Packages

@paramira/aes-gcm

Minimal AES-256-GCM string encryption with a base64url transport codec. No password derivation or key management — bring your own 32-byte key.

License: MIT. Generic: AES-GCM string encryption, bring-your-own-key.

Source: packages/aes-gcm · public repo: phuman/aes-gcm

What it does

Minimal AES-256-GCM string encryption with a base64url transport codec. No password derivation, no key management — bring your own raw 32-byte key (from PBKDF2, a WebAuthn PRF result, wherever).

decryptString throws (GCM auth-tag mismatch) if the key is wrong or the ciphertext was tampered with — never returns garbage silently.

Also exports bytesToB64url/b64urlToBytes, the codec nonce/ciphertext are encoded with, for when you need to move raw bytes over the same kind of transport-safe channel.

Extracted out of @paramira/identity, which re-exports these same functions as encryptBackup/decryptBackup for backward compatibility — nothing here has anything to do with DIDs or Ed25519.

Used by

Packages: ephemeral-share, identity, relay-envelope, webauthn-lock

In tests or development only: paramira-suite.

Uses

@noble/ciphers

Packages

The 54 packages in the Paramira monorepo, by area: what each does, where it's used, and its license.

agreements

The canonical payload for signing an agreement-type protocol: a hash of the exact clauses and version, built identically by the app that signs and the directory that verifies.