{"_id":"@aliran/core","_rev":"3-815171ed7e23b05bc5c4829f79c67a03","name":"@aliran/core","dist-tags":{"latest":"0.1.2"},"versions":{"0.1.0":{"name":"@aliran/core","version":"0.1.0","keywords":["oprf","argon2id","crypto","p2p","holepunch","aliran"],"license":"MIT","_id":"@aliran/core@0.1.0","maintainers":[{"name":"abuelosimpson","email":"abuelo.simpson@nym.hush.com"}],"homepage":"https://abuelosimpson.github.io/aliran/","bugs":{"url":"https://github.com/AbueloSimpson/aliran/issues"},"dist":{"shasum":"96f08a450d9b47215df42a99982dcbefe83fde89","tarball":"https://registry.npmjs.org/@aliran/core/-/core-0.1.0.tgz","fileCount":11,"integrity":"sha512-DTOfHMWs3c/+uLOjXD1J57scJE7SsR5HwxRAL/jYRZepy2rkzAlH6DV5NXbZOAf/NixOvIzu1My1uZWxlEaYwg==","signatures":[{"sig":"MEYCIQD39KmtyyuqdKNUNbjwXc/nm/9Xq2QKYb8GerYQLU/XiAIhAILquAOb55kdiN/hhnGrWMDRnhMalVK6hGGHoFySlSef","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":29816},"main":"index.js","type":"module","comment":"OPRF group math uses the audited @noble/curves ristretto255 (sodium-native in this build lacks ristretto ops). Argon2id + secretbox use sodium-native. Have the crypto independently reviewed before production. net-tune.js and store-gc.js are deliberately NOT re-exported by index.js — server components import them by path (they are Node/Bare infra helpers, not crypto).","engines":{"node":">=20"},"exports":{".":"./index.js","./pow.js":"./pow.js","./oprf.js":"./oprf.js","./token.js":"./token.js","./keybox.js":"./keybox.js","./net-tune.js":"./net-tune.js","./password.js":"./password.js","./store-gc.js":"./store-gc.js","./package.json":"./package.json"},"gitHead":"140e299e79f56c6f011a14f56cdc4cd0ccfc5d04","scripts":{"test":"node test.mjs"},"_npmUser":{"name":"abuelosimpson","email":"abuelo.simpson@nym.hush.com"},"repository":{"url":"git+https://github.com/AbueloSimpson/aliran.git","type":"git","directory":"core"},"_npmVersion":"11.13.0","description":"Aliran shared crypto: OPRF login, Argon2id verifiers, key wrapping","directories":{},"_nodeVersion":"24.17.0","dependencies":{"b4a":"^1.6.6","@noble/curves":"^1.6.0","@noble/hashes":"^1.5.0","sodium-native":"^4.3.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/core_0.1.0_1784688364296_0.1103025210384001","host":"s3://npm-registry-packages-npm-production"}},"0.1.1":{"name":"@aliran/core","version":"0.1.1","keywords":["oprf","argon2id","crypto","p2p","holepunch","aliran"],"license":"MIT","_id":"@aliran/core@0.1.1","maintainers":[{"name":"abuelosimpson","email":"abuelo.simpson@nym.hush.com"}],"homepage":"https://abuelosimpson.github.io/aliran/","bugs":{"url":"https://github.com/AbueloSimpson/aliran/issues"},"dist":{"shasum":"f109e1b22acb7f5016108effbb111d0b2487a86d","tarball":"https://registry.npmjs.org/@aliran/core/-/core-0.1.1.tgz","fileCount":12,"integrity":"sha512-thuCPUDFGdYlMiKngWQAEMwzFRjNECx0YWGrvsb0Vfyc9TNmUQXBFwYd8CjMn7tMpcKyt6LS1OrNUJDLpvq5tA==","signatures":[{"sig":"MEYCIQCYv7xCcH0ZdAjeRtpewyT1x4XQK9B2AlLPpP9oP8JOPgIhAKXDViGLsjGSBwDEY07w+uYtchH4H4+LpTynob+sU1mG","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":32194},"main":"index.js","type":"module","comment":"OPRF group math uses the audited @noble/curves ristretto255 (sodium-native in this build lacks ristretto ops). Argon2id + secretbox use sodium-native. Have the crypto independently reviewed before production. net-tune.js and store-gc.js are deliberately NOT re-exported by index.js — server components import them by path (they are Node/Bare infra helpers, not crypto).","engines":{"node":">=20"},"exports":{".":"./index.js","./pow.js":"./pow.js","./oprf.js":"./oprf.js","./token.js":"./token.js","./keybox.js":"./keybox.js","./net-tune.js":"./net-tune.js","./password.js":"./password.js","./store-gc.js":"./store-gc.js","./package.json":"./package.json","./net-tune-core.js":"./net-tune-core.js"},"gitHead":"3c15b9b3929a044e97082e43e62b148c7c05e3e9","scripts":{"test":"node test.mjs"},"_npmUser":{"name":"abuelosimpson","email":"abuelo.simpson@nym.hush.com"},"repository":{"url":"git+https://github.com/AbueloSimpson/aliran.git","type":"git","directory":"core"},"_npmVersion":"11.13.0","description":"Aliran shared crypto: OPRF login, Argon2id verifiers, key wrapping","directories":{},"_nodeVersion":"24.17.0","dependencies":{"b4a":"^1.6.6","@noble/curves":"^1.6.0","@noble/hashes":"^1.5.0","sodium-native":"^4.3.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/core_0.1.1_1784695387260_0.30280913960297595","host":"s3://npm-registry-packages-npm-production"}},"0.1.2":{"name":"@aliran/core","version":"0.1.2","description":"Aliran shared crypto: OPRF login, Argon2id verifiers, key wrapping","license":"MIT","type":"module","main":"index.js","exports":{".":"./index.js","./oprf.js":"./oprf.js","./password.js":"./password.js","./keybox.js":"./keybox.js","./pow.js":"./pow.js","./token.js":"./token.js","./session.js":"./session.js","./pairing.js":"./pairing.js","./net-tune.js":"./net-tune.js","./net-tune-core.js":"./net-tune-core.js","./store-gc.js":"./store-gc.js","./atomic-write.js":"./atomic-write.js","./config-snapshot.js":"./config-snapshot.js","./config-routes.js":"./config-routes.js","./backup-index.js":"./backup-index.js","./package.json":"./package.json"},"repository":{"type":"git","url":"git+https://github.com/AbueloSimpson/aliran.git","directory":"core"},"homepage":"https://abuelosimpson.github.io/aliran/","bugs":{"url":"https://github.com/AbueloSimpson/aliran/issues"},"keywords":["oprf","argon2id","crypto","p2p","holepunch","aliran"],"engines":{"node":">=20"},"publishConfig":{"access":"public"},"scripts":{"test":"node test.mjs"},"dependencies":{"@noble/curves":"^1.6.0","@noble/hashes":"^1.5.0","b4a":"^1.6.6","sodium-native":"^4.3.0"},"comment":"OPRF group math uses the audited @noble/curves ristretto255 (sodium-native in this build lacks ristretto ops). Argon2id + secretbox use sodium-native. Have the crypto independently reviewed before production. net-tune.js, net-tune-core.js, store-gc.js, atomic-write.js, config-snapshot.js, config-routes.js and backup-index.js are deliberately NOT re-exported by index.js — server components import them by path (they are Node/Bare infra helpers, not crypto).","gitHead":"faa056315a0f4425eb7952991512c17511f3224f","_id":"@aliran/core@0.1.2","_nodeVersion":"24.17.0","_npmVersion":"11.13.0","dist":{"integrity":"sha512-x80jCJX6GOc/hR7+Nby4OqstbRP8v1qb0qNhI5hk+oyYPpCcPPY3UhGdsEX62Qlzt8dsXKGbwbb8JLOwQCBvdQ==","shasum":"d3c2120f7d608caf9ffc637f1750a6833627fff6","tarball":"https://registry.npmjs.org/@aliran/core/-/core-0.1.2.tgz","fileCount":18,"unpackedSize":90671,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIGQpRTgL2CDQo/lkySZXBC4/TqssMIHqPiolT2lLKLKsAiBPhSrhwGOk84jSRwC7nzTo9nvE+4EpzthPovhaq2Ytpg=="}]},"_npmUser":{"name":"abuelosimpson","email":"abuelo.simpson@nym.hush.com"},"directories":{},"maintainers":[{"name":"abuelosimpson","email":"abuelo.simpson@nym.hush.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/core_0.1.2_1785575115295_0.007777799298455568"},"_hasShrinkwrap":false}},"time":{"created":"2026-07-22T02:46:04.076Z","modified":"2026-08-01T09:05:15.568Z","0.1.0":"2026-07-22T02:46:04.432Z","0.1.1":"2026-07-22T04:43:07.428Z","0.1.2":"2026-08-01T09:05:15.439Z"},"bugs":{"url":"https://github.com/AbueloSimpson/aliran/issues"},"license":"MIT","homepage":"https://abuelosimpson.github.io/aliran/","keywords":["oprf","argon2id","crypto","p2p","holepunch","aliran"],"repository":{"type":"git","url":"git+https://github.com/AbueloSimpson/aliran.git","directory":"core"},"description":"Aliran shared crypto: OPRF login, Argon2id verifiers, key wrapping","maintainers":[{"name":"abuelosimpson","email":"abuelo.simpson@nym.hush.com"}],"readme":"# @aliran/core\r\n\r\nShared crypto (plus two infra helpers) for the [Aliran](https://github.com/AbueloSimpson/aliran)\r\npeer-to-peer OTT streaming platform. It runs in **Node (>= 20)** and in the\r\n**Bare** runtime (the Android app's worklet) — the crypto modules use no\r\nNode-only APIs.\r\n\r\nEvery panel, broadcaster, repeater, and player in an Aliran deployment agrees on\r\nthese primitives. The [security model](https://abuelosimpson.github.io/aliran/security-model/)\r\ndocuments how they fit together.\r\n\r\n## Modules\r\n\r\n`index.js` re-exports the five crypto modules. You import the three infra helpers\r\nby path — they are Node/Bare plumbing, not crypto. Each one reads or writes the\r\ndisk, so `index.js` keeps them out: the client bundles `index.js` into the Bare\r\nworklet, which has no `fs`.\r\n\r\n| Module | Exports | Purpose |\r\n|---|---|---|\r\n| `oprf.js` | `oprfKeyGen` `blind` `evaluate` `evaluateFull` `finalize` | OPRF over ristretto255 ([@noble/curves](https://github.com/paulmillr/noble-curves)) — the login protocol's core: the panel never sees a plaintext password, and the client never sees the OPRF key. |\r\n| `password.js` | `randomSalt` `deriveVerifier` `verify` `wrapKeyFrom` `wrap` `unwrap` `ARGON2_DEFAULT` `SALT_BYTES` | Argon2id verifiers + XSalsa20-Poly1305 secretbox wrapping of per-user key material (sodium-native). |\r\n| `keybox.js` | `userKeyPair` `sealTo` `sealOpen` `authKeyPair` `authSign` `authVerify` | X25519 sealed boxes (granting stream keys to a user) + Ed25519 signatures (proving a login/session). |\r\n| `token.js` | `signToken` `verifyToken` `tokenValid` | Panel-signed session tokens. |\r\n| `pow.js` | `powSolve` `powVerify` | Proof-of-work gate for unauthenticated RPCs. |\r\n| `net-tune.js` (by path) | `tuneSwarm` `tuneSocket` `readKernelCeilings` `evaluateBuffer` `logSwarmTuning` … | Hyperswarm UDP socket-buffer sizing + honest clamp detection ([why](https://abuelosimpson.github.io/aliran/kb/network-tuning/)). |\r\n| `store-gc.js` (by path) | `purgeStaleCores` `DISCOVERY_HEX_RE` | Reclaims stray Corestore core directories not on a keep-list. |\r\n| `atomic-write.js` (by path) | `writeFileAtomic` `writeJsonAtomic` `atomicTmpPath` `isAtomicTmp` | Replaces a file safely. It writes a temp file beside the target, flushes it to disk, then renames it over the target. A crash during the write cannot truncate the file. Secrets get their `0600` mode before the rename, so no other user can read them. |\r\n\r\n```js\r\nimport { blind, finalize, deriveVerifier, sealOpen, tokenValid } from '@aliran/core'\r\nimport { tuneSwarm } from '@aliran/core/net-tune.js'\r\n```\r\n\r\n## Caveat\r\n\r\nThe OPRF group math uses the audited `@noble/curves` ristretto255 implementation.\r\nArgon2id and secretbox use `sodium-native`. Aliran wrote the **composition**\r\nitself — have it independently reviewed before you bet production credentials on it.\r\n\r\n## Test\r\n\r\n```sh\r\nnpm test   # node test.mjs — fast, no network\r\n```\r\n\r\nMIT — part of the [Aliran monorepo](https://github.com/AbueloSimpson/aliran).\r\n","readmeFilename":"README.md"}