internxt-crypto 1.0.1 → 1.1.0

package/README.md

@@ -153,7 +153,7 @@ const userID = 'user ID';
 const db = await openDatabase(userID);
 
 // Derive database key
-const key = await deriveIndexKey(baseKey);
+const key = await deriveDatabaseKey(baseKey);
 
 // Encrypt and store one or several emails
 await encryptAndStoreEmail(email, key, db);

package/dist/derive-key.d.mts

@@ -16,6 +16,13 @@ declare function deriveSymmetricKeyFromContext(context: string, baseKey: Uint8Ar
  * @returns The derived secret key
  */
 declare function deriveSymmetricKeyFromTwoKeys(key1: Uint8Array, key2: Uint8Array): Uint8Array;
+/**
+ * Derives database encryption key for the given user
+ *
+ * @param baseKey - The base key (NOT PASSWORD!)
+ * @returns The symmetric key for protecting database
+ */
+declare const deriveDatabaseKey: (baseKey: Uint8Array) => Promise<Uint8Array>;
 //#endregion
-export { deriveSymmetricKeyFromContext, deriveSymmetricKeyFromTwoKeys };
+export { deriveDatabaseKey, deriveSymmetricKeyFromContext, deriveSymmetricKeyFromTwoKeys };
 //# sourceMappingURL=derive-key.d.mts.map

package/dist/derive-key.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"derive-key.d.mts","names":[],"sources":["../src/derive-key/deriveKeysFromKey.ts"],"mappings":";;AAYA;;;;;;;iBAAgB,6BAAA,CAA8B,OAAA,UAAiB,OAAA,EAAS,UAAA,GAAa,UAAA;;;AAWrF;;;;;iBAAgB,6BAAA,CAA8B,IAAA,EAAM,UAAA,EAAY,IAAA,EAAM,UAAA,GAAa,UAAA"}
+{"version":3,"file":"derive-key.d.mts","names":[],"sources":["../src/derive-key/deriveKeysFromKey.ts"],"mappings":";;AAYA;;;;;;;iBAAgB,6BAAA,CAA8B,OAAA,UAAiB,OAAA,EAAS,UAAA,GAAa,UAAA;;;AAWrF;;;;;iBAAgB,6BAAA,CAA8B,IAAA,EAAM,UAAA,EAAY,IAAA,EAAM,UAAA,GAAa,UAAA;;;;;;;cAkBtE,iBAAA,GAA2B,OAAA,EAAS,UAAA,KAAa,OAAA,CAAQ,UAAA"}

package/dist/derive-key.d.ts

@@ -16,6 +16,13 @@ declare function deriveSymmetricKeyFromContext(context: string, baseKey: Uint8Ar
  * @returns The derived secret key
  */
 declare function deriveSymmetricKeyFromTwoKeys(key1: Uint8Array, key2: Uint8Array): Uint8Array;
+/**
+ * Derives database encryption key for the given user
+ *
+ * @param baseKey - The base key (NOT PASSWORD!)
+ * @returns The symmetric key for protecting database
+ */
+declare const deriveDatabaseKey: (baseKey: Uint8Array) => Promise<Uint8Array>;
 //#endregion
-export { deriveSymmetricKeyFromContext, deriveSymmetricKeyFromTwoKeys };
+export { deriveDatabaseKey, deriveSymmetricKeyFromContext, deriveSymmetricKeyFromTwoKeys };
 //# sourceMappingURL=derive-key.d.ts.map

package/dist/derive-key.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"derive-key.d.ts","names":[],"sources":["../src/derive-key/deriveKeysFromKey.ts"],"mappings":";;AAYA;;;;;;;iBAAgB,6BAAA,CAA8B,OAAA,UAAiB,OAAA,EAAS,UAAA,GAAa,UAAA;;;AAWrF;;;;;iBAAgB,6BAAA,CAA8B,IAAA,EAAM,UAAA,EAAY,IAAA,EAAM,UAAA,GAAa,UAAA"}
+{"version":3,"file":"derive-key.d.ts","names":[],"sources":["../src/derive-key/deriveKeysFromKey.ts"],"mappings":";;AAYA;;;;;;;iBAAgB,6BAAA,CAA8B,OAAA,UAAiB,OAAA,EAAS,UAAA,GAAa,UAAA;;;AAWrF;;;;;iBAAgB,6BAAA,CAA8B,IAAA,EAAM,UAAA,EAAY,IAAA,EAAM,UAAA,GAAa,UAAA;;;;;;;cAkBtE,iBAAA,GAA2B,OAAA,EAAS,UAAA,KAAa,OAAA,CAAQ,UAAA"}

package/dist/derive-key.js

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_deriveKeysFromKey = require('./deriveKeysFromKey-C4McqO6_.js');
+const require_deriveKeysFromKey = require('./deriveKeysFromKey-GTRMuxDj.js');
 
+exports.deriveDatabaseKey = require_deriveKeysFromKey.deriveDatabaseKey;
 exports.deriveSymmetricKeyFromContext = require_deriveKeysFromKey.deriveSymmetricKeyFromContext;
 exports.deriveSymmetricKeyFromTwoKeys = require_deriveKeysFromKey.deriveSymmetricKeyFromTwoKeys;

package/dist/derive-key.mjs

@@ -1,3 +1,3 @@
-import { n as deriveSymmetricKeyFromTwoKeys, t as deriveSymmetricKeyFromContext } from "./deriveKeysFromKey-DPU_h7wr.mjs";
+import { n as deriveSymmetricKeyFromContext, r as deriveSymmetricKeyFromTwoKeys, t as deriveDatabaseKey } from "./deriveKeysFromKey-CseBjg0n.mjs";
 
-export { deriveSymmetricKeyFromContext, deriveSymmetricKeyFromTwoKeys };
+export { deriveDatabaseKey, deriveSymmetricKeyFromContext, deriveSymmetricKeyFromTwoKeys };

package/dist/{deriveKeysFromKey-DPU_h7wr.mjs → deriveKeysFromKey-CseBjg0n.mjs}

@@ -1,4 +1,4 @@
-import { AES_KEY_BYTE_LENGTH, CONTEXT_DERIVE } from "./constants.mjs";
+import { AES_KEY_BYTE_LENGTH, CONTEXT_DERIVE, CONTEXT_INDEX } from "./constants.mjs";
 import { s as UTF8ToUint8 } from "./genID-D08K7JPr.mjs";
 import { blake3 } from "@noble/hashes/blake3.js";
 
@@ -29,7 +29,16 @@ function deriveSymmetricKeyFromTwoKeys(key1, key2) {
 		throw new Error("Failed to derive symmetric key from two keys and context", { cause: error });
 	}
 }
+/**
+* Derives database encryption key for the given user
+*
+* @param baseKey - The base key (NOT PASSWORD!)
+* @returns The symmetric key for protecting database
+*/
+const deriveDatabaseKey = async (baseKey) => {
+	return deriveSymmetricKeyFromContext(CONTEXT_INDEX, baseKey);
+};
 
 //#endregion
-export { deriveSymmetricKeyFromTwoKeys as n, deriveSymmetricKeyFromContext as t };
-//# sourceMappingURL=deriveKeysFromKey-DPU_h7wr.mjs.map
+export { deriveSymmetricKeyFromContext as n, deriveSymmetricKeyFromTwoKeys as r, deriveDatabaseKey as t };
+//# sourceMappingURL=deriveKeysFromKey-CseBjg0n.mjs.map

package/dist/deriveKeysFromKey-CseBjg0n.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"deriveKeysFromKey-CseBjg0n.mjs","names":[],"sources":["../src/derive-key/deriveKeysFromKey.ts"],"sourcesContent":["import { blake3 } from '@noble/hashes/blake3.js';\nimport { AES_KEY_BYTE_LENGTH, CONTEXT_DERIVE, CONTEXT_INDEX } from '../constants';\nimport { UTF8ToUint8 } from '../utils';\n\n/**\n * Derives a symmetric key from the base key and context string\n *\n * @param context - The context string.\n * The context string should be hardcoded, globally unique, and application-specific.\n * @param baseKey - The base key (NOT PASSWORD!)\n * @returns The derived secret key\n */\nexport function deriveSymmetricKeyFromContext(context: string, baseKey: Uint8Array): Uint8Array {\n  return blake3(baseKey, { context: UTF8ToUint8(context) });\n}\n\n/**\n * Derives a symmetric key from two keys\n *\n * @param key1 - The 32-bytes key\n * @param key2 - The 32-bytes key\n * @returns The derived secret key\n */\nexport function deriveSymmetricKeyFromTwoKeys(key1: Uint8Array, key2: Uint8Array): Uint8Array {\n  try {\n    if (key2.length != AES_KEY_BYTE_LENGTH || key1.length != AES_KEY_BYTE_LENGTH) {\n      throw new Error(`Input key length must be exactly ${AES_KEY_BYTE_LENGTH} bytes`);\n    }\n    const key = blake3(key1, { key: key2 });\n    return deriveSymmetricKeyFromContext(CONTEXT_DERIVE, key);\n  } catch (error) {\n    throw new Error('Failed to derive symmetric key from two keys and context', { cause: error });\n  }\n}\n\n/**\n * Derives database encryption key for the given user\n *\n * @param baseKey - The base key (NOT PASSWORD!)\n * @returns The symmetric key for protecting database\n */\nexport const deriveDatabaseKey = async (baseKey: Uint8Array): Promise<Uint8Array> => {\n  return deriveSymmetricKeyFromContext(CONTEXT_INDEX, baseKey);\n};\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAgB,8BAA8B,SAAiB,SAAiC;AAC9F,QAAO,OAAO,SAAS,EAAE,SAAS,YAAY,QAAQ,EAAE,CAAC;;;;;;;;;AAU3D,SAAgB,8BAA8B,MAAkB,MAA8B;AAC5F,KAAI;AACF,MAAI,KAAK,UAAU,uBAAuB,KAAK,UAAU,oBACvD,OAAM,IAAI,MAAM,oCAAoC,oBAAoB,QAAQ;AAGlF,SAAO,8BAA8B,gBADzB,OAAO,MAAM,EAAE,KAAK,MAAM,CAAC,CACkB;UAClD,OAAO;AACd,QAAM,IAAI,MAAM,4DAA4D,EAAE,OAAO,OAAO,CAAC;;;;;;;;;AAUjG,MAAa,oBAAoB,OAAO,YAA6C;AACnF,QAAO,8BAA8B,eAAe,QAAQ"}

package/dist/{deriveKeysFromKey-C4McqO6_.js → deriveKeysFromKey-GTRMuxDj.js}

@@ -30,8 +30,23 @@ function deriveSymmetricKeyFromTwoKeys(key1, key2) {
 		throw new Error("Failed to derive symmetric key from two keys and context", { cause: error });
 	}
 }
+/**
+* Derives database encryption key for the given user
+*
+* @param baseKey - The base key (NOT PASSWORD!)
+* @returns The symmetric key for protecting database
+*/
+const deriveDatabaseKey = async (baseKey) => {
+	return deriveSymmetricKeyFromContext(require_constants.CONTEXT_INDEX, baseKey);
+};
 
 //#endregion
+Object.defineProperty(exports, 'deriveDatabaseKey', {
+  enumerable: true,
+  get: function () {
+    return deriveDatabaseKey;
+  }
+});
 Object.defineProperty(exports, 'deriveSymmetricKeyFromContext', {
   enumerable: true,
   get: function () {
@@ -44,4 +59,4 @@ Object.defineProperty(exports, 'deriveSymmetricKeyFromTwoKeys', {
     return deriveSymmetricKeyFromTwoKeys;
   }
 });
-//# sourceMappingURL=deriveKeysFromKey-C4McqO6_.js.map
+//# sourceMappingURL=deriveKeysFromKey-GTRMuxDj.js.map

package/dist/deriveKeysFromKey-GTRMuxDj.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deriveKeysFromKey-GTRMuxDj.js","names":["UTF8ToUint8","AES_KEY_BYTE_LENGTH","CONTEXT_DERIVE","CONTEXT_INDEX"],"sources":["../src/derive-key/deriveKeysFromKey.ts"],"sourcesContent":["import { blake3 } from '@noble/hashes/blake3.js';\nimport { AES_KEY_BYTE_LENGTH, CONTEXT_DERIVE, CONTEXT_INDEX } from '../constants';\nimport { UTF8ToUint8 } from '../utils';\n\n/**\n * Derives a symmetric key from the base key and context string\n *\n * @param context - The context string.\n * The context string should be hardcoded, globally unique, and application-specific.\n * @param baseKey - The base key (NOT PASSWORD!)\n * @returns The derived secret key\n */\nexport function deriveSymmetricKeyFromContext(context: string, baseKey: Uint8Array): Uint8Array {\n  return blake3(baseKey, { context: UTF8ToUint8(context) });\n}\n\n/**\n * Derives a symmetric key from two keys\n *\n * @param key1 - The 32-bytes key\n * @param key2 - The 32-bytes key\n * @returns The derived secret key\n */\nexport function deriveSymmetricKeyFromTwoKeys(key1: Uint8Array, key2: Uint8Array): Uint8Array {\n  try {\n    if (key2.length != AES_KEY_BYTE_LENGTH || key1.length != AES_KEY_BYTE_LENGTH) {\n      throw new Error(`Input key length must be exactly ${AES_KEY_BYTE_LENGTH} bytes`);\n    }\n    const key = blake3(key1, { key: key2 });\n    return deriveSymmetricKeyFromContext(CONTEXT_DERIVE, key);\n  } catch (error) {\n    throw new Error('Failed to derive symmetric key from two keys and context', { cause: error });\n  }\n}\n\n/**\n * Derives database encryption key for the given user\n *\n * @param baseKey - The base key (NOT PASSWORD!)\n * @returns The symmetric key for protecting database\n */\nexport const deriveDatabaseKey = async (baseKey: Uint8Array): Promise<Uint8Array> => {\n  return deriveSymmetricKeyFromContext(CONTEXT_INDEX, baseKey);\n};\n"],"mappings":";;;;;;;;;;;;;;AAYA,SAAgB,8BAA8B,SAAiB,SAAiC;AAC9F,4CAAc,SAAS,EAAE,SAASA,0BAAY,QAAQ,EAAE,CAAC;;;;;;;;;AAU3D,SAAgB,8BAA8B,MAAkB,MAA8B;AAC5F,KAAI;AACF,MAAI,KAAK,UAAUC,yCAAuB,KAAK,UAAUA,sCACvD,OAAM,IAAI,MAAM,oCAAoCA,sCAAoB,QAAQ;AAGlF,SAAO,8BAA8BC,sEADlB,MAAM,EAAE,KAAK,MAAM,CAAC,CACkB;UAClD,OAAO;AACd,QAAM,IAAI,MAAM,4DAA4D,EAAE,OAAO,OAAO,CAAC;;;;;;;;;AAUjG,MAAa,oBAAoB,OAAO,YAA6C;AACnF,QAAO,8BAA8BC,iCAAe,QAAQ"}

package/dist/email-crypto.d.mts

@@ -1,4 +1,4 @@
-import { EmailBody, HybridEncryptedEmail, HybridKeyPair, PwdProtectedEmail, RecipientWithPublicKey } from "./types.mjs";
+import { EmailBody, EmailBodyEncrypted, HybridEncKey, HybridEncryptedEmail, HybridKeyPair, PwdProtectedEmail, PwdProtectedKey, RecipientWithPublicKey } from "./types.mjs";
 
 //#region src/email-crypto/hybridEncyptedEmail.d.ts
 /**
@@ -57,5 +57,68 @@ declare function decryptPwdProtectedEmail(encryptedEmail: PwdProtectedEmail, pas
  */
 declare function generateEmailKeys(): Promise<HybridKeyPair>;
 //#endregion
-export { createPwdProtectedEmail, decryptEmailHybrid, decryptPwdProtectedEmail, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, generateEmailKeys };
+//#region src/email-crypto/core.d.ts
+/**
+ * Symmetrically encrypts email body.
+ *
+ * @param body - The email body to encrypt.
+ * @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).
+ * @returns The resulting encrypted email body and symmetric key used for encryption
+ */
+declare function encryptEmailBody(body: EmailBody, aux?: Uint8Array): Promise<{
+  encEmailBody: EmailBodyEncrypted;
+  encryptionKey: Uint8Array;
+}>;
+/**
+ * Symmetrically encrypts email body with the given key.
+ *
+ * @param body - The email body to encrypt.
+ * @param encryptionKey - The symmetric key to encrypt the email.
+ * @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).
+ * @returns The resulting encrypted email body and symmetric key used for encryption
+ */
+declare function encryptEmailBodyWithKey(body: EmailBody, encryptionKey: Uint8Array, aux?: Uint8Array): Promise<EmailBodyEncrypted>;
+/**
+ * Decrypts symmetrically encrypted email body.
+ *
+ * @param encEmailBody - The email body to decrypt.
+ * @param encryptionKey - The symmetric key to decrypt the email.
+ * @param aux - An optional auxilary sting for AEAD (e.g., email ID or timestamp).
+ * @returns The resulting decrypted email body
+ */
+declare function decryptEmailBody(encEmailBody: EmailBodyEncrypted, encryptionKey: Uint8Array, aux?: Uint8Array): Promise<EmailBody>;
+/**
+ * Encrypts the email symmetric key using hybrid encryption.
+ *
+ * @param emailEncryptionKey - The symmetric key used for email encryption.
+ * @param recipient - The recipient with a public hybrid key.
+ * @returns The encrypted email symmetric key
+ */
+declare function encryptKeysHybrid(emailEncryptionKey: Uint8Array, recipient: RecipientWithPublicKey): Promise<HybridEncKey>;
+/**
+ * Decrypts the email symmetric key encrypted via hybrid encryption.
+ *
+ * @param encryptedKey - The encrypted email key.
+ * @param recipientPrivateKey - The private key of the recipient.
+ * @returns The email encryption key
+ */
+declare function decryptKeysHybrid(encryptedKey: HybridEncKey, recipientPrivateKey: Uint8Array): Promise<Uint8Array>;
+/**
+ * Password-protects the email symmetric key.
+ *
+ * @param emailEncryptionKey - The symmetric key used for email encryption.
+ * @param password - The secret password for key protection.
+ * @returns The password-protected email symmetric key
+ */
+declare function passwordProtectKey(emailEncryptionKey: Uint8Array, password: string): Promise<PwdProtectedKey>;
+/**
+ * Removes passoword-protection and exposes the email symmetric key.
+ *
+ * @param emailEncryptionKey -  The password-protected email key.
+ * @param password - The secret password for key protection.
+ * @returns The email encryption key
+ */
+declare function removePasswordProtection(emailEncryptionKey: PwdProtectedKey, password: string): Promise<Uint8Array>;
+//#endregion
+export { createPwdProtectedEmail, decryptEmailBody, decryptEmailHybrid, decryptKeysHybrid, decryptPwdProtectedEmail, encryptEmailBody, encryptEmailBodyWithKey, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, encryptKeysHybrid, generateEmailKeys, passwordProtectKey, removePasswordProtection };
 //# sourceMappingURL=email-crypto.d.mts.map

package/dist/email-crypto.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"email-crypto.d.mts","names":[],"sources":["../src/email-crypto/hybridEncyptedEmail.ts","../src/email-crypto/pwdProtectedEmail.ts","../src/email-crypto/emailKeys.ts"],"mappings":";;;;;AAWA;;;;;;iBAAsB,kBAAA,CACpB,IAAA,EAAM,SAAA,EACN,SAAA,EAAW,sBAAA,EACX,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,oBAAA;;;;;;;;;iBAkBW,uCAAA,CACpB,IAAA,EAAM,SAAA,EACN,UAAA,EAAY,sBAAA,IACZ,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,oBAAA;;;;;AAJX;;;;iBA8BsB,kBAAA,CACpB,YAAA,EAAc,oBAAA,EACd,0BAAA,EAA4B,UAAA,EAC5B,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;AAxDX;;;;;;iBCAsB,uBAAA,CACpB,SAAA,EAAW,SAAA,EACX,QAAA,UACA,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,iBAAA;;;;;;;;;iBAmBW,wBAAA,CACpB,cAAA,EAAgB,iBAAA,EAChB,QAAA,UACA,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;AD3BX;;;iBEHsB,iBAAA,CAAA,GAAqB,OAAA,CAAQ,aAAA"}
+{"version":3,"file":"email-crypto.d.mts","names":[],"sources":["../src/email-crypto/hybridEncyptedEmail.ts","../src/email-crypto/pwdProtectedEmail.ts","../src/email-crypto/emailKeys.ts","../src/email-crypto/core.ts"],"mappings":";;;;;AAWA;;;;;;iBAAsB,kBAAA,CACpB,IAAA,EAAM,SAAA,EACN,SAAA,EAAW,sBAAA,EACX,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,oBAAA;;;;;;;;;iBAkBW,uCAAA,CACpB,IAAA,EAAM,SAAA,EACN,UAAA,EAAY,sBAAA,IACZ,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,oBAAA;;;;;AAJX;;;;iBA8BsB,kBAAA,CACpB,YAAA,EAAc,oBAAA,EACd,0BAAA,EAA4B,UAAA,EAC5B,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;AAxDX;;;;;;iBCAsB,uBAAA,CACpB,SAAA,EAAW,SAAA,EACX,QAAA,UACA,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,iBAAA;;;;;;;;;iBAmBW,wBAAA,CACpB,cAAA,EAAgB,iBAAA,EAChB,QAAA,UACA,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;AD3BX;;;iBEHsB,iBAAA,CAAA,GAAqB,OAAA,CAAQ,aAAA;;;;;AFGnD;;;;;iBGGsB,gBAAA,CACpB,IAAA,EAAM,SAAA,EACN,GAAA,GAAM,UAAA,GACL,OAAA;EACD,YAAA,EAAc,kBAAA;EACd,aAAA,EAAe,UAAA;AAAA;;;;;;;;;iBAuBK,uBAAA,CACpB,IAAA,EAAM,SAAA,EACN,aAAA,EAAe,UAAA,EACf,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,kBAAA;;;AHbX;;;;;;iBG8CsB,gBAAA,CACpB,YAAA,EAAc,kBAAA,EACd,aAAA,EAAe,UAAA,EACf,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;;;;iBA8BW,iBAAA,CACpB,kBAAA,EAAoB,UAAA,EACpB,SAAA,EAAW,sBAAA,GACV,OAAA,CAAQ,YAAA;;;;;;AHrDX;;iBG6EsB,iBAAA,CACpB,YAAA,EAAc,YAAA,EACd,mBAAA,EAAqB,UAAA,GACpB,OAAA,CAAQ,UAAA;;;;;;;;iBAmBW,kBAAA,CAAmB,kBAAA,EAAoB,UAAA,EAAY,QAAA,WAAmB,OAAA,CAAQ,eAAA;;;;;;;;iBAmB9E,wBAAA,CACpB,kBAAA,EAAoB,eAAA,EACpB,QAAA,WACC,OAAA,CAAQ,UAAA"}

package/dist/email-crypto.d.ts

@@ -1,4 +1,4 @@
-import { EmailBody, HybridEncryptedEmail, HybridKeyPair, PwdProtectedEmail, RecipientWithPublicKey } from "./types.js";
+import { EmailBody, EmailBodyEncrypted, HybridEncKey, HybridEncryptedEmail, HybridKeyPair, PwdProtectedEmail, PwdProtectedKey, RecipientWithPublicKey } from "./types.js";
 
 //#region src/email-crypto/hybridEncyptedEmail.d.ts
 /**
@@ -57,5 +57,68 @@ declare function decryptPwdProtectedEmail(encryptedEmail: PwdProtectedEmail, pas
  */
 declare function generateEmailKeys(): Promise<HybridKeyPair>;
 //#endregion
-export { createPwdProtectedEmail, decryptEmailHybrid, decryptPwdProtectedEmail, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, generateEmailKeys };
+//#region src/email-crypto/core.d.ts
+/**
+ * Symmetrically encrypts email body.
+ *
+ * @param body - The email body to encrypt.
+ * @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).
+ * @returns The resulting encrypted email body and symmetric key used for encryption
+ */
+declare function encryptEmailBody(body: EmailBody, aux?: Uint8Array): Promise<{
+  encEmailBody: EmailBodyEncrypted;
+  encryptionKey: Uint8Array;
+}>;
+/**
+ * Symmetrically encrypts email body with the given key.
+ *
+ * @param body - The email body to encrypt.
+ * @param encryptionKey - The symmetric key to encrypt the email.
+ * @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).
+ * @returns The resulting encrypted email body and symmetric key used for encryption
+ */
+declare function encryptEmailBodyWithKey(body: EmailBody, encryptionKey: Uint8Array, aux?: Uint8Array): Promise<EmailBodyEncrypted>;
+/**
+ * Decrypts symmetrically encrypted email body.
+ *
+ * @param encEmailBody - The email body to decrypt.
+ * @param encryptionKey - The symmetric key to decrypt the email.
+ * @param aux - An optional auxilary sting for AEAD (e.g., email ID or timestamp).
+ * @returns The resulting decrypted email body
+ */
+declare function decryptEmailBody(encEmailBody: EmailBodyEncrypted, encryptionKey: Uint8Array, aux?: Uint8Array): Promise<EmailBody>;
+/**
+ * Encrypts the email symmetric key using hybrid encryption.
+ *
+ * @param emailEncryptionKey - The symmetric key used for email encryption.
+ * @param recipient - The recipient with a public hybrid key.
+ * @returns The encrypted email symmetric key
+ */
+declare function encryptKeysHybrid(emailEncryptionKey: Uint8Array, recipient: RecipientWithPublicKey): Promise<HybridEncKey>;
+/**
+ * Decrypts the email symmetric key encrypted via hybrid encryption.
+ *
+ * @param encryptedKey - The encrypted email key.
+ * @param recipientPrivateKey - The private key of the recipient.
+ * @returns The email encryption key
+ */
+declare function decryptKeysHybrid(encryptedKey: HybridEncKey, recipientPrivateKey: Uint8Array): Promise<Uint8Array>;
+/**
+ * Password-protects the email symmetric key.
+ *
+ * @param emailEncryptionKey - The symmetric key used for email encryption.
+ * @param password - The secret password for key protection.
+ * @returns The password-protected email symmetric key
+ */
+declare function passwordProtectKey(emailEncryptionKey: Uint8Array, password: string): Promise<PwdProtectedKey>;
+/**
+ * Removes passoword-protection and exposes the email symmetric key.
+ *
+ * @param emailEncryptionKey -  The password-protected email key.
+ * @param password - The secret password for key protection.
+ * @returns The email encryption key
+ */
+declare function removePasswordProtection(emailEncryptionKey: PwdProtectedKey, password: string): Promise<Uint8Array>;
+//#endregion
+export { createPwdProtectedEmail, decryptEmailBody, decryptEmailHybrid, decryptKeysHybrid, decryptPwdProtectedEmail, encryptEmailBody, encryptEmailBodyWithKey, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, encryptKeysHybrid, generateEmailKeys, passwordProtectKey, removePasswordProtection };
 //# sourceMappingURL=email-crypto.d.ts.map

package/dist/email-crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-crypto.d.ts","names":[],"sources":["../src/email-crypto/hybridEncyptedEmail.ts","../src/email-crypto/pwdProtectedEmail.ts","../src/email-crypto/emailKeys.ts"],"mappings":";;;;;AAWA;;;;;;iBAAsB,kBAAA,CACpB,IAAA,EAAM,SAAA,EACN,SAAA,EAAW,sBAAA,EACX,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,oBAAA;;;;;;;;;iBAkBW,uCAAA,CACpB,IAAA,EAAM,SAAA,EACN,UAAA,EAAY,sBAAA,IACZ,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,oBAAA;;;;;AAJX;;;;iBA8BsB,kBAAA,CACpB,YAAA,EAAc,oBAAA,EACd,0BAAA,EAA4B,UAAA,EAC5B,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;AAxDX;;;;;;iBCAsB,uBAAA,CACpB,SAAA,EAAW,SAAA,EACX,QAAA,UACA,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,iBAAA;;;;;;;;;iBAmBW,wBAAA,CACpB,cAAA,EAAgB,iBAAA,EAChB,QAAA,UACA,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;AD3BX;;;iBEHsB,iBAAA,CAAA,GAAqB,OAAA,CAAQ,aAAA"}
+{"version":3,"file":"email-crypto.d.ts","names":[],"sources":["../src/email-crypto/hybridEncyptedEmail.ts","../src/email-crypto/pwdProtectedEmail.ts","../src/email-crypto/emailKeys.ts","../src/email-crypto/core.ts"],"mappings":";;;;;AAWA;;;;;;iBAAsB,kBAAA,CACpB,IAAA,EAAM,SAAA,EACN,SAAA,EAAW,sBAAA,EACX,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,oBAAA;;;;;;;;;iBAkBW,uCAAA,CACpB,IAAA,EAAM,SAAA,EACN,UAAA,EAAY,sBAAA,IACZ,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,oBAAA;;;;;AAJX;;;;iBA8BsB,kBAAA,CACpB,YAAA,EAAc,oBAAA,EACd,0BAAA,EAA4B,UAAA,EAC5B,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;AAxDX;;;;;;iBCAsB,uBAAA,CACpB,SAAA,EAAW,SAAA,EACX,QAAA,UACA,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,iBAAA;;;;;;;;;iBAmBW,wBAAA,CACpB,cAAA,EAAgB,iBAAA,EAChB,QAAA,UACA,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;AD3BX;;;iBEHsB,iBAAA,CAAA,GAAqB,OAAA,CAAQ,aAAA;;;;;AFGnD;;;;;iBGGsB,gBAAA,CACpB,IAAA,EAAM,SAAA,EACN,GAAA,GAAM,UAAA,GACL,OAAA;EACD,YAAA,EAAc,kBAAA;EACd,aAAA,EAAe,UAAA;AAAA;;;;;;;;;iBAuBK,uBAAA,CACpB,IAAA,EAAM,SAAA,EACN,aAAA,EAAe,UAAA,EACf,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,kBAAA;;;AHbX;;;;;;iBG8CsB,gBAAA,CACpB,YAAA,EAAc,kBAAA,EACd,aAAA,EAAe,UAAA,EACf,GAAA,GAAM,UAAA,GACL,OAAA,CAAQ,SAAA;;;;;;;;iBA8BW,iBAAA,CACpB,kBAAA,EAAoB,UAAA,EACpB,SAAA,EAAW,sBAAA,GACV,OAAA,CAAQ,YAAA;;;;;;AHrDX;;iBG6EsB,iBAAA,CACpB,YAAA,EAAc,YAAA,EACd,mBAAA,EAAqB,UAAA,GACpB,OAAA,CAAQ,UAAA;;;;;;;;iBAmBW,kBAAA,CAAmB,kBAAA,EAAoB,UAAA,EAAY,QAAA,WAAmB,OAAA,CAAQ,eAAA;;;;;;;;iBAmB9E,wBAAA,CACpB,kBAAA,EAAoB,eAAA,EACpB,QAAA,WACC,OAAA,CAAQ,UAAA"}

package/dist/email-crypto.js

@@ -1,122 +1,16 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_xwing = require('./xwing-iRWVRtNE.js');
-const require_core = require('./core-Bj26rNdA.js');
+const require_emailKeys = require('./emailKeys-DWvKANTZ.js');
 
-//#region src/email-crypto/hybridEncyptedEmail.ts
-/**
-* Encrypts the email body using hybrid encryption.
-*
-* @param body - The email body to encrypt.
-* @param recipientPublicKeys - The public keys of the recipient.
-* @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).
-* @returns The encrypted email body
-*/
-async function encryptEmailHybrid(body, recipient, aux) {
-	try {
-		const { encryptionKey, encEmailBody } = await require_core.encryptEmailBody(body, aux);
-		return {
-			encEmailBody,
-			encryptedKey: await require_core.encryptKeysHybrid(encryptionKey, recipient)
-		};
-	} catch (error) {
-		throw new Error("Failed to encrypt email body with hybrid encryption", { cause: error });
-	}
-}
-/**
-* Encrypts the email body using hybrid encryption for multiple recipients.
-*
-* @param body - The email body to encrypt for multiple recipients.
-* @param recipients - The recipients with corresponding public keys.
-* @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).
-* @returns The set of encrypted email bodies
-*/
-async function encryptEmailHybridForMultipleRecipients(body, recipients, aux) {
-	try {
-		const { encryptionKey, encEmailBody } = await require_core.encryptEmailBody(body, aux);
-		const encryptedEmails = [];
-		for (const recipient of recipients) {
-			const encryptedKey = await require_core.encryptKeysHybrid(encryptionKey, recipient);
-			encryptedEmails.push({
-				encEmailBody,
-				encryptedKey
-			});
-		}
-		return encryptedEmails;
-	} catch (error) {
-		throw new Error("Failed to encrypt email to multiple recipients with hybrid encryption", { cause: error });
-	}
-}
-/**
-* Decrypts the email using hybrid encryption.
-*
-* @param encEmailBody - The encrypted email.
-* @param recipientPrivateHybridKeys - The private key of the recipient.
-* @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).
-* @returns The decrypted email body
-*/
-async function decryptEmailHybrid(encEmailBody, recipientPrivateHybridKeys, aux) {
-	try {
-		const encryptionKey = await require_core.decryptKeysHybrid(encEmailBody.encryptedKey, recipientPrivateHybridKeys);
-		return await require_core.decryptEmailBody(encEmailBody.encEmailBody, encryptionKey, aux);
-	} catch (error) {
-		throw new Error("Failed to decrypt email with hybrid encryption", { cause: error });
-	}
-}
-
-//#endregion
-//#region src/email-crypto/pwdProtectedEmail.ts
-/**
-* Creates a password-protected email.
-*
-* @param email - The email to password-protect
-* @param password - The secret password shared among recipients
-* @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).
-* @returns The password-protected email
-*/
-async function createPwdProtectedEmail(emailBody, password, aux) {
-	try {
-		const { encryptionKey, encEmailBody } = await require_core.encryptEmailBody(emailBody, aux);
-		return {
-			encEmailBody,
-			encryptedKey: await require_core.passwordProtectKey(encryptionKey, password)
-		};
-	} catch (error) {
-		throw new Error("Failed to password-protect email", { cause: error });
-	}
-}
-/**
-* Opens a password-protected email.
-*
-* @param encryptedEmail - The encrypted email
-* @param password - The secret password shared among recipients.
-* @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).
-* @returns The decrypted email body
-*/
-async function decryptPwdProtectedEmail(encryptedEmail, password, aux) {
-	try {
-		const encryptionKey = await require_core.removePasswordProtection(encryptedEmail.encryptedKey, password);
-		return await require_core.decryptEmailBody(encryptedEmail.encEmailBody, encryptionKey, aux);
-	} catch (error) {
-		throw new Error("Failed to decrypt password-protect email", { cause: error });
-	}
-}
-
-//#endregion
-//#region src/email-crypto/emailKeys.ts
-/**
-* Generates public and private keys for email encryption.
-*
-* @returns The user's private and public keys
-*/
-async function generateEmailKeys() {
-	return require_xwing.genHybridKeys();
-}
-
-//#endregion
-exports.createPwdProtectedEmail = createPwdProtectedEmail;
-exports.decryptEmailHybrid = decryptEmailHybrid;
-exports.decryptPwdProtectedEmail = decryptPwdProtectedEmail;
-exports.encryptEmailHybrid = encryptEmailHybrid;
-exports.encryptEmailHybridForMultipleRecipients = encryptEmailHybridForMultipleRecipients;
-exports.generateEmailKeys = generateEmailKeys;
-//# sourceMappingURL=email-crypto.js.map
+exports.createPwdProtectedEmail = require_emailKeys.createPwdProtectedEmail;
+exports.decryptEmailBody = require_emailKeys.decryptEmailBody;
+exports.decryptEmailHybrid = require_emailKeys.decryptEmailHybrid;
+exports.decryptKeysHybrid = require_emailKeys.decryptKeysHybrid;
+exports.decryptPwdProtectedEmail = require_emailKeys.decryptPwdProtectedEmail;
+exports.encryptEmailBody = require_emailKeys.encryptEmailBody;
+exports.encryptEmailBodyWithKey = require_emailKeys.encryptEmailBodyWithKey;
+exports.encryptEmailHybrid = require_emailKeys.encryptEmailHybrid;
+exports.encryptEmailHybridForMultipleRecipients = require_emailKeys.encryptEmailHybridForMultipleRecipients;
+exports.encryptKeysHybrid = require_emailKeys.encryptKeysHybrid;
+exports.generateEmailKeys = require_emailKeys.generateEmailKeys;
+exports.passwordProtectKey = require_emailKeys.passwordProtectKey;
+exports.removePasswordProtection = require_emailKeys.removePasswordProtection;

package/dist/email-crypto.mjs

@@ -1,116 +1,3 @@
-import { r as genHybridKeys } from "./xwing-CQmQX6hn.mjs";
-import { a as encryptKeysHybrid, n as decryptKeysHybrid, o as passwordProtectKey, r as encryptEmailBody, s as removePasswordProtection, t as decryptEmailBody } from "./core-pEGygy6S.mjs";
+import { a as encryptEmailHybrid, c as decryptKeysHybrid, d as encryptKeysHybrid, f as passwordProtectKey, i as decryptEmailHybrid, l as encryptEmailBody, n as createPwdProtectedEmail, o as encryptEmailHybridForMultipleRecipients, p as removePasswordProtection, r as decryptPwdProtectedEmail, s as decryptEmailBody, t as generateEmailKeys, u as encryptEmailBodyWithKey } from "./emailKeys-nzn7U7HQ.mjs";
 
-//#region src/email-crypto/hybridEncyptedEmail.ts
-/**
-* Encrypts the email body using hybrid encryption.
-*
-* @param body - The email body to encrypt.
-* @param recipientPublicKeys - The public keys of the recipient.
-* @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).
-* @returns The encrypted email body
-*/
-async function encryptEmailHybrid(body, recipient, aux) {
-	try {
-		const { encryptionKey, encEmailBody } = await encryptEmailBody(body, aux);
-		return {
-			encEmailBody,
-			encryptedKey: await encryptKeysHybrid(encryptionKey, recipient)
-		};
-	} catch (error) {
-		throw new Error("Failed to encrypt email body with hybrid encryption", { cause: error });
-	}
-}
-/**
-* Encrypts the email body using hybrid encryption for multiple recipients.
-*
-* @param body - The email body to encrypt for multiple recipients.
-* @param recipients - The recipients with corresponding public keys.
-* @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).
-* @returns The set of encrypted email bodies
-*/
-async function encryptEmailHybridForMultipleRecipients(body, recipients, aux) {
-	try {
-		const { encryptionKey, encEmailBody } = await encryptEmailBody(body, aux);
-		const encryptedEmails = [];
-		for (const recipient of recipients) {
-			const encryptedKey = await encryptKeysHybrid(encryptionKey, recipient);
-			encryptedEmails.push({
-				encEmailBody,
-				encryptedKey
-			});
-		}
-		return encryptedEmails;
-	} catch (error) {
-		throw new Error("Failed to encrypt email to multiple recipients with hybrid encryption", { cause: error });
-	}
-}
-/**
-* Decrypts the email using hybrid encryption.
-*
-* @param encEmailBody - The encrypted email.
-* @param recipientPrivateHybridKeys - The private key of the recipient.
-* @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).
-* @returns The decrypted email body
-*/
-async function decryptEmailHybrid(encEmailBody, recipientPrivateHybridKeys, aux) {
-	try {
-		const encryptionKey = await decryptKeysHybrid(encEmailBody.encryptedKey, recipientPrivateHybridKeys);
-		return await decryptEmailBody(encEmailBody.encEmailBody, encryptionKey, aux);
-	} catch (error) {
-		throw new Error("Failed to decrypt email with hybrid encryption", { cause: error });
-	}
-}
-
-//#endregion
-//#region src/email-crypto/pwdProtectedEmail.ts
-/**
-* Creates a password-protected email.
-*
-* @param email - The email to password-protect
-* @param password - The secret password shared among recipients
-* @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).
-* @returns The password-protected email
-*/
-async function createPwdProtectedEmail(emailBody, password, aux) {
-	try {
-		const { encryptionKey, encEmailBody } = await encryptEmailBody(emailBody, aux);
-		return {
-			encEmailBody,
-			encryptedKey: await passwordProtectKey(encryptionKey, password)
-		};
-	} catch (error) {
-		throw new Error("Failed to password-protect email", { cause: error });
-	}
-}
-/**
-* Opens a password-protected email.
-*
-* @param encryptedEmail - The encrypted email
-* @param password - The secret password shared among recipients.
-* @param aux -  An optional auxilary sting for AEAD (e.g., email ID or timestamp).
-* @returns The decrypted email body
-*/
-async function decryptPwdProtectedEmail(encryptedEmail, password, aux) {
-	try {
-		const encryptionKey = await removePasswordProtection(encryptedEmail.encryptedKey, password);
-		return await decryptEmailBody(encryptedEmail.encEmailBody, encryptionKey, aux);
-	} catch (error) {
-		throw new Error("Failed to decrypt password-protect email", { cause: error });
-	}
-}
-
-//#endregion
-//#region src/email-crypto/emailKeys.ts
-/**
-* Generates public and private keys for email encryption.
-*
-* @returns The user's private and public keys
-*/
-async function generateEmailKeys() {
-	return genHybridKeys();
-}
-
-//#endregion
-export { createPwdProtectedEmail, decryptEmailHybrid, decryptPwdProtectedEmail, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, generateEmailKeys };
-//# sourceMappingURL=email-crypto.mjs.map
+export { createPwdProtectedEmail, decryptEmailBody, decryptEmailHybrid, decryptKeysHybrid, decryptPwdProtectedEmail, encryptEmailBody, encryptEmailBodyWithKey, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, encryptKeysHybrid, generateEmailKeys, passwordProtectKey, removePasswordProtection };

package/dist/{emailEncryptionKey-C4X1Bwy4.js → emailEncryptionKey-F_YuJu1H.js}

@@ -1,6 +1,6 @@
 const require_constants = require('./constants.js');
 const require_genID = require('./genID-cWOPmspk.js');
-const require_deriveKeysFromKey = require('./deriveKeysFromKey-C4McqO6_.js');
+const require_deriveKeysFromKey = require('./deriveKeysFromKey-GTRMuxDj.js');
 const require_aes = require('./aes-CuW_SPl-.js');
 const require_xwing = require('./xwing-iRWVRtNE.js');
 const require_types = require('./types.js');
@@ -141,4 +141,4 @@ Object.defineProperty(exports, 'openRecoveryKeystore', {
     return openRecoveryKeystore;
   }
 });
-//# sourceMappingURL=emailEncryptionKey-C4X1Bwy4.js.map
+//# sourceMappingURL=emailEncryptionKey-F_YuJu1H.js.map

package/dist/{emailEncryptionKey-C4X1Bwy4.js.map → emailEncryptionKey-F_YuJu1H.js.map}

@@ -1 +1 @@
-{"version":3,"file":"emailEncryptionKey-C4X1Bwy4.js","names":["UTF8ToUint8","uint8ArrayToBase64","encryptSymmetrically","base64ToUint8Array","decryptSymmetrically","deriveSymmetricKeyFromContext","CONTEXT_RECOVERY","mnemonicToBytes","CONTEXT_ENC_KEYSTORE","genHybridKeys","KeystoreType","genMnemonic"],"sources":["../src/keystore-crypto/core.ts","../src/keystore-crypto/emailEncryptionKey.ts"],"sourcesContent":["import { encryptSymmetrically, decryptSymmetrically } from '../symmetric-crypto';\nimport { base64ToUint8Array, uint8ArrayToBase64, UTF8ToUint8, mnemonicToBytes } from '../utils';\nimport { deriveSymmetricKeyFromContext } from '../derive-key';\nimport { CONTEXT_ENC_KEYSTORE, CONTEXT_RECOVERY } from '../constants';\nimport { EncryptedKeystore, HybridKeyPair, KeystoreType } from '../types';\n\n/**\n * Encrypts the user's hybrid key using symmetric encryption to get a keystore\n *\n * @param secretKey - The symmetric key to encrypt the keystore content\n * @param key - The hybrid key pair\n * @param userEmail - The email of the user\n * @param type - The keystore type\n * @returns The encrypted keystore\n */\nexport async function encryptKeystoreContent(\n  secretKey: Uint8Array,\n  keys: HybridKeyPair,\n  userEmail: string,\n  type: KeystoreType,\n): Promise<EncryptedKeystore> {\n  try {\n    const aux = UTF8ToUint8(userEmail + type);\n    const publicKey = uint8ArrayToBase64(keys.publicKey);\n    const secretKeyEncrypted = await encryptSymmetrically(secretKey, keys.secretKey, aux);\n\n    const keystore: EncryptedKeystore = {\n      userEmail,\n      type,\n      publicKey,\n      privateKeyEncrypted: uint8ArrayToBase64(secretKeyEncrypted),\n    };\n    return keystore;\n  } catch (error) {\n    throw new Error('Failed to encrypt keystore content', { cause: error });\n  }\n}\n\n/**\n * Decrypts the keystore content using symmetric encryption\n *\n * @param kesytoreOpeningKey - The symmetric key to decrypt the keystore content\n * @param encryptedKeys - The encrypted keystore content\n * @returns The decrypted hybrid key pair contained in the keystore\n */\nexport async function decryptKeystoreContent(\n  kesytoreOpeningKey: Uint8Array,\n  encryptedKeystore: EncryptedKeystore,\n): Promise<HybridKeyPair> {\n  try {\n    const aux = UTF8ToUint8(encryptedKeystore.userEmail + encryptedKeystore.type);\n    const publicKey = base64ToUint8Array(encryptedKeystore.publicKey);\n    const ciphertext = base64ToUint8Array(encryptedKeystore.privateKeyEncrypted);\n    const secretKey = await decryptSymmetrically(kesytoreOpeningKey, ciphertext, aux);\n    return {\n      publicKey,\n      secretKey,\n    };\n  } catch (error) {\n    throw new Error('Failed to decrypt keystore content', { cause: error });\n  }\n}\n\n/**\n * Derives a secret key for protecting the recovery keystore\n *\n * @param recoveryCodes - The recovery codes\n * @returns The derived secret key for protecting the recovery keystore\n */\nexport async function deriveRecoveryKey(recoveryCodes: string): Promise<Uint8Array> {\n  const recoverCodesArray = mnemonicToBytes(recoveryCodes);\n  return deriveSymmetricKeyFromContext(CONTEXT_RECOVERY, recoverCodesArray);\n}\n\n/**\n * Derives a secret key for protecting the encryption keystore\n *\n * @param baseKey - The base secret key from which a new key secret will be derived\n * @returns The derived secret key for protecting the encryption keystore\n */\nexport async function deriveEncryptionKeystoreKey(baseKey: Uint8Array): Promise<Uint8Array> {\n  return deriveSymmetricKeyFromContext(CONTEXT_ENC_KEYSTORE, baseKey);\n}\n","import { EncryptedKeystore, KeystoreType, HybridKeyPair } from '../types';\nimport { genMnemonic } from '../utils';\nimport { encryptKeystoreContent, decryptKeystoreContent, deriveEncryptionKeystoreKey, deriveRecoveryKey } from './core';\nimport { genHybridKeys } from '../hybrid-crypto';\n\n/**\n * Generates hybrid keys and creates encrypted main and recovery keystores\n * The main keystore encryption key is derived from the base key (stored in session storage)\n * The recovery keystore encryption key is derived from the recovery codes\n *\n * @returns The encryption and recovery keystores, recovery codes and hybrid keys\n */\nexport async function createEncryptionAndRecoveryKeystores(\n  userEmail: string,\n  baseKey: Uint8Array,\n): Promise<{\n  encryptionKeystore: EncryptedKeystore;\n  recoveryKeystore: EncryptedKeystore;\n  recoveryCodes: string;\n  keys: HybridKeyPair;\n}> {\n  try {\n    const keys = genHybridKeys();\n\n    const secretKey = await deriveEncryptionKeystoreKey(baseKey);\n    const encryptionKeystore = await encryptKeystoreContent(secretKey, keys, userEmail, KeystoreType.ENCRYPTION);\n\n    const recoveryCodes = genMnemonic();\n    const recoveryKey = await deriveRecoveryKey(recoveryCodes);\n    const recoveryKeystore = await encryptKeystoreContent(recoveryKey, keys, userEmail, KeystoreType.RECOVERY);\n\n    return { encryptionKeystore, recoveryKeystore, recoveryCodes, keys };\n  } catch (error) {\n    throw new Error('Failed to create encryption and recovery keystores', { cause: error });\n  }\n}\n\n/**\n * Opens the encryption keystore and returns the email encryption keys\n * The decryption key is derived from the base key (stored in session storage)\n *\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @param baseKey - The base key from which the decryption key will be derived\n * @returns The encryption keys\n */\nexport async function openEncryptionKeystore(\n  encryptedKeystore: EncryptedKeystore,\n  baseKey: Uint8Array,\n): Promise<HybridKeyPair> {\n  try {\n    if (encryptedKeystore.type != KeystoreType.ENCRYPTION) {\n      throw new Error('Input is invalid');\n    }\n    const secretKey = await deriveEncryptionKeystoreKey(baseKey);\n    const keys = await decryptKeystoreContent(secretKey, encryptedKeystore);\n    return keys;\n  } catch (error) {\n    throw new Error('Failed to open encryption keystore', { cause: error });\n  }\n}\n\n/**\n * Opens the recovery keystore and returns the email encryption keys\n * The decryption key is derived from the base key (stored in session storage)\n *\n * @param recoveryCodes - The user's recovery codes\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @returns The encryption keys\n */\nexport async function openRecoveryKeystore(\n  recoveryCodes: string,\n  encryptedKeystore: EncryptedKeystore,\n): Promise<HybridKeyPair> {\n  try {\n    if (encryptedKeystore.type != KeystoreType.RECOVERY) {\n      throw new Error('Input is invalid');\n    }\n    const recoveryKey = await deriveRecoveryKey(recoveryCodes);\n    const keys = await decryptKeystoreContent(recoveryKey, encryptedKeystore);\n    return keys;\n  } catch (error) {\n    throw new Error('Failed to open recovery keystore', { cause: error });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAeA,eAAsB,uBACpB,WACA,MACA,WACA,MAC4B;AAC5B,KAAI;EACF,MAAM,MAAMA,0BAAY,YAAY,KAAK;AAUzC,SANoC;GAClC;GACA;GACA,WANgBC,iCAAmB,KAAK,UAAU;GAOlD,qBAAqBA,iCANI,MAAMC,iCAAqB,WAAW,KAAK,WAAW,IAAI,CAMxB;GAC5D;UAEM,OAAO;AACd,QAAM,IAAI,MAAM,sCAAsC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;AAW3E,eAAsB,uBACpB,oBACA,mBACwB;AACxB,KAAI;EACF,MAAM,MAAMF,0BAAY,kBAAkB,YAAY,kBAAkB,KAAK;AAI7E,SAAO;GACL,WAJgBG,iCAAmB,kBAAkB,UAAU;GAK/D,WAHgB,MAAMC,iCAAqB,oBAD1BD,iCAAmB,kBAAkB,oBAAoB,EACC,IAAI;GAIhF;UACM,OAAO;AACd,QAAM,IAAI,MAAM,sCAAsC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;AAU3E,eAAsB,kBAAkB,eAA4C;AAElF,QAAOE,wDAA8BC,oCADXC,8BAAgB,cAAc,CACiB;;;;;;;;AAS3E,eAAsB,4BAA4B,SAA0C;AAC1F,QAAOF,wDAA8BG,wCAAsB,QAAQ;;;;;;;;;;;;ACrErE,eAAsB,qCACpB,WACA,SAMC;AACD,KAAI;EACF,MAAM,OAAOC,6BAAe;EAG5B,MAAM,qBAAqB,MAAM,uBADf,MAAM,4BAA4B,QAAQ,EACO,MAAM,WAAWC,2BAAa,WAAW;EAE5G,MAAM,gBAAgBC,2BAAa;AAInC,SAAO;GAAE;GAAoB,kBAFJ,MAAM,uBADX,MAAM,kBAAkB,cAAc,EACS,MAAM,WAAWD,2BAAa,SAAS;GAE3D;GAAe;GAAM;UAC7D,OAAO;AACd,QAAM,IAAI,MAAM,sDAAsD,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;;AAY3F,eAAsB,uBACpB,mBACA,SACwB;AACxB,KAAI;AACF,MAAI,kBAAkB,QAAQA,2BAAa,WACzC,OAAM,IAAI,MAAM,mBAAmB;AAIrC,SADa,MAAM,uBADD,MAAM,4BAA4B,QAAQ,EACP,kBAAkB;UAEhE,OAAO;AACd,QAAM,IAAI,MAAM,sCAAsC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;;AAY3E,eAAsB,qBACpB,eACA,mBACwB;AACxB,KAAI;AACF,MAAI,kBAAkB,QAAQA,2BAAa,SACzC,OAAM,IAAI,MAAM,mBAAmB;AAIrC,SADa,MAAM,uBADC,MAAM,kBAAkB,cAAc,EACH,kBAAkB;UAElE,OAAO;AACd,QAAM,IAAI,MAAM,oCAAoC,EAAE,OAAO,OAAO,CAAC"}
+{"version":3,"file":"emailEncryptionKey-F_YuJu1H.js","names":["UTF8ToUint8","uint8ArrayToBase64","encryptSymmetrically","base64ToUint8Array","decryptSymmetrically","deriveSymmetricKeyFromContext","CONTEXT_RECOVERY","mnemonicToBytes","CONTEXT_ENC_KEYSTORE","genHybridKeys","KeystoreType","genMnemonic"],"sources":["../src/keystore-crypto/core.ts","../src/keystore-crypto/emailEncryptionKey.ts"],"sourcesContent":["import { encryptSymmetrically, decryptSymmetrically } from '../symmetric-crypto';\nimport { base64ToUint8Array, uint8ArrayToBase64, UTF8ToUint8, mnemonicToBytes } from '../utils';\nimport { deriveSymmetricKeyFromContext } from '../derive-key';\nimport { CONTEXT_ENC_KEYSTORE, CONTEXT_RECOVERY } from '../constants';\nimport { EncryptedKeystore, HybridKeyPair, KeystoreType } from '../types';\n\n/**\n * Encrypts the user's hybrid key using symmetric encryption to get a keystore\n *\n * @param secretKey - The symmetric key to encrypt the keystore content\n * @param key - The hybrid key pair\n * @param userEmail - The email of the user\n * @param type - The keystore type\n * @returns The encrypted keystore\n */\nexport async function encryptKeystoreContent(\n  secretKey: Uint8Array,\n  keys: HybridKeyPair,\n  userEmail: string,\n  type: KeystoreType,\n): Promise<EncryptedKeystore> {\n  try {\n    const aux = UTF8ToUint8(userEmail + type);\n    const publicKey = uint8ArrayToBase64(keys.publicKey);\n    const secretKeyEncrypted = await encryptSymmetrically(secretKey, keys.secretKey, aux);\n\n    const keystore: EncryptedKeystore = {\n      userEmail,\n      type,\n      publicKey,\n      privateKeyEncrypted: uint8ArrayToBase64(secretKeyEncrypted),\n    };\n    return keystore;\n  } catch (error) {\n    throw new Error('Failed to encrypt keystore content', { cause: error });\n  }\n}\n\n/**\n * Decrypts the keystore content using symmetric encryption\n *\n * @param kesytoreOpeningKey - The symmetric key to decrypt the keystore content\n * @param encryptedKeys - The encrypted keystore content\n * @returns The decrypted hybrid key pair contained in the keystore\n */\nexport async function decryptKeystoreContent(\n  kesytoreOpeningKey: Uint8Array,\n  encryptedKeystore: EncryptedKeystore,\n): Promise<HybridKeyPair> {\n  try {\n    const aux = UTF8ToUint8(encryptedKeystore.userEmail + encryptedKeystore.type);\n    const publicKey = base64ToUint8Array(encryptedKeystore.publicKey);\n    const ciphertext = base64ToUint8Array(encryptedKeystore.privateKeyEncrypted);\n    const secretKey = await decryptSymmetrically(kesytoreOpeningKey, ciphertext, aux);\n    return {\n      publicKey,\n      secretKey,\n    };\n  } catch (error) {\n    throw new Error('Failed to decrypt keystore content', { cause: error });\n  }\n}\n\n/**\n * Derives a secret key for protecting the recovery keystore\n *\n * @param recoveryCodes - The recovery codes\n * @returns The derived secret key for protecting the recovery keystore\n */\nexport async function deriveRecoveryKey(recoveryCodes: string): Promise<Uint8Array> {\n  const recoverCodesArray = mnemonicToBytes(recoveryCodes);\n  return deriveSymmetricKeyFromContext(CONTEXT_RECOVERY, recoverCodesArray);\n}\n\n/**\n * Derives a secret key for protecting the encryption keystore\n *\n * @param baseKey - The base secret key from which a new key secret will be derived\n * @returns The derived secret key for protecting the encryption keystore\n */\nexport async function deriveEncryptionKeystoreKey(baseKey: Uint8Array): Promise<Uint8Array> {\n  return deriveSymmetricKeyFromContext(CONTEXT_ENC_KEYSTORE, baseKey);\n}\n","import { EncryptedKeystore, KeystoreType, HybridKeyPair } from '../types';\nimport { genMnemonic } from '../utils';\nimport { encryptKeystoreContent, decryptKeystoreContent, deriveEncryptionKeystoreKey, deriveRecoveryKey } from './core';\nimport { genHybridKeys } from '../hybrid-crypto';\n\n/**\n * Generates hybrid keys and creates encrypted main and recovery keystores\n * The main keystore encryption key is derived from the base key (stored in session storage)\n * The recovery keystore encryption key is derived from the recovery codes\n *\n * @returns The encryption and recovery keystores, recovery codes and hybrid keys\n */\nexport async function createEncryptionAndRecoveryKeystores(\n  userEmail: string,\n  baseKey: Uint8Array,\n): Promise<{\n  encryptionKeystore: EncryptedKeystore;\n  recoveryKeystore: EncryptedKeystore;\n  recoveryCodes: string;\n  keys: HybridKeyPair;\n}> {\n  try {\n    const keys = genHybridKeys();\n\n    const secretKey = await deriveEncryptionKeystoreKey(baseKey);\n    const encryptionKeystore = await encryptKeystoreContent(secretKey, keys, userEmail, KeystoreType.ENCRYPTION);\n\n    const recoveryCodes = genMnemonic();\n    const recoveryKey = await deriveRecoveryKey(recoveryCodes);\n    const recoveryKeystore = await encryptKeystoreContent(recoveryKey, keys, userEmail, KeystoreType.RECOVERY);\n\n    return { encryptionKeystore, recoveryKeystore, recoveryCodes, keys };\n  } catch (error) {\n    throw new Error('Failed to create encryption and recovery keystores', { cause: error });\n  }\n}\n\n/**\n * Opens the encryption keystore and returns the email encryption keys\n * The decryption key is derived from the base key (stored in session storage)\n *\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @param baseKey - The base key from which the decryption key will be derived\n * @returns The encryption keys\n */\nexport async function openEncryptionKeystore(\n  encryptedKeystore: EncryptedKeystore,\n  baseKey: Uint8Array,\n): Promise<HybridKeyPair> {\n  try {\n    if (encryptedKeystore.type != KeystoreType.ENCRYPTION) {\n      throw new Error('Input is invalid');\n    }\n    const secretKey = await deriveEncryptionKeystoreKey(baseKey);\n    const keys = await decryptKeystoreContent(secretKey, encryptedKeystore);\n    return keys;\n  } catch (error) {\n    throw new Error('Failed to open encryption keystore', { cause: error });\n  }\n}\n\n/**\n * Opens the recovery keystore and returns the email encryption keys\n * The decryption key is derived from the base key (stored in session storage)\n *\n * @param recoveryCodes - The user's recovery codes\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @returns The encryption keys\n */\nexport async function openRecoveryKeystore(\n  recoveryCodes: string,\n  encryptedKeystore: EncryptedKeystore,\n): Promise<HybridKeyPair> {\n  try {\n    if (encryptedKeystore.type != KeystoreType.RECOVERY) {\n      throw new Error('Input is invalid');\n    }\n    const recoveryKey = await deriveRecoveryKey(recoveryCodes);\n    const keys = await decryptKeystoreContent(recoveryKey, encryptedKeystore);\n    return keys;\n  } catch (error) {\n    throw new Error('Failed to open recovery keystore', { cause: error });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAeA,eAAsB,uBACpB,WACA,MACA,WACA,MAC4B;AAC5B,KAAI;EACF,MAAM,MAAMA,0BAAY,YAAY,KAAK;AAUzC,SANoC;GAClC;GACA;GACA,WANgBC,iCAAmB,KAAK,UAAU;GAOlD,qBAAqBA,iCANI,MAAMC,iCAAqB,WAAW,KAAK,WAAW,IAAI,CAMxB;GAC5D;UAEM,OAAO;AACd,QAAM,IAAI,MAAM,sCAAsC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;AAW3E,eAAsB,uBACpB,oBACA,mBACwB;AACxB,KAAI;EACF,MAAM,MAAMF,0BAAY,kBAAkB,YAAY,kBAAkB,KAAK;AAI7E,SAAO;GACL,WAJgBG,iCAAmB,kBAAkB,UAAU;GAK/D,WAHgB,MAAMC,iCAAqB,oBAD1BD,iCAAmB,kBAAkB,oBAAoB,EACC,IAAI;GAIhF;UACM,OAAO;AACd,QAAM,IAAI,MAAM,sCAAsC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;AAU3E,eAAsB,kBAAkB,eAA4C;AAElF,QAAOE,wDAA8BC,oCADXC,8BAAgB,cAAc,CACiB;;;;;;;;AAS3E,eAAsB,4BAA4B,SAA0C;AAC1F,QAAOF,wDAA8BG,wCAAsB,QAAQ;;;;;;;;;;;;ACrErE,eAAsB,qCACpB,WACA,SAMC;AACD,KAAI;EACF,MAAM,OAAOC,6BAAe;EAG5B,MAAM,qBAAqB,MAAM,uBADf,MAAM,4BAA4B,QAAQ,EACO,MAAM,WAAWC,2BAAa,WAAW;EAE5G,MAAM,gBAAgBC,2BAAa;AAInC,SAAO;GAAE;GAAoB,kBAFJ,MAAM,uBADX,MAAM,kBAAkB,cAAc,EACS,MAAM,WAAWD,2BAAa,SAAS;GAE3D;GAAe;GAAM;UAC7D,OAAO;AACd,QAAM,IAAI,MAAM,sDAAsD,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;;AAY3F,eAAsB,uBACpB,mBACA,SACwB;AACxB,KAAI;AACF,MAAI,kBAAkB,QAAQA,2BAAa,WACzC,OAAM,IAAI,MAAM,mBAAmB;AAIrC,SADa,MAAM,uBADD,MAAM,4BAA4B,QAAQ,EACP,kBAAkB;UAEhE,OAAO;AACd,QAAM,IAAI,MAAM,sCAAsC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;;AAY3E,eAAsB,qBACpB,eACA,mBACwB;AACxB,KAAI;AACF,MAAI,kBAAkB,QAAQA,2BAAa,SACzC,OAAM,IAAI,MAAM,mBAAmB;AAIrC,SADa,MAAM,uBADC,MAAM,kBAAkB,cAAc,EACH,kBAAkB;UAElE,OAAO;AACd,QAAM,IAAI,MAAM,oCAAoC,EAAE,OAAO,OAAO,CAAC"}

package/dist/{emailEncryptionKey-BtSPYd9M.mjs → emailEncryptionKey-kIsseFo6.mjs}

@@ -1,6 +1,6 @@
 import { CONTEXT_ENC_KEYSTORE, CONTEXT_RECOVERY } from "./constants.mjs";
 import { a as genMnemonic, c as base64ToUint8Array, o as mnemonicToBytes, s as UTF8ToUint8, u as uint8ArrayToBase64 } from "./genID-D08K7JPr.mjs";
-import { t as deriveSymmetricKeyFromContext } from "./deriveKeysFromKey-DPU_h7wr.mjs";
+import { n as deriveSymmetricKeyFromContext } from "./deriveKeysFromKey-CseBjg0n.mjs";
 import { n as encryptSymmetrically, t as decryptSymmetrically } from "./aes-B8TA-JKq.mjs";
 import { r as genHybridKeys } from "./xwing-CQmQX6hn.mjs";
 import { KeystoreType } from "./types.mjs";
@@ -124,4 +124,4 @@ async function openRecoveryKeystore(recoveryCodes, encryptedKeystore) {
 
 //#endregion
 export { openEncryptionKeystore as n, openRecoveryKeystore as r, createEncryptionAndRecoveryKeystores as t };
-//# sourceMappingURL=emailEncryptionKey-BtSPYd9M.mjs.map
+//# sourceMappingURL=emailEncryptionKey-kIsseFo6.mjs.map