//#region src/crypto/types.ts
var e = class extends Error {
	constructor(e, t, n) {
		super(e), this.code = t, this.cause = n, this.name = "CryptoError";
	}
};
//#endregion
//#region src/crypto/encoding.ts
function t(t) {
	if (typeof btoa == "function") {
		let e = String.fromCharCode(...t);
		return btoa(e);
	}
	if (typeof Buffer < "u") return Buffer.from(t).toString("base64");
	throw new e("No base64 encoding available", "ENCODING_ERROR");
}
function n(t) {
	try {
		if (typeof atob == "function") {
			let e = atob(t), n = new Uint8Array(e.length);
			for (let t = 0; t < e.length; t++) n[t] = e.charCodeAt(t);
			return n;
		}
		if (typeof Buffer < "u") return new Uint8Array(Buffer.from(t, "base64"));
		throw new e("No base64 decoding available", "ENCODING_ERROR");
	} catch (t) {
		throw t instanceof e ? t : new e("Invalid base64 string", "ENCODING_ERROR", t);
	}
}
function r(e) {
	return Array.from(e).map((e) => e.toString(16).padStart(2, "0")).join("");
}
function i(t) {
	let n = t.replace(/\s/g, "").toLowerCase();
	if (n.length % 2 != 0) throw new e("Invalid hex string: odd length", "ENCODING_ERROR");
	if (!/^[0-9a-f]*$/.test(n)) throw new e("Invalid hex string: non-hex characters", "ENCODING_ERROR");
	let r = new Uint8Array(n.length / 2);
	for (let e = 0; e < n.length; e += 2) r[e / 2] = parseInt(n.slice(e, e + 2), 16);
	return r;
}
function a(e) {
	return new TextEncoder().encode(e);
}
function o(e) {
	return new TextDecoder().decode(e);
}
function s(e, t) {
	let n = new Uint8Array(1 + e.length + t.length);
	return n[0] = 1, n.set(e, 1), n.set(t, 1 + e.length), n;
}
function c(t) {
	if (t.length < 14) throw new e("Invalid encrypted data: too short", "INVALID_CIPHERTEXT");
	let n = t[0];
	if (n !== 1) throw new e(`Unsupported encryption format version: ${String(n)}`, "INVALID_CIPHERTEXT");
	return {
		iv: t.slice(1, 13),
		ciphertext: t.slice(13)
	};
}
function l(e, t) {
	if (e.length !== t.length) return !1;
	let n = 0;
	for (let r = 0; r < e.length; r++) n |= (e[r] ?? 0) ^ (t[r] ?? 0);
	return n === 0;
}
function u(e) {
	e.fill(0);
}
function d(...e) {
	let t = e.reduce((e, t) => e + t.length, 0), n = new Uint8Array(t), r = 0;
	for (let t of e) n.set(t, r), r += t.length;
	return n;
}
//#endregion
//#region src/crypto/encoding-helpers.ts
function f(e, n) {
	switch (n) {
		case "base64": return t(e);
		case "hex": return r(e);
		case "raw": return o(e);
		default: return t(e);
	}
}
function p(e, t) {
	switch (t) {
		case "base64": return n(e);
		case "hex": return i(e);
		case "raw": return a(e);
		default: return n(e);
	}
}
//#endregion
//#region src/crypto/keys.ts
var m = 256, h = m / 8, g = 12, _ = 1e5, v = 16;
async function y() {
	try {
		let e = await crypto.subtle.generateKey({
			name: "AES-GCM",
			length: m
		}, !0, ["encrypt", "decrypt"]), t = await crypto.subtle.exportKey("raw", e);
		return r(new Uint8Array(t));
	} catch (t) {
		throw new e("Failed to generate symmetric key", "KEY_GENERATION_FAILED", t);
	}
}
async function b(t) {
	try {
		let n = i(t);
		if (n.length !== h) throw new e(`Invalid key length: expected ${String(h)} bytes, got ${String(n.length)}`, "INVALID_KEY_LENGTH");
		return await crypto.subtle.importKey("raw", n, {
			name: "AES-GCM",
			length: m
		}, !1, ["encrypt", "decrypt"]);
	} catch (t) {
		throw t instanceof e ? t : new e("Failed to import symmetric key", "KEY_IMPORT_FAILED", t);
	}
}
function x() {
	return crypto.getRandomValues(new Uint8Array(g));
}
function S(e) {
	return crypto.getRandomValues(new Uint8Array(e));
}
async function C(t = 4096) {
	try {
		let e = await crypto.subtle.generateKey({
			name: "RSA-OAEP",
			modulusLength: t,
			publicExponent: new Uint8Array([
				1,
				0,
				1
			]),
			hash: "SHA-256"
		}, !0, ["encrypt", "decrypt"]);
		return {
			publicKey: e.publicKey,
			privateKey: e.privateKey
		};
	} catch (t) {
		throw new e("Failed to generate RSA key pair", "KEY_GENERATION_FAILED", t);
	}
}
async function w(n) {
	try {
		let e = await crypto.subtle.exportKey("spki", n);
		return E(t(new Uint8Array(e)), "PUBLIC KEY");
	} catch (t) {
		throw new e("Failed to export public key", "KEY_EXPORT_FAILED", t);
	}
}
async function T(n) {
	try {
		let e = await crypto.subtle.exportKey("pkcs8", n);
		return E(t(new Uint8Array(e)), "PRIVATE KEY");
	} catch (t) {
		throw new e("Failed to export private key", "KEY_EXPORT_FAILED", t);
	}
}
function E(e, t) {
	let n = [];
	for (let t = 0; t < e.length; t += 64) n.push(e.slice(t, t + 64));
	return `-----BEGIN ${t}-----\n${n.join("\n")}\n-----END ${t}-----`;
}
async function D(t) {
	try {
		let e = n(k(t, "PUBLIC KEY"));
		return await crypto.subtle.importKey("spki", e, {
			name: "RSA-OAEP",
			hash: "SHA-256"
		}, !0, ["encrypt"]);
	} catch (t) {
		throw t instanceof e ? t : new e("Failed to import public key", "KEY_IMPORT_FAILED", t);
	}
}
async function O(t) {
	try {
		let e = n(k(t, "PRIVATE KEY"));
		return await crypto.subtle.importKey("pkcs8", e, {
			name: "RSA-OAEP",
			hash: "SHA-256"
		}, !0, ["decrypt"]);
	} catch (t) {
		throw t instanceof e ? t : new e("Failed to import private key", "KEY_IMPORT_FAILED", t);
	}
}
function k(t, n) {
	let r = `-----BEGIN ${n}-----`, i = `-----END ${n}-----`, a = t.indexOf(r), o = t.indexOf(i);
	if (a === -1 || o === -1) throw new e(`Invalid PEM format: missing ${n} markers`, "INVALID_KEY");
	return t.slice(a + r.length, o).replace(/\s/g, "");
}
async function A(t, n, r = {}) {
	let { iterations: i = _, saltLength: a = v, hash: o = "SHA-256" } = r;
	try {
		let e = n ?? S(a), r = await crypto.subtle.importKey("raw", new TextEncoder().encode(t), "PBKDF2", !1, ["deriveBits", "deriveKey"]);
		return {
			key: await crypto.subtle.deriveKey({
				name: "PBKDF2",
				salt: e,
				iterations: i,
				hash: o
			}, r, {
				name: "AES-GCM",
				length: m
			}, !0, ["encrypt", "decrypt"]),
			salt: e
		};
	} catch (t) {
		throw new e("Failed to derive key from password", "KEY_DERIVATION_FAILED", t);
	}
}
async function j(t) {
	try {
		let e = await crypto.subtle.exportKey("raw", t);
		return r(new Uint8Array(e));
	} catch (t) {
		throw new e("Failed to export derived key", "KEY_EXPORT_FAILED", t);
	}
}
//#endregion
//#region src/crypto/symmetric.ts
var M = 128, N = class t {
	key;
	encoding;
	constructor(e, t) {
		this.key = e, this.encoding = t;
	}
	static async create(e, n = {}) {
		return new t(await b(e), n.encoding ?? "base64");
	}
	static fromKey(e, n = {}) {
		return new t(e, n.encoding ?? "base64");
	}
	async encrypt(t) {
		try {
			let e = typeof t == "string" ? a(t) : t, n = x(), r = await crypto.subtle.encrypt({
				name: "AES-GCM",
				iv: n,
				tagLength: M
			}, this.key, e);
			return f(s(n, new Uint8Array(r)), this.encoding);
		} catch (t) {
			throw t instanceof e ? t : new e("Encryption failed", "ENCRYPTION_FAILED", t);
		}
	}
	async decrypt(t) {
		try {
			let { iv: e, ciphertext: n } = c(p(t, this.encoding)), r = await crypto.subtle.decrypt({
				name: "AES-GCM",
				iv: e,
				tagLength: M
			}, this.key, n);
			return o(new Uint8Array(r));
		} catch (t) {
			throw t instanceof e ? t : new e("Decryption failed", "DECRYPTION_FAILED", t);
		}
	}
	async encryptBytes(t) {
		try {
			let e = x(), n = await crypto.subtle.encrypt({
				name: "AES-GCM",
				iv: e,
				tagLength: M
			}, this.key, t);
			return s(e, new Uint8Array(n));
		} catch (t) {
			throw t instanceof e ? t : new e("Encryption failed", "ENCRYPTION_FAILED", t);
		}
	}
	async decryptBytes(t) {
		try {
			let { iv: e, ciphertext: n } = c(t), r = await crypto.subtle.decrypt({
				name: "AES-GCM",
				iv: e,
				tagLength: M
			}, this.key, n);
			return new Uint8Array(r);
		} catch (t) {
			throw t instanceof e ? t : new e("Decryption failed", "DECRYPTION_FAILED", t);
		}
	}
	getEncoding() {
		return this.encoding;
	}
};
async function P(e, t = {}) {
	return N.create(e, t);
}
function F(e, t = {}) {
	return N.fromKey(e, t);
}
async function I(e, t) {
	return (await P(e)).encrypt(t);
}
async function L(e, t) {
	return (await P(e)).decrypt(t);
}
//#endregion
//#region src/crypto/hybrid.ts
var R = 256, z = 128, B = 2, V = class {
	encoding;
	rsaKeySize;
	constructor(e = {}) {
		this.encoding = e.encoding ?? "base64", this.rsaKeySize = e.rsaKeySize ?? 4096;
	}
	async encrypt(t, n) {
		try {
			let e = typeof n == "string" ? a(n) : n, r = await crypto.subtle.generateKey({
				name: "AES-GCM",
				length: R
			}, !0, ["encrypt", "decrypt"]), i = await crypto.subtle.exportKey("raw", r), o = await crypto.subtle.encrypt({ name: "RSA-OAEP" }, t, i), s = x(), c = await crypto.subtle.encrypt({
				name: "AES-GCM",
				iv: s,
				tagLength: z
			}, r, e), l = new Uint8Array(o), u = new Uint8Array(c), d = l.length, p = new Uint8Array(3 + d + 12 + u.length);
			return p[0] = B, p[1] = d >> 8 & 255, p[2] = d & 255, p.set(l, 3), p.set(s, 3 + d), p.set(u, 3 + d + 12), f(p, this.encoding);
		} catch (t) {
			throw t instanceof e ? t : new e("Hybrid encryption failed", "ENCRYPTION_FAILED", t);
		}
	}
	async decrypt(t, n) {
		try {
			let r = p(n, this.encoding);
			if (r.length < 16) throw new e("Invalid hybrid ciphertext: too short", "INVALID_CIPHERTEXT");
			let i = r[0];
			if (i !== B) throw new e(`Unsupported hybrid encryption version: ${String(i)}`, "INVALID_CIPHERTEXT");
			let a = (r[1] ?? 0) << 8 | (r[2] ?? 0);
			if (r.length < 3 + a + 12 + 1) throw new e("Invalid hybrid ciphertext: truncated", "INVALID_CIPHERTEXT");
			let o = r.slice(3, 3 + a), s = r.slice(3 + a, 3 + a + 12), c = r.slice(3 + a + 12), l = await crypto.subtle.decrypt({ name: "RSA-OAEP" }, t, o), u = await crypto.subtle.importKey("raw", l, {
				name: "AES-GCM",
				length: R
			}, !1, ["decrypt"]), d = await crypto.subtle.decrypt({
				name: "AES-GCM",
				iv: s,
				tagLength: z
			}, u, c);
			return new Uint8Array(d);
		} catch (t) {
			throw t instanceof e ? t : new e("Hybrid decryption failed", "DECRYPTION_FAILED", t);
		}
	}
	async decryptToString(e, t) {
		let n = await this.decrypt(e, t);
		return new TextDecoder().decode(n);
	}
	getEncoding() {
		return this.encoding;
	}
	getRsaKeySize() {
		return this.rsaKeySize;
	}
};
function H(e = {}) {
	return new V(e);
}
async function U(e, t, n = {}) {
	return H(n).encrypt(e, t);
}
async function W(e, t, n = {}) {
	return H(n).decrypt(e, t);
}
async function G(e, t, n = {}) {
	return H(n).decryptToString(e, t);
}
//#endregion
//#region src/crypto/index.ts
var K = class {
	config;
	constructor(e = {}) {
		this.config = {
			encoding: e.encoding ?? "base64",
			rsaKeySize: e.rsaKeySize ?? 4096,
			pbkdf2Iterations: e.pbkdf2Iterations ?? 1e5
		};
	}
	async generateSymmetricKey() {
		return y();
	}
	async encryptSecret(e, t) {
		return (await P(e, { encoding: this.config.encoding })).encrypt(t);
	}
	async decryptSecret(e, t) {
		return (await P(e, { encoding: this.config.encoding })).decrypt(t);
	}
	async generateKeyPair() {
		return C(this.config.rsaKeySize);
	}
	async encrypt(e, t) {
		return H({
			encoding: this.config.encoding,
			rsaKeySize: this.config.rsaKeySize
		}).encrypt(e, t);
	}
	async decrypt(e, t) {
		return H({
			encoding: this.config.encoding,
			rsaKeySize: this.config.rsaKeySize
		}).decrypt(e, t);
	}
	async decryptToString(e, t) {
		return H({
			encoding: this.config.encoding,
			rsaKeySize: this.config.rsaKeySize
		}).decryptToString(e, t);
	}
	async exportPublicKey(e) {
		return w(e);
	}
	async exportPrivateKey(e) {
		return T(e);
	}
	async importPublicKey(e) {
		return D(e);
	}
	async importPrivateKey(e) {
		return O(e);
	}
	async deriveKeyFromPassword(e, t) {
		return A(e, t, { iterations: this.config.pbkdf2Iterations });
	}
	getConfig() {
		return { ...this.config };
	}
};
function q(e = {}) {
	return new K(e);
}
var J = null;
function Y(e) {
	return J ??= q(e), J;
}
function X(e) {
	return q(e);
}
//#endregion
export { e as CryptoError, K as CryptoManagerImpl, V as HybridCipherImpl, N as SymmetricCipherImpl, o as bytesToString, d as concat, l as constantTimeEqual, q as createCryptoManager, H as createHybridCipher, P as createSymmetricCipher, F as createSymmetricCipherFromKey, X as cryptum, c as decodeEncryptedData, p as decodeInput, L as decryptSecret, A as deriveKeyFromPassword, s as encodeEncryptedData, f as encodeOutput, I as encryptSecret, j as exportDerivedKey, T as exportPrivateKey, w as exportPublicKey, n as fromBase64, i as fromHex, x as generateIV, C as generateKeyPair, y as generateSymmetricKey, Y as getDefaultCryptoManager, W as hybridDecrypt, G as hybridDecryptToString, U as hybridEncrypt, O as importPrivateKey, D as importPublicKey, b as importSymmetricKey, S as randomBytes, a as stringToBytes, t as toBase64, r as toHex, u as zeroize };

//# sourceMappingURL=index.js.map