qumra-pos-auth 0.1.0

package/README.md

@@ -0,0 +1,113 @@
+# qumra-pos-auth
+
+Offline-capable identity for POS and local-first apps. Pure-JS, cross-platform
+(**React Native, Web, Desktop, Node**), and **completely independent of any storage
+layer** — you wire it to your data/sync code through one callback.
+
+## Install
+
+```bash
+npm i qumra-pos-auth
+# or
+yarn add qumra-pos-auth
+# or
+pnpm add qumra-pos-auth
+```
+
+Runtime deps are only `@noble/hashes` (argon2id) and `@noble/curves` (Ed25519) — both
+pure-JS, no native build on any platform.
+
+## What it does
+
+- **Three operating modes** — `online` (valid tokens, syncing) · `offline-degraded`
+  (was online, token expired / no network, still runs on a local session) ·
+  `offline-activated` (an Ed25519-signed activation key, verified locally, server never
+  contacted) · `unactivated`.
+- **`active → grace → locked` state machine** — data is **never** erased; the worst case
+  is that new sales lock. Grace still sells (with a warning); recovery = any successful
+  online contact.
+- **Tokens** — OAuth token vault with **single-flight rotating refresh** (15-min access /
+  30-day refresh by default). `getValidToken()` never throws — `null` means *pause*, not
+  logout.
+- **Local cashier PIN** — argon2id verified against a **synced** hash (same code online &
+  offline), with per-cashier lockout.
+- **Offline activation** — parses `payload.signature`, verifies the Ed25519 signature
+  against a pinned public key, then device + expiry.
+
+## Quick start — the library takes a token from you
+
+This package has **zero endpoint code**. *You* do login/refresh (REST, GraphQL, anything)
+and hand it the tokens through the `AuthApi` port. It never knows your server.
+
+```ts
+import { createAuth, type AuthApi } from "qumra-pos-auth";
+
+// YOU own the network. The library only calls these two methods.
+const api: AuthApi = {
+  async login({ username, password }) {
+    const t = await myBackend.login(username, password); // your REST/GraphQL call
+    return { accessToken: t.access, refreshToken: t.refresh, expiresInSec: 900, refreshExpiresInSec: 2592000 };
+  },
+  async refresh(refreshToken) {
+    const t = await myBackend.refresh(refreshToken); // your call
+    return { accessToken: t.access, refreshToken: t.refresh, expiresInSec: 900, refreshExpiresInSec: 2592000 };
+  },
+};
+
+const auth = createAuth({ api, vault, directory, activationPublicKey });
+await auth.service.init();
+await auth.service.onlineLogin({ username, password });
+await auth.service.cashierLogin("cashier-1", "1234");
+auth.service.onStatusChange((s) => renderBar(s)); // { mode, access, cashier, ... }
+```
+
+**Even simpler** — if you manage tokens 100% outside and don't need the vault/refresh
+logic, skip the auth token layer entirely and just feed your token to the sync engine:
+`new SyncEngine(storage, { getAuthToken: () => myToken })`.
+
+## The one seam to your storage/sync
+
+`qumra-pos-auth` never imports your storage. Wire them in the app with a single callback.
+Since sync engines usually poll a **synchronous** token getter, use `getAccessTokenSync`
+(an in-memory cache kept warm by the async refresh loop):
+
+```ts
+// e.g. with qumra-pos-storage's SyncEngine:
+new SyncEngine(storage, { getAuthToken: () => auth.getAccessTokenSync() });
+```
+
+- `getAccessTokenSync(): string | null` — synchronous, no I/O. `null` ⇒ sync pauses.
+- `getValidToken(): Promise<string | null>` — async variant (triggers refresh if needed).
+
+## Ports you implement (per platform)
+
+Everything I/O is an injectable port, so the same core runs everywhere:
+
+- **`AuthVault`** — secure persistence. Back it with Electron `safeStorage`, browser
+  IndexedDB, or RN Keychain. (`saveTokens/loadTokens`, `…Session`, `…Activation`, `…Meta`.)
+- **`CashierDirectory`** — `listCashiers()`; return the synced cashier rows (id, name,
+  `pinHash`, active) from your storage.
+- **`AuthApi`** — you implement `login`/`refresh` with your own fetch/GraphQL. The library
+  never knows your endpoint; it just receives the tokens you return.
+- **`PinHasher` / `SignatureVerifier`** — default to the bundled `NoblePinHasher`
+  (argon2id, PHC format) and `NobleSignatureVerifier` (Ed25519) from `qumra-pos-auth/crypto`;
+  swap for a native impl on RN if you want.
+
+## Error semantics for your `AuthApi`
+
+Throw the right error so the state machine behaves correctly:
+
+- Network / server-down / 5xx → `throw new AuthNetworkError(...)` — retryable, **keeps** the
+  tokens, sync just pauses.
+- Rejected (bad credentials / refresh revoked) → `throw new AuthRejectedError(...)` —
+  permanent, **clears** the tokens.
+
+Both are exported from `qumra-pos-auth`.
+
+## Publishing
+
+Ships dual **ESM + CJS + `.d.ts`** (built with tsup). Crypto is also available at the
+`qumra-pos-auth/crypto` subpath. To publish under a different name, change `name` in
+`package.json`.
+
+MIT.

package/dist/SignatureVerifier-ueydiL4D.d.cts

@@ -0,0 +1,25 @@
+/**
+ * منفذ تعمية الـ PIN. الافتراضي argon2id (NoblePinHasher) — pure JS يشتغل على كل
+ * منصة من غير native build. قابل للحقن علشان RN يقدر يستخدم impl أصلي أسرع،
+ * والاختبارات تستخدم fake سريع.
+ *
+ * صيغة الـ encoded لازم تطابق اللي السيرفر بينتجه (PHC القياسية) علشان الـ hash
+ * المتزامن يتحقق محلياً.
+ */
+interface PinHasher {
+    /** يعمّي PIN وبيرجّع string بصيغة PHC (فيه الـ salt والمعاملات). */
+    hash(pin: string): Promise<string>;
+    /** يتحقق من PIN ضد encoded string — مقارنة بزمن ثابت. */
+    verify(pin: string, encoded: string): Promise<boolean>;
+}
+
+/**
+ * منفذ التحقق من التوقيع (Ed25519) لمفاتيح التفعيل الأوفلاين. الافتراضي
+ * NobleSignatureVerifier (pure JS). الجهاز عنده المفتاح العام لقمرة مثبّت،
+ * وبيتحقق من المفتاح محلياً بدون أي سيرفر.
+ */
+interface SignatureVerifier {
+    verify(message: Uint8Array, signature: Uint8Array, publicKey: Uint8Array): Promise<boolean>;
+}
+
+export type { PinHasher as P, SignatureVerifier as S };

package/dist/SignatureVerifier-ueydiL4D.d.ts

@@ -0,0 +1,25 @@
+/**
+ * منفذ تعمية الـ PIN. الافتراضي argon2id (NoblePinHasher) — pure JS يشتغل على كل
+ * منصة من غير native build. قابل للحقن علشان RN يقدر يستخدم impl أصلي أسرع،
+ * والاختبارات تستخدم fake سريع.
+ *
+ * صيغة الـ encoded لازم تطابق اللي السيرفر بينتجه (PHC القياسية) علشان الـ hash
+ * المتزامن يتحقق محلياً.
+ */
+interface PinHasher {
+    /** يعمّي PIN وبيرجّع string بصيغة PHC (فيه الـ salt والمعاملات). */
+    hash(pin: string): Promise<string>;
+    /** يتحقق من PIN ضد encoded string — مقارنة بزمن ثابت. */
+    verify(pin: string, encoded: string): Promise<boolean>;
+}
+
+/**
+ * منفذ التحقق من التوقيع (Ed25519) لمفاتيح التفعيل الأوفلاين. الافتراضي
+ * NobleSignatureVerifier (pure JS). الجهاز عنده المفتاح العام لقمرة مثبّت،
+ * وبيتحقق من المفتاح محلياً بدون أي سيرفر.
+ */
+interface SignatureVerifier {
+    verify(message: Uint8Array, signature: Uint8Array, publicKey: Uint8Array): Promise<boolean>;
+}
+
+export type { PinHasher as P, SignatureVerifier as S };

package/dist/chunk-SRPTNNYT.js

@@ -0,0 +1,127 @@
+import { argon2idAsync } from '@noble/hashes/argon2';
+import { randomBytes, utf8ToBytes } from '@noble/hashes/utils';
+import { ed25519 } from '@noble/curves/ed25519';
+
+// src/crypto/base64.ts
+var STD = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var URL = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+function encode(bytes, alphabet) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const b0 = bytes[i];
+    const b1 = i + 1 < bytes.length ? bytes[i + 1] : 0;
+    const b2 = i + 2 < bytes.length ? bytes[i + 2] : 0;
+    const triple = b0 << 16 | b1 << 8 | b2;
+    out += alphabet[triple >> 18 & 63];
+    out += alphabet[triple >> 12 & 63];
+    if (i + 1 < bytes.length) out += alphabet[triple >> 6 & 63];
+    if (i + 2 < bytes.length) out += alphabet[triple & 63];
+  }
+  return out;
+}
+function decode(str, alphabet) {
+  const lookup = new Int16Array(128).fill(-1);
+  for (let i = 0; i < alphabet.length; i++) lookup[alphabet.charCodeAt(i)] = i;
+  const clean = str.replace(/[=\s]/g, "");
+  const out = new Uint8Array(Math.floor(clean.length * 6 / 8));
+  let bits = 0;
+  let value = 0;
+  let o = 0;
+  for (let i = 0; i < clean.length; i++) {
+    const c = clean.charCodeAt(i);
+    const idx = c < 128 ? lookup[c] : -1;
+    if (idx < 0) throw new Error("base64: \u062D\u0631\u0641 \u063A\u064A\u0631 \u0635\u0627\u0644\u062D");
+    value = value << 6 | idx;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      out[o++] = value >> bits & 255;
+    }
+  }
+  return out;
+}
+var b64 = {
+  encode: (b) => encode(b, STD),
+  decode: (s) => decode(s, STD)
+};
+var b64url = {
+  encode: (b) => encode(b, URL),
+  decode: (s) => decode(s, URL)
+};
+var DEFAULT_ARGON2_PARAMS = {
+  t: 3,
+  m: 64 * 1024,
+  p: 1,
+  dkLen: 32
+};
+var V = 19;
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+var NoblePinHasher = class {
+  params;
+  constructor(params = DEFAULT_ARGON2_PARAMS) {
+    this.params = params;
+  }
+  async hash(pin) {
+    const salt = randomBytes(16);
+    const { t, m, p, dkLen } = this.params;
+    const out = await argon2idAsync(utf8ToBytes(pin), salt, { t, m, p, dkLen });
+    return `$argon2id$v=${V}$m=${m},t=${t},p=${p}$${b64.encode(salt)}$${b64.encode(out)}`;
+  }
+  async verify(pin, encoded) {
+    const parsed = parsePhc(encoded);
+    if (!parsed) return false;
+    const out = await argon2idAsync(utf8ToBytes(pin), parsed.salt, {
+      t: parsed.t,
+      m: parsed.m,
+      p: parsed.p,
+      dkLen: parsed.hash.length
+    });
+    return constantTimeEqual(out, parsed.hash);
+  }
+};
+function parsePhc(encoded) {
+  const parts = encoded.split("$");
+  if (parts.length !== 6) return null;
+  if (parts[1] !== "argon2id") return null;
+  const paramStr = parts[3];
+  const saltStr = parts[4];
+  const hashStr = parts[5];
+  if (paramStr === void 0 || saltStr === void 0 || hashStr === void 0) {
+    return null;
+  }
+  const params = /* @__PURE__ */ new Map();
+  for (const kv of paramStr.split(",")) {
+    const [k, v] = kv.split("=");
+    if (k === void 0 || v === void 0) return null;
+    const n = Number(v);
+    if (!Number.isFinite(n)) return null;
+    params.set(k, n);
+  }
+  const m = params.get("m");
+  const t = params.get("t");
+  const p = params.get("p");
+  if (m === void 0 || t === void 0 || p === void 0) return null;
+  try {
+    return { m, t, p, salt: b64.decode(saltStr), hash: b64.decode(hashStr) };
+  } catch {
+    return null;
+  }
+}
+var NobleSignatureVerifier = class {
+  async verify(message, signature, publicKey) {
+    try {
+      return ed25519.verify(signature, message, publicKey);
+    } catch {
+      return false;
+    }
+  }
+};
+
+export { DEFAULT_ARGON2_PARAMS, NoblePinHasher, NobleSignatureVerifier, b64, b64url };
+//# sourceMappingURL=chunk-SRPTNNYT.js.map
+//# sourceMappingURL=chunk-SRPTNNYT.js.map

package/dist/chunk-SRPTNNYT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/crypto/base64.ts","../src/crypto/NoblePinHasher.ts","../src/crypto/NobleSignatureVerifier.ts"],"names":[],"mappings":";;;;;AAKA,IAAM,GAAA,GAAM,kEAAA;AACZ,IAAM,GAAA,GAAM,kEAAA;AAEZ,SAAS,MAAA,CAAO,OAAmB,QAAA,EAA0B;AAC3D,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAA,EAAG;AACxC,IAAA,MAAM,EAAA,GAAK,MAAM,CAAC,CAAA;AAClB,IAAA,MAAM,EAAA,GAAK,IAAI,CAAA,GAAI,KAAA,CAAM,SAAS,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA,GAAK,CAAA;AAClD,IAAA,MAAM,EAAA,GAAK,IAAI,CAAA,GAAI,KAAA,CAAM,SAAS,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA,GAAK,CAAA;AAClD,IAAA,MAAM,MAAA,GAAU,EAAA,IAAM,EAAA,GAAO,EAAA,IAAM,CAAA,GAAK,EAAA;AACxC,IAAA,GAAA,IAAO,QAAA,CAAU,MAAA,IAAU,EAAA,GAAM,EAAE,CAAA;AACnC,IAAA,GAAA,IAAO,QAAA,CAAU,MAAA,IAAU,EAAA,GAAM,EAAE,CAAA;AACnC,IAAA,IAAI,CAAA,GAAI,IAAI,KAAA,CAAM,MAAA,SAAe,QAAA,CAAU,MAAA,IAAU,IAAK,EAAE,CAAA;AAC5D,IAAA,IAAI,IAAI,CAAA,GAAI,KAAA,CAAM,QAAQ,GAAA,IAAO,QAAA,CAAS,SAAS,EAAE,CAAA;AAAA,EACvD;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,MAAA,CAAO,KAAa,QAAA,EAA8B;AACzD,EAAA,MAAM,SAAS,IAAI,UAAA,CAAW,GAAG,CAAA,CAAE,KAAK,EAAE,CAAA;AAC1C,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,CAAS,MAAA,EAAQ,CAAA,EAAA,EAAK,MAAA,CAAO,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA,GAAI,CAAA;AAE3E,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,OAAA,CAAQ,QAAA,EAAU,EAAE,CAAA;AACtC,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,IAAA,CAAK,MAAO,KAAA,CAAM,MAAA,GAAS,CAAA,GAAK,CAAC,CAAC,CAAA;AAC7D,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,CAAA,GAAI,KAAA,CAAM,UAAA,CAAW,CAAC,CAAA;AAC5B,IAAA,MAAM,GAAA,GAAM,CAAA,GAAI,GAAA,GAAM,MAAA,CAAO,CAAC,CAAA,GAAK,EAAA;AACnC,IAAA,IAAI,GAAA,GAAM,CAAA,EAAG,MAAM,IAAI,MAAM,wEAAsB,CAAA;AACnD,IAAA,KAAA,GAAS,SAAS,CAAA,GAAK,GAAA;AACvB,IAAA,IAAA,IAAQ,CAAA;AACR,IAAA,IAAI,QAAQ,CAAA,EAAG;AACb,MAAA,IAAA,IAAQ,CAAA;AACR,MAAA,GAAA,CAAI,CAAA,EAAG,CAAA,GAAK,KAAA,IAAS,IAAA,GAAQ,GAAA;AAAA,IAC/B;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAEO,IAAM,GAAA,GAAM;AAAA,EACjB,MAAA,EAAQ,CAAC,CAAA,KAA0B,MAAA,CAAO,GAAG,GAAG,CAAA;AAAA,EAChD,MAAA,EAAQ,CAAC,CAAA,KAA0B,MAAA,CAAO,GAAG,GAAG;AAClD;AAEO,IAAM,MAAA,GAAS;AAAA,EACpB,MAAA,EAAQ,CAAC,CAAA,KAA0B,MAAA,CAAO,GAAG,GAAG,CAAA;AAAA,EAChD,MAAA,EAAQ,CAAC,CAAA,KAA0B,MAAA,CAAO,GAAG,GAAG;AAClD;AC9BO,IAAM,qBAAA,GAAsC;AAAA,EACjD,CAAA,EAAG,CAAA;AAAA,EACH,GAAG,EAAA,GAAK,IAAA;AAAA,EACR,CAAA,EAAG,CAAA;AAAA,EACH,KAAA,EAAO;AACT;AAEA,IAAM,CAAA,GAAI,EAAA;AAEV,SAAS,iBAAA,CAAkB,GAAe,CAAA,EAAwB;AAChE,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAA,EAAA,EAAK,IAAA,IAAQ,CAAA,CAAE,CAAC,CAAA,GAAK,CAAA,CAAE,CAAC,CAAA;AACtD,EAAA,OAAO,IAAA,KAAS,CAAA;AAClB;AAEO,IAAM,iBAAN,MAA0C;AAAA,EAC9B,MAAA;AAAA,EAEjB,WAAA,CAAY,SAAuB,qBAAA,EAAuB;AACxD,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,MAAM,IAAA,GAAO,YAAY,EAAE,CAAA;AAC3B,IAAA,MAAM,EAAE,CAAA,EAAG,CAAA,EAAG,CAAA,EAAG,KAAA,KAAU,IAAA,CAAK,MAAA;AAChC,IAAA,MAAM,GAAA,GAAM,MAAM,aAAA,CAAc,WAAA,CAAY,GAAG,CAAA,EAAG,IAAA,EAAM,EAAE,CAAA,EAAG,CAAA,EAAG,CAAA,EAAG,KAAA,EAAO,CAAA;AAC1E,IAAA,OAAO,eAAe,CAAC,CAAA,GAAA,EAAM,CAAC,CAAA,GAAA,EAAM,CAAC,CAAA,GAAA,EAAM,CAAC,CAAA,CAAA,EAAI,GAAA,CAAI,OAAO,IAAI,CAAC,IAAI,GAAA,CAAI,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,EACrF;AAAA,EAEA,MAAM,MAAA,CAAO,GAAA,EAAa,OAAA,EAAmC;AAC3D,IAAA,MAAM,MAAA,GAAS,SAAS,OAAO,CAAA;AAC/B,IAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,IAAA,MAAM,MAAM,MAAM,aAAA,CAAc,YAAY,GAAG,CAAA,EAAG,OAAO,IAAA,EAAM;AAAA,MAC7D,GAAG,MAAA,CAAO,CAAA;AAAA,MACV,GAAG,MAAA,CAAO,CAAA;AAAA,MACV,GAAG,MAAA,CAAO,CAAA;AAAA,MACV,KAAA,EAAO,OAAO,IAAA,CAAK;AAAA,KACpB,CAAA;AACD,IAAA,OAAO,iBAAA,CAAkB,GAAA,EAAK,MAAA,CAAO,IAAI,CAAA;AAAA,EAC3C;AACF;AAWA,SAAS,SAAS,OAAA,EAA6B;AAE7C,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA;AAE/B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAC/B,EAAA,IAAI,KAAA,CAAM,CAAC,CAAA,KAAM,UAAA,EAAY,OAAO,IAAA;AACpC,EAAA,MAAM,QAAA,GAAW,MAAM,CAAC,CAAA;AACxB,EAAA,MAAM,OAAA,GAAU,MAAM,CAAC,CAAA;AACvB,EAAA,MAAM,OAAA,GAAU,MAAM,CAAC,CAAA;AACvB,EAAA,IAAI,QAAA,KAAa,MAAA,IAAa,OAAA,KAAY,MAAA,IAAa,YAAY,MAAA,EAAW;AAC5E,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAoB;AACvC,EAAA,KAAA,MAAW,EAAA,IAAM,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,EAAA,CAAG,MAAM,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAA,KAAM,MAAA,IAAa,CAAA,KAAM,MAAA,EAAW,OAAO,IAAA;AAC/C,IAAA,MAAM,CAAA,GAAI,OAAO,CAAC,CAAA;AAClB,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,CAAC,GAAG,OAAO,IAAA;AAChC,IAAA,MAAA,CAAO,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,EACjB;AACA,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AACxB,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AACxB,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AACxB,EAAA,IAAI,MAAM,MAAA,IAAa,CAAA,KAAM,MAAA,IAAa,CAAA,KAAM,QAAW,OAAO,IAAA;AAClE,EAAA,IAAI;AACF,IAAA,OAAO,EAAE,CAAA,EAAG,CAAA,EAAG,CAAA,EAAG,IAAA,EAAM,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA,EAAG,IAAA,EAAM,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA,EAAE;AAAA,EACzE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AClGO,IAAM,yBAAN,MAA0D;AAAA,EAC/D,MAAM,MAAA,CACJ,OAAA,EACA,SAAA,EACA,SAAA,EACkB;AAClB,IAAA,IAAI;AACF,MAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,SAAA,EAAW,OAAA,EAAS,SAAS,CAAA;AAAA,IACrD,CAAA,CAAA,MAAQ;AAEN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACF","file":"chunk-SRPTNNYT.js","sourcesContent":["/**\n * Base64 محمول (standard + url-safe) بدون الاعتماد على Buffer أو btoa — علشان نفس\n * الكود يشتغل في Node و المتصفح و React Native. الترميز بدون padding افتراضياً\n * (صيغة PHC و JWT كده)، وفك الترميز بيتقبّل بوجود أو غياب الـ padding.\n */\nconst STD = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\nconst URL = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n\nfunction encode(bytes: Uint8Array, alphabet: string): string {\n  let out = \"\";\n  for (let i = 0; i < bytes.length; i += 3) {\n    const b0 = bytes[i]!;\n    const b1 = i + 1 < bytes.length ? bytes[i + 1]! : 0;\n    const b2 = i + 2 < bytes.length ? bytes[i + 2]! : 0;\n    const triple = (b0 << 16) | (b1 << 8) | b2;\n    out += alphabet[(triple >> 18) & 63];\n    out += alphabet[(triple >> 12) & 63];\n    if (i + 1 < bytes.length) out += alphabet[(triple >> 6) & 63];\n    if (i + 2 < bytes.length) out += alphabet[triple & 63];\n  }\n  return out;\n}\n\nfunction decode(str: string, alphabet: string): Uint8Array {\n  const lookup = new Int16Array(128).fill(-1);\n  for (let i = 0; i < alphabet.length; i++) lookup[alphabet.charCodeAt(i)] = i;\n  // شيل الـ padding والمسافات\n  const clean = str.replace(/[=\\s]/g, \"\");\n  const out = new Uint8Array(Math.floor((clean.length * 6) / 8));\n  let bits = 0;\n  let value = 0;\n  let o = 0;\n  for (let i = 0; i < clean.length; i++) {\n    const c = clean.charCodeAt(i);\n    const idx = c < 128 ? lookup[c]! : -1;\n    if (idx < 0) throw new Error(\"base64: حرف غير صالح\");\n    value = (value << 6) | idx;\n    bits += 6;\n    if (bits >= 8) {\n      bits -= 8;\n      out[o++] = (value >> bits) & 0xff;\n    }\n  }\n  return out;\n}\n\nexport const b64 = {\n  encode: (b: Uint8Array): string => encode(b, STD),\n  decode: (s: string): Uint8Array => decode(s, STD),\n};\n\nexport const b64url = {\n  encode: (b: Uint8Array): string => encode(b, URL),\n  decode: (s: string): Uint8Array => decode(s, URL),\n};\n","import { argon2idAsync } from \"@noble/hashes/argon2\";\nimport { randomBytes, utf8ToBytes } from \"@noble/hashes/utils\";\nimport type { PinHasher } from \"../ports/PinHasher\";\nimport { b64 } from \"./base64\";\n\n/**\n * الافتراضي لتعمية الـ PIN: argon2id بصيغة PHC القياسية، pure JS من @noble/hashes.\n * نفس الصيغة اللي السيرفر بينتجها فالـ hash المتزامن يتحقق محلياً (نفس الكود\n * أونلاين وأوفلاين).\n *\n * صيغة الناتج: $argon2id$v=19$m=<m>,t=<t>,p=<p>$<saltB64>$<hashB64>\n */\nexport interface Argon2Params {\n  /** iterations (t). */\n  t: number;\n  /** memory بالـ KiB (m). */\n  m: number;\n  /** parallelism (p). */\n  p: number;\n  /** طول الـ hash بالبايت. */\n  dkLen: number;\n}\n\n/** إعداد متزن للأجهزة (64MiB, 3 مرات) — يطابق الافتراضي الشائع للسيرفر. */\nexport const DEFAULT_ARGON2_PARAMS: Argon2Params = {\n  t: 3,\n  m: 64 * 1024,\n  p: 1,\n  dkLen: 32,\n};\n\nconst V = 19; // argon2 version 1.3\n\nfunction constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i++) diff |= a[i]! ^ b[i]!;\n  return diff === 0;\n}\n\nexport class NoblePinHasher implements PinHasher {\n  private readonly params: Argon2Params;\n\n  constructor(params: Argon2Params = DEFAULT_ARGON2_PARAMS) {\n    this.params = params;\n  }\n\n  async hash(pin: string): Promise<string> {\n    const salt = randomBytes(16);\n    const { t, m, p, dkLen } = this.params;\n    const out = await argon2idAsync(utf8ToBytes(pin), salt, { t, m, p, dkLen });\n    return `$argon2id$v=${V}$m=${m},t=${t},p=${p}$${b64.encode(salt)}$${b64.encode(out)}`;\n  }\n\n  async verify(pin: string, encoded: string): Promise<boolean> {\n    const parsed = parsePhc(encoded);\n    if (!parsed) return false;\n    const out = await argon2idAsync(utf8ToBytes(pin), parsed.salt, {\n      t: parsed.t,\n      m: parsed.m,\n      p: parsed.p,\n      dkLen: parsed.hash.length,\n    });\n    return constantTimeEqual(out, parsed.hash);\n  }\n}\n\ninterface Phc {\n  m: number;\n  t: number;\n  p: number;\n  salt: Uint8Array;\n  hash: Uint8Array;\n}\n\n/** يفكّ صيغة PHC لـ argon2id. بيرجّع null لو مش متعرّف عليها (نتيجتها verify=false). */\nfunction parsePhc(encoded: string): Phc | null {\n  // $argon2id$v=19$m=..,t=..,p=..$salt$hash\n  const parts = encoded.split(\"$\");\n  // [\"\", \"argon2id\", \"v=19\", \"m=..,t=..,p=..\", \"<salt>\", \"<hash>\"]\n  if (parts.length !== 6) return null;\n  if (parts[1] !== \"argon2id\") return null;\n  const paramStr = parts[3];\n  const saltStr = parts[4];\n  const hashStr = parts[5];\n  if (paramStr === undefined || saltStr === undefined || hashStr === undefined) {\n    return null;\n  }\n  const params = new Map<string, number>();\n  for (const kv of paramStr.split(\",\")) {\n    const [k, v] = kv.split(\"=\");\n    if (k === undefined || v === undefined) return null;\n    const n = Number(v);\n    if (!Number.isFinite(n)) return null;\n    params.set(k, n);\n  }\n  const m = params.get(\"m\");\n  const t = params.get(\"t\");\n  const p = params.get(\"p\");\n  if (m === undefined || t === undefined || p === undefined) return null;\n  try {\n    return { m, t, p, salt: b64.decode(saltStr), hash: b64.decode(hashStr) };\n  } catch {\n    return null;\n  }\n}\n","import { ed25519 } from \"@noble/curves/ed25519\";\nimport type { SignatureVerifier } from \"../ports/SignatureVerifier\";\n\n/**\n * الافتراضي للتحقق من التوقيع: Ed25519 من @noble/curves (pure JS). بيتحقق محلياً\n * من مفاتيح التفعيل الموقّعة بمفتاح قمرة الخاص — بدون أي نداء سيرفر.\n */\nexport class NobleSignatureVerifier implements SignatureVerifier {\n  async verify(\n    message: Uint8Array,\n    signature: Uint8Array,\n    publicKey: Uint8Array,\n  ): Promise<boolean> {\n    try {\n      return ed25519.verify(signature, message, publicKey);\n    } catch {\n      // توقيع/مفتاح بحجم غلط → اعتبره غير صالح بدل ما نرمي.\n      return false;\n    }\n  }\n}\n"]}

package/dist/crypto.cjs

@@ -0,0 +1,133 @@
+'use strict';
+
+var argon2 = require('@noble/hashes/argon2');
+var utils = require('@noble/hashes/utils');
+var ed25519 = require('@noble/curves/ed25519');
+
+// src/crypto/base64.ts
+var STD = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var URL = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+function encode(bytes, alphabet) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const b0 = bytes[i];
+    const b1 = i + 1 < bytes.length ? bytes[i + 1] : 0;
+    const b2 = i + 2 < bytes.length ? bytes[i + 2] : 0;
+    const triple = b0 << 16 | b1 << 8 | b2;
+    out += alphabet[triple >> 18 & 63];
+    out += alphabet[triple >> 12 & 63];
+    if (i + 1 < bytes.length) out += alphabet[triple >> 6 & 63];
+    if (i + 2 < bytes.length) out += alphabet[triple & 63];
+  }
+  return out;
+}
+function decode(str, alphabet) {
+  const lookup = new Int16Array(128).fill(-1);
+  for (let i = 0; i < alphabet.length; i++) lookup[alphabet.charCodeAt(i)] = i;
+  const clean = str.replace(/[=\s]/g, "");
+  const out = new Uint8Array(Math.floor(clean.length * 6 / 8));
+  let bits = 0;
+  let value = 0;
+  let o = 0;
+  for (let i = 0; i < clean.length; i++) {
+    const c = clean.charCodeAt(i);
+    const idx = c < 128 ? lookup[c] : -1;
+    if (idx < 0) throw new Error("base64: \u062D\u0631\u0641 \u063A\u064A\u0631 \u0635\u0627\u0644\u062D");
+    value = value << 6 | idx;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      out[o++] = value >> bits & 255;
+    }
+  }
+  return out;
+}
+var b64 = {
+  encode: (b) => encode(b, STD),
+  decode: (s) => decode(s, STD)
+};
+var b64url = {
+  encode: (b) => encode(b, URL),
+  decode: (s) => decode(s, URL)
+};
+var DEFAULT_ARGON2_PARAMS = {
+  t: 3,
+  m: 64 * 1024,
+  p: 1,
+  dkLen: 32
+};
+var V = 19;
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+var NoblePinHasher = class {
+  params;
+  constructor(params = DEFAULT_ARGON2_PARAMS) {
+    this.params = params;
+  }
+  async hash(pin) {
+    const salt = utils.randomBytes(16);
+    const { t, m, p, dkLen } = this.params;
+    const out = await argon2.argon2idAsync(utils.utf8ToBytes(pin), salt, { t, m, p, dkLen });
+    return `$argon2id$v=${V}$m=${m},t=${t},p=${p}$${b64.encode(salt)}$${b64.encode(out)}`;
+  }
+  async verify(pin, encoded) {
+    const parsed = parsePhc(encoded);
+    if (!parsed) return false;
+    const out = await argon2.argon2idAsync(utils.utf8ToBytes(pin), parsed.salt, {
+      t: parsed.t,
+      m: parsed.m,
+      p: parsed.p,
+      dkLen: parsed.hash.length
+    });
+    return constantTimeEqual(out, parsed.hash);
+  }
+};
+function parsePhc(encoded) {
+  const parts = encoded.split("$");
+  if (parts.length !== 6) return null;
+  if (parts[1] !== "argon2id") return null;
+  const paramStr = parts[3];
+  const saltStr = parts[4];
+  const hashStr = parts[5];
+  if (paramStr === void 0 || saltStr === void 0 || hashStr === void 0) {
+    return null;
+  }
+  const params = /* @__PURE__ */ new Map();
+  for (const kv of paramStr.split(",")) {
+    const [k, v] = kv.split("=");
+    if (k === void 0 || v === void 0) return null;
+    const n = Number(v);
+    if (!Number.isFinite(n)) return null;
+    params.set(k, n);
+  }
+  const m = params.get("m");
+  const t = params.get("t");
+  const p = params.get("p");
+  if (m === void 0 || t === void 0 || p === void 0) return null;
+  try {
+    return { m, t, p, salt: b64.decode(saltStr), hash: b64.decode(hashStr) };
+  } catch {
+    return null;
+  }
+}
+var NobleSignatureVerifier = class {
+  async verify(message, signature, publicKey) {
+    try {
+      return ed25519.ed25519.verify(signature, message, publicKey);
+    } catch {
+      return false;
+    }
+  }
+};
+
+exports.DEFAULT_ARGON2_PARAMS = DEFAULT_ARGON2_PARAMS;
+exports.NoblePinHasher = NoblePinHasher;
+exports.NobleSignatureVerifier = NobleSignatureVerifier;
+exports.b64 = b64;
+exports.b64url = b64url;
+//# sourceMappingURL=crypto.cjs.map
+//# sourceMappingURL=crypto.cjs.map

package/dist/crypto.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/crypto/base64.ts","../src/crypto/NoblePinHasher.ts","../src/crypto/NobleSignatureVerifier.ts"],"names":["randomBytes","argon2idAsync","utf8ToBytes","ed25519"],"mappings":";;;;;;;AAKA,IAAM,GAAA,GAAM,kEAAA;AACZ,IAAM,GAAA,GAAM,kEAAA;AAEZ,SAAS,MAAA,CAAO,OAAmB,QAAA,EAA0B;AAC3D,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAA,EAAG;AACxC,IAAA,MAAM,EAAA,GAAK,MAAM,CAAC,CAAA;AAClB,IAAA,MAAM,EAAA,GAAK,IAAI,CAAA,GAAI,KAAA,CAAM,SAAS,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA,GAAK,CAAA;AAClD,IAAA,MAAM,EAAA,GAAK,IAAI,CAAA,GAAI,KAAA,CAAM,SAAS,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA,GAAK,CAAA;AAClD,IAAA,MAAM,MAAA,GAAU,EAAA,IAAM,EAAA,GAAO,EAAA,IAAM,CAAA,GAAK,EAAA;AACxC,IAAA,GAAA,IAAO,QAAA,CAAU,MAAA,IAAU,EAAA,GAAM,EAAE,CAAA;AACnC,IAAA,GAAA,IAAO,QAAA,CAAU,MAAA,IAAU,EAAA,GAAM,EAAE,CAAA;AACnC,IAAA,IAAI,CAAA,GAAI,IAAI,KAAA,CAAM,MAAA,SAAe,QAAA,CAAU,MAAA,IAAU,IAAK,EAAE,CAAA;AAC5D,IAAA,IAAI,IAAI,CAAA,GAAI,KAAA,CAAM,QAAQ,GAAA,IAAO,QAAA,CAAS,SAAS,EAAE,CAAA;AAAA,EACvD;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,MAAA,CAAO,KAAa,QAAA,EAA8B;AACzD,EAAA,MAAM,SAAS,IAAI,UAAA,CAAW,GAAG,CAAA,CAAE,KAAK,EAAE,CAAA;AAC1C,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,CAAS,MAAA,EAAQ,CAAA,EAAA,EAAK,MAAA,CAAO,QAAA,CAAS,UAAA,CAAW,CAAC,CAAC,CAAA,GAAI,CAAA;AAE3E,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,OAAA,CAAQ,QAAA,EAAU,EAAE,CAAA;AACtC,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,IAAA,CAAK,MAAO,KAAA,CAAM,MAAA,GAAS,CAAA,GAAK,CAAC,CAAC,CAAA;AAC7D,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,CAAA,GAAI,KAAA,CAAM,UAAA,CAAW,CAAC,CAAA;AAC5B,IAAA,MAAM,GAAA,GAAM,CAAA,GAAI,GAAA,GAAM,MAAA,CAAO,CAAC,CAAA,GAAK,EAAA;AACnC,IAAA,IAAI,GAAA,GAAM,CAAA,EAAG,MAAM,IAAI,MAAM,wEAAsB,CAAA;AACnD,IAAA,KAAA,GAAS,SAAS,CAAA,GAAK,GAAA;AACvB,IAAA,IAAA,IAAQ,CAAA;AACR,IAAA,IAAI,QAAQ,CAAA,EAAG;AACb,MAAA,IAAA,IAAQ,CAAA;AACR,MAAA,GAAA,CAAI,CAAA,EAAG,CAAA,GAAK,KAAA,IAAS,IAAA,GAAQ,GAAA;AAAA,IAC/B;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAEO,IAAM,GAAA,GAAM;AAAA,EACjB,MAAA,EAAQ,CAAC,CAAA,KAA0B,MAAA,CAAO,GAAG,GAAG,CAAA;AAAA,EAChD,MAAA,EAAQ,CAAC,CAAA,KAA0B,MAAA,CAAO,GAAG,GAAG;AAClD;AAEO,IAAM,MAAA,GAAS;AAAA,EACpB,MAAA,EAAQ,CAAC,CAAA,KAA0B,MAAA,CAAO,GAAG,GAAG,CAAA;AAAA,EAChD,MAAA,EAAQ,CAAC,CAAA,KAA0B,MAAA,CAAO,GAAG,GAAG;AAClD;AC9BO,IAAM,qBAAA,GAAsC;AAAA,EACjD,CAAA,EAAG,CAAA;AAAA,EACH,GAAG,EAAA,GAAK,IAAA;AAAA,EACR,CAAA,EAAG,CAAA;AAAA,EACH,KAAA,EAAO;AACT;AAEA,IAAM,CAAA,GAAI,EAAA;AAEV,SAAS,iBAAA,CAAkB,GAAe,CAAA,EAAwB;AAChE,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAA,EAAA,EAAK,IAAA,IAAQ,CAAA,CAAE,CAAC,CAAA,GAAK,CAAA,CAAE,CAAC,CAAA;AACtD,EAAA,OAAO,IAAA,KAAS,CAAA;AAClB;AAEO,IAAM,iBAAN,MAA0C;AAAA,EAC9B,MAAA;AAAA,EAEjB,WAAA,CAAY,SAAuB,qBAAA,EAAuB;AACxD,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA,EAEA,MAAM,KAAK,GAAA,EAA8B;AACvC,IAAA,MAAM,IAAA,GAAOA,kBAAY,EAAE,CAAA;AAC3B,IAAA,MAAM,EAAE,CAAA,EAAG,CAAA,EAAG,CAAA,EAAG,KAAA,KAAU,IAAA,CAAK,MAAA;AAChC,IAAA,MAAM,GAAA,GAAM,MAAMC,oBAAA,CAAcC,iBAAA,CAAY,GAAG,CAAA,EAAG,IAAA,EAAM,EAAE,CAAA,EAAG,CAAA,EAAG,CAAA,EAAG,KAAA,EAAO,CAAA;AAC1E,IAAA,OAAO,eAAe,CAAC,CAAA,GAAA,EAAM,CAAC,CAAA,GAAA,EAAM,CAAC,CAAA,GAAA,EAAM,CAAC,CAAA,CAAA,EAAI,GAAA,CAAI,OAAO,IAAI,CAAC,IAAI,GAAA,CAAI,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,EACrF;AAAA,EAEA,MAAM,MAAA,CAAO,GAAA,EAAa,OAAA,EAAmC;AAC3D,IAAA,MAAM,MAAA,GAAS,SAAS,OAAO,CAAA;AAC/B,IAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,IAAA,MAAM,MAAM,MAAMD,oBAAA,CAAcC,kBAAY,GAAG,CAAA,EAAG,OAAO,IAAA,EAAM;AAAA,MAC7D,GAAG,MAAA,CAAO,CAAA;AAAA,MACV,GAAG,MAAA,CAAO,CAAA;AAAA,MACV,GAAG,MAAA,CAAO,CAAA;AAAA,MACV,KAAA,EAAO,OAAO,IAAA,CAAK;AAAA,KACpB,CAAA;AACD,IAAA,OAAO,iBAAA,CAAkB,GAAA,EAAK,MAAA,CAAO,IAAI,CAAA;AAAA,EAC3C;AACF;AAWA,SAAS,SAAS,OAAA,EAA6B;AAE7C,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA;AAE/B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAC/B,EAAA,IAAI,KAAA,CAAM,CAAC,CAAA,KAAM,UAAA,EAAY,OAAO,IAAA;AACpC,EAAA,MAAM,QAAA,GAAW,MAAM,CAAC,CAAA;AACxB,EAAA,MAAM,OAAA,GAAU,MAAM,CAAC,CAAA;AACvB,EAAA,MAAM,OAAA,GAAU,MAAM,CAAC,CAAA;AACvB,EAAA,IAAI,QAAA,KAAa,MAAA,IAAa,OAAA,KAAY,MAAA,IAAa,YAAY,MAAA,EAAW;AAC5E,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAoB;AACvC,EAAA,KAAA,MAAW,EAAA,IAAM,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,EAAA,CAAG,MAAM,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAA,KAAM,MAAA,IAAa,CAAA,KAAM,MAAA,EAAW,OAAO,IAAA;AAC/C,IAAA,MAAM,CAAA,GAAI,OAAO,CAAC,CAAA;AAClB,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,CAAC,GAAG,OAAO,IAAA;AAChC,IAAA,MAAA,CAAO,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,EACjB;AACA,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AACxB,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AACxB,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AACxB,EAAA,IAAI,MAAM,MAAA,IAAa,CAAA,KAAM,MAAA,IAAa,CAAA,KAAM,QAAW,OAAO,IAAA;AAClE,EAAA,IAAI;AACF,IAAA,OAAO,EAAE,CAAA,EAAG,CAAA,EAAG,CAAA,EAAG,IAAA,EAAM,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA,EAAG,IAAA,EAAM,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA,EAAE;AAAA,EACzE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AClGO,IAAM,yBAAN,MAA0D;AAAA,EAC/D,MAAM,MAAA,CACJ,OAAA,EACA,SAAA,EACA,SAAA,EACkB;AAClB,IAAA,IAAI;AACF,MAAA,OAAOC,eAAA,CAAQ,MAAA,CAAO,SAAA,EAAW,OAAA,EAAS,SAAS,CAAA;AAAA,IACrD,CAAA,CAAA,MAAQ;AAEN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACF","file":"crypto.cjs","sourcesContent":["/**\n * Base64 محمول (standard + url-safe) بدون الاعتماد على Buffer أو btoa — علشان نفس\n * الكود يشتغل في Node و المتصفح و React Native. الترميز بدون padding افتراضياً\n * (صيغة PHC و JWT كده)، وفك الترميز بيتقبّل بوجود أو غياب الـ padding.\n */\nconst STD = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\nconst URL = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n\nfunction encode(bytes: Uint8Array, alphabet: string): string {\n  let out = \"\";\n  for (let i = 0; i < bytes.length; i += 3) {\n    const b0 = bytes[i]!;\n    const b1 = i + 1 < bytes.length ? bytes[i + 1]! : 0;\n    const b2 = i + 2 < bytes.length ? bytes[i + 2]! : 0;\n    const triple = (b0 << 16) | (b1 << 8) | b2;\n    out += alphabet[(triple >> 18) & 63];\n    out += alphabet[(triple >> 12) & 63];\n    if (i + 1 < bytes.length) out += alphabet[(triple >> 6) & 63];\n    if (i + 2 < bytes.length) out += alphabet[triple & 63];\n  }\n  return out;\n}\n\nfunction decode(str: string, alphabet: string): Uint8Array {\n  const lookup = new Int16Array(128).fill(-1);\n  for (let i = 0; i < alphabet.length; i++) lookup[alphabet.charCodeAt(i)] = i;\n  // شيل الـ padding والمسافات\n  const clean = str.replace(/[=\\s]/g, \"\");\n  const out = new Uint8Array(Math.floor((clean.length * 6) / 8));\n  let bits = 0;\n  let value = 0;\n  let o = 0;\n  for (let i = 0; i < clean.length; i++) {\n    const c = clean.charCodeAt(i);\n    const idx = c < 128 ? lookup[c]! : -1;\n    if (idx < 0) throw new Error(\"base64: حرف غير صالح\");\n    value = (value << 6) | idx;\n    bits += 6;\n    if (bits >= 8) {\n      bits -= 8;\n      out[o++] = (value >> bits) & 0xff;\n    }\n  }\n  return out;\n}\n\nexport const b64 = {\n  encode: (b: Uint8Array): string => encode(b, STD),\n  decode: (s: string): Uint8Array => decode(s, STD),\n};\n\nexport const b64url = {\n  encode: (b: Uint8Array): string => encode(b, URL),\n  decode: (s: string): Uint8Array => decode(s, URL),\n};\n","import { argon2idAsync } from \"@noble/hashes/argon2\";\nimport { randomBytes, utf8ToBytes } from \"@noble/hashes/utils\";\nimport type { PinHasher } from \"../ports/PinHasher\";\nimport { b64 } from \"./base64\";\n\n/**\n * الافتراضي لتعمية الـ PIN: argon2id بصيغة PHC القياسية، pure JS من @noble/hashes.\n * نفس الصيغة اللي السيرفر بينتجها فالـ hash المتزامن يتحقق محلياً (نفس الكود\n * أونلاين وأوفلاين).\n *\n * صيغة الناتج: $argon2id$v=19$m=<m>,t=<t>,p=<p>$<saltB64>$<hashB64>\n */\nexport interface Argon2Params {\n  /** iterations (t). */\n  t: number;\n  /** memory بالـ KiB (m). */\n  m: number;\n  /** parallelism (p). */\n  p: number;\n  /** طول الـ hash بالبايت. */\n  dkLen: number;\n}\n\n/** إعداد متزن للأجهزة (64MiB, 3 مرات) — يطابق الافتراضي الشائع للسيرفر. */\nexport const DEFAULT_ARGON2_PARAMS: Argon2Params = {\n  t: 3,\n  m: 64 * 1024,\n  p: 1,\n  dkLen: 32,\n};\n\nconst V = 19; // argon2 version 1.3\n\nfunction constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i++) diff |= a[i]! ^ b[i]!;\n  return diff === 0;\n}\n\nexport class NoblePinHasher implements PinHasher {\n  private readonly params: Argon2Params;\n\n  constructor(params: Argon2Params = DEFAULT_ARGON2_PARAMS) {\n    this.params = params;\n  }\n\n  async hash(pin: string): Promise<string> {\n    const salt = randomBytes(16);\n    const { t, m, p, dkLen } = this.params;\n    const out = await argon2idAsync(utf8ToBytes(pin), salt, { t, m, p, dkLen });\n    return `$argon2id$v=${V}$m=${m},t=${t},p=${p}$${b64.encode(salt)}$${b64.encode(out)}`;\n  }\n\n  async verify(pin: string, encoded: string): Promise<boolean> {\n    const parsed = parsePhc(encoded);\n    if (!parsed) return false;\n    const out = await argon2idAsync(utf8ToBytes(pin), parsed.salt, {\n      t: parsed.t,\n      m: parsed.m,\n      p: parsed.p,\n      dkLen: parsed.hash.length,\n    });\n    return constantTimeEqual(out, parsed.hash);\n  }\n}\n\ninterface Phc {\n  m: number;\n  t: number;\n  p: number;\n  salt: Uint8Array;\n  hash: Uint8Array;\n}\n\n/** يفكّ صيغة PHC لـ argon2id. بيرجّع null لو مش متعرّف عليها (نتيجتها verify=false). */\nfunction parsePhc(encoded: string): Phc | null {\n  // $argon2id$v=19$m=..,t=..,p=..$salt$hash\n  const parts = encoded.split(\"$\");\n  // [\"\", \"argon2id\", \"v=19\", \"m=..,t=..,p=..\", \"<salt>\", \"<hash>\"]\n  if (parts.length !== 6) return null;\n  if (parts[1] !== \"argon2id\") return null;\n  const paramStr = parts[3];\n  const saltStr = parts[4];\n  const hashStr = parts[5];\n  if (paramStr === undefined || saltStr === undefined || hashStr === undefined) {\n    return null;\n  }\n  const params = new Map<string, number>();\n  for (const kv of paramStr.split(\",\")) {\n    const [k, v] = kv.split(\"=\");\n    if (k === undefined || v === undefined) return null;\n    const n = Number(v);\n    if (!Number.isFinite(n)) return null;\n    params.set(k, n);\n  }\n  const m = params.get(\"m\");\n  const t = params.get(\"t\");\n  const p = params.get(\"p\");\n  if (m === undefined || t === undefined || p === undefined) return null;\n  try {\n    return { m, t, p, salt: b64.decode(saltStr), hash: b64.decode(hashStr) };\n  } catch {\n    return null;\n  }\n}\n","import { ed25519 } from \"@noble/curves/ed25519\";\nimport type { SignatureVerifier } from \"../ports/SignatureVerifier\";\n\n/**\n * الافتراضي للتحقق من التوقيع: Ed25519 من @noble/curves (pure JS). بيتحقق محلياً\n * من مفاتيح التفعيل الموقّعة بمفتاح قمرة الخاص — بدون أي نداء سيرفر.\n */\nexport class NobleSignatureVerifier implements SignatureVerifier {\n  async verify(\n    message: Uint8Array,\n    signature: Uint8Array,\n    publicKey: Uint8Array,\n  ): Promise<boolean> {\n    try {\n      return ed25519.verify(signature, message, publicKey);\n    } catch {\n      // توقيع/مفتاح بحجم غلط → اعتبره غير صالح بدل ما نرمي.\n      return false;\n    }\n  }\n}\n"]}

package/dist/crypto.d.cts

@@ -0,0 +1,46 @@
+import { P as PinHasher, S as SignatureVerifier } from './SignatureVerifier-ueydiL4D.cjs';
+
+declare const b64: {
+    encode: (b: Uint8Array) => string;
+    decode: (s: string) => Uint8Array;
+};
+declare const b64url: {
+    encode: (b: Uint8Array) => string;
+    decode: (s: string) => Uint8Array;
+};
+
+/**
+ * الافتراضي لتعمية الـ PIN: argon2id بصيغة PHC القياسية، pure JS من @noble/hashes.
+ * نفس الصيغة اللي السيرفر بينتجها فالـ hash المتزامن يتحقق محلياً (نفس الكود
+ * أونلاين وأوفلاين).
+ *
+ * صيغة الناتج: $argon2id$v=19$m=<m>,t=<t>,p=<p>$<saltB64>$<hashB64>
+ */
+interface Argon2Params {
+    /** iterations (t). */
+    t: number;
+    /** memory بالـ KiB (m). */
+    m: number;
+    /** parallelism (p). */
+    p: number;
+    /** طول الـ hash بالبايت. */
+    dkLen: number;
+}
+/** إعداد متزن للأجهزة (64MiB, 3 مرات) — يطابق الافتراضي الشائع للسيرفر. */
+declare const DEFAULT_ARGON2_PARAMS: Argon2Params;
+declare class NoblePinHasher implements PinHasher {
+    private readonly params;
+    constructor(params?: Argon2Params);
+    hash(pin: string): Promise<string>;
+    verify(pin: string, encoded: string): Promise<boolean>;
+}
+
+/**
+ * الافتراضي للتحقق من التوقيع: Ed25519 من @noble/curves (pure JS). بيتحقق محلياً
+ * من مفاتيح التفعيل الموقّعة بمفتاح قمرة الخاص — بدون أي نداء سيرفر.
+ */
+declare class NobleSignatureVerifier implements SignatureVerifier {
+    verify(message: Uint8Array, signature: Uint8Array, publicKey: Uint8Array): Promise<boolean>;
+}
+
+export { type Argon2Params, DEFAULT_ARGON2_PARAMS, NoblePinHasher, NobleSignatureVerifier, b64, b64url };

package/dist/crypto.d.ts

@@ -0,0 +1,46 @@
+import { P as PinHasher, S as SignatureVerifier } from './SignatureVerifier-ueydiL4D.js';
+
+declare const b64: {
+    encode: (b: Uint8Array) => string;
+    decode: (s: string) => Uint8Array;
+};
+declare const b64url: {
+    encode: (b: Uint8Array) => string;
+    decode: (s: string) => Uint8Array;
+};
+
+/**
+ * الافتراضي لتعمية الـ PIN: argon2id بصيغة PHC القياسية، pure JS من @noble/hashes.
+ * نفس الصيغة اللي السيرفر بينتجها فالـ hash المتزامن يتحقق محلياً (نفس الكود
+ * أونلاين وأوفلاين).
+ *
+ * صيغة الناتج: $argon2id$v=19$m=<m>,t=<t>,p=<p>$<saltB64>$<hashB64>
+ */
+interface Argon2Params {
+    /** iterations (t). */
+    t: number;
+    /** memory بالـ KiB (m). */
+    m: number;
+    /** parallelism (p). */
+    p: number;
+    /** طول الـ hash بالبايت. */
+    dkLen: number;
+}
+/** إعداد متزن للأجهزة (64MiB, 3 مرات) — يطابق الافتراضي الشائع للسيرفر. */
+declare const DEFAULT_ARGON2_PARAMS: Argon2Params;
+declare class NoblePinHasher implements PinHasher {
+    private readonly params;
+    constructor(params?: Argon2Params);
+    hash(pin: string): Promise<string>;
+    verify(pin: string, encoded: string): Promise<boolean>;
+}
+
+/**
+ * الافتراضي للتحقق من التوقيع: Ed25519 من @noble/curves (pure JS). بيتحقق محلياً
+ * من مفاتيح التفعيل الموقّعة بمفتاح قمرة الخاص — بدون أي نداء سيرفر.
+ */
+declare class NobleSignatureVerifier implements SignatureVerifier {
+    verify(message: Uint8Array, signature: Uint8Array, publicKey: Uint8Array): Promise<boolean>;
+}
+
+export { type Argon2Params, DEFAULT_ARGON2_PARAMS, NoblePinHasher, NobleSignatureVerifier, b64, b64url };

package/dist/crypto.js

@@ -0,0 +1,3 @@
+export { DEFAULT_ARGON2_PARAMS, NoblePinHasher, NobleSignatureVerifier, b64, b64url } from './chunk-SRPTNNYT.js';
+//# sourceMappingURL=crypto.js.map
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"crypto.js"}