12 +0,0 @@
-{"kind":"O","text":"Invoking: heft build --clean --production\n"}
-{"kind":"O","text":" ---- build started ---- \n"}
-{"kind":"O","text":"[build:set-browserslist-ignore-old-data-env-var] Setting environment variable BROWSERSLIST_IGNORE_OLD_DATA=1\n"}
-{"kind":"O","text":"[build:sass] Starting...\n"}
-{"kind":"O","text":"[build:image-typings] Processing static assets...\n"}
-{"kind":"O","text":"[build:image-typings] Finished processing static assets.\n"}
-{"kind":"O","text":"[build:sass] No SCSS files to process.\n"}
-{"kind":"O","text":"[build:typescript] Using TypeScript version 5.8.2\n"}
-{"kind":"O","text":"[build:webpack] No Webpack configuration found\n"}
-{"kind":"O","text":"[build:lint] Using ESLint version 9.39.3\n"}
-{"kind":"O","text":" ---- build finished (6.641s) ---- \n"}
-{"kind":"O","text":"-------------------- Finished (6.647s) --------------------\n"}