quantumsure-qstore 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,14 @@
-# Temporary Holding Version
+# quantumsure-qstore
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Quantum-resistant field-level encryption for client data.
+
+Encrypt sensitive fields **before** they are written to your database.  
+Decrypt them only when you need the plaintext.  
+The plaintext never leaves your environment.
+
+Powered by **ML-KEM-1024** (Kyber) + **ChaCha20-Poly1305**.
+
+## Installation
+
+```bash
+npm install quantumsure-qstore

package/dist/index.d.mts

@@ -0,0 +1,23 @@
+/**
+ * Encrypt plaintext with a recipient's ML-KEM-1024 public key.
+ *
+ * Format of the returned blob:
+ *   kemCiphertext : nonce : ciphertext : authTag
+ * (all parts base64, separated by `:`)
+ *
+ * @param plaintext    - The field value to protect
+ * @param publicKeyB64 - Recipient's public key (base64)
+ * @returns Encrypted blob that is safe to store in any database
+ */
+declare function qstoreEncrypt(plaintext: string, publicKeyB64: string): Promise<string>;
+
+/**
+ * Decrypt a blob previously produced by qstoreEncrypt.
+ *
+ * @param encryptedBlob - The string returned by qstoreEncrypt
+ * @param privateKeyB64 - The corresponding ML-KEM-1024 private key (base64)
+ * @returns Original plaintext
+ */
+declare function qstoreDecrypt(encryptedBlob: string, privateKeyB64: string): Promise<string>;
+
+export { qstoreDecrypt, qstoreEncrypt };

package/dist/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Encrypt plaintext with a recipient's ML-KEM-1024 public key.
+ *
+ * Format of the returned blob:
+ *   kemCiphertext : nonce : ciphertext : authTag
+ * (all parts base64, separated by `:`)
+ *
+ * @param plaintext    - The field value to protect
+ * @param publicKeyB64 - Recipient's public key (base64)
+ * @returns Encrypted blob that is safe to store in any database
+ */
+declare function qstoreEncrypt(plaintext: string, publicKeyB64: string): Promise<string>;
+
+/**
+ * Decrypt a blob previously produced by qstoreEncrypt.
+ *
+ * @param encryptedBlob - The string returned by qstoreEncrypt
+ * @param privateKeyB64 - The corresponding ML-KEM-1024 private key (base64)
+ * @returns Original plaintext
+ */
+declare function qstoreDecrypt(encryptedBlob: string, privateKeyB64: string): Promise<string>;
+
+export { qstoreDecrypt, qstoreEncrypt };

package/dist/index.js

@@ -0,0 +1,124 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  qstoreDecrypt: () => qstoreDecrypt,
+  qstoreEncrypt: () => qstoreEncrypt
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/encrypt.ts
+var import_mlkem = require("mlkem");
+var import_chacha = require("@noble/ciphers/chacha.js");
+
+// src/utils.ts
+var import_buffer = require("buffer");
+function randomBytes(length) {
+  const array = new Uint8Array(length);
+  crypto.getRandomValues(array);
+  return import_buffer.Buffer.from(array);
+}
+async function computeMac(data, key) {
+  const dataBytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
+  const keyBytes = typeof key === "string" ? new TextEncoder().encode(key) : key;
+  const combined = import_buffer.Buffer.concat([
+    import_buffer.Buffer.from(dataBytes),
+    import_buffer.Buffer.from(keyBytes)
+  ]);
+  const hash = await crypto.subtle.digest("SHA-256", combined);
+  return import_buffer.Buffer.from(hash);
+}
+function toBase64(data) {
+  return import_buffer.Buffer.from(data).toString("base64");
+}
+function fromBase64(b64) {
+  return import_buffer.Buffer.from(b64, "base64");
+}
+
+// src/encrypt.ts
+async function qstoreEncrypt(plaintext, publicKeyB64) {
+  if (!plaintext && plaintext !== "") {
+    throw new Error("qstoreEncrypt: plaintext is required");
+  }
+  if (!publicKeyB64) {
+    throw new Error("qstoreEncrypt: publicKeyB64 is required");
+  }
+  const publicKey = fromBase64(publicKeyB64);
+  const kem = new import_mlkem.MlKem1024();
+  const [kemCiphertext, sharedSecret] = await kem.encap(publicKey);
+  const nonce = randomBytes(12);
+  const dataBytes = new TextEncoder().encode(plaintext);
+  const chacha = (0, import_chacha.chacha20poly1305)(sharedSecret, nonce);
+  const encrypted = chacha.encrypt(dataBytes);
+  const combinedForMac = new TextEncoder().encode(
+    `${toBase64(nonce)}${toBase64(encrypted)}`
+  );
+  const authTag = await computeMac(combinedForMac, sharedSecret);
+  return [
+    toBase64(kemCiphertext),
+    toBase64(nonce),
+    toBase64(encrypted),
+    toBase64(authTag)
+  ].join(":");
+}
+
+// src/decrypt.ts
+var import_mlkem2 = require("mlkem");
+var import_chacha2 = require("@noble/ciphers/chacha.js");
+async function qstoreDecrypt(encryptedBlob, privateKeyB64) {
+  if (!encryptedBlob) {
+    throw new Error("qstoreDecrypt: encryptedBlob is required");
+  }
+  if (!privateKeyB64) {
+    throw new Error("qstoreDecrypt: privateKeyB64 is required");
+  }
+  const parts = encryptedBlob.split(":");
+  if (parts.length !== 4) {
+    throw new Error(
+      "qstoreDecrypt: invalid encrypted blob format (expected 4 parts)"
+    );
+  }
+  const [kemCiphertextB64, nonceB64, encryptedB64, authTagB64] = parts;
+  const privateKey = fromBase64(privateKeyB64);
+  const kemCiphertext = fromBase64(kemCiphertextB64);
+  const nonce = fromBase64(nonceB64);
+  const encrypted = fromBase64(encryptedB64);
+  const authTag = fromBase64(authTagB64);
+  const kem = new import_mlkem2.MlKem1024();
+  const sharedSecret = await kem.decap(kemCiphertext, privateKey);
+  const combinedForMac = new TextEncoder().encode(
+    `${nonceB64}${encryptedB64}`
+  );
+  const computedMac = await computeMac(combinedForMac, sharedSecret);
+  if (!computedMac.equals(authTag)) {
+    throw new Error(
+      "qstoreDecrypt: invalid MAC \u2013 data may have been tampered with"
+    );
+  }
+  const chacha = (0, import_chacha2.chacha20poly1305)(sharedSecret, nonce);
+  const decrypted = chacha.decrypt(encrypted);
+  return new TextDecoder().decode(decrypted);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  qstoreDecrypt,
+  qstoreEncrypt
+});

package/dist/index.mjs

@@ -0,0 +1,96 @@
+// src/encrypt.ts
+import { MlKem1024 } from "mlkem";
+import { chacha20poly1305 } from "@noble/ciphers/chacha.js";
+
+// src/utils.ts
+import { Buffer } from "buffer";
+function randomBytes(length) {
+  const array = new Uint8Array(length);
+  crypto.getRandomValues(array);
+  return Buffer.from(array);
+}
+async function computeMac(data, key) {
+  const dataBytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
+  const keyBytes = typeof key === "string" ? new TextEncoder().encode(key) : key;
+  const combined = Buffer.concat([
+    Buffer.from(dataBytes),
+    Buffer.from(keyBytes)
+  ]);
+  const hash = await crypto.subtle.digest("SHA-256", combined);
+  return Buffer.from(hash);
+}
+function toBase64(data) {
+  return Buffer.from(data).toString("base64");
+}
+function fromBase64(b64) {
+  return Buffer.from(b64, "base64");
+}
+
+// src/encrypt.ts
+async function qstoreEncrypt(plaintext, publicKeyB64) {
+  if (!plaintext && plaintext !== "") {
+    throw new Error("qstoreEncrypt: plaintext is required");
+  }
+  if (!publicKeyB64) {
+    throw new Error("qstoreEncrypt: publicKeyB64 is required");
+  }
+  const publicKey = fromBase64(publicKeyB64);
+  const kem = new MlKem1024();
+  const [kemCiphertext, sharedSecret] = await kem.encap(publicKey);
+  const nonce = randomBytes(12);
+  const dataBytes = new TextEncoder().encode(plaintext);
+  const chacha = chacha20poly1305(sharedSecret, nonce);
+  const encrypted = chacha.encrypt(dataBytes);
+  const combinedForMac = new TextEncoder().encode(
+    `${toBase64(nonce)}${toBase64(encrypted)}`
+  );
+  const authTag = await computeMac(combinedForMac, sharedSecret);
+  return [
+    toBase64(kemCiphertext),
+    toBase64(nonce),
+    toBase64(encrypted),
+    toBase64(authTag)
+  ].join(":");
+}
+
+// src/decrypt.ts
+import { MlKem1024 as MlKem10242 } from "mlkem";
+import { chacha20poly1305 as chacha20poly13052 } from "@noble/ciphers/chacha.js";
+async function qstoreDecrypt(encryptedBlob, privateKeyB64) {
+  if (!encryptedBlob) {
+    throw new Error("qstoreDecrypt: encryptedBlob is required");
+  }
+  if (!privateKeyB64) {
+    throw new Error("qstoreDecrypt: privateKeyB64 is required");
+  }
+  const parts = encryptedBlob.split(":");
+  if (parts.length !== 4) {
+    throw new Error(
+      "qstoreDecrypt: invalid encrypted blob format (expected 4 parts)"
+    );
+  }
+  const [kemCiphertextB64, nonceB64, encryptedB64, authTagB64] = parts;
+  const privateKey = fromBase64(privateKeyB64);
+  const kemCiphertext = fromBase64(kemCiphertextB64);
+  const nonce = fromBase64(nonceB64);
+  const encrypted = fromBase64(encryptedB64);
+  const authTag = fromBase64(authTagB64);
+  const kem = new MlKem10242();
+  const sharedSecret = await kem.decap(kemCiphertext, privateKey);
+  const combinedForMac = new TextEncoder().encode(
+    `${nonceB64}${encryptedB64}`
+  );
+  const computedMac = await computeMac(combinedForMac, sharedSecret);
+  if (!computedMac.equals(authTag)) {
+    throw new Error(
+      "qstoreDecrypt: invalid MAC \u2013 data may have been tampered with"
+    );
+  }
+  const chacha = chacha20poly13052(sharedSecret, nonce);
+  const decrypted = chacha.decrypt(encrypted);
+  return new TextDecoder().decode(decrypted);
+}
+export {
+  qstoreDecrypt,
+  qstoreEncrypt
+};

package/package.json

@@ -1,6 +1,48 @@
 {
   "name": "quantumsure-qstore",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Quantum-resistant field-level encryption for client data. Encrypt before storage, decrypt on read — plaintext never leaves your environment.",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "module": "dist/index.mjs",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+
+    }
+  },
+  "files": ["dist"],
+  "scripts": {
+    "build": "tsup src/index.ts --format cjs,esm --dts --clean",
+    "dev": "tsup src/index.ts --format cjs,esm --dts --watch",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "quantum",
+    "post-quantum",
+    "encryption",
+    "field-level",
+    "ml-kem",
+    "kyber",
+    "zero-knowledge",
+    "quantumsure"
+  ],
+  "author": "QuantumSure",
+  "license": "MIT",
+  "dependencies": {
+    "mlkem": "^2.3.1",
+    "@noble/ciphers": "^1.0.0",
+    "buffer": "^6.0.3"
+  },
+  "devDependencies": {
+    "typescript": "^5.4.0",
+    "tsup": "^8.0.0",
+    "@types/node": "^20.0.0"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "sideEffects": false
+}