@vollcrypt/files-node 0.1.1

package/index.d.ts

@@ -0,0 +1,167 @@
+/* tslint:disable */
+/* eslint-disable */
+
+/* auto-generated by NAPI-RS */
+
+export declare function generateDek(): Buffer
+export declare function generateFileId(): Buffer
+export declare function generateSalt(): Buffer
+export declare function generateGk(): Buffer
+export interface ChunkEnvelope {
+  chunkIndex: number
+  iv: Buffer
+  ciphertext: Buffer
+  tag: Buffer
+}
+export declare function encryptChunk(dek: Uint8Array, fileId: Uint8Array, chunkIndex: number, plaintext: Uint8Array): ChunkEnvelope
+export declare function decryptChunk(dek: Uint8Array, fileId: Uint8Array, chunkIndex: number, envelope: ChunkEnvelope): Buffer
+export declare function chunkLeafHash(envelope: ChunkEnvelope): Buffer
+export declare function merkleRoot(leaves: Array<Uint8Array>): Buffer
+export declare function merkleProof(leaves: Array<Uint8Array>, leafIndex: number): Array<Buffer>
+export declare function verifyMerkleProof(leaf: Uint8Array, leafIndex: number, totalLeaves: number, proof: Array<Uint8Array>, expectedRoot: Uint8Array): boolean
+export interface KdfChoice {
+  kind: string
+  rounds?: number
+  mCost?: number
+  tCost?: number
+  pCost?: number
+  salt?: Buffer
+}
+export interface WrapEntry {
+  kind: string
+  salt?: Buffer
+  rounds?: number
+  mCost?: number
+  tCost?: number
+  pCost?: number
+  recipientId?: Buffer
+  gkVersion?: number
+  ephemeralX25519?: Buffer
+  ciphertextMlKem?: Buffer
+  groupId?: Buffer
+  wrappedKey: Buffer
+}
+export declare function wrapDekWithPassword(dek: Uint8Array, password: string, kdf: KdfChoice): WrapEntry
+export declare function unwrapDekWithPassword(wrap: WrapEntry, password: string): Buffer
+export declare function unwrapDekWithPasswordAsync(wrap: WrapEntry, password: string): Promise<unknown>
+export interface KeySubpair {
+  x25519: Buffer
+  mlKem: Buffer
+}
+export interface RecipientKeypair {
+  publicKey: KeySubpair
+  secretKey: KeySubpair
+}
+export declare function generateRecipientKeypair(): RecipientKeypair
+export declare function wrapKeyToRecipient(key: Uint8Array, recipientId: Uint8Array, gkVersion: number, recipientPk: KeySubpair): WrapEntry
+export declare function unwrapKeyWithRecipientKey(wrap: WrapEntry, recipientSk: KeySubpair): Buffer
+export declare function wrapDekForGroup(dek: Uint8Array, groupId: Uint8Array, gkVersion: number, gk: Uint8Array): WrapEntry
+export declare function unwrapDekWithGroupKey(wrap: WrapEntry, gk: Uint8Array): Buffer
+export interface Ed25519KeypairObj {
+  publicKey: Buffer
+  secretKey: Buffer
+}
+export declare function ed25519KeypairGenerate(): Ed25519KeypairObj
+export declare function ed25519Sign(sk: Uint8Array, message: Uint8Array): Buffer
+export declare function ed25519Verify(pk: Uint8Array, message: Uint8Array, signature: Uint8Array): boolean
+export interface MemberPublicKeyObj {
+  recipient: KeySubpair
+  signingPk: Buffer
+}
+export interface SignedMetadata {
+  kind: string
+  signerPubkey?: Buffer
+  timestamp: number
+  keyLogId?: Buffer
+  sealedGroupId?: Buffer
+  sealedGkVersion?: number
+  iv?: Buffer
+  sealedPayload?: Buffer
+  sealedTag?: Buffer
+}
+export interface HeaderObj {
+  version: number
+  mode: number
+  cipherId: number
+  fileId: Buffer
+  chunkSize: number
+  plaintextSize: number
+  merkleRoot: Buffer
+  wraps: Array<WrapEntry>
+  signedMetadata?: SignedMetadata
+  signature?: Buffer
+}
+export interface ParsedHeaderObj {
+  header: HeaderObj
+  headerLen: number
+}
+export interface RewrapResult {
+  header: Buffer
+  updatedCount: number
+}
+export declare function rewrapDekInHeader(headerBytes: Uint8Array, oldGk: Uint8Array, newGk: Uint8Array, newGkVersion: number): RewrapResult
+export declare function cryptoShredHeader(headerBytes: Uint8Array): Buffer
+export declare function signHeaderPlain(header: HeaderObj, signerPk: Uint8Array, signerSk: Uint8Array, keyLogId: Uint8Array, timestamp: number): HeaderObj
+export declare function signHeaderSealed(header: HeaderObj, signerPk: Uint8Array, signerSk: Uint8Array, keyLogId: Uint8Array, timestamp: number, sealedGroupId: Uint8Array, sealedGkVersion: number, sealedGk: Uint8Array): HeaderObj
+export declare function verifyHeaderSignaturePlain(header: HeaderObj): Buffer
+export declare function verifyHeaderSignatureSealed(header: HeaderObj, sealedGk: Uint8Array): Buffer
+export interface KeyLogEntry {
+  kind: string
+  userId?: Buffer
+  deviceId: Buffer
+  devicePubkey?: Buffer
+  humanLabel?: string
+  prevHash: Buffer
+  timestamp: number
+  signature: Buffer
+}
+export interface SenderInfo {
+  signerPubkey: Buffer
+  userId: Buffer
+  deviceId: Buffer
+  deviceWasActive: boolean
+  humanLabel?: string
+}
+export declare function resolveSender(header: HeaderObj, keyLog: KeyLog, sealedGk?: Uint8Array | undefined | null): SenderInfo
+export interface PipelinedSignInfoObj {
+  kind: string
+  signerEd25519Pk: Buffer
+  signerEd25519Sk: Buffer
+  keyLogId: Buffer
+  timestamp: number
+  sealedGroupId?: Buffer
+  sealedGkVersion?: number
+  sealedGk?: Buffer
+}
+export declare function encryptFilePipelinedAsync(sourcePath: string, destPath: string, dek: Uint8Array, fileId: Uint8Array, chunkSize: number, wraps: Array<WrapEntry>, mode: number, numWorkers: number, signInfo?: PipelinedSignInfoObj | undefined | null): Promise<unknown>
+export declare function decryptFilePipelinedAsync(sourcePath: string, destPath: string, dek: Uint8Array, numWorkers: number): Promise<unknown>
+export declare class GroupManifest {
+  static genesis(groupId: Uint8Array, initialGk: Uint8Array, founderMemberId: Uint8Array, founderRecipientPk: KeySubpair, founderEd25519Pk: Uint8Array, founderEd25519Sk: Uint8Array, timestamp: number): GroupManifest
+  static parse(bytes: Uint8Array): GroupManifest
+  write(): Buffer
+  verify(): void
+  addMember(newMemberId: Uint8Array, newMemberPk: MemberPublicKeyObj, currentGk: Uint8Array, adminPk: Uint8Array, adminSk: Uint8Array, timestamp: number): void
+  removeMember(removedMemberId: Uint8Array, adminPk: Uint8Array, adminSk: Uint8Array, timestamp: number): void
+  rotateGroupKey(newGk: Uint8Array, adminPk: Uint8Array, adminSk: Uint8Array, timestamp: number): number
+  shredGroupKey(versionToShred: number, reason: string, adminPk: Uint8Array, adminSk: Uint8Array, timestamp: number): void
+  currentMembers(): Array<Buffer>
+  currentGkVersion(): number
+  findMemberWrap(memberId: Uint8Array): WrapEntry
+  findMemberWrapForVersion(memberId: Uint8Array, gkVersion: number): WrapEntry
+  isVersionShredded(gkVersion: number): boolean
+}
+export declare class HeaderClass {
+  static parse(bytes: Uint8Array): ParsedHeaderObj
+  static write(header: HeaderObj): Buffer
+}
+export declare class KeyLog {
+  static create(authorityPubkey: Uint8Array): KeyLog
+  static parse(bytes: Uint8Array): KeyLog
+  write(): Buffer
+  verify(): void
+  registerDevice(userId: Uint8Array, deviceId: Uint8Array, devicePk: Uint8Array, humanLabel: string, authoritySk: Uint8Array, timestamp: number): Buffer
+  revokeDevice(deviceId: Uint8Array, authoritySk: Uint8Array, timestamp: number): void
+  lookupByEntryHash(hash: Uint8Array): KeyLogEntry | null
+  deviceWasActiveAt(deviceId: Uint8Array, timestamp: number): boolean
+  userForDevice(deviceId: Uint8Array): Buffer | null
+}

package/index.js

@@ -0,0 +1,347 @@
+/* tslint:disable */
+/* eslint-disable */
+/* prettier-ignore */
+
+/* auto-generated by NAPI-RS */
+
+const { existsSync, readFileSync } = require('fs')
+const { join } = require('path')
+
+const { platform, arch } = process
+
+let nativeBinding = null
+let localFileExisted = false
+let loadError = null
+
+function isMusl() {
+  // For Node 10
+  if (!process.report || typeof process.report.getReport !== 'function') {
+    try {
+      const lddPath = require('child_process').execSync('which ldd').toString().trim()
+      return readFileSync(lddPath, 'utf8').includes('musl')
+    } catch (e) {
+      return true
+    }
+  } else {
+    const { glibcVersionRuntime } = process.report.getReport().header
+    return !glibcVersionRuntime
+  }
+}
+
+switch (platform) {
+  case 'android':
+    switch (arch) {
+      case 'arm64':
+        localFileExisted = existsSync(join(__dirname, 'vollcrypt-files-node.android-arm64.node'))
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./vollcrypt-files-node.android-arm64.node')
+          } else {
+            nativeBinding = require('@vollcrypt/files-node-android-arm64')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      case 'arm':
+        localFileExisted = existsSync(join(__dirname, 'vollcrypt-files-node.android-arm-eabi.node'))
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./vollcrypt-files-node.android-arm-eabi.node')
+          } else {
+            nativeBinding = require('@vollcrypt/files-node-android-arm-eabi')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      default:
+        throw new Error(`Unsupported architecture on Android ${arch}`)
+    }
+    break
+  case 'win32':
+    switch (arch) {
+      case 'x64':
+        localFileExisted = existsSync(
+          join(__dirname, 'vollcrypt-files-node.win32-x64-msvc.node')
+        )
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./vollcrypt-files-node.win32-x64-msvc.node')
+          } else {
+            nativeBinding = require('@vollcrypt/files-node-win32-x64-msvc')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      case 'ia32':
+        localFileExisted = existsSync(
+          join(__dirname, 'vollcrypt-files-node.win32-ia32-msvc.node')
+        )
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./vollcrypt-files-node.win32-ia32-msvc.node')
+          } else {
+            nativeBinding = require('@vollcrypt/files-node-win32-ia32-msvc')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      case 'arm64':
+        localFileExisted = existsSync(
+          join(__dirname, 'vollcrypt-files-node.win32-arm64-msvc.node')
+        )
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./vollcrypt-files-node.win32-arm64-msvc.node')
+          } else {
+            nativeBinding = require('@vollcrypt/files-node-win32-arm64-msvc')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      default:
+        throw new Error(`Unsupported architecture on Windows: ${arch}`)
+    }
+    break
+  case 'darwin':
+    localFileExisted = existsSync(join(__dirname, 'vollcrypt-files-node.darwin-universal.node'))
+    try {
+      if (localFileExisted) {
+        nativeBinding = require('./vollcrypt-files-node.darwin-universal.node')
+      } else {
+        nativeBinding = require('@vollcrypt/files-node-darwin-universal')
+      }
+      break
+    } catch {}
+    switch (arch) {
+      case 'x64':
+        localFileExisted = existsSync(join(__dirname, 'vollcrypt-files-node.darwin-x64.node'))
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./vollcrypt-files-node.darwin-x64.node')
+          } else {
+            nativeBinding = require('@vollcrypt/files-node-darwin-x64')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      case 'arm64':
+        localFileExisted = existsSync(
+          join(__dirname, 'vollcrypt-files-node.darwin-arm64.node')
+        )
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./vollcrypt-files-node.darwin-arm64.node')
+          } else {
+            nativeBinding = require('@vollcrypt/files-node-darwin-arm64')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      default:
+        throw new Error(`Unsupported architecture on macOS: ${arch}`)
+    }
+    break
+  case 'freebsd':
+    if (arch !== 'x64') {
+      throw new Error(`Unsupported architecture on FreeBSD: ${arch}`)
+    }
+    localFileExisted = existsSync(join(__dirname, 'vollcrypt-files-node.freebsd-x64.node'))
+    try {
+      if (localFileExisted) {
+        nativeBinding = require('./vollcrypt-files-node.freebsd-x64.node')
+      } else {
+        nativeBinding = require('@vollcrypt/files-node-freebsd-x64')
+      }
+    } catch (e) {
+      loadError = e
+    }
+    break
+  case 'linux':
+    switch (arch) {
+      case 'x64':
+        if (isMusl()) {
+          localFileExisted = existsSync(
+            join(__dirname, 'vollcrypt-files-node.linux-x64-musl.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./vollcrypt-files-node.linux-x64-musl.node')
+            } else {
+              nativeBinding = require('@vollcrypt/files-node-linux-x64-musl')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        } else {
+          localFileExisted = existsSync(
+            join(__dirname, 'vollcrypt-files-node.linux-x64-gnu.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./vollcrypt-files-node.linux-x64-gnu.node')
+            } else {
+              nativeBinding = require('@vollcrypt/files-node-linux-x64-gnu')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        }
+        break
+      case 'arm64':
+        if (isMusl()) {
+          localFileExisted = existsSync(
+            join(__dirname, 'vollcrypt-files-node.linux-arm64-musl.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./vollcrypt-files-node.linux-arm64-musl.node')
+            } else {
+              nativeBinding = require('@vollcrypt/files-node-linux-arm64-musl')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        } else {
+          localFileExisted = existsSync(
+            join(__dirname, 'vollcrypt-files-node.linux-arm64-gnu.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./vollcrypt-files-node.linux-arm64-gnu.node')
+            } else {
+              nativeBinding = require('@vollcrypt/files-node-linux-arm64-gnu')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        }
+        break
+      case 'arm':
+        if (isMusl()) {
+          localFileExisted = existsSync(
+            join(__dirname, 'vollcrypt-files-node.linux-arm-musleabihf.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./vollcrypt-files-node.linux-arm-musleabihf.node')
+            } else {
+              nativeBinding = require('@vollcrypt/files-node-linux-arm-musleabihf')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        } else {
+          localFileExisted = existsSync(
+            join(__dirname, 'vollcrypt-files-node.linux-arm-gnueabihf.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./vollcrypt-files-node.linux-arm-gnueabihf.node')
+            } else {
+              nativeBinding = require('@vollcrypt/files-node-linux-arm-gnueabihf')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        }
+        break
+      case 'riscv64':
+        if (isMusl()) {
+          localFileExisted = existsSync(
+            join(__dirname, 'vollcrypt-files-node.linux-riscv64-musl.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./vollcrypt-files-node.linux-riscv64-musl.node')
+            } else {
+              nativeBinding = require('@vollcrypt/files-node-linux-riscv64-musl')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        } else {
+          localFileExisted = existsSync(
+            join(__dirname, 'vollcrypt-files-node.linux-riscv64-gnu.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./vollcrypt-files-node.linux-riscv64-gnu.node')
+            } else {
+              nativeBinding = require('@vollcrypt/files-node-linux-riscv64-gnu')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        }
+        break
+      case 's390x':
+        localFileExisted = existsSync(
+          join(__dirname, 'vollcrypt-files-node.linux-s390x-gnu.node')
+        )
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./vollcrypt-files-node.linux-s390x-gnu.node')
+          } else {
+            nativeBinding = require('@vollcrypt/files-node-linux-s390x-gnu')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      default:
+        throw new Error(`Unsupported architecture on Linux: ${arch}`)
+    }
+    break
+  default:
+    throw new Error(`Unsupported OS: ${platform}, architecture: ${arch}`)
+}
+
+if (!nativeBinding) {
+  if (loadError) {
+    throw loadError
+  }
+  throw new Error(`Failed to load native binding`)
+}
+
+const { generateDek, generateFileId, generateSalt, generateGk, encryptChunk, decryptChunk, chunkLeafHash, merkleRoot, merkleProof, verifyMerkleProof, wrapDekWithPassword, unwrapDekWithPassword, unwrapDekWithPasswordAsync, generateRecipientKeypair, wrapKeyToRecipient, unwrapKeyWithRecipientKey, wrapDekForGroup, unwrapDekWithGroupKey, ed25519KeypairGenerate, ed25519Sign, ed25519Verify, GroupManifest, HeaderClass, rewrapDekInHeader, cryptoShredHeader, signHeaderPlain, signHeaderSealed, verifyHeaderSignaturePlain, verifyHeaderSignatureSealed, KeyLog, resolveSender, encryptFilePipelinedAsync, decryptFilePipelinedAsync } = nativeBinding
+
+module.exports.generateDek = generateDek
+module.exports.generateFileId = generateFileId
+module.exports.generateSalt = generateSalt
+module.exports.generateGk = generateGk
+module.exports.encryptChunk = encryptChunk
+module.exports.decryptChunk = decryptChunk
+module.exports.chunkLeafHash = chunkLeafHash
+module.exports.merkleRoot = merkleRoot
+module.exports.merkleProof = merkleProof
+module.exports.verifyMerkleProof = verifyMerkleProof
+module.exports.wrapDekWithPassword = wrapDekWithPassword
+module.exports.unwrapDekWithPassword = unwrapDekWithPassword
+module.exports.unwrapDekWithPasswordAsync = unwrapDekWithPasswordAsync
+module.exports.generateRecipientKeypair = generateRecipientKeypair
+module.exports.wrapKeyToRecipient = wrapKeyToRecipient
+module.exports.unwrapKeyWithRecipientKey = unwrapKeyWithRecipientKey
+module.exports.wrapDekForGroup = wrapDekForGroup
+module.exports.unwrapDekWithGroupKey = unwrapDekWithGroupKey
+module.exports.ed25519KeypairGenerate = ed25519KeypairGenerate
+module.exports.ed25519Sign = ed25519Sign
+module.exports.ed25519Verify = ed25519Verify
+module.exports.GroupManifest = GroupManifest
+module.exports.HeaderClass = HeaderClass
+module.exports.rewrapDekInHeader = rewrapDekInHeader
+module.exports.cryptoShredHeader = cryptoShredHeader
+module.exports.signHeaderPlain = signHeaderPlain
+module.exports.signHeaderSealed = signHeaderSealed
+module.exports.verifyHeaderSignaturePlain = verifyHeaderSignaturePlain
+module.exports.verifyHeaderSignatureSealed = verifyHeaderSignatureSealed
+module.exports.KeyLog = KeyLog
+module.exports.resolveSender = resolveSender
+module.exports.encryptFilePipelinedAsync = encryptFilePipelinedAsync
+module.exports.decryptFilePipelinedAsync = decryptFilePipelinedAsync

package/package.json

@@ -0,0 +1,65 @@
+{
+  "name": "@vollcrypt/files-node",
+  "version": "0.1.1",
+  "description": "Cross-platform, quantum-resistant file encryption engine for Node.js - native binding",
+  "main": "index.js",
+  "types": "index.d.ts",
+  "napi": {
+    "name": "vollcrypt-files-node",
+    "triples": {
+      "defaults": true,
+      "additional": [
+        "aarch64-apple-darwin",
+        "aarch64-unknown-linux-gnu",
+        "aarch64-unknown-linux-musl"
+      ]
+    }
+  },
+  "scripts": {
+    "build": "npx @napi-rs/cli build --platform --release",
+    "build:debug": "npx @napi-rs/cli build --platform",
+    "test": "node --import tsx --test tests/api.test.ts"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/BeratVural/vollcrypt.git",
+    "directory": "vollcrypt-files/node"
+  },
+  "homepage": "https://github.com/BeratVural/vollcrypt#readme",
+  "bugs": {
+    "url": "https://github.com/BeratVural/vollcrypt/issues"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "files": [
+    "index.d.ts",
+    "index.js",
+    "vollcrypt-files-node.*.node"
+  ],
+  "keywords": [
+    "vollcrypt",
+    "cryptography",
+    "encryption",
+    "file-encryption",
+    "aes-gcm",
+    "ed25519",
+    "x25519",
+    "ml-kem",
+    "post-quantum",
+    "pqc",
+    "e2ee",
+    "napi"
+  ],
+  "author": "Berat Vural <berat.vural.tr@gmail.com>",
+  "license": "GPL-3.0-only OR LicenseRef-Commercial",
+  "devDependencies": {
+    "@napi-rs/cli": "^2.18.4",
+    "@types/node": "^20.11.0",
+    "tsx": "^4.7.0",
+    "typescript": "^5.3.3"
+  }
+}