@zudojs/crypto 0.0.1

package/dist/compare/compare.helper.js

@@ -0,0 +1,17 @@
+/**
+ * Performs a constant-time comparison of two byte arrays.
+ *
+ * Returns false immediately if the lengths differ.
+ * Uses XOR accumulation to avoid timing side-channels.
+ */
+export function timingSafeEqual(left, right) {
+    if (left.byteLength !== right.byteLength) {
+        return false;
+    }
+    let difference = 0;
+    for (let index = 0; index < left.byteLength; index += 1) {
+        difference |= left[index] ^ right[index];
+    }
+    return difference === 0;
+}
+//# sourceMappingURL=compare.helper.js.map

package/dist/compare/compare.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compare.helper.js","sourceRoot":"","sources":["../../src/compare/compare.helper.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAgB,EAAE,KAAiB;IACjE,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,UAAU,IAAI,IAAI,CAAC,KAAK,CAAE,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;IAC7C,CAAC;IAED,OAAO,UAAU,KAAK,CAAC,CAAC;AAC1B,CAAC"}

package/dist/compare/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @zudojs/crypto/compare
+ *
+ * Constant-time comparison utilities for cryptographic operations.
+ */
+export * from "./compare.helper.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/compare/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/compare/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,qBAAqB,CAAC"}

package/dist/compare/index.js

@@ -0,0 +1,7 @@
+/**
+ * @zudojs/crypto/compare
+ *
+ * Constant-time comparison utilities for cryptographic operations.
+ */
+export * from "./compare.helper.js";
+//# sourceMappingURL=index.js.map

package/dist/compare/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/compare/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,qBAAqB,CAAC"}

package/dist/cryptoAlgorithm/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @zudojs/crypto/cryptoAlgorithm
+ *
+ * Cryptographic algorithm definitions and types.
+ */
+export * from "../cryptoConstants/cryptoConstants.type.js";
+export * from "../cryptoConstants/cryptoConstants.guard.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cryptoAlgorithm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cryptoAlgorithm/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,4CAA4C,CAAC;AAC3D,cAAc,6CAA6C,CAAC"}

package/dist/cryptoAlgorithm/index.js

@@ -0,0 +1,8 @@
+/**
+ * @zudojs/crypto/cryptoAlgorithm
+ *
+ * Cryptographic algorithm definitions and types.
+ */
+export * from "../cryptoConstants/cryptoConstants.type.js";
+export * from "../cryptoConstants/cryptoConstants.guard.js";
+//# sourceMappingURL=index.js.map

package/dist/cryptoAlgorithm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cryptoAlgorithm/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,4CAA4C,CAAC;AAC3D,cAAc,6CAA6C,CAAC"}

package/dist/cryptoCipher/cryptoCipher.core.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Options used when encrypting data.
+ */
+export interface CipherOptions {
+    readonly iv?: Uint8Array;
+    readonly aad?: Uint8Array;
+}
+/**
+ * Authenticated encryption result.
+ */
+export interface CipherResult {
+    readonly algorithm: string;
+    readonly ciphertext: Uint8Array;
+    readonly iv: Uint8Array;
+    readonly authTag: Uint8Array;
+}
+/**
+ * Encrypts data using AES-256-GCM.
+ */
+export declare function encrypt(plaintext: Uint8Array, key: Uint8Array, options?: CipherOptions): Promise<CipherResult>;
+/**
+ * Decrypts AES-256-GCM ciphertext.
+ */
+export declare function decrypt(ciphertext: Uint8Array, key: Uint8Array, iv: Uint8Array, authTag: Uint8Array, aad?: Uint8Array): Promise<Uint8Array>;
+//# sourceMappingURL=cryptoCipher.core.d.ts.map

package/dist/cryptoCipher/cryptoCipher.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cryptoCipher.core.d.ts","sourceRoot":"","sources":["../../src/cryptoCipher/cryptoCipher.core.ts"],"names":[],"mappings":"AAIA;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;CAC9B;AAED;;GAEG;AACH,wBAAsB,OAAO,CAC3B,SAAS,EAAE,UAAU,EACrB,GAAG,EAAE,UAAU,EACf,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAcvB;AAED;;GAEG;AACH,wBAAsB,OAAO,CAC3B,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,UAAU,EACf,EAAE,EAAE,UAAU,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,CAAC,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAWrB"}

package/dist/cryptoCipher/cryptoCipher.core.js

@@ -0,0 +1,35 @@
+import { createNodeCryptoProvider } from "../node/index.js";
+const provider = createNodeCryptoProvider();
+/**
+ * Encrypts data using AES-256-GCM.
+ */
+export async function encrypt(plaintext, key, options = {}) {
+    const encrypted = await provider.encrypt({
+        key,
+        plaintext,
+        associatedData: options.aad,
+        nonce: options.iv,
+    });
+    return Object.freeze({
+        algorithm: encrypted.algorithm,
+        ciphertext: encrypted.ciphertext,
+        iv: encrypted.nonce,
+        authTag: encrypted.tag,
+    });
+}
+/**
+ * Decrypts AES-256-GCM ciphertext.
+ */
+export async function decrypt(ciphertext, key, iv, authTag, aad) {
+    return provider.decrypt({
+        key,
+        encrypted: {
+            algorithm: "aes-256-gcm",
+            ciphertext,
+            nonce: iv,
+            tag: authTag,
+        },
+        associatedData: aad,
+    });
+}
+//# sourceMappingURL=cryptoCipher.core.js.map

package/dist/cryptoCipher/cryptoCipher.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cryptoCipher.core.js","sourceRoot":"","sources":["../../src/cryptoCipher/cryptoCipher.core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;AAoB5C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,SAAqB,EACrB,GAAe,EACf,OAAO,GAAkB,EAAE;IAE3B,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;QACvC,GAAG;QACH,SAAS;QACT,cAAc,EAAE,OAAO,CAAC,GAAG;QAC3B,KAAK,EAAE,OAAO,CAAC,EAAE;KAClB,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,EAAE,EAAE,SAAS,CAAC,KAAK;QACnB,OAAO,EAAE,SAAS,CAAC,GAAG;KACvB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,UAAsB,EACtB,GAAe,EACf,EAAc,EACd,OAAmB,EACnB,GAAgB;IAEhB,OAAO,QAAQ,CAAC,OAAO,CAAC;QACtB,GAAG;QACH,SAAS,EAAE;YACT,SAAS,EAAE,aAAa;YACxB,UAAU;YACV,KAAK,EAAE,EAAE;YACT,GAAG,EAAE,OAAO;SACb;QACD,cAAc,EAAE,GAAG;KACpB,CAAC,CAAC;AACL,CAAC"}

package/dist/cryptoCipher/cryptoCipher.envelope.d.ts

@@ -0,0 +1,16 @@
+import type { CipherOptions } from "./cryptoCipher.core.js";
+/**
+ * Creates an encrypted envelope suitable for storage or transport.
+ *
+ * The format is:
+ *
+ * version.algorithm.iv.authTag.ciphertext
+ *
+ * All binary fields are Base64URL encoded.
+ */
+export declare function encryptEnvelope(plaintext: Uint8Array, key: Uint8Array, options?: CipherOptions): Promise<string>;
+/**
+ * Decrypts an encrypted envelope.
+ */
+export declare function decryptEnvelope(envelope: string, key: Uint8Array, aad?: Uint8Array): Promise<Uint8Array>;
+//# sourceMappingURL=cryptoCipher.envelope.d.ts.map

package/dist/cryptoCipher/cryptoCipher.envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cryptoCipher.envelope.d.ts","sourceRoot":"","sources":["../../src/cryptoCipher/cryptoCipher.envelope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAI5D;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,UAAU,EACrB,GAAG,EAAE,UAAU,EACf,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,UAAU,EACf,GAAG,CAAC,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CA2BrB"}

package/dist/cryptoCipher/cryptoCipher.envelope.js

@@ -0,0 +1,50 @@
+import { encrypt, decrypt } from "./cryptoCipher.core.js";
+/**
+ * Creates an encrypted envelope suitable for storage or transport.
+ *
+ * The format is:
+ *
+ * version.algorithm.iv.authTag.ciphertext
+ *
+ * All binary fields are Base64URL encoded.
+ */
+export async function encryptEnvelope(plaintext, key, options = {}) {
+    const result = await encrypt(plaintext, key, options);
+    return [
+        "v1",
+        result.algorithm,
+        Buffer.from(result.iv).toString("base64url"),
+        Buffer.from(result.authTag).toString("base64url"),
+        Buffer.from(result.ciphertext).toString("base64url"),
+    ].join(".");
+}
+/**
+ * Decrypts an encrypted envelope.
+ */
+export async function decryptEnvelope(envelope, key, aad) {
+    if (typeof envelope !== "string") {
+        throw new TypeError("Encrypted envelope must be a string.");
+    }
+    const parts = envelope.split(".");
+    if (parts.length !== 5) {
+        throw new TypeError("Invalid encrypted envelope.");
+    }
+    const [version, algorithm, encodedIv, encodedAuthTag, encodedCiphertext] = parts;
+    if (version !== "v1") {
+        throw new TypeError(`Unsupported encrypted envelope version: ${version}.`);
+    }
+    if (algorithm !== "aes-256-gcm") {
+        throw new TypeError(`Unsupported envelope algorithm: ${algorithm}.`);
+    }
+    const iv = decodeBase64Url(encodedIv);
+    const authTag = decodeBase64Url(encodedAuthTag);
+    const ciphertext = decodeBase64Url(encodedCiphertext);
+    return decrypt(ciphertext, key, iv, authTag, aad);
+}
+function decodeBase64Url(value) {
+    if (!/^[A-Za-z0-9_-]*$/.test(value)) {
+        throw new TypeError("Invalid Base64URL value.");
+    }
+    return new Uint8Array(Buffer.from(value, "base64url"));
+}
+//# sourceMappingURL=cryptoCipher.envelope.js.map

package/dist/cryptoCipher/cryptoCipher.envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cryptoCipher.envelope.js","sourceRoot":"","sources":["../../src/cryptoCipher/cryptoCipher.envelope.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAqB,EACrB,GAAe,EACf,OAAO,GAAkB,EAAE;IAE3B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEtD,OAAO;QACL,IAAI;QACJ,MAAM,CAAC,SAAS;QAChB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KACrD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,GAAe,EACf,GAAgB;IAEhB,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CAAC,6BAA6B,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,iBAAiB,CAAC,GACtE,KAAiD,CAAC;IAEpD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CAAC,2CAA2C,OAAO,GAAG,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CAAC,mCAAmC,SAAS,GAAG,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,EAAE,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAEtD,OAAO,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/cryptoCipher/cryptoCipher.string.d.ts

@@ -0,0 +1,10 @@
+import type { CipherOptions, CipherResult } from "./cryptoCipher.core.js";
+/**
+ * Encrypts a UTF-8 string using AES-256-GCM.
+ */
+export declare function encryptString(plaintext: string, key: Uint8Array, options?: CipherOptions): Promise<CipherResult>;
+/**
+ * Decrypts AES-256-GCM ciphertext into a UTF-8 string.
+ */
+export declare function decryptString(ciphertext: Uint8Array, key: Uint8Array, iv: Uint8Array, authTag: Uint8Array, aad?: Uint8Array): Promise<string>;
+//# sourceMappingURL=cryptoCipher.string.d.ts.map

package/dist/cryptoCipher/cryptoCipher.string.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cryptoCipher.string.d.ts","sourceRoot":"","sources":["../../src/cryptoCipher/cryptoCipher.string.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAI1E;;GAEG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,UAAU,EACf,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,UAAU,EACf,EAAE,EAAE,UAAU,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,CAAC,EAAE,UAAU,GACf,OAAO,CAAC,MAAM,CAAC,CAIjB"}

package/dist/cryptoCipher/cryptoCipher.string.js

@@ -0,0 +1,15 @@
+import { encrypt, decrypt } from "./cryptoCipher.core.js";
+/**
+ * Encrypts a UTF-8 string using AES-256-GCM.
+ */
+export async function encryptString(plaintext, key, options = {}) {
+    return encrypt(new Uint8Array(Buffer.from(plaintext, "utf8")), key, options);
+}
+/**
+ * Decrypts AES-256-GCM ciphertext into a UTF-8 string.
+ */
+export async function decryptString(ciphertext, key, iv, authTag, aad) {
+    const plaintext = await decrypt(ciphertext, key, iv, authTag, aad);
+    return Buffer.from(plaintext).toString("utf8");
+}
+//# sourceMappingURL=cryptoCipher.string.js.map

package/dist/cryptoCipher/cryptoCipher.string.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cryptoCipher.string.js","sourceRoot":"","sources":["../../src/cryptoCipher/cryptoCipher.string.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAiB,EACjB,GAAe,EACf,OAAO,GAAkB,EAAE;IAE3B,OAAO,OAAO,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AAC/E,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAsB,EACtB,GAAe,EACf,EAAc,EACd,OAAmB,EACnB,GAAgB;IAEhB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAEnE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACjD,CAAC"}

package/dist/cryptoCipher/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @zudojs/crypto/cryptoCipher
+ *
+ * Symmetric and asymmetric encryption operations.
+ */
+export * from "./cryptoCipher.core.js";
+export * from "./cryptoCipher.string.js";
+export * from "./cryptoCipher.envelope.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cryptoCipher/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cryptoCipher/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC"}

package/dist/cryptoCipher/index.js

@@ -0,0 +1,9 @@
+/**
+ * @zudojs/crypto/cryptoCipher
+ *
+ * Symmetric and asymmetric encryption operations.
+ */
+export * from "./cryptoCipher.core.js";
+export * from "./cryptoCipher.string.js";
+export * from "./cryptoCipher.envelope.js";
+//# sourceMappingURL=index.js.map

package/dist/cryptoCipher/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cryptoCipher/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC"}

package/dist/cryptoConstants/cryptoConstants.config.d.ts

@@ -0,0 +1,36 @@
+import { CRYPTO_ALGORITHM, ENCODING } from "./cryptoConstants.type.js";
+import { TOKEN_PREFIX } from "./cryptoConstants.token.js";
+/**
+ * Type-safe union of supported crypto algorithm identifiers.
+ */
+export type CryptoAlgorithmName = (typeof CRYPTO_ALGORITHM)[keyof typeof CRYPTO_ALGORITHM];
+/**
+ * Type-safe union of supported token prefixes.
+ */
+export type TokenPrefix = (typeof TOKEN_PREFIX)[keyof typeof TOKEN_PREFIX];
+/**
+ * Type-safe union of supported encodings.
+ */
+export type CryptoEncodingName = (typeof ENCODING)[keyof typeof ENCODING];
+/**
+ * Returns the default AES-GCM configuration.
+ */
+export declare function getDefaultAesGcmConfig(): {
+    readonly keyBytes: number;
+    readonly keyBits: number;
+    readonly ivBytes: number;
+    readonly authTagBytes: number;
+};
+/**
+ * Returns the default password hashing configuration.
+ */
+export declare function getDefaultPasswordHashConfig(): {
+    readonly saltBytes: number;
+    readonly keyBytes: number;
+    readonly scryptCost: number;
+    readonly scryptBlockSize: number;
+    readonly scryptParallelization: number;
+    readonly pbkdf2Iterations: number;
+    readonly pbkdf2Digest: string;
+};
+//# sourceMappingURL=cryptoConstants.config.d.ts.map

package/dist/cryptoConstants/cryptoConstants.config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cryptoConstants.config.d.ts","sourceRoot":"","sources":["../../src/cryptoConstants/cryptoConstants.config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAW,MAAM,2BAA2B,CAAC;AAEhF,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAI1D;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC7B,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAE3D;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAE3E;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,MAAM,OAAO,QAAQ,CAAC,CAAC;AAE1E;;GAEG;AACH,wBAAgB,sBAAsB,IAAI;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAOA;AAED;;GAEG;AACH,wBAAgB,4BAA4B,IAAI;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAgBA"}

package/dist/cryptoConstants/cryptoConstants.config.js

@@ -0,0 +1,29 @@
+import { CRYPTO_ALGORITHM, ENCODING, AES_GCM } from "./cryptoConstants.type.js";
+import { TOKEN_PREFIX } from "./cryptoConstants.token.js";
+import { PASSWORD_HASH } from "./cryptoConstants.security.js";
+/**
+ * Returns the default AES-GCM configuration.
+ */
+export function getDefaultAesGcmConfig() {
+    return {
+        keyBytes: AES_GCM.KEY_BYTES,
+        keyBits: AES_GCM.KEY_BITS,
+        ivBytes: AES_GCM.IV_BYTES,
+        authTagBytes: AES_GCM.AUTH_TAG_BYTES,
+    };
+}
+/**
+ * Returns the default password hashing configuration.
+ */
+export function getDefaultPasswordHashConfig() {
+    return {
+        saltBytes: PASSWORD_HASH.SALT_BYTES,
+        keyBytes: PASSWORD_HASH.KEY_BYTES,
+        scryptCost: PASSWORD_HASH.SCRYPT.COST,
+        scryptBlockSize: PASSWORD_HASH.SCRYPT.BLOCK_SIZE,
+        scryptParallelization: PASSWORD_HASH.SCRYPT.PARALLELIZATION,
+        pbkdf2Iterations: PASSWORD_HASH.PBKDF2.ITERATIONS,
+        pbkdf2Digest: PASSWORD_HASH.PBKDF2.DIGEST,
+    };
+}
+//# sourceMappingURL=cryptoConstants.config.js.map

package/dist/cryptoConstants/cryptoConstants.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cryptoConstants.config.js","sourceRoot":"","sources":["../../src/cryptoConstants/cryptoConstants.config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAEhF,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAkB9D;;GAEG;AACH,MAAM,UAAU,sBAAsB;IAMpC,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,SAAS;QAC3B,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,YAAY,EAAE,OAAO,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B;IAS1C,OAAO;QACL,SAAS,EAAE,aAAa,CAAC,UAAU;QAEnC,QAAQ,EAAE,aAAa,CAAC,SAAS;QAEjC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI;QAErC,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,UAAU;QAEhD,qBAAqB,EAAE,aAAa,CAAC,MAAM,CAAC,eAAe;QAE3D,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,UAAU;QAEjD,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM;KAC1C,CAAC;AACJ,CAAC"}

package/dist/cryptoConstants/cryptoConstants.guard.d.ts

@@ -0,0 +1,28 @@
+import { CryptoAlgorithm } from "./cryptoConstants.type.js";
+/**
+ * Returns true when an algorithm provides authenticated encryption.
+ */
+export declare function isAeadAlgorithm(algorithm: CryptoAlgorithm): boolean;
+/**
+ * Returns true when an algorithm is a hashing algorithm.
+ */
+export declare function isHashAlgorithm(algorithm: CryptoAlgorithm): boolean;
+/**
+ * Returns true when an algorithm is a key derivation algorithm.
+ */
+export declare function isKeyDerivationAlgorithm(algorithm: CryptoAlgorithm): boolean;
+/**
+ * Returns true when an algorithm is a message authentication algorithm.
+ */
+export declare function isMacAlgorithm(algorithm: CryptoAlgorithm): boolean;
+/**
+ * Returns true when the supplied value is a supported algorithm.
+ */
+export declare function isCryptoAlgorithm(value: unknown): value is CryptoAlgorithm;
+/**
+ * Parses an algorithm from an arbitrary value.
+ *
+ * Throws when the value is not a supported algorithm.
+ */
+export declare function parseCryptoAlgorithm(value: string): CryptoAlgorithm;
+//# sourceMappingURL=cryptoConstants.guard.d.ts.map

package/dist/cryptoConstants/cryptoConstants.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cryptoConstants.guard.d.ts","sourceRoot":"","sources":["../../src/cryptoConstants/cryptoConstants.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EAKhB,MAAM,2BAA2B,CAAC;AAEnC;;GAEG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAInE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAInE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAI5E;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAElE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAK1E;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAQnE"}

package/dist/cryptoConstants/cryptoConstants.guard.js

@@ -0,0 +1,45 @@
+import { CryptoAlgorithm, AEAD_ALGORITHMS, HASH_ALGORITHMS, KEY_DERIVATION_ALGORITHMS, MAC_ALGORITHMS, } from "./cryptoConstants.type.js";
+/**
+ * Returns true when an algorithm provides authenticated encryption.
+ */
+export function isAeadAlgorithm(algorithm) {
+    return AEAD_ALGORITHMS.includes(algorithm);
+}
+/**
+ * Returns true when an algorithm is a hashing algorithm.
+ */
+export function isHashAlgorithm(algorithm) {
+    return HASH_ALGORITHMS.includes(algorithm);
+}
+/**
+ * Returns true when an algorithm is a key derivation algorithm.
+ */
+export function isKeyDerivationAlgorithm(algorithm) {
+    return KEY_DERIVATION_ALGORITHMS.includes(algorithm);
+}
+/**
+ * Returns true when an algorithm is a message authentication algorithm.
+ */
+export function isMacAlgorithm(algorithm) {
+    return MAC_ALGORITHMS.includes(algorithm);
+}
+/**
+ * Returns true when the supplied value is a supported algorithm.
+ */
+export function isCryptoAlgorithm(value) {
+    return (typeof value === "string" &&
+        Object.values(CryptoAlgorithm).includes(value));
+}
+/**
+ * Parses an algorithm from an arbitrary value.
+ *
+ * Throws when the value is not a supported algorithm.
+ */
+export function parseCryptoAlgorithm(value) {
+    const normalized = value.trim().toLowerCase();
+    if (isCryptoAlgorithm(normalized)) {
+        return normalized;
+    }
+    throw new TypeError(`Unsupported cryptographic algorithm: "${value}".`);
+}
+//# sourceMappingURL=cryptoConstants.guard.js.map

package/dist/cryptoConstants/cryptoConstants.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cryptoConstants.guard.js","sourceRoot":"","sources":["../../src/cryptoConstants/cryptoConstants.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,yBAAyB,EACzB,cAAc,GACf,MAAM,2BAA2B,CAAC;AAEnC;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,SAA0B;IACxD,OAAO,eAAe,CAAC,QAAQ,CAC7B,SAA6C,CAC9C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,SAA0B;IACxD,OAAO,eAAe,CAAC,QAAQ,CAC7B,SAA6C,CAC9C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAA0B;IACjE,OAAO,yBAAyB,CAAC,QAAQ,CACvC,SAAuD,CACxD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,SAA0B;IACvD,OAAO,cAAc,CAAC,QAAQ,CAAC,SAA4C,CAAC,CAAC;AAC/E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAwB,CAAC,CAClE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE9C,IAAI,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,IAAI,SAAS,CAAC,yCAAyC,KAAK,IAAI,CAAC,CAAC;AAC1E,CAAC"}

package/dist/cryptoConstants/cryptoConstants.security.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Password hashing constants.
+ */
+export declare const PASSWORD_HASH: Readonly<{
+    readonly SALT_BYTES: 16;
+    readonly KEY_BYTES: 32;
+    readonly SCRYPT: Readonly<{
+        COST: 16384;
+        BLOCK_SIZE: 8;
+        PARALLELIZATION: 1;
+    }>;
+    readonly PBKDF2: Readonly<{
+        ITERATIONS: 310000;
+        DIGEST: "sha256";
+    }>;
+}>;
+/**
+ * Password policy defaults.
+ *
+ * These values are intentionally conservative defaults.
+ * Applications may impose stricter requirements.
+ */
+export declare const PASSWORD_POLICY: Readonly<{
+    readonly MIN_LENGTH: 8;
+    readonly RECOMMENDED_MIN_LENGTH: 12;
+    readonly MAX_LENGTH: 1024;
+}>;
+/**
+ * Password reset and verification token lifetime defaults.
+ *
+ * Values are expressed in milliseconds.
+ */
+export declare const TOKEN_TTL: Readonly<{
+    readonly EMAIL_VERIFICATION_MS: number;
+    readonly PASSWORD_RESET_MS: number;
+    readonly LOGIN_VERIFICATION_MS: number;
+    readonly CSRF_MS: 3600000;
+    readonly SESSION_MS: number;
+    readonly REFRESH_TOKEN_MS: number;
+}>;
+//# sourceMappingURL=cryptoConstants.security.d.ts.map

package/dist/cryptoConstants/cryptoConstants.security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cryptoConstants.security.d.ts","sourceRoot":"","sources":["../../src/cryptoConstants/cryptoConstants.security.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,eAAO,MAAM,aAAa;yBACZ,EAAE;wBACH,EAAE;;;;;;;;;;EAYJ,CAAC;AAEZ;;;;;GAKG;AACH,eAAO,MAAM,eAAe;yBACd,CAAC;qCACW,EAAE;yBACd,IAAI;EACP,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,SAAS;;;;;;;EAYX,CAAC"}

package/dist/cryptoConstants/cryptoConstants.security.js

@@ -0,0 +1,42 @@
+import { TimeMs } from "@zudojs/constants";
+/**
+ * Password hashing constants.
+ */
+export const PASSWORD_HASH = Object.freeze({
+    SALT_BYTES: 16,
+    KEY_BYTES: 32,
+    SCRYPT: Object.freeze({
+        COST: 16_384,
+        BLOCK_SIZE: 8,
+        PARALLELIZATION: 1,
+    }),
+    PBKDF2: Object.freeze({
+        ITERATIONS: 310_000,
+        DIGEST: "sha256",
+    }),
+});
+/**
+ * Password policy defaults.
+ *
+ * These values are intentionally conservative defaults.
+ * Applications may impose stricter requirements.
+ */
+export const PASSWORD_POLICY = Object.freeze({
+    MIN_LENGTH: 8,
+    RECOMMENDED_MIN_LENGTH: 12,
+    MAX_LENGTH: 1024,
+});
+/**
+ * Password reset and verification token lifetime defaults.
+ *
+ * Values are expressed in milliseconds.
+ */
+export const TOKEN_TTL = Object.freeze({
+    EMAIL_VERIFICATION_MS: TimeMs.MINUTE * 15,
+    PASSWORD_RESET_MS: TimeMs.MINUTE * 15,
+    LOGIN_VERIFICATION_MS: TimeMs.MINUTE * 10,
+    CSRF_MS: TimeMs.HOUR,
+    SESSION_MS: 24 * TimeMs.HOUR,
+    REFRESH_TOKEN_MS: 30 * 24 * TimeMs.HOUR,
+});
+//# sourceMappingURL=cryptoConstants.security.js.map

package/dist/cryptoConstants/cryptoConstants.security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cryptoConstants.security.js","sourceRoot":"","sources":["../../src/cryptoConstants/cryptoConstants.security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,UAAU,EAAE,EAAE;IACd,SAAS,EAAE,EAAE;IAEb,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,CAAC;QACb,eAAe,EAAE,CAAC;KACnB,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,OAAO;QACnB,MAAM,EAAE,QAAQ;KACjB,CAAC;CACM,CAAC,CAAC;AAEZ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3C,UAAU,EAAE,CAAC;IACb,sBAAsB,EAAE,EAAE;IAC1B,UAAU,EAAE,IAAI;CACR,CAAC,CAAC;AAEZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IACrC,qBAAqB,EAAE,MAAM,CAAC,MAAM,GAAG,EAAE;IAEzC,iBAAiB,EAAE,MAAM,CAAC,MAAM,GAAG,EAAE;IAErC,qBAAqB,EAAE,MAAM,CAAC,MAAM,GAAG,EAAE;IAEzC,OAAO,EAAE,MAAM,CAAC,IAAI;IAEpB,UAAU,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI;IAE5B,gBAAgB,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI;CAC/B,CAAC,CAAC"}

package/dist/cryptoConstants/cryptoConstants.token.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Token constants.
+ */
+export declare const TOKEN: Readonly<{
+    readonly DEFAULT_BYTES: 32;
+    readonly API_KEY_BYTES: 32;
+    readonly SESSION_BYTES: 32;
+    readonly REFRESH_BYTES: 48;
+    readonly VERIFICATION_BYTES: 32;
+    readonly PASSWORD_RESET_BYTES: 32;
+    readonly CSRF_BYTES: 32;
+    readonly OTP_DIGITS: 6;
+    readonly OTP_MIN_DIGITS: 4;
+    readonly OTP_MAX_DIGITS: 12;
+}>;
+/**
+ * Random value constraints.
+ */
+export declare const RANDOM: Readonly<{
+    readonly MIN_BYTES: 16;
+    readonly DEFAULT_BYTES: 32;
+}>;
+/**
+ * Common token prefixes.
+ *
+ * Prefixes make opaque credentials easier to identify during
+ * logging, debugging, and secret scanning without exposing
+ * their underlying value.
+ */
+export declare const TOKEN_PREFIX: Readonly<{
+    readonly API_KEY: "lat_";
+    readonly SESSION: "sess_";
+    readonly REFRESH: "ref_";
+    readonly VERIFICATION: "verify_";
+    readonly PASSWORD_RESET: "reset_";
+    readonly CSRF: "csrf_";
+}>;
+/**
+ * Cryptographic protocol versions.
+ */
+export declare const CRYPTO_VERSION: Readonly<{
+    readonly CURRENT: "v1";
+    readonly PASSWORD_HASH: "v1";
+    readonly ENCRYPTION_ENVELOPE: "v1";
+    readonly TOKEN: "v1";
+}>;
+//# sourceMappingURL=cryptoConstants.token.d.ts.map

package/dist/cryptoConstants/cryptoConstants.token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cryptoConstants.token.d.ts","sourceRoot":"","sources":["../../src/cryptoConstants/cryptoConstants.token.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,KAAK;4BACD,EAAE;4BAEF,EAAE;4BACF,EAAE;4BACF,EAAE;iCACG,EAAE;mCACA,EAAE;yBACZ,EAAE;yBAEF,CAAC;6BACG,CAAC;6BACD,EAAE;EACT,CAAC;AAEZ;;GAEG;AACH,eAAO,MAAM,MAAM;wBACN,EAAE;4BACE,EAAE;EACR,CAAC;AAEZ;;;;;;GAMG;AACH,eAAO,MAAM,YAAY;sBACd,MAAM;sBACN,OAAO;sBACP,MAAM;2BACD,SAAS;6BACP,QAAQ;mBAClB,OAAO;EACJ,CAAC;AAEZ;;GAEG;AACH,eAAO,MAAM,cAAc;sBAChB,IAAI;4BACE,IAAI;kCACE,IAAI;oBAClB,IAAI;EACF,CAAC"}

package/dist/cryptoConstants/cryptoConstants.token.js

@@ -0,0 +1,47 @@
+/**
+ * Token constants.
+ */
+export const TOKEN = Object.freeze({
+    DEFAULT_BYTES: 32,
+    API_KEY_BYTES: 32,
+    SESSION_BYTES: 32,
+    REFRESH_BYTES: 48,
+    VERIFICATION_BYTES: 32,
+    PASSWORD_RESET_BYTES: 32,
+    CSRF_BYTES: 32,
+    OTP_DIGITS: 6,
+    OTP_MIN_DIGITS: 4,
+    OTP_MAX_DIGITS: 12,
+});
+/**
+ * Random value constraints.
+ */
+export const RANDOM = Object.freeze({
+    MIN_BYTES: 16,
+    DEFAULT_BYTES: 32,
+});
+/**
+ * Common token prefixes.
+ *
+ * Prefixes make opaque credentials easier to identify during
+ * logging, debugging, and secret scanning without exposing
+ * their underlying value.
+ */
+export const TOKEN_PREFIX = Object.freeze({
+    API_KEY: "lat_",
+    SESSION: "sess_",
+    REFRESH: "ref_",
+    VERIFICATION: "verify_",
+    PASSWORD_RESET: "reset_",
+    CSRF: "csrf_",
+});
+/**
+ * Cryptographic protocol versions.
+ */
+export const CRYPTO_VERSION = Object.freeze({
+    CURRENT: "v1",
+    PASSWORD_HASH: "v1",
+    ENCRYPTION_ENVELOPE: "v1",
+    TOKEN: "v1",
+});
+//# sourceMappingURL=cryptoConstants.token.js.map