@zudojs/crypto 1.3.2 → 1.4.0

package/dist/cryptoPassword/cryptoPassword.validate.js

@@ -1,10 +1,13 @@
-import { PASSWORD_HASH, PASSWORD_POLICY, } from "../cryptoConstants/cryptoConstants.security.js";
+import { PASSWORD_HASH } from "../cryptoConstants/cryptoConstants.security.js";
 import { fromBase64Url } from "../cryptoEncoding/encoding/cryptoEncoding.base64url.js";
+import { passwordHashError } from "../cryptoErrors/cryptoErrors.helper.js";
 const LIMITS = PASSWORD_HASH.LIMITS;
 /**
  * Validates the structural constraints of scrypt password hashing
  * parameters, including upper bounds so that parameters read back from a
  * stored hash cannot force unbounded CPU or memory usage.
+ *
+ * @throws {CryptoError} `CRYPTO_HASH` for any parameter outside its bound.
  */
 export function validateParameters(parameters) {
     validateSaltAndKeyBytes(parameters.saltBytes, parameters.keyBytes);
@@ -12,43 +15,45 @@ export function validateParameters(parameters) {
         parameters.cost < LIMITS.MIN_SCRYPT_COST ||
         parameters.cost > LIMITS.MAX_SCRYPT_COST ||
         (parameters.cost & (parameters.cost - 1)) !== 0) {
-        throw new RangeError(`cost must be a power of two between ${LIMITS.MIN_SCRYPT_COST} and ${LIMITS.MAX_SCRYPT_COST}.`);
+        throw passwordHashError(`cost must be a power of two between ${LIMITS.MIN_SCRYPT_COST} and ${LIMITS.MAX_SCRYPT_COST}.`);
     }
     if (!Number.isInteger(parameters.blockSize) ||
         parameters.blockSize <= 0 ||
         parameters.blockSize > LIMITS.MAX_SCRYPT_BLOCK_SIZE) {
-        throw new RangeError(`blockSize must be an integer between 1 and ${LIMITS.MAX_SCRYPT_BLOCK_SIZE}.`);
+        throw passwordHashError(`blockSize must be an integer between 1 and ${LIMITS.MAX_SCRYPT_BLOCK_SIZE}.`);
     }
     if (!Number.isInteger(parameters.parallelization) ||
         parameters.parallelization <= 0 ||
         parameters.parallelization > LIMITS.MAX_SCRYPT_PARALLELIZATION) {
-        throw new RangeError(`parallelization must be an integer between 1 and ${LIMITS.MAX_SCRYPT_PARALLELIZATION}.`);
+        throw passwordHashError(`parallelization must be an integer between 1 and ${LIMITS.MAX_SCRYPT_PARALLELIZATION}.`);
     }
     if (128 * parameters.cost * parameters.blockSize > LIMITS.MAX_SCRYPT_MEMORY_BYTES) {
-        throw new RangeError(`cost * blockSize exceeds the scrypt memory bound of ${LIMITS.MAX_SCRYPT_MEMORY_BYTES} bytes.`);
+        throw passwordHashError(`cost * blockSize exceeds the scrypt memory bound of ${LIMITS.MAX_SCRYPT_MEMORY_BYTES} bytes.`);
     }
 }
 /**
  * Validates PBKDF2 password hashing parameters, including upper bounds.
+ *
+ * @throws {CryptoError} `CRYPTO_HASH` for any parameter outside its bound.
  */
 export function validatePbkdf2Parameters(parameters) {
     validateSaltAndKeyBytes(parameters.saltBytes, parameters.keyBytes);
     if (!Number.isInteger(parameters.iterations) ||
         parameters.iterations < PASSWORD_HASH.PBKDF2.MIN_ITERATIONS ||
         parameters.iterations > LIMITS.MAX_PBKDF2_ITERATIONS) {
-        throw new RangeError(`iterations must be an integer between ${PASSWORD_HASH.PBKDF2.MIN_ITERATIONS} and ${LIMITS.MAX_PBKDF2_ITERATIONS}.`);
+        throw passwordHashError(`iterations must be an integer between ${PASSWORD_HASH.PBKDF2.MIN_ITERATIONS} and ${LIMITS.MAX_PBKDF2_ITERATIONS}.`);
     }
 }
 function validateSaltAndKeyBytes(saltBytes, keyBytes) {
     if (!Number.isInteger(saltBytes) ||
         saltBytes < LIMITS.MIN_SALT_BYTES ||
         saltBytes > LIMITS.MAX_SALT_BYTES) {
-        throw new RangeError(`saltBytes must be an integer between ${LIMITS.MIN_SALT_BYTES} and ${LIMITS.MAX_SALT_BYTES}.`);
+        throw passwordHashError(`saltBytes must be an integer between ${LIMITS.MIN_SALT_BYTES} and ${LIMITS.MAX_SALT_BYTES}.`);
     }
     if (!Number.isInteger(keyBytes) ||
         keyBytes < LIMITS.MIN_KEY_BYTES ||
         keyBytes > LIMITS.MAX_KEY_BYTES) {
-        throw new RangeError(`keyBytes must be an integer between ${LIMITS.MIN_KEY_BYTES} and ${LIMITS.MAX_KEY_BYTES}.`);
+        throw passwordHashError(`keyBytes must be an integer between ${LIMITS.MIN_KEY_BYTES} and ${LIMITS.MAX_KEY_BYTES}.`);
     }
 }
 /**
@@ -73,19 +78,3 @@ export function decodeBase64Url(value) {
     }
     return fromBase64Url(value);
 }
-/**
- * Asserts that a value is a password string within the policy length
- * bounds (non-empty, at most `PASSWORD_POLICY.MAX_LENGTH` code units).
- */
-export function assertPassword(password) {
-    if (typeof password !== "string") {
-        throw new TypeError("Password must be a string.");
-    }
-    if (password.length === 0) {
-        throw new TypeError("Password cannot be empty.");
-    }
-    if (password.length > PASSWORD_POLICY.MAX_LENGTH) {
-        throw new RangeError(`Password must not exceed ${PASSWORD_POLICY.MAX_LENGTH} characters.`);
-    }
-}
-//# sourceMappingURL=cryptoPassword.validate.js.map

package/dist/cryptoPassword/index.d.ts

@@ -8,4 +8,3 @@ export * from "./cryptoPassword.type.js";
 export * from "./cryptoPassword.codec.js";
 export * from "./cryptoPassword.validate.js";
 export * from "./cryptoPassword.helper.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/cryptoPassword/index.js

@@ -8,4 +8,3 @@ export * from "./cryptoPassword.type.js";
 export * from "./cryptoPassword.codec.js";
 export * from "./cryptoPassword.validate.js";
 export * from "./cryptoPassword.helper.js";
-//# sourceMappingURL=index.js.map

package/dist/cryptoProvider/cryptoProvider.capability.d.ts

@@ -45,4 +45,3 @@ export declare function assertHmacCapability(provider: CryptoProvider): void;
  * configuration failure, and it throws.
  */
 export declare function assertPasswordHashingCapability(provider: CryptoProvider): void;
-//# sourceMappingURL=cryptoProvider.capability.d.ts.map

package/dist/cryptoProvider/cryptoProvider.capability.js

@@ -65,4 +65,3 @@ export function assertHmacCapability(provider) {
 export function assertPasswordHashingCapability(provider) {
     assertProviderCapability(provider, "passwordHashing", CryptoOperation.KEY_DERIVATION);
 }
-//# sourceMappingURL=cryptoProvider.capability.js.map

package/dist/cryptoProvider/cryptoProvider.core.d.ts

@@ -7,4 +7,3 @@ export interface CryptoProvider extends RandomProvider, HashProvider, HmacProvid
     readonly name: string;
     readonly capabilities: CryptoCapabilities;
 }
-//# sourceMappingURL=cryptoProvider.core.d.ts.map

package/dist/cryptoProvider/cryptoProvider.core.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=cryptoProvider.core.js.map

package/dist/cryptoProvider/cryptoProvider.default.d.ts

@@ -36,4 +36,3 @@ export declare function setDefaultCryptoProvider(provider: CryptoProvider): void
  * Restores the built-in Node provider as the default.
  */
 export declare function resetDefaultCryptoProvider(): void;
-//# sourceMappingURL=cryptoProvider.default.d.ts.map

package/dist/cryptoProvider/cryptoProvider.default.js

@@ -92,4 +92,3 @@ export function setDefaultCryptoProvider(provider) {
 export function resetDefaultCryptoProvider() {
     defaultProvider = undefined;
 }
-//# sourceMappingURL=cryptoProvider.default.js.map

package/dist/cryptoProvider/cryptoProvider.interface.d.ts

@@ -63,4 +63,3 @@ export interface PasswordProvider {
     hashPassword(password: CryptoInput, options?: PasswordHashProviderOptions): Promise<string>;
     verifyPassword(password: CryptoInput, hash: string): Promise<boolean>;
 }
-//# sourceMappingURL=cryptoProvider.interface.d.ts.map

package/dist/cryptoProvider/cryptoProvider.interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=cryptoProvider.interface.js.map

package/dist/cryptoProvider/cryptoProvider.type.d.ts

@@ -67,4 +67,3 @@ export declare function isPbkdf2Digest(value: unknown): value is Pbkdf2Digest;
  * Returns whether a value names a supported signature algorithm.
  */
 export declare function isSignatureAlgorithmName(value: unknown): value is SignatureAlgorithm;
-//# sourceMappingURL=cryptoProvider.type.d.ts.map

package/dist/cryptoProvider/cryptoProvider.type.js

@@ -38,4 +38,3 @@ export function isPbkdf2Digest(value) {
 export function isSignatureAlgorithmName(value) {
     return typeof value === "string" && SIGNATURE_ALGORITHM_NAMES.has(value);
 }
-//# sourceMappingURL=cryptoProvider.type.js.map

package/dist/cryptoProvider/index.d.ts

@@ -13,4 +13,3 @@ export type { RandomProvider, HashProvider, HmacProvider, EncryptionProvider, Si
 export { getDefaultCryptoProvider, setDefaultCryptoProvider, resetDefaultCryptoProvider, assertCryptoProvider, CRYPTO_PROVIDER_METHODS, } from "./cryptoProvider.default.js";
 export { assertProviderCapability, assertRandomCapability, assertHashCapability, assertHmacCapability, assertPasswordHashingCapability, } from "./cryptoProvider.capability.js";
 export * from "./types/index.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/cryptoProvider/index.js

@@ -2,4 +2,3 @@ export { isHashAlgorithmName, isHmacAlgorithmName, isPbkdf2Digest, isSignatureAl
 export { getDefaultCryptoProvider, setDefaultCryptoProvider, resetDefaultCryptoProvider, assertCryptoProvider, CRYPTO_PROVIDER_METHODS, } from "./cryptoProvider.default.js";
 export { assertProviderCapability, assertRandomCapability, assertHashCapability, assertHmacCapability, assertPasswordHashingCapability, } from "./cryptoProvider.capability.js";
 export * from "./types/index.js";
-//# sourceMappingURL=index.js.map

package/dist/cryptoProvider/types/cryptoCipher.type.d.ts

@@ -30,4 +30,3 @@ export interface DecryptOptions {
     readonly encrypted: EncryptedData;
     readonly associatedData?: CryptoInput;
 }
-//# sourceMappingURL=cryptoCipher.type.d.ts.map

package/dist/cryptoProvider/types/cryptoCipher.type.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=cryptoCipher.type.js.map

package/dist/cryptoProvider/types/cryptoHash.type.d.ts

@@ -11,4 +11,3 @@ export interface HashResult {
  * Supported hash output encodings.
  */
 export type HashEncoding = "hex" | "base64" | "base64url";
-//# sourceMappingURL=cryptoHash.type.d.ts.map

package/dist/cryptoProvider/types/cryptoHash.type.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=cryptoHash.type.js.map

package/dist/cryptoProvider/types/cryptoKeyDerivation.type.d.ts

@@ -55,4 +55,3 @@ export interface PasswordHashProviderOptions {
     readonly keyBytes?: number;
     readonly salt?: Uint8Array;
 }
-//# sourceMappingURL=cryptoKeyDerivation.type.d.ts.map

package/dist/cryptoProvider/types/cryptoKeyDerivation.type.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=cryptoKeyDerivation.type.js.map

package/dist/cryptoProvider/types/cryptoRandom.type.d.ts

@@ -6,4 +6,3 @@ export interface RandomTokenOptions {
     readonly bytes?: number;
     readonly encoding?: EncodingFormat;
 }
-//# sourceMappingURL=cryptoRandom.type.d.ts.map

package/dist/cryptoProvider/types/cryptoRandom.type.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=cryptoRandom.type.js.map

package/dist/cryptoProvider/types/cryptoSignature.type.d.ts

@@ -1,9 +1,16 @@
+import type { KeyObject } from "node:crypto";
 import type { CryptoInput, SignatureAlgorithm } from "../cryptoProvider.type.js";
+/**
+ * Key material accepted by `sign`/`verify`: PEM text, DER bytes (PKCS#8 for
+ * private keys, SPKI for public keys) or a Node `KeyObject` such as the ones
+ * `generateEd25519KeyPair()` returns.
+ */
+export type SignatureKeyMaterial = CryptoInput | KeyObject;
 /**
  * Options for signing.
  */
 export interface SignOptions {
-    readonly key: CryptoInput;
+    readonly key: SignatureKeyMaterial;
     readonly data: CryptoInput;
     readonly algorithm?: SignatureAlgorithm;
 }
@@ -11,9 +18,8 @@ export interface SignOptions {
  * Options for verification.
  */
 export interface VerifyOptions {
-    readonly key: CryptoInput;
+    readonly key: SignatureKeyMaterial;
     readonly data: CryptoInput;
     readonly signature: Uint8Array;
     readonly algorithm?: SignatureAlgorithm;
 }
-//# sourceMappingURL=cryptoSignature.type.d.ts.map

package/dist/cryptoProvider/types/cryptoSignature.type.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=cryptoSignature.type.js.map

package/dist/cryptoProvider/types/index.d.ts

@@ -6,7 +6,6 @@
  */
 export type { HashResult, HashEncoding } from "./cryptoHash.type.js";
 export type { EncryptedData, EncryptOptions, DecryptOptions, } from "./cryptoCipher.type.js";
-export type { SignOptions, VerifyOptions } from "./cryptoSignature.type.js";
+export type { SignOptions, VerifyOptions, SignatureKeyMaterial, } from "./cryptoSignature.type.js";
 export type { DerivedKeyResult, DerivedKeyAlgorithm, DeriveKeyOptions, PasswordHashProviderOptions, } from "./cryptoKeyDerivation.type.js";
 export type { RandomTokenOptions } from "./cryptoRandom.type.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/cryptoProvider/types/index.js

@@ -5,4 +5,3 @@
  * algorithms, and operation options.
  */
 export {};
-//# sourceMappingURL=index.js.map

package/dist/cryptoRandom/cryptoRandom.choice.d.ts

@@ -14,4 +14,3 @@ export declare function randomChoice<T>(values: readonly T[], provider?: CryptoP
  * random bytes.
  */
 export declare function fillRandomBytes(target: Uint8Array, provider?: CryptoProvider): Promise<Uint8Array>;
-//# sourceMappingURL=cryptoRandom.choice.d.ts.map

package/dist/cryptoRandom/cryptoRandom.choice.js

@@ -35,4 +35,3 @@ export async function fillRandomBytes(target, provider = getDefaultCryptoProvide
     target.set(bytes);
     return target;
 }
-//# sourceMappingURL=cryptoRandom.choice.js.map

package/dist/cryptoRandom/cryptoRandom.core.d.ts

@@ -21,4 +21,3 @@ export declare function randomIntegerBelow(max: number, provider?: CryptoProvide
  * Generates a random UUID v4.
  */
 export declare function randomUuid(provider?: CryptoProvider): Promise<string>;
-//# sourceMappingURL=cryptoRandom.core.d.ts.map

package/dist/cryptoRandom/cryptoRandom.core.js

@@ -34,4 +34,3 @@ export async function randomUuid(provider = getDefaultCryptoProvider()) {
     assertRandomCapability(provider);
     return provider.randomUUID();
 }
-//# sourceMappingURL=cryptoRandom.core.js.map

package/dist/cryptoRandom/cryptoRandom.string.d.ts

@@ -1,6 +1,10 @@
 import type { CryptoProvider } from "../cryptoProvider/index.js";
 /**
  * Generates a cryptographically secure random hexadecimal string.
+ *
+ * `length` counts output **characters**, not bytes: `randomHex(32)` is 32
+ * hex digits carrying 16 bytes (128 bits) of entropy. `randomBase64` and
+ * `randomBase64Url` take a byte count instead.
  */
 export declare function randomHex(length: number, provider?: CryptoProvider): Promise<string>;
 /**
@@ -9,6 +13,9 @@ export declare function randomHex(length: number, provider?: CryptoProvider): Pr
 export declare function randomBase64(byteLength: number, provider?: CryptoProvider): Promise<string>;
 /**
  * Generates a cryptographically secure URL-safe random string.
+ *
+ * `byteLength` counts random **bytes**; the output is about 4/3 as many
+ * characters (`randomBase64Url(32)` is 43 characters of 256-bit entropy).
  */
 export declare function randomBase64Url(byteLength: number, provider?: CryptoProvider): Promise<string>;
 /**
@@ -34,4 +41,3 @@ export declare function randomAlphanumeric(length: number, provider?: CryptoProv
  * the alphabet must not be empty, and each character is drawn uniformly.
  */
 export declare function randomFromAlphabet(length: number, alphabet: string, provider?: CryptoProvider): Promise<string>;
-//# sourceMappingURL=cryptoRandom.string.d.ts.map

package/dist/cryptoRandom/cryptoRandom.string.js

@@ -7,6 +7,10 @@ function assertLength(length, name = "length") {
 }
 /**
  * Generates a cryptographically secure random hexadecimal string.
+ *
+ * `length` counts output **characters**, not bytes: `randomHex(32)` is 32
+ * hex digits carrying 16 bytes (128 bits) of entropy. `randomBase64` and
+ * `randomBase64Url` take a byte count instead.
  */
 export async function randomHex(length, provider = getDefaultCryptoProvider()) {
     assertLength(length);
@@ -25,6 +29,9 @@ export async function randomBase64(byteLength, provider = getDefaultCryptoProvid
 }
 /**
  * Generates a cryptographically secure URL-safe random string.
+ *
+ * `byteLength` counts random **bytes**; the output is about 4/3 as many
+ * characters (`randomBase64Url(32)` is 43 characters of 256-bit entropy).
  */
 export async function randomBase64Url(byteLength, provider = getDefaultCryptoProvider()) {
     assertLength(byteLength, "byteLength");
@@ -75,4 +82,3 @@ export async function randomFromAlphabet(length, alphabet, provider = getDefault
     }
     return result.join("");
 }
-//# sourceMappingURL=cryptoRandom.string.js.map

package/dist/cryptoRandom/index.d.ts

@@ -6,4 +6,3 @@
 export * from "./cryptoRandom.core.js";
 export * from "./cryptoRandom.string.js";
 export * from "./cryptoRandom.choice.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/cryptoRandom/index.js

@@ -6,4 +6,3 @@
 export * from "./cryptoRandom.core.js";
 export * from "./cryptoRandom.string.js";
 export * from "./cryptoRandom.choice.js";
-//# sourceMappingURL=index.js.map

package/dist/cryptoService/cryptoService.core.d.ts

@@ -81,4 +81,3 @@ export declare const cryptoService: CryptoService;
  * Returns the default crypto service instance.
  */
 export declare function getCryptoService(): CryptoService;
-//# sourceMappingURL=cryptoService.core.d.ts.map

package/dist/cryptoService/cryptoService.core.js

@@ -132,4 +132,3 @@ export const cryptoService = createCryptoService();
 export function getCryptoService() {
     return cryptoService;
 }
-//# sourceMappingURL=cryptoService.core.js.map

package/dist/cryptoService/cryptoService.derivation.d.ts

@@ -3,4 +3,3 @@ import type { Pbkdf2Options, ScryptOptions } from "../cryptoKeyDerivation/crypto
 import type { CryptoAlgorithm } from "../cryptoConstants/cryptoConstants.type.js";
 export type { DerivedKeyResult, Pbkdf2Options, ScryptOptions };
 export declare function serviceDeriveKey(password: string | Uint8Array, algorithm: CryptoAlgorithm, options?: Pbkdf2Options | ScryptOptions, provider?: CryptoProvider): Promise<DerivedKeyResult>;
-//# sourceMappingURL=cryptoService.derivation.d.ts.map

package/dist/cryptoService/cryptoService.derivation.js

@@ -11,4 +11,3 @@ export async function serviceDeriveKey(password, algorithm, options, provider) {
         return rethrowAsCryptoError(error, (cause) => keyDerivationError("Key derivation failed.", algorithm, cause));
     }
 }
-//# sourceMappingURL=cryptoService.derivation.js.map

package/dist/cryptoService/cryptoService.encoding.d.ts

@@ -2,4 +2,3 @@ import type { CryptoEncoding } from "../cryptoEncoding/cryptoEncoding.core.js";
 export type { CryptoEncoding };
 export declare function serviceEncode(value: Uint8Array, encoding?: CryptoEncoding): string;
 export declare function serviceDecode(value: string, encoding?: CryptoEncoding): Uint8Array;
-//# sourceMappingURL=cryptoService.encoding.d.ts.map

package/dist/cryptoService/cryptoService.encoding.js

@@ -17,4 +17,3 @@ export function serviceDecode(value, encoding = "base64url") {
         return rethrowAsCryptoError(error, (cause) => operationError("Crypto decoding failed.", CryptoOperation.DECODE, cause));
     }
 }
-//# sourceMappingURL=cryptoService.encoding.js.map

package/dist/cryptoService/index.d.ts

@@ -4,4 +4,3 @@
  * High-level cryptographic service interface.
  */
 export { CryptoService, createCryptoService, cryptoService, getCryptoService, type CryptoServiceOptions, } from "./cryptoService.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/cryptoService/index.js

@@ -4,4 +4,3 @@
  * High-level cryptographic service interface.
  */
 export { CryptoService, createCryptoService, cryptoService, getCryptoService, } from "./cryptoService.core.js";
-//# sourceMappingURL=index.js.map

package/dist/cryptoService/operations/cryptoService.cipher.d.ts

@@ -3,4 +3,3 @@ import type { CipherOptions, CipherResult } from "../../cryptoCipher/cryptoCiphe
 export type { CipherOptions, CipherResult };
 export declare function serviceEncrypt(plaintext: Uint8Array, key: Uint8Array, options?: CipherOptions, provider?: CryptoProvider): Promise<CipherResult>;
 export declare function serviceDecrypt(ciphertext: Uint8Array, key: Uint8Array, iv: Uint8Array, authTag: Uint8Array, aad?: Uint8Array, provider?: CryptoProvider): Promise<Uint8Array>;
-//# sourceMappingURL=cryptoService.cipher.d.ts.map

package/dist/cryptoService/operations/cryptoService.cipher.js

@@ -20,4 +20,3 @@ export async function serviceDecrypt(ciphertext, key, iv, authTag, aad, provider
         return rethrowAsCryptoError(error, (cause) => cipherError("Decryption failed.", CryptoOperation.DECRYPT, "aes-256-gcm", cause));
     }
 }
-//# sourceMappingURL=cryptoService.cipher.js.map

package/dist/cryptoService/operations/cryptoService.hash.d.ts

@@ -1,4 +1,3 @@
 import type { CryptoProvider } from "../../cryptoProvider/index.js";
 export declare function serviceHash(value: string | Uint8Array, provider?: CryptoProvider): Promise<Uint8Array>;
 export declare function serviceHashHex(value: string | Uint8Array, provider?: CryptoProvider): Promise<string>;
-//# sourceMappingURL=cryptoService.hash.d.ts.map

package/dist/cryptoService/operations/cryptoService.hash.js

@@ -14,4 +14,3 @@ export async function serviceHash(value, provider = getDefaultCryptoProvider())
 export async function serviceHashHex(value, provider) {
     return encode(await serviceHash(value, provider), "hex");
 }
-//# sourceMappingURL=cryptoService.hash.js.map

package/dist/cryptoService/operations/cryptoService.password.d.ts

@@ -7,4 +7,3 @@ export declare function serviceHashPassword(password: string, options?: Password
  * non-string arguments are programmer errors and throw.
  */
 export declare function serviceVerifyPassword(password: string, encodedHash: string, provider?: CryptoProvider): Promise<boolean>;
-//# sourceMappingURL=cryptoService.password.d.ts.map

package/dist/cryptoService/operations/cryptoService.password.js

@@ -27,4 +27,3 @@ export async function serviceVerifyPassword(password, encodedHash, provider) {
         return rethrowAsCryptoError(error, (cause) => operationError("Password verification failed.", CryptoOperation.VERIFY_HASH, cause));
     }
 }
-//# sourceMappingURL=cryptoService.password.js.map

package/dist/cryptoService/operations/cryptoService.token.d.ts

@@ -9,4 +9,3 @@ export declare function serviceHashToken(token: string, provider?: CryptoProvide
  * hashes yield false; non-string arguments throw.
  */
 export declare function serviceVerifyToken(token: string, expectedHash: string, provider?: CryptoProvider): Promise<boolean>;
-//# sourceMappingURL=cryptoService.token.d.ts.map

package/dist/cryptoService/operations/cryptoService.token.js

@@ -47,4 +47,3 @@ export async function serviceVerifyToken(token, expectedHash, provider) {
         return rethrowAsCryptoError(error, (cause) => hashError("Token verification failed.", "sha256", cause));
     }
 }
-//# sourceMappingURL=cryptoService.token.js.map

package/dist/cryptoService/operations/index.d.ts

@@ -8,4 +8,3 @@ export * from "./cryptoService.cipher.js";
 export * from "./cryptoService.hash.js";
 export * from "./cryptoService.password.js";
 export * from "./cryptoService.token.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/cryptoService/operations/index.js

@@ -8,4 +8,3 @@ export * from "./cryptoService.cipher.js";
 export * from "./cryptoService.hash.js";
 export * from "./cryptoService.password.js";
 export * from "./cryptoService.token.js";
-//# sourceMappingURL=index.js.map

package/dist/cryptoSignature/cryptoSignature.core.d.ts

@@ -1,5 +1,5 @@
 import type { CryptoProvider } from "../cryptoProvider/index.js";
-import type { CryptoInput } from "../cryptoProvider/index.js";
+import type { SignatureKeyMaterial } from "../cryptoProvider/index.js";
 import type { SignatureAlgorithm } from "../cryptoProvider/index.js";
 /**
  * Signature options.
@@ -14,20 +14,19 @@ export type SignatureOptions = {
 /**
  * Signs arbitrary data using a private key (PEM text, DER bytes or KeyObject).
  */
-export declare function sign(data: Uint8Array, privateKey: CryptoInput, options?: SignatureOptions): Promise<Uint8Array>;
+export declare function sign(data: Uint8Array, privateKey: SignatureKeyMaterial, options?: SignatureOptions): Promise<Uint8Array>;
 /**
  * Verifies a signature using a public key.
  *
  * Returns false for malformed keys or signatures; throws only when the
  * algorithm is unsupported or incompatible with the key type.
  */
-export declare function verify(data: Uint8Array, signature: Uint8Array, publicKey: CryptoInput, options?: SignatureOptions): Promise<boolean>;
+export declare function verify(data: Uint8Array, signature: Uint8Array, publicKey: SignatureKeyMaterial, options?: SignatureOptions): Promise<boolean>;
 /**
  * Signs UTF-8 text.
  */
-export declare function signString(data: string, privateKey: CryptoInput, options?: SignatureOptions): Promise<Uint8Array>;
+export declare function signString(data: string, privateKey: SignatureKeyMaterial, options?: SignatureOptions): Promise<Uint8Array>;
 /**
  * Verifies a signature against UTF-8 text.
  */
-export declare function verifyString(data: string, signature: Uint8Array, publicKey: CryptoInput, options?: SignatureOptions): Promise<boolean>;
-//# sourceMappingURL=cryptoSignature.core.d.ts.map
+export declare function verifyString(data: string, signature: Uint8Array, publicKey: SignatureKeyMaterial, options?: SignatureOptions): Promise<boolean>;

package/dist/cryptoSignature/cryptoSignature.core.js

@@ -41,4 +41,3 @@ export async function signString(data, privateKey, options = {}) {
 export async function verifyString(data, signature, publicKey, options = {}) {
     return verify(Buffer.from(data, "utf8"), signature, publicKey, options);
 }
-//# sourceMappingURL=cryptoSignature.core.js.map

package/dist/cryptoSignature/index.d.ts

@@ -4,4 +4,3 @@
  * Digital signature creation and verification.
  */
 export * from "./cryptoSignature.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/cryptoSignature/index.js

@@ -4,4 +4,3 @@
  * Digital signature creation and verification.
  */
 export * from "./cryptoSignature.core.js";
-//# sourceMappingURL=index.js.map

package/dist/cryptoToken/cryptoToken.core.d.ts

@@ -58,4 +58,3 @@ export declare function generateEmailVerificationCode(digits?: number, provider?
  * Generates a short-lived login verification code.
  */
 export declare function generateLoginCode(digits?: number, provider?: CryptoProvider): Promise<string>;
-//# sourceMappingURL=cryptoToken.core.d.ts.map

package/dist/cryptoToken/cryptoToken.core.js

@@ -114,4 +114,3 @@ export async function generateEmailVerificationCode(digits = TOKEN.OTP_DIGITS, p
 export async function generateLoginCode(digits = TOKEN.OTP_DIGITS, provider) {
     return generateOtp(digits, provider);
 }
-//# sourceMappingURL=cryptoToken.core.js.map

package/dist/cryptoToken/cryptoToken.hash.d.ts

@@ -23,4 +23,3 @@ export declare function verifyTokenHash(token: string, expectedHash: string, pro
  * This is useful when a raw bearer token must never be persisted.
  */
 export declare function hashTokenForStorage(token: string, provider?: CryptoProvider): Promise<string>;
-//# sourceMappingURL=cryptoToken.hash.d.ts.map

package/dist/cryptoToken/cryptoToken.hash.js

@@ -58,4 +58,3 @@ function assertToken(token) {
         throw new TypeError("Token must be a non-empty string.");
     }
 }
-//# sourceMappingURL=cryptoToken.hash.js.map

package/dist/cryptoToken/cryptoToken.utils.d.ts

@@ -10,4 +10,3 @@ export declare function hasTokenPrefix(token: string, prefix: string): boolean;
  * Validates the basic shape of an opaque token.
  */
 export declare function isValidToken(token: string, minimumLength?: number): boolean;
-//# sourceMappingURL=cryptoToken.utils.d.ts.map

package/dist/cryptoToken/cryptoToken.utils.js

@@ -27,4 +27,3 @@ function assertToken(token) {
         throw new TypeError("Token must be a non-empty string.");
     }
 }
-//# sourceMappingURL=cryptoToken.utils.js.map

package/dist/cryptoToken/index.d.ts

@@ -6,4 +6,3 @@
 export * from "./cryptoToken.core.js";
 export * from "./cryptoToken.hash.js";
 export * from "./cryptoToken.utils.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/cryptoToken/index.js

@@ -6,4 +6,3 @@
 export * from "./cryptoToken.core.js";
 export * from "./cryptoToken.hash.js";
 export * from "./cryptoToken.utils.js";
-//# sourceMappingURL=index.js.map

package/dist/cryptoUtils/cryptoUtils.compare.d.ts

@@ -10,4 +10,3 @@ export declare function secureEqual(left: Uint8Array, right: Uint8Array): boolea
  * Alias of `timingSafeEqualString`.
  */
 export declare function secureStringEqual(left: string, right: string): boolean;
-//# sourceMappingURL=cryptoUtils.compare.d.ts.map

package/dist/cryptoUtils/cryptoUtils.compare.js

@@ -15,4 +15,3 @@ export function secureEqual(left, right) {
 export function secureStringEqual(left, right) {
     return timingSafeEqualString(left, right);
 }
-//# sourceMappingURL=cryptoUtils.compare.js.map

package/dist/cryptoUtils/cryptoUtils.conversion.d.ts

@@ -22,4 +22,3 @@ export declare function sliceBytes(value: Uint8Array, start?: number, end?: numb
  * Clears sensitive byte material from memory where possible.
  */
 export declare function wipe(value: Uint8Array): void;
-//# sourceMappingURL=cryptoUtils.conversion.d.ts.map

package/dist/cryptoUtils/cryptoUtils.conversion.js

@@ -47,4 +47,3 @@ export function sliceBytes(value, start, end) {
 export function wipe(value) {
     value.fill(0);
 }
-//# sourceMappingURL=cryptoUtils.conversion.js.map

package/dist/cryptoUtils/cryptoUtils.number.d.ts

@@ -9,4 +9,3 @@ export declare function numberToBytes(value: number, byteLength?: number): Uint8
  * Converts unsigned big-endian bytes into a number.
  */
 export declare function bytesToNumber(value: Uint8Array): number;
-//# sourceMappingURL=cryptoUtils.number.d.ts.map

package/dist/cryptoUtils/cryptoUtils.number.js

@@ -38,4 +38,3 @@ export function bytesToNumber(value) {
     }
     return result;
 }
-//# sourceMappingURL=cryptoUtils.number.js.map

package/dist/cryptoUtils/cryptoUtils.text.d.ts

@@ -10,4 +10,3 @@ export declare function normalizeText(value: string): string;
  * Returns the UTF-8 byte length of a string.
  */
 export declare function utf8ByteLength(value: string): number;
-//# sourceMappingURL=cryptoUtils.text.d.ts.map