npm install @siglo/core @siglo/crypto

import { timingSafeCompare } from '@siglo/crypto';

// Compares identical length buffers or encoded strings in constant time
const isValid = timingSafeCompare(computedSignature, providedSignature, 'hex');

import { verifyWebhookStep, InMemoryNonceStore } from '@siglo/crypto';
import { RedisNonceStore } from '@siglo/redis';

// Option A: High-performance single-process in-memory bucketed ring buffer
const inMemoryDedup = new InMemoryNonceStore(60); // 60s bucket intervals

// Option B: Multi-replica distributed Redis store (SET ... PX ... NX)
const redisDedup = new RedisNonceStore({ client: redisClient });

export const verifyStripe = verifyWebhookStep('verifyStripe', {
    provider: 'stripe',
    secret: process.env.STRIPE_WEBHOOK_SECRET!,
    payload: ctx => ctx.rawBody,
    signature: ctx => ctx.headers['stripe-signature'],
    toleranceSeconds: 300,
    dedupStore: redisDedup, // Intra-window replay protection
});

import { verifyWebhookStep } from '@siglo/crypto';

export const verifyLargeWebhook = verifyWebhookStep('verifyStream', {
    provider: 'generic-hmac',
    secret: process.env.WEBHOOK_SECRET!,
    payload: ctx => ctx.reqStream, // Node.js Readable stream or AsyncIterable<Buffer>
    signature: ctx => ctx.headers['x-signature'],
    maxBodyBytes: 50 * 1024 * 1024, // 50MB maximum ceiling
    spoolThresholdBytes: 5 * 1024 * 1024, // Spool to disk if > 5MB
});

import { WebhookProtocol, verifyWebhookStep } from '@siglo/crypto';
import crypto from 'node:crypto';

export const customTokenProtocol: WebhookProtocol = {
    name: 'custom-internal-gateway',

    parseHeaders(headers, signatureHeader) {
        return {
            timestamp: Number(headers['x-timestamp']),
            signatures: [signatureHeader],
        };
    },

    verify({ secret, rawPayload, signatureHeader }) {
        const expected = crypto.createHmac('sha256', secret).update(rawPayload).digest('hex');
        return crypto.timingSafeEqual(Buffer.from(signatureHeader), Buffer.from(expected));
    },
};

export interface EncryptedEnvelope {
    __sigloCipher: 'aes-256-gcm';
    v?: number; // Envelope schema version (default: 1)
    kid?: string; // Active Key ID at encryption time
    iv: string; // Hex-encoded 96-bit (12-byte) Initialization Vector
    tag: string; // Hex-encoded 128-bit (16-byte) Authentication Tag
    data: string; // Hex-encoded ciphertext
    edek?: string; // Optional base64 wrapped DEK for cloud KMS
    kekId?: string; // Optional KMS Key ARN / Identifier
}

import { StaticKeyRing, encryptFieldsStep, decryptFieldsStep } from '@siglo/crypto';

// Initialize KeyRing with active key and historical rotation keys
const keyRing = new StaticKeyRing('key-2026-q2', {
    'key-2026-q1': process.env.KEY_2026_Q1!, // Historical retirement key
    'key-2026-q2': process.env.KEY_2026_Q2!, // Current active encryption key
});

export const encryptStep = encryptFieldsStep('protectData', {
    fields: ['user.ssn'],
    keyRing,
});

export const decryptStep = decryptFieldsStep('restoreData', {
    fields: ['user.ssn'],
    keyRing,
    onNeedsRekey: (ctx, field, oldKid, activeKid) => {
        console.log(`Field ${field} encrypted with ${oldKid} needs re-keying to ${activeKid}`);
    },
});

import { maskFieldsStep, maskPatterns } from '@siglo/crypto';

export const sanitizeStep = maskFieldsStep('sanitizeForDevTools', {
    fields: [
        'user.billing.taxId', // Nested object path
        'passengers.*.passportNumber', // Array wildcard
        'orders.*.payment.cardToken', // Deep nested wildcard
    ],
    maskPattern: maskPatterns.last4,
});

import { Step } from '@siglo/core';

// Webhook Verification Step
export function verifyWebhookStep<const TName extends string, TInput>(
  name: TName,
  options: WebhookVerifyOptions<TInput>
): WebhookVerifyStep<TInput, TName>;

// AES-256-GCM Envelope Encryption Step
export function encryptFieldsStep<const TName extends string, TInput>(
  name: TName,
  options: FieldCipherOptions<TInput>
): EncryptFieldsStep<TInput, TName>;

// AES-256-GCM Envelope Decryption Step
export function decryptFieldsStep<const TName extends string, TInput>(
  name: TName,
  options: FieldCipherOptions<TInput>
): DecryptFieldsStep<TInput, TName>;

// Context Redaction Step
export function maskFieldsStep<const TName extends string, TInput>(
  name: TName,
  options: MaskFieldsOptions<TInput>
): MaskFieldsStep<TInput, TName>;

// KeyRing and Utilities
export class StaticKeyRing implements KeyRing { ... }
export class InMemoryNonceStore implements WebhookDedupStore { ... }
export function deriveSubkey(masterKey: string | Buffer, contextInfo: string | Buffer): Buffer;
export function timingSafeCompare(a: string | Buffer, b: string | Buffer, encoding?: 'hex' | 'base64'): boolean;
export function deepFreeze<T>(obj: T): T;