quantumsure-qstore 0.1.0 → 0.2.0

package/dist/index.d.mts

@@ -20,4 +20,20 @@ declare function qstoreEncrypt(plaintext: string, publicKeyB64: string): Promise
  */
 declare function qstoreDecrypt(encryptedBlob: string, privateKeyB64: string): Promise<string>;
 
-export { qstoreDecrypt, qstoreEncrypt };
+/**
+ * Encrypt file bytes for a recipient ML-KEM-1024 public key (base64).
+ *
+ * Bundle format (.qsecure):
+ *   version (2 bytes: 1,0)
+ *   kemLen  (2 bytes, big-endian)
+ *   kemCiphertext
+ *   nonce   (24 bytes)
+ *   encryptedFile (XChaCha20-Poly1305)
+ */
+declare function encryptFileBytes(fileBytes: Uint8Array, publicKeyB64: string): Promise<Uint8Array>;
+/**
+ * Decrypt a .qsecure bundle with the recipient ML-KEM-1024 private key (base64).
+ */
+declare function decryptFileBytes(bundle: Uint8Array, privateKeyB64: string): Promise<Uint8Array>;
+
+export { decryptFileBytes, encryptFileBytes, qstoreDecrypt, qstoreEncrypt };

package/dist/index.d.ts

@@ -20,4 +20,20 @@ declare function qstoreEncrypt(plaintext: string, publicKeyB64: string): Promise
  */
 declare function qstoreDecrypt(encryptedBlob: string, privateKeyB64: string): Promise<string>;
 
-export { qstoreDecrypt, qstoreEncrypt };
+/**
+ * Encrypt file bytes for a recipient ML-KEM-1024 public key (base64).
+ *
+ * Bundle format (.qsecure):
+ *   version (2 bytes: 1,0)
+ *   kemLen  (2 bytes, big-endian)
+ *   kemCiphertext
+ *   nonce   (24 bytes)
+ *   encryptedFile (XChaCha20-Poly1305)
+ */
+declare function encryptFileBytes(fileBytes: Uint8Array, publicKeyB64: string): Promise<Uint8Array>;
+/**
+ * Decrypt a .qsecure bundle with the recipient ML-KEM-1024 private key (base64).
+ */
+declare function decryptFileBytes(bundle: Uint8Array, privateKeyB64: string): Promise<Uint8Array>;
+
+export { decryptFileBytes, encryptFileBytes, qstoreDecrypt, qstoreEncrypt };

package/dist/index.js

@@ -20,6 +20,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  decryptFileBytes: () => decryptFileBytes,
+  encryptFileBytes: () => encryptFileBytes,
   qstoreDecrypt: () => qstoreDecrypt,
   qstoreEncrypt: () => qstoreEncrypt
 });
@@ -117,8 +119,93 @@ async function qstoreDecrypt(encryptedBlob, privateKeyB64) {
   const decrypted = chacha.decrypt(encrypted);
   return new TextDecoder().decode(decrypted);
 }
+
+// src/file.ts
+var import_mlkem3 = require("mlkem");
+var import_chacha3 = require("@noble/ciphers/chacha.js");
+var import_buffer2 = require("buffer");
+function randomBytes2(length) {
+  const out = new Uint8Array(length);
+  crypto.getRandomValues(out);
+  return out;
+}
+function fromBase642(b64) {
+  return new Uint8Array(import_buffer2.Buffer.from(b64, "base64"));
+}
+function concatBytes(...parts) {
+  const total = parts.reduce((n, p) => n + p.length, 0);
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+}
+async function encryptFileBytes(fileBytes, publicKeyB64) {
+  if (!(fileBytes instanceof Uint8Array) || fileBytes.length === 0) {
+    throw new Error("encryptFileBytes: fileBytes must be a non-empty Uint8Array");
+  }
+  if (!publicKeyB64) {
+    throw new Error("encryptFileBytes: publicKeyB64 is required");
+  }
+  const publicKey = fromBase642(publicKeyB64);
+  const kem = new import_mlkem3.MlKem1024();
+  const [kemCiphertext, fileKey] = await kem.encap(publicKey);
+  const nonce = randomBytes2(24);
+  const encryptedFile = (0, import_chacha3.xchacha20poly1305)(fileKey, nonce).encrypt(fileBytes);
+  const version = new Uint8Array([1, 0]);
+  const kemLenBytes = new Uint8Array([
+    kemCiphertext.length >> 8 & 255,
+    kemCiphertext.length & 255
+  ]);
+  return concatBytes(
+    version,
+    kemLenBytes,
+    kemCiphertext,
+    nonce,
+    encryptedFile
+  );
+}
+async function decryptFileBytes(bundle, privateKeyB64) {
+  if (!(bundle instanceof Uint8Array)) {
+    throw new Error("decryptFileBytes: bundle must be a Uint8Array");
+  }
+  if (!privateKeyB64) {
+    throw new Error("decryptFileBytes: privateKeyB64 is required");
+  }
+  if (bundle.length < 2 + 2 + 24) {
+    throw new Error("decryptFileBytes: file is too short to be valid");
+  }
+  const version = bundle.slice(0, 2);
+  if (version[0] !== 1 || version[1] !== 0) {
+    throw new Error(
+      `decryptFileBytes: unsupported file version ${version[0]}.${version[1]}`
+    );
+  }
+  const kemLen = bundle[2] << 8 | bundle[3];
+  if (kemLen < 1568 || kemLen > 2e3) {
+    throw new Error("decryptFileBytes: invalid KEM ciphertext length");
+  }
+  const offset = 4;
+  if (bundle.length < offset + kemLen + 24) {
+    throw new Error("decryptFileBytes: truncated bundle");
+  }
+  const kemCiphertext = bundle.slice(offset, offset + kemLen);
+  const nonce = bundle.slice(offset + kemLen, offset + kemLen + 24);
+  const encryptedFile = bundle.slice(offset + kemLen + 24);
+  if (encryptedFile.length === 0) {
+    throw new Error("decryptFileBytes: no encrypted data found");
+  }
+  const privateKey = fromBase642(privateKeyB64);
+  const kem = new import_mlkem3.MlKem1024();
+  const fileKey = await kem.decap(kemCiphertext, privateKey);
+  return (0, import_chacha3.xchacha20poly1305)(fileKey, nonce).decrypt(encryptedFile);
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  decryptFileBytes,
+  encryptFileBytes,
   qstoreDecrypt,
   qstoreEncrypt
 });

package/dist/index.mjs

@@ -90,7 +90,92 @@ async function qstoreDecrypt(encryptedBlob, privateKeyB64) {
   const decrypted = chacha.decrypt(encrypted);
   return new TextDecoder().decode(decrypted);
 }
+
+// src/file.ts
+import { MlKem1024 as MlKem10243 } from "mlkem";
+import { xchacha20poly1305 } from "@noble/ciphers/chacha.js";
+import { Buffer as Buffer2 } from "buffer";
+function randomBytes2(length) {
+  const out = new Uint8Array(length);
+  crypto.getRandomValues(out);
+  return out;
+}
+function fromBase642(b64) {
+  return new Uint8Array(Buffer2.from(b64, "base64"));
+}
+function concatBytes(...parts) {
+  const total = parts.reduce((n, p) => n + p.length, 0);
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+}
+async function encryptFileBytes(fileBytes, publicKeyB64) {
+  if (!(fileBytes instanceof Uint8Array) || fileBytes.length === 0) {
+    throw new Error("encryptFileBytes: fileBytes must be a non-empty Uint8Array");
+  }
+  if (!publicKeyB64) {
+    throw new Error("encryptFileBytes: publicKeyB64 is required");
+  }
+  const publicKey = fromBase642(publicKeyB64);
+  const kem = new MlKem10243();
+  const [kemCiphertext, fileKey] = await kem.encap(publicKey);
+  const nonce = randomBytes2(24);
+  const encryptedFile = xchacha20poly1305(fileKey, nonce).encrypt(fileBytes);
+  const version = new Uint8Array([1, 0]);
+  const kemLenBytes = new Uint8Array([
+    kemCiphertext.length >> 8 & 255,
+    kemCiphertext.length & 255
+  ]);
+  return concatBytes(
+    version,
+    kemLenBytes,
+    kemCiphertext,
+    nonce,
+    encryptedFile
+  );
+}
+async function decryptFileBytes(bundle, privateKeyB64) {
+  if (!(bundle instanceof Uint8Array)) {
+    throw new Error("decryptFileBytes: bundle must be a Uint8Array");
+  }
+  if (!privateKeyB64) {
+    throw new Error("decryptFileBytes: privateKeyB64 is required");
+  }
+  if (bundle.length < 2 + 2 + 24) {
+    throw new Error("decryptFileBytes: file is too short to be valid");
+  }
+  const version = bundle.slice(0, 2);
+  if (version[0] !== 1 || version[1] !== 0) {
+    throw new Error(
+      `decryptFileBytes: unsupported file version ${version[0]}.${version[1]}`
+    );
+  }
+  const kemLen = bundle[2] << 8 | bundle[3];
+  if (kemLen < 1568 || kemLen > 2e3) {
+    throw new Error("decryptFileBytes: invalid KEM ciphertext length");
+  }
+  const offset = 4;
+  if (bundle.length < offset + kemLen + 24) {
+    throw new Error("decryptFileBytes: truncated bundle");
+  }
+  const kemCiphertext = bundle.slice(offset, offset + kemLen);
+  const nonce = bundle.slice(offset + kemLen, offset + kemLen + 24);
+  const encryptedFile = bundle.slice(offset + kemLen + 24);
+  if (encryptedFile.length === 0) {
+    throw new Error("decryptFileBytes: no encrypted data found");
+  }
+  const privateKey = fromBase642(privateKeyB64);
+  const kem = new MlKem10243();
+  const fileKey = await kem.decap(kemCiphertext, privateKey);
+  return xchacha20poly1305(fileKey, nonce).decrypt(encryptedFile);
+}
 export {
+  decryptFileBytes,
+  encryptFileBytes,
   qstoreDecrypt,
   qstoreEncrypt
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quantumsure-qstore",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Quantum-resistant field-level encryption for client data. Encrypt before storage, decrypt on read — plaintext never leaves your environment.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",