Crypto SDK

@sebastienrousseau/crypto-sdk

A zero-dependency, typed HTTP client for the Crypto Service REST API, with full post-quantum support.

Getting started

Install — installation via pnpm, npm, or yarn
Requirements — runtime floor and environment prerequisites
Quick Start — minimal working usage sample

The Crypto Service ecosystem

The Crypto Service ecosystem — full 14-package suite overview

Package reference

Reference & Usage — features, configuration, and capabilities
Examples — runnable sample code

Operational

Development — build, lint, format, and test targets
Security — vulnerability disclosure and cryptographic invariants
Documentation — TypeDoc API docs and ecosystem guides
Stability guarantees — SemVer axis and release policy
License

Install

pnpm add @sebastienrousseau/crypto-sdk
# or
npm install @sebastienrousseau/crypto-sdk
# or
yarn add @sebastienrousseau/crypto-sdk

Requirements

Node.js: ^22.0.0 or >=24.0.0 (active and maintenance LTS releases)
Package Manager: pnpm >=9 (recommended) or npm >=10
TypeScript: >=5.0 (when compiling with TypeScript)

Quick Start

import { CryptoClient } from "@sebastienrousseau/crypto-sdk";

const client = new CryptoClient({
  baseUrl: "http://localhost:3000",
});

const { data } = await client.hash({ algorithm: "sha256", data: "hello" });
console.log(data.digest);

CryptoClient accepts two optional authentication mechanisms:

Option	Header sent	Description
`apiKey`	`x-api-key: <value>`	Static API key
`token`	`Authorization: Bearer <value>`	JWT bearer token

Failed requests throw a CryptoApiError:

import { CryptoClient, CryptoApiError } from "@sebastienrousseau/crypto-sdk";

try {
  await client.hash({ algorithm: "invalid", data: "test" });
} catch (err) {
  if (err instanceof CryptoApiError) {
    console.error(err.status); // HTTP status code (e.g. 400)
    console.error(err.body.error); // Error message from the server
  }
}

The Crypto Service ecosystem

Crypto Service provides a complete cryptography stack across 14 specialized packages:

Package	Role	Description
`@sebastienrousseau/crypto-api`	API Schemas	Shared TypeScript types and utilities for the Crypto Service Suite, defining the canonical API surface.
`@sebastienrousseau/crypto-cli`	Terminal CLI	An interactive command-line interface for cryptographic operations, supporting both legacy OpenPGP and modern post-quantum algorithms.
`@sebastienrousseau/crypto-edge`	Edge Runtime	Edge-runtime cryptographic operations using the Web Crypto API, optimized for Cloudflare Workers, Vercel Edge, and Deno.
`@sebastienrousseau/crypto-kms`	Cloud KMS	Unified Key Management Service interface for AWS KMS, GCP Cloud KMS, Azure Key Vault, and HashiCorp Vault.
`@sebastienrousseau/crypto-lib`	Core Library	A modern cryptographic library for TypeScript, with post-quantum support, zero unsafe dependencies, and 100% test coverage.
`@sebastienrousseau/crypto-middleware`	Middleware	Framework-agnostic cryptographic middleware for Express, Fastify, and Koa applications.
`@sebastienrousseau/crypto-prisma`	ORM Adapter	Transparent field-level encryption extension for Prisma Client, powered by AES-256-GCM.
`@sebastienrousseau/crypto-react`	React Hooks	React hooks and context provider for client-side cryptographic operations with zero boilerplate.
`@sebastienrousseau/crypto-sdk` (this package)	Client SDK	A zero-dependency, typed HTTP client for the Crypto Service REST API, with full post-quantum support.
`@sebastienrousseau/crypto-server`	HTTP API	A hardened Fastify REST API for cryptographic operations, with rate limiting, OpenAPI schemas, and post-quantum endpoints.
`@sebastienrousseau/crypto-testing`	Test Support	Deterministic keys, fast mocks, and test fixtures for crypto-lib
`@sebastienrousseau/crypto-typeorm`	ORM Adapter	TypeORM column-level encryption with a single decorator, powered by crypto-lib.
`@sebastienrousseau/crypto-vue`	Vue Composables	Vue 3 composables for client-side cryptography
`@sebastienrousseau/crypto-wasm`	Acceleration	WebAssembly performance accelerator for crypto-lib

Overview

crypto-sdk is a typed HTTP client that wraps the Crypto Service REST API. It uses the global fetch API (no runtime dependencies) and provides strongly-typed methods for every v2 endpoint -- hashing, encryption, signing, key derivation, password hashing, key management, sealed boxes, secretboxes, and post-quantum KEM and signature operations.

## API Reference

Every method returns Promise<ApiResponse<T>> where ApiResponse<T> is { data: T }.

Method	Endpoint	Description
`hash(body)`	`POST /v2/hash`	Compute a cryptographic hash
`encrypt(body)`	`POST /v2/encrypt`	Encrypt plaintext
`decrypt(body)`	`POST /v2/decrypt`	Decrypt ciphertext
`sign(body)`	`POST /v2/sign`	Sign a message
`verify(body)`	`POST /v2/verify`	Verify a signature
`kdf(body)`	`POST /v2/kdf`	Derive a key
`mac(body)`	`POST /v2/hmac`	Compute a MAC
`macVerify(body)`	`POST /v2/hmac/verify`	Verify a MAC
`passwordHash(body)`	`POST /v2/password/hash`	Hash a password
`passwordVerify(body)`	`POST /v2/password/verify`	Verify a password hash
`passwordEncrypt(body)`	`POST /v2/password/encrypt`	Encrypt data with a password
`passwordDecrypt(body)`	`POST /v2/password/decrypt`	Decrypt password-encrypted data
`generateKeyPair(body?)`	`POST /v2/keys/generate`	Generate a key pair
`keyWrap(body)`	`POST /v2/keys/wrap`	Wrap a key
`keyUnwrap(body)`	`POST /v2/keys/unwrap`	Unwrap a wrapped key
`secretboxSeal(body)`	`POST /v2/secretbox/seal`	Seal plaintext with a symmetric key
`secretboxOpen(body)`	`POST /v2/secretbox/open`	Open a sealed secretbox
`sealedboxSeal(body)`	`POST /v2/sealedbox/seal`	Seal plaintext for a recipient public key
`sealedboxOpen(body)`	`POST /v2/sealedbox/open`	Open a sealed box
`pqGenerateKeyPair()`	`POST /v2/pq/hybrid/keygen`	Generate a hybrid key pair
`pqEncapsulate(body)`	`POST /v2/pq/hybrid/encapsulate`	Encapsulate a shared secret
`pqDecapsulate(body)`	`POST /v2/pq/hybrid/decapsulate`	Decapsulate a shared secret
`pqSignKeygen(body)`	`POST /v2/pq/dsa/keygen`	Generate an ML-DSA key pair
`pqSign(body)`	`POST /v2/pq/dsa/sign`	Sign with ML-DSA
`pqVerify(body)`	`POST /v2/pq/dsa/verify`	Verify an ML-DSA signature
`pqHashSignKeygen(body)`	`POST /v2/pq/hash-sign/keygen`	Generate an SLH-DSA key pair
`pqHashSign(body)`	`POST /v2/pq/hash-sign/sign`	Sign with SLH-DSA
`pqHashVerify(body)`	`POST /v2/pq/hash-sign/verify`	Verify an SLH-DSA signature
`algorithms()`	`GET /v2/algorithms`	List all supported algorithms
`health()`	`GET /health`	Server health check

## Examples

All examples are self-contained TypeScript files in the examples/ directory. Each requires the crypto-server running on http://localhost:3000 (override via CRYPTO_SERVER_URL).

npx ts-node examples/<name>.ts

Category	Example	Purpose
Algorithms	algorithms.ts	List all supported algorithms
Encryption	encrypt.ts	AES-256-GCM encrypt and decrypt
Hashing	hash.ts	Compute SHA-256 and BLAKE2b digests
KDF	kdf.ts	Key derivation with HKDF-SHA256
Key Gen	keygen.ts	Generate key pairs
Key Wrap	keywrap.ts	AES key wrapping and unwrapping
MAC	mac.ts	HMAC-SHA256 compute and verify
Passwords	password.ts	Argon2 hashing and password encryption
PQ KEM	pqkem.ts	Hybrid X25519 + ML-KEM key exchange
PQ Sign	pqsign.ts	ML-DSA post-quantum signing
PQ Hash Sign	pqhashsign.ts	SLH-DSA post-quantum signing
Sealed Box	sealedbox.ts	Anonymous public-key encryption
Secretbox	secretbox.ts	Symmetric authenticated encryption
Signing	sign.ts	Ed25519 signing and verification

Development

pnpm --filter @sebastienrousseau/crypto-sdk run build
pnpm --filter @sebastienrousseau/crypto-sdk run test
pnpm --filter @sebastienrousseau/crypto-sdk run lint
pnpm --filter @sebastienrousseau/crypto-sdk run format

All 14 packages in the Crypto Service workspace maintain a 100% coverage floor across statements, branches, functions, and lines.

Security

Report vulnerabilities privately via GitHub Security Advisories or according to SECURITY.md. Never report security issues publicly.

All cryptographic operations leverage audited primitives, enforce constant-time execution where applicable, and zero sensitive key material upon disposal.

Documentation

Stability guarantees

Versions advance strictly one step at a time on the 0.0.x line (v0.0.1 → v0.0.2 → v0.0.3 ... → v0.0.999 → v0.1.0). Work for every release iteration begins on a dedicated feat/v<version> branch.

All 14 packages in the workspace move in lockstep. Public API signatures, cipher output formats, and serialization schemas are strictly versioned. Breaking changes to serialized formats or algorithm defaults are considered major breaking changes. Minimum toolchain upgrades (e.g. Node.js LTS floor) are governed by POLICIES.md.

License

Dual-licensed under Apache 2.0 or MIT, at your option.