internxt-crypto 0.0.14 → 1.0.0

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","names":[],"sources":["../src/constants.ts"],"sourcesContent":["export const AES_ALGORITHM = 'AES-GCM';\nexport const AES_KEY_BIT_LENGTH = 256;\nexport const AUX_BYTE_LEN = 16;\nexport const IV_LEN_BYTES = 16;\n\nexport const KEY_WRAPPING_ALGORITHM = 'AES-KW';\nexport const KEY_FORMAT = 'raw';\nexport const CONTEXT_WRAPPING = 'CRYPTO library 2025-08-22 18:10:00 key derived from ecc and kyber secrets';\n\nexport const ECC_ALGORITHM = 'X25519';\n\nexport const CONTEXT_ENC_KEYSTORE = 'CRYPTO library 2025-07-30 16:18:03 key for opening encryption keys keystore';\nexport const CONTEXT_RECOVERY = 'CRYPTO library 2025-07-30 16:20:00 key for account recovery';\nexport const CONTEXT_INDEX = 'CRYPTO library 2025-07-30 17:20:00 key for protecting current search indices';\nexport const CONTEXT_DERIVE = 'CRYPTO library 2025-08-27 17:08:00 derive one key from two keys';\n\n// Second recommended parameter set from RFC 9106\nexport const ARGON2ID_PARALLELISM = 3;\nexport const ARGON2ID_ITERATIONS = 4;\nexport const ARGON2ID_MEMORY_SIZE = 65536;\nexport const ARGON2ID_SALT_BYTE_LENGTH = 16;\nexport const ARGON2ID_OUTPUT_BYTE_LENGTH = 32;\n\nexport const KYBER768_PUBLIC_KEY_LENGTH = 1184;\nexport const KYBER768_SECRET_KEY_LENGTH = 2400;\nexport const KYBER_SEED_LENGTH = 64;\n\nexport const HASH_BIT_LEN = 256;\n\nexport const MAX_CACHE_SIZE = 600000000; // 600 MB\nexport const MAX_EMAIL_PER_BATCH = 100;\nexport const DB_LABEL = 'email';\nexport const DB_VERSION = 1;\n\nexport const XWING_PUBLIC_KEY_LENGTH = 1216;\nexport const XWING_SECRET_KEY_LENGTH = 32;\nexport const XWING_SEED_BYTE_LENGTH = 32;\nexport const XWING_CIPHERTEXT_BYTE_LENGTH = 1120;\n"],"mappings":";;;AAAA,MAAa,gBAAgB;AAC7B,MAAa,qBAAqB;AAClC,MAAa,eAAe;AAC5B,MAAa,eAAe;AAE5B,MAAa,yBAAyB;AACtC,MAAa,aAAa;AAC1B,MAAa,mBAAmB;AAEhC,MAAa,gBAAgB;AAE7B,MAAa,uBAAuB;AACpC,MAAa,mBAAmB;AAChC,MAAa,gBAAgB;AAC7B,MAAa,iBAAiB;AAG9B,MAAa,uBAAuB;AACpC,MAAa,sBAAsB;AACnC,MAAa,uBAAuB;AACpC,MAAa,4BAA4B;AACzC,MAAa,8BAA8B;AAE3C,MAAa,6BAA6B;AAC1C,MAAa,6BAA6B;AAC1C,MAAa,oBAAoB;AAEjC,MAAa,eAAe;AAE5B,MAAa,iBAAiB;AAC9B,MAAa,sBAAsB;AACnC,MAAa,WAAW;AACxB,MAAa,aAAa;AAE1B,MAAa,0BAA0B;AACvC,MAAa,0BAA0B;AACvC,MAAa,yBAAyB;AACtC,MAAa,+BAA+B"}
+{"version":3,"file":"constants.js","names":[],"sources":["../src/constants.ts"],"sourcesContent":["export const AES_KEY_BYTE_LENGTH = 32;\nexport const IV_LEN_BYTES = 12;\n\nexport const CONTEXT_ENC_KEYSTORE = 'CRYPTO library 2025-07-30 16:18:03 key for opening encryption keys keystore';\nexport const CONTEXT_RECOVERY = 'CRYPTO library 2025-07-30 16:20:00 key for account recovery';\nexport const CONTEXT_INDEX = 'CRYPTO library 2025-07-30 17:20:00 key for protecting current search indices';\nexport const CONTEXT_DERIVE = 'CRYPTO library 2025-08-27 17:08:00 derive one key from two keys';\n\n// Second recommended parameter set from RFC 9106\nexport const ARGON2ID_PARALLELISM = 3;\nexport const ARGON2ID_ITERATIONS = 4;\nexport const ARGON2ID_MEMORY_SIZE = 65536;\nexport const ARGON2ID_SALT_BYTE_LENGTH = 16;\nexport const ARGON2ID_OUTPUT_BYTE_LENGTH = 32;\n\nexport const KYBER768_PUBLIC_KEY_LENGTH = 1184;\nexport const KYBER768_SECRET_KEY_LENGTH = 2400;\nexport const KYBER_SEED_LENGTH = 64;\n\nexport const MAX_CACHE_SIZE = 600000000; // 600 MB\nexport const MAX_EMAIL_PER_BATCH = 100;\nexport const DB_LABEL = 'email';\nexport const DB_VERSION = 1;\n\nexport const XWING_PUBLIC_KEY_LENGTH = 1216;\nexport const XWING_SECRET_KEY_LENGTH = 32;\nexport const XWING_SEED_BYTE_LENGTH = 32;\nexport const XWING_CIPHERTEXT_BYTE_LENGTH = 1120;\n"],"mappings":";;;AAAA,MAAa,sBAAsB;AACnC,MAAa,eAAe;AAE5B,MAAa,uBAAuB;AACpC,MAAa,mBAAmB;AAChC,MAAa,gBAAgB;AAC7B,MAAa,iBAAiB;AAG9B,MAAa,uBAAuB;AACpC,MAAa,sBAAsB;AACnC,MAAa,uBAAuB;AACpC,MAAa,4BAA4B;AACzC,MAAa,8BAA8B;AAE3C,MAAa,6BAA6B;AAC1C,MAAa,6BAA6B;AAC1C,MAAa,oBAAoB;AAEjC,MAAa,iBAAiB;AAC9B,MAAa,sBAAsB;AACnC,MAAa,WAAW;AACxB,MAAa,aAAa;AAE1B,MAAa,0BAA0B;AACvC,MAAa,0BAA0B;AACvC,MAAa,yBAAyB;AACtC,MAAa,+BAA+B"}

package/dist/constants.mjs

@@ -1,12 +1,6 @@
 //#region src/constants.ts
-const AES_ALGORITHM = "AES-GCM";
-const AES_KEY_BIT_LENGTH = 256;
-const AUX_BYTE_LEN = 16;
-const IV_LEN_BYTES = 16;
-const KEY_WRAPPING_ALGORITHM = "AES-KW";
-const KEY_FORMAT = "raw";
-const CONTEXT_WRAPPING = "CRYPTO library 2025-08-22 18:10:00 key derived from ecc and kyber secrets";
-const ECC_ALGORITHM = "X25519";
+const AES_KEY_BYTE_LENGTH = 32;
+const IV_LEN_BYTES = 12;
 const CONTEXT_ENC_KEYSTORE = "CRYPTO library 2025-07-30 16:18:03 key for opening encryption keys keystore";
 const CONTEXT_RECOVERY = "CRYPTO library 2025-07-30 16:20:00 key for account recovery";
 const CONTEXT_INDEX = "CRYPTO library 2025-07-30 17:20:00 key for protecting current search indices";
@@ -19,7 +13,6 @@ const ARGON2ID_OUTPUT_BYTE_LENGTH = 32;
 const KYBER768_PUBLIC_KEY_LENGTH = 1184;
 const KYBER768_SECRET_KEY_LENGTH = 2400;
 const KYBER_SEED_LENGTH = 64;
-const HASH_BIT_LEN = 256;
 const MAX_CACHE_SIZE = 6e8;
 const MAX_EMAIL_PER_BATCH = 100;
 const DB_LABEL = "email";
@@ -30,5 +23,5 @@ const XWING_SEED_BYTE_LENGTH = 32;
 const XWING_CIPHERTEXT_BYTE_LENGTH = 1120;
 
 //#endregion
-export { AES_ALGORITHM, AES_KEY_BIT_LENGTH, ARGON2ID_ITERATIONS, ARGON2ID_MEMORY_SIZE, ARGON2ID_OUTPUT_BYTE_LENGTH, ARGON2ID_PARALLELISM, ARGON2ID_SALT_BYTE_LENGTH, AUX_BYTE_LEN, CONTEXT_DERIVE, CONTEXT_ENC_KEYSTORE, CONTEXT_INDEX, CONTEXT_RECOVERY, CONTEXT_WRAPPING, DB_LABEL, DB_VERSION, ECC_ALGORITHM, HASH_BIT_LEN, IV_LEN_BYTES, KEY_FORMAT, KEY_WRAPPING_ALGORITHM, KYBER768_PUBLIC_KEY_LENGTH, KYBER768_SECRET_KEY_LENGTH, KYBER_SEED_LENGTH, MAX_CACHE_SIZE, MAX_EMAIL_PER_BATCH, XWING_CIPHERTEXT_BYTE_LENGTH, XWING_PUBLIC_KEY_LENGTH, XWING_SECRET_KEY_LENGTH, XWING_SEED_BYTE_LENGTH };
+export { AES_KEY_BYTE_LENGTH, ARGON2ID_ITERATIONS, ARGON2ID_MEMORY_SIZE, ARGON2ID_OUTPUT_BYTE_LENGTH, ARGON2ID_PARALLELISM, ARGON2ID_SALT_BYTE_LENGTH, CONTEXT_DERIVE, CONTEXT_ENC_KEYSTORE, CONTEXT_INDEX, CONTEXT_RECOVERY, DB_LABEL, DB_VERSION, IV_LEN_BYTES, KYBER768_PUBLIC_KEY_LENGTH, KYBER768_SECRET_KEY_LENGTH, KYBER_SEED_LENGTH, MAX_CACHE_SIZE, MAX_EMAIL_PER_BATCH, XWING_CIPHERTEXT_BYTE_LENGTH, XWING_PUBLIC_KEY_LENGTH, XWING_SECRET_KEY_LENGTH, XWING_SEED_BYTE_LENGTH };
 //# sourceMappingURL=constants.mjs.map

package/dist/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":[],"sources":["../src/constants.ts"],"sourcesContent":["export const AES_ALGORITHM = 'AES-GCM';\nexport const AES_KEY_BIT_LENGTH = 256;\nexport const AUX_BYTE_LEN = 16;\nexport const IV_LEN_BYTES = 16;\n\nexport const KEY_WRAPPING_ALGORITHM = 'AES-KW';\nexport const KEY_FORMAT = 'raw';\nexport const CONTEXT_WRAPPING = 'CRYPTO library 2025-08-22 18:10:00 key derived from ecc and kyber secrets';\n\nexport const ECC_ALGORITHM = 'X25519';\n\nexport const CONTEXT_ENC_KEYSTORE = 'CRYPTO library 2025-07-30 16:18:03 key for opening encryption keys keystore';\nexport const CONTEXT_RECOVERY = 'CRYPTO library 2025-07-30 16:20:00 key for account recovery';\nexport const CONTEXT_INDEX = 'CRYPTO library 2025-07-30 17:20:00 key for protecting current search indices';\nexport const CONTEXT_DERIVE = 'CRYPTO library 2025-08-27 17:08:00 derive one key from two keys';\n\n// Second recommended parameter set from RFC 9106\nexport const ARGON2ID_PARALLELISM = 3;\nexport const ARGON2ID_ITERATIONS = 4;\nexport const ARGON2ID_MEMORY_SIZE = 65536;\nexport const ARGON2ID_SALT_BYTE_LENGTH = 16;\nexport const ARGON2ID_OUTPUT_BYTE_LENGTH = 32;\n\nexport const KYBER768_PUBLIC_KEY_LENGTH = 1184;\nexport const KYBER768_SECRET_KEY_LENGTH = 2400;\nexport const KYBER_SEED_LENGTH = 64;\n\nexport const HASH_BIT_LEN = 256;\n\nexport const MAX_CACHE_SIZE = 600000000; // 600 MB\nexport const MAX_EMAIL_PER_BATCH = 100;\nexport const DB_LABEL = 'email';\nexport const DB_VERSION = 1;\n\nexport const XWING_PUBLIC_KEY_LENGTH = 1216;\nexport const XWING_SECRET_KEY_LENGTH = 32;\nexport const XWING_SEED_BYTE_LENGTH = 32;\nexport const XWING_CIPHERTEXT_BYTE_LENGTH = 1120;\n"],"mappings":";AAAA,MAAa,gBAAgB;AAC7B,MAAa,qBAAqB;AAClC,MAAa,eAAe;AAC5B,MAAa,eAAe;AAE5B,MAAa,yBAAyB;AACtC,MAAa,aAAa;AAC1B,MAAa,mBAAmB;AAEhC,MAAa,gBAAgB;AAE7B,MAAa,uBAAuB;AACpC,MAAa,mBAAmB;AAChC,MAAa,gBAAgB;AAC7B,MAAa,iBAAiB;AAG9B,MAAa,uBAAuB;AACpC,MAAa,sBAAsB;AACnC,MAAa,uBAAuB;AACpC,MAAa,4BAA4B;AACzC,MAAa,8BAA8B;AAE3C,MAAa,6BAA6B;AAC1C,MAAa,6BAA6B;AAC1C,MAAa,oBAAoB;AAEjC,MAAa,eAAe;AAE5B,MAAa,iBAAiB;AAC9B,MAAa,sBAAsB;AACnC,MAAa,WAAW;AACxB,MAAa,aAAa;AAE1B,MAAa,0BAA0B;AACvC,MAAa,0BAA0B;AACvC,MAAa,yBAAyB;AACtC,MAAa,+BAA+B"}
+{"version":3,"file":"constants.mjs","names":[],"sources":["../src/constants.ts"],"sourcesContent":["export const AES_KEY_BYTE_LENGTH = 32;\nexport const IV_LEN_BYTES = 12;\n\nexport const CONTEXT_ENC_KEYSTORE = 'CRYPTO library 2025-07-30 16:18:03 key for opening encryption keys keystore';\nexport const CONTEXT_RECOVERY = 'CRYPTO library 2025-07-30 16:20:00 key for account recovery';\nexport const CONTEXT_INDEX = 'CRYPTO library 2025-07-30 17:20:00 key for protecting current search indices';\nexport const CONTEXT_DERIVE = 'CRYPTO library 2025-08-27 17:08:00 derive one key from two keys';\n\n// Second recommended parameter set from RFC 9106\nexport const ARGON2ID_PARALLELISM = 3;\nexport const ARGON2ID_ITERATIONS = 4;\nexport const ARGON2ID_MEMORY_SIZE = 65536;\nexport const ARGON2ID_SALT_BYTE_LENGTH = 16;\nexport const ARGON2ID_OUTPUT_BYTE_LENGTH = 32;\n\nexport const KYBER768_PUBLIC_KEY_LENGTH = 1184;\nexport const KYBER768_SECRET_KEY_LENGTH = 2400;\nexport const KYBER_SEED_LENGTH = 64;\n\nexport const MAX_CACHE_SIZE = 600000000; // 600 MB\nexport const MAX_EMAIL_PER_BATCH = 100;\nexport const DB_LABEL = 'email';\nexport const DB_VERSION = 1;\n\nexport const XWING_PUBLIC_KEY_LENGTH = 1216;\nexport const XWING_SECRET_KEY_LENGTH = 32;\nexport const XWING_SEED_BYTE_LENGTH = 32;\nexport const XWING_CIPHERTEXT_BYTE_LENGTH = 1120;\n"],"mappings":";AAAA,MAAa,sBAAsB;AACnC,MAAa,eAAe;AAE5B,MAAa,uBAAuB;AACpC,MAAa,mBAAmB;AAChC,MAAa,gBAAgB;AAC7B,MAAa,iBAAiB;AAG9B,MAAa,uBAAuB;AACpC,MAAa,sBAAsB;AACnC,MAAa,uBAAuB;AACpC,MAAa,4BAA4B;AACzC,MAAa,8BAA8B;AAE3C,MAAa,6BAA6B;AAC1C,MAAa,6BAA6B;AAC1C,MAAa,oBAAoB;AAEjC,MAAa,iBAAiB;AAC9B,MAAa,sBAAsB;AACnC,MAAa,WAAW;AACxB,MAAa,aAAa;AAE1B,MAAa,0BAA0B;AACvC,MAAa,0BAA0B;AACvC,MAAa,yBAAyB;AACtC,MAAa,+BAA+B"}

package/dist/core-Bj26rNdA.js

@@ -0,0 +1,227 @@
+const require_chunk = require('./chunk-EbLFQX5m.js');
+const require_genID = require('./genID-cWOPmspk.js');
+const require_deriveKeysFromPassword = require('./deriveKeysFromPassword-C7xAGGsh.js');
+const require_aes = require('./aes-CuW_SPl-.js');
+const require_xwing = require('./xwing-iRWVRtNE.js');
+let _noble_ciphers_aes_js = require("@noble/ciphers/aes.js");
+
+//#region src/key-wrapper/aesWrapper.ts
+/**
+* Unwraps the given wrapped key
+*
+* @param encryptedKey - The wrapped key
+* @param wrappingKey - The secret key used for unwrapping
+* @returns The resulting key
+*/
+async function unwrapKey(encryptedKey, wrappingKey) {
+	return (0, _noble_ciphers_aes_js.aeskw)(wrappingKey).decrypt(encryptedKey);
+}
+/**
+* Wraps the given key
+*
+* @param key - The key to be wrapped
+* @param wrappingKey - The secret key used for wrapping
+* @returns The resulting ciphertext
+*/
+async function wrapKey(key, wrappingKey) {
+	return (0, _noble_ciphers_aes_js.aeskw)(wrappingKey).encrypt(key);
+}
+
+//#endregion
+//#region src/email-crypto/core.ts
+/**
+* Symmetrically encrypts email body.
+*
+* @param body - The email body to encrypt.
+* @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).
+* @returns The resulting encrypted email body and symmetric key used for encryption
+*/
+async function encryptEmailBody(body, aux) {
+	try {
+		if (!body.text || !body.subject) throw new Error("Invalid input");
+		const encryptionKey = require_aes.genSymmetricKey();
+		return {
+			encEmailBody: await encryptEmailBodyWithKey(body, encryptionKey, aux),
+			encryptionKey
+		};
+	} catch (error) {
+		throw new Error("Failed to symmetrically encrypt email body", { cause: error });
+	}
+}
+/**
+* Symmetrically encrypts email body with the given key.
+*
+* @param body - The email body to encrypt.
+* @param encryptionKey - The symmetric key to encrypt the email.
+* @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).
+* @returns The resulting encrypted email body and symmetric key used for encryption
+*/
+async function encryptEmailBodyWithKey(body, encryptionKey, aux) {
+	try {
+		const text = require_genID.UTF8ToUint8(body.text);
+		const subjectEnc = await require_aes.encryptSymmetrically(encryptionKey, require_genID.UTF8ToUint8(body.subject), aux);
+		const enc = {
+			encText: require_genID.uint8ArrayToBase64(await require_aes.encryptSymmetrically(encryptionKey, text, aux)),
+			encSubject: require_genID.uint8ArrayToBase64(subjectEnc)
+		};
+		if (body.attachments) {
+			const promises = body.attachments.map((attachment) => {
+				return require_aes.encryptSymmetrically(encryptionKey, require_genID.UTF8ToUint8(attachment), aux);
+			});
+			enc.encAttachments = (await Promise.all(promises))?.map(require_genID.uint8ArrayToBase64);
+		}
+		return enc;
+	} catch (error) {
+		throw new Error("Failed to encrypt email body", { cause: error });
+	}
+}
+/**
+* Decrypts symmetrically encrypted email body.
+*
+* @param encEmailBody - The email body to decrypt.
+* @param encryptionKey - The symmetric key to decrypt the email.
+* @param aux - An optional auxilary sting for AEAD (e.g., email ID or timestamp).
+* @returns The resulting decrypted email body
+*/
+async function decryptEmailBody(encEmailBody, encryptionKey, aux) {
+	try {
+		const subject = require_genID.uint8ToUTF8(await require_aes.decryptSymmetrically(encryptionKey, require_genID.base64ToUint8Array(encEmailBody.encSubject), aux));
+		const body = {
+			text: require_genID.uint8ToUTF8(await require_aes.decryptSymmetrically(encryptionKey, require_genID.base64ToUint8Array(encEmailBody.encText), aux)),
+			subject
+		};
+		if (encEmailBody.encAttachments) {
+			const promises = (encEmailBody.encAttachments?.map(require_genID.base64ToUint8Array))?.map((encAtt) => require_aes.decryptSymmetrically(encryptionKey, encAtt, aux));
+			body.attachments = (await Promise.all(promises))?.map((att) => require_genID.uint8ToUTF8(att));
+		}
+		return body;
+	} catch (error) {
+		throw new Error("Failed to symmetrically decrypt email body", { cause: error });
+	}
+}
+/**
+* Encrypts the email symmetric key using hybrid encryption.
+*
+* @param emailEncryptionKey - The symmetric key used for email encryption.
+* @param recipient - The recipient with a public hybrid key.
+* @returns The encrypted email symmetric key
+*/
+async function encryptKeysHybrid(emailEncryptionKey, recipient) {
+	try {
+		const { cipherText, sharedSecret } = require_xwing.encapsulateHybrid(recipient.publicHybridKey);
+		return {
+			encryptedKey: require_genID.uint8ArrayToBase64(await wrapKey(emailEncryptionKey, sharedSecret)),
+			hybridCiphertext: require_genID.uint8ArrayToBase64(cipherText),
+			encryptedForEmail: recipient.email
+		};
+	} catch (error) {
+		throw new Error("Failed to encrypt email key using hybrid encryption", { cause: error });
+	}
+}
+/**
+* Decrypts the email symmetric key encrypted via hybrid encryption.
+*
+* @param encryptedKey - The encrypted email key.
+* @param recipientPrivateKey - The private key of the recipient.
+* @returns The email encryption key
+*/
+async function decryptKeysHybrid(encryptedKey, recipientPrivateKey) {
+	try {
+		const kyberCiphertext = require_genID.base64ToUint8Array(encryptedKey.hybridCiphertext);
+		return await unwrapKey(require_genID.base64ToUint8Array(encryptedKey.encryptedKey), require_xwing.decapsulateHybrid(kyberCiphertext, recipientPrivateKey));
+	} catch (error) {
+		throw new Error("Failed to decrypt email key encrypted via hybrid encryption", { cause: error });
+	}
+}
+/**
+* Password-protects the email symmetric key.
+*
+* @param emailEncryptionKey - The symmetric key used for email encryption.
+* @param password - The secret password for key protection.
+* @returns The password-protected email symmetric key
+*/
+async function passwordProtectKey(emailEncryptionKey, password) {
+	try {
+		const { key, salt } = await require_deriveKeysFromPassword.getKeyFromPassword(password);
+		const encryptedKey = await wrapKey(emailEncryptionKey, key);
+		const saltStr = require_genID.uint8ArrayToBase64(salt);
+		return {
+			encryptedKey: require_genID.uint8ArrayToBase64(encryptedKey),
+			salt: saltStr
+		};
+	} catch (error) {
+		throw new Error("Failed to password-protect email key", { cause: error });
+	}
+}
+/**
+* Removes passoword-protection and exposes the email symmetric key.
+*
+* @param emailEncryptionKey -  The password-protected email key.
+* @param password - The secret password for key protection.
+* @returns The email encryption key
+*/
+async function removePasswordProtection(emailEncryptionKey, password) {
+	try {
+		const salt = require_genID.base64ToUint8Array(emailEncryptionKey.salt);
+		return await unwrapKey(require_genID.base64ToUint8Array(emailEncryptionKey.encryptedKey), await require_deriveKeysFromPassword.getKeyFromPasswordAndSalt(password, salt));
+	} catch (error) {
+		throw new Error("Failed to remove password-protection from email key", { cause: error });
+	}
+}
+
+//#endregion
+Object.defineProperty(exports, 'decryptEmailBody', {
+  enumerable: true,
+  get: function () {
+    return decryptEmailBody;
+  }
+});
+Object.defineProperty(exports, 'decryptKeysHybrid', {
+  enumerable: true,
+  get: function () {
+    return decryptKeysHybrid;
+  }
+});
+Object.defineProperty(exports, 'encryptEmailBody', {
+  enumerable: true,
+  get: function () {
+    return encryptEmailBody;
+  }
+});
+Object.defineProperty(exports, 'encryptEmailBodyWithKey', {
+  enumerable: true,
+  get: function () {
+    return encryptEmailBodyWithKey;
+  }
+});
+Object.defineProperty(exports, 'encryptKeysHybrid', {
+  enumerable: true,
+  get: function () {
+    return encryptKeysHybrid;
+  }
+});
+Object.defineProperty(exports, 'passwordProtectKey', {
+  enumerable: true,
+  get: function () {
+    return passwordProtectKey;
+  }
+});
+Object.defineProperty(exports, 'removePasswordProtection', {
+  enumerable: true,
+  get: function () {
+    return removePasswordProtection;
+  }
+});
+Object.defineProperty(exports, 'unwrapKey', {
+  enumerable: true,
+  get: function () {
+    return unwrapKey;
+  }
+});
+Object.defineProperty(exports, 'wrapKey', {
+  enumerable: true,
+  get: function () {
+    return wrapKey;
+  }
+});
+//# sourceMappingURL=core-Bj26rNdA.js.map

package/dist/core-Bj26rNdA.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-Bj26rNdA.js","names":["genSymmetricKey","UTF8ToUint8","encryptSymmetrically","uint8ArrayToBase64","uint8ToUTF8","decryptSymmetrically","base64ToUint8Array","encapsulateHybrid","decapsulateHybrid","getKeyFromPassword","getKeyFromPasswordAndSalt"],"sources":["../src/key-wrapper/aesWrapper.ts","../src/email-crypto/core.ts"],"sourcesContent":["import { aeskw } from '@noble/ciphers/aes.js';\n\n/**\n * Unwraps the given wrapped key\n *\n * @param encryptedKey - The wrapped key\n * @param wrappingKey - The secret key used for unwrapping\n * @returns The resulting key\n */\nexport async function unwrapKey(encryptedKey: Uint8Array, wrappingKey: Uint8Array): Promise<Uint8Array> {\n  return aeskw(wrappingKey).decrypt(encryptedKey);\n}\n\n/**\n * Wraps the given key\n *\n * @param key - The key to be wrapped\n * @param wrappingKey - The secret key used for wrapping\n * @returns The resulting ciphertext\n */\nexport async function wrapKey(key: Uint8Array, wrappingKey: Uint8Array): Promise<Uint8Array> {\n  return aeskw(wrappingKey).encrypt(key);\n}\n","import { HybridEncKey, PwdProtectedKey, EmailBody, EmailBodyEncrypted, RecipientWithPublicKey } from '../types';\nimport { encryptSymmetrically, decryptSymmetrically, genSymmetricKey } from '../symmetric-crypto';\nimport { encapsulateHybrid, decapsulateHybrid } from '../hybrid-crypto';\nimport { wrapKey, unwrapKey } from '../key-wrapper';\nimport { getKeyFromPassword, getKeyFromPasswordAndSalt } from '../derive-password';\nimport { UTF8ToUint8, base64ToUint8Array, uint8ArrayToBase64, uint8ToUTF8 } from '../utils';\n\n/**\n * Symmetrically encrypts email body.\n *\n * @param body - The email body to encrypt.\n * @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).\n * @returns The resulting encrypted email body and symmetric key used for encryption\n */\nexport async function encryptEmailBody(\n  body: EmailBody,\n  aux?: Uint8Array,\n): Promise<{\n  encEmailBody: EmailBodyEncrypted;\n  encryptionKey: Uint8Array;\n}> {\n  try {\n    if (!body.text || !body.subject) {\n      throw new Error('Invalid input');\n    }\n    const encryptionKey = genSymmetricKey();\n    const encEmailBody = await encryptEmailBodyWithKey(body, encryptionKey, aux);\n\n    return { encEmailBody, encryptionKey };\n  } catch (error) {\n    throw new Error('Failed to symmetrically encrypt email body', { cause: error });\n  }\n}\n\n/**\n * Symmetrically encrypts email body with the given key.\n *\n * @param body - The email body to encrypt.\n * @param encryptionKey - The symmetric key to encrypt the email.\n * @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).\n * @returns The resulting encrypted email body and symmetric key used for encryption\n */\nexport async function encryptEmailBodyWithKey(\n  body: EmailBody,\n  encryptionKey: Uint8Array,\n  aux?: Uint8Array,\n): Promise<EmailBodyEncrypted> {\n  try {\n    const text = UTF8ToUint8(body.text);\n    const subject = UTF8ToUint8(body.subject);\n    const subjectEnc = await encryptSymmetrically(encryptionKey, subject, aux);\n    const encryptedText = await encryptSymmetrically(encryptionKey, text, aux);\n    const encText = uint8ArrayToBase64(encryptedText);\n    const encSubject = uint8ArrayToBase64(subjectEnc);\n    const enc: EmailBodyEncrypted = { encText, encSubject };\n\n    if (body.attachments) {\n      const promises = body.attachments.map((attachment) => {\n        const binaryAttachment = UTF8ToUint8(attachment);\n        return encryptSymmetrically(encryptionKey, binaryAttachment, aux);\n      });\n      const encryptedAttachments = await Promise.all(promises);\n      enc.encAttachments = encryptedAttachments?.map(uint8ArrayToBase64);\n    }\n\n    return enc;\n  } catch (error) {\n    throw new Error('Failed to encrypt email body', { cause: error });\n  }\n}\n\n/**\n * Decrypts symmetrically encrypted email body.\n *\n * @param encEmailBody - The email body to decrypt.\n * @param encryptionKey - The symmetric key to decrypt the email.\n * @param aux - An optional auxilary sting for AEAD (e.g., email ID or timestamp).\n * @returns The resulting decrypted email body\n */\nexport async function decryptEmailBody(\n  encEmailBody: EmailBodyEncrypted,\n  encryptionKey: Uint8Array,\n  aux?: Uint8Array,\n): Promise<EmailBody> {\n  try {\n    const encSubject = base64ToUint8Array(encEmailBody.encSubject);\n    const subjectArray = await decryptSymmetrically(encryptionKey, encSubject, aux);\n    const subject = uint8ToUTF8(subjectArray);\n    const encText = base64ToUint8Array(encEmailBody.encText);\n    const textArray = await decryptSymmetrically(encryptionKey, encText, aux);\n    const text = uint8ToUTF8(textArray);\n    const body: EmailBody = { text, subject };\n\n    if (encEmailBody.encAttachments) {\n      const encAttachments = encEmailBody.encAttachments?.map(base64ToUint8Array);\n      const promises = encAttachments?.map((encAtt) => decryptSymmetrically(encryptionKey, encAtt, aux));\n      const decryptedAttachments = await Promise.all(promises);\n      body.attachments = decryptedAttachments?.map((att) => uint8ToUTF8(att));\n    }\n\n    return body;\n  } catch (error) {\n    throw new Error('Failed to symmetrically decrypt email body', { cause: error });\n  }\n}\n\n/**\n * Encrypts the email symmetric key using hybrid encryption.\n *\n * @param emailEncryptionKey - The symmetric key used for email encryption.\n * @param recipient - The recipient with a public hybrid key.\n * @returns The encrypted email symmetric key\n */\nexport async function encryptKeysHybrid(\n  emailEncryptionKey: Uint8Array,\n  recipient: RecipientWithPublicKey,\n): Promise<HybridEncKey> {\n  try {\n    const { cipherText, sharedSecret } = encapsulateHybrid(recipient.publicHybridKey);\n    const encryptedKey = await wrapKey(emailEncryptionKey, sharedSecret);\n    const encryptedKeyBase64 = uint8ArrayToBase64(encryptedKey);\n    const kyberCiphertextBase64 = uint8ArrayToBase64(cipherText);\n\n    return {\n      encryptedKey: encryptedKeyBase64,\n      hybridCiphertext: kyberCiphertextBase64,\n      encryptedForEmail: recipient.email,\n    };\n  } catch (error) {\n    throw new Error('Failed to encrypt email key using hybrid encryption', { cause: error });\n  }\n}\n\n/**\n * Decrypts the email symmetric key encrypted via hybrid encryption.\n *\n * @param encryptedKey - The encrypted email key.\n * @param recipientPrivateKey - The private key of the recipient.\n * @returns The email encryption key\n */\nexport async function decryptKeysHybrid(\n  encryptedKey: HybridEncKey,\n  recipientPrivateKey: Uint8Array,\n): Promise<Uint8Array> {\n  try {\n    const kyberCiphertext = base64ToUint8Array(encryptedKey.hybridCiphertext);\n    const encKey = base64ToUint8Array(encryptedKey.encryptedKey);\n    const sharedSecret = decapsulateHybrid(kyberCiphertext, recipientPrivateKey);\n    const encryptionKey = await unwrapKey(encKey, sharedSecret);\n    return encryptionKey;\n  } catch (error) {\n    throw new Error('Failed to decrypt email key encrypted via hybrid encryption', { cause: error });\n  }\n}\n\n/**\n * Password-protects the email symmetric key.\n *\n * @param emailEncryptionKey - The symmetric key used for email encryption.\n * @param password - The secret password for key protection.\n * @returns The password-protected email symmetric key\n */\nexport async function passwordProtectKey(emailEncryptionKey: Uint8Array, password: string): Promise<PwdProtectedKey> {\n  try {\n    const { key, salt } = await getKeyFromPassword(password);\n    const encryptedKey = await wrapKey(emailEncryptionKey, key);\n    const saltStr = uint8ArrayToBase64(salt);\n    const encryptedKeyStr = uint8ArrayToBase64(encryptedKey);\n    return { encryptedKey: encryptedKeyStr, salt: saltStr };\n  } catch (error) {\n    throw new Error('Failed to password-protect email key', { cause: error });\n  }\n}\n\n/**\n * Removes passoword-protection and exposes the email symmetric key.\n *\n * @param emailEncryptionKey -  The password-protected email key.\n * @param password - The secret password for key protection.\n * @returns The email encryption key\n */\nexport async function removePasswordProtection(\n  emailEncryptionKey: PwdProtectedKey,\n  password: string,\n): Promise<Uint8Array> {\n  try {\n    const salt = base64ToUint8Array(emailEncryptionKey.salt);\n    const encryptedKey = base64ToUint8Array(emailEncryptionKey.encryptedKey);\n    const key = await getKeyFromPasswordAndSalt(password, salt);\n    const encryptionKey = await unwrapKey(encryptedKey, key);\n    return encryptionKey;\n  } catch (error) {\n    throw new Error('Failed to remove password-protection from email key', { cause: error });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AASA,eAAsB,UAAU,cAA0B,aAA8C;AACtG,yCAAa,YAAY,CAAC,QAAQ,aAAa;;;;;;;;;AAUjD,eAAsB,QAAQ,KAAiB,aAA8C;AAC3F,yCAAa,YAAY,CAAC,QAAQ,IAAI;;;;;;;;;;;;ACPxC,eAAsB,iBACpB,MACA,KAIC;AACD,KAAI;AACF,MAAI,CAAC,KAAK,QAAQ,CAAC,KAAK,QACtB,OAAM,IAAI,MAAM,gBAAgB;EAElC,MAAM,gBAAgBA,6BAAiB;AAGvC,SAAO;GAAE,cAFY,MAAM,wBAAwB,MAAM,eAAe,IAAI;GAErD;GAAe;UAC/B,OAAO;AACd,QAAM,IAAI,MAAM,8CAA8C,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;;AAYnF,eAAsB,wBACpB,MACA,eACA,KAC6B;AAC7B,KAAI;EACF,MAAM,OAAOC,0BAAY,KAAK,KAAK;EAEnC,MAAM,aAAa,MAAMC,iCAAqB,eAD9BD,0BAAY,KAAK,QAAQ,EAC6B,IAAI;EAI1E,MAAM,MAA0B;GAAE,SAFlBE,iCADM,MAAMD,iCAAqB,eAAe,MAAM,IAAI,CACzB;GAEN,YADxBC,iCAAmB,WAAW;GACM;AAEvD,MAAI,KAAK,aAAa;GACpB,MAAM,WAAW,KAAK,YAAY,KAAK,eAAe;AAEpD,WAAOD,iCAAqB,eADHD,0BAAY,WAAW,EACa,IAAI;KACjE;AAEF,OAAI,kBADyB,MAAM,QAAQ,IAAI,SAAS,GACb,IAAIE,iCAAmB;;AAGpE,SAAO;UACA,OAAO;AACd,QAAM,IAAI,MAAM,gCAAgC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;;AAYrE,eAAsB,iBACpB,cACA,eACA,KACoB;AACpB,KAAI;EAGF,MAAM,UAAUC,0BADK,MAAMC,iCAAqB,eAD7BC,iCAAmB,aAAa,WAAW,EACa,IAAI,CACtC;EAIzC,MAAM,OAAkB;GAAE,MADbF,0BADK,MAAMC,iCAAqB,eAD7BC,iCAAmB,aAAa,QAAQ,EACa,IAAI,CACtC;GACH;GAAS;AAEzC,MAAI,aAAa,gBAAgB;GAE/B,MAAM,YADiB,aAAa,gBAAgB,IAAIA,iCAAmB,GAC1C,KAAK,WAAWD,iCAAqB,eAAe,QAAQ,IAAI,CAAC;AAElG,QAAK,eADwB,MAAM,QAAQ,IAAI,SAAS,GACf,KAAK,QAAQD,0BAAY,IAAI,CAAC;;AAGzE,SAAO;UACA,OAAO;AACd,QAAM,IAAI,MAAM,8CAA8C,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;AAWnF,eAAsB,kBACpB,oBACA,WACuB;AACvB,KAAI;EACF,MAAM,EAAE,YAAY,iBAAiBG,gCAAkB,UAAU,gBAAgB;AAKjF,SAAO;GACL,cAJyBJ,iCADN,MAAM,QAAQ,oBAAoB,aAAa,CACT;GAKzD,kBAJ4BA,iCAAmB,WAAW;GAK1D,mBAAmB,UAAU;GAC9B;UACM,OAAO;AACd,QAAM,IAAI,MAAM,uDAAuD,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;AAW5F,eAAsB,kBACpB,cACA,qBACqB;AACrB,KAAI;EACF,MAAM,kBAAkBG,iCAAmB,aAAa,iBAAiB;AAIzE,SADsB,MAAM,UAFbA,iCAAmB,aAAa,aAAa,EACvCE,gCAAkB,iBAAiB,oBAAoB,CACjB;UAEpD,OAAO;AACd,QAAM,IAAI,MAAM,+DAA+D,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;AAWpG,eAAsB,mBAAmB,oBAAgC,UAA4C;AACnH,KAAI;EACF,MAAM,EAAE,KAAK,SAAS,MAAMC,kDAAmB,SAAS;EACxD,MAAM,eAAe,MAAM,QAAQ,oBAAoB,IAAI;EAC3D,MAAM,UAAUN,iCAAmB,KAAK;AAExC,SAAO;GAAE,cADeA,iCAAmB,aAAa;GAChB,MAAM;GAAS;UAChD,OAAO;AACd,QAAM,IAAI,MAAM,wCAAwC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;AAW7E,eAAsB,yBACpB,oBACA,UACqB;AACrB,KAAI;EACF,MAAM,OAAOG,iCAAmB,mBAAmB,KAAK;AAIxD,SADsB,MAAM,UAFPA,iCAAmB,mBAAmB,aAAa,EAC5D,MAAMI,yDAA0B,UAAU,KAAK,CACH;UAEjD,OAAO;AACd,QAAM,IAAI,MAAM,uDAAuD,EAAE,OAAO,OAAO,CAAC"}

package/dist/core-pEGygy6S.mjs

@@ -0,0 +1,173 @@
+import { c as base64ToUint8Array, f as uint8ToUTF8, s as UTF8ToUint8, u as uint8ArrayToBase64 } from "./genID-D08K7JPr.mjs";
+import { n as getKeyFromPasswordAndSalt, t as getKeyFromPassword } from "./deriveKeysFromPassword-DXgSvTNC.mjs";
+import { n as encryptSymmetrically, r as genSymmetricKey, t as decryptSymmetrically } from "./aes-B8TA-JKq.mjs";
+import { n as encapsulateHybrid, t as decapsulateHybrid } from "./xwing-CQmQX6hn.mjs";
+import { aeskw } from "@noble/ciphers/aes.js";
+
+//#region src/key-wrapper/aesWrapper.ts
+/**
+* Unwraps the given wrapped key
+*
+* @param encryptedKey - The wrapped key
+* @param wrappingKey - The secret key used for unwrapping
+* @returns The resulting key
+*/
+async function unwrapKey(encryptedKey, wrappingKey) {
+	return aeskw(wrappingKey).decrypt(encryptedKey);
+}
+/**
+* Wraps the given key
+*
+* @param key - The key to be wrapped
+* @param wrappingKey - The secret key used for wrapping
+* @returns The resulting ciphertext
+*/
+async function wrapKey(key, wrappingKey) {
+	return aeskw(wrappingKey).encrypt(key);
+}
+
+//#endregion
+//#region src/email-crypto/core.ts
+/**
+* Symmetrically encrypts email body.
+*
+* @param body - The email body to encrypt.
+* @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).
+* @returns The resulting encrypted email body and symmetric key used for encryption
+*/
+async function encryptEmailBody(body, aux) {
+	try {
+		if (!body.text || !body.subject) throw new Error("Invalid input");
+		const encryptionKey = genSymmetricKey();
+		return {
+			encEmailBody: await encryptEmailBodyWithKey(body, encryptionKey, aux),
+			encryptionKey
+		};
+	} catch (error) {
+		throw new Error("Failed to symmetrically encrypt email body", { cause: error });
+	}
+}
+/**
+* Symmetrically encrypts email body with the given key.
+*
+* @param body - The email body to encrypt.
+* @param encryptionKey - The symmetric key to encrypt the email.
+* @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).
+* @returns The resulting encrypted email body and symmetric key used for encryption
+*/
+async function encryptEmailBodyWithKey(body, encryptionKey, aux) {
+	try {
+		const text = UTF8ToUint8(body.text);
+		const subjectEnc = await encryptSymmetrically(encryptionKey, UTF8ToUint8(body.subject), aux);
+		const enc = {
+			encText: uint8ArrayToBase64(await encryptSymmetrically(encryptionKey, text, aux)),
+			encSubject: uint8ArrayToBase64(subjectEnc)
+		};
+		if (body.attachments) {
+			const promises = body.attachments.map((attachment) => {
+				return encryptSymmetrically(encryptionKey, UTF8ToUint8(attachment), aux);
+			});
+			enc.encAttachments = (await Promise.all(promises))?.map(uint8ArrayToBase64);
+		}
+		return enc;
+	} catch (error) {
+		throw new Error("Failed to encrypt email body", { cause: error });
+	}
+}
+/**
+* Decrypts symmetrically encrypted email body.
+*
+* @param encEmailBody - The email body to decrypt.
+* @param encryptionKey - The symmetric key to decrypt the email.
+* @param aux - An optional auxilary sting for AEAD (e.g., email ID or timestamp).
+* @returns The resulting decrypted email body
+*/
+async function decryptEmailBody(encEmailBody, encryptionKey, aux) {
+	try {
+		const subject = uint8ToUTF8(await decryptSymmetrically(encryptionKey, base64ToUint8Array(encEmailBody.encSubject), aux));
+		const body = {
+			text: uint8ToUTF8(await decryptSymmetrically(encryptionKey, base64ToUint8Array(encEmailBody.encText), aux)),
+			subject
+		};
+		if (encEmailBody.encAttachments) {
+			const promises = (encEmailBody.encAttachments?.map(base64ToUint8Array))?.map((encAtt) => decryptSymmetrically(encryptionKey, encAtt, aux));
+			body.attachments = (await Promise.all(promises))?.map((att) => uint8ToUTF8(att));
+		}
+		return body;
+	} catch (error) {
+		throw new Error("Failed to symmetrically decrypt email body", { cause: error });
+	}
+}
+/**
+* Encrypts the email symmetric key using hybrid encryption.
+*
+* @param emailEncryptionKey - The symmetric key used for email encryption.
+* @param recipient - The recipient with a public hybrid key.
+* @returns The encrypted email symmetric key
+*/
+async function encryptKeysHybrid(emailEncryptionKey, recipient) {
+	try {
+		const { cipherText, sharedSecret } = encapsulateHybrid(recipient.publicHybridKey);
+		return {
+			encryptedKey: uint8ArrayToBase64(await wrapKey(emailEncryptionKey, sharedSecret)),
+			hybridCiphertext: uint8ArrayToBase64(cipherText),
+			encryptedForEmail: recipient.email
+		};
+	} catch (error) {
+		throw new Error("Failed to encrypt email key using hybrid encryption", { cause: error });
+	}
+}
+/**
+* Decrypts the email symmetric key encrypted via hybrid encryption.
+*
+* @param encryptedKey - The encrypted email key.
+* @param recipientPrivateKey - The private key of the recipient.
+* @returns The email encryption key
+*/
+async function decryptKeysHybrid(encryptedKey, recipientPrivateKey) {
+	try {
+		const kyberCiphertext = base64ToUint8Array(encryptedKey.hybridCiphertext);
+		return await unwrapKey(base64ToUint8Array(encryptedKey.encryptedKey), decapsulateHybrid(kyberCiphertext, recipientPrivateKey));
+	} catch (error) {
+		throw new Error("Failed to decrypt email key encrypted via hybrid encryption", { cause: error });
+	}
+}
+/**
+* Password-protects the email symmetric key.
+*
+* @param emailEncryptionKey - The symmetric key used for email encryption.
+* @param password - The secret password for key protection.
+* @returns The password-protected email symmetric key
+*/
+async function passwordProtectKey(emailEncryptionKey, password) {
+	try {
+		const { key, salt } = await getKeyFromPassword(password);
+		const encryptedKey = await wrapKey(emailEncryptionKey, key);
+		const saltStr = uint8ArrayToBase64(salt);
+		return {
+			encryptedKey: uint8ArrayToBase64(encryptedKey),
+			salt: saltStr
+		};
+	} catch (error) {
+		throw new Error("Failed to password-protect email key", { cause: error });
+	}
+}
+/**
+* Removes passoword-protection and exposes the email symmetric key.
+*
+* @param emailEncryptionKey -  The password-protected email key.
+* @param password - The secret password for key protection.
+* @returns The email encryption key
+*/
+async function removePasswordProtection(emailEncryptionKey, password) {
+	try {
+		const salt = base64ToUint8Array(emailEncryptionKey.salt);
+		return await unwrapKey(base64ToUint8Array(emailEncryptionKey.encryptedKey), await getKeyFromPasswordAndSalt(password, salt));
+	} catch (error) {
+		throw new Error("Failed to remove password-protection from email key", { cause: error });
+	}
+}
+
+//#endregion
+export { encryptKeysHybrid as a, unwrapKey as c, encryptEmailBodyWithKey as i, wrapKey as l, decryptKeysHybrid as n, passwordProtectKey as o, encryptEmailBody as r, removePasswordProtection as s, decryptEmailBody as t };
+//# sourceMappingURL=core-pEGygy6S.mjs.map

package/dist/core-pEGygy6S.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-pEGygy6S.mjs","names":[],"sources":["../src/key-wrapper/aesWrapper.ts","../src/email-crypto/core.ts"],"sourcesContent":["import { aeskw } from '@noble/ciphers/aes.js';\n\n/**\n * Unwraps the given wrapped key\n *\n * @param encryptedKey - The wrapped key\n * @param wrappingKey - The secret key used for unwrapping\n * @returns The resulting key\n */\nexport async function unwrapKey(encryptedKey: Uint8Array, wrappingKey: Uint8Array): Promise<Uint8Array> {\n  return aeskw(wrappingKey).decrypt(encryptedKey);\n}\n\n/**\n * Wraps the given key\n *\n * @param key - The key to be wrapped\n * @param wrappingKey - The secret key used for wrapping\n * @returns The resulting ciphertext\n */\nexport async function wrapKey(key: Uint8Array, wrappingKey: Uint8Array): Promise<Uint8Array> {\n  return aeskw(wrappingKey).encrypt(key);\n}\n","import { HybridEncKey, PwdProtectedKey, EmailBody, EmailBodyEncrypted, RecipientWithPublicKey } from '../types';\nimport { encryptSymmetrically, decryptSymmetrically, genSymmetricKey } from '../symmetric-crypto';\nimport { encapsulateHybrid, decapsulateHybrid } from '../hybrid-crypto';\nimport { wrapKey, unwrapKey } from '../key-wrapper';\nimport { getKeyFromPassword, getKeyFromPasswordAndSalt } from '../derive-password';\nimport { UTF8ToUint8, base64ToUint8Array, uint8ArrayToBase64, uint8ToUTF8 } from '../utils';\n\n/**\n * Symmetrically encrypts email body.\n *\n * @param body - The email body to encrypt.\n * @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).\n * @returns The resulting encrypted email body and symmetric key used for encryption\n */\nexport async function encryptEmailBody(\n  body: EmailBody,\n  aux?: Uint8Array,\n): Promise<{\n  encEmailBody: EmailBodyEncrypted;\n  encryptionKey: Uint8Array;\n}> {\n  try {\n    if (!body.text || !body.subject) {\n      throw new Error('Invalid input');\n    }\n    const encryptionKey = genSymmetricKey();\n    const encEmailBody = await encryptEmailBodyWithKey(body, encryptionKey, aux);\n\n    return { encEmailBody, encryptionKey };\n  } catch (error) {\n    throw new Error('Failed to symmetrically encrypt email body', { cause: error });\n  }\n}\n\n/**\n * Symmetrically encrypts email body with the given key.\n *\n * @param body - The email body to encrypt.\n * @param encryptionKey - The symmetric key to encrypt the email.\n * @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).\n * @returns The resulting encrypted email body and symmetric key used for encryption\n */\nexport async function encryptEmailBodyWithKey(\n  body: EmailBody,\n  encryptionKey: Uint8Array,\n  aux?: Uint8Array,\n): Promise<EmailBodyEncrypted> {\n  try {\n    const text = UTF8ToUint8(body.text);\n    const subject = UTF8ToUint8(body.subject);\n    const subjectEnc = await encryptSymmetrically(encryptionKey, subject, aux);\n    const encryptedText = await encryptSymmetrically(encryptionKey, text, aux);\n    const encText = uint8ArrayToBase64(encryptedText);\n    const encSubject = uint8ArrayToBase64(subjectEnc);\n    const enc: EmailBodyEncrypted = { encText, encSubject };\n\n    if (body.attachments) {\n      const promises = body.attachments.map((attachment) => {\n        const binaryAttachment = UTF8ToUint8(attachment);\n        return encryptSymmetrically(encryptionKey, binaryAttachment, aux);\n      });\n      const encryptedAttachments = await Promise.all(promises);\n      enc.encAttachments = encryptedAttachments?.map(uint8ArrayToBase64);\n    }\n\n    return enc;\n  } catch (error) {\n    throw new Error('Failed to encrypt email body', { cause: error });\n  }\n}\n\n/**\n * Decrypts symmetrically encrypted email body.\n *\n * @param encEmailBody - The email body to decrypt.\n * @param encryptionKey - The symmetric key to decrypt the email.\n * @param aux - An optional auxilary sting for AEAD (e.g., email ID or timestamp).\n * @returns The resulting decrypted email body\n */\nexport async function decryptEmailBody(\n  encEmailBody: EmailBodyEncrypted,\n  encryptionKey: Uint8Array,\n  aux?: Uint8Array,\n): Promise<EmailBody> {\n  try {\n    const encSubject = base64ToUint8Array(encEmailBody.encSubject);\n    const subjectArray = await decryptSymmetrically(encryptionKey, encSubject, aux);\n    const subject = uint8ToUTF8(subjectArray);\n    const encText = base64ToUint8Array(encEmailBody.encText);\n    const textArray = await decryptSymmetrically(encryptionKey, encText, aux);\n    const text = uint8ToUTF8(textArray);\n    const body: EmailBody = { text, subject };\n\n    if (encEmailBody.encAttachments) {\n      const encAttachments = encEmailBody.encAttachments?.map(base64ToUint8Array);\n      const promises = encAttachments?.map((encAtt) => decryptSymmetrically(encryptionKey, encAtt, aux));\n      const decryptedAttachments = await Promise.all(promises);\n      body.attachments = decryptedAttachments?.map((att) => uint8ToUTF8(att));\n    }\n\n    return body;\n  } catch (error) {\n    throw new Error('Failed to symmetrically decrypt email body', { cause: error });\n  }\n}\n\n/**\n * Encrypts the email symmetric key using hybrid encryption.\n *\n * @param emailEncryptionKey - The symmetric key used for email encryption.\n * @param recipient - The recipient with a public hybrid key.\n * @returns The encrypted email symmetric key\n */\nexport async function encryptKeysHybrid(\n  emailEncryptionKey: Uint8Array,\n  recipient: RecipientWithPublicKey,\n): Promise<HybridEncKey> {\n  try {\n    const { cipherText, sharedSecret } = encapsulateHybrid(recipient.publicHybridKey);\n    const encryptedKey = await wrapKey(emailEncryptionKey, sharedSecret);\n    const encryptedKeyBase64 = uint8ArrayToBase64(encryptedKey);\n    const kyberCiphertextBase64 = uint8ArrayToBase64(cipherText);\n\n    return {\n      encryptedKey: encryptedKeyBase64,\n      hybridCiphertext: kyberCiphertextBase64,\n      encryptedForEmail: recipient.email,\n    };\n  } catch (error) {\n    throw new Error('Failed to encrypt email key using hybrid encryption', { cause: error });\n  }\n}\n\n/**\n * Decrypts the email symmetric key encrypted via hybrid encryption.\n *\n * @param encryptedKey - The encrypted email key.\n * @param recipientPrivateKey - The private key of the recipient.\n * @returns The email encryption key\n */\nexport async function decryptKeysHybrid(\n  encryptedKey: HybridEncKey,\n  recipientPrivateKey: Uint8Array,\n): Promise<Uint8Array> {\n  try {\n    const kyberCiphertext = base64ToUint8Array(encryptedKey.hybridCiphertext);\n    const encKey = base64ToUint8Array(encryptedKey.encryptedKey);\n    const sharedSecret = decapsulateHybrid(kyberCiphertext, recipientPrivateKey);\n    const encryptionKey = await unwrapKey(encKey, sharedSecret);\n    return encryptionKey;\n  } catch (error) {\n    throw new Error('Failed to decrypt email key encrypted via hybrid encryption', { cause: error });\n  }\n}\n\n/**\n * Password-protects the email symmetric key.\n *\n * @param emailEncryptionKey - The symmetric key used for email encryption.\n * @param password - The secret password for key protection.\n * @returns The password-protected email symmetric key\n */\nexport async function passwordProtectKey(emailEncryptionKey: Uint8Array, password: string): Promise<PwdProtectedKey> {\n  try {\n    const { key, salt } = await getKeyFromPassword(password);\n    const encryptedKey = await wrapKey(emailEncryptionKey, key);\n    const saltStr = uint8ArrayToBase64(salt);\n    const encryptedKeyStr = uint8ArrayToBase64(encryptedKey);\n    return { encryptedKey: encryptedKeyStr, salt: saltStr };\n  } catch (error) {\n    throw new Error('Failed to password-protect email key', { cause: error });\n  }\n}\n\n/**\n * Removes passoword-protection and exposes the email symmetric key.\n *\n * @param emailEncryptionKey -  The password-protected email key.\n * @param password - The secret password for key protection.\n * @returns The email encryption key\n */\nexport async function removePasswordProtection(\n  emailEncryptionKey: PwdProtectedKey,\n  password: string,\n): Promise<Uint8Array> {\n  try {\n    const salt = base64ToUint8Array(emailEncryptionKey.salt);\n    const encryptedKey = base64ToUint8Array(emailEncryptionKey.encryptedKey);\n    const key = await getKeyFromPasswordAndSalt(password, salt);\n    const encryptionKey = await unwrapKey(encryptedKey, key);\n    return encryptionKey;\n  } catch (error) {\n    throw new Error('Failed to remove password-protection from email key', { cause: error });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AASA,eAAsB,UAAU,cAA0B,aAA8C;AACtG,QAAO,MAAM,YAAY,CAAC,QAAQ,aAAa;;;;;;;;;AAUjD,eAAsB,QAAQ,KAAiB,aAA8C;AAC3F,QAAO,MAAM,YAAY,CAAC,QAAQ,IAAI;;;;;;;;;;;;ACPxC,eAAsB,iBACpB,MACA,KAIC;AACD,KAAI;AACF,MAAI,CAAC,KAAK,QAAQ,CAAC,KAAK,QACtB,OAAM,IAAI,MAAM,gBAAgB;EAElC,MAAM,gBAAgB,iBAAiB;AAGvC,SAAO;GAAE,cAFY,MAAM,wBAAwB,MAAM,eAAe,IAAI;GAErD;GAAe;UAC/B,OAAO;AACd,QAAM,IAAI,MAAM,8CAA8C,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;;AAYnF,eAAsB,wBACpB,MACA,eACA,KAC6B;AAC7B,KAAI;EACF,MAAM,OAAO,YAAY,KAAK,KAAK;EAEnC,MAAM,aAAa,MAAM,qBAAqB,eAD9B,YAAY,KAAK,QAAQ,EAC6B,IAAI;EAI1E,MAAM,MAA0B;GAAE,SAFlB,mBADM,MAAM,qBAAqB,eAAe,MAAM,IAAI,CACzB;GAEN,YADxB,mBAAmB,WAAW;GACM;AAEvD,MAAI,KAAK,aAAa;GACpB,MAAM,WAAW,KAAK,YAAY,KAAK,eAAe;AAEpD,WAAO,qBAAqB,eADH,YAAY,WAAW,EACa,IAAI;KACjE;AAEF,OAAI,kBADyB,MAAM,QAAQ,IAAI,SAAS,GACb,IAAI,mBAAmB;;AAGpE,SAAO;UACA,OAAO;AACd,QAAM,IAAI,MAAM,gCAAgC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;;AAYrE,eAAsB,iBACpB,cACA,eACA,KACoB;AACpB,KAAI;EAGF,MAAM,UAAU,YADK,MAAM,qBAAqB,eAD7B,mBAAmB,aAAa,WAAW,EACa,IAAI,CACtC;EAIzC,MAAM,OAAkB;GAAE,MADb,YADK,MAAM,qBAAqB,eAD7B,mBAAmB,aAAa,QAAQ,EACa,IAAI,CACtC;GACH;GAAS;AAEzC,MAAI,aAAa,gBAAgB;GAE/B,MAAM,YADiB,aAAa,gBAAgB,IAAI,mBAAmB,GAC1C,KAAK,WAAW,qBAAqB,eAAe,QAAQ,IAAI,CAAC;AAElG,QAAK,eADwB,MAAM,QAAQ,IAAI,SAAS,GACf,KAAK,QAAQ,YAAY,IAAI,CAAC;;AAGzE,SAAO;UACA,OAAO;AACd,QAAM,IAAI,MAAM,8CAA8C,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;AAWnF,eAAsB,kBACpB,oBACA,WACuB;AACvB,KAAI;EACF,MAAM,EAAE,YAAY,iBAAiB,kBAAkB,UAAU,gBAAgB;AAKjF,SAAO;GACL,cAJyB,mBADN,MAAM,QAAQ,oBAAoB,aAAa,CACT;GAKzD,kBAJ4B,mBAAmB,WAAW;GAK1D,mBAAmB,UAAU;GAC9B;UACM,OAAO;AACd,QAAM,IAAI,MAAM,uDAAuD,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;AAW5F,eAAsB,kBACpB,cACA,qBACqB;AACrB,KAAI;EACF,MAAM,kBAAkB,mBAAmB,aAAa,iBAAiB;AAIzE,SADsB,MAAM,UAFb,mBAAmB,aAAa,aAAa,EACvC,kBAAkB,iBAAiB,oBAAoB,CACjB;UAEpD,OAAO;AACd,QAAM,IAAI,MAAM,+DAA+D,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;AAWpG,eAAsB,mBAAmB,oBAAgC,UAA4C;AACnH,KAAI;EACF,MAAM,EAAE,KAAK,SAAS,MAAM,mBAAmB,SAAS;EACxD,MAAM,eAAe,MAAM,QAAQ,oBAAoB,IAAI;EAC3D,MAAM,UAAU,mBAAmB,KAAK;AAExC,SAAO;GAAE,cADe,mBAAmB,aAAa;GAChB,MAAM;GAAS;UAChD,OAAO;AACd,QAAM,IAAI,MAAM,wCAAwC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;AAW7E,eAAsB,yBACpB,oBACA,UACqB;AACrB,KAAI;EACF,MAAM,OAAO,mBAAmB,mBAAmB,KAAK;AAIxD,SADsB,MAAM,UAFP,mBAAmB,mBAAmB,aAAa,EAC5D,MAAM,0BAA0B,UAAU,KAAK,CACH;UAEjD,OAAO;AACd,QAAM,IAAI,MAAM,uDAAuD,EAAE,OAAO,OAAO,CAAC"}

package/dist/derive-key.d.mts

@@ -8,15 +8,6 @@
  * @returns The derived secret key
  */
 declare function deriveSymmetricKeyFromContext(context: string, baseKey: Uint8Array): Uint8Array;
-/**
- * Derives a symmetric CryptoKey from the base key and context string
- *
- * @param context - The context string.
- * The context string should be hardcoded, globally unique, and application-specific.
- * @param baseKey - The base key (NOT PASSWORD!)
- * @returns The derived secret CryptoKey
- */
-declare function deriveSymmetricCryptoKeyFromContext(context: string, baseKey: Uint8Array): Promise<CryptoKey>;
 /**
  * Derives a symmetric key from two keys
  *
@@ -25,70 +16,6 @@ declare function deriveSymmetricCryptoKeyFromContext(context: string, baseKey: U
  * @returns The derived secret key
  */
 declare function deriveSymmetricKeyFromTwoKeys(key1: Uint8Array, key2: Uint8Array): Uint8Array;
-/**
- * Derives a symmetric CryptoKey from two keys
- *
- * @param key1 - The 32-bytes key
- * @param key2 - The 32-bytes key
- * @returns The derived secret CryptoKey
- */
-declare function deriveSymmetricCryptoKeyFromTwoKeys(key1: Uint8Array, key2: Uint8Array): Promise<CryptoKey>;
-/**
- * Derives a symmetric key from two keys and context
- *
- * @param key1 - The 32-bytes key
- * @param key2 - The 32-bytes key
- * @param context - The context string
- * @returns The derived symmetric key
- */
-declare function deriveSymmetricKeyFromTwoKeysAndContext(key1: Uint8Array, key2: Uint8Array, context: string): Uint8Array;
-//#endregion
-//#region src/derive-key/deriveKeysFromPassword.d.ts
-/**
- * Derives a symmetric key from a user's password with a randomly sampled salt
- *
- * @param password - The user's password
- * @returns The derived secret key and randomly sampled salt
- */
-declare function getKeyFromPassword(password: string): Promise<{
-  key: Uint8Array;
-  salt: Uint8Array;
-}>;
-/**
- * Derives a symmetric key from a user's password and salt
- *
- * @param password - The user's password
- * @param salt - The given salt
- * @returns The derived secret key
- */
-declare function getKeyFromPasswordAndSalt(password: string, salt: Uint8Array): Promise<Uint8Array>;
-/**
- * Derives a HEX symmetric key from a user's password with a randomly sampled salt
- *
- * @param password - The user's password
- * @returns The derived HEX secret key and randomly sampled HEX salt
- */
-declare function getKeyFromPasswordHex(password: string): Promise<{
-  keyHex: string;
-  saltHex: string;
-}>;
-/**
- * Derives a HEX symmetric key from a user's password and salt
- *
- * @param password - The user's password
- * @param saltHex - The given HEX salt
- * @returns The derived HEX secret key
- */
-declare function getKeyFromPasswordAndSaltHex(password: string, saltHex: string): Promise<string>;
-/**
- * Verifies the derived key
- *
- * @param password - The user's password
- * @param saltHex - The given HEX salt
- * @param keyHex - The derived HEX key
- * @returns The result of the key verification
- */
-declare function verifyKeyFromPasswordHex(password: string, saltHex: string, keyHex: string): Promise<boolean>;
 //#endregion
-export { deriveSymmetricCryptoKeyFromContext, deriveSymmetricCryptoKeyFromTwoKeys, deriveSymmetricKeyFromContext, deriveSymmetricKeyFromTwoKeys, deriveSymmetricKeyFromTwoKeysAndContext, getKeyFromPassword, getKeyFromPasswordAndSalt, getKeyFromPasswordAndSaltHex, getKeyFromPasswordHex, verifyKeyFromPasswordHex };
+export { deriveSymmetricKeyFromContext, deriveSymmetricKeyFromTwoKeys };
 //# sourceMappingURL=derive-key.d.mts.map

package/dist/derive-key.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"derive-key.d.mts","names":[],"sources":["../src/derive-key/deriveKeysFromKey.ts","../src/derive-key/deriveKeysFromPassword.ts"],"mappings":";;AAaA;;;;;;;iBAAgB,6BAAA,CAA8B,OAAA,UAAiB,OAAA,EAAS,UAAA,GAAa,UAAA;;;AAYrF;;;;;;iBAAsB,mCAAA,CAAoC,OAAA,UAAiB,OAAA,EAAS,UAAA,GAAa,OAAA,CAAQ,SAAA;;;;;;;;iBAwBzF,6BAAA,CAA8B,IAAA,EAAM,UAAA,EAAY,IAAA,EAAM,UAAA,GAAa,UAAA;AAAnF;;;;;;;AAAA,iBAWsB,mCAAA,CAAoC,IAAA,EAAM,UAAA,EAAY,IAAA,EAAM,UAAA,GAAa,OAAA,CAAQ,SAAA;;;;;;;;AAAvG;iBAkBgB,uCAAA,CACd,IAAA,EAAM,UAAA,EACN,IAAA,EAAM,UAAA,EACN,OAAA,WACC,UAAA;;;;AArEH;;;;;iBCJsB,kBAAA,CAAmB,QAAA,WAAmB,OAAA;EAAU,GAAA,EAAK,UAAA;EAAY,IAAA,EAAM,UAAA;AAAA;;ADgB7F;;;;;;iBCIsB,yBAAA,CAA0B,QAAA,UAAkB,IAAA,EAAM,UAAA,GAAa,OAAA,CAAQ,UAAA;;;;;;;iBAoBvE,qBAAA,CAAsB,QAAA,WAAmB,OAAA;EAAU,MAAA;EAAgB,OAAA;AAAA;;;;;;;;iBAgBnE,4BAAA,CAA6B,QAAA,UAAkB,OAAA,WAAkB,OAAA;;;;;;ADLvF;;;iBCuBsB,wBAAA,CAAyB,QAAA,UAAkB,OAAA,UAAiB,MAAA,WAAiB,OAAA"}
+{"version":3,"file":"derive-key.d.mts","names":[],"sources":["../src/derive-key/deriveKeysFromKey.ts"],"mappings":";;AAYA;;;;;;;iBAAgB,6BAAA,CAA8B,OAAA,UAAiB,OAAA,EAAS,UAAA,GAAa,UAAA;;;AAWrF;;;;;iBAAgB,6BAAA,CAA8B,IAAA,EAAM,UAAA,EAAY,IAAA,EAAM,UAAA,GAAa,UAAA"}