internxt-crypto 1.2.0 → 1.3.1

package/README.md

@@ -131,12 +131,12 @@ expect(decryptedEmail).toStrictEqual(email);
 
 // keystore
 const userEmail = 'user email';
-const password = 'user password';
-const { encryptionKeystore, recoveryKeystore, recoveryCodes, salt } = await createEncryptionAndRecoveryKeystores(
+const mnemonic = 'user mnemonic';
+const { encryptionKeystore, recoveryKeystore, recoveryCodes } = await createEncryptionAndRecoveryKeystores(
       userEmail,
-      password
+      mnemonic
     );
-const resultEnc = await openEncryptionKeystore(encryptionKeystore, password, salt);
+const resultEnc = await openEncryptionKeystore(encryptionKeystore, mnemonic);
 const resultRec = await openRecoveryKeystore(recoveryCodes, recoveryKeystore);
 
 expect(resultEnc).toStrictEqual(resultRec);

package/dist/asymmetric-crypto.js

@@ -1,7 +1,6 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_chunk = require('./chunk-EbLFQX5m.js');
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("./chunk-C13QxCFV.js");
 let _noble_curves_webcrypto_js = require("@noble/curves/webcrypto.js");
-
 //#region src/asymmetric-crypto/ellipticCurve.ts
 /**
 * Derives secret key from the other user's public key and own private key
@@ -25,8 +24,8 @@ async function deriveSecretKey(aliceSecretKey, bobPublicKey) {
 async function generateEccKeys() {
 	return _noble_curves_webcrypto_js.x25519.keygen();
 }
-
 //#endregion
 exports.deriveSecretKey = deriveSecretKey;
 exports.generateEccKeys = generateEccKeys;
+
 //# sourceMappingURL=asymmetric-crypto.js.map

package/dist/asymmetric-crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"asymmetric-crypto.js","names":["x25519"],"sources":["../src/asymmetric-crypto/ellipticCurve.ts"],"sourcesContent":["import { x25519 } from '@noble/curves/webcrypto.js';\n\n/**\n * Derives secret key from the other user's public key and own private key\n *\n * @param aliceSecretKey - The secret key of the user deriving the shared secret key\n * @param bobPublicKey - The public key of the other user\n * @returns The derived secret key bits\n */\nexport async function deriveSecretKey(aliceSecretKey: Uint8Array, bobPublicKey: Uint8Array): Promise<Uint8Array> {\n  try {\n    return await x25519.getSharedSecret(aliceSecretKey, bobPublicKey);\n  } catch (error) {\n    throw new Error('Failed to derive elliptic curve secret key', { cause: error });\n  }\n}\n\n/**\n * Generates elliptic curve key pair\n *\n * @returns The generated key pair\n */\nexport async function generateEccKeys(): Promise<{ secretKey: Uint8Array; publicKey: Uint8Array }> {\n  return x25519.keygen();\n}\n"],"mappings":";;;;;;;;;;;;AASA,eAAsB,gBAAgB,gBAA4B,cAA+C;AAC/G,KAAI;AACF,SAAO,MAAMA,kCAAO,gBAAgB,gBAAgB,aAAa;UAC1D,OAAO;AACd,QAAM,IAAI,MAAM,8CAA8C,EAAE,OAAO,OAAO,CAAC;;;;;;;;AASnF,eAAsB,kBAA6E;AACjG,QAAOA,kCAAO,QAAQ"}
+{"version":3,"file":"asymmetric-crypto.js","names":["x25519"],"sources":["../src/asymmetric-crypto/ellipticCurve.ts"],"sourcesContent":["import { x25519 } from '@noble/curves/webcrypto.js';\n\n/**\n * Derives secret key from the other user's public key and own private key\n *\n * @param aliceSecretKey - The secret key of the user deriving the shared secret key\n * @param bobPublicKey - The public key of the other user\n * @returns The derived secret key bits\n */\nexport async function deriveSecretKey(aliceSecretKey: Uint8Array, bobPublicKey: Uint8Array): Promise<Uint8Array> {\n  try {\n    return await x25519.getSharedSecret(aliceSecretKey, bobPublicKey);\n  } catch (error) {\n    throw new Error('Failed to derive elliptic curve secret key', { cause: error });\n  }\n}\n\n/**\n * Generates elliptic curve key pair\n *\n * @returns The generated key pair\n */\nexport async function generateEccKeys(): Promise<{ secretKey: Uint8Array; publicKey: Uint8Array }> {\n  return x25519.keygen();\n}\n"],"mappings":";;;;;;;;;;;AASA,eAAsB,gBAAgB,gBAA4B,cAA+C;AAC/G,KAAI;AACF,SAAO,MAAMA,2BAAAA,OAAO,gBAAgB,gBAAgB,aAAa;UAC1D,OAAO;AACd,QAAM,IAAI,MAAM,8CAA8C,EAAE,OAAO,OAAO,CAAC;;;;;;;;AASnF,eAAsB,kBAA6E;AACjG,QAAOA,2BAAAA,OAAO,QAAQ"}

package/dist/asymmetric-crypto.mjs

@@ -1,5 +1,4 @@
 import { x25519 } from "@noble/curves/webcrypto.js";
-
 //#region src/asymmetric-crypto/ellipticCurve.ts
 /**
 * Derives secret key from the other user's public key and own private key
@@ -23,7 +22,7 @@ async function deriveSecretKey(aliceSecretKey, bobPublicKey) {
 async function generateEccKeys() {
 	return x25519.keygen();
 }
-
 //#endregion
 export { deriveSecretKey, generateEccKeys };
+
 //# sourceMappingURL=asymmetric-crypto.mjs.map

package/dist/asymmetric-crypto.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"asymmetric-crypto.mjs","names":[],"sources":["../src/asymmetric-crypto/ellipticCurve.ts"],"sourcesContent":["import { x25519 } from '@noble/curves/webcrypto.js';\n\n/**\n * Derives secret key from the other user's public key and own private key\n *\n * @param aliceSecretKey - The secret key of the user deriving the shared secret key\n * @param bobPublicKey - The public key of the other user\n * @returns The derived secret key bits\n */\nexport async function deriveSecretKey(aliceSecretKey: Uint8Array, bobPublicKey: Uint8Array): Promise<Uint8Array> {\n  try {\n    return await x25519.getSharedSecret(aliceSecretKey, bobPublicKey);\n  } catch (error) {\n    throw new Error('Failed to derive elliptic curve secret key', { cause: error });\n  }\n}\n\n/**\n * Generates elliptic curve key pair\n *\n * @returns The generated key pair\n */\nexport async function generateEccKeys(): Promise<{ secretKey: Uint8Array; publicKey: Uint8Array }> {\n  return x25519.keygen();\n}\n"],"mappings":";;;;;;;;;;AASA,eAAsB,gBAAgB,gBAA4B,cAA+C;AAC/G,KAAI;AACF,SAAO,MAAM,OAAO,gBAAgB,gBAAgB,aAAa;UAC1D,OAAO;AACd,QAAM,IAAI,MAAM,8CAA8C,EAAE,OAAO,OAAO,CAAC;;;;;;;;AASnF,eAAsB,kBAA6E;AACjG,QAAO,OAAO,QAAQ"}
+{"version":3,"file":"asymmetric-crypto.mjs","names":[],"sources":["../src/asymmetric-crypto/ellipticCurve.ts"],"sourcesContent":["import { x25519 } from '@noble/curves/webcrypto.js';\n\n/**\n * Derives secret key from the other user's public key and own private key\n *\n * @param aliceSecretKey - The secret key of the user deriving the shared secret key\n * @param bobPublicKey - The public key of the other user\n * @returns The derived secret key bits\n */\nexport async function deriveSecretKey(aliceSecretKey: Uint8Array, bobPublicKey: Uint8Array): Promise<Uint8Array> {\n  try {\n    return await x25519.getSharedSecret(aliceSecretKey, bobPublicKey);\n  } catch (error) {\n    throw new Error('Failed to derive elliptic curve secret key', { cause: error });\n  }\n}\n\n/**\n * Generates elliptic curve key pair\n *\n * @returns The generated key pair\n */\nexport async function generateEccKeys(): Promise<{ secretKey: Uint8Array; publicKey: Uint8Array }> {\n  return x25519.keygen();\n}\n"],"mappings":";;;;;;;;;AASA,eAAsB,gBAAgB,gBAA4B,cAA+C;AAC/G,KAAI;AACF,SAAO,MAAM,OAAO,gBAAgB,gBAAgB,aAAa;UAC1D,OAAO;AACd,QAAM,IAAI,MAAM,8CAA8C,EAAE,OAAO,OAAO,CAAC;;;;;;;;AASnF,eAAsB,kBAA6E;AACjG,QAAO,OAAO,QAAQ"}

package/dist/chunk-C13QxCFV.js

@@ -0,0 +1,50 @@
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+Object.defineProperty(exports, "__commonJSMin", {
+	enumerable: true,
+	get: function() {
+		return __commonJSMin;
+	}
+});
+Object.defineProperty(exports, "__exportAll", {
+	enumerable: true,
+	get: function() {
+		return __exportAll;
+	}
+});
+Object.defineProperty(exports, "__toESM", {
+	enumerable: true,
+	get: function() {
+		return __toESM;
+	}
+});

package/dist/chunk-CfYAbeIz.mjs

@@ -0,0 +1,13 @@
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+export { __exportAll as t };

package/dist/constants.js

@@ -1,5 +1,4 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 //#region src/constants.ts
 const AES_KEY_BYTE_LENGTH = 32;
 const IV_LEN_BYTES = 12;
@@ -24,7 +23,6 @@ const XWING_PUBLIC_KEY_LENGTH = 1216;
 const XWING_SECRET_KEY_LENGTH = 32;
 const XWING_SEED_BYTE_LENGTH = 32;
 const XWING_CIPHERTEXT_BYTE_LENGTH = 1120;
-
 //#endregion
 exports.AES_KEY_BYTE_LENGTH = AES_KEY_BYTE_LENGTH;
 exports.ARGON2ID_ITERATIONS = ARGON2ID_ITERATIONS;
@@ -49,4 +47,5 @@ exports.XWING_CIPHERTEXT_BYTE_LENGTH = XWING_CIPHERTEXT_BYTE_LENGTH;
 exports.XWING_PUBLIC_KEY_LENGTH = XWING_PUBLIC_KEY_LENGTH;
 exports.XWING_SECRET_KEY_LENGTH = XWING_SECRET_KEY_LENGTH;
 exports.XWING_SEED_BYTE_LENGTH = XWING_SEED_BYTE_LENGTH;
+
 //# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","names":[],"sources":["../src/constants.ts"],"sourcesContent":["export const AES_KEY_BYTE_LENGTH = 32;\nexport const IV_LEN_BYTES = 12;\n\nexport const CONTEXT_ENC_KEYSTORE = 'CRYPTO library 2025-07-30 16:18:03 key for opening encryption keys keystore';\nexport const CONTEXT_RECOVERY = 'CRYPTO library 2025-07-30 16:20:00 key for account recovery';\nexport const CONTEXT_DATABASE = 'CRYPTO library 2025-07-30 17:20:00 key for protecting current search indices';\nexport const CONTEXT_DRAFT = 'CRYPTO library 2026-04-23 10:56:00 key for protecting email drafts';\nexport const CONTEXT_TWO_KEYS = 'CRYPTO library 2025-08-27 17:08:00 derive one key from two keys';\n\n// Second recommended parameter set from RFC 9106\nexport const ARGON2ID_PARALLELISM = 3;\nexport const ARGON2ID_ITERATIONS = 4;\nexport const ARGON2ID_MEMORY_SIZE = 65536;\nexport const ARGON2ID_SALT_BYTE_LENGTH = 16;\nexport const ARGON2ID_OUTPUT_BYTE_LENGTH = 32;\n\nexport const KYBER768_PUBLIC_KEY_LENGTH = 1184;\nexport const KYBER768_SECRET_KEY_LENGTH = 2400;\nexport const KYBER_SEED_LENGTH = 64;\n\nexport const MAX_CACHE_SIZE = 600000000; // 600 MB\nexport const MAX_EMAIL_PER_BATCH = 100;\nexport const DB_LABEL = 'email';\nexport const DB_VERSION = 1;\n\nexport const XWING_PUBLIC_KEY_LENGTH = 1216;\nexport const XWING_SECRET_KEY_LENGTH = 32;\nexport const XWING_SEED_BYTE_LENGTH = 32;\nexport const XWING_CIPHERTEXT_BYTE_LENGTH = 1120;\n"],"mappings":";;;AAAA,MAAa,sBAAsB;AACnC,MAAa,eAAe;AAE5B,MAAa,uBAAuB;AACpC,MAAa,mBAAmB;AAChC,MAAa,mBAAmB;AAChC,MAAa,gBAAgB;AAC7B,MAAa,mBAAmB;AAGhC,MAAa,uBAAuB;AACpC,MAAa,sBAAsB;AACnC,MAAa,uBAAuB;AACpC,MAAa,4BAA4B;AACzC,MAAa,8BAA8B;AAE3C,MAAa,6BAA6B;AAC1C,MAAa,6BAA6B;AAC1C,MAAa,oBAAoB;AAEjC,MAAa,iBAAiB;AAC9B,MAAa,sBAAsB;AACnC,MAAa,WAAW;AACxB,MAAa,aAAa;AAE1B,MAAa,0BAA0B;AACvC,MAAa,0BAA0B;AACvC,MAAa,yBAAyB;AACtC,MAAa,+BAA+B"}
+{"version":3,"file":"constants.js","names":[],"sources":["../src/constants.ts"],"sourcesContent":["export const AES_KEY_BYTE_LENGTH = 32;\nexport const IV_LEN_BYTES = 12;\n\nexport const CONTEXT_ENC_KEYSTORE = 'CRYPTO library 2025-07-30 16:18:03 key for opening encryption keys keystore';\nexport const CONTEXT_RECOVERY = 'CRYPTO library 2025-07-30 16:20:00 key for account recovery';\nexport const CONTEXT_DATABASE = 'CRYPTO library 2025-07-30 17:20:00 key for protecting current search indices';\nexport const CONTEXT_DRAFT = 'CRYPTO library 2026-04-23 10:56:00 key for protecting email drafts';\nexport const CONTEXT_TWO_KEYS = 'CRYPTO library 2025-08-27 17:08:00 derive one key from two keys';\n\n// Second recommended parameter set from RFC 9106\nexport const ARGON2ID_PARALLELISM = 3;\nexport const ARGON2ID_ITERATIONS = 4;\nexport const ARGON2ID_MEMORY_SIZE = 65536;\nexport const ARGON2ID_SALT_BYTE_LENGTH = 16;\nexport const ARGON2ID_OUTPUT_BYTE_LENGTH = 32;\n\nexport const KYBER768_PUBLIC_KEY_LENGTH = 1184;\nexport const KYBER768_SECRET_KEY_LENGTH = 2400;\nexport const KYBER_SEED_LENGTH = 64;\n\nexport const MAX_CACHE_SIZE = 600000000; // 600 MB\nexport const MAX_EMAIL_PER_BATCH = 100;\nexport const DB_LABEL = 'email';\nexport const DB_VERSION = 1;\n\nexport const XWING_PUBLIC_KEY_LENGTH = 1216;\nexport const XWING_SECRET_KEY_LENGTH = 32;\nexport const XWING_SEED_BYTE_LENGTH = 32;\nexport const XWING_CIPHERTEXT_BYTE_LENGTH = 1120;\n"],"mappings":";;AAAA,MAAa,sBAAsB;AACnC,MAAa,eAAe;AAE5B,MAAa,uBAAuB;AACpC,MAAa,mBAAmB;AAChC,MAAa,mBAAmB;AAChC,MAAa,gBAAgB;AAC7B,MAAa,mBAAmB;AAGhC,MAAa,uBAAuB;AACpC,MAAa,sBAAsB;AACnC,MAAa,uBAAuB;AACpC,MAAa,4BAA4B;AACzC,MAAa,8BAA8B;AAE3C,MAAa,6BAA6B;AAC1C,MAAa,6BAA6B;AAC1C,MAAa,oBAAoB;AAEjC,MAAa,iBAAiB;AAC9B,MAAa,sBAAsB;AACnC,MAAa,WAAW;AACxB,MAAa,aAAa;AAE1B,MAAa,0BAA0B;AACvC,MAAa,0BAA0B;AACvC,MAAa,yBAAyB;AACtC,MAAa,+BAA+B"}

package/dist/constants.mjs

@@ -22,7 +22,7 @@ const XWING_PUBLIC_KEY_LENGTH = 1216;
 const XWING_SECRET_KEY_LENGTH = 32;
 const XWING_SEED_BYTE_LENGTH = 32;
 const XWING_CIPHERTEXT_BYTE_LENGTH = 1120;
-
 //#endregion
 export { AES_KEY_BYTE_LENGTH, ARGON2ID_ITERATIONS, ARGON2ID_MEMORY_SIZE, ARGON2ID_OUTPUT_BYTE_LENGTH, ARGON2ID_PARALLELISM, ARGON2ID_SALT_BYTE_LENGTH, CONTEXT_DATABASE, CONTEXT_DRAFT, CONTEXT_ENC_KEYSTORE, CONTEXT_RECOVERY, CONTEXT_TWO_KEYS, DB_LABEL, DB_VERSION, IV_LEN_BYTES, KYBER768_PUBLIC_KEY_LENGTH, KYBER768_SECRET_KEY_LENGTH, KYBER_SEED_LENGTH, MAX_CACHE_SIZE, MAX_EMAIL_PER_BATCH, XWING_CIPHERTEXT_BYTE_LENGTH, XWING_PUBLIC_KEY_LENGTH, XWING_SECRET_KEY_LENGTH, XWING_SEED_BYTE_LENGTH };
+
 //# sourceMappingURL=constants.mjs.map

package/dist/derive-key.js

@@ -1,6 +1,51 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_deriveKeysFromMnemonic = require('./deriveKeysFromMnemonic-Dbx7VSBQ.js');
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("./chunk-C13QxCFV.js");
+const require_constants = require("./constants.js");
+const require_utils = require("./utils.js");
+let _noble_hashes_blake3_js = require("@noble/hashes/blake3.js");
+//#region src/derive-key/deriveKeysFromKey.ts
+/**
+* Derives a symmetric key from the base key and context string
+*
+* @param context - The context string.
+* The context string should be hardcoded, globally unique, and application-specific.
+* @param baseKey - The base key (NOT PASSWORD!)
+* @returns The derived secret key
+*/
+function deriveSymmetricKeyFromContext(context, baseKey) {
+	return (0, _noble_hashes_blake3_js.blake3)(baseKey, { context: require_utils.UTF8ToUint8(context) });
+}
+/**
+* Derives a symmetric key from two keys
+*
+* @param key1 - The 32-bytes key
+* @param key2 - The 32-bytes key
+* @returns The derived secret key
+*/
+function deriveSymmetricKeyFromTwoKeys(key1, key2) {
+	try {
+		if (key2.length !== 32 || key1.length !== 32) throw new Error(`Input key length must be exactly 32 bytes`);
+		return deriveSymmetricKeyFromContext(require_constants.CONTEXT_TWO_KEYS, (0, _noble_hashes_blake3_js.blake3)(key1, { key: key2 }));
+	} catch (error) {
+		throw new Error("Failed to derive symmetric key from two keys and context", { cause: error });
+	}
+}
+//#endregion
+//#region src/derive-key/deriveKeysFromMnemonic.ts
+/**
+* Derives encryption key from the user's mnemonic and context string
+*
+* @param mnemonic - The user's mnemonic (machine-generated with secure PRNG)
+* @param context - The context string.
+* The context string should be hardcoded, globally unique, and application-specific.
+* @returns The symmetric key for protecting database
+*/
+const deriveKeyFromMnemonic = async (mnemonic, context) => {
+	return deriveSymmetricKeyFromContext(context, require_utils.mnemonicToBytes(mnemonic));
+};
+//#endregion
+exports.deriveKeyFromMnemonic = deriveKeyFromMnemonic;
+exports.deriveSymmetricKeyFromContext = deriveSymmetricKeyFromContext;
+exports.deriveSymmetricKeyFromTwoKeys = deriveSymmetricKeyFromTwoKeys;
 
-exports.deriveKeyFromMnemonic = require_deriveKeysFromMnemonic.deriveKeyFromMnemonic;
-exports.deriveSymmetricKeyFromContext = require_deriveKeysFromMnemonic.deriveSymmetricKeyFromContext;
-exports.deriveSymmetricKeyFromTwoKeys = require_deriveKeysFromMnemonic.deriveSymmetricKeyFromTwoKeys;
+//# sourceMappingURL=derive-key.js.map

package/dist/derive-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-key.js","names":["UTF8ToUint8","CONTEXT_TWO_KEYS","mnemonicToBytes"],"sources":["../src/derive-key/deriveKeysFromKey.ts","../src/derive-key/deriveKeysFromMnemonic.ts"],"sourcesContent":["import { blake3 } from '@noble/hashes/blake3.js';\nimport { AES_KEY_BYTE_LENGTH, CONTEXT_TWO_KEYS } from '../constants';\nimport { UTF8ToUint8 } from '../utils';\n\n/**\n * Derives a symmetric key from the base key and context string\n *\n * @param context - The context string.\n * The context string should be hardcoded, globally unique, and application-specific.\n * @param baseKey - The base key (NOT PASSWORD!)\n * @returns The derived secret key\n */\nexport function deriveSymmetricKeyFromContext(context: string, baseKey: Uint8Array): Uint8Array {\n  return blake3(baseKey, { context: UTF8ToUint8(context) });\n}\n\n/**\n * Derives a symmetric key from two keys\n *\n * @param key1 - The 32-bytes key\n * @param key2 - The 32-bytes key\n * @returns The derived secret key\n */\nexport function deriveSymmetricKeyFromTwoKeys(key1: Uint8Array, key2: Uint8Array): Uint8Array {\n  try {\n    if (key2.length !== AES_KEY_BYTE_LENGTH || key1.length !== AES_KEY_BYTE_LENGTH) {\n      throw new Error(`Input key length must be exactly ${AES_KEY_BYTE_LENGTH} bytes`);\n    }\n    const key = blake3(key1, { key: key2 });\n    return deriveSymmetricKeyFromContext(CONTEXT_TWO_KEYS, key);\n  } catch (error) {\n    throw new Error('Failed to derive symmetric key from two keys and context', { cause: error });\n  }\n}\n","import { mnemonicToBytes } from '../utils';\nimport { deriveSymmetricKeyFromContext } from './deriveKeysFromKey';\n\n/**\n * Derives encryption key from the user's mnemonic and context string\n *\n * @param mnemonic - The user's mnemonic (machine-generated with secure PRNG)\n * @param context - The context string.\n * The context string should be hardcoded, globally unique, and application-specific.\n * @returns The symmetric key for protecting database\n */\nexport const deriveKeyFromMnemonic = async (mnemonic: string, context: string): Promise<Uint8Array> => {\n  // mnemonic is always machine-generated with secure PRNG, so it is safe to convert it to bytes without additional processing\n  const entropy = mnemonicToBytes(mnemonic);\n  return deriveSymmetricKeyFromContext(context, entropy);\n};\n"],"mappings":";;;;;;;;;;;;;;AAYA,SAAgB,8BAA8B,SAAiB,SAAiC;AAC9F,SAAA,GAAA,wBAAA,QAAc,SAAS,EAAE,SAASA,cAAAA,YAAY,QAAQ,EAAE,CAAC;;;;;;;;;AAU3D,SAAgB,8BAA8B,MAAkB,MAA8B;AAC5F,KAAI;AACF,MAAI,KAAK,WAAA,MAAkC,KAAK,WAAA,GAC9C,OAAM,IAAI,MAAM,4CAAgE;AAGlF,SAAO,8BAA8BC,kBAAAA,mBAAAA,GAAAA,wBAAAA,QADlB,MAAM,EAAE,KAAK,MAAM,CACoB,CAAC;UACpD,OAAO;AACd,QAAM,IAAI,MAAM,4DAA4D,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;;;;ACpBjG,MAAa,wBAAwB,OAAO,UAAkB,YAAyC;AAGrG,QAAO,8BAA8B,SADrBC,cAAAA,gBAAgB,SACqB,CAAC"}

package/dist/derive-key.mjs

@@ -1,3 +1,47 @@
-import { n as deriveSymmetricKeyFromContext, r as deriveSymmetricKeyFromTwoKeys, t as deriveKeyFromMnemonic } from "./deriveKeysFromMnemonic-DB0UHE-y.mjs";
+import { CONTEXT_TWO_KEYS } from "./constants.mjs";
+import { UTF8ToUint8, mnemonicToBytes } from "./utils.mjs";
+import { blake3 } from "@noble/hashes/blake3.js";
+//#region src/derive-key/deriveKeysFromKey.ts
+/**
+* Derives a symmetric key from the base key and context string
+*
+* @param context - The context string.
+* The context string should be hardcoded, globally unique, and application-specific.
+* @param baseKey - The base key (NOT PASSWORD!)
+* @returns The derived secret key
+*/
+function deriveSymmetricKeyFromContext(context, baseKey) {
+	return blake3(baseKey, { context: UTF8ToUint8(context) });
+}
+/**
+* Derives a symmetric key from two keys
+*
+* @param key1 - The 32-bytes key
+* @param key2 - The 32-bytes key
+* @returns The derived secret key
+*/
+function deriveSymmetricKeyFromTwoKeys(key1, key2) {
+	try {
+		if (key2.length !== 32 || key1.length !== 32) throw new Error(`Input key length must be exactly 32 bytes`);
+		return deriveSymmetricKeyFromContext(CONTEXT_TWO_KEYS, blake3(key1, { key: key2 }));
+	} catch (error) {
+		throw new Error("Failed to derive symmetric key from two keys and context", { cause: error });
+	}
+}
+//#endregion
+//#region src/derive-key/deriveKeysFromMnemonic.ts
+/**
+* Derives encryption key from the user's mnemonic and context string
+*
+* @param mnemonic - The user's mnemonic (machine-generated with secure PRNG)
+* @param context - The context string.
+* The context string should be hardcoded, globally unique, and application-specific.
+* @returns The symmetric key for protecting database
+*/
+const deriveKeyFromMnemonic = async (mnemonic, context) => {
+	return deriveSymmetricKeyFromContext(context, mnemonicToBytes(mnemonic));
+};
+//#endregion
+export { deriveKeyFromMnemonic, deriveSymmetricKeyFromContext, deriveSymmetricKeyFromTwoKeys };
 
-export { deriveKeyFromMnemonic, deriveSymmetricKeyFromContext, deriveSymmetricKeyFromTwoKeys };
+//# sourceMappingURL=derive-key.mjs.map

package/dist/derive-key.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-key.mjs","names":[],"sources":["../src/derive-key/deriveKeysFromKey.ts","../src/derive-key/deriveKeysFromMnemonic.ts"],"sourcesContent":["import { blake3 } from '@noble/hashes/blake3.js';\nimport { AES_KEY_BYTE_LENGTH, CONTEXT_TWO_KEYS } from '../constants';\nimport { UTF8ToUint8 } from '../utils';\n\n/**\n * Derives a symmetric key from the base key and context string\n *\n * @param context - The context string.\n * The context string should be hardcoded, globally unique, and application-specific.\n * @param baseKey - The base key (NOT PASSWORD!)\n * @returns The derived secret key\n */\nexport function deriveSymmetricKeyFromContext(context: string, baseKey: Uint8Array): Uint8Array {\n  return blake3(baseKey, { context: UTF8ToUint8(context) });\n}\n\n/**\n * Derives a symmetric key from two keys\n *\n * @param key1 - The 32-bytes key\n * @param key2 - The 32-bytes key\n * @returns The derived secret key\n */\nexport function deriveSymmetricKeyFromTwoKeys(key1: Uint8Array, key2: Uint8Array): Uint8Array {\n  try {\n    if (key2.length !== AES_KEY_BYTE_LENGTH || key1.length !== AES_KEY_BYTE_LENGTH) {\n      throw new Error(`Input key length must be exactly ${AES_KEY_BYTE_LENGTH} bytes`);\n    }\n    const key = blake3(key1, { key: key2 });\n    return deriveSymmetricKeyFromContext(CONTEXT_TWO_KEYS, key);\n  } catch (error) {\n    throw new Error('Failed to derive symmetric key from two keys and context', { cause: error });\n  }\n}\n","import { mnemonicToBytes } from '../utils';\nimport { deriveSymmetricKeyFromContext } from './deriveKeysFromKey';\n\n/**\n * Derives encryption key from the user's mnemonic and context string\n *\n * @param mnemonic - The user's mnemonic (machine-generated with secure PRNG)\n * @param context - The context string.\n * The context string should be hardcoded, globally unique, and application-specific.\n * @returns The symmetric key for protecting database\n */\nexport const deriveKeyFromMnemonic = async (mnemonic: string, context: string): Promise<Uint8Array> => {\n  // mnemonic is always machine-generated with secure PRNG, so it is safe to convert it to bytes without additional processing\n  const entropy = mnemonicToBytes(mnemonic);\n  return deriveSymmetricKeyFromContext(context, entropy);\n};\n"],"mappings":";;;;;;;;;;;;AAYA,SAAgB,8BAA8B,SAAiB,SAAiC;AAC9F,QAAO,OAAO,SAAS,EAAE,SAAS,YAAY,QAAQ,EAAE,CAAC;;;;;;;;;AAU3D,SAAgB,8BAA8B,MAAkB,MAA8B;AAC5F,KAAI;AACF,MAAI,KAAK,WAAA,MAAkC,KAAK,WAAA,GAC9C,OAAM,IAAI,MAAM,4CAAgE;AAGlF,SAAO,8BAA8B,kBADzB,OAAO,MAAM,EAAE,KAAK,MAAM,CACoB,CAAC;UACpD,OAAO;AACd,QAAM,IAAI,MAAM,4DAA4D,EAAE,OAAO,OAAO,CAAC;;;;;;;;;;;;;ACpBjG,MAAa,wBAAwB,OAAO,UAAkB,YAAyC;AAGrG,QAAO,8BAA8B,SADrB,gBAAgB,SACqB,CAAC"}

package/dist/{deriveKeysFromPassword-iMHv-tIA.js → derive-password-CbYRDq7V.js}

@@ -1,9 +1,9 @@
-const require_chunk = require('./chunk-EbLFQX5m.js');
-const require_constants = require('./constants.js');
+const require_chunk = require("./chunk-C13QxCFV.js");
+const require_constants = require("./constants.js");
 let _noble_hashes_utils_js = require("@noble/hashes/utils.js");
-
-//#region node_modules/hash-wasm/dist/index.umd.js
-var require_index_umd = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, module) => {
+//#endregion
+//#region src/derive-password/core.ts
+var import_index_umd = (/* @__PURE__ */ require_chunk.__commonJSMin(((exports, module) => {
 	/*!
 	* hash-wasm (https://www.npmjs.com/package/hash-wasm)
 	* (c) Dani Biro
@@ -2234,11 +2234,7 @@ var require_index_umd = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, m
 		exports$1.xxhash32 = xxhash32;
 		exports$1.xxhash64 = xxhash64;
 	}));
-}));
-
-//#endregion
-//#region src/derive-password/core.ts
-var import_index_umd = require_index_umd();
+})))();
 /**
 * Calculates hash using the argon2id password-hashing function
 *
@@ -2250,7 +2246,7 @@ var import_index_umd = require_index_umd();
 * @param hashLength - The desired hash byte length
 * @returns The resulting hash
 */
-async function argon2(password, salt, parallelism = require_constants.ARGON2ID_PARALLELISM, iterations = require_constants.ARGON2ID_ITERATIONS, memorySize = require_constants.ARGON2ID_MEMORY_SIZE, hashLength = require_constants.ARGON2ID_OUTPUT_BYTE_LENGTH) {
+async function argon2(password, salt, parallelism = 3, iterations = 4, memorySize = require_constants.ARGON2ID_MEMORY_SIZE, hashLength = 32) {
 	return (0, import_index_umd.argon2id)({
 		password,
 		salt,
@@ -2261,7 +2257,6 @@ async function argon2(password, salt, parallelism = require_constants.ARGON2ID_P
 		outputType: "binary"
 	});
 }
-
 //#endregion
 //#region src/derive-password/deriveKeysFromPassword.ts
 /**
@@ -2270,7 +2265,7 @@ async function argon2(password, salt, parallelism = require_constants.ARGON2ID_P
 * @returns The salt
 */
 function generateSalt() {
-	return (0, _noble_hashes_utils_js.randomBytes)(require_constants.ARGON2ID_SALT_BYTE_LENGTH);
+	return (0, _noble_hashes_utils_js.randomBytes)(16);
 }
 /**
 * Derives a symmetric key from a user's password with a randomly sampled salt
@@ -2303,24 +2298,24 @@ async function getKeyFromPasswordAndSalt(password, salt) {
 		throw new Error("Failed to derive key from password and salt", { cause: error });
 	}
 }
-
 //#endregion
-Object.defineProperty(exports, 'generateSalt', {
-  enumerable: true,
-  get: function () {
-    return generateSalt;
-  }
+Object.defineProperty(exports, "generateSalt", {
+	enumerable: true,
+	get: function() {
+		return generateSalt;
+	}
 });
-Object.defineProperty(exports, 'getKeyFromPassword', {
-  enumerable: true,
-  get: function () {
-    return getKeyFromPassword;
-  }
+Object.defineProperty(exports, "getKeyFromPassword", {
+	enumerable: true,
+	get: function() {
+		return getKeyFromPassword;
+	}
 });
-Object.defineProperty(exports, 'getKeyFromPasswordAndSalt', {
-  enumerable: true,
-  get: function () {
-    return getKeyFromPasswordAndSalt;
-  }
+Object.defineProperty(exports, "getKeyFromPasswordAndSalt", {
+	enumerable: true,
+	get: function() {
+		return getKeyFromPasswordAndSalt;
+	}
 });
-//# sourceMappingURL=deriveKeysFromPassword-iMHv-tIA.js.map
+
+//# sourceMappingURL=derive-password-CbYRDq7V.js.map