d3nengineer/stream-encryption-psr7

PSR-7 stream decorators for media encryption (AES-CBC + HKDF + HMAC)

v1.0.1 2026-04-01 11:15 UTC

Requires

• php: ^8.2
• guzzlehttp/psr7: ^2.0
• psr/http-message: ^1.0 || ^2.0

Requires (Dev)

• phpunit/phpunit: ^11.5

MIT

• stream
• encryption
• hmac
• psr-7
• aes-cbc

README

d3nengineer/stream-encryption-psr7 is a PHP 8.2+ library that exposes lazy PSR-7 stream decorators for media encryption and decryption using AES-CBC, HKDF-SHA256, and truncated HMAC-SHA256 payloads.

Warning

Do not use in production. This repository was created as part of a test assignment and is published for demonstration purposes only. It is not production-ready and is not recommended for real-world use.

Installation

composer require d3nengineer/stream-encryption-psr7

Recommended Entry Point

Use Infra\StreamEncryption\Stream\StreamFactory for the common happy path. It creates lazy encrypting and decrypting decorators without changing the underlying stream behavior or exception model.

<?php

use GuzzleHttp\Psr7\Utils;
use Infra\StreamEncryption\Enum\MediaType;
use Infra\StreamEncryption\Stream\StreamFactory;

$factory = new StreamFactory();
$mediaKey = random_bytes(32);

$encrypted = $factory->encrypt(
    Utils::streamFor("binary\x00payload"),
    $mediaKey,
    MediaType::IMAGE,
);

$decrypted = $factory->decrypt(
    Utils::streamFor((string) $encrypted),
    $mediaKey,
    MediaType::IMAGE,
);

$plaintext = (string) $decrypted;

Supported Runtime

• PHP 8.2+
• psr/http-message ^1.0 or ^2.0
• guzzlehttp/psr7 ^2.0

Verification

Run the same checks locally that the repository uses for release-readiness:

composer check

More Details

Package behavior and operational guarantees that do not belong on the landing page live in docs/usage.md. Maintainer-facing release steps live in docs/release-checklist.md.