@x402-hpke/node/dist/index.js

Provider-agnostic HPKE envelope library for x402 (Node) — cross-language interop with Python

import { seal, open } from "./envelope.js";
import { generateKeyPair, selectJwkFromJwks, fetchJwks, setJwks, generatePublicJwk } from "./keys.js";
import { canonicalAad } from "./aad.js";
import { NsForbiddenError, JwksUrlRequiredError } from "./errors.js";
export { canonicalAad, buildCanonicalAad, validateX402Core } from "./aad.js";
export { generateKeyPair, selectJwkFromJwks, generatePublicJwk, generateJwks, generateSingleJwks } from "./keys.js";
export * from "./payment.js";
export * from "./extensions.js";
export * from "./helpers.js";
export { sealChunkXChaCha, openChunkXChaCha } from "./streaming.js";
export * as X402Errors from "./errors.js";
export { CanonicalHeaders } from "./constants.js";
export { x402SecureTransport } from "./x402SecureTransport.js";
export const X402_HPKE_VERSION = "v1";
export const X402_HPKE_SUITE = "X25519-HKDF-SHA256-CHACHA20POLY1305";
export function createHpke(opts) {
    const ns = opts.namespace;
    if (!ns || ns.toLowerCase() === "x402") {
        throw new NsForbiddenError("NS_FORBIDDEN");
    }
    const kem = opts.kem ?? "X25519";
    const kdf = opts.kdf ?? "HKDF-SHA256";
    const aead = opts.aead ?? "CHACHA20-POLY1305";
    const defaultMakePublic = opts.publicEntities;
    return {
        namespace: ns,
        kem,
        kdf,
        aead,
        version: X402_HPKE_VERSION,
        suite: X402_HPKE_SUITE,
        seal: (args) => {
            const makeEntitiesPublic = args.makeEntitiesPublic ?? defaultMakePublic;
            return seal({ ...args, makeEntitiesPublic, namespace: ns, kem, kdf, aead });
        },
        open: (args) => open({ ...args, namespace: ns, kem, kdf, aead }),
        canonicalAad: (x402, app) => canonicalAad(ns, x402, app),
        generateKeyPair,
        generatePublicJwk,
        selectJwkFromJwks,
        // Simplified JWKS fetch: prefer explicit url, fall back to createHpke(opts).jwksUrl
        async fetchJwks(url, ttl) {
            const effectiveUrl = url ?? opts.jwksUrl;
            if (!effectiveUrl)
                throw new JwksUrlRequiredError("JWKS_URL_REQUIRED");
            return fetchJwks(effectiveUrl, ttl);
        },
        setJwks,
    };
}