@ysk-kit/crypto 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 YSK Limited
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+export interface ICryptoPort {
+    encrypt(plain: Uint8Array): Promise<Uint8Array>;
+    decrypt(cipher: Uint8Array): Promise<Uint8Array>;
+}
+export declare const DEV_CRYPTO_KEY_HEX: string;
+export declare const createAes256Gcm: (masterKeyHex: string) => ICryptoPort;
+export declare const encryptUtf8: (port: ICryptoPort, text: string) => Promise<Uint8Array>;
+export declare const decryptUtf8: (port: ICryptoPort, blob: Uint8Array) => Promise<string>;
+export declare const createCryptoFromEnv: (env: {
+    CRYPTO_MASTER_KEY?: string | undefined;
+    NODE_ENV?: string | undefined;
+}) => ICryptoPort;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAClD;AAUD,eAAO,MAAM,kBAAkB,QAAkE,CAAC;AAElG,eAAO,MAAM,eAAe,GAAI,cAAc,MAAM,KAAG,WAsBtD,CAAC;AAEF,eAAO,MAAM,WAAW,GAAU,MAAM,WAAW,EAAE,MAAM,MAAM,KAAG,OAAO,CAAC,UAAU,CACxC,CAAC;AAE/C,eAAO,MAAM,WAAW,GAAU,MAAM,WAAW,EAAE,MAAM,UAAU,KAAG,OAAO,CAAC,MAAM,CAClC,CAAC;AAErD,eAAO,MAAM,mBAAmB,GAAI,KAAK;IACvC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B,KAAG,WAMH,CAAC"}

package/dist/index.js

@@ -0,0 +1,49 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
+const VERSION = 1;
+const IV_LENGTH = 12;
+const TAG_LENGTH = 16;
+const KEY_LENGTH = 32;
+const parseKey = (hex) => {
+    const key = Buffer.from(hex, 'hex');
+    if (key.length !== KEY_LENGTH) {
+        throw new Error('CRYPTO_MASTER_KEY must be 64 hex chars (32 bytes)');
+    }
+    return key;
+};
+export const DEV_CRYPTO_KEY_HEX = createHash('sha256').update('ysk-kit-dev-crypto').digest('hex');
+export const createAes256Gcm = (masterKeyHex) => {
+    const key = parseKey(masterKeyHex);
+    return {
+        async encrypt(plain) {
+            const iv = randomBytes(IV_LENGTH);
+            const cipher = createCipheriv('aes-256-gcm', key, iv);
+            const ciphertext = Buffer.concat([cipher.update(plain), cipher.final()]);
+            const tag = cipher.getAuthTag();
+            return Buffer.concat([Buffer.from([VERSION]), iv, ciphertext, tag]);
+        },
+        async decrypt(blob) {
+            const buf = Buffer.from(blob);
+            if (buf.length < 1 + IV_LENGTH + TAG_LENGTH)
+                throw new Error('ciphertext too short');
+            if (buf[0] !== VERSION)
+                throw new Error('unsupported crypto version');
+            const iv = buf.subarray(1, 1 + IV_LENGTH);
+            const tag = buf.subarray(buf.length - TAG_LENGTH);
+            const ciphertext = buf.subarray(1 + IV_LENGTH, buf.length - TAG_LENGTH);
+            const decipher = createDecipheriv('aes-256-gcm', key, iv);
+            decipher.setAuthTag(tag);
+            return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        },
+    };
+};
+export const encryptUtf8 = async (port, text) => port.encrypt(new TextEncoder().encode(text));
+export const decryptUtf8 = async (port, blob) => new TextDecoder().decode(await port.decrypt(blob));
+export const createCryptoFromEnv = (env) => {
+    if (env.CRYPTO_MASTER_KEY)
+        return createAes256Gcm(env.CRYPTO_MASTER_KEY);
+    if (env.NODE_ENV === 'production') {
+        throw new Error('CRYPTO_MASTER_KEY is required in production');
+    }
+    return createAes256Gcm(DEV_CRYPTO_KEY_HEX);
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAExF,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,UAAU,GAAG,EAAE,CAAC;AAOtB,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAU,EAAE;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAElG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,YAAoB,EAAe,EAAE;IACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACnC,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACtD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACzE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,SAAS,GAAG,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACrF,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACtE,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC;YACxE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,IAAiB,EAAE,IAAY,EAAuB,EAAE,CACxF,IAAI,CAAC,OAAO,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAE/C,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,IAAiB,EAAE,IAAgB,EAAmB,EAAE,CACxF,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAErD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAGnC,EAAe,EAAE;IAChB,IAAI,GAAG,CAAC,iBAAiB;QAAE,OAAO,eAAe,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACzE,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,eAAe,CAAC,kBAAkB,CAAC,CAAC;AAC7C,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@ysk-kit/crypto",
+  "version": "1.0.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^24.5.2",
+    "typescript": "^6.0.3",
+    "vitest": "^5.0.2"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "test": "vitest run --passWithNoTests",
+    "build": "tsc -p tsconfig.build.json"
+  }
+}