internxt-crypto 1.2.0 → 1.3.0

package/README.md

@@ -131,12 +131,12 @@ expect(decryptedEmail).toStrictEqual(email);
 
 // keystore
 const userEmail = 'user email';
-const password = 'user password';
-const { encryptionKeystore, recoveryKeystore, recoveryCodes, salt } = await createEncryptionAndRecoveryKeystores(
+const mnemonic = 'user mnemonic';
+const { encryptionKeystore, recoveryKeystore, recoveryCodes } = await createEncryptionAndRecoveryKeystores(
       userEmail,
-      password
+      mnemonic
     );
-const resultEnc = await openEncryptionKeystore(encryptionKeystore, password, salt);
+const resultEnc = await openEncryptionKeystore(encryptionKeystore, mnemonic);
 const resultRec = await openRecoveryKeystore(recoveryCodes, recoveryKeystore);
 
 expect(resultEnc).toStrictEqual(resultRec);

package/dist/{emailEncryptionKey-Cw-vW_Oq.js → emailEncryptionKey-Ba95VuFO.js}

@@ -1,7 +1,6 @@
 const require_constants = require('./constants.js');
 const require_genID = require('./genID-cWOPmspk.js');
 const require_deriveKeysFromMnemonic = require('./deriveKeysFromMnemonic-Dbx7VSBQ.js');
-const require_deriveKeysFromPassword = require('./deriveKeysFromPassword-iMHv-tIA.js');
 const require_aes = require('./aes-CuW_SPl-.js');
 const require_xwing = require('./xwing-iRWVRtNE.js');
 const require_types = require('./types.js');
@@ -18,11 +17,12 @@ const require_types = require('./types.js');
 */
 async function encryptKeystoreContent(secretKey, keys, userEmail, type) {
 	try {
-		const aux = require_genID.UTF8ToUint8(userEmail + type);
+		const publicKey = require_genID.uint8ArrayToBase64(keys.publicKey);
+		const aux = require_genID.UTF8ToUint8(userEmail + type + publicKey);
 		return {
 			userEmail,
 			type,
-			publicKey: require_genID.uint8ArrayToBase64(keys.publicKey),
+			publicKey,
 			privateKeyEncrypted: require_genID.uint8ArrayToBase64(await require_aes.encryptSymmetrically(secretKey, keys.secretKey, aux))
 		};
 	} catch (error) {
@@ -38,7 +38,7 @@ async function encryptKeystoreContent(secretKey, keys, userEmail, type) {
 */
 async function decryptKeystoreContent(kesytoreOpeningKey, encryptedKeystore) {
 	try {
-		const aux = require_genID.UTF8ToUint8(encryptedKeystore.userEmail + encryptedKeystore.type);
+		const aux = require_genID.UTF8ToUint8(encryptedKeystore.userEmail + encryptedKeystore.type + encryptedKeystore.publicKey);
 		return {
 			publicKey: require_genID.base64ToUint8Array(encryptedKeystore.publicKey),
 			secretKey: await require_aes.decryptSymmetrically(kesytoreOpeningKey, require_genID.base64ToUint8Array(encryptedKeystore.privateKeyEncrypted), aux)
@@ -57,28 +57,13 @@ async function deriveRecoveryKey(recoveryCodes) {
 	return require_deriveKeysFromMnemonic.deriveKeyFromMnemonic(recoveryCodes, require_constants.CONTEXT_RECOVERY);
 }
 /**
-* Derives a secret key for protecting the encryption keystore
+* Derives a secret key for protecting the encryption keystore from user's mnemonic
 *
-* @param password - The user's password
-* @param salt - The keystore salt
+* @param mnemonic - The user's mnemonic (machine-generated with secure PRNG)
 * @returns The derived secret key for protecting the encryption keystore
 */
-async function deriveEncryptionKeystoreKey(password, salt) {
-	return require_deriveKeysFromMnemonic.deriveSymmetricKeyFromContext(require_constants.CONTEXT_ENC_KEYSTORE, await require_deriveKeysFromPassword.getKeyFromPasswordAndSalt(password, salt));
-}
-/**
-* Derives a secret key for protecting the encryption keystore
-*
-* @param password - The user's password
-* @param salt - The keystore salt
-* @returns The derived secret key for protecting the encryption keystore
-*/
-async function deriveNewEncryptionKeystoreKey(password) {
-	const { key, salt } = await require_deriveKeysFromPassword.getKeyFromPassword(password);
-	return {
-		secretKey: require_deriveKeysFromMnemonic.deriveSymmetricKeyFromContext(require_constants.CONTEXT_ENC_KEYSTORE, key),
-		salt
-	};
+async function deriveEncryptionKeystoreKeyFromMnemonic(mnemonic) {
+	return require_deriveKeysFromMnemonic.deriveKeyFromMnemonic(mnemonic, require_constants.CONTEXT_ENC_KEYSTORE);
 }
 
 //#endregion
@@ -89,6 +74,12 @@ var FailedToCreateKeyStores = class FailedToCreateKeyStores extends Error {
 		Object.setPrototypeOf(this, FailedToCreateKeyStores.prototype);
 	}
 };
+var InvalidInputKeyStore = class InvalidInputKeyStore extends Error {
+	constructor() {
+		super("Invalid input");
+		Object.setPrototypeOf(this, InvalidInputKeyStore.prototype);
+	}
+};
 var FailedToOpenEncryptionKeyStore = class FailedToOpenEncryptionKeyStore extends Error {
 	constructor(errorMsg) {
 		super("Failed to open encryption keystore: " + errorMsg);
@@ -101,10 +92,10 @@ var FailedToOpenRecoveryKeyStore = class FailedToOpenRecoveryKeyStore extends Er
 		Object.setPrototypeOf(this, FailedToOpenRecoveryKeyStore.prototype);
 	}
 };
-var FailedToChangePasswordForKeyStore = class FailedToChangePasswordForKeyStore extends Error {
+var FailedToChangeMnemonicForKeyStore = class FailedToChangeMnemonicForKeyStore extends Error {
 	constructor(errorMsg) {
 		super("Error while fetching message: " + errorMsg);
-		Object.setPrototypeOf(this, FailedToChangePasswordForKeyStore.prototype);
+		Object.setPrototypeOf(this, FailedToChangeMnemonicForKeyStore.prototype);
 	}
 };
 
@@ -112,27 +103,25 @@ var FailedToChangePasswordForKeyStore = class FailedToChangePasswordForKeyStore
 //#region src/keystore-crypto/emailEncryptionKey.ts
 /**
 * Generates hybrid keys and creates encrypted main and recovery keystores
-* The main keystore encryption key is derived from the user's password
+* The main keystore encryption key is derived from the user's mnemonic
 * The recovery keystore encryption key is derived from the recovery codes
 *
 * @param userEmail - The user's email
-* @param password - The user's password
+* @param mnemonic - The user's mnemonic
 * @returns The encryption keys
 *
 * @returns The encryption and recovery keystores, recovery codes and hybrid keys
 */
-async function createEncryptionAndRecoveryKeystores(userEmail, password) {
+async function createEncryptionAndRecoveryKeystores(userEmail, mnemonic) {
 	try {
 		const keys = require_xwing.genHybridKeys();
-		const { secretKey, salt } = await deriveNewEncryptionKeystoreKey(password);
-		const encryptionKeystore = await encryptKeystoreContent(secretKey, keys, userEmail, require_types.KeystoreType.ENCRYPTION);
+		const encryptionKeystore = await encryptKeystoreContent(await deriveEncryptionKeystoreKeyFromMnemonic(mnemonic), keys, userEmail, require_types.KeystoreType.ENCRYPTION);
 		const recoveryCodes = require_genID.genMnemonic();
 		return {
 			encryptionKeystore,
 			recoveryKeystore: await encryptKeystoreContent(await deriveRecoveryKey(recoveryCodes), keys, userEmail, require_types.KeystoreType.RECOVERY),
 			recoveryCodes,
-			keys,
-			salt
+			keys
 		};
 	} catch (error) {
 		throw new FailedToCreateKeyStores(error instanceof Error ? error.message : String(error));
@@ -140,18 +129,18 @@ async function createEncryptionAndRecoveryKeystores(userEmail, password) {
 }
 /**
 * Opens the encryption keystore and returns the email encryption keys
-* The decryption key is derived from the user password
+* The decryption key is derived from the user mnemonic
 *
 * @param encryptedKeystore - The encrypted keystore containing encryption keys
-* @param password - The user's password
-* @param salt - The keystore's salt
+* @param mnemonic - The user's mnemonic
 * @returns The encryption keys
 */
-async function openEncryptionKeystore(encryptedKeystore, password, salt) {
+async function openEncryptionKeystore(encryptedKeystore, mnemonic) {
 	try {
-		if (encryptedKeystore.type !== require_types.KeystoreType.ENCRYPTION) throw new Error("Input is invalid");
-		return await decryptKeystoreContent(await deriveEncryptionKeystoreKey(password, salt), encryptedKeystore);
+		if (encryptedKeystore.type !== require_types.KeystoreType.ENCRYPTION) throw new InvalidInputKeyStore();
+		return await decryptKeystoreContent(await deriveEncryptionKeystoreKeyFromMnemonic(mnemonic), encryptedKeystore);
 	} catch (error) {
+		if (error instanceof InvalidInputKeyStore) throw error;
 		throw new FailedToOpenEncryptionKeyStore(error instanceof Error ? error.message : String(error));
 	}
 }
@@ -165,42 +154,40 @@ async function openEncryptionKeystore(encryptedKeystore, password, salt) {
 */
 async function openRecoveryKeystore(recoveryCodes, encryptedKeystore) {
 	try {
-		if (encryptedKeystore.type !== require_types.KeystoreType.RECOVERY) throw new Error("Input is invalid");
+		if (encryptedKeystore.type !== require_types.KeystoreType.RECOVERY) throw new InvalidInputKeyStore();
 		return await decryptKeystoreContent(await deriveRecoveryKey(recoveryCodes), encryptedKeystore);
 	} catch (error) {
+		if (error instanceof InvalidInputKeyStore) throw error;
 		throw new FailedToOpenRecoveryKeyStore(error instanceof Error ? error.message : String(error));
 	}
 }
 /**
-* Re-encrypts the encryption keystore with a new password
-* The decryption key is derived from the user password
+* Re-encrypts the encryption keystore with a new mnemonic
+* The decryption key is derived from the user mnemonic
 *
 * @param encryptedKeystore - The encrypted keystore containing encryption keys
-* @param oldPassword - The user's old password
-* @param newPassword - The user's new password
-* @param oldSalt - The keystore's old salt
-* @returns The keys, re-encrypted keystore, and new salt
+* @param oldMnemonic - The user's old mnemonic
+* @param newMnemonic - The user's new mnemonic
+* @returns The keys and new re-encrypted keystore
 */
-async function changePasswordForEncryptionKeystore(encryptedKeystore, oldPassword, newPassword, oldSalt) {
+async function changeMnemonicForEncryptionKeystore(encryptedKeystore, oldMnemonic, newMnemonic) {
 	try {
-		if (encryptedKeystore.type !== require_types.KeystoreType.ENCRYPTION) throw new Error("Input is invalid");
-		const keys = await openEncryptionKeystore(encryptedKeystore, oldPassword, oldSalt);
-		const { secretKey, salt } = await deriveNewEncryptionKeystoreKey(newPassword);
+		const keys = await openEncryptionKeystore(encryptedKeystore, oldMnemonic);
 		return {
-			newKeystore: await encryptKeystoreContent(secretKey, keys, encryptedKeystore.userEmail, require_types.KeystoreType.ENCRYPTION),
-			newSalt: salt,
+			newKeystore: await encryptKeystoreContent(await deriveEncryptionKeystoreKeyFromMnemonic(newMnemonic), keys, encryptedKeystore.userEmail, require_types.KeystoreType.ENCRYPTION),
 			keys
 		};
 	} catch (error) {
-		throw new FailedToChangePasswordForKeyStore(error instanceof Error ? error.message : String(error));
+		if (error instanceof InvalidInputKeyStore) throw error;
+		throw new FailedToChangeMnemonicForKeyStore(error instanceof Error ? error.message : String(error));
 	}
 }
 
 //#endregion
-Object.defineProperty(exports, 'FailedToChangePasswordForKeyStore', {
+Object.defineProperty(exports, 'FailedToChangeMnemonicForKeyStore', {
   enumerable: true,
   get: function () {
-    return FailedToChangePasswordForKeyStore;
+    return FailedToChangeMnemonicForKeyStore;
   }
 });
 Object.defineProperty(exports, 'FailedToCreateKeyStores', {
@@ -221,10 +208,16 @@ Object.defineProperty(exports, 'FailedToOpenRecoveryKeyStore', {
     return FailedToOpenRecoveryKeyStore;
   }
 });
-Object.defineProperty(exports, 'changePasswordForEncryptionKeystore', {
+Object.defineProperty(exports, 'InvalidInputKeyStore', {
+  enumerable: true,
+  get: function () {
+    return InvalidInputKeyStore;
+  }
+});
+Object.defineProperty(exports, 'changeMnemonicForEncryptionKeystore', {
   enumerable: true,
   get: function () {
-    return changePasswordForEncryptionKeystore;
+    return changeMnemonicForEncryptionKeystore;
   }
 });
 Object.defineProperty(exports, 'createEncryptionAndRecoveryKeystores', {
@@ -245,4 +238,4 @@ Object.defineProperty(exports, 'openRecoveryKeystore', {
     return openRecoveryKeystore;
   }
 });
-//# sourceMappingURL=emailEncryptionKey-Cw-vW_Oq.js.map
+//# sourceMappingURL=emailEncryptionKey-Ba95VuFO.js.map

package/dist/emailEncryptionKey-Ba95VuFO.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailEncryptionKey-Ba95VuFO.js","names":["uint8ArrayToBase64","UTF8ToUint8","encryptSymmetrically","base64ToUint8Array","decryptSymmetrically","deriveKeyFromMnemonic","CONTEXT_RECOVERY","CONTEXT_ENC_KEYSTORE","genHybridKeys","KeystoreType","genMnemonic"],"sources":["../src/keystore-crypto/core.ts","../src/keystore-crypto/errors.ts","../src/keystore-crypto/emailEncryptionKey.ts"],"sourcesContent":["import { encryptSymmetrically, decryptSymmetrically } from '../symmetric-crypto';\nimport { base64ToUint8Array, uint8ArrayToBase64, UTF8ToUint8 } from '../utils';\nimport { deriveKeyFromMnemonic } from '../derive-key';\nimport { CONTEXT_ENC_KEYSTORE, CONTEXT_RECOVERY } from '../constants';\nimport { EncryptedKeystore, HybridKeyPair, KeystoreType } from '../types';\n\n/**\n * Encrypts the user's hybrid key using symmetric encryption to get a keystore\n *\n * @param secretKey - The symmetric key to encrypt the keystore content\n * @param key - The hybrid key pair\n * @param userEmail - The email of the user\n * @param type - The keystore type\n * @returns The encrypted keystore\n */\nexport async function encryptKeystoreContent(\n  secretKey: Uint8Array,\n  keys: HybridKeyPair,\n  userEmail: string,\n  type: KeystoreType,\n): Promise<EncryptedKeystore> {\n  try {\n    const publicKey = uint8ArrayToBase64(keys.publicKey);\n\n    const aux = UTF8ToUint8(userEmail + type + publicKey);\n    const secretKeyEncrypted = await encryptSymmetrically(secretKey, keys.secretKey, aux);\n\n    const keystore: EncryptedKeystore = {\n      userEmail,\n      type,\n      publicKey,\n      privateKeyEncrypted: uint8ArrayToBase64(secretKeyEncrypted),\n    };\n    return keystore;\n  } catch (error) {\n    throw new Error('Failed to encrypt keystore content', { cause: error });\n  }\n}\n\n/**\n * Decrypts the keystore content using symmetric encryption\n *\n * @param kesytoreOpeningKey - The symmetric key to decrypt the keystore content\n * @param encryptedKeys - The encrypted keystore content\n * @returns The decrypted hybrid key pair contained in the keystore\n */\nexport async function decryptKeystoreContent(\n  kesytoreOpeningKey: Uint8Array,\n  encryptedKeystore: EncryptedKeystore,\n): Promise<HybridKeyPair> {\n  try {\n    const aux = UTF8ToUint8(encryptedKeystore.userEmail + encryptedKeystore.type + encryptedKeystore.publicKey);\n    const publicKey = base64ToUint8Array(encryptedKeystore.publicKey);\n    const ciphertext = base64ToUint8Array(encryptedKeystore.privateKeyEncrypted);\n    const secretKey = await decryptSymmetrically(kesytoreOpeningKey, ciphertext, aux);\n    return {\n      publicKey,\n      secretKey,\n    };\n  } catch (error) {\n    throw new Error('Failed to decrypt keystore content', { cause: error });\n  }\n}\n\n/**\n * Derives a secret key for protecting the recovery keystore\n *\n * @param recoveryCodes - The recovery codes (machine-generated with secure PRNG)\n * @returns The derived secret key for protecting the recovery keystore\n */\nexport async function deriveRecoveryKey(recoveryCodes: string): Promise<Uint8Array> {\n  return deriveKeyFromMnemonic(recoveryCodes, CONTEXT_RECOVERY);\n}\n\n/**\n * Derives a secret key for protecting the encryption keystore from user's mnemonic\n *\n * @param mnemonic - The user's mnemonic (machine-generated with secure PRNG)\n * @returns The derived secret key for protecting the encryption keystore\n */\nexport async function deriveEncryptionKeystoreKeyFromMnemonic(mnemonic: string): Promise<Uint8Array> {\n  return deriveKeyFromMnemonic(mnemonic, CONTEXT_ENC_KEYSTORE);\n}\n","export class FailedToCreateKeyStores extends Error {\n  constructor(errorMsg?: string) {\n    super('Failed to create encryption and recovery keystores: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToCreateKeyStores.prototype);\n  }\n}\n\nexport class InvalidInputKeyStore extends Error {\n  constructor() {\n    super('Invalid input');\n\n    Object.setPrototypeOf(this, InvalidInputKeyStore.prototype);\n  }\n}\n\nexport class FailedToOpenEncryptionKeyStore extends Error {\n  constructor(errorMsg?: string) {\n    super('Failed to open encryption keystore: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToOpenEncryptionKeyStore.prototype);\n  }\n}\n\nexport class FailedToOpenRecoveryKeyStore extends Error {\n  constructor(errorMsg?: string) {\n    super('Failed to open recovery keystore: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToOpenRecoveryKeyStore.prototype);\n  }\n}\n\nexport class FailedToChangeMnemonicForKeyStore extends Error {\n  constructor(errorMsg?: string) {\n    super('Error while fetching message: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToChangeMnemonicForKeyStore.prototype);\n  }\n}\n","import { EncryptedKeystore, KeystoreType, HybridKeyPair } from '../types';\nimport { genMnemonic } from '../utils';\nimport {\n  encryptKeystoreContent,\n  decryptKeystoreContent,\n  deriveEncryptionKeystoreKeyFromMnemonic,\n  deriveRecoveryKey,\n} from './core';\nimport { genHybridKeys } from '../hybrid-crypto';\nimport {\n  FailedToOpenEncryptionKeyStore,\n  FailedToCreateKeyStores,\n  FailedToOpenRecoveryKeyStore,\n  FailedToChangeMnemonicForKeyStore,\n  InvalidInputKeyStore,\n} from './errors';\n\n/**\n * Generates hybrid keys and creates encrypted main and recovery keystores\n * The main keystore encryption key is derived from the user's mnemonic\n * The recovery keystore encryption key is derived from the recovery codes\n *\n * @param userEmail - The user's email\n * @param mnemonic - The user's mnemonic\n * @returns The encryption keys\n *\n * @returns The encryption and recovery keystores, recovery codes and hybrid keys\n */\nexport async function createEncryptionAndRecoveryKeystores(\n  userEmail: string,\n  mnemonic: string,\n): Promise<{\n  encryptionKeystore: EncryptedKeystore;\n  recoveryKeystore: EncryptedKeystore;\n  recoveryCodes: string;\n  keys: HybridKeyPair;\n}> {\n  try {\n    const keys = genHybridKeys();\n\n    const secretKey = await deriveEncryptionKeystoreKeyFromMnemonic(mnemonic);\n    const encryptionKeystore = await encryptKeystoreContent(secretKey, keys, userEmail, KeystoreType.ENCRYPTION);\n\n    const recoveryCodes = genMnemonic();\n    const recoveryKey = await deriveRecoveryKey(recoveryCodes);\n    const recoveryKeystore = await encryptKeystoreContent(recoveryKey, keys, userEmail, KeystoreType.RECOVERY);\n\n    return { encryptionKeystore, recoveryKeystore, recoveryCodes, keys };\n  } catch (error) {\n    throw new FailedToCreateKeyStores(error instanceof Error ? error.message : String(error));\n  }\n}\n\n/**\n * Opens the encryption keystore and returns the email encryption keys\n * The decryption key is derived from the user mnemonic\n *\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @param mnemonic - The user's mnemonic\n * @returns The encryption keys\n */\nexport async function openEncryptionKeystore(\n  encryptedKeystore: EncryptedKeystore,\n  mnemonic: string,\n): Promise<HybridKeyPair> {\n  try {\n    if (encryptedKeystore.type !== KeystoreType.ENCRYPTION) {\n      throw new InvalidInputKeyStore();\n    }\n    const secretKey = await deriveEncryptionKeystoreKeyFromMnemonic(mnemonic);\n    const keys = await decryptKeystoreContent(secretKey, encryptedKeystore);\n    return keys;\n  } catch (error) {\n    if (error instanceof InvalidInputKeyStore) throw error;\n    throw new FailedToOpenEncryptionKeyStore(error instanceof Error ? error.message : String(error));\n  }\n}\n\n/**\n * Opens the recovery keystore and returns the email encryption keys\n * The decryption key is derived from the recovery codes (machine-generated mnemonic)\n *\n * @param recoveryCodes - The user's recovery codes\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @returns The encryption keys\n */\nexport async function openRecoveryKeystore(\n  recoveryCodes: string,\n  encryptedKeystore: EncryptedKeystore,\n): Promise<HybridKeyPair> {\n  try {\n    if (encryptedKeystore.type !== KeystoreType.RECOVERY) {\n      throw new InvalidInputKeyStore();\n    }\n    const recoveryKey = await deriveRecoveryKey(recoveryCodes);\n    const keys = await decryptKeystoreContent(recoveryKey, encryptedKeystore);\n    return keys;\n  } catch (error) {\n    if (error instanceof InvalidInputKeyStore) throw error;\n    throw new FailedToOpenRecoveryKeyStore(error instanceof Error ? error.message : String(error));\n  }\n}\n\n/**\n * Re-encrypts the encryption keystore with a new mnemonic\n * The decryption key is derived from the user mnemonic\n *\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @param oldMnemonic - The user's old mnemonic\n * @param newMnemonic - The user's new mnemonic\n * @returns The keys and new re-encrypted keystore\n */\nexport async function changeMnemonicForEncryptionKeystore(\n  encryptedKeystore: EncryptedKeystore,\n  oldMnemonic: string,\n  newMnemonic: string,\n): Promise<{ keys: HybridKeyPair; newKeystore: EncryptedKeystore }> {\n  try {\n    const keys = await openEncryptionKeystore(encryptedKeystore, oldMnemonic);\n\n    const secretKey = await deriveEncryptionKeystoreKeyFromMnemonic(newMnemonic);\n    const newKeystore = await encryptKeystoreContent(\n      secretKey,\n      keys,\n      encryptedKeystore.userEmail,\n      KeystoreType.ENCRYPTION,\n    );\n\n    return { newKeystore, keys };\n  } catch (error) {\n    if (error instanceof InvalidInputKeyStore) throw error;\n    throw new FailedToChangeMnemonicForKeyStore(error instanceof Error ? error.message : String(error));\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAeA,eAAsB,uBACpB,WACA,MACA,WACA,MAC4B;AAC5B,KAAI;EACF,MAAM,YAAYA,iCAAmB,KAAK,UAAU;EAEpD,MAAM,MAAMC,0BAAY,YAAY,OAAO,UAAU;AASrD,SANoC;GAClC;GACA;GACA;GACA,qBAAqBD,iCANI,MAAME,iCAAqB,WAAW,KAAK,WAAW,IAAI,CAMxB;GAC5D;UAEM,OAAO;AACd,QAAM,IAAI,MAAM,sCAAsC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;AAW3E,eAAsB,uBACpB,oBACA,mBACwB;AACxB,KAAI;EACF,MAAM,MAAMD,0BAAY,kBAAkB,YAAY,kBAAkB,OAAO,kBAAkB,UAAU;AAI3G,SAAO;GACL,WAJgBE,iCAAmB,kBAAkB,UAAU;GAK/D,WAHgB,MAAMC,iCAAqB,oBAD1BD,iCAAmB,kBAAkB,oBAAoB,EACC,IAAI;GAIhF;UACM,OAAO;AACd,QAAM,IAAI,MAAM,sCAAsC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;AAU3E,eAAsB,kBAAkB,eAA4C;AAClF,QAAOE,qDAAsB,eAAeC,mCAAiB;;;;;;;;AAS/D,eAAsB,wCAAwC,UAAuC;AACnG,QAAOD,qDAAsB,UAAUE,uCAAqB;;;;;ACjF9D,IAAa,0BAAb,MAAa,gCAAgC,MAAM;CACjD,YAAY,UAAmB;AAC7B,QAAM,yDAAyD,SAAS;AAExE,SAAO,eAAe,MAAM,wBAAwB,UAAU;;;AAIlE,IAAa,uBAAb,MAAa,6BAA6B,MAAM;CAC9C,cAAc;AACZ,QAAM,gBAAgB;AAEtB,SAAO,eAAe,MAAM,qBAAqB,UAAU;;;AAI/D,IAAa,iCAAb,MAAa,uCAAuC,MAAM;CACxD,YAAY,UAAmB;AAC7B,QAAM,yCAAyC,SAAS;AAExD,SAAO,eAAe,MAAM,+BAA+B,UAAU;;;AAIzE,IAAa,+BAAb,MAAa,qCAAqC,MAAM;CACtD,YAAY,UAAmB;AAC7B,QAAM,uCAAuC,SAAS;AAEtD,SAAO,eAAe,MAAM,6BAA6B,UAAU;;;AAIvE,IAAa,oCAAb,MAAa,0CAA0C,MAAM;CAC3D,YAAY,UAAmB;AAC7B,QAAM,mCAAmC,SAAS;AAElD,SAAO,eAAe,MAAM,kCAAkC,UAAU;;;;;;;;;;;;;;;;;ACR5E,eAAsB,qCACpB,WACA,UAMC;AACD,KAAI;EACF,MAAM,OAAOC,6BAAe;EAG5B,MAAM,qBAAqB,MAAM,uBADf,MAAM,wCAAwC,SAAS,EACN,MAAM,WAAWC,2BAAa,WAAW;EAE5G,MAAM,gBAAgBC,2BAAa;AAInC,SAAO;GAAE;GAAoB,kBAFJ,MAAM,uBADX,MAAM,kBAAkB,cAAc,EACS,MAAM,WAAWD,2BAAa,SAAS;GAE3D;GAAe;GAAM;UAC7D,OAAO;AACd,QAAM,IAAI,wBAAwB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;;;;;;;;;;AAY7F,eAAsB,uBACpB,mBACA,UACwB;AACxB,KAAI;AACF,MAAI,kBAAkB,SAASA,2BAAa,WAC1C,OAAM,IAAI,sBAAsB;AAIlC,SADa,MAAM,uBADD,MAAM,wCAAwC,SAAS,EACpB,kBAAkB;UAEhE,OAAO;AACd,MAAI,iBAAiB,qBAAsB,OAAM;AACjD,QAAM,IAAI,+BAA+B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;;;;;;;;;;AAYpG,eAAsB,qBACpB,eACA,mBACwB;AACxB,KAAI;AACF,MAAI,kBAAkB,SAASA,2BAAa,SAC1C,OAAM,IAAI,sBAAsB;AAIlC,SADa,MAAM,uBADC,MAAM,kBAAkB,cAAc,EACH,kBAAkB;UAElE,OAAO;AACd,MAAI,iBAAiB,qBAAsB,OAAM;AACjD,QAAM,IAAI,6BAA6B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;;;;;;;;;;;AAalG,eAAsB,oCACpB,mBACA,aACA,aACkE;AAClE,KAAI;EACF,MAAM,OAAO,MAAM,uBAAuB,mBAAmB,YAAY;AAUzE,SAAO;GAAE,aAPW,MAAM,uBADR,MAAM,wCAAwC,YAAY,EAG1E,MACA,kBAAkB,WAClBA,2BAAa,WACd;GAEqB;GAAM;UACrB,OAAO;AACd,MAAI,iBAAiB,qBAAsB,OAAM;AACjD,QAAM,IAAI,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC"}

package/dist/{emailEncryptionKey-D9sk_WKj.mjs → emailEncryptionKey-CYvr26FG.mjs}

@@ -1,7 +1,6 @@
 import { CONTEXT_ENC_KEYSTORE, CONTEXT_RECOVERY } from "./constants.mjs";
 import { a as genMnemonic, c as base64ToUint8Array, s as UTF8ToUint8, u as uint8ArrayToBase64 } from "./genID-D08K7JPr.mjs";
-import { n as deriveSymmetricKeyFromContext, t as deriveKeyFromMnemonic } from "./deriveKeysFromMnemonic-DB0UHE-y.mjs";
-import { n as getKeyFromPassword, r as getKeyFromPasswordAndSalt } from "./deriveKeysFromPassword-DFzo2OII.mjs";
+import { t as deriveKeyFromMnemonic } from "./deriveKeysFromMnemonic-DB0UHE-y.mjs";
 import { n as encryptSymmetrically, t as decryptSymmetrically } from "./aes-B8TA-JKq.mjs";
 import { r as genHybridKeys } from "./xwing-CQmQX6hn.mjs";
 import { KeystoreType } from "./types.mjs";
@@ -18,11 +17,12 @@ import { KeystoreType } from "./types.mjs";
 */
 async function encryptKeystoreContent(secretKey, keys, userEmail, type) {
 	try {
-		const aux = UTF8ToUint8(userEmail + type);
+		const publicKey = uint8ArrayToBase64(keys.publicKey);
+		const aux = UTF8ToUint8(userEmail + type + publicKey);
 		return {
 			userEmail,
 			type,
-			publicKey: uint8ArrayToBase64(keys.publicKey),
+			publicKey,
 			privateKeyEncrypted: uint8ArrayToBase64(await encryptSymmetrically(secretKey, keys.secretKey, aux))
 		};
 	} catch (error) {
@@ -38,7 +38,7 @@ async function encryptKeystoreContent(secretKey, keys, userEmail, type) {
 */
 async function decryptKeystoreContent(kesytoreOpeningKey, encryptedKeystore) {
 	try {
-		const aux = UTF8ToUint8(encryptedKeystore.userEmail + encryptedKeystore.type);
+		const aux = UTF8ToUint8(encryptedKeystore.userEmail + encryptedKeystore.type + encryptedKeystore.publicKey);
 		return {
 			publicKey: base64ToUint8Array(encryptedKeystore.publicKey),
 			secretKey: await decryptSymmetrically(kesytoreOpeningKey, base64ToUint8Array(encryptedKeystore.privateKeyEncrypted), aux)
@@ -57,28 +57,13 @@ async function deriveRecoveryKey(recoveryCodes) {
 	return deriveKeyFromMnemonic(recoveryCodes, CONTEXT_RECOVERY);
 }
 /**
-* Derives a secret key for protecting the encryption keystore
+* Derives a secret key for protecting the encryption keystore from user's mnemonic
 *
-* @param password - The user's password
-* @param salt - The keystore salt
+* @param mnemonic - The user's mnemonic (machine-generated with secure PRNG)
 * @returns The derived secret key for protecting the encryption keystore
 */
-async function deriveEncryptionKeystoreKey(password, salt) {
-	return deriveSymmetricKeyFromContext(CONTEXT_ENC_KEYSTORE, await getKeyFromPasswordAndSalt(password, salt));
-}
-/**
-* Derives a secret key for protecting the encryption keystore
-*
-* @param password - The user's password
-* @param salt - The keystore salt
-* @returns The derived secret key for protecting the encryption keystore
-*/
-async function deriveNewEncryptionKeystoreKey(password) {
-	const { key, salt } = await getKeyFromPassword(password);
-	return {
-		secretKey: deriveSymmetricKeyFromContext(CONTEXT_ENC_KEYSTORE, key),
-		salt
-	};
+async function deriveEncryptionKeystoreKeyFromMnemonic(mnemonic) {
+	return deriveKeyFromMnemonic(mnemonic, CONTEXT_ENC_KEYSTORE);
 }
 
 //#endregion
@@ -89,6 +74,12 @@ var FailedToCreateKeyStores = class FailedToCreateKeyStores extends Error {
 		Object.setPrototypeOf(this, FailedToCreateKeyStores.prototype);
 	}
 };
+var InvalidInputKeyStore = class InvalidInputKeyStore extends Error {
+	constructor() {
+		super("Invalid input");
+		Object.setPrototypeOf(this, InvalidInputKeyStore.prototype);
+	}
+};
 var FailedToOpenEncryptionKeyStore = class FailedToOpenEncryptionKeyStore extends Error {
 	constructor(errorMsg) {
 		super("Failed to open encryption keystore: " + errorMsg);
@@ -101,10 +92,10 @@ var FailedToOpenRecoveryKeyStore = class FailedToOpenRecoveryKeyStore extends Er
 		Object.setPrototypeOf(this, FailedToOpenRecoveryKeyStore.prototype);
 	}
 };
-var FailedToChangePasswordForKeyStore = class FailedToChangePasswordForKeyStore extends Error {
+var FailedToChangeMnemonicForKeyStore = class FailedToChangeMnemonicForKeyStore extends Error {
 	constructor(errorMsg) {
 		super("Error while fetching message: " + errorMsg);
-		Object.setPrototypeOf(this, FailedToChangePasswordForKeyStore.prototype);
+		Object.setPrototypeOf(this, FailedToChangeMnemonicForKeyStore.prototype);
 	}
 };
 
@@ -112,27 +103,25 @@ var FailedToChangePasswordForKeyStore = class FailedToChangePasswordForKeyStore
 //#region src/keystore-crypto/emailEncryptionKey.ts
 /**
 * Generates hybrid keys and creates encrypted main and recovery keystores
-* The main keystore encryption key is derived from the user's password
+* The main keystore encryption key is derived from the user's mnemonic
 * The recovery keystore encryption key is derived from the recovery codes
 *
 * @param userEmail - The user's email
-* @param password - The user's password
+* @param mnemonic - The user's mnemonic
 * @returns The encryption keys
 *
 * @returns The encryption and recovery keystores, recovery codes and hybrid keys
 */
-async function createEncryptionAndRecoveryKeystores(userEmail, password) {
+async function createEncryptionAndRecoveryKeystores(userEmail, mnemonic) {
 	try {
 		const keys = genHybridKeys();
-		const { secretKey, salt } = await deriveNewEncryptionKeystoreKey(password);
-		const encryptionKeystore = await encryptKeystoreContent(secretKey, keys, userEmail, KeystoreType.ENCRYPTION);
+		const encryptionKeystore = await encryptKeystoreContent(await deriveEncryptionKeystoreKeyFromMnemonic(mnemonic), keys, userEmail, KeystoreType.ENCRYPTION);
 		const recoveryCodes = genMnemonic();
 		return {
 			encryptionKeystore,
 			recoveryKeystore: await encryptKeystoreContent(await deriveRecoveryKey(recoveryCodes), keys, userEmail, KeystoreType.RECOVERY),
 			recoveryCodes,
-			keys,
-			salt
+			keys
 		};
 	} catch (error) {
 		throw new FailedToCreateKeyStores(error instanceof Error ? error.message : String(error));
@@ -140,18 +129,18 @@ async function createEncryptionAndRecoveryKeystores(userEmail, password) {
 }
 /**
 * Opens the encryption keystore and returns the email encryption keys
-* The decryption key is derived from the user password
+* The decryption key is derived from the user mnemonic
 *
 * @param encryptedKeystore - The encrypted keystore containing encryption keys
-* @param password - The user's password
-* @param salt - The keystore's salt
+* @param mnemonic - The user's mnemonic
 * @returns The encryption keys
 */
-async function openEncryptionKeystore(encryptedKeystore, password, salt) {
+async function openEncryptionKeystore(encryptedKeystore, mnemonic) {
 	try {
-		if (encryptedKeystore.type !== KeystoreType.ENCRYPTION) throw new Error("Input is invalid");
-		return await decryptKeystoreContent(await deriveEncryptionKeystoreKey(password, salt), encryptedKeystore);
+		if (encryptedKeystore.type !== KeystoreType.ENCRYPTION) throw new InvalidInputKeyStore();
+		return await decryptKeystoreContent(await deriveEncryptionKeystoreKeyFromMnemonic(mnemonic), encryptedKeystore);
 	} catch (error) {
+		if (error instanceof InvalidInputKeyStore) throw error;
 		throw new FailedToOpenEncryptionKeyStore(error instanceof Error ? error.message : String(error));
 	}
 }
@@ -165,37 +154,35 @@ async function openEncryptionKeystore(encryptedKeystore, password, salt) {
 */
 async function openRecoveryKeystore(recoveryCodes, encryptedKeystore) {
 	try {
-		if (encryptedKeystore.type !== KeystoreType.RECOVERY) throw new Error("Input is invalid");
+		if (encryptedKeystore.type !== KeystoreType.RECOVERY) throw new InvalidInputKeyStore();
 		return await decryptKeystoreContent(await deriveRecoveryKey(recoveryCodes), encryptedKeystore);
 	} catch (error) {
+		if (error instanceof InvalidInputKeyStore) throw error;
 		throw new FailedToOpenRecoveryKeyStore(error instanceof Error ? error.message : String(error));
 	}
 }
 /**
-* Re-encrypts the encryption keystore with a new password
-* The decryption key is derived from the user password
+* Re-encrypts the encryption keystore with a new mnemonic
+* The decryption key is derived from the user mnemonic
 *
 * @param encryptedKeystore - The encrypted keystore containing encryption keys
-* @param oldPassword - The user's old password
-* @param newPassword - The user's new password
-* @param oldSalt - The keystore's old salt
-* @returns The keys, re-encrypted keystore, and new salt
+* @param oldMnemonic - The user's old mnemonic
+* @param newMnemonic - The user's new mnemonic
+* @returns The keys and new re-encrypted keystore
 */
-async function changePasswordForEncryptionKeystore(encryptedKeystore, oldPassword, newPassword, oldSalt) {
+async function changeMnemonicForEncryptionKeystore(encryptedKeystore, oldMnemonic, newMnemonic) {
 	try {
-		if (encryptedKeystore.type !== KeystoreType.ENCRYPTION) throw new Error("Input is invalid");
-		const keys = await openEncryptionKeystore(encryptedKeystore, oldPassword, oldSalt);
-		const { secretKey, salt } = await deriveNewEncryptionKeystoreKey(newPassword);
+		const keys = await openEncryptionKeystore(encryptedKeystore, oldMnemonic);
 		return {
-			newKeystore: await encryptKeystoreContent(secretKey, keys, encryptedKeystore.userEmail, KeystoreType.ENCRYPTION),
-			newSalt: salt,
+			newKeystore: await encryptKeystoreContent(await deriveEncryptionKeystoreKeyFromMnemonic(newMnemonic), keys, encryptedKeystore.userEmail, KeystoreType.ENCRYPTION),
 			keys
 		};
 	} catch (error) {
-		throw new FailedToChangePasswordForKeyStore(error instanceof Error ? error.message : String(error));
+		if (error instanceof InvalidInputKeyStore) throw error;
+		throw new FailedToChangeMnemonicForKeyStore(error instanceof Error ? error.message : String(error));
 	}
 }
 
 //#endregion
-export { FailedToChangePasswordForKeyStore as a, FailedToOpenRecoveryKeyStore as c, openRecoveryKeystore as i, createEncryptionAndRecoveryKeystores as n, FailedToCreateKeyStores as o, openEncryptionKeystore as r, FailedToOpenEncryptionKeyStore as s, changePasswordForEncryptionKeystore as t };
-//# sourceMappingURL=emailEncryptionKey-D9sk_WKj.mjs.map
+export { FailedToChangeMnemonicForKeyStore as a, FailedToOpenRecoveryKeyStore as c, openRecoveryKeystore as i, InvalidInputKeyStore as l, createEncryptionAndRecoveryKeystores as n, FailedToCreateKeyStores as o, openEncryptionKeystore as r, FailedToOpenEncryptionKeyStore as s, changeMnemonicForEncryptionKeystore as t };
+//# sourceMappingURL=emailEncryptionKey-CYvr26FG.mjs.map

package/dist/emailEncryptionKey-CYvr26FG.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailEncryptionKey-CYvr26FG.mjs","names":[],"sources":["../src/keystore-crypto/core.ts","../src/keystore-crypto/errors.ts","../src/keystore-crypto/emailEncryptionKey.ts"],"sourcesContent":["import { encryptSymmetrically, decryptSymmetrically } from '../symmetric-crypto';\nimport { base64ToUint8Array, uint8ArrayToBase64, UTF8ToUint8 } from '../utils';\nimport { deriveKeyFromMnemonic } from '../derive-key';\nimport { CONTEXT_ENC_KEYSTORE, CONTEXT_RECOVERY } from '../constants';\nimport { EncryptedKeystore, HybridKeyPair, KeystoreType } from '../types';\n\n/**\n * Encrypts the user's hybrid key using symmetric encryption to get a keystore\n *\n * @param secretKey - The symmetric key to encrypt the keystore content\n * @param key - The hybrid key pair\n * @param userEmail - The email of the user\n * @param type - The keystore type\n * @returns The encrypted keystore\n */\nexport async function encryptKeystoreContent(\n  secretKey: Uint8Array,\n  keys: HybridKeyPair,\n  userEmail: string,\n  type: KeystoreType,\n): Promise<EncryptedKeystore> {\n  try {\n    const publicKey = uint8ArrayToBase64(keys.publicKey);\n\n    const aux = UTF8ToUint8(userEmail + type + publicKey);\n    const secretKeyEncrypted = await encryptSymmetrically(secretKey, keys.secretKey, aux);\n\n    const keystore: EncryptedKeystore = {\n      userEmail,\n      type,\n      publicKey,\n      privateKeyEncrypted: uint8ArrayToBase64(secretKeyEncrypted),\n    };\n    return keystore;\n  } catch (error) {\n    throw new Error('Failed to encrypt keystore content', { cause: error });\n  }\n}\n\n/**\n * Decrypts the keystore content using symmetric encryption\n *\n * @param kesytoreOpeningKey - The symmetric key to decrypt the keystore content\n * @param encryptedKeys - The encrypted keystore content\n * @returns The decrypted hybrid key pair contained in the keystore\n */\nexport async function decryptKeystoreContent(\n  kesytoreOpeningKey: Uint8Array,\n  encryptedKeystore: EncryptedKeystore,\n): Promise<HybridKeyPair> {\n  try {\n    const aux = UTF8ToUint8(encryptedKeystore.userEmail + encryptedKeystore.type + encryptedKeystore.publicKey);\n    const publicKey = base64ToUint8Array(encryptedKeystore.publicKey);\n    const ciphertext = base64ToUint8Array(encryptedKeystore.privateKeyEncrypted);\n    const secretKey = await decryptSymmetrically(kesytoreOpeningKey, ciphertext, aux);\n    return {\n      publicKey,\n      secretKey,\n    };\n  } catch (error) {\n    throw new Error('Failed to decrypt keystore content', { cause: error });\n  }\n}\n\n/**\n * Derives a secret key for protecting the recovery keystore\n *\n * @param recoveryCodes - The recovery codes (machine-generated with secure PRNG)\n * @returns The derived secret key for protecting the recovery keystore\n */\nexport async function deriveRecoveryKey(recoveryCodes: string): Promise<Uint8Array> {\n  return deriveKeyFromMnemonic(recoveryCodes, CONTEXT_RECOVERY);\n}\n\n/**\n * Derives a secret key for protecting the encryption keystore from user's mnemonic\n *\n * @param mnemonic - The user's mnemonic (machine-generated with secure PRNG)\n * @returns The derived secret key for protecting the encryption keystore\n */\nexport async function deriveEncryptionKeystoreKeyFromMnemonic(mnemonic: string): Promise<Uint8Array> {\n  return deriveKeyFromMnemonic(mnemonic, CONTEXT_ENC_KEYSTORE);\n}\n","export class FailedToCreateKeyStores extends Error {\n  constructor(errorMsg?: string) {\n    super('Failed to create encryption and recovery keystores: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToCreateKeyStores.prototype);\n  }\n}\n\nexport class InvalidInputKeyStore extends Error {\n  constructor() {\n    super('Invalid input');\n\n    Object.setPrototypeOf(this, InvalidInputKeyStore.prototype);\n  }\n}\n\nexport class FailedToOpenEncryptionKeyStore extends Error {\n  constructor(errorMsg?: string) {\n    super('Failed to open encryption keystore: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToOpenEncryptionKeyStore.prototype);\n  }\n}\n\nexport class FailedToOpenRecoveryKeyStore extends Error {\n  constructor(errorMsg?: string) {\n    super('Failed to open recovery keystore: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToOpenRecoveryKeyStore.prototype);\n  }\n}\n\nexport class FailedToChangeMnemonicForKeyStore extends Error {\n  constructor(errorMsg?: string) {\n    super('Error while fetching message: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToChangeMnemonicForKeyStore.prototype);\n  }\n}\n","import { EncryptedKeystore, KeystoreType, HybridKeyPair } from '../types';\nimport { genMnemonic } from '../utils';\nimport {\n  encryptKeystoreContent,\n  decryptKeystoreContent,\n  deriveEncryptionKeystoreKeyFromMnemonic,\n  deriveRecoveryKey,\n} from './core';\nimport { genHybridKeys } from '../hybrid-crypto';\nimport {\n  FailedToOpenEncryptionKeyStore,\n  FailedToCreateKeyStores,\n  FailedToOpenRecoveryKeyStore,\n  FailedToChangeMnemonicForKeyStore,\n  InvalidInputKeyStore,\n} from './errors';\n\n/**\n * Generates hybrid keys and creates encrypted main and recovery keystores\n * The main keystore encryption key is derived from the user's mnemonic\n * The recovery keystore encryption key is derived from the recovery codes\n *\n * @param userEmail - The user's email\n * @param mnemonic - The user's mnemonic\n * @returns The encryption keys\n *\n * @returns The encryption and recovery keystores, recovery codes and hybrid keys\n */\nexport async function createEncryptionAndRecoveryKeystores(\n  userEmail: string,\n  mnemonic: string,\n): Promise<{\n  encryptionKeystore: EncryptedKeystore;\n  recoveryKeystore: EncryptedKeystore;\n  recoveryCodes: string;\n  keys: HybridKeyPair;\n}> {\n  try {\n    const keys = genHybridKeys();\n\n    const secretKey = await deriveEncryptionKeystoreKeyFromMnemonic(mnemonic);\n    const encryptionKeystore = await encryptKeystoreContent(secretKey, keys, userEmail, KeystoreType.ENCRYPTION);\n\n    const recoveryCodes = genMnemonic();\n    const recoveryKey = await deriveRecoveryKey(recoveryCodes);\n    const recoveryKeystore = await encryptKeystoreContent(recoveryKey, keys, userEmail, KeystoreType.RECOVERY);\n\n    return { encryptionKeystore, recoveryKeystore, recoveryCodes, keys };\n  } catch (error) {\n    throw new FailedToCreateKeyStores(error instanceof Error ? error.message : String(error));\n  }\n}\n\n/**\n * Opens the encryption keystore and returns the email encryption keys\n * The decryption key is derived from the user mnemonic\n *\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @param mnemonic - The user's mnemonic\n * @returns The encryption keys\n */\nexport async function openEncryptionKeystore(\n  encryptedKeystore: EncryptedKeystore,\n  mnemonic: string,\n): Promise<HybridKeyPair> {\n  try {\n    if (encryptedKeystore.type !== KeystoreType.ENCRYPTION) {\n      throw new InvalidInputKeyStore();\n    }\n    const secretKey = await deriveEncryptionKeystoreKeyFromMnemonic(mnemonic);\n    const keys = await decryptKeystoreContent(secretKey, encryptedKeystore);\n    return keys;\n  } catch (error) {\n    if (error instanceof InvalidInputKeyStore) throw error;\n    throw new FailedToOpenEncryptionKeyStore(error instanceof Error ? error.message : String(error));\n  }\n}\n\n/**\n * Opens the recovery keystore and returns the email encryption keys\n * The decryption key is derived from the recovery codes (machine-generated mnemonic)\n *\n * @param recoveryCodes - The user's recovery codes\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @returns The encryption keys\n */\nexport async function openRecoveryKeystore(\n  recoveryCodes: string,\n  encryptedKeystore: EncryptedKeystore,\n): Promise<HybridKeyPair> {\n  try {\n    if (encryptedKeystore.type !== KeystoreType.RECOVERY) {\n      throw new InvalidInputKeyStore();\n    }\n    const recoveryKey = await deriveRecoveryKey(recoveryCodes);\n    const keys = await decryptKeystoreContent(recoveryKey, encryptedKeystore);\n    return keys;\n  } catch (error) {\n    if (error instanceof InvalidInputKeyStore) throw error;\n    throw new FailedToOpenRecoveryKeyStore(error instanceof Error ? error.message : String(error));\n  }\n}\n\n/**\n * Re-encrypts the encryption keystore with a new mnemonic\n * The decryption key is derived from the user mnemonic\n *\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @param oldMnemonic - The user's old mnemonic\n * @param newMnemonic - The user's new mnemonic\n * @returns The keys and new re-encrypted keystore\n */\nexport async function changeMnemonicForEncryptionKeystore(\n  encryptedKeystore: EncryptedKeystore,\n  oldMnemonic: string,\n  newMnemonic: string,\n): Promise<{ keys: HybridKeyPair; newKeystore: EncryptedKeystore }> {\n  try {\n    const keys = await openEncryptionKeystore(encryptedKeystore, oldMnemonic);\n\n    const secretKey = await deriveEncryptionKeystoreKeyFromMnemonic(newMnemonic);\n    const newKeystore = await encryptKeystoreContent(\n      secretKey,\n      keys,\n      encryptedKeystore.userEmail,\n      KeystoreType.ENCRYPTION,\n    );\n\n    return { newKeystore, keys };\n  } catch (error) {\n    if (error instanceof InvalidInputKeyStore) throw error;\n    throw new FailedToChangeMnemonicForKeyStore(error instanceof Error ? error.message : String(error));\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAeA,eAAsB,uBACpB,WACA,MACA,WACA,MAC4B;AAC5B,KAAI;EACF,MAAM,YAAY,mBAAmB,KAAK,UAAU;EAEpD,MAAM,MAAM,YAAY,YAAY,OAAO,UAAU;AASrD,SANoC;GAClC;GACA;GACA;GACA,qBAAqB,mBANI,MAAM,qBAAqB,WAAW,KAAK,WAAW,IAAI,CAMxB;GAC5D;UAEM,OAAO;AACd,QAAM,IAAI,MAAM,sCAAsC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;AAW3E,eAAsB,uBACpB,oBACA,mBACwB;AACxB,KAAI;EACF,MAAM,MAAM,YAAY,kBAAkB,YAAY,kBAAkB,OAAO,kBAAkB,UAAU;AAI3G,SAAO;GACL,WAJgB,mBAAmB,kBAAkB,UAAU;GAK/D,WAHgB,MAAM,qBAAqB,oBAD1B,mBAAmB,kBAAkB,oBAAoB,EACC,IAAI;GAIhF;UACM,OAAO;AACd,QAAM,IAAI,MAAM,sCAAsC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;AAU3E,eAAsB,kBAAkB,eAA4C;AAClF,QAAO,sBAAsB,eAAe,iBAAiB;;;;;;;;AAS/D,eAAsB,wCAAwC,UAAuC;AACnG,QAAO,sBAAsB,UAAU,qBAAqB;;;;;ACjF9D,IAAa,0BAAb,MAAa,gCAAgC,MAAM;CACjD,YAAY,UAAmB;AAC7B,QAAM,yDAAyD,SAAS;AAExE,SAAO,eAAe,MAAM,wBAAwB,UAAU;;;AAIlE,IAAa,uBAAb,MAAa,6BAA6B,MAAM;CAC9C,cAAc;AACZ,QAAM,gBAAgB;AAEtB,SAAO,eAAe,MAAM,qBAAqB,UAAU;;;AAI/D,IAAa,iCAAb,MAAa,uCAAuC,MAAM;CACxD,YAAY,UAAmB;AAC7B,QAAM,yCAAyC,SAAS;AAExD,SAAO,eAAe,MAAM,+BAA+B,UAAU;;;AAIzE,IAAa,+BAAb,MAAa,qCAAqC,MAAM;CACtD,YAAY,UAAmB;AAC7B,QAAM,uCAAuC,SAAS;AAEtD,SAAO,eAAe,MAAM,6BAA6B,UAAU;;;AAIvE,IAAa,oCAAb,MAAa,0CAA0C,MAAM;CAC3D,YAAY,UAAmB;AAC7B,QAAM,mCAAmC,SAAS;AAElD,SAAO,eAAe,MAAM,kCAAkC,UAAU;;;;;;;;;;;;;;;;;ACR5E,eAAsB,qCACpB,WACA,UAMC;AACD,KAAI;EACF,MAAM,OAAO,eAAe;EAG5B,MAAM,qBAAqB,MAAM,uBADf,MAAM,wCAAwC,SAAS,EACN,MAAM,WAAW,aAAa,WAAW;EAE5G,MAAM,gBAAgB,aAAa;AAInC,SAAO;GAAE;GAAoB,kBAFJ,MAAM,uBADX,MAAM,kBAAkB,cAAc,EACS,MAAM,WAAW,aAAa,SAAS;GAE3D;GAAe;GAAM;UAC7D,OAAO;AACd,QAAM,IAAI,wBAAwB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;;;;;;;;;;AAY7F,eAAsB,uBACpB,mBACA,UACwB;AACxB,KAAI;AACF,MAAI,kBAAkB,SAAS,aAAa,WAC1C,OAAM,IAAI,sBAAsB;AAIlC,SADa,MAAM,uBADD,MAAM,wCAAwC,SAAS,EACpB,kBAAkB;UAEhE,OAAO;AACd,MAAI,iBAAiB,qBAAsB,OAAM;AACjD,QAAM,IAAI,+BAA+B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;;;;;;;;;;AAYpG,eAAsB,qBACpB,eACA,mBACwB;AACxB,KAAI;AACF,MAAI,kBAAkB,SAAS,aAAa,SAC1C,OAAM,IAAI,sBAAsB;AAIlC,SADa,MAAM,uBADC,MAAM,kBAAkB,cAAc,EACH,kBAAkB;UAElE,OAAO;AACd,MAAI,iBAAiB,qBAAsB,OAAM;AACjD,QAAM,IAAI,6BAA6B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;;;;;;;;;;;AAalG,eAAsB,oCACpB,mBACA,aACA,aACkE;AAClE,KAAI;EACF,MAAM,OAAO,MAAM,uBAAuB,mBAAmB,YAAY;AAUzE,SAAO;GAAE,aAPW,MAAM,uBADR,MAAM,wCAAwC,YAAY,EAG1E,MACA,kBAAkB,WAClB,aAAa,WACd;GAEqB;GAAM;UACrB,OAAO;AACd,MAAI,iBAAiB,qBAAsB,OAAM;AACjD,QAAM,IAAI,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC"}

package/dist/index.d.mts

@@ -5,7 +5,7 @@ import { generateSalt, getKeyFromPassword, getKeyFromPasswordAndSalt } from "./d
 import { EmailBody, EmailBodyEncrypted, EncryptedKeystore, HybridEncKey, HybridEncryptedEmail, HybridKeyPair, KeystoreType, PwdProtectedEmail, PwdProtectedKey, RecipientWithPublicKey } from "./types.mjs";
 import { createPwdProtectedEmail, decryptEmailBody, decryptEmailHybrid, decryptPwdProtectedEmail, deriveDatabaseKey, deriveEmailDraftKey, encryptEmailBody, encryptEmailBodyWithKey, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, generateEmailKeys } from "./email-crypto.mjs";
 import { getBytesFromData, getBytesFromDataArray, hashData, hashDataArray, hashDataArrayWithKey, hashDataWithKey } from "./hash.mjs";
-import { FailedToChangePasswordForKeyStore, FailedToCreateKeyStores, FailedToOpenEncryptionKeyStore, FailedToOpenRecoveryKeyStore, changePasswordForEncryptionKeystore, createEncryptionAndRecoveryKeystores, openEncryptionKeystore, openRecoveryKeystore } from "./keystore-crypto.mjs";
+import { FailedToChangeMnemonicForKeyStore, FailedToCreateKeyStores, FailedToOpenEncryptionKeyStore, FailedToOpenRecoveryKeyStore, InvalidInputKeyStore, changeMnemonicForEncryptionKeystore, createEncryptionAndRecoveryKeystores, openEncryptionKeystore, openRecoveryKeystore } from "./keystore-crypto.mjs";
 import { decapsulateKyber, encapsulateKyber, generateKyberKeys } from "./post-quantum-crypto.mjs";
 import { decryptSymmetrically, encryptSymmetrically, genSymmetricKey } from "./symmetric-crypto.mjs";
 import { UTF8ToUint8, base64ToUint8Array, bytesToMnemonic, bytesToUuid, genMnemonic, generateUuid, hexToUint8Array, mnemonicToBytes, uint8ArrayToBase64, uint8ArrayToHex, uint8ToUTF8, uuidToBytes } from "./utils.mjs";
@@ -28,5 +28,5 @@ declare function unwrapKey(encryptedKey: Uint8Array, wrappingKey: Uint8Array): P
  */
 declare function wrapKey(key: Uint8Array, wrappingKey: Uint8Array): Promise<Uint8Array>;
 //#endregion
-export { AES_KEY_BYTE_LENGTH, ARGON2ID_ITERATIONS, ARGON2ID_MEMORY_SIZE, ARGON2ID_OUTPUT_BYTE_LENGTH, ARGON2ID_PARALLELISM, ARGON2ID_SALT_BYTE_LENGTH, CONTEXT_DATABASE, CONTEXT_DRAFT, CONTEXT_ENC_KEYSTORE, CONTEXT_RECOVERY, CONTEXT_TWO_KEYS, DB_LABEL, DB_VERSION, EmailBody, EmailBodyEncrypted, EncryptedKeystore, FailedToChangePasswordForKeyStore, FailedToCreateKeyStores, FailedToOpenEncryptionKeyStore, FailedToOpenRecoveryKeyStore, HybridEncKey, HybridEncryptedEmail, HybridKeyPair, IV_LEN_BYTES, KYBER768_PUBLIC_KEY_LENGTH, KYBER768_SECRET_KEY_LENGTH, KYBER_SEED_LENGTH, KeystoreType, MAX_CACHE_SIZE, MAX_EMAIL_PER_BATCH, PwdProtectedEmail, PwdProtectedKey, RecipientWithPublicKey, UTF8ToUint8, XWING_CIPHERTEXT_BYTE_LENGTH, XWING_PUBLIC_KEY_LENGTH, XWING_SECRET_KEY_LENGTH, XWING_SEED_BYTE_LENGTH, base64ToUint8Array, bytesToMnemonic, bytesToUuid, changePasswordForEncryptionKeystore, createEncryptionAndRecoveryKeystores, createPwdProtectedEmail, decapsulateKyber, decryptEmailBody, decryptEmailHybrid, decryptPwdProtectedEmail, decryptSymmetrically, deriveDatabaseKey, deriveEmailDraftKey, deriveKeyFromMnemonic, deriveSecretKey, deriveSymmetricKeyFromContext, deriveSymmetricKeyFromTwoKeys, encapsulateKyber, encryptEmailBody, encryptEmailBodyWithKey, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, encryptSymmetrically, genMnemonic, genSymmetricKey, generateEccKeys, generateEmailKeys, generateKyberKeys, generateSalt, generateUuid, getBytesFromData, getBytesFromDataArray, getKeyFromPassword, getKeyFromPasswordAndSalt, hashData, hashDataArray, hashDataArrayWithKey, hashDataWithKey, hexToUint8Array, mnemonicToBytes, openEncryptionKeystore, openRecoveryKeystore, uint8ArrayToBase64, uint8ArrayToHex, uint8ToUTF8, unwrapKey, uuidToBytes, wrapKey };
+export { AES_KEY_BYTE_LENGTH, ARGON2ID_ITERATIONS, ARGON2ID_MEMORY_SIZE, ARGON2ID_OUTPUT_BYTE_LENGTH, ARGON2ID_PARALLELISM, ARGON2ID_SALT_BYTE_LENGTH, CONTEXT_DATABASE, CONTEXT_DRAFT, CONTEXT_ENC_KEYSTORE, CONTEXT_RECOVERY, CONTEXT_TWO_KEYS, DB_LABEL, DB_VERSION, EmailBody, EmailBodyEncrypted, EncryptedKeystore, FailedToChangeMnemonicForKeyStore, FailedToCreateKeyStores, FailedToOpenEncryptionKeyStore, FailedToOpenRecoveryKeyStore, HybridEncKey, HybridEncryptedEmail, HybridKeyPair, IV_LEN_BYTES, InvalidInputKeyStore, KYBER768_PUBLIC_KEY_LENGTH, KYBER768_SECRET_KEY_LENGTH, KYBER_SEED_LENGTH, KeystoreType, MAX_CACHE_SIZE, MAX_EMAIL_PER_BATCH, PwdProtectedEmail, PwdProtectedKey, RecipientWithPublicKey, UTF8ToUint8, XWING_CIPHERTEXT_BYTE_LENGTH, XWING_PUBLIC_KEY_LENGTH, XWING_SECRET_KEY_LENGTH, XWING_SEED_BYTE_LENGTH, base64ToUint8Array, bytesToMnemonic, bytesToUuid, changeMnemonicForEncryptionKeystore, createEncryptionAndRecoveryKeystores, createPwdProtectedEmail, decapsulateKyber, decryptEmailBody, decryptEmailHybrid, decryptPwdProtectedEmail, decryptSymmetrically, deriveDatabaseKey, deriveEmailDraftKey, deriveKeyFromMnemonic, deriveSecretKey, deriveSymmetricKeyFromContext, deriveSymmetricKeyFromTwoKeys, encapsulateKyber, encryptEmailBody, encryptEmailBodyWithKey, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, encryptSymmetrically, genMnemonic, genSymmetricKey, generateEccKeys, generateEmailKeys, generateKyberKeys, generateSalt, generateUuid, getBytesFromData, getBytesFromDataArray, getKeyFromPassword, getKeyFromPasswordAndSalt, hashData, hashDataArray, hashDataArrayWithKey, hashDataWithKey, hexToUint8Array, mnemonicToBytes, openEncryptionKeystore, openRecoveryKeystore, uint8ArrayToBase64, uint8ArrayToHex, uint8ToUTF8, unwrapKey, uuidToBytes, wrapKey };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.ts

@@ -5,7 +5,7 @@ import { generateSalt, getKeyFromPassword, getKeyFromPasswordAndSalt } from "./d
 import { EmailBody, EmailBodyEncrypted, EncryptedKeystore, HybridEncKey, HybridEncryptedEmail, HybridKeyPair, KeystoreType, PwdProtectedEmail, PwdProtectedKey, RecipientWithPublicKey } from "./types.js";
 import { createPwdProtectedEmail, decryptEmailBody, decryptEmailHybrid, decryptPwdProtectedEmail, deriveDatabaseKey, deriveEmailDraftKey, encryptEmailBody, encryptEmailBodyWithKey, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, generateEmailKeys } from "./email-crypto.js";
 import { getBytesFromData, getBytesFromDataArray, hashData, hashDataArray, hashDataArrayWithKey, hashDataWithKey } from "./hash.js";
-import { FailedToChangePasswordForKeyStore, FailedToCreateKeyStores, FailedToOpenEncryptionKeyStore, FailedToOpenRecoveryKeyStore, changePasswordForEncryptionKeystore, createEncryptionAndRecoveryKeystores, openEncryptionKeystore, openRecoveryKeystore } from "./keystore-crypto.js";
+import { FailedToChangeMnemonicForKeyStore, FailedToCreateKeyStores, FailedToOpenEncryptionKeyStore, FailedToOpenRecoveryKeyStore, InvalidInputKeyStore, changeMnemonicForEncryptionKeystore, createEncryptionAndRecoveryKeystores, openEncryptionKeystore, openRecoveryKeystore } from "./keystore-crypto.js";
 import { decapsulateKyber, encapsulateKyber, generateKyberKeys } from "./post-quantum-crypto.js";
 import { decryptSymmetrically, encryptSymmetrically, genSymmetricKey } from "./symmetric-crypto.js";
 import { UTF8ToUint8, base64ToUint8Array, bytesToMnemonic, bytesToUuid, genMnemonic, generateUuid, hexToUint8Array, mnemonicToBytes, uint8ArrayToBase64, uint8ArrayToHex, uint8ToUTF8, uuidToBytes } from "./utils.js";
@@ -28,5 +28,5 @@ declare function unwrapKey(encryptedKey: Uint8Array, wrappingKey: Uint8Array): P
  */
 declare function wrapKey(key: Uint8Array, wrappingKey: Uint8Array): Promise<Uint8Array>;
 //#endregion
-export { AES_KEY_BYTE_LENGTH, ARGON2ID_ITERATIONS, ARGON2ID_MEMORY_SIZE, ARGON2ID_OUTPUT_BYTE_LENGTH, ARGON2ID_PARALLELISM, ARGON2ID_SALT_BYTE_LENGTH, CONTEXT_DATABASE, CONTEXT_DRAFT, CONTEXT_ENC_KEYSTORE, CONTEXT_RECOVERY, CONTEXT_TWO_KEYS, DB_LABEL, DB_VERSION, EmailBody, EmailBodyEncrypted, EncryptedKeystore, FailedToChangePasswordForKeyStore, FailedToCreateKeyStores, FailedToOpenEncryptionKeyStore, FailedToOpenRecoveryKeyStore, HybridEncKey, HybridEncryptedEmail, HybridKeyPair, IV_LEN_BYTES, KYBER768_PUBLIC_KEY_LENGTH, KYBER768_SECRET_KEY_LENGTH, KYBER_SEED_LENGTH, KeystoreType, MAX_CACHE_SIZE, MAX_EMAIL_PER_BATCH, PwdProtectedEmail, PwdProtectedKey, RecipientWithPublicKey, UTF8ToUint8, XWING_CIPHERTEXT_BYTE_LENGTH, XWING_PUBLIC_KEY_LENGTH, XWING_SECRET_KEY_LENGTH, XWING_SEED_BYTE_LENGTH, base64ToUint8Array, bytesToMnemonic, bytesToUuid, changePasswordForEncryptionKeystore, createEncryptionAndRecoveryKeystores, createPwdProtectedEmail, decapsulateKyber, decryptEmailBody, decryptEmailHybrid, decryptPwdProtectedEmail, decryptSymmetrically, deriveDatabaseKey, deriveEmailDraftKey, deriveKeyFromMnemonic, deriveSecretKey, deriveSymmetricKeyFromContext, deriveSymmetricKeyFromTwoKeys, encapsulateKyber, encryptEmailBody, encryptEmailBodyWithKey, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, encryptSymmetrically, genMnemonic, genSymmetricKey, generateEccKeys, generateEmailKeys, generateKyberKeys, generateSalt, generateUuid, getBytesFromData, getBytesFromDataArray, getKeyFromPassword, getKeyFromPasswordAndSalt, hashData, hashDataArray, hashDataArrayWithKey, hashDataWithKey, hexToUint8Array, mnemonicToBytes, openEncryptionKeystore, openRecoveryKeystore, uint8ArrayToBase64, uint8ArrayToHex, uint8ToUTF8, unwrapKey, uuidToBytes, wrapKey };
+export { AES_KEY_BYTE_LENGTH, ARGON2ID_ITERATIONS, ARGON2ID_MEMORY_SIZE, ARGON2ID_OUTPUT_BYTE_LENGTH, ARGON2ID_PARALLELISM, ARGON2ID_SALT_BYTE_LENGTH, CONTEXT_DATABASE, CONTEXT_DRAFT, CONTEXT_ENC_KEYSTORE, CONTEXT_RECOVERY, CONTEXT_TWO_KEYS, DB_LABEL, DB_VERSION, EmailBody, EmailBodyEncrypted, EncryptedKeystore, FailedToChangeMnemonicForKeyStore, FailedToCreateKeyStores, FailedToOpenEncryptionKeyStore, FailedToOpenRecoveryKeyStore, HybridEncKey, HybridEncryptedEmail, HybridKeyPair, IV_LEN_BYTES, InvalidInputKeyStore, KYBER768_PUBLIC_KEY_LENGTH, KYBER768_SECRET_KEY_LENGTH, KYBER_SEED_LENGTH, KeystoreType, MAX_CACHE_SIZE, MAX_EMAIL_PER_BATCH, PwdProtectedEmail, PwdProtectedKey, RecipientWithPublicKey, UTF8ToUint8, XWING_CIPHERTEXT_BYTE_LENGTH, XWING_PUBLIC_KEY_LENGTH, XWING_SECRET_KEY_LENGTH, XWING_SEED_BYTE_LENGTH, base64ToUint8Array, bytesToMnemonic, bytesToUuid, changeMnemonicForEncryptionKeystore, createEncryptionAndRecoveryKeystores, createPwdProtectedEmail, decapsulateKyber, decryptEmailBody, decryptEmailHybrid, decryptPwdProtectedEmail, decryptSymmetrically, deriveDatabaseKey, deriveEmailDraftKey, deriveKeyFromMnemonic, deriveSecretKey, deriveSymmetricKeyFromContext, deriveSymmetricKeyFromTwoKeys, encapsulateKyber, encryptEmailBody, encryptEmailBodyWithKey, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, encryptSymmetrically, genMnemonic, genSymmetricKey, generateEccKeys, generateEmailKeys, generateKyberKeys, generateSalt, generateUuid, getBytesFromData, getBytesFromDataArray, getKeyFromPassword, getKeyFromPasswordAndSalt, hashData, hashDataArray, hashDataArrayWithKey, hashDataWithKey, hexToUint8Array, mnemonicToBytes, openEncryptionKeystore, openRecoveryKeystore, uint8ArrayToBase64, uint8ArrayToHex, uint8ToUTF8, unwrapKey, uuidToBytes, wrapKey };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -8,7 +8,7 @@ const require_aes = require('./aes-CuW_SPl-.js');
 const require_emailKeys = require('./emailKeys-BFI-paQq.js');
 const require_hash = require('./hash.js');
 const require_types = require('./types.js');
-const require_emailEncryptionKey = require('./emailEncryptionKey-Cw-vW_Oq.js');
+const require_emailEncryptionKey = require('./emailEncryptionKey-Ba95VuFO.js');
 const require_post_quantum_crypto = require('./post-quantum-crypto.js');
 
 exports.AES_KEY_BYTE_LENGTH = require_constants.AES_KEY_BYTE_LENGTH;
@@ -24,11 +24,12 @@ exports.CONTEXT_RECOVERY = require_constants.CONTEXT_RECOVERY;
 exports.CONTEXT_TWO_KEYS = require_constants.CONTEXT_TWO_KEYS;
 exports.DB_LABEL = require_constants.DB_LABEL;
 exports.DB_VERSION = require_constants.DB_VERSION;
-exports.FailedToChangePasswordForKeyStore = require_emailEncryptionKey.FailedToChangePasswordForKeyStore;
+exports.FailedToChangeMnemonicForKeyStore = require_emailEncryptionKey.FailedToChangeMnemonicForKeyStore;
 exports.FailedToCreateKeyStores = require_emailEncryptionKey.FailedToCreateKeyStores;
 exports.FailedToOpenEncryptionKeyStore = require_emailEncryptionKey.FailedToOpenEncryptionKeyStore;
 exports.FailedToOpenRecoveryKeyStore = require_emailEncryptionKey.FailedToOpenRecoveryKeyStore;
 exports.IV_LEN_BYTES = require_constants.IV_LEN_BYTES;
+exports.InvalidInputKeyStore = require_emailEncryptionKey.InvalidInputKeyStore;
 exports.KYBER768_PUBLIC_KEY_LENGTH = require_constants.KYBER768_PUBLIC_KEY_LENGTH;
 exports.KYBER768_SECRET_KEY_LENGTH = require_constants.KYBER768_SECRET_KEY_LENGTH;
 exports.KYBER_SEED_LENGTH = require_constants.KYBER_SEED_LENGTH;
@@ -43,7 +44,7 @@ exports.XWING_SEED_BYTE_LENGTH = require_constants.XWING_SEED_BYTE_LENGTH;
 exports.base64ToUint8Array = require_genID.base64ToUint8Array;
 exports.bytesToMnemonic = require_genID.bytesToMnemonic;
 exports.bytesToUuid = require_genID.bytesToUuid;
-exports.changePasswordForEncryptionKeystore = require_emailEncryptionKey.changePasswordForEncryptionKeystore;
+exports.changeMnemonicForEncryptionKeystore = require_emailEncryptionKey.changeMnemonicForEncryptionKeystore;
 exports.createEncryptionAndRecoveryKeystores = require_emailEncryptionKey.createEncryptionAndRecoveryKeystores;
 exports.createPwdProtectedEmail = require_emailKeys.createPwdProtectedEmail;
 exports.decapsulateKyber = require_post_quantum_crypto.decapsulateKyber;

package/dist/index.mjs

@@ -7,7 +7,7 @@ import { n as encryptSymmetrically, r as genSymmetricKey, t as decryptSymmetrica
 import { _ as wrapKey, a as decryptPwdProtectedEmail, c as encryptEmailHybridForMultipleRecipients, d as encryptEmailBody, f as encryptEmailBodyWithKey, g as unwrapKey, i as createPwdProtectedEmail, l as decryptEmailBody, n as deriveEmailDraftKey, o as decryptEmailHybrid, r as generateEmailKeys, s as encryptEmailHybrid, t as deriveDatabaseKey } from "./emailKeys-BjIeINfC.mjs";
 import { getBytesFromData, getBytesFromDataArray, hashData, hashDataArray, hashDataArrayWithKey, hashDataWithKey } from "./hash.mjs";
 import { KeystoreType } from "./types.mjs";
-import { a as FailedToChangePasswordForKeyStore, c as FailedToOpenRecoveryKeyStore, i as openRecoveryKeystore, n as createEncryptionAndRecoveryKeystores, o as FailedToCreateKeyStores, r as openEncryptionKeystore, s as FailedToOpenEncryptionKeyStore, t as changePasswordForEncryptionKeystore } from "./emailEncryptionKey-D9sk_WKj.mjs";
+import { a as FailedToChangeMnemonicForKeyStore, c as FailedToOpenRecoveryKeyStore, i as openRecoveryKeystore, l as InvalidInputKeyStore, n as createEncryptionAndRecoveryKeystores, o as FailedToCreateKeyStores, r as openEncryptionKeystore, s as FailedToOpenEncryptionKeyStore, t as changeMnemonicForEncryptionKeystore } from "./emailEncryptionKey-CYvr26FG.mjs";
 import { decapsulateKyber, encapsulateKyber, generateKyberKeys } from "./post-quantum-crypto.mjs";
 
-export { AES_KEY_BYTE_LENGTH, ARGON2ID_ITERATIONS, ARGON2ID_MEMORY_SIZE, ARGON2ID_OUTPUT_BYTE_LENGTH, ARGON2ID_PARALLELISM, ARGON2ID_SALT_BYTE_LENGTH, CONTEXT_DATABASE, CONTEXT_DRAFT, CONTEXT_ENC_KEYSTORE, CONTEXT_RECOVERY, CONTEXT_TWO_KEYS, DB_LABEL, DB_VERSION, FailedToChangePasswordForKeyStore, FailedToCreateKeyStores, FailedToOpenEncryptionKeyStore, FailedToOpenRecoveryKeyStore, IV_LEN_BYTES, KYBER768_PUBLIC_KEY_LENGTH, KYBER768_SECRET_KEY_LENGTH, KYBER_SEED_LENGTH, KeystoreType, MAX_CACHE_SIZE, MAX_EMAIL_PER_BATCH, UTF8ToUint8, XWING_CIPHERTEXT_BYTE_LENGTH, XWING_PUBLIC_KEY_LENGTH, XWING_SECRET_KEY_LENGTH, XWING_SEED_BYTE_LENGTH, base64ToUint8Array, bytesToMnemonic, bytesToUuid, changePasswordForEncryptionKeystore, createEncryptionAndRecoveryKeystores, createPwdProtectedEmail, decapsulateKyber, decryptEmailBody, decryptEmailHybrid, decryptPwdProtectedEmail, decryptSymmetrically, deriveDatabaseKey, deriveEmailDraftKey, deriveKeyFromMnemonic, deriveSecretKey, deriveSymmetricKeyFromContext, deriveSymmetricKeyFromTwoKeys, encapsulateKyber, encryptEmailBody, encryptEmailBodyWithKey, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, encryptSymmetrically, genMnemonic, genSymmetricKey, generateEccKeys, generateEmailKeys, generateKyberKeys, generateSalt, generateUuid, getBytesFromData, getBytesFromDataArray, getKeyFromPassword, getKeyFromPasswordAndSalt, hashData, hashDataArray, hashDataArrayWithKey, hashDataWithKey, hexToUint8Array, mnemonicToBytes, openEncryptionKeystore, openRecoveryKeystore, uint8ArrayToBase64, uint8ArrayToHex, uint8ToUTF8, unwrapKey, uuidToBytes, wrapKey };
+export { AES_KEY_BYTE_LENGTH, ARGON2ID_ITERATIONS, ARGON2ID_MEMORY_SIZE, ARGON2ID_OUTPUT_BYTE_LENGTH, ARGON2ID_PARALLELISM, ARGON2ID_SALT_BYTE_LENGTH, CONTEXT_DATABASE, CONTEXT_DRAFT, CONTEXT_ENC_KEYSTORE, CONTEXT_RECOVERY, CONTEXT_TWO_KEYS, DB_LABEL, DB_VERSION, FailedToChangeMnemonicForKeyStore, FailedToCreateKeyStores, FailedToOpenEncryptionKeyStore, FailedToOpenRecoveryKeyStore, IV_LEN_BYTES, InvalidInputKeyStore, KYBER768_PUBLIC_KEY_LENGTH, KYBER768_SECRET_KEY_LENGTH, KYBER_SEED_LENGTH, KeystoreType, MAX_CACHE_SIZE, MAX_EMAIL_PER_BATCH, UTF8ToUint8, XWING_CIPHERTEXT_BYTE_LENGTH, XWING_PUBLIC_KEY_LENGTH, XWING_SECRET_KEY_LENGTH, XWING_SEED_BYTE_LENGTH, base64ToUint8Array, bytesToMnemonic, bytesToUuid, changeMnemonicForEncryptionKeystore, createEncryptionAndRecoveryKeystores, createPwdProtectedEmail, decapsulateKyber, decryptEmailBody, decryptEmailHybrid, decryptPwdProtectedEmail, decryptSymmetrically, deriveDatabaseKey, deriveEmailDraftKey, deriveKeyFromMnemonic, deriveSecretKey, deriveSymmetricKeyFromContext, deriveSymmetricKeyFromTwoKeys, encapsulateKyber, encryptEmailBody, encryptEmailBodyWithKey, encryptEmailHybrid, encryptEmailHybridForMultipleRecipients, encryptSymmetrically, genMnemonic, genSymmetricKey, generateEccKeys, generateEmailKeys, generateKyberKeys, generateSalt, generateUuid, getBytesFromData, getBytesFromDataArray, getKeyFromPassword, getKeyFromPasswordAndSalt, hashData, hashDataArray, hashDataArrayWithKey, hashDataWithKey, hexToUint8Array, mnemonicToBytes, openEncryptionKeystore, openRecoveryKeystore, uint8ArrayToBase64, uint8ArrayToHex, uint8ToUTF8, unwrapKey, uuidToBytes, wrapKey };

package/dist/keystore-crypto.d.mts

@@ -3,32 +3,30 @@ import { EncryptedKeystore, HybridKeyPair } from "./types.mjs";
 //#region src/keystore-crypto/emailEncryptionKey.d.ts
 /**
  * Generates hybrid keys and creates encrypted main and recovery keystores
- * The main keystore encryption key is derived from the user's password
+ * The main keystore encryption key is derived from the user's mnemonic
  * The recovery keystore encryption key is derived from the recovery codes
  *
  * @param userEmail - The user's email
- * @param password - The user's password
+ * @param mnemonic - The user's mnemonic
  * @returns The encryption keys
  *
  * @returns The encryption and recovery keystores, recovery codes and hybrid keys
  */
-declare function createEncryptionAndRecoveryKeystores(userEmail: string, password: string): Promise<{
+declare function createEncryptionAndRecoveryKeystores(userEmail: string, mnemonic: string): Promise<{
   encryptionKeystore: EncryptedKeystore;
   recoveryKeystore: EncryptedKeystore;
   recoveryCodes: string;
   keys: HybridKeyPair;
-  salt: Uint8Array;
 }>;
 /**
  * Opens the encryption keystore and returns the email encryption keys
- * The decryption key is derived from the user password
+ * The decryption key is derived from the user mnemonic
  *
  * @param encryptedKeystore - The encrypted keystore containing encryption keys
- * @param password - The user's password
- * @param salt - The keystore's salt
+ * @param mnemonic - The user's mnemonic
  * @returns The encryption keys
  */
-declare function openEncryptionKeystore(encryptedKeystore: EncryptedKeystore, password: string, salt: Uint8Array): Promise<HybridKeyPair>;
+declare function openEncryptionKeystore(encryptedKeystore: EncryptedKeystore, mnemonic: string): Promise<HybridKeyPair>;
 /**
  * Opens the recovery keystore and returns the email encryption keys
  * The decryption key is derived from the recovery codes (machine-generated mnemonic)
@@ -39,18 +37,16 @@ declare function openEncryptionKeystore(encryptedKeystore: EncryptedKeystore, pa
  */
 declare function openRecoveryKeystore(recoveryCodes: string, encryptedKeystore: EncryptedKeystore): Promise<HybridKeyPair>;
 /**
- * Re-encrypts the encryption keystore with a new password
- * The decryption key is derived from the user password
+ * Re-encrypts the encryption keystore with a new mnemonic
+ * The decryption key is derived from the user mnemonic
  *
  * @param encryptedKeystore - The encrypted keystore containing encryption keys
- * @param oldPassword - The user's old password
- * @param newPassword - The user's new password
- * @param oldSalt - The keystore's old salt
- * @returns The keys, re-encrypted keystore, and new salt
+ * @param oldMnemonic - The user's old mnemonic
+ * @param newMnemonic - The user's new mnemonic
+ * @returns The keys and new re-encrypted keystore
  */
-declare function changePasswordForEncryptionKeystore(encryptedKeystore: EncryptedKeystore, oldPassword: string, newPassword: string, oldSalt: Uint8Array): Promise<{
+declare function changeMnemonicForEncryptionKeystore(encryptedKeystore: EncryptedKeystore, oldMnemonic: string, newMnemonic: string): Promise<{
   keys: HybridKeyPair;
-  newSalt: Uint8Array;
   newKeystore: EncryptedKeystore;
 }>;
 //#endregion
@@ -58,15 +54,18 @@ declare function changePasswordForEncryptionKeystore(encryptedKeystore: Encrypte
 declare class FailedToCreateKeyStores extends Error {
   constructor(errorMsg?: string);
 }
+declare class InvalidInputKeyStore extends Error {
+  constructor();
+}
 declare class FailedToOpenEncryptionKeyStore extends Error {
   constructor(errorMsg?: string);
 }
 declare class FailedToOpenRecoveryKeyStore extends Error {
   constructor(errorMsg?: string);
 }
-declare class FailedToChangePasswordForKeyStore extends Error {
+declare class FailedToChangeMnemonicForKeyStore extends Error {
   constructor(errorMsg?: string);
 }
 //#endregion
-export { FailedToChangePasswordForKeyStore, FailedToCreateKeyStores, FailedToOpenEncryptionKeyStore, FailedToOpenRecoveryKeyStore, changePasswordForEncryptionKeystore, createEncryptionAndRecoveryKeystores, openEncryptionKeystore, openRecoveryKeystore };
+export { FailedToChangeMnemonicForKeyStore, FailedToCreateKeyStores, FailedToOpenEncryptionKeyStore, FailedToOpenRecoveryKeyStore, InvalidInputKeyStore, changeMnemonicForEncryptionKeystore, createEncryptionAndRecoveryKeystores, openEncryptionKeystore, openRecoveryKeystore };
 //# sourceMappingURL=keystore-crypto.d.mts.map

package/dist/keystore-crypto.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"keystore-crypto.d.mts","names":[],"sources":["../src/keystore-crypto/emailEncryptionKey.ts","../src/keystore-crypto/errors.ts"],"mappings":";;;;;AA4BA;;;;;;;;;iBAAsB,oCAAA,CACpB,SAAA,UACA,QAAA,WACC,OAAA;EACD,kBAAA,EAAoB,iBAAA;EACpB,gBAAA,EAAkB,iBAAA;EAClB,aAAA;EACA,IAAA,EAAM,aAAA;EACN,IAAA,EAAM,UAAA;AAAA;;;;;;;;;AA2BR;iBAAsB,sBAAA,CACpB,iBAAA,EAAmB,iBAAA,EACnB,QAAA,UACA,IAAA,EAAM,UAAA,GACL,OAAA,CAAQ,aAAA;;;;;;;;;iBAqBW,oBAAA,CACpB,aAAA,UACA,iBAAA,EAAmB,iBAAA,GAClB,OAAA,CAAQ,aAAA;;;;;;;;AAHX;;;iBA0BsB,mCAAA,CACpB,iBAAA,EAAmB,iBAAA,EACnB,WAAA,UACA,WAAA,UACA,OAAA,EAAS,UAAA,GACR,OAAA;EAAU,IAAA,EAAM,aAAA;EAAe,OAAA,EAAS,UAAA;EAAY,WAAA,EAAa,iBAAA;AAAA;;;cCvHvD,uBAAA,SAAgC,KAAA;cAC/B,QAAA;AAAA;AAAA,cAOD,8BAAA,SAAuC,KAAA;cACtC,QAAA;AAAA;AAAA,cAOD,4BAAA,SAAqC,KAAA;cACpC,QAAA;AAAA;AAAA,cAOD,iCAAA,SAA0C,KAAA;cACzC,QAAA;AAAA"}
+{"version":3,"file":"keystore-crypto.d.mts","names":[],"sources":["../src/keystore-crypto/emailEncryptionKey.ts","../src/keystore-crypto/errors.ts"],"mappings":";;;;;AA4BA;;;;;;;;;iBAAsB,oCAAA,CACpB,SAAA,UACA,QAAA,WACC,OAAA;EACD,kBAAA,EAAoB,iBAAA;EACpB,gBAAA,EAAkB,iBAAA;EAClB,aAAA;EACA,IAAA,EAAM,aAAA;AAAA;;;;;;;AA0BR;;iBAAsB,sBAAA,CACpB,iBAAA,EAAmB,iBAAA,EACnB,QAAA,WACC,OAAA,CAAQ,aAAA;;;;;;;;;iBAsBW,oBAAA,CACpB,aAAA,UACA,iBAAA,EAAmB,iBAAA,GAClB,OAAA,CAAQ,aAAA;;;;AAHX;;;;;;iBA0BsB,mCAAA,CACpB,iBAAA,EAAmB,iBAAA,EACnB,WAAA,UACA,WAAA,WACC,OAAA;EAAU,IAAA,EAAM,aAAA;EAAe,WAAA,EAAa,iBAAA;AAAA;;;cCpHlC,uBAAA,SAAgC,KAAA;cAC/B,QAAA;AAAA;AAAA,cAOD,oBAAA,SAA6B,KAAA;EAAA,WAAA,CAAA;AAAA;AAAA,cAQ7B,8BAAA,SAAuC,KAAA;cACtC,QAAA;AAAA;AAAA,cAOD,4BAAA,SAAqC,KAAA;cACpC,QAAA;AAAA;AAAA,cAOD,iCAAA,SAA0C,KAAA;cACzC,QAAA;AAAA"}

package/dist/keystore-crypto.d.ts

@@ -3,32 +3,30 @@ import { EncryptedKeystore, HybridKeyPair } from "./types.js";
 //#region src/keystore-crypto/emailEncryptionKey.d.ts
 /**
  * Generates hybrid keys and creates encrypted main and recovery keystores
- * The main keystore encryption key is derived from the user's password
+ * The main keystore encryption key is derived from the user's mnemonic
  * The recovery keystore encryption key is derived from the recovery codes
  *
  * @param userEmail - The user's email
- * @param password - The user's password
+ * @param mnemonic - The user's mnemonic
  * @returns The encryption keys
  *
  * @returns The encryption and recovery keystores, recovery codes and hybrid keys
  */
-declare function createEncryptionAndRecoveryKeystores(userEmail: string, password: string): Promise<{
+declare function createEncryptionAndRecoveryKeystores(userEmail: string, mnemonic: string): Promise<{
   encryptionKeystore: EncryptedKeystore;
   recoveryKeystore: EncryptedKeystore;
   recoveryCodes: string;
   keys: HybridKeyPair;
-  salt: Uint8Array;
 }>;
 /**
  * Opens the encryption keystore and returns the email encryption keys
- * The decryption key is derived from the user password
+ * The decryption key is derived from the user mnemonic
  *
  * @param encryptedKeystore - The encrypted keystore containing encryption keys
- * @param password - The user's password
- * @param salt - The keystore's salt
+ * @param mnemonic - The user's mnemonic
  * @returns The encryption keys
  */
-declare function openEncryptionKeystore(encryptedKeystore: EncryptedKeystore, password: string, salt: Uint8Array): Promise<HybridKeyPair>;
+declare function openEncryptionKeystore(encryptedKeystore: EncryptedKeystore, mnemonic: string): Promise<HybridKeyPair>;
 /**
  * Opens the recovery keystore and returns the email encryption keys
  * The decryption key is derived from the recovery codes (machine-generated mnemonic)
@@ -39,18 +37,16 @@ declare function openEncryptionKeystore(encryptedKeystore: EncryptedKeystore, pa
  */
 declare function openRecoveryKeystore(recoveryCodes: string, encryptedKeystore: EncryptedKeystore): Promise<HybridKeyPair>;
 /**
- * Re-encrypts the encryption keystore with a new password
- * The decryption key is derived from the user password
+ * Re-encrypts the encryption keystore with a new mnemonic
+ * The decryption key is derived from the user mnemonic
  *
  * @param encryptedKeystore - The encrypted keystore containing encryption keys
- * @param oldPassword - The user's old password
- * @param newPassword - The user's new password
- * @param oldSalt - The keystore's old salt
- * @returns The keys, re-encrypted keystore, and new salt
+ * @param oldMnemonic - The user's old mnemonic
+ * @param newMnemonic - The user's new mnemonic
+ * @returns The keys and new re-encrypted keystore
  */
-declare function changePasswordForEncryptionKeystore(encryptedKeystore: EncryptedKeystore, oldPassword: string, newPassword: string, oldSalt: Uint8Array): Promise<{
+declare function changeMnemonicForEncryptionKeystore(encryptedKeystore: EncryptedKeystore, oldMnemonic: string, newMnemonic: string): Promise<{
   keys: HybridKeyPair;
-  newSalt: Uint8Array;
   newKeystore: EncryptedKeystore;
 }>;
 //#endregion
@@ -58,15 +54,18 @@ declare function changePasswordForEncryptionKeystore(encryptedKeystore: Encrypte
 declare class FailedToCreateKeyStores extends Error {
   constructor(errorMsg?: string);
 }
+declare class InvalidInputKeyStore extends Error {
+  constructor();
+}
 declare class FailedToOpenEncryptionKeyStore extends Error {
   constructor(errorMsg?: string);
 }
 declare class FailedToOpenRecoveryKeyStore extends Error {
   constructor(errorMsg?: string);
 }
-declare class FailedToChangePasswordForKeyStore extends Error {
+declare class FailedToChangeMnemonicForKeyStore extends Error {
   constructor(errorMsg?: string);
 }
 //#endregion
-export { FailedToChangePasswordForKeyStore, FailedToCreateKeyStores, FailedToOpenEncryptionKeyStore, FailedToOpenRecoveryKeyStore, changePasswordForEncryptionKeystore, createEncryptionAndRecoveryKeystores, openEncryptionKeystore, openRecoveryKeystore };
+export { FailedToChangeMnemonicForKeyStore, FailedToCreateKeyStores, FailedToOpenEncryptionKeyStore, FailedToOpenRecoveryKeyStore, InvalidInputKeyStore, changeMnemonicForEncryptionKeystore, createEncryptionAndRecoveryKeystores, openEncryptionKeystore, openRecoveryKeystore };
 //# sourceMappingURL=keystore-crypto.d.ts.map

package/dist/keystore-crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keystore-crypto.d.ts","names":[],"sources":["../src/keystore-crypto/emailEncryptionKey.ts","../src/keystore-crypto/errors.ts"],"mappings":";;;;;AA4BA;;;;;;;;;iBAAsB,oCAAA,CACpB,SAAA,UACA,QAAA,WACC,OAAA;EACD,kBAAA,EAAoB,iBAAA;EACpB,gBAAA,EAAkB,iBAAA;EAClB,aAAA;EACA,IAAA,EAAM,aAAA;EACN,IAAA,EAAM,UAAA;AAAA;;;;;;;;;AA2BR;iBAAsB,sBAAA,CACpB,iBAAA,EAAmB,iBAAA,EACnB,QAAA,UACA,IAAA,EAAM,UAAA,GACL,OAAA,CAAQ,aAAA;;;;;;;;;iBAqBW,oBAAA,CACpB,aAAA,UACA,iBAAA,EAAmB,iBAAA,GAClB,OAAA,CAAQ,aAAA;;;;;;;;AAHX;;;iBA0BsB,mCAAA,CACpB,iBAAA,EAAmB,iBAAA,EACnB,WAAA,UACA,WAAA,UACA,OAAA,EAAS,UAAA,GACR,OAAA;EAAU,IAAA,EAAM,aAAA;EAAe,OAAA,EAAS,UAAA;EAAY,WAAA,EAAa,iBAAA;AAAA;;;cCvHvD,uBAAA,SAAgC,KAAA;cAC/B,QAAA;AAAA;AAAA,cAOD,8BAAA,SAAuC,KAAA;cACtC,QAAA;AAAA;AAAA,cAOD,4BAAA,SAAqC,KAAA;cACpC,QAAA;AAAA;AAAA,cAOD,iCAAA,SAA0C,KAAA;cACzC,QAAA;AAAA"}
+{"version":3,"file":"keystore-crypto.d.ts","names":[],"sources":["../src/keystore-crypto/emailEncryptionKey.ts","../src/keystore-crypto/errors.ts"],"mappings":";;;;;AA4BA;;;;;;;;;iBAAsB,oCAAA,CACpB,SAAA,UACA,QAAA,WACC,OAAA;EACD,kBAAA,EAAoB,iBAAA;EACpB,gBAAA,EAAkB,iBAAA;EAClB,aAAA;EACA,IAAA,EAAM,aAAA;AAAA;;;;;;;AA0BR;;iBAAsB,sBAAA,CACpB,iBAAA,EAAmB,iBAAA,EACnB,QAAA,WACC,OAAA,CAAQ,aAAA;;;;;;;;;iBAsBW,oBAAA,CACpB,aAAA,UACA,iBAAA,EAAmB,iBAAA,GAClB,OAAA,CAAQ,aAAA;;;;AAHX;;;;;;iBA0BsB,mCAAA,CACpB,iBAAA,EAAmB,iBAAA,EACnB,WAAA,UACA,WAAA,WACC,OAAA;EAAU,IAAA,EAAM,aAAA;EAAe,WAAA,EAAa,iBAAA;AAAA;;;cCpHlC,uBAAA,SAAgC,KAAA;cAC/B,QAAA;AAAA;AAAA,cAOD,oBAAA,SAA6B,KAAA;EAAA,WAAA,CAAA;AAAA;AAAA,cAQ7B,8BAAA,SAAuC,KAAA;cACtC,QAAA;AAAA;AAAA,cAOD,4BAAA,SAAqC,KAAA;cACpC,QAAA;AAAA;AAAA,cAOD,iCAAA,SAA0C,KAAA;cACzC,QAAA;AAAA"}

package/dist/keystore-crypto.js

@@ -1,11 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_emailEncryptionKey = require('./emailEncryptionKey-Cw-vW_Oq.js');
+const require_emailEncryptionKey = require('./emailEncryptionKey-Ba95VuFO.js');
 
-exports.FailedToChangePasswordForKeyStore = require_emailEncryptionKey.FailedToChangePasswordForKeyStore;
+exports.FailedToChangeMnemonicForKeyStore = require_emailEncryptionKey.FailedToChangeMnemonicForKeyStore;
 exports.FailedToCreateKeyStores = require_emailEncryptionKey.FailedToCreateKeyStores;
 exports.FailedToOpenEncryptionKeyStore = require_emailEncryptionKey.FailedToOpenEncryptionKeyStore;
 exports.FailedToOpenRecoveryKeyStore = require_emailEncryptionKey.FailedToOpenRecoveryKeyStore;
-exports.changePasswordForEncryptionKeystore = require_emailEncryptionKey.changePasswordForEncryptionKeystore;
+exports.InvalidInputKeyStore = require_emailEncryptionKey.InvalidInputKeyStore;
+exports.changeMnemonicForEncryptionKeystore = require_emailEncryptionKey.changeMnemonicForEncryptionKeystore;
 exports.createEncryptionAndRecoveryKeystores = require_emailEncryptionKey.createEncryptionAndRecoveryKeystores;
 exports.openEncryptionKeystore = require_emailEncryptionKey.openEncryptionKeystore;
 exports.openRecoveryKeystore = require_emailEncryptionKey.openRecoveryKeystore;

package/dist/keystore-crypto.mjs

@@ -1,3 +1,3 @@
-import { a as FailedToChangePasswordForKeyStore, c as FailedToOpenRecoveryKeyStore, i as openRecoveryKeystore, n as createEncryptionAndRecoveryKeystores, o as FailedToCreateKeyStores, r as openEncryptionKeystore, s as FailedToOpenEncryptionKeyStore, t as changePasswordForEncryptionKeystore } from "./emailEncryptionKey-D9sk_WKj.mjs";
+import { a as FailedToChangeMnemonicForKeyStore, c as FailedToOpenRecoveryKeyStore, i as openRecoveryKeystore, l as InvalidInputKeyStore, n as createEncryptionAndRecoveryKeystores, o as FailedToCreateKeyStores, r as openEncryptionKeystore, s as FailedToOpenEncryptionKeyStore, t as changeMnemonicForEncryptionKeystore } from "./emailEncryptionKey-CYvr26FG.mjs";
 
-export { FailedToChangePasswordForKeyStore, FailedToCreateKeyStores, FailedToOpenEncryptionKeyStore, FailedToOpenRecoveryKeyStore, changePasswordForEncryptionKeystore, createEncryptionAndRecoveryKeystores, openEncryptionKeystore, openRecoveryKeystore };
+export { FailedToChangeMnemonicForKeyStore, FailedToCreateKeyStores, FailedToOpenEncryptionKeyStore, FailedToOpenRecoveryKeyStore, InvalidInputKeyStore, changeMnemonicForEncryptionKeystore, createEncryptionAndRecoveryKeystores, openEncryptionKeystore, openRecoveryKeystore };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "internxt-crypto",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "module": "dist/index.js",

package/dist/emailEncryptionKey-Cw-vW_Oq.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"emailEncryptionKey-Cw-vW_Oq.js","names":["UTF8ToUint8","uint8ArrayToBase64","encryptSymmetrically","base64ToUint8Array","decryptSymmetrically","deriveKeyFromMnemonic","CONTEXT_RECOVERY","deriveSymmetricKeyFromContext","CONTEXT_ENC_KEYSTORE","getKeyFromPasswordAndSalt","getKeyFromPassword","genHybridKeys","KeystoreType","genMnemonic"],"sources":["../src/keystore-crypto/core.ts","../src/keystore-crypto/errors.ts","../src/keystore-crypto/emailEncryptionKey.ts"],"sourcesContent":["import { encryptSymmetrically, decryptSymmetrically } from '../symmetric-crypto';\nimport { base64ToUint8Array, uint8ArrayToBase64, UTF8ToUint8 } from '../utils';\nimport { deriveKeyFromMnemonic, deriveSymmetricKeyFromContext } from '../derive-key';\nimport { CONTEXT_ENC_KEYSTORE, CONTEXT_RECOVERY } from '../constants';\nimport { EncryptedKeystore, HybridKeyPair, KeystoreType } from '../types';\nimport { getKeyFromPasswordAndSalt, getKeyFromPassword } from '../derive-password';\n\n/**\n * Encrypts the user's hybrid key using symmetric encryption to get a keystore\n *\n * @param secretKey - The symmetric key to encrypt the keystore content\n * @param key - The hybrid key pair\n * @param userEmail - The email of the user\n * @param type - The keystore type\n * @returns The encrypted keystore\n */\nexport async function encryptKeystoreContent(\n  secretKey: Uint8Array,\n  keys: HybridKeyPair,\n  userEmail: string,\n  type: KeystoreType,\n): Promise<EncryptedKeystore> {\n  try {\n    const aux = UTF8ToUint8(userEmail + type);\n    const publicKey = uint8ArrayToBase64(keys.publicKey);\n    const secretKeyEncrypted = await encryptSymmetrically(secretKey, keys.secretKey, aux);\n\n    const keystore: EncryptedKeystore = {\n      userEmail,\n      type,\n      publicKey,\n      privateKeyEncrypted: uint8ArrayToBase64(secretKeyEncrypted),\n    };\n    return keystore;\n  } catch (error) {\n    throw new Error('Failed to encrypt keystore content', { cause: error });\n  }\n}\n\n/**\n * Decrypts the keystore content using symmetric encryption\n *\n * @param kesytoreOpeningKey - The symmetric key to decrypt the keystore content\n * @param encryptedKeys - The encrypted keystore content\n * @returns The decrypted hybrid key pair contained in the keystore\n */\nexport async function decryptKeystoreContent(\n  kesytoreOpeningKey: Uint8Array,\n  encryptedKeystore: EncryptedKeystore,\n): Promise<HybridKeyPair> {\n  try {\n    const aux = UTF8ToUint8(encryptedKeystore.userEmail + encryptedKeystore.type);\n    const publicKey = base64ToUint8Array(encryptedKeystore.publicKey);\n    const ciphertext = base64ToUint8Array(encryptedKeystore.privateKeyEncrypted);\n    const secretKey = await decryptSymmetrically(kesytoreOpeningKey, ciphertext, aux);\n    return {\n      publicKey,\n      secretKey,\n    };\n  } catch (error) {\n    throw new Error('Failed to decrypt keystore content', { cause: error });\n  }\n}\n\n/**\n * Derives a secret key for protecting the recovery keystore\n *\n * @param recoveryCodes - The recovery codes (machine-generated with secure PRNG)\n * @returns The derived secret key for protecting the recovery keystore\n */\nexport async function deriveRecoveryKey(recoveryCodes: string): Promise<Uint8Array> {\n  return deriveKeyFromMnemonic(recoveryCodes, CONTEXT_RECOVERY);\n}\n\n/**\n * Derives a secret key for protecting the encryption keystore from user's mnemonic\n *\n * @param mnemonic - The user's mnemonic (machine-generated with secure PRNG)\n * @returns The derived secret key for protecting the encryption keystore\n */\nexport async function deriveEncryptionKeystoreKeyFromMnemonic(mnemonic: string): Promise<Uint8Array> {\n  return deriveKeyFromMnemonic(mnemonic, CONTEXT_ENC_KEYSTORE);\n}\n\n/**\n * Derives a secret key for protecting the encryption keystore\n *\n * @param password - The user's password\n * @param salt - The keystore salt\n * @returns The derived secret key for protecting the encryption keystore\n */\nexport async function deriveEncryptionKeystoreKey(password: string, salt: Uint8Array): Promise<Uint8Array> {\n  const baseKey = await getKeyFromPasswordAndSalt(password, salt);\n  return deriveSymmetricKeyFromContext(CONTEXT_ENC_KEYSTORE, baseKey);\n}\n\n/**\n * Derives a secret key for protecting the encryption keystore\n *\n * @param password - The user's password\n * @param salt - The keystore salt\n * @returns The derived secret key for protecting the encryption keystore\n */\nexport async function deriveNewEncryptionKeystoreKey(\n  password: string,\n): Promise<{ secretKey: Uint8Array; salt: Uint8Array }> {\n  const { key, salt } = await getKeyFromPassword(password);\n  const secretKey = deriveSymmetricKeyFromContext(CONTEXT_ENC_KEYSTORE, key);\n  return { secretKey, salt };\n}\n","export class FailedToCreateKeyStores extends Error {\n  constructor(errorMsg?: string) {\n    super('Failed to create encryption and recovery keystores: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToCreateKeyStores.prototype);\n  }\n}\n\nexport class FailedToOpenEncryptionKeyStore extends Error {\n  constructor(errorMsg?: string) {\n    super('Failed to open encryption keystore: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToOpenEncryptionKeyStore.prototype);\n  }\n}\n\nexport class FailedToOpenRecoveryKeyStore extends Error {\n  constructor(errorMsg?: string) {\n    super('Failed to open recovery keystore: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToOpenRecoveryKeyStore.prototype);\n  }\n}\n\nexport class FailedToChangePasswordForKeyStore extends Error {\n  constructor(errorMsg?: string) {\n    super('Error while fetching message: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToChangePasswordForKeyStore.prototype);\n  }\n}\n","import { EncryptedKeystore, KeystoreType, HybridKeyPair } from '../types';\nimport { genMnemonic } from '../utils';\nimport {\n  encryptKeystoreContent,\n  decryptKeystoreContent,\n  deriveEncryptionKeystoreKey,\n  deriveNewEncryptionKeystoreKey,\n  deriveRecoveryKey,\n} from './core';\nimport { genHybridKeys } from '../hybrid-crypto';\nimport {\n  FailedToOpenEncryptionKeyStore,\n  FailedToCreateKeyStores,\n  FailedToOpenRecoveryKeyStore,\n  FailedToChangePasswordForKeyStore,\n} from './errors';\n\n/**\n * Generates hybrid keys and creates encrypted main and recovery keystores\n * The main keystore encryption key is derived from the user's password\n * The recovery keystore encryption key is derived from the recovery codes\n *\n * @param userEmail - The user's email\n * @param password - The user's password\n * @returns The encryption keys\n *\n * @returns The encryption and recovery keystores, recovery codes and hybrid keys\n */\nexport async function createEncryptionAndRecoveryKeystores(\n  userEmail: string,\n  password: string,\n): Promise<{\n  encryptionKeystore: EncryptedKeystore;\n  recoveryKeystore: EncryptedKeystore;\n  recoveryCodes: string;\n  keys: HybridKeyPair;\n  salt: Uint8Array;\n}> {\n  try {\n    const keys = genHybridKeys();\n\n    const { secretKey, salt } = await deriveNewEncryptionKeystoreKey(password);\n    const encryptionKeystore = await encryptKeystoreContent(secretKey, keys, userEmail, KeystoreType.ENCRYPTION);\n\n    const recoveryCodes = genMnemonic();\n    const recoveryKey = await deriveRecoveryKey(recoveryCodes);\n    const recoveryKeystore = await encryptKeystoreContent(recoveryKey, keys, userEmail, KeystoreType.RECOVERY);\n\n    return { encryptionKeystore, recoveryKeystore, recoveryCodes, keys, salt };\n  } catch (error) {\n    throw new FailedToCreateKeyStores(error instanceof Error ? error.message : String(error));\n  }\n}\n\n/**\n * Opens the encryption keystore and returns the email encryption keys\n * The decryption key is derived from the user password\n *\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @param password - The user's password\n * @param salt - The keystore's salt\n * @returns The encryption keys\n */\nexport async function openEncryptionKeystore(\n  encryptedKeystore: EncryptedKeystore,\n  password: string,\n  salt: Uint8Array,\n): Promise<HybridKeyPair> {\n  try {\n    if (encryptedKeystore.type !== KeystoreType.ENCRYPTION) {\n      throw new Error('Input is invalid');\n    }\n    const secretKey = await deriveEncryptionKeystoreKey(password, salt);\n    const keys = await decryptKeystoreContent(secretKey, encryptedKeystore);\n    return keys;\n  } catch (error) {\n    throw new FailedToOpenEncryptionKeyStore(error instanceof Error ? error.message : String(error));\n  }\n}\n\n/**\n * Opens the recovery keystore and returns the email encryption keys\n * The decryption key is derived from the recovery codes (machine-generated mnemonic)\n *\n * @param recoveryCodes - The user's recovery codes\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @returns The encryption keys\n */\nexport async function openRecoveryKeystore(\n  recoveryCodes: string,\n  encryptedKeystore: EncryptedKeystore,\n): Promise<HybridKeyPair> {\n  try {\n    if (encryptedKeystore.type !== KeystoreType.RECOVERY) {\n      throw new Error('Input is invalid');\n    }\n    const recoveryKey = await deriveRecoveryKey(recoveryCodes);\n    const keys = await decryptKeystoreContent(recoveryKey, encryptedKeystore);\n    return keys;\n  } catch (error) {\n    throw new FailedToOpenRecoveryKeyStore(error instanceof Error ? error.message : String(error));\n  }\n}\n\n/**\n * Re-encrypts the encryption keystore with a new password\n * The decryption key is derived from the user password\n *\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @param oldPassword - The user's old password\n * @param newPassword - The user's new password\n * @param oldSalt - The keystore's old salt\n * @returns The keys, re-encrypted keystore, and new salt\n */\nexport async function changePasswordForEncryptionKeystore(\n  encryptedKeystore: EncryptedKeystore,\n  oldPassword: string,\n  newPassword: string,\n  oldSalt: Uint8Array,\n): Promise<{ keys: HybridKeyPair; newSalt: Uint8Array; newKeystore: EncryptedKeystore }> {\n  try {\n    if (encryptedKeystore.type !== KeystoreType.ENCRYPTION) {\n      throw new Error('Input is invalid');\n    }\n    const keys = await openEncryptionKeystore(encryptedKeystore, oldPassword, oldSalt);\n\n    const { secretKey, salt } = await deriveNewEncryptionKeystoreKey(newPassword);\n    const newKeystore = await encryptKeystoreContent(\n      secretKey,\n      keys,\n      encryptedKeystore.userEmail,\n      KeystoreType.ENCRYPTION,\n    );\n\n    return { newKeystore, newSalt: salt, keys };\n  } catch (error) {\n    throw new FailedToChangePasswordForKeyStore(error instanceof Error ? error.message : String(error));\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBA,eAAsB,uBACpB,WACA,MACA,WACA,MAC4B;AAC5B,KAAI;EACF,MAAM,MAAMA,0BAAY,YAAY,KAAK;AAUzC,SANoC;GAClC;GACA;GACA,WANgBC,iCAAmB,KAAK,UAAU;GAOlD,qBAAqBA,iCANI,MAAMC,iCAAqB,WAAW,KAAK,WAAW,IAAI,CAMxB;GAC5D;UAEM,OAAO;AACd,QAAM,IAAI,MAAM,sCAAsC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;AAW3E,eAAsB,uBACpB,oBACA,mBACwB;AACxB,KAAI;EACF,MAAM,MAAMF,0BAAY,kBAAkB,YAAY,kBAAkB,KAAK;AAI7E,SAAO;GACL,WAJgBG,iCAAmB,kBAAkB,UAAU;GAK/D,WAHgB,MAAMC,iCAAqB,oBAD1BD,iCAAmB,kBAAkB,oBAAoB,EACC,IAAI;GAIhF;UACM,OAAO;AACd,QAAM,IAAI,MAAM,sCAAsC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;AAU3E,eAAsB,kBAAkB,eAA4C;AAClF,QAAOE,qDAAsB,eAAeC,mCAAiB;;;;;;;;;AAoB/D,eAAsB,4BAA4B,UAAkB,MAAuC;AAEzG,QAAOC,6DAA8BC,wCADrB,MAAMC,yDAA0B,UAAU,KAAK,CACI;;;;;;;;;AAUrE,eAAsB,+BACpB,UACsD;CACtD,MAAM,EAAE,KAAK,SAAS,MAAMC,kDAAmB,SAAS;AAExD,QAAO;EAAE,WADSH,6DAA8BC,wCAAsB,IAAI;EACtD;EAAM;;;;;AC5G5B,IAAa,0BAAb,MAAa,gCAAgC,MAAM;CACjD,YAAY,UAAmB;AAC7B,QAAM,yDAAyD,SAAS;AAExE,SAAO,eAAe,MAAM,wBAAwB,UAAU;;;AAIlE,IAAa,iCAAb,MAAa,uCAAuC,MAAM;CACxD,YAAY,UAAmB;AAC7B,QAAM,yCAAyC,SAAS;AAExD,SAAO,eAAe,MAAM,+BAA+B,UAAU;;;AAIzE,IAAa,+BAAb,MAAa,qCAAqC,MAAM;CACtD,YAAY,UAAmB;AAC7B,QAAM,uCAAuC,SAAS;AAEtD,SAAO,eAAe,MAAM,6BAA6B,UAAU;;;AAIvE,IAAa,oCAAb,MAAa,0CAA0C,MAAM;CAC3D,YAAY,UAAmB;AAC7B,QAAM,mCAAmC,SAAS;AAElD,SAAO,eAAe,MAAM,kCAAkC,UAAU;;;;;;;;;;;;;;;;;ACA5E,eAAsB,qCACpB,WACA,UAOC;AACD,KAAI;EACF,MAAM,OAAOG,6BAAe;EAE5B,MAAM,EAAE,WAAW,SAAS,MAAM,+BAA+B,SAAS;EAC1E,MAAM,qBAAqB,MAAM,uBAAuB,WAAW,MAAM,WAAWC,2BAAa,WAAW;EAE5G,MAAM,gBAAgBC,2BAAa;AAInC,SAAO;GAAE;GAAoB,kBAFJ,MAAM,uBADX,MAAM,kBAAkB,cAAc,EACS,MAAM,WAAWD,2BAAa,SAAS;GAE3D;GAAe;GAAM;GAAM;UACnE,OAAO;AACd,QAAM,IAAI,wBAAwB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;;;;;;;;;;;AAa7F,eAAsB,uBACpB,mBACA,UACA,MACwB;AACxB,KAAI;AACF,MAAI,kBAAkB,SAASA,2BAAa,WAC1C,OAAM,IAAI,MAAM,mBAAmB;AAIrC,SADa,MAAM,uBADD,MAAM,4BAA4B,UAAU,KAAK,EACd,kBAAkB;UAEhE,OAAO;AACd,QAAM,IAAI,+BAA+B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;;;;;;;;;;AAYpG,eAAsB,qBACpB,eACA,mBACwB;AACxB,KAAI;AACF,MAAI,kBAAkB,SAASA,2BAAa,SAC1C,OAAM,IAAI,MAAM,mBAAmB;AAIrC,SADa,MAAM,uBADC,MAAM,kBAAkB,cAAc,EACH,kBAAkB;UAElE,OAAO;AACd,QAAM,IAAI,6BAA6B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;;;;;;;;;;;;AAclG,eAAsB,oCACpB,mBACA,aACA,aACA,SACuF;AACvF,KAAI;AACF,MAAI,kBAAkB,SAASA,2BAAa,WAC1C,OAAM,IAAI,MAAM,mBAAmB;EAErC,MAAM,OAAO,MAAM,uBAAuB,mBAAmB,aAAa,QAAQ;EAElF,MAAM,EAAE,WAAW,SAAS,MAAM,+BAA+B,YAAY;AAQ7E,SAAO;GAAE,aAPW,MAAM,uBACxB,WACA,MACA,kBAAkB,WAClBA,2BAAa,WACd;GAEqB,SAAS;GAAM;GAAM;UACpC,OAAO;AACd,QAAM,IAAI,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC"}

package/dist/emailEncryptionKey-D9sk_WKj.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"emailEncryptionKey-D9sk_WKj.mjs","names":[],"sources":["../src/keystore-crypto/core.ts","../src/keystore-crypto/errors.ts","../src/keystore-crypto/emailEncryptionKey.ts"],"sourcesContent":["import { encryptSymmetrically, decryptSymmetrically } from '../symmetric-crypto';\nimport { base64ToUint8Array, uint8ArrayToBase64, UTF8ToUint8 } from '../utils';\nimport { deriveKeyFromMnemonic, deriveSymmetricKeyFromContext } from '../derive-key';\nimport { CONTEXT_ENC_KEYSTORE, CONTEXT_RECOVERY } from '../constants';\nimport { EncryptedKeystore, HybridKeyPair, KeystoreType } from '../types';\nimport { getKeyFromPasswordAndSalt, getKeyFromPassword } from '../derive-password';\n\n/**\n * Encrypts the user's hybrid key using symmetric encryption to get a keystore\n *\n * @param secretKey - The symmetric key to encrypt the keystore content\n * @param key - The hybrid key pair\n * @param userEmail - The email of the user\n * @param type - The keystore type\n * @returns The encrypted keystore\n */\nexport async function encryptKeystoreContent(\n  secretKey: Uint8Array,\n  keys: HybridKeyPair,\n  userEmail: string,\n  type: KeystoreType,\n): Promise<EncryptedKeystore> {\n  try {\n    const aux = UTF8ToUint8(userEmail + type);\n    const publicKey = uint8ArrayToBase64(keys.publicKey);\n    const secretKeyEncrypted = await encryptSymmetrically(secretKey, keys.secretKey, aux);\n\n    const keystore: EncryptedKeystore = {\n      userEmail,\n      type,\n      publicKey,\n      privateKeyEncrypted: uint8ArrayToBase64(secretKeyEncrypted),\n    };\n    return keystore;\n  } catch (error) {\n    throw new Error('Failed to encrypt keystore content', { cause: error });\n  }\n}\n\n/**\n * Decrypts the keystore content using symmetric encryption\n *\n * @param kesytoreOpeningKey - The symmetric key to decrypt the keystore content\n * @param encryptedKeys - The encrypted keystore content\n * @returns The decrypted hybrid key pair contained in the keystore\n */\nexport async function decryptKeystoreContent(\n  kesytoreOpeningKey: Uint8Array,\n  encryptedKeystore: EncryptedKeystore,\n): Promise<HybridKeyPair> {\n  try {\n    const aux = UTF8ToUint8(encryptedKeystore.userEmail + encryptedKeystore.type);\n    const publicKey = base64ToUint8Array(encryptedKeystore.publicKey);\n    const ciphertext = base64ToUint8Array(encryptedKeystore.privateKeyEncrypted);\n    const secretKey = await decryptSymmetrically(kesytoreOpeningKey, ciphertext, aux);\n    return {\n      publicKey,\n      secretKey,\n    };\n  } catch (error) {\n    throw new Error('Failed to decrypt keystore content', { cause: error });\n  }\n}\n\n/**\n * Derives a secret key for protecting the recovery keystore\n *\n * @param recoveryCodes - The recovery codes (machine-generated with secure PRNG)\n * @returns The derived secret key for protecting the recovery keystore\n */\nexport async function deriveRecoveryKey(recoveryCodes: string): Promise<Uint8Array> {\n  return deriveKeyFromMnemonic(recoveryCodes, CONTEXT_RECOVERY);\n}\n\n/**\n * Derives a secret key for protecting the encryption keystore from user's mnemonic\n *\n * @param mnemonic - The user's mnemonic (machine-generated with secure PRNG)\n * @returns The derived secret key for protecting the encryption keystore\n */\nexport async function deriveEncryptionKeystoreKeyFromMnemonic(mnemonic: string): Promise<Uint8Array> {\n  return deriveKeyFromMnemonic(mnemonic, CONTEXT_ENC_KEYSTORE);\n}\n\n/**\n * Derives a secret key for protecting the encryption keystore\n *\n * @param password - The user's password\n * @param salt - The keystore salt\n * @returns The derived secret key for protecting the encryption keystore\n */\nexport async function deriveEncryptionKeystoreKey(password: string, salt: Uint8Array): Promise<Uint8Array> {\n  const baseKey = await getKeyFromPasswordAndSalt(password, salt);\n  return deriveSymmetricKeyFromContext(CONTEXT_ENC_KEYSTORE, baseKey);\n}\n\n/**\n * Derives a secret key for protecting the encryption keystore\n *\n * @param password - The user's password\n * @param salt - The keystore salt\n * @returns The derived secret key for protecting the encryption keystore\n */\nexport async function deriveNewEncryptionKeystoreKey(\n  password: string,\n): Promise<{ secretKey: Uint8Array; salt: Uint8Array }> {\n  const { key, salt } = await getKeyFromPassword(password);\n  const secretKey = deriveSymmetricKeyFromContext(CONTEXT_ENC_KEYSTORE, key);\n  return { secretKey, salt };\n}\n","export class FailedToCreateKeyStores extends Error {\n  constructor(errorMsg?: string) {\n    super('Failed to create encryption and recovery keystores: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToCreateKeyStores.prototype);\n  }\n}\n\nexport class FailedToOpenEncryptionKeyStore extends Error {\n  constructor(errorMsg?: string) {\n    super('Failed to open encryption keystore: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToOpenEncryptionKeyStore.prototype);\n  }\n}\n\nexport class FailedToOpenRecoveryKeyStore extends Error {\n  constructor(errorMsg?: string) {\n    super('Failed to open recovery keystore: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToOpenRecoveryKeyStore.prototype);\n  }\n}\n\nexport class FailedToChangePasswordForKeyStore extends Error {\n  constructor(errorMsg?: string) {\n    super('Error while fetching message: ' + errorMsg);\n\n    Object.setPrototypeOf(this, FailedToChangePasswordForKeyStore.prototype);\n  }\n}\n","import { EncryptedKeystore, KeystoreType, HybridKeyPair } from '../types';\nimport { genMnemonic } from '../utils';\nimport {\n  encryptKeystoreContent,\n  decryptKeystoreContent,\n  deriveEncryptionKeystoreKey,\n  deriveNewEncryptionKeystoreKey,\n  deriveRecoveryKey,\n} from './core';\nimport { genHybridKeys } from '../hybrid-crypto';\nimport {\n  FailedToOpenEncryptionKeyStore,\n  FailedToCreateKeyStores,\n  FailedToOpenRecoveryKeyStore,\n  FailedToChangePasswordForKeyStore,\n} from './errors';\n\n/**\n * Generates hybrid keys and creates encrypted main and recovery keystores\n * The main keystore encryption key is derived from the user's password\n * The recovery keystore encryption key is derived from the recovery codes\n *\n * @param userEmail - The user's email\n * @param password - The user's password\n * @returns The encryption keys\n *\n * @returns The encryption and recovery keystores, recovery codes and hybrid keys\n */\nexport async function createEncryptionAndRecoveryKeystores(\n  userEmail: string,\n  password: string,\n): Promise<{\n  encryptionKeystore: EncryptedKeystore;\n  recoveryKeystore: EncryptedKeystore;\n  recoveryCodes: string;\n  keys: HybridKeyPair;\n  salt: Uint8Array;\n}> {\n  try {\n    const keys = genHybridKeys();\n\n    const { secretKey, salt } = await deriveNewEncryptionKeystoreKey(password);\n    const encryptionKeystore = await encryptKeystoreContent(secretKey, keys, userEmail, KeystoreType.ENCRYPTION);\n\n    const recoveryCodes = genMnemonic();\n    const recoveryKey = await deriveRecoveryKey(recoveryCodes);\n    const recoveryKeystore = await encryptKeystoreContent(recoveryKey, keys, userEmail, KeystoreType.RECOVERY);\n\n    return { encryptionKeystore, recoveryKeystore, recoveryCodes, keys, salt };\n  } catch (error) {\n    throw new FailedToCreateKeyStores(error instanceof Error ? error.message : String(error));\n  }\n}\n\n/**\n * Opens the encryption keystore and returns the email encryption keys\n * The decryption key is derived from the user password\n *\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @param password - The user's password\n * @param salt - The keystore's salt\n * @returns The encryption keys\n */\nexport async function openEncryptionKeystore(\n  encryptedKeystore: EncryptedKeystore,\n  password: string,\n  salt: Uint8Array,\n): Promise<HybridKeyPair> {\n  try {\n    if (encryptedKeystore.type !== KeystoreType.ENCRYPTION) {\n      throw new Error('Input is invalid');\n    }\n    const secretKey = await deriveEncryptionKeystoreKey(password, salt);\n    const keys = await decryptKeystoreContent(secretKey, encryptedKeystore);\n    return keys;\n  } catch (error) {\n    throw new FailedToOpenEncryptionKeyStore(error instanceof Error ? error.message : String(error));\n  }\n}\n\n/**\n * Opens the recovery keystore and returns the email encryption keys\n * The decryption key is derived from the recovery codes (machine-generated mnemonic)\n *\n * @param recoveryCodes - The user's recovery codes\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @returns The encryption keys\n */\nexport async function openRecoveryKeystore(\n  recoveryCodes: string,\n  encryptedKeystore: EncryptedKeystore,\n): Promise<HybridKeyPair> {\n  try {\n    if (encryptedKeystore.type !== KeystoreType.RECOVERY) {\n      throw new Error('Input is invalid');\n    }\n    const recoveryKey = await deriveRecoveryKey(recoveryCodes);\n    const keys = await decryptKeystoreContent(recoveryKey, encryptedKeystore);\n    return keys;\n  } catch (error) {\n    throw new FailedToOpenRecoveryKeyStore(error instanceof Error ? error.message : String(error));\n  }\n}\n\n/**\n * Re-encrypts the encryption keystore with a new password\n * The decryption key is derived from the user password\n *\n * @param encryptedKeystore - The encrypted keystore containing encryption keys\n * @param oldPassword - The user's old password\n * @param newPassword - The user's new password\n * @param oldSalt - The keystore's old salt\n * @returns The keys, re-encrypted keystore, and new salt\n */\nexport async function changePasswordForEncryptionKeystore(\n  encryptedKeystore: EncryptedKeystore,\n  oldPassword: string,\n  newPassword: string,\n  oldSalt: Uint8Array,\n): Promise<{ keys: HybridKeyPair; newSalt: Uint8Array; newKeystore: EncryptedKeystore }> {\n  try {\n    if (encryptedKeystore.type !== KeystoreType.ENCRYPTION) {\n      throw new Error('Input is invalid');\n    }\n    const keys = await openEncryptionKeystore(encryptedKeystore, oldPassword, oldSalt);\n\n    const { secretKey, salt } = await deriveNewEncryptionKeystoreKey(newPassword);\n    const newKeystore = await encryptKeystoreContent(\n      secretKey,\n      keys,\n      encryptedKeystore.userEmail,\n      KeystoreType.ENCRYPTION,\n    );\n\n    return { newKeystore, newSalt: salt, keys };\n  } catch (error) {\n    throw new FailedToChangePasswordForKeyStore(error instanceof Error ? error.message : String(error));\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBA,eAAsB,uBACpB,WACA,MACA,WACA,MAC4B;AAC5B,KAAI;EACF,MAAM,MAAM,YAAY,YAAY,KAAK;AAUzC,SANoC;GAClC;GACA;GACA,WANgB,mBAAmB,KAAK,UAAU;GAOlD,qBAAqB,mBANI,MAAM,qBAAqB,WAAW,KAAK,WAAW,IAAI,CAMxB;GAC5D;UAEM,OAAO;AACd,QAAM,IAAI,MAAM,sCAAsC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;AAW3E,eAAsB,uBACpB,oBACA,mBACwB;AACxB,KAAI;EACF,MAAM,MAAM,YAAY,kBAAkB,YAAY,kBAAkB,KAAK;AAI7E,SAAO;GACL,WAJgB,mBAAmB,kBAAkB,UAAU;GAK/D,WAHgB,MAAM,qBAAqB,oBAD1B,mBAAmB,kBAAkB,oBAAoB,EACC,IAAI;GAIhF;UACM,OAAO;AACd,QAAM,IAAI,MAAM,sCAAsC,EAAE,OAAO,OAAO,CAAC;;;;;;;;;AAU3E,eAAsB,kBAAkB,eAA4C;AAClF,QAAO,sBAAsB,eAAe,iBAAiB;;;;;;;;;AAoB/D,eAAsB,4BAA4B,UAAkB,MAAuC;AAEzG,QAAO,8BAA8B,sBADrB,MAAM,0BAA0B,UAAU,KAAK,CACI;;;;;;;;;AAUrE,eAAsB,+BACpB,UACsD;CACtD,MAAM,EAAE,KAAK,SAAS,MAAM,mBAAmB,SAAS;AAExD,QAAO;EAAE,WADS,8BAA8B,sBAAsB,IAAI;EACtD;EAAM;;;;;AC5G5B,IAAa,0BAAb,MAAa,gCAAgC,MAAM;CACjD,YAAY,UAAmB;AAC7B,QAAM,yDAAyD,SAAS;AAExE,SAAO,eAAe,MAAM,wBAAwB,UAAU;;;AAIlE,IAAa,iCAAb,MAAa,uCAAuC,MAAM;CACxD,YAAY,UAAmB;AAC7B,QAAM,yCAAyC,SAAS;AAExD,SAAO,eAAe,MAAM,+BAA+B,UAAU;;;AAIzE,IAAa,+BAAb,MAAa,qCAAqC,MAAM;CACtD,YAAY,UAAmB;AAC7B,QAAM,uCAAuC,SAAS;AAEtD,SAAO,eAAe,MAAM,6BAA6B,UAAU;;;AAIvE,IAAa,oCAAb,MAAa,0CAA0C,MAAM;CAC3D,YAAY,UAAmB;AAC7B,QAAM,mCAAmC,SAAS;AAElD,SAAO,eAAe,MAAM,kCAAkC,UAAU;;;;;;;;;;;;;;;;;ACA5E,eAAsB,qCACpB,WACA,UAOC;AACD,KAAI;EACF,MAAM,OAAO,eAAe;EAE5B,MAAM,EAAE,WAAW,SAAS,MAAM,+BAA+B,SAAS;EAC1E,MAAM,qBAAqB,MAAM,uBAAuB,WAAW,MAAM,WAAW,aAAa,WAAW;EAE5G,MAAM,gBAAgB,aAAa;AAInC,SAAO;GAAE;GAAoB,kBAFJ,MAAM,uBADX,MAAM,kBAAkB,cAAc,EACS,MAAM,WAAW,aAAa,SAAS;GAE3D;GAAe;GAAM;GAAM;UACnE,OAAO;AACd,QAAM,IAAI,wBAAwB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;;;;;;;;;;;AAa7F,eAAsB,uBACpB,mBACA,UACA,MACwB;AACxB,KAAI;AACF,MAAI,kBAAkB,SAAS,aAAa,WAC1C,OAAM,IAAI,MAAM,mBAAmB;AAIrC,SADa,MAAM,uBADD,MAAM,4BAA4B,UAAU,KAAK,EACd,kBAAkB;UAEhE,OAAO;AACd,QAAM,IAAI,+BAA+B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;;;;;;;;;;AAYpG,eAAsB,qBACpB,eACA,mBACwB;AACxB,KAAI;AACF,MAAI,kBAAkB,SAAS,aAAa,SAC1C,OAAM,IAAI,MAAM,mBAAmB;AAIrC,SADa,MAAM,uBADC,MAAM,kBAAkB,cAAc,EACH,kBAAkB;UAElE,OAAO;AACd,QAAM,IAAI,6BAA6B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;;;;;;;;;;;;;AAclG,eAAsB,oCACpB,mBACA,aACA,aACA,SACuF;AACvF,KAAI;AACF,MAAI,kBAAkB,SAAS,aAAa,WAC1C,OAAM,IAAI,MAAM,mBAAmB;EAErC,MAAM,OAAO,MAAM,uBAAuB,mBAAmB,aAAa,QAAQ;EAElF,MAAM,EAAE,WAAW,SAAS,MAAM,+BAA+B,YAAY;AAQ7E,SAAO;GAAE,aAPW,MAAM,uBACxB,WACA,MACA,kBAAkB,WAClB,aAAa,WACd;GAEqB,SAAS;GAAM;GAAM;UACpC,OAAO;AACd,QAAM,IAAI,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC"}