115 lines
12 KiB
Plaintext
115 lines
12 KiB
Plaintext
page wrnexusencryption {
|
|
seo {
|
|
title = "@wrnexus/encryption"
|
|
description = "Hashing, HMAC, authenticated encryption, and key derivation."
|
|
}
|
|
|
|
view {
|
|
<div class="docs-shell">
|
|
<a class="skip-link" href="#main">Skip to content</a>
|
|
<header class="topbar">
|
|
<a class="brand" href="/"><span>W</span> WRNexusJS</a>
|
|
<nav aria-label="Primary"><a href="/getting-started">Get started</a><a href="/packages">Packages</a><a href="/language">Language</a><a href="/architecture">Architecture</a></nav>
|
|
<div class="topbar-actions"><a class="preview-pill" href="/access">Private preview · v0.2.19</a><button data-wire-theme-toggle class="theme-button" aria-label="Toggle color theme" title="Toggle color theme">◐</button></div>
|
|
</header>
|
|
<div class="mobile-doc-nav"><details><summary>Browse documentation</summary><nav><a href="/getting-started">Get started</a><a href="/packages">Packages</a><a href="/language">Language</a><a href="/architecture">Architecture</a><a href="/tutorial">Tutorial</a><a href="/guides/project-structure">Guides</a><a href="/examples">Examples</a><a href="/search">Search</a></nav></details></div>
|
|
<main class="page package-page">
|
|
<aside class="sidebar"><a href="/packages">← All packages</a><span class="category">Security</span><h2>@wrnexus/encryption</h2><p>Hashing, HMAC, authenticated encryption, and key derivation.</p><span class="status status-beta">Private preview · 0.2.19</span><nav><a href="#access">Access</a><a href="#guide">Guide</a><a href="#api">Complete API</a></nav></aside>
|
|
<article id="main" class="documentation"><section class="doc-intro"><span class="eyebrow">Security · Preview</span><h1>@wrnexus/encryption</h1><p>Hashing, HMAC, authenticated encryption, and key derivation.</p><section id="access" class="access-callout"><h2>Private registry access required</h2><p>This package is not available from the public npm registry. After WorkRoot approves access and supplies private registry instructions, install the release-aligned package:</p><pre><code>bun add @wrnexus/encryption@0.2.19</code><button type="button" class="copy-button" aria-label="Copy installation command">Copy</button></pre><p><a href="/access">Request preview access</a>. Never put registry tokens in source control.</p></section></section><section id="guide" class="prose"><blockquote>Dependency-free crypto helpers for WRNexusJS: authenticated symmetric encryption (AES-256-GCM), hashing, and HMAC signing.</blockquote>
|
|
<p>Part of the <strong>WRNexusJS</strong> framework — an SSR-first, Bun-native full-stack web framework.</p>
|
|
<h3 id="overview">Overview</h3>
|
|
<p>This package provides small, focused cryptographic primitives for server-side use: encrypting secrets/tokens/database fields at rest with AES-256-GCM, deriving keys from passwords via PBKDF2, computing SHA-256 digests, and signing/verifying payloads with HMAC-SHA256. It is built entirely on the standard <strong>Web Crypto API</strong> (<code>crypto.subtle</code>) plus <code>btoa</code>/<code>atob</code> and <code>TextEncoder</code>/<code>TextDecoder</code> — no third-party dependencies. Reach for it whenever you need to protect sensitive values or verify webhook signatures. All functions are <code>async</code> (Web Crypto is promise-based).</p>
|
|
<pre data-language="bash"><code>bun add @wrnexus/encryption</code></pre>
|
|
<blockquote>Private package — the machine must be authenticated to the <code>wrnexus</code> npm org</blockquote>
|
|
<blockquote>(a read token in <code>~/.npmrc</code>). Requires <strong>Bun</strong> (Node is not supported).</blockquote>
|
|
<h3 id="api">API</h3>
|
|
<p>All keys are exchanged as <strong>base64 strings</strong> and all digests/signatures as <strong>hex strings</strong>.</p>
|
|
<div class="table-wrap"><table>
|
|
<thead><tr><th>Export</th><th>Signature</th><th>Description</th></tr></thead>
|
|
<tbody><tr><td><code>generateKey</code></td><td><code>() => Promise<string></code></td><td>Generate a random 256-bit AES key, base64-encoded. Store it as a secret.</td></tr><tr><td><code>deriveKey</code></td><td><code>(password: string, salt: string) => Promise<string></code></td><td>Derive a base64 AES-256 key from a password + salt using PBKDF2 (100,000 iterations, SHA-256).</td></tr><tr><td><code>encrypt</code></td><td><code>(plaintext: string, key: string) => Promise<string></code></td><td>AES-256-GCM encrypt a string. Returns base64 of <code>iv(12 bytes) ‖ ciphertext+tag</code>. A fresh random IV is used each call.</td></tr><tr><td><code>decrypt</code></td><td><code>(payload: string, key: string) => Promise<string></code></td><td>Decrypt a value produced by <code>encrypt</code>. Throws if the key is wrong or the data was tampered with.</td></tr><tr><td><code>sha256</code></td><td><code>(data: string) => Promise<string></code></td><td>SHA-256 hex digest of a string (e.g. content hashing, dedup keys).</td></tr><tr><td><code>hmacSign</code></td><td><code>(data: string, secret: string) => Promise<string></code></td><td>HMAC-SHA256 hex signature of <code>data</code> with <code>secret</code> (e.g. signing webhooks).</td></tr><tr><td><code>hmacVerify</code></td><td><code>(data: string, secret: string, signature: string) => Promise<boolean></code></td><td>Constant-time verify of an HMAC-SHA256 hex signature.</td></tr></tbody></table></div>
|
|
<p>Notes:</p>
|
|
<ul>
|
|
<li><code>generateKey</code> produces a 32-byte (256-bit) key via <code>crypto.getRandomValues</code>.</li>
|
|
<li><code>encrypt</code>/<code>decrypt</code> require a base64-encoded 256-bit key; anything else throws <code>"Encryption key must be a base64 256-bit key"</code>.</li>
|
|
<li><code>decrypt</code> throws <code>"Invalid ciphertext"</code> if the payload is shorter than the 12-byte IV, and the underlying Web Crypto call throws on any authentication (tag) mismatch.</li>
|
|
<li><code>hmacVerify</code> compares in constant time (length check plus XOR accumulation) to avoid timing leaks.</li>
|
|
</ul>
|
|
<h3 id="usage">Usage</h3>
|
|
<p>Symmetric encryption of a secret at rest:</p>
|
|
<pre data-language="ts"><code>import { generateKey, encrypt, decrypt } from "@wrnexus/encryption";
|
|
|
|
const key = await generateKey(); // store this safely (env/secret manager)
|
|
|
|
const box = await encrypt("card #1234", key); // opaque base64 string, safe to persist
|
|
const plain = await decrypt(box, key); // "card #1234"</code></pre>
|
|
<p>Deriving a key from a user password instead of a random key:</p>
|
|
<pre data-language="ts"><code>import { deriveKey, encrypt } from "@wrnexus/encryption";
|
|
|
|
const key = await deriveKey("correct horse battery staple", "per-user-salt");
|
|
const box = await encrypt("secret note", key);</code></pre>
|
|
<p>Hashing and webhook signature verification:</p>
|
|
<pre data-language="ts"><code>import { sha256, hmacSign, hmacVerify } from "@wrnexus/encryption";
|
|
|
|
const digest = await sha256("some content"); // 64-char hex string
|
|
|
|
const signature = await hmacSign(rawBody, webhookSecret);
|
|
const ok = await hmacVerify(rawBody, webhookSecret, incomingSignatureHeader);
|
|
if (!ok) throw new Error("Invalid webhook signature");</code></pre>
|
|
<h3 id="requirements-notes">Requirements / Notes</h3>
|
|
<ul>
|
|
<li><strong>Bun-only.</strong> Relies on the Web Crypto API (<code>crypto.subtle</code>, <code>crypto.getRandomValues</code>) and the global <code>btoa</code>/<code>atob</code>, <code>TextEncoder</code>/<code>TextDecoder</code> — all available in Bun's runtime.</li>
|
|
<li><strong>No dependencies.</strong> The package has an empty dependency set; nothing is bundled beyond standard runtime APIs.</li>
|
|
<li>Algorithms: AES-256-GCM (encryption), PBKDF2 with 100k SHA-256 iterations (key derivation), SHA-256 (digest), HMAC-SHA256 (signing).</li>
|
|
<li>Keep generated/derived keys and HMAC secrets out of source control; treat them as first-class secrets.</li>
|
|
</ul></section><section id="api" class="prose api"><h2>Complete TypeScript API</h2><p>This declaration comes from the exact installed package and lists its exported functions, classes, interfaces, and types.</p><pre data-language="typescript"><code>/**
|
|
* @wrnexus/encryption — authenticated symmetric encryption (AES-256-GCM) via
|
|
* WebCrypto, dependency-free. Use it to encrypt secrets, tokens, or database
|
|
* fields at rest.
|
|
*
|
|
* const key = await generateKey(); // store this safely
|
|
* const box = await encrypt("card #1234", key); // opaque base64 string
|
|
* const plain = await decrypt(box, key); // "card #1234"
|
|
*
|
|
* A key derived from a password (PBKDF2) is also supported via `deriveKey`.
|
|
*/
|
|
/** SHA-256 hex digest of a string (e.g. content hashing, dedup keys). */
|
|
declare function sha256(data: string): Promise<string>;
|
|
/** HMAC-SHA256 hex signature of `data` with `secret` (e.g. signing webhooks). */
|
|
declare function hmacSign(data: string, secret: string): Promise<string>;
|
|
/** Constant-time verify of an HMAC-SHA256 signature. */
|
|
declare function hmacVerify(data: string, secret: string, signature: string): Promise<boolean>;
|
|
/** Generate a random 256-bit key, base64-encoded. Store it as a secret. */
|
|
declare function generateKey(): Promise<string>;
|
|
/**
|
|
* Encrypt a string. Output is base64 of `iv(12) || ciphertext+tag`, safe to
|
|
* store or transmit. Each call uses a fresh random IV.
|
|
*/
|
|
declare function encrypt(plaintext: string, key: string): Promise<string>;
|
|
/** Decrypt a value produced by `encrypt`. Throws if the key is wrong or data tampered. */
|
|
declare function decrypt(payload: string, key: string): Promise<string>;
|
|
/** Derive a base64 AES key from a password + salt (PBKDF2, 100k iterations). */
|
|
declare function deriveKey(password: string, salt: string): Promise<string>;
|
|
|
|
export { decrypt, deriveKey, encrypt, generateKey, hmacSign, hmacVerify, sha256 };
|
|
</code></pre></section><section id="examples" class="prose examples"><h2>Examples</h2><p>Examples are taken from this package's installed documentation and must be evaluated with its requirements and stability notes.</p><div class="example-grid"><article class="example-card"><h3>Example 1</h3><pre data-language="bash"><code>bun add @wrnexus/encryption</code></pre></article><article class="example-card"><h3>Example 2</h3><pre data-language="ts"><code>import { generateKey, encrypt, decrypt } from "@wrnexus/encryption";
|
|
|
|
const key = await generateKey(); // store this safely (env/secret manager)
|
|
|
|
const box = await encrypt("card #1234", key); // opaque base64 string, safe to persist
|
|
const plain = await decrypt(box, key); // "card #1234"</code></pre></article><article class="example-card"><h3>Example 3</h3><pre data-language="ts"><code>import { deriveKey, encrypt } from "@wrnexus/encryption";
|
|
|
|
const key = await deriveKey("correct horse battery staple", "per-user-salt");
|
|
const box = await encrypt("secret note", key);</code></pre></article><article class="example-card"><h3>Example 4</h3><pre data-language="ts"><code>import { sha256, hmacSign, hmacVerify } from "@wrnexus/encryption";
|
|
|
|
const digest = await sha256("some content"); // 64-char hex string
|
|
|
|
const signature = await hmacSign(rawBody, webhookSecret);
|
|
const ok = await hmacVerify(rawBody, webhookSecret, incomingSignatureHeader);
|
|
if (!ok) throw new Error("Invalid webhook signature");</code></pre></article></div></section></article>
|
|
<aside class="on-this-page"><h2>On this page</h2><nav><a class="toc-level-2" href="#guide">Guide</a><a class="toc-level-3" href="#overview">Overview</a><a class="toc-level-3" href="#api">API</a><a class="toc-level-3" href="#usage">Usage</a><a class="toc-level-3" href="#requirements-notes">Requirements / Notes</a><a class="toc-level-2" href="#api">Complete API</a><a class="toc-level-2" href="#examples">Examples</a></nav></aside>
|
|
</main>
|
|
<footer>WRNexusJS 0.2.19 · Private Developer Preview · Bun-native · Documentation generated from installed package APIs.</footer>
|
|
</div>
|
|
}
|
|
}
|