@virtru/dsp-sdk 0.7.3 → 0.7.5

package/CHANGELOG.md

@@ -1,6 +1,20 @@
 # Change Log - @virtru/dsp-sdk
 
-This log was last generated on Tue, 28 Apr 2026 15:37:06 GMT and should not be manually modified.
+This log was last generated on Thu, 14 May 2026 17:39:47 GMT and should not be manually modified.
+
+## 0.7.5
+Thu, 14 May 2026 17:39:47 GMT
+
+### Patches
+
+- fix FIPS AES-GCM decrypt to accept payload with authTag appended (opentdf-sdk >=0.16 contract)
+
+## 0.7.4
+Tue, 28 Apr 2026 16:40:32 GMT
+
+### Patches
+
+- Fix fips library dynamic import for vite 8
 
 ## 0.7.3
 Tue, 28 Apr 2026 15:37:06 GMT

package/dist/src/lib/fips-crypto/primitives.js

@@ -67,9 +67,10 @@ export const getVirtruCrypto = async () => {
  * Loaded dynamically so non-FIPS consumers do not require the optional peer.
  */
 export const initializeFipsCrypto = () => {
-    // Keep specifier dynamic so Vite/Rollup does not eagerly resolve the optional
-    // peer in non-FIPS builds; load occurs only when FIPS mode is enabled.
-    const modulePath = '@virtru-private/fips-crypto-js';
+    // .join() prevents esbuild from constant-folding the specifier into a string
+    // literal, which would cause Vite 8's import-analysis to error on the
+    // unresolvable bare specifier. @vite-ignore kept for defense in depth.
+    const modulePath = ['@virtru-private', 'fips-crypto-js'].join('/');
     void import(/* @vite-ignore */ modulePath).catch((err) => {
         console.error('Virtru FIPS crypto initialization failed: @virtru-private/fips-crypto-js is not installed.', err);
     });

package/dist/src/lib/fips-crypto/symmetric.js

@@ -58,10 +58,11 @@ export async function decrypt(payload, key, iv, algorithm, authTag) {
     const algName = algorithm === AES_CBC_URN ? 'AES-CBC' : 'AES-GCM';
     let payloadBytes = new Uint8Array(payload.asArrayBuffer());
     const ivBytes = new Uint8Array(iv.asArrayBuffer());
-    if (algName === 'AES-GCM') {
-        if (!authTag) {
-            throw new Error('Missing authTag for AES-GCM decryption');
-        }
+    if (algName === 'AES-GCM' && authTag) {
+        // Legacy contract (opentdf-sdk <0.16): authTag passed separately —
+        // recombine for WebCrypto, which expects payload || authTag.
+        // >=0.16 (web-sdk PR #922): the tag is already appended to payload, so
+        // we pass it through unchanged. Mirrors DefaultCryptoService behaviour.
         const tagBytes = new Uint8Array(authTag.asArrayBuffer());
         const combined = new Uint8Array(payloadBytes.length + tagBytes.length);
         combined.set(payloadBytes, 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@virtru/dsp-sdk",
-  "version": "0.7.3",
+  "version": "0.7.5",
   "license": "SEE LICENSE IN LICENSE",
   "main": "dist/src/index.js",
   "exports": {