Sterister
80c410f518
Ships the Prism FR (encrypted-profile-storage-v4.9.md) as a generic relay-side encrypted blob primitive: deterministically-located, AEAD-sealed blobs keyed by a 32-byte slotId derived client-side via HKDF from the user's master key. Unlocks credential-only bootstrap of new devices into existing E2EE state — no QR, no physical access. Server: BlobStore interface + Memory/Sqlite/Postgres impls, createBlobRoutes for GET/PUT/DELETE /v1/blob/:slotId with TOFU pubkey auth and If-Match CAS (409/412 semantics). Mounted on the same Hono app as the inbox; SHADE_BLOB_PG_URL / SHADE_BLOB_DB_PATH / SHADE_DISABLE_BLOB env-var plumbing in standalone. SDK: createProfileNamespace high-level wrapper (HKDF derivation, random-nonce AEAD seal, slotId-bound AAD) + low-level BlobClient. Cross-platform test vectors in test-vectors/blob-storage.json. New errors: ConflictError (409), PreconditionFailedError (412). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
68 lines
1.4 KiB
TypeScript
68 lines
1.4 KiB
TypeScript
/**
|
|
* Browser-safe entry point — exports KeyManager + crypto primitives only.
|
|
*
|
|
* Use this subpath when bundling for the browser to avoid pulling
|
|
* `bun:sqlite` (Bun-only) or `postgres` (Node-only) into the output.
|
|
*
|
|
* ```ts
|
|
* import { KeyManager } from '@shade/storage-encrypted/crypto';
|
|
* ```
|
|
*
|
|
* For backend storage, import `@shade/storage-encrypted/sqlite` (Bun) or
|
|
* `@shade/storage-encrypted/postgres` (Node). For browser storage, import
|
|
* `@shade/storage-encrypted/idb`.
|
|
*/
|
|
|
|
export {
|
|
KeyManager,
|
|
type KeySource,
|
|
type KeychainBackend,
|
|
type KeyManagerOptions,
|
|
} from './crypto/key-manager.js';
|
|
export {
|
|
DEFAULT_SCRYPT,
|
|
DEFAULT_ARGON2ID,
|
|
type ScryptParams,
|
|
type Argon2idParams,
|
|
deriveMasterKey,
|
|
deriveMasterKeyArgon2id,
|
|
deriveStorageKey,
|
|
deriveFieldKey,
|
|
deriveNonce,
|
|
buildAad,
|
|
hkdfDerive,
|
|
deriveBlobSlotId,
|
|
deriveBlobKey,
|
|
deriveBlobSigningSeed,
|
|
} from './crypto/kdf.js';
|
|
export {
|
|
AEAD_NONCE_LEN,
|
|
AEAD_TAG_LEN,
|
|
aeadSeal,
|
|
aeadOpen,
|
|
} from './crypto/aead.js';
|
|
export {
|
|
COL,
|
|
TBL,
|
|
sealString,
|
|
openString,
|
|
sealBytes,
|
|
openBytes,
|
|
sealIdentity,
|
|
openIdentity,
|
|
sealConfig,
|
|
openConfig,
|
|
sealSignedPreKey,
|
|
openSignedPreKey,
|
|
sealOneTimePreKey,
|
|
openOneTimePreKey,
|
|
sealSession,
|
|
openSession,
|
|
sealTrust,
|
|
openTrust,
|
|
sealRetired,
|
|
openRetired,
|
|
sealStreamSensitive,
|
|
openStreamSensitive,
|
|
} from './crypto/row-codec.js';
|