tom_crypto 1.2.0

Cryptographic utilities for secure authentication and data protection including JWT tokens, password hashing, and RSA encryption.

1.2.0

• Fixed: TomJwtConfiguration could not be constructed by a consumer. All four positional parameters of its constructor are typed by this package's dependencies — JWTKey and JWTAlgorithm from dart_jsonwebtoken, RSAPrivateKey and RSAPublicKey from pointycastle — and none of the four was exported, so no code outside this package could name them. The class's own dartdoc documents the construction it made impossible. TomClientJwtToken.token and .audience had the same problem: their values could be read but their types could not be written down.
• Added: the barrel now exports the types this package's public API names — Audience, JWT, JWTAlgorithm, JWTKey and SecretKey from dart_jsonwebtoken, and RSAPrivateKey and RSAPublicKey from pointycastle. The lists are exactly the names this surface mentions. Both dependencies declare an RSAPrivateKey and an RSAPublicKey, so exporting either wholesale would give consumers an ambiguous name; the pointycastle pair wins because it is what TomJwtConfiguration holds and what RsaKeyHelper.parsePrivateKeyFromPem returns. Code needing dart_jsonwebtoken's own RSA/EC/EdDSA signing keys, which this surface never names, imports that package directly.
• Added: test/barrel_surface_test.dart, a compile-time guard. It imports only the barrel and names each type in a declaration, so losing an export stops the file compiling rather than failing an assertion inside it.

1.1.0

• Fixed: secure random bytes could never take the value 255. Both places that drew raw randomness used Random.nextInt(255), whose bound is exclusive, so every generated byte fell in 0..254. This affected the Fortuna seed in RsaKeyHelper.getSecureRandom (and therefore every RSA key pair) and the salt in TomPasswordHasher.generateSalt (which is hex-encoded into the stored salt$hash). The loss is about 0.0056 bits per byte. Existing password hashes remain verifiable — the salt is stored alongside the hash — so no migration is required.
• Added: TomSecureBytes.generate, now the single source of raw randomness in this package. Both call sites above previously carried their own copy of the same draw loop, and both copies were wrong in the same way; there is now one implementation for a third copy to not drift from.

1.0.0

• Initial version.