@peculiar/webcrypto 1.7.1

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:npm/%40peculiar/webcrypto@1.7.1
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/%40peculiar/webcrypto@1.7.1

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:5385758f42e499c1bed3c560c33b743f4ab712d67dc613fe2fd0d162acaebfd7","contract":["assert Crypto provides getRandomValues filling typed arrays with random values and randomUUID generating RFC 4122 v4 UUID strings","assert subtle.digest computes SHA-256 cryptographic digests returning 32-byte ArrayBuffer outputs","assert subtle.generateKey, encrypt, and decrypt perform AES-GCM symmetric encryption and authenticated decryption","assert subtle.generateKey, sign, and verify create and validate digital signatures using ECDSA with P-256 and SHA-256","assert subtle.exportKey and importKey serialize and reconstruct CryptoKey instances using JWK format"],"goal":"verify pkg:npm/%40peculiar/webcrypto@1.7.1","kind":"HOW","packages":["pkg:npm/%40peculiar/webcrypto@1.7.1"],"schemaVersion":1,"symbols":["Crypto","CryptoKey"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"npm","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/%40peculiar/webcrypto@1.7.1"],"schemaVersion":1,"subject":"pkg:npm/%40peculiar/webcrypto@1.7.1","verifierAdapter":"node-typescript@1"}

import { Crypto, CryptoKey } from "@peculiar/webcrypto";

export const webcrypto = new Crypto();
export { Crypto, CryptoKey };

export async function digestMessage(message, algorithm = "SHA-256") {
  const encoder = new TextEncoder();
  const data = encoder.encode(message);
  return await webcrypto.subtle.digest(algorithm, data);
}

export async function generateAesGcmKey(length = 256) {
  return await webcrypto.subtle.generateKey(
    { name: "AES-GCM", length },
    true,
    ["encrypt", "decrypt"]
  );
}

export async function encryptAesGcm(key, plaintext, iv) {
  const encoder = new TextEncoder();
  const data = encoder.encode(plaintext);
  return await webcrypto.subtle.encrypt({ name: "AES-GCM", iv }, key, data);
}

export async function decryptAesGcm(key, ciphertext, iv) {
  const decrypted = await webcrypto.subtle.decrypt({ name: "AES-GCM", iv }, key, ciphertext);
  const decoder = new TextDecoder();
  return decoder.decode(decrypted);
}

{
  "name": "sample-peculiar-webcrypto",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-peculiar-webcrypto",
      "version": "1.0.0",
      "license": "ISC",
      "dependencies": {
        "@peculiar/webcrypto": "1.7.1"
      }
    },
    "node_modules/@peculiar/asn1-schema": {
      "version": "2.9.4",
      "resolved": "https://registry.npmjs.org/@peculiar/asn1-schema/-/asn1-schema-2.9.4.tgz",
      "integrity": "sha512-GjzePcT9Iw8NzeOPf73iNS9xM+TBhd/FilAfP+RQGkTMQJTVWtytN3JHJACCjf/ABNau5S7mS3g+DcuxmRgYEg==",
      "license": "MIT",
      "dependencies": {
        "@peculiar/utils": "^2.0.2",
        "asn1js": "^3.0.10",
        "tslib": "^2.8.1"
      },
      "engines": {
        "node": ">=14"
      }
    },
    "node_modules/@peculiar/json-schema": {
      "version": "1.1.12",
      "resolved": "https://registry.npmjs.org/@peculiar/json-schema/-/json-schema-1.1.12.tgz",
      "integrity": "sha512-coUfuoMeIB7B8/NMekxaDzLhaYmp0HZNPEjYRm9goRou8UZIC3z21s0sL9AWoCw4EG876QyO3kYrc61WNF9B/w==",
      "license": "MIT",
      "dependencies": {
        "tslib": "^2.0.0"
      },
      "engines": {
        "node": ">=8.0.0"
      }
    },
    "node_modules/@peculiar/utils": {
      "version": "2.0.3",
      "resolved": "https://registry.npmjs.org/@peculiar/utils/-/utils-2.0.3.tgz",
      "integrity": "sha512-+oL3HPFRIZ1St2K50lWCXiioIgSoxzz7R1J3uF6neO2yl1sgmpgY6XXJH4BdpoDkMWznQTeYF6oWNDZLCdQ4eQ==",
      "license": "MIT",
      "dependencies": {
        "tslib": "^2.8.1"
      }
    },
    "node_modules/@peculiar/webcrypto": {
      "version": "1.7.1",
      "resolved": "https://registry.npmjs.org/@peculiar/webcrypto/-/webcrypto-1.7.1.tgz",
      "integrity": "sha512-ODOov0sGMJMf3jPonOkgGqPknTsu+DdQ7kD++gz8aI+aFMOMHFbWAA2taqXXVTdP+OTOQR/znGvSpmkeI0WTYQ==",
      "license": "MIT",
      "dependencies": {
        "@peculiar/asn1-schema": "^2.7.0",
        "@peculiar/json-schema": "^1.1.12",
        "@peculiar/utils": "^2.0.2",
        "tslib": "^2.8.1",
        "webcrypto-core": "^1.9.2"
      },
      "engines": {
        "node": ">=14.18.0"
      }
    },
    "node_modules/asn1js": {
      "version": "3.0.10",
      "resolved": "https://registry.npmjs.org/asn1js/-/asn1js-3.0.10.tgz",
      "integrity": "sha512-S2s3aOytiKdFRdulw2qPE51MzjzVOisppcVv7jVFR+Kw0kxwvFrDcYA0h7Ndqbmj0HkMIXYWaoj7fli8kgx1eg==",
      "license": "BSD-3-Clause",
      "dependencies": {
        "pvtsutils": "^1.3.6",
        "pvutils": "^1.1.5",
        "tslib": "^2.8.1"
      },
      "engines": {
        "node": ">=12.0.0"
      }
    },
    "node_modules/pvtsutils": {
      "version": "1.3.6",
      "resolved": "https://registry.npmjs.org/pvtsutils/-/pvtsutils-1.3.6.tgz",
      "integrity": "sha512-PLgQXQ6H2FWCaeRak8vvk1GW462lMxB5s3Jm673N82zI4vqtVUPuZdffdZbPDFRoU8kAhItWFtPCWiPpp4/EDg==",
      "license": "MIT",
      "dependencies": {
        "tslib": "^2.8.1"
      }
    },
    "node_modules/pvutils": {
      "version": "1.2.0",
      "resolved": "https://registry.npmjs.org/pvutils/-/pvutils-1.2.0.tgz",
      "integrity": "sha512-BbubeCEyTuQjVMakvJQ/Sxbc93F2pwmbsxONT/ZRrwU7Ua38d8unYTwXpTVLAKJ4BDuH9IGztCjQcd/N/39Dvg==",
      "license": "MIT",
      "engines": {
        "node": ">=16.0.0"
      }
    },
    "node_modules/tslib": {
      "version": "2.8.1",
      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
      "license": "0BSD"
    },
    "node_modules/webcrypto-core": {
      "version": "1.9.2",
      "resolved": "https://registry.npmjs.org/webcrypto-core/-/webcrypto-core-1.9.2.tgz",
      "integrity": "sha512-gsXecm82UQNlTBURJGuqOWy1Ww08S3kZUcr3aOJS02Pk0xLtkfeUAVC0u0xhgdonFme80edSJUIJyuvL/7250Q==",
      "license": "MIT",
      "dependencies": {
        "@peculiar/asn1-schema": "^2.7.0",
        "@peculiar/json-schema": "^1.1.12",
        "@peculiar/utils": "^2.0.2",
        "asn1js": "^3.0.10",
        "tslib": "^2.8.1"
      }
    }
  }
}

{
  "name": "sample-peculiar-webcrypto",
  "version": "1.0.0",
  "type": "module",
  "dependencies": {
    "@peculiar/webcrypto": "1.7.1"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:npm/%40peculiar/webcrypto@1.7.1",
  "kind": "HOW",
  "packages": [
    "pkg:npm/%40peculiar/webcrypto@1.7.1"
  ]
}

import assert from "node:assert/strict";
import { Crypto, CryptoKey } from "@peculiar/webcrypto";
import {
  webcrypto,
  digestMessage,
  generateAesGcmKey,
  encryptAesGcm,
  decryptAesGcm,
} from "../index.mjs";

// Assertion 1: Crypto provides getRandomValues filling typed arrays with random values and randomUUID generating RFC 4122 v4 UUID strings
const cryptoInstance = new Crypto();
assert.ok(cryptoInstance instanceof Crypto);
assert.ok(cryptoInstance.subtle);

const randomBuffer = new Uint8Array(32);
const filled = cryptoInstance.getRandomValues(randomBuffer);
assert.strictEqual(filled, randomBuffer);
assert.ok(randomBuffer.some((byte) => byte !== 0));

const uuid = cryptoInstance.randomUUID();
assert.match(uuid, /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i);

// Assertion 2: subtle.digest computes SHA-256 cryptographic digests returning 32-byte ArrayBuffer outputs
const testMessage = "Clean-room verification payload for webcrypto";
const digestBuffer = await digestMessage(testMessage, "SHA-256");
assert.ok(digestBuffer instanceof ArrayBuffer);
assert.strictEqual(digestBuffer.byteLength, 32);

const directDigest = await cryptoInstance.subtle.digest(
  "SHA-256",
  new TextEncoder().encode(testMessage)
);
assert.deepEqual(new Uint8Array(digestBuffer), new Uint8Array(directDigest));

// Assertion 3: subtle.generateKey, encrypt, and decrypt perform AES-GCM symmetric encryption and authenticated decryption
const aesKey = await generateAesGcmKey(256);
assert.ok(aesKey instanceof CryptoKey);
assert.strictEqual(aesKey.type, "secret");
assert.strictEqual(aesKey.algorithm.name, "AES-GCM");

const iv = cryptoInstance.getRandomValues(new Uint8Array(12));
const ciphertext = await encryptAesGcm(aesKey, testMessage, iv);
assert.ok(ciphertext instanceof ArrayBuffer);
assert.ok(ciphertext.byteLength > 0);

const decryptedText = await decryptAesGcm(aesKey, ciphertext, iv);
assert.strictEqual(decryptedText, testMessage);

// Assertion 4: subtle.generateKey, sign, and verify create and validate digital signatures using ECDSA with P-256 and SHA-256
const ecdsaPair = await cryptoInstance.subtle.generateKey(
  { name: "ECDSA", namedCurve: "P-256" },
  true,
  ["sign", "verify"]
);
assert.ok(ecdsaPair.publicKey instanceof CryptoKey);
assert.ok(ecdsaPair.privateKey instanceof CryptoKey);

const payloadData = new TextEncoder().encode("ECDSA signature payload");
const signature = await cryptoInstance.subtle.sign(
  { name: "ECDSA", hash: { name: "SHA-256" } },
  ecdsaPair.privateKey,
  payloadData
);
assert.ok(signature instanceof ArrayBuffer);

const isValidSig = await cryptoInstance.subtle.verify(
  { name: "ECDSA", hash: { name: "SHA-256" } },
  ecdsaPair.publicKey,
  signature,
  payloadData
);
assert.strictEqual(isValidSig, true);

const tamperedData = new TextEncoder().encode("Tampered signature payload");
const isTamperedValid = await cryptoInstance.subtle.verify(
  { name: "ECDSA", hash: { name: "SHA-256" } },
  ecdsaPair.publicKey,
  signature,
  tamperedData
);
assert.strictEqual(isTamperedValid, false);

// Assertion 5: subtle.exportKey and importKey serialize and reconstruct CryptoKey instances using JWK format
const exportedJwk = await cryptoInstance.subtle.exportKey("jwk", aesKey);
assert.strictEqual(exportedJwk.kty, "oct");
assert.ok(typeof exportedJwk.k === "string" && exportedJwk.k.length > 0);
assert.deepEqual(exportedJwk.key_ops, ["encrypt", "decrypt"]);
assert.strictEqual(exportedJwk.ext, true);

const importedKey = await cryptoInstance.subtle.importKey(
  "jwk",
  exportedJwk,
  { name: "AES-GCM" },
  true,
  ["decrypt"]
);
assert.ok(importedKey instanceof CryptoKey);
const decryptedWithImported = await decryptAesGcm(importedKey, ciphertext, iv);
assert.strictEqual(decryptedWithImported, testMessage);

console.log("All contract assertions passed successfully.");