simple-hpke 0.0.9 → 0.1.0

package/dist/index.d.ts

@@ -1,67 +1,34 @@
-import { type SupportedEncodings } from 'uint8arrays';
-export type Uint8ArrayEncodings = SupportedEncodings;
+import { type RecipientKey, encryptToString, encryptBytes } from './util';
 /**
- * A recipient's X25519 public key, in any of four forms:
- * - `CryptoKey`: an X25519 public key.
- * - `CryptoKeyPair`: its `.publicKey` is used (encryption never needs the
- *   private half).
- * - `Uint8Array`: 32 raw X25519 public-key bytes.
- * - `{ publicKey, encoding? }`: the public key as an encoded string;
- *   `encoding` defaults to `base64url`.
- */
-export type RecipientKey = CryptoKey | CryptoKeyPair | Uint8Array | {
-    publicKey: string;
-    encoding?: Uint8ArrayEncodings;
-};
-/**
- * Wrap an AES key to a recipient's public key.
+ * Create a new AES key for the given public key.
  *
- * @param recipient The recipient's X25519 public key, as a `CryptoKey`,
- *   `CryptoKeyPair` (its `.publicKey` is used), 32 raw bytes (`Uint8Array`),
- *   or `{ publicKey:string, encoding? }` (encoding defaults to `base64url`).
- * @param aesKey Optional key to seal, as either an AES-GCM `CryptoKey` or its
- *   raw bytes (`Uint8Array`, 16 or 32 bytes). Omit to generate a fresh
- *   extractable key of `opts.keysize` bits. A supplied `CryptoKey` MUST be
- *   extractable (its raw bytes are sealed).
- * @param opts `keysize` (128/256, default 256; ignored when `aesKey` is
- *   supplied) and `info` (bound into the HPKE key schedule; default empty).
- * @returns { wrapped:Uint8Array, key:CryptoKey } The envelope bytes and a
- *   usable AES-GCM `CryptoKey`.
+ * @param recipient Public key for decryptor
+ * @param opts `size` and `info`
+ * @returns {{ enc, key }} The wrapped envelope bytes and the generated
+ *   AES-GCM key.
  */
-export declare function seal(recipient: RecipientKey, aesKey?: CryptoKey | Uint8Array | null, opts?: {
-    keysize?: 128 | 256;
+export declare function create(recipient: RecipientKey, opts?: {
+    size?: 128 | 256;
     info?: Uint8Array | string;
 }): Promise<{
-    wrapped: Uint8Array;
+    enc: Uint8Array<ArrayBufferLike>;
     key: CryptoKey;
 }>;
 /**
- * Recover an AES key that was wrapped with `seal`, using your private key.
+ * Encrypt the given AES key to the given public key.
  *
- * @param keypair The same X25519 `CryptoKeyPair` used to seal.
- * @param wrapped The envelope returned by `seal` (`enc ‖ ciphertext`).
- * @param opts `info` — must match the value passed to `seal`.
- * @returns The recovered AES-GCM `CryptoKey` (extractable).
+ * @returns {{ enc, key }} The wrapped envelope bytes and a usable AES-GCM
+ *   key with the same raw bytes as `aesKey`.
  */
-declare function openBytes(keypair: CryptoKeyPair, wrapped: Uint8Array, opts?: {
-    info: Uint8Array | string;
-}): Promise<CryptoKey>;
-/**
- * Like `open`, but returns the recovered key as raw bytes instead of
- * importing it as an AES-GCM `CryptoKey`. Exposed as `open.raw`.
- *
- * @param keypair The same X25519 `CryptoKeyPair` used to seal.
- * @param wrapped The envelope returned by `seal` (`enc ‖ ciphertext`).
- * @param opts `info` — must match the value passed to `seal`.
- * @returns The recovered key bytes (16 or 32 bytes, matching whatever
- *   was sealed).
- */
-declare function openRawBytes(keypair: CryptoKeyPair, wrapped: Uint8Array, opts?: {
-    info: Uint8Array | string;
-}): Promise<Uint8Array>;
+export declare function seal(recipient: RecipientKey, aesKey: CryptoKey | Uint8Array | null, opts?: {
+    info?: Uint8Array | string;
+}): Promise<{
+    enc: Uint8Array<ArrayBufferLike>;
+    key: CryptoKey;
+}>;
 /**
- * Recover the AES key wrapped by `seal`. Call `open(...)` for a usable
- * AES-GCM `CryptoKey`, or `open.raw(...)` for the raw key bytes.
+ * Recover the AES key wrapped by `create` or `seal`. Call `open(...)` for a
+ * usable AES-GCM `CryptoKey`, or `open.raw(...)` for the raw key bytes.
  */
 export declare const open: typeof openBytes & {
     raw: typeof openRawBytes;
@@ -132,63 +99,28 @@ declare function decryptFromString(keypair: CryptoKeyPair, message: string, opts
     buffer: true;
 }): Promise<Uint8Array>;
 /**
- * Seal a fresh (or supplied) AES key to `recipient`, then AES-GCM encrypt a
- * message under it. The wrapped key, IV, and ciphertext are concatenated
- * into a single self-describing envelope.
- *
- * Wire format: `wrappedLen(2, big-endian) ‖ wrapped ‖ iv(12) ‖ ciphertext`.
- * The length prefix lets `decrypt` slice the segments apart for either
- * 128- or 256-bit wrapped keys.
- *
- * @param recipient The recipient's X25519 public key, as a `CryptoKey`,
- *   `CryptoKeyPair` (its `.publicKey` is used), 32 raw bytes (`Uint8Array`),
- *   or `{ publicKey:string, encoding? }` (encoding defaults to `base64url`).
- * @param message Plaintext to encrypt. A `string` is UTF-8 encoded.
- * @param aesKey Optional key, as either an AES-GCM `CryptoKey` or its raw
- *   bytes (`Uint8Array`, 16 or 32 bytes). Omit to generate a fresh key of
- *   `opts.keysize` bits. A supplied `CryptoKey` MUST be extractable. Each
- *   call picks a fresh random 96-bit IV for the message ciphertext, so
- *   reusing the same `aesKey` across many calls carries the standard
- *   birthday bound for random nonces (collision risk becomes
- *   non-negligible around 2^32 messages under one key, NIST SP 800-38D) --
- *   prefer a fresh key per call (the default) over reusing one at scale.
- * @param opts `keysize` (128/256, default 256; ignored when `aesKey` is
- *   supplied) and `info` (bound into the HPKE key schedule).
- * @returns The concatenated envelope bytes.
+ * Like `open`, but returns the recovered key as raw bytes instead of
+ * importing it as an AES-GCM `CryptoKey`. Exposed as `open.raw`.
  *
- * `encrypt.asString(...)` returns the same envelope as an encoded string.
+ * @param keypair The same X25519 `CryptoKeyPair` used to create or seal.
+ * @param wrapped The `enc` bytes returned by `create` or `seal`.
+ * @param opts `info` — must match the value passed to `create` or `seal`.
+ * @returns The recovered key bytes (16 or 32 bytes, matching whatever
+ *   was wrapped).
  */
-declare function encryptBytes(recipient: RecipientKey, message: Uint8Array | string, aesKey?: CryptoKey | Uint8Array | null, opts?: {
-    keysize?: 128 | 256;
-    info?: Uint8Array | string;
+declare function openRawBytes(keypair: CryptoKeyPair, wrapped: Uint8Array, opts?: {
+    info: Uint8Array | string;
 }): Promise<Uint8Array>;
 /**
- * Like `encrypt`, but encodes the envelope bytes to a string — handy for
- * transports that carry text (JSON, URLs, headers). Decode with
- * `fromString(...)` (or any matching decoder) and pass the bytes to
- * `decrypt` / `decrypt.asString`. Exposed as `encrypt.asString`.
+ * Recover an AES key that was wrapped with `create` or `seal`.
  *
- * @param recipient The recipient's X25519 public key, as a `CryptoKey`,
- *   `CryptoKeyPair` (its `.publicKey` is used), 32 raw bytes (`Uint8Array`),
- *   or `{ publicKey:string, encoding? }` (encoding defaults to `base64url`).
- * @param message Plaintext to encrypt. A `string` is UTF-8 encoded.
- * @param aesKey Optional key, as either an AES-GCM `CryptoKey` or its raw
- *   bytes (`Uint8Array`, 16 or 32 bytes). Omit to generate a fresh key of
- *   `opts.keysize` bits. A supplied `CryptoKey` MUST be extractable. Each
- *   call picks a fresh random 96-bit IV for the message ciphertext, so
- *   reusing the same `aesKey` across many calls carries the standard
- *   birthday bound for random nonces (collision risk becomes
- *   non-negligible around 2^32 messages under one key, NIST SP 800-38D) --
- *   prefer a fresh key per call (the default) over reusing one at scale.
- * @param opts `keysize` (128/256, default 256; ignored when `aesKey` is
- *   supplied), `info` (bound into the HPKE key schedule), and `encoding`
- *   (the string encoding of the returned envelope; default `base64url`).
- * @returns The encoded envelope string.
+ * @param keypair The same X25519 `CryptoKeyPair` used to create or seal.
+ * @param wrapped The `enc` bytes returned by `create` or `seal`.
+ * @param opts `info` — must match the value passed to `create` or `seal`.
+ * @returns The recovered AES-GCM `CryptoKey` (extractable).
  */
-declare function encryptToString(recipient: RecipientKey, message: Uint8Array | string, aesKey?: CryptoKey | Uint8Array | null, opts?: {
-    keysize?: 128 | 256;
-    info?: Uint8Array | string;
-    encoding?: SupportedEncodings;
-}): Promise<string>;
+declare function openBytes(keypair: CryptoKeyPair, wrapped: Uint8Array, opts?: {
+    info: Uint8Array | string;
+}): Promise<CryptoKey>;
 export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAM3E,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,CAAA;AAEpD;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAClB,SAAS,GACT,aAAa,GACb,UAAU,GACV;IAAE,SAAS,EAAC,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAC,mBAAmB,CAAA;CAAE,CAAA;AAqCzD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,IAAI,CACtB,SAAS,EAAC,YAAY,EACtB,MAAM,CAAC,EAAC,SAAS,GAAC,UAAU,GAAC,IAAI,EACjC,IAAI,CAAC,EAAC;IAEF,OAAO,CAAC,EAAC,GAAG,GAAC,GAAG,CAAA;IAEhB,IAAI,CAAC,EAAC,UAAU,GAAC,MAAM,CAAA;CAC1B,GACH,OAAO,CAAC;IAAE,OAAO,EAAC,UAAU,CAAC;IAAC,GAAG,EAAC,SAAS,CAAA;CAAE,CAAC,CA0B/C;AAED;;;;;;;GAOG;AACH,iBAAe,SAAS,CACpB,OAAO,EAAC,aAAa,EACrB,OAAO,EAAC,UAAU,EAClB,IAAI,CAAC,EAAC;IAAE,IAAI,EAAC,UAAU,GAAC,MAAM,CAAA;CAAE,GAClC,OAAO,CAAC,SAAS,CAAC,CAGnB;AAED;;;;;;;;;GASG;AACH,iBAAe,YAAY,CACvB,OAAO,EAAC,aAAa,EACrB,OAAO,EAAC,UAAU,EAClB,IAAI,CAAC,EAAC;IAAE,IAAI,EAAC,UAAU,GAAC,MAAM,CAAA;CAAE,GAClC,OAAO,CAAC,UAAU,CAAC,CAYpB;AAED;;;GAGG;AACH,eAAO,MAAM,IAAI;;CAEf,CAAA;AAOF;;;;GAIG;AACH,eAAO,MAAM,OAAO;;CAElB,CAAA;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,OAAO;;;CAGlB,CAAA;AAEF;;;;;;;;GAQG;AACH,iBAAe,YAAY,CACvB,OAAO,EAAC,aAAa,EACrB,OAAO,EAAC,UAAU,EAClB,IAAI,CAAC,EAAC;IAAE,IAAI,CAAC,EAAC,UAAU,GAAC,MAAM,CAAA;CAAE,GACnC,OAAO,CAAC,UAAU,CAAC,CA6BpB;AAED;;;;;;;;GAQG;AACH,iBAAe,eAAe,CAC1B,OAAO,EAAC,aAAa,EACrB,OAAO,EAAC,UAAU,EAClB,IAAI,CAAC,EAAC;IAAE,IAAI,CAAC,EAAC,UAAU,GAAC,MAAM,CAAA;CAAE,GACnC,OAAO,CAAC,MAAM,CAAC,CAGhB;AAED;;;;;;;;;;;;;GAaG;AACH,iBAAe,iBAAiB,CAC5B,OAAO,EAAC,aAAa,EACrB,OAAO,EAAC,MAAM,EACd,IAAI,CAAC,EAAC;IAAE,IAAI,CAAC,EAAC,UAAU,GAAC,MAAM,CAAC;IAAC,MAAM,CAAC,EAAC,KAAK,CAAA;CAAE,GAClD,OAAO,CAAC,MAAM,CAAC,CAAA;AAEjB,iBAAe,iBAAiB,CAC5B,OAAO,EAAC,aAAa,EACrB,OAAO,EAAC,MAAM,EACd,IAAI,EAAC;IAAE,IAAI,CAAC,EAAC,UAAU,GAAC,MAAM,CAAC;IAAC,MAAM,EAAC,IAAI,CAAA;CAAE,GAC/C,OAAO,CAAC,UAAU,CAAC,CAAA;AAmbrB;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,iBAAe,YAAY,CACvB,SAAS,EAAC,YAAY,EACtB,OAAO,EAAC,UAAU,GAAC,MAAM,EACzB,MAAM,CAAC,EAAC,SAAS,GAAC,UAAU,GAAC,IAAI,EACjC,IAAI,CAAC,EAAC;IACF,OAAO,CAAC,EAAC,GAAG,GAAC,GAAG,CAAA;IAChB,IAAI,CAAC,EAAC,UAAU,GAAC,MAAM,CAAA;CAC1B,GACH,OAAO,CAAC,UAAU,CAAC,CAcpB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,iBAAe,eAAe,CAC1B,SAAS,EAAC,YAAY,EACtB,OAAO,EAAC,UAAU,GAAC,MAAM,EACzB,MAAM,CAAC,EAAC,SAAS,GAAC,UAAU,GAAC,IAAI,EACjC,IAAI,CAAC,EAAC;IACF,OAAO,CAAC,EAAC,GAAG,GAAC,GAAG,CAAA;IAChB,IAAI,CAAC,EAAC,UAAU,GAAC,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAC,kBAAkB,CAAA;CAC/B,GACH,OAAO,CAAC,MAAM,CAAC,CAGhB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACH,KAAK,YAAY,EAGjB,eAAe,EACf,YAAY,EAOf,MAAM,QAAQ,CAAA;AAoBf;;;;;;;GAOG;AACH,wBAAsB,MAAM,CACxB,SAAS,EAAC,YAAY,EACtB,IAAI,CAAC,EAAC;IAEF,IAAI,CAAC,EAAC,GAAG,GAAC,GAAG,CAAA;IAEb,IAAI,CAAC,EAAC,UAAU,GAAC,MAAM,CAAA;CAC1B,GACH,OAAO,CAAC;IAAE,GAAG,EAAC,UAAU,CAAC,eAAe,CAAC,CAAC;IAAC,GAAG,EAAC,SAAS,CAAA;CAAE,CAAC,CAG5D;AAED;;;;;GAKG;AACH,wBAAsB,IAAI,CACtB,SAAS,EAAC,YAAY,EACtB,MAAM,EAAC,SAAS,GAAC,UAAU,GAAC,IAAI,EAChC,IAAI,CAAC,EAAC;IAEF,IAAI,CAAC,EAAC,UAAU,GAAC,MAAM,CAAA;CAC1B,GACH,OAAO,CAAC;IAAE,GAAG,EAAC,UAAU,CAAC,eAAe,CAAC,CAAC;IAAC,GAAG,EAAC,SAAS,CAAA;CAAE,CAAC,CAG5D;AAED;;;GAGG;AACH,eAAO,MAAM,IAAI;;CAEf,CAAA;AAEF;;;;GAIG;AACH,eAAO,MAAM,OAAO;;CAElB,CAAA;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,OAAO;;;CAGlB,CAAA;AAEF;;;;;;;;GAQG;AACH,iBAAe,YAAY,CACvB,OAAO,EAAC,aAAa,EACrB,OAAO,EAAC,UAAU,EAClB,IAAI,CAAC,EAAC;IAAE,IAAI,CAAC,EAAC,UAAU,GAAC,MAAM,CAAA;CAAE,GACnC,OAAO,CAAC,UAAU,CAAC,CA6BpB;AAED;;;;;;;;GAQG;AACH,iBAAe,eAAe,CAC1B,OAAO,EAAC,aAAa,EACrB,OAAO,EAAC,UAAU,EAClB,IAAI,CAAC,EAAC;IAAE,IAAI,CAAC,EAAC,UAAU,GAAC,MAAM,CAAA;CAAE,GACnC,OAAO,CAAC,MAAM,CAAC,CAGhB;AAED;;;;;;;;;;;;;GAaG;AACH,iBAAe,iBAAiB,CAC5B,OAAO,EAAC,aAAa,EACrB,OAAO,EAAC,MAAM,EACd,IAAI,CAAC,EAAC;IAAE,IAAI,CAAC,EAAC,UAAU,GAAC,MAAM,CAAC;IAAC,MAAM,CAAC,EAAC,KAAK,CAAA;CAAE,GAClD,OAAO,CAAC,MAAM,CAAC,CAAA;AAEjB,iBAAe,iBAAiB,CAC5B,OAAO,EAAC,aAAa,EACrB,OAAO,EAAC,MAAM,EACd,IAAI,EAAC;IAAE,IAAI,CAAC,EAAC,UAAU,GAAC,MAAM,CAAC;IAAC,MAAM,EAAC,IAAI,CAAA;CAAE,GAC/C,OAAO,CAAC,UAAU,CAAC,CAAA;AA0HrB;;;;;;;;;GASG;AACH,iBAAe,YAAY,CACvB,OAAO,EAAC,aAAa,EACrB,OAAO,EAAC,UAAU,EAClB,IAAI,CAAC,EAAC;IAAE,IAAI,EAAC,UAAU,GAAC,MAAM,CAAA;CAAE,GAClC,OAAO,CAAC,UAAU,CAAC,CAYpB;AAED;;;;;;;GAOG;AACH,iBAAe,SAAS,CACpB,OAAO,EAAC,aAAa,EACrB,OAAO,EAAC,UAAU,EAClB,IAAI,CAAC,EAAC;IAAE,IAAI,EAAC,UAAU,GAAC,MAAM,CAAA;CAAE,GAClC,OAAO,CAAC,SAAS,CAAC,CAGnB"}

package/dist/index.js

@@ -1283,8 +1283,7 @@ function toString2(array, encoding = "utf8") {
 }
 __name(toString2, "toString");
 
-// src/index.ts
-var subtle = globalThis.crypto.subtle;
+// src/constants.ts
 var KEM_ID = 32;
 var KDF_ID = 1;
 var AEAD_ID = 2;
@@ -1295,6 +1294,7 @@ var ENC_LENGTH = 32;
 var AEAD_TAG_LENGTH = 16;
 var MODE_BASE = 0;
 var HPKE_V1 = new TextEncoder().encode("HPKE-v1");
+var WRAPPED_LEN_PREFIX = 2;
 var KEM_SUITE_ID = concat2(
   new TextEncoder().encode("KEM"),
   i2osp(KEM_ID, 2)
@@ -1305,174 +1305,68 @@ var HPKE_SUITE_ID = concat2(
   i2osp(KDF_ID, 2),
   i2osp(AEAD_ID, 2)
 );
-async function seal(recipient, aesKey, opts) {
-  const info = normalizeInfo(opts?.info);
-  let keyBytes;
-  if (aesKey instanceof Uint8Array) {
-    validateRawKeyBytes(aesKey);
-    keyBytes = aesKey;
-  } else if (aesKey) {
-    keyBytes = await exportAesKeyBytes(aesKey);
-    validateRawKeyBytes(keyBytes);
-  } else {
-    const keysize = opts?.keysize ?? 256;
-    validateKeysize(keysize);
-    keyBytes = globalThis.crypto.getRandomValues(
-      new Uint8Array(keysize / 8)
-    );
-  }
-  const publicKey = await resolveRecipientPublicKey(recipient);
-  const { sharedSecret, enc } = await encap(publicKey);
-  const { key, baseNonce } = await keySchedule(sharedSecret, info);
-  const ciphertext = await aeadSeal(key, baseNonce, keyBytes);
-  const wrapped = concat2(enc, ciphertext);
-  const aesGcmKey = await importAesKey(keyBytes);
-  return { wrapped, key: aesGcmKey };
-}
-__name(seal, "seal");
-async function openBytes(keypair, wrapped, opts) {
-  const keyBytes = await openRawBytes(keypair, wrapped, opts);
-  return importAesKey(keyBytes);
-}
-__name(openBytes, "openBytes");
-async function openRawBytes(keypair, wrapped, opts) {
-  if (wrapped.byteLength < ENC_LENGTH + AEAD_TAG_LENGTH) {
-    throw new Error("malformed envelope: too short");
-  }
-  const info = normalizeInfo(opts?.info);
-  const enc = wrapped.slice(0, ENC_LENGTH);
-  const ciphertext = wrapped.slice(ENC_LENGTH);
-  const sharedSecret = await decap(enc, keypair);
-  const { key, baseNonce } = await keySchedule(sharedSecret, info);
-  return aeadOpen(key, baseNonce, ciphertext);
-}
-__name(openRawBytes, "openRawBytes");
-var open = Object.assign(openBytes, {
-  raw: openRawBytes
-});
-var WRAPPED_LEN_PREFIX = 2;
-var encrypt = Object.assign(encryptBytes, {
-  asString: encryptToString
-});
-var decrypt = Object.assign(decryptBytes, {
-  asString: decryptToString,
-  fromString: decryptFromString
-});
-async function decryptBytes(keypair, message, opts) {
-  if (message.byteLength < WRAPPED_LEN_PREFIX) {
-    throw new Error("malformed message: too short");
-  }
-  const wrappedLen = message[0] << 8 | message[1];
-  const ivStart = WRAPPED_LEN_PREFIX + wrappedLen;
-  const ctStart = ivStart + NN;
-  if (message.byteLength < ctStart + AEAD_TAG_LENGTH) {
-    throw new Error("malformed message: too short");
-  }
-  const wrapped = message.slice(WRAPPED_LEN_PREFIX, ivStart);
-  const iv = message.slice(ivStart, ctStart);
-  const ciphertext = message.slice(ctStart);
-  const keyBytes = await openRawBytes(
-    keypair,
-    wrapped,
-    opts?.info !== void 0 ? { info: opts.info } : void 0
-  );
-  const key = await importAesKeyDecryptOnly(keyBytes);
-  const pt = await subtle.decrypt(
-    { name: "AES-GCM", iv },
-    key,
-    ciphertext
-  );
-  return new Uint8Array(pt);
-}
-__name(decryptBytes, "decryptBytes");
-async function decryptToString(keypair, message, opts) {
-  const bytes = await decryptBytes(keypair, message, opts);
-  return new TextDecoder().decode(bytes);
-}
-__name(decryptToString, "decryptToString");
-async function decryptFromString(keypair, message, opts) {
-  const bytes = fromString2(message, "base64url");
-  const plaintext = await decryptBytes(
-    keypair,
-    bytes,
-    opts?.info !== void 0 ? { info: opts.info } : void 0
-  );
-  return opts?.buffer ? plaintext : new TextDecoder().decode(plaintext);
-}
-__name(decryptFromString, "decryptFromString");
-function validateKeysize(keysize) {
-  if (keysize !== 128 && keysize !== 256) {
-    throw new Error(
-      `invalid keysize: ${keysize} (expected 128 or 256)`
-    );
-  }
-}
-__name(validateKeysize, "validateKeysize");
-function validateRawKeyBytes(raw) {
-  if (raw.length !== 16 && raw.length !== 32) {
-    throw new Error(
-      `invalid aesKey length: ${raw.length} bytes (expected 16 or 32)`
-    );
-  }
-}
-__name(validateRawKeyBytes, "validateRawKeyBytes");
-function normalizeInfo(info) {
-  if (info === void 0 || info === null) return new Uint8Array(0);
-  if (typeof info === "string") return new TextEncoder().encode(info);
-  return info;
-}
-__name(normalizeInfo, "normalizeInfo");
-async function exportAesKeyBytes(key) {
-  if (!key.extractable) {
-    throw new Error(
-      "aesKey must be extractable: its raw bytes are what get sealed"
-    );
-  }
-  return new Uint8Array(await subtle.exportKey("raw", key));
-}
-__name(exportAesKeyBytes, "exportAesKeyBytes");
-async function importAesKey(raw) {
-  return subtle.importKey(
+
+// src/util.ts
+var subtle = globalThis.crypto.subtle;
+async function aeadSeal(key, nonce, plaintext) {
+  const k = await subtle.importKey(
     "raw",
-    raw,
+    key,
     { name: "AES-GCM" },
-    true,
-    ["encrypt", "decrypt"]
+    false,
+    ["encrypt"]
+  );
+  const ct = await subtle.encrypt(
+    { name: "AES-GCM", iv: nonce },
+    k,
+    plaintext
   );
+  return new Uint8Array(ct);
 }
-__name(importAesKey, "importAesKey");
-async function importAesKeyDecryptOnly(raw) {
-  return subtle.importKey(
+__name(aeadSeal, "aeadSeal");
+async function aeadOpen(key, nonce, ciphertext) {
+  const k = await subtle.importKey(
     "raw",
-    raw,
+    key,
     { name: "AES-GCM" },
     false,
     ["decrypt"]
   );
+  const pt = await subtle.decrypt(
+    { name: "AES-GCM", iv: nonce },
+    k,
+    ciphertext
+  );
+  return new Uint8Array(pt);
 }
-__name(importAesKeyDecryptOnly, "importAesKeyDecryptOnly");
-function i2osp(n, len) {
-  const out = new Uint8Array(len);
-  let v = n;
-  for (let i = len - 1; i >= 0; i--) {
-    out[i] = v & 255;
-    v = Math.floor(v / 256);
+__name(aeadOpen, "aeadOpen");
+async function encryptBytes(recipient, message, aesKey, opts) {
+  const plaintext = typeof message === "string" ? new TextEncoder().encode(message) : message;
+  let enc;
+  let key;
+  if (!aesKey) {
+    const keys = await create2(recipient, opts);
+    enc = keys.enc;
+    key = keys.key;
+  } else {
+    const keys = await seal(recipient, aesKey, opts);
+    enc = keys.enc;
+    key = keys.key;
   }
-  return out;
+  const iv = globalThis.crypto.getRandomValues(new Uint8Array(NN));
+  const ct = new Uint8Array(await subtle.encrypt(
+    { name: "AES-GCM", iv },
+    key,
+    plaintext
+  ));
+  return concat2(i2osp(enc.length, WRAPPED_LEN_PREFIX), enc, iv, ct);
 }
-__name(i2osp, "i2osp");
-function concat2(...arrays) {
-  let total = 0;
-  for (const a of arrays) total += a.length;
-  const out = new Uint8Array(total);
-  let offset = 0;
-  for (const a of arrays) {
-    out.set(a, offset);
-    offset += a.length;
-  }
-  return out;
+__name(encryptBytes, "encryptBytes");
+async function encryptToString(recipient, message, aesKey, opts) {
+  const envelope = await encryptBytes(recipient, message, aesKey, opts);
+  return toString2(envelope, opts?.encoding ?? "base64url");
 }
-__name(concat2, "concat");
+__name(encryptToString, "encryptToString");
 async function hmac(key, data) {
   const k = await subtle.importKey(
     "raw",
@@ -1641,6 +1535,144 @@ async function decap(enc, keypair) {
   return extractAndExpand(dhBytes, kemContext);
 }
 __name(decap, "decap");
+function i2osp(n, len) {
+  const out = new Uint8Array(len);
+  let v = n;
+  for (let i = len - 1; i >= 0; i--) {
+    out[i] = v & 255;
+    v = Math.floor(v / 256);
+  }
+  return out;
+}
+__name(i2osp, "i2osp");
+function concat2(...arrays) {
+  let total = 0;
+  for (const a of arrays) total += a.length;
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const a of arrays) {
+    out.set(a, offset);
+    offset += a.length;
+  }
+  return out;
+}
+__name(concat2, "concat");
+
+// src/index.ts
+var subtle2 = globalThis.crypto.subtle;
+async function create2(recipient, opts) {
+  const { wrapped, key } = await encryptKey(recipient, null, opts);
+  return { enc: wrapped, key };
+}
+__name(create2, "create");
+async function seal(recipient, aesKey, opts) {
+  const { wrapped, key } = await encryptKey(recipient, aesKey, opts);
+  return { enc: wrapped, key };
+}
+__name(seal, "seal");
+var open = Object.assign(openBytes, {
+  raw: openRawBytes
+});
+var encrypt = Object.assign(encryptBytes, {
+  asString: encryptToString
+});
+var decrypt = Object.assign(decryptBytes, {
+  asString: decryptToString,
+  fromString: decryptFromString
+});
+async function decryptBytes(keypair, message, opts) {
+  if (message.byteLength < WRAPPED_LEN_PREFIX) {
+    throw new Error("malformed message: too short");
+  }
+  const wrappedLen = message[0] << 8 | message[1];
+  const ivStart = WRAPPED_LEN_PREFIX + wrappedLen;
+  const ctStart = ivStart + NN;
+  if (message.byteLength < ctStart + AEAD_TAG_LENGTH) {
+    throw new Error("malformed message: too short");
+  }
+  const wrapped = message.slice(WRAPPED_LEN_PREFIX, ivStart);
+  const iv = message.slice(ivStart, ctStart);
+  const ciphertext = message.slice(ctStart);
+  const keyBytes = await openRawBytes(
+    keypair,
+    wrapped,
+    opts?.info !== void 0 ? { info: opts.info } : void 0
+  );
+  const key = await importAesKeyDecryptOnly(keyBytes);
+  const pt = await subtle2.decrypt(
+    { name: "AES-GCM", iv },
+    key,
+    ciphertext
+  );
+  return new Uint8Array(pt);
+}
+__name(decryptBytes, "decryptBytes");
+async function decryptToString(keypair, message, opts) {
+  const bytes = await decryptBytes(keypair, message, opts);
+  return new TextDecoder().decode(bytes);
+}
+__name(decryptToString, "decryptToString");
+async function decryptFromString(keypair, message, opts) {
+  const bytes = fromString2(message, "base64url");
+  const plaintext = await decryptBytes(
+    keypair,
+    bytes,
+    opts?.info !== void 0 ? { info: opts.info } : void 0
+  );
+  return opts?.buffer ? plaintext : new TextDecoder().decode(plaintext);
+}
+__name(decryptFromString, "decryptFromString");
+function validateKeysize(keysize) {
+  if (keysize !== 128 && keysize !== 256) {
+    throw new Error(
+      `invalid keysize: ${keysize} (expected 128 or 256)`
+    );
+  }
+}
+__name(validateKeysize, "validateKeysize");
+function validateRawKeyBytes(raw) {
+  if (raw.length !== 16 && raw.length !== 32) {
+    throw new Error(
+      `invalid aesKey length: ${raw.length} bytes (expected 16 or 32)`
+    );
+  }
+}
+__name(validateRawKeyBytes, "validateRawKeyBytes");
+function normalizeInfo(info) {
+  if (info === void 0 || info === null) return new Uint8Array(0);
+  if (typeof info === "string") return new TextEncoder().encode(info);
+  return info;
+}
+__name(normalizeInfo, "normalizeInfo");
+async function exportAesKeyBytes(key) {
+  if (!key.extractable) {
+    throw new Error(
+      "aesKey must be extractable: its raw bytes are what get sealed"
+    );
+  }
+  return new Uint8Array(await subtle2.exportKey("raw", key));
+}
+__name(exportAesKeyBytes, "exportAesKeyBytes");
+async function importAesKey(raw) {
+  return subtle2.importKey(
+    "raw",
+    raw,
+    { name: "AES-GCM" },
+    true,
+    ["encrypt", "decrypt"]
+  );
+}
+__name(importAesKey, "importAesKey");
+async function importAesKeyDecryptOnly(raw) {
+  return subtle2.importKey(
+    "raw",
+    raw,
+    { name: "AES-GCM" },
+    false,
+    ["decrypt"]
+  );
+}
+__name(importAesKeyDecryptOnly, "importAesKeyDecryptOnly");
 async function keySchedule(sharedSecret, info) {
   const empty2 = new Uint8Array(0);
   const pskIdHash = await labeledExtract(
@@ -1679,56 +1711,50 @@ async function keySchedule(sharedSecret, info) {
   return { key, baseNonce };
 }
 __name(keySchedule, "keySchedule");
-async function aeadSeal(key, nonce, plaintext) {
-  const k = await subtle.importKey(
-    "raw",
-    key,
-    { name: "AES-GCM" },
-    false,
-    ["encrypt"]
-  );
-  const ct = await subtle.encrypt(
-    { name: "AES-GCM", iv: nonce },
-    k,
-    plaintext
-  );
-  return new Uint8Array(ct);
-}
-__name(aeadSeal, "aeadSeal");
-async function aeadOpen(key, nonce, ciphertext) {
-  const k = await subtle.importKey(
-    "raw",
-    key,
-    { name: "AES-GCM" },
-    false,
-    ["decrypt"]
-  );
-  const pt = await subtle.decrypt(
-    { name: "AES-GCM", iv: nonce },
-    k,
-    ciphertext
-  );
-  return new Uint8Array(pt);
+async function openRawBytes(keypair, wrapped, opts) {
+  if (wrapped.byteLength < ENC_LENGTH + AEAD_TAG_LENGTH) {
+    throw new Error("malformed envelope: too short");
+  }
+  const info = normalizeInfo(opts?.info);
+  const enc = wrapped.slice(0, ENC_LENGTH);
+  const ciphertext = wrapped.slice(ENC_LENGTH);
+  const sharedSecret = await decap(enc, keypair);
+  const { key, baseNonce } = await keySchedule(sharedSecret, info);
+  return aeadOpen(key, baseNonce, ciphertext);
 }
-__name(aeadOpen, "aeadOpen");
-async function encryptBytes(recipient, message, aesKey, opts) {
-  const plaintext = typeof message === "string" ? new TextEncoder().encode(message) : message;
-  const { wrapped, key } = await seal(recipient, aesKey, opts);
-  const iv = globalThis.crypto.getRandomValues(new Uint8Array(NN));
-  const ct = new Uint8Array(await subtle.encrypt(
-    { name: "AES-GCM", iv },
-    key,
-    plaintext
-  ));
-  return concat2(i2osp(wrapped.length, WRAPPED_LEN_PREFIX), wrapped, iv, ct);
+__name(openRawBytes, "openRawBytes");
+async function openBytes(keypair, wrapped, opts) {
+  const keyBytes = await openRawBytes(keypair, wrapped, opts);
+  return importAesKey(keyBytes);
 }
-__name(encryptBytes, "encryptBytes");
-async function encryptToString(recipient, message, aesKey, opts) {
-  const envelope = await encryptBytes(recipient, message, aesKey, opts);
-  return toString2(envelope, opts?.encoding ?? "base64url");
+__name(openBytes, "openBytes");
+async function encryptKey(recipient, aesKey, opts) {
+  const info = normalizeInfo(opts?.info);
+  let keyBytes;
+  if (aesKey instanceof Uint8Array) {
+    validateRawKeyBytes(aesKey);
+    keyBytes = aesKey;
+  } else if (aesKey) {
+    keyBytes = await exportAesKeyBytes(aesKey);
+    validateRawKeyBytes(keyBytes);
+  } else {
+    const keysize = opts?.size ?? 256;
+    validateKeysize(keysize);
+    keyBytes = globalThis.crypto.getRandomValues(
+      new Uint8Array(keysize / 8)
+    );
+  }
+  const publicKey = await resolveRecipientPublicKey(recipient);
+  const { sharedSecret, enc } = await encap(publicKey);
+  const { key, baseNonce } = await keySchedule(sharedSecret, info);
+  const ciphertext = await aeadSeal(key, baseNonce, keyBytes);
+  const wrapped = concat2(enc, ciphertext);
+  const aesGcmKey = await importAesKey(keyBytes);
+  return { wrapped, key: aesGcmKey };
 }
-__name(encryptToString, "encryptToString");
+__name(encryptKey, "encryptKey");
 export {
+  create2 as create,
   decrypt,
   encrypt,
   open,