@wemush/wols 1.2.0 → 1.3.0

package/dist/cjs/crypto/encrypt.js

@@ -1,253 +1,334 @@
 "use strict";
 /**
- * WOLS Encryption Module
+ * WOLS Encryption Module (WOLS v1.3.0 encrypted format)
  *
- * Provides AES-256-GCM encryption for specimens using Web Crypto API.
- * Supports both password-based (PBKDF2) and raw CryptoKey encryption.
+ * AES-256-GCM via WebCrypto, so it runs in Node.js 20+, browsers, Deno and Bun.
  *
- * ## Security Model
+ * ## Wire format
  *
- * This module implements a **deterministic key derivation** model optimized for:
- * - Cross-environment compatibility (browser + Node.js)
- * - Offline decryption (no external key storage needed)
- * - Self-describing payloads (iterations stored in output)
- *
- * ### Password vs CryptoKey
- *
- * | Input Type | Use Case | Security Level |
- * |------------|----------|----------------|
- * | `string` (password) | Simple sharing, QR codes | Good (depends on password strength) |
- * | `CryptoKey` | Server-side, key management systems | Best (full control over key material) |
- *
- * ### Security Considerations
- *
- * 1. **Fixed Salt**: The PBKDF2 salt is fixed per crypto version. This is intentional
- *    for deterministic cross-environment key derivation. Password strength is critical.
- *
- * 2. **Iteration Count**: Default 100,000 iterations. Can be increased via `iterations`
- *    option for higher security (at cost of performance).
- *
- * 3. **Random IV**: Each encryption uses a cryptographically random 96-bit IV,
- *    ensuring identical plaintexts produce different ciphertexts.
- *
- * 4. **Authenticated Encryption**: AES-256-GCM provides both confidentiality and
- *    integrity - tampered ciphertext will fail decryption.
- *
- * ## Future Specification Updates (v1.2.1+)
- *
- * TODO(wols-spec): The following enhancements should be documented in the upstream
- * WOLS specification (wemush/open-standard/SPECIFICATION.md) in a future release:
+ * ```
+ * wemush://v1/encrypted/{id}?e={ciphertext}&iv={iv}&kdf={pbkdf2|raw}[&salt={salt}&i={iterations}]
+ * ```
  *
- * 1. **EncryptedSpecimen schema**: Define the `cryptoVersion` and `iterations` fields
- *    in the encrypted payload format section.
+ * - `e`: ciphertext with the 16-byte GCM tag appended
+ * - `iv`: fresh random 12-byte IV per encryption
+ * - All binary values are base64url without padding
  *
- * 2. **Configurable iterations**: Document the `iterations` option in EncryptionOptions
- *    with recommended ranges (100k-600k) and minimum floor (10k).
+ * ## Keys
  *
- * 3. **Self-describing payloads**: Explain that v1.2.0+ payloads include derivation
- *    parameters for forward-compatible decryption.
+ * | `key` value | `kdf` | Notes |
+ * |-------------|-------|-------|
+ * | `string` passphrase | `pbkdf2` | PBKDF2-HMAC-SHA256, fresh random 16-byte salt per label, ≥100,000 iterations |
+ * | 32-byte `Uint8Array` / `ArrayBuffer` | `raw` | Key shared out of band |
+ * | AES-GCM 256 `CryptoKey` | `raw` | Key shared out of band |
  *
- * 4. **Security guidance**: Add a security considerations section covering:
- *    - Fixed salt tradeoffs (determinism vs uniqueness)
- *    - Password strength requirements
- *    - When to use CryptoKey vs password
- *    - Optional random salt for high-security scenarios (future v2)
+ * Pre-1.3.0 releases derived passphrase keys with a fixed library-wide salt.
+ * That scheme is never generated any more; see `allowLegacy` on decryption.
  *
  * @module crypto/encrypt
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.toEncryptedUrl = toEncryptedUrl;
 exports.encryptSpecimen = encryptSpecimen;
+exports.encryptFields = encryptFields;
+exports.isEncryptedField = isEncryptedField;
+exports.isEncryptedSpecimen = isEncryptedSpecimen;
 exports.isEncrypted = isEncrypted;
+const errors_js_1 = require("../errors.js");
 const specimen_js_1 = require("../specimen.js");
-// =============================================================================
-// CONSTANTS
-// =============================================================================
-/**
- * Salt for PBKDF2 key derivation.
- *
- * DESIGN DECISION: This salt is intentionally fixed (not random) for deterministic
- * key derivation. This allows:
- *
- * 1. **Cross-environment compatibility**: Same password produces same key in
- *    browser (Web Crypto API) and server (Node.js crypto), enabling encrypted
- *    specimens to be decrypted in either environment.
- *
- * 2. **Offline decryption**: No need to store/transmit the salt alongside the
- *    encrypted payload - the salt is known from the library version.
- *
- * 3. **Version-aware migration**: The salt includes a version identifier
- *    (@wemush/wols/crypto/v1) allowing future versions to use different salts
- *    while maintaining backward compatibility for decryption.
- *
- * SECURITY NOTE: The fixed salt means password security depends entirely on
- * password strength. Users should use strong, unique passwords. For maximum
- * security, use a CryptoKey directly instead of a password string.
- *
- * @internal
- */
-const PBKDF2_SALT = new TextEncoder().encode('@wemush/wols/crypto/v1');
-/** Default number of PBKDF2 iterations */
-const DEFAULT_PBKDF2_ITERATIONS = 100_000;
-/** Minimum allowed PBKDF2 iterations (security floor) */
-const MIN_PBKDF2_ITERATIONS = 10_000;
-/** Current crypto schema version */
-const CRYPTO_VERSION = 'v1';
-/** IV length in bytes (96 bits = 12 bytes recommended for GCM) */
-const IV_LENGTH = 12;
-// =============================================================================
-// UTILITY FUNCTIONS
-// =============================================================================
-/**
- * Convert ArrayBuffer to base64url string
- */
-function toBase64Url(buffer) {
-    const bytes = new Uint8Array(buffer);
-    let binary = '';
-    for (const byte of bytes) {
-        binary += String.fromCharCode(byte);
+const shared_js_1 = require("./shared.js");
+function encryptionError(message, code = errors_js_1.WolsErrorCode.ENCRYPTION_ERROR) {
+    throw new errors_js_1.WolsEncryptionError(code, message);
+}
+/** Generators MUST use 100,000 to 10,000,000 iterations (WOLS 1.3.0). */
+function checkGenerateIterations(iterations) {
+    if (typeof iterations !== 'number' ||
+        !Number.isInteger(iterations) ||
+        iterations < shared_js_1.MIN_GENERATE_ITERATIONS ||
+        iterations > shared_js_1.MAX_ITERATIONS) {
+        return encryptionError(`PBKDF2 iterations must be an integer from ${shared_js_1.MIN_GENERATE_ITERATIONS} to ` +
+            `${shared_js_1.MAX_ITERATIONS}, got ${String(iterations)}`);
     }
-    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+    return iterations;
 }
-/**
- * Validate and normalize iteration count
- * @throws Error if iterations below minimum
- */
-function validateIterations(iterations) {
-    const count = iterations ?? DEFAULT_PBKDF2_ITERATIONS;
-    if (count < MIN_PBKDF2_ITERATIONS) {
-        throw new Error(`PBKDF2 iterations must be at least ${MIN_PBKDF2_ITERATIONS}, got ${count}`);
+/** Decode canonical, unpadded base64url, or throw an encryption error naming the parameter. */
+function canonicalBytes(name, value) {
+    let bytes;
+    if (typeof value === 'string' && !value.includes('=')) {
+        try {
+            bytes = (0, shared_js_1.base64UrlDecode)(value);
+        }
+        catch {
+            bytes = undefined;
+        }
     }
-    return count;
+    // Re-encoding catches non-canonical spellings (non-zero trailing bits) that
+    // decode to the same bytes as a different string.
+    if (bytes === undefined || (0, shared_js_1.base64UrlEncode)(bytes) !== value) {
+        return encryptionError(`${name} must be canonical base64url without padding`);
+    }
+    return bytes;
+}
+function bytesEqual(a, b) {
+    return a.length === b.length && a.every((byte, i) => byte === b[i]);
 }
+/** Identifying fields (WOLS 1.3.0) stay in cleartext so labels remain routable. */
+const STRUCTURAL_FIELDS = new Set(shared_js_1.IDENTIFYING_FIELDS);
 /**
- * Derive a CryptoKey from a password using PBKDF2
+ * Turn the caller's key into an AES key plus the parameters to record.
+ * A passphrase gets a fresh random salt for every call (one call = one label).
  */
-async function deriveKey(password, iterations) {
-    const encoder = new TextEncoder();
-    const passwordBytes = encoder.encode(password);
-    // Import password as key material
-    const keyMaterial = await crypto.subtle.importKey('raw', passwordBytes, 'PBKDF2', false, [
-        'deriveKey',
-    ]);
-    // Derive AES-256-GCM key
-    return crypto.subtle.deriveKey({
-        name: 'PBKDF2',
-        salt: PBKDF2_SALT,
-        iterations,
-        hash: 'SHA-256',
-    }, keyMaterial, { name: 'AES-GCM', length: 256 }, false, ['encrypt']);
+async function resolveEncryptionKey(options) {
+    const { key } = options;
+    if ((0, shared_js_1.isPassphrase)(key)) {
+        const iterations = checkGenerateIterations(options.iterations ?? shared_js_1.DEFAULT_PBKDF2_ITERATIONS);
+        const salt = (0, shared_js_1.randomBytes)(shared_js_1.SALT_LENGTH);
+        const keyBytes = await (0, shared_js_1.derivePassphraseKey)(key, salt, iterations);
+        return {
+            cryptoKey: await (0, shared_js_1.importAesKey)(keyBytes, 'encrypt'),
+            kdf: 'pbkdf2',
+            salt: (0, shared_js_1.base64UrlEncode)(salt),
+            iterations,
+        };
+    }
+    if ((0, shared_js_1.isRawKey)(key)) {
+        const resolved = await (0, shared_js_1.resolveRawKey)(key, 'encrypt');
+        if (typeof resolved === 'string') {
+            encryptionError(resolved, errors_js_1.WolsErrorCode.INVALID_KEY);
+        }
+        return { cryptoKey: resolved, kdf: 'raw' };
+    }
+    return encryptionError('key must be a passphrase string, 32 raw key bytes, or an AES-GCM CryptoKey', errors_js_1.WolsErrorCode.INVALID_KEY);
 }
 /**
- * Generate a random initialization vector
+ * AES-256-GCM encrypt UTF-8 text with a fresh IV. The tag is appended by
+ * WebCrypto. `aad` is used for field-level values only; whole labels have none.
  */
-function generateIV() {
-    const buffer = new ArrayBuffer(IV_LENGTH);
-    const iv = new Uint8Array(buffer);
-    crypto.getRandomValues(iv);
-    return { iv, ivBuffer: buffer };
+async function seal(cryptoKey, text, aad) {
+    const iv = (0, shared_js_1.randomBytes)(shared_js_1.IV_LENGTH);
+    const params = aad === undefined ? { name: 'AES-GCM', iv } : { name: 'AES-GCM', iv, additionalData: aad };
+    const ciphertext = await crypto.subtle.encrypt(params, cryptoKey, new TextEncoder().encode(text));
+    return { payload: (0, shared_js_1.base64UrlEncode)(ciphertext), iv: (0, shared_js_1.base64UrlEncode)(iv) };
+}
+/** Split `wemush:{suffix}` into its suffix, enforcing a non-empty suffix. */
+function idSuffix(id) {
+    if (typeof id !== 'string' || !id.startsWith('wemush:') || id.length === 'wemush:'.length) {
+        encryptionError(`Specimen id must be 'wemush:' followed by a non-empty suffix, got '${String(id)}'`);
+    }
+    return id.slice('wemush:'.length);
 }
 // =============================================================================
-// ENCRYPTION FUNCTIONS
+// URL SERIALIZATION
 // =============================================================================
 /**
- * Encrypt a specimen using AES-256-GCM
+ * Build the encrypted-format URL for an encrypted specimen.
  *
- * @param specimen - The specimen to encrypt
- * @param options - Encryption options (key required)
- * @returns Promise resolving to encrypted specimen wrapper
+ * Enforces the generator rules, so a hand-built object cannot produce a
+ * non-conformant label:
+ * - `payload` and `iv` are canonical unpadded base64url, the IV is 12 bytes,
+ *   and the payload is at least the 16-byte GCM tag
+ * - `kdf` is present: `pbkdf2` needs 100,000 to 2^32-1 iterations and a salt
+ *   of at least 16 bytes that is not the legacy library salt (compared as
+ *   bytes); `raw` must not carry `salt` or `iterations`
  *
- * @example
- * ```typescript
- * import { encryptSpecimen } from '@wemush/wols/crypto';
- *
- * // Basic encryption with default iterations (100k)
- * const encrypted = await encryptSpecimen(specimen, {
- *   key: 'my-secret-password',
- * });
- *
- * // Higher security with custom iterations
- * const secureEncrypted = await encryptSpecimen(specimen, {
- *   key: 'my-secret-password',
- *   iterations: 300_000,
- * });
- * // Returns: { encrypted: true, payload: "...", iv: "...", algorithm: "AES-256-GCM", cryptoVersion: "v1", iterations: 300000 }
- * ```
+ * Labels with more than 10,000,000 iterations are valid but exceed the
+ * decoders' default `maxIterations`, so readers must raise it.
+ *
+ * @throws WolsEncryptionError when the object would produce a non-conformant
+ *   label (including legacy payloads, which are never generated)
+ * @since 1.3.0
  */
+function toEncryptedUrl(encrypted) {
+    const suffix = idSuffix(encrypted.id);
+    if (encrypted.kdf !== 'pbkdf2' && encrypted.kdf !== 'raw') {
+        encryptionError('Encrypted URLs require kdf=pbkdf2 or kdf=raw; legacy payloads are not generated');
+    }
+    if (canonicalBytes('payload', encrypted.payload).length < shared_js_1.GCM_TAG_LENGTH) {
+        encryptionError(`payload must include the ${shared_js_1.GCM_TAG_LENGTH}-byte GCM tag`);
+    }
+    if (canonicalBytes('iv', encrypted.iv).length !== shared_js_1.IV_LENGTH) {
+        encryptionError(`iv must be ${shared_js_1.IV_LENGTH} bytes`);
+    }
+    const params = [`e=${encrypted.payload}`, `iv=${encrypted.iv}`, `kdf=${encrypted.kdf}`];
+    if (encrypted.kdf === 'pbkdf2') {
+        const { salt } = encrypted;
+        if (!salt || encrypted.iterations === undefined) {
+            encryptionError('kdf=pbkdf2 requires salt and iterations');
+        }
+        const iterations = checkGenerateIterations(encrypted.iterations);
+        const saltBytes = canonicalBytes('salt', salt);
+        if (saltBytes.length < shared_js_1.SALT_LENGTH) {
+            encryptionError(`salt must be at least ${shared_js_1.SALT_LENGTH} bytes, got ${saltBytes.length}`);
+        }
+        if (bytesEqual(saltBytes, shared_js_1.LEGACY_PBKDF2_SALT)) {
+            encryptionError('The fixed pre-1.3.0 library salt must not be used to generate labels');
+        }
+        params.push(`salt=${salt}`, `i=${iterations}`);
+    }
+    else if (encrypted.salt !== undefined || encrypted.iterations !== undefined) {
+        encryptionError('kdf=raw labels must not carry salt or iterations');
+    }
+    if (encrypted.signature !== undefined) {
+        params.push(`sig=${encodeURIComponent(encrypted.signature)}`);
+    }
+    return `${shared_js_1.ENCRYPTED_URL_PREFIX}${encodeURIComponent(suffix)}?${params.join('&')}`;
+}
 async function encryptSpecimen(specimen, options) {
-    const { key, fields } = options;
-    // If partial encryption requested, handle separately
+    (0, shared_js_1.assertWebCrypto)();
+    const { fields } = options;
     if (fields !== undefined && fields.length > 0) {
-        return encryptPartial(specimen, options);
-    }
-    // Validate and get iteration count
-    const iterations = validateIterations(options.iterations);
-    // Get or derive the encryption key
-    // When key is a CryptoKey, iterations is still recorded for documentation
-    // but not used (key is already derived)
-    const cryptoKey = typeof key === 'string' ? await deriveKey(key, iterations) : key;
-    // Serialize the specimen to JSON
-    const plaintext = (0, specimen_js_1.serializeSpecimen)(specimen);
-    const plaintextBytes = new TextEncoder().encode(plaintext);
-    // Generate random IV
-    const { iv, ivBuffer } = generateIV();
-    // Encrypt
-    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, cryptoKey, plaintextBytes);
-    // Return encrypted specimen with version and iterations for self-describing decryption
-    return {
+        // Deprecated 1.2.x path: same behavior as encryptFields(). A call that
+        // passes `fields` literally is typed FieldEncryptedSpecimen by the first
+        // overload; options typed as plain EncryptionOptions keep the 1.2.x
+        // signature for source compatibility, which is why the option is deprecated.
+        const fieldOptions = {
+            key: options.key,
+            fields: fields,
+        };
+        if (options.iterations !== undefined)
+            fieldOptions.iterations = options.iterations;
+        return encryptFields(specimen, fieldOptions);
+    }
+    const id = specimen.id;
+    idSuffix(id);
+    const resolved = await resolveEncryptionKey(options);
+    const sealed = await seal(resolved.cryptoKey, (0, specimen_js_1.serializeSpecimen)(specimen));
+    const result = {
         encrypted: true,
-        payload: toBase64Url(ciphertext),
-        iv: toBase64Url(ivBuffer),
         algorithm: 'AES-256-GCM',
-        cryptoVersion: CRYPTO_VERSION,
-        iterations,
+        payload: sealed.payload,
+        iv: sealed.iv,
+        kdf: resolved.kdf,
+        id,
     };
+    if (resolved.salt !== undefined)
+        result.salt = resolved.salt;
+    if (resolved.iterations !== undefined)
+        result.iterations = resolved.iterations;
+    result.url = toEncryptedUrl(result);
+    return result;
 }
 /**
- * Encrypt only specific fields of a specimen
+ * Field-level encryption (WOLS v1.3.0): replace the value of each named field
+ * with an {@link EncryptedField} and leave the rest of the specimen in cleartext.
  *
- * Returns a specimen-like object with specified fields encrypted.
+ * One key (and, for passphrases, one random salt) per call; a fresh IV per field.
+ * Each value is bound to its label and field with AES-GCM additional data:
+ * the UTF-8 of `"{id}\n{field}"` (WOLS 1.3.0). A value moved to another field
+ * or copied into another label fails authentication. Restore with `decryptFields()`.
+ *
+ * The identifying fields (`@context`, `@type`, `id`, `version`, `type`,
+ * `species`) can't be encrypted.
+ *
+ * @param specimen - The specimen to partially encrypt
+ * @param options - `key`, `fields` (each must be present on the specimen), optional `iterations`
+ * @throws WolsEncryptionError when `fields` is empty, names a field the specimen
+ *   does not have, or names a field twice; or for an unusable key
+ *
+ * @example
+ * ```typescript
+ * const partial = await encryptFields(specimen, { key: passphrase, fields: ['strain'] });
+ * partial.species;  // still cleartext
+ * partial.strain;   // { encrypted: true, algorithm: 'AES-256-GCM', payload, iv, kdf: 'pbkdf2', salt, iterations }
+ * ```
+ *
+ * @since 1.3.0
  */
-async function encryptPartial(specimen, options) {
-    const { key, fields = [] } = options;
-    // Validate and get iteration count
-    const iterations = validateIterations(options.iterations);
-    // Get or derive the encryption key
-    const cryptoKey = typeof key === 'string' ? await deriveKey(key, iterations) : key;
-    // Clone the specimen
-    const result = { ...specimen };
-    // Encrypt each specified field
+async function encryptFields(specimen, options) {
+    (0, shared_js_1.assertWebCrypto)();
+    const { fields } = options;
+    if (!Array.isArray(fields) || fields.length === 0) {
+        encryptionError('encryptFields requires a non-empty fields array');
+    }
+    // The AAD binds every value to the label's full id, so the id must be usable.
+    idSuffix(specimen.id);
+    const seen = new Set();
     for (const field of fields) {
-        const value = result[field];
-        if (value !== undefined) {
-            const plaintext = JSON.stringify(value);
-            const plaintextBytes = new TextEncoder().encode(plaintext);
-            const { iv, ivBuffer } = generateIV();
-            const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, cryptoKey, plaintextBytes);
-            result[field] = {
-                encrypted: true,
-                payload: toBase64Url(ciphertext),
-                iv: toBase64Url(ivBuffer),
-                algorithm: 'AES-256-GCM',
-                cryptoVersion: CRYPTO_VERSION,
-                iterations,
-            };
+        if (typeof field === 'string' && STRUCTURAL_FIELDS.has(field)) {
+            encryptionError(`Cannot encrypt field '${field}': it identifies the label and must stay in cleartext`);
+        }
+        if (typeof field !== 'string' || !Object.hasOwn(specimen, field)) {
+            encryptionError(`Cannot encrypt field '${String(field)}': the specimen has no such field. ` +
+                'Refusing to leave it unprotected.');
         }
+        if (specimen[field] === undefined) {
+            encryptionError(`Cannot encrypt field '${field}': its value is undefined`);
+        }
+        if (seen.has(field)) {
+            encryptionError(`Field '${field}' is listed more than once`);
+        }
+        seen.add(field);
+    }
+    const keyOptions = { key: options.key };
+    if (options.iterations !== undefined)
+        keyOptions.iterations = options.iterations;
+    const resolved = await resolveEncryptionKey(keyOptions);
+    const result = { ...specimen };
+    for (const field of fields) {
+        // Fresh IV per field; AAD = "{id}\n{field}" (WOLS 1.3.0).
+        const sealed = await seal(resolved.cryptoKey, JSON.stringify(result[field]), (0, shared_js_1.fieldAad)(specimen.id, field));
+        const encryptedField = {
+            encrypted: true,
+            algorithm: 'AES-256-GCM',
+            payload: sealed.payload,
+            iv: sealed.iv,
+            kdf: resolved.kdf,
+        };
+        if (resolved.salt !== undefined)
+            encryptedField.salt = resolved.salt;
+        if (resolved.iterations !== undefined)
+            encryptedField.iterations = resolved.iterations;
+        result[field] = encryptedField;
     }
-    // Cast to EncryptedSpecimen for return type consistency
-    // In partial mode, this is actually a hybrid object
     return result;
 }
+// =============================================================================
+// TYPE GUARDS
+// =============================================================================
+function hasCipherShape(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        value['encrypted'] === true &&
+        typeof value['payload'] === 'string' &&
+        typeof value['iv'] === 'string');
+}
+/**
+ * Whether a value is a field-level {@link EncryptedField}: an encrypted value
+ * with a `kdf` and no specimen `id` or `url`.
+ *
+ * The 1.3.0 shapes are told apart structurally: whole-label objects produced
+ * by `encryptSpecimen` and `parseEncryptedUrl` always carry `id`, and field
+ * values never do. Legacy (pre-1.3.0) values have no `kdf` and are reported
+ * as {@link isEncryptedSpecimen}, whether they were whole labels or fields.
+ * `decryptFields` handles legacy field values regardless (with `allowLegacy`).
+ *
+ * @since 1.3.0
+ */
+function isEncryptedField(value) {
+    return (hasCipherShape(value) &&
+        (value['kdf'] === 'pbkdf2' || value['kdf'] === 'raw') &&
+        value['id'] === undefined &&
+        value['url'] === undefined);
+}
+/**
+ * Whether a value is a whole-label {@link EncryptedSpecimen} (v1.3.0 or legacy).
+ *
+ * @since 1.3.0
+ */
+function isEncryptedSpecimen(value) {
+    return hasCipherShape(value) && !isEncryptedField(value);
+}
 /**
- * Type guard to check if an object is an encrypted specimen
+ * Whether a value carries the `encrypted: true` marker: either a whole-label
+ * {@link EncryptedSpecimen} or a field-level {@link EncryptedField}. Use
+ * {@link isEncryptedSpecimen} or {@link isEncryptedField} to tell them apart.
+ *
+ * @since 1.3.0 Narrows to `EncryptedSpecimen | EncryptedField`
  */
 function isEncrypted(value) {
-    if (value === null || value === undefined) {
-        return false;
-    }
-    if (typeof value !== 'object') {
+    if (value === null || value === undefined || typeof value !== 'object') {
         return false;
     }
-    const obj = value;
-    return obj['encrypted'] === true;
+    return value['encrypted'] === true;
 }
 //# sourceMappingURL=encrypt.js.map

package/dist/cjs/crypto/encrypt.js.map

@@ -1 +1 @@
-{"version":3,"file":"encrypt.js","sourceRoot":"","sources":["../../../src/crypto/encrypt.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;;AA6IH,0CA0CC;AAuDD,kCASC;AArPD,gDAAmD;AAGnD,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAEvE,0CAA0C;AAC1C,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAE1C,yDAAyD;AACzD,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,oCAAoC;AACpC,MAAM,cAAc,GAAG,IAAa,CAAC;AAErC,kEAAkE;AAClE,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;GAEG;AACH,SAAS,WAAW,CAAC,MAAqC;IACxD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAqB,CAAC,CAAC;IACpD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,UAA8B;IACxD,MAAM,KAAK,GAAG,UAAU,IAAI,yBAAyB,CAAC;IACtD,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,sCAAsC,qBAAqB,SAAS,KAAK,EAAE,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,UAAkB;IAC3D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE/C,kCAAkC;IAClC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE;QACvF,WAAW;KACZ,CAAC,CAAC;IAEH,yBAAyB;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,WAAW;QACjB,UAAU;QACV,IAAI,EAAE,SAAS;KAChB,EACD,WAAW,EACX,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,UAAU;IACjB,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAC3B,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACI,KAAK,UAAU,eAAe,CACnC,QAAkB,EAClB,OAA0B;IAE1B,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAEhC,qDAAqD;IACrD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,mCAAmC;IACnC,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAE1D,mCAAmC;IACnC,0EAA0E;IAC1E,wCAAwC;IACxC,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAEnF,iCAAiC;IACjC,MAAM,SAAS,GAAG,IAAA,+BAAiB,EAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAE3D,qBAAqB;IACrB,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,UAAU,EAAE,CAAC;IAEtC,UAAU;IACV,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,SAAS,EACT,cAAc,CACf,CAAC;IAEF,uFAAuF;IACvF,OAAO;QACL,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,WAAW,CAAC,UAAU,CAAC;QAChC,EAAE,EAAE,WAAW,CAAC,QAAQ,CAAC;QACzB,SAAS,EAAE,aAAa;QACxB,aAAa,EAAE,cAAc;QAC7B,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,QAAkB,EAClB,OAA0B;IAE1B,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;IAErC,mCAAmC;IACnC,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAE1D,mCAAmC;IACnC,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAEnF,qBAAqB;IACrB,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAA6B,CAAC;IAE1D,+BAA+B;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACxC,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3D,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,UAAU,EAAE,CAAC;YAEtC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,SAAS,EACT,cAAc,CACf,CAAC;YAEF,MAAM,CAAC,KAAK,CAAC,GAAG;gBACd,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,WAAW,CAAC,UAAU,CAAC;gBAChC,EAAE,EAAE,WAAW,CAAC,QAAQ,CAAC;gBACzB,SAAS,EAAE,aAAa;gBACxB,aAAa,EAAE,cAAc;gBAC7B,UAAU;aACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,oDAAoD;IACpD,OAAO,MAAsC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;AACnC,CAAC"}
+{"version":3,"file":"encrypt.js","sourceRoot":"","sources":["../../../src/crypto/encrypt.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;AA8KH,wCAmCC;AAuCD,0CAoCC;AA4BD,sCA0DC;AA4BD,4CAOC;AAOD,kDAEC;AASD,kCAKC;AA1aD,4CAAkE;AAClE,gDAAmD;AAYnD,2CAoBqB;AAarB,SAAS,eAAe,CAAC,OAAe,EAAE,IAAI,GAAG,yBAAa,CAAC,gBAAgB;IAC7E,MAAM,IAAI,+BAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,yEAAyE;AACzE,SAAS,uBAAuB,CAAC,UAAmB;IAClD,IACE,OAAO,UAAU,KAAK,QAAQ;QAC9B,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;QAC7B,UAAU,GAAG,mCAAuB;QACpC,UAAU,GAAG,0BAAc,EAC3B,CAAC;QACD,OAAO,eAAe,CACpB,6CAA6C,mCAAuB,MAAM;YACxE,GAAG,0BAAc,SAAS,MAAM,CAAC,UAAU,CAAC,EAAE,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,+FAA+F;AAC/F,SAAS,cAAc,CAAC,IAAY,EAAE,KAAc;IAClD,IAAI,KAA6B,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC;YACH,KAAK,GAAG,IAAA,2BAAe,EAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;IACH,CAAC;IACD,4EAA4E;IAC5E,kDAAkD;IAClD,IAAI,KAAK,KAAK,SAAS,IAAI,IAAA,2BAAe,EAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC5D,OAAO,eAAe,CAAC,GAAG,IAAI,8CAA8C,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,mFAAmF;AACnF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,8BAAkB,CAAC,CAAC;AAEtD;;;GAGG;AACH,KAAK,UAAU,oBAAoB,CAAC,OAA0B;IAC5D,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAExB,IAAI,IAAA,wBAAY,EAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,CAAC,UAAU,IAAI,qCAAyB,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,IAAA,uBAAW,EAAC,uBAAW,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAA,+BAAmB,EAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAClE,OAAO;YACL,SAAS,EAAE,MAAM,IAAA,wBAAY,EAAC,QAAQ,EAAE,SAAS,CAAC;YAClD,GAAG,EAAE,QAAQ;YACb,IAAI,EAAE,IAAA,2BAAe,EAAC,IAAI,CAAC;YAC3B,UAAU;SACX,CAAC;IACJ,CAAC;IAED,IAAI,IAAA,oBAAQ,EAAC,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,MAAM,IAAA,yBAAa,EAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,eAAe,CAAC,QAAQ,EAAE,yBAAa,CAAC,WAAW,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IAED,OAAO,eAAe,CACpB,4EAA4E,EAC5E,yBAAa,CAAC,WAAW,CAC1B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,IAAI,CACjB,SAAoB,EACpB,IAAY,EACZ,GAA6B;IAE7B,MAAM,EAAE,GAAG,IAAA,uBAAW,EAAC,qBAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GACV,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;IAC7F,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAClG,OAAO,EAAE,OAAO,EAAE,IAAA,2BAAe,EAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAA,2BAAe,EAAC,EAAE,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,EAAW;IAC3B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QAC1F,eAAe,CACb,sEAAsE,MAAM,CAAC,EAAE,CAAC,GAAG,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,cAAc,CAAC,SAA4B;IACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACtC,IAAI,SAAS,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC1D,eAAe,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,0BAAc,EAAE,CAAC;QACzE,eAAe,CAAC,4BAA4B,0BAAc,eAAe,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,qBAAS,EAAE,CAAC;QAC5D,eAAe,CAAC,cAAc,qBAAS,QAAQ,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,KAAK,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;IACxF,IAAI,SAAS,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAChD,eAAe,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/C,IAAI,SAAS,CAAC,MAAM,GAAG,uBAAW,EAAE,CAAC;YACnC,eAAe,CAAC,yBAAyB,uBAAW,eAAe,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,UAAU,CAAC,SAAS,EAAE,8BAAkB,CAAC,EAAE,CAAC;YAC9C,eAAe,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,KAAK,UAAU,EAAE,CAAC,CAAC;IACjD,CAAC;SAAM,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9E,eAAe,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,OAAO,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,gCAAoB,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACpF,CAAC;AAuCM,KAAK,UAAU,eAAe,CACnC,QAAkB,EAClB,OAA0B;IAE1B,IAAA,2BAAe,GAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,uEAAuE;QACvE,yEAAyE;QACzE,oEAAoE;QACpE,6EAA6E;QAC7E,MAAM,YAAY,GAA2B;YAC3C,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,MAAM,EAAE,MAAqC;SAC9C,CAAC;QACF,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;YAAE,YAAY,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACnF,OAAO,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,CAAC,CAAC;IACb,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAA,+BAAiB,EAAC,QAAQ,CAAC,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAsB;QAChC,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,EAAE;KACH,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC7D,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;IAC/E,MAAM,CAAC,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACI,KAAK,UAAU,aAAa,CACjC,QAAkB,EAClB,OAAkC;IAElC,IAAA,2BAAe,GAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,eAAe,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,eAAe,CACb,yBAAyB,KAAK,uDAAuD,CACtF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;YACjE,eAAe,CACb,yBAAyB,MAAM,CAAC,KAAK,CAAC,qCAAqC;gBACzE,mCAAmC,CACtC,CAAC;QACJ,CAAC;QACD,IAAK,QAA+C,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YAC1E,eAAe,CAAC,yBAAyB,KAAK,2BAA2B,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,eAAe,CAAC,UAAU,KAAK,4BAA4B,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAsB,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3D,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,UAAU,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACjF,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAA6B,CAAC;IAE1D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,0DAA0D;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,QAAQ,CAAC,SAAS,EAClB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAC7B,IAAA,oBAAQ,EAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAC7B,CAAC;QACF,MAAM,cAAc,GAAmB;YACrC,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,aAAa;YACxB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,GAAG,EAAE,QAAQ,CAAC,GAAG;SAClB,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;YAAE,cAAc,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QACrE,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS;YAAE,cAAc,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QACvF,MAAM,CAAC,KAAK,CAAC,GAAG,cAAc,CAAC;IACjC,CAAC;IAED,OAAO,MAAqC,CAAC;AAC/C,CAAC;AAED,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAAiC,CAAC,WAAW,CAAC,KAAK,IAAI;QACxD,OAAQ,KAAiC,CAAC,SAAS,CAAC,KAAK,QAAQ;QACjE,OAAQ,KAAiC,CAAC,IAAI,CAAC,KAAK,QAAQ,CAC7D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,OAAO,CACL,cAAc,CAAC,KAAK,CAAC;QACrB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS;QACzB,KAAK,CAAC,KAAK,CAAC,KAAK,SAAS,CAC3B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,KAAc;IAChD,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAQ,KAAiC,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;AAClE,CAAC"}

package/dist/cjs/crypto/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WOLS Crypto Module
+ *
+ * AES-256-GCM encryption and decryption for specimens in the WOLS v1.3.0
+ * encrypted format (`wemush://v1/encrypted/{id}?e=&iv=&kdf=...`).
+ *
+ * @module crypto
+ */
+export { encryptSpecimen, encryptFields, isEncrypted, isEncryptedSpecimen, isEncryptedField, toEncryptedUrl, } from './encrypt.js';
+export { decryptSpecimen, decryptPlaintext, decryptField, decryptFields, parseEncryptedUrl, type FieldBinding, } from './decrypt.js';
+export { base64UrlEncode, base64UrlDecode, derivePassphraseKey } from './shared.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/crypto/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/crypto/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,eAAe,EACf,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC"}