@wipcomputer/memory-crystal 0.7.30 → 0.7.32

package/dist/chunk-KCQUXVYT.js

@@ -1,108 +0,0 @@
-import {
-  resolveSecretPath
-} from "./chunk-EXEZZADG.js";
-
-// src/crypto.ts
-import { readFileSync, existsSync } from "fs";
-import { createCipheriv, createDecipheriv, createHmac, randomBytes, hkdfSync } from "crypto";
-import { createHash } from "crypto";
-var KEY_PATH = process.env.CRYSTAL_RELAY_KEY_PATH || resolveSecretPath("crystal-relay-key");
-function loadRelayKey() {
-  if (!existsSync(KEY_PATH)) {
-    throw new Error(
-      `Relay key not found at ${KEY_PATH}
-Generate one: mkdir -p ~/.ldm/secrets && openssl rand -base64 32 > ~/.ldm/secrets/crystal-relay-key && chmod 600 ~/.ldm/secrets/crystal-relay-key
-Or run: crystal pair`
-    );
-  }
-  const raw = readFileSync(KEY_PATH, "utf-8").trim();
-  const key = Buffer.from(raw, "base64");
-  if (key.length !== 32) {
-    throw new Error(`Relay key must be 32 bytes (256 bits). Got ${key.length} bytes. Regenerate with: openssl rand -base64 32`);
-  }
-  return key;
-}
-function deriveSigningKey(masterKey) {
-  return Buffer.from(hkdfSync("sha256", masterKey, "", "crystal-relay-sign", 32));
-}
-function encrypt(plaintext, masterKey) {
-  const nonce = randomBytes(12);
-  const cipher = createCipheriv("aes-256-gcm", masterKey, nonce);
-  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  const signingKey = deriveSigningKey(masterKey);
-  const hmacData = Buffer.concat([nonce, ciphertext, tag]);
-  const hmac = createHmac("sha256", signingKey).update(hmacData).digest("hex");
-  return {
-    v: 1,
-    nonce: nonce.toString("base64"),
-    ciphertext: ciphertext.toString("base64"),
-    tag: tag.toString("base64"),
-    hmac
-  };
-}
-function decrypt(payload, masterKey) {
-  if (payload.v !== 1) {
-    throw new Error(`Unknown payload version: ${payload.v}`);
-  }
-  const nonce = Buffer.from(payload.nonce, "base64");
-  const ciphertext = Buffer.from(payload.ciphertext, "base64");
-  const tag = Buffer.from(payload.tag, "base64");
-  const signingKey = deriveSigningKey(masterKey);
-  const hmacData = Buffer.concat([nonce, ciphertext, tag]);
-  const expectedHmac = createHmac("sha256", signingKey).update(hmacData).digest("hex");
-  if (payload.hmac !== expectedHmac) {
-    throw new Error("HMAC verification failed \u2014 blob rejected (tampered or wrong key)");
-  }
-  const decipher = createDecipheriv("aes-256-gcm", masterKey, nonce);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-}
-function encryptJSON(data, masterKey) {
-  const plaintext = Buffer.from(JSON.stringify(data), "utf-8");
-  return encrypt(plaintext, masterKey);
-}
-function decryptJSON(payload, masterKey) {
-  const plaintext = decrypt(payload, masterKey);
-  return JSON.parse(plaintext.toString("utf-8"));
-}
-function encryptFile(filePath, masterKey) {
-  const plaintext = readFileSync(filePath);
-  return encrypt(plaintext, masterKey);
-}
-var RELAY_KEY_PATH = KEY_PATH;
-function generateRelayKey() {
-  return randomBytes(32);
-}
-function encodePairingString(key) {
-  if (key.length !== 32) throw new Error("Key must be 32 bytes");
-  return `mc1:${key.toString("base64")}`;
-}
-function decodePairingString(str) {
-  const trimmed = str.trim();
-  if (!trimmed.startsWith("mc1:")) {
-    throw new Error("Invalid pairing string (expected mc1: prefix)");
-  }
-  const key = Buffer.from(trimmed.slice(4), "base64");
-  if (key.length !== 32) {
-    throw new Error(`Invalid key length: expected 32 bytes, got ${key.length}`);
-  }
-  return key;
-}
-function hashBuffer(data) {
-  return createHash("sha256").update(data).digest("hex");
-}
-
-export {
-  loadRelayKey,
-  encrypt,
-  decrypt,
-  encryptJSON,
-  decryptJSON,
-  encryptFile,
-  RELAY_KEY_PATH,
-  generateRelayKey,
-  encodePairingString,
-  decodePairingString,
-  hashBuffer
-};