@enclave-technologies/pqc-primitives 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,173 @@
+# enclave-pqc-primitives
+
+NIST-aligned **post-quantum cryptographic primitives** for Enclave product
+SDKs. Licensed under **Apache-2.0**.
+
+This is the foundational (tier-1) crate **and** the npm package
+`@enclave-technologies/pqc-primitives` (WASM bindings). Product SDKs (Auth, Sign, Verify,
+Messaging, …) build **on top of** it. This package stays **algorithm-only** —
+no sessions, envelopes, tokens, or credentials.
+
+This crate implements NIST Category 5 exclusively (ML-KEM-1024 / ML-DSA-87),
+satisfying CNSA 2.0's algorithm requirements for national security systems.
+This is an architectural choice, not a certification — FIPS 140-3 module
+validation and any NSS accreditation remain separate, unstarted processes.
+
+## Algorithm suite (`ENCLAVE_PQ_SUITE_v1`)
+
+Category 5 only — there is **no** Category 3 parameter set and **no**
+suite-selection API.
+
+| Role | Algorithm | Standard | Implementation |
+|------|-----------|----------|----------------|
+| Key encapsulation | ML-KEM-1024 | FIPS 203 | RustCrypto [`ml-kem`](https://crates.io/crates/ml-kem) |
+| Signatures | ML-DSA-87 | FIPS 204 | RustCrypto [`ml-dsa`](https://crates.io/crates/ml-dsa) |
+| Bulk AEAD | AES-256-GCM | FIPS 197 / SP 800-38D | RustCrypto [`aes-gcm`](https://crates.io/crates/aes-gcm) |
+| Hash / XOF | SHAKE256 | FIPS 202 | RustCrypto [`sha3`](https://crates.io/crates/sha3) |
+| Labeled KDF | `enclave-kdf-v1` | SHAKE256 domain-separated | this crate |
+| Password → key | Argon2id | RFC 9106 (classical) | RustCrypto [`argon2`](https://crates.io/crates/argon2) |
+
+`enclave-kdf-v1` is for **high-entropy** input (shared secrets, etc.).
+**Argon2id** (`pwhash`) is for **human passwords**: deliberately slow and
+memory-hard so stolen ciphertext resists offline guessing. Do not substitute
+one for the other, and do not lower OWASP baseline params for login latency
+without treating that as a direct security tradeoff.
+
+Argon2id is classical and **outside** the Category 5 / CNSA 2.0 suite table —
+it fills the password → key gap alongside those primitives.
+### Encoding sizes (FIPS)
+
+| | Public key | Secret (expanded) | Seed | Ciphertext / signature |
+|--|------------|-------------------|------|------------------------|
+| ML-KEM-1024 | 1568 | 3168 | 64 | ciphertext 1568; shared secret 32 |
+| ML-DSA-87 | 2592 | 4896 | 32 | signature 4627 |
+
+## Layout
+
+```text
+src/                 Rust primitives (kem, sig, aead, hash, kdf, pwhash, provider, self_test, usage)
+bindings/wasm/       wasm-bindgen façade (algorithm names only)
+js/                  TS helpers / constants (source of truth for sizes)
+scripts/build-wasm.mjs
+dist/{bundler,nodejs,web}/   wasm-pack outputs + JS façade
+tests/               Round-trips, CAST coverage, AES/SHAKE KATs
+```
+
+## Rust usage
+
+```rust
+use enclave_pqc_primitives::{aead, kdf, kem, pwhash, run_self_tests, sig, SoftwareProvider, CryptoProvider};
+
+run_self_tests()?; // optional CAST at startup (includes Argon2id KAT)
+
+let kem_kp = kem::generate_keypair()?; // includes PCT
+let enc = kem::encapsulate(&kem_kp.keypair.public_key)?;
+let shared = kem::decapsulate(&enc.encapsulation.ciphertext, &kem_kp.keypair.secret_key)?;
+let aes_key = kdf::labeled_kdf("aes-256-gcm-key", &shared.shared_secret, 32)?;
+
+// Human password → AEAD key (OWASP Argon2id baseline; intentionally slow):
+let salt = pwhash::generate_salt()?;
+let pw_key = pwhash::pwhash_derive_key(b"user-passphrase", &salt.salt, &pwhash::RECOMMENDED_PARAMS)?;
+
+let nonce = [0u8; aead::NONCE_BYTES]; // caller must ensure uniqueness
+let sealed = aead::encrypt(&aes_key.key, &nonce, b"hello", b"aad")?;
+
+let sig_kp = sig::generate_keypair()?; // includes PCT
+let signature = sig::sign(&sig_kp.keypair.secret_key, b"message")?;
+sig::verify(&sig_kp.keypair.public_key, b"message", &signature.signature)?;
+
+// Same operations via the substitution seam (SoftwareProvider is not FIPS-validated):
+let provider = SoftwareProvider;
+let _ = provider.kem_generate_keypair()?;
+# Ok::<(), enclave_pqc_primitives::Error>(())
+```
+
+Each operation returns a [`CryptoUsageRecord`] (`algorithm`, `suite_id`,
+`operation`, `crate_version`) for CBOM / audit attach points. Persistence and
+telemetry belong in Encrypt / product layers — not this crate.
+
+## JavaScript / TypeScript (`@enclave-technologies/pqc-primitives`)
+
+WASM façade over the same Category 5 Rust core. Algorithm-namespaced only
+(`kem*` / `sig*` / `aead*` / …) — no product concepts.
+
+### Install / build
+
+```bash
+# Requires: rustup target wasm32-unknown-unknown, wasm-pack (auto-installed)
+npm install
+npm run build
+npm test
+```
+
+### Multi-runtime exports
+
+| Consumer | Import condition / path |
+|----------|-------------------------|
+| Node / Vitest | `import … from "@enclave-technologies/pqc-primitives"` → `dist/nodejs` |
+| Next.js / webpack / Vite | `"browser"` → `dist/bundler` |
+| Deno / raw ESM | `"./web"` or `"deno"` → `dist/web` |
+
+```ts
+import {
+  KEM, SIG, AEAD, HASH, KDF_LABEL_PREFIX, PWHASH,
+  kemGenerateKeypair, kemEncapsulate, kemDecapsulate,
+  sigGenerateKeypair, sigSign, sigSignWithContext, sigVerify,
+  aeadEncrypt, aeadDecrypt,
+  labeledKdf, labeledKdf32, shake256, zeroize,
+  pwhashDeriveKey, generateSalt, RECOMMENDED_PARAMS,
+  runSelfTests, getLastUsageRecord,
+  isPairwiseConsistencyFailure, isSelfTestFailure,
+} from "@enclave-technologies/pqc-primitives";
+
+await runSelfTests();
+const kp = kemGenerateKeypair(); // PCT inside; seed-form secretKey (64 B)
+const usage = getLastUsageRecord(); // { algorithm, suiteId, operation, crateVersion }
+```
+
+Keygen returns the preferred **seed** secret-key form (`KEM.SECRET_KEY_SEED_BYTES` /
+`SIG.SECRET_KEY_SEED_BYTES`). FIPS expanded sizes are `SECRET_KEY_BYTES` (3168 / 4896)
+via `kemExpandedSecretKey` / `sigExpandedSecretKey`.
+
+Typed failures use `err.name`:
+- `PairwiseConsistencyFailureError` — PCT failed in keygen
+- `SelfTestFailureError` — CAST failed in `runSelfTests`
+
+Errors otherwise throw greppable prefixes: `InvalidLength:`, `InvalidEncoding:`,
+`AeadFailure:`, `SignatureInvalid:`, `InvalidParameter:`.
+
+### Secret zeroization (important)
+
+Rust zeroizes secret keys on `Drop` **inside** WASM. Bytes copied into a JS
+`Uint8Array` are **not** cleared by the GC. Call `zeroize(secretKey)` when
+finished with long-lived secrets.
+
+## Dependencies (pinned)
+
+| Crate | Role | Provenance |
+|-------|------|------------|
+| `ml-kem =0.3.2` | ML-KEM-1024 | **RustCrypto** |
+| `ml-dsa =0.1.1` | ML-DSA-87 | **RustCrypto** |
+| `aes-gcm =0.10.3` | AES-256-GCM | **RustCrypto** |
+| `sha3 =0.10.8` | SHAKE256 | **RustCrypto** |
+| `argon2 =0.5.3` | Argon2id (password → key) | **RustCrypto** |
+| `getrandom =0.2.17` | CSPRNG for salts / (via ML-*) | **RustCrypto** adjacent |
+| `zeroize =1.8.1` | Secret wipe-on-drop | **RustCrypto** |
+
+### Flagged dependencies
+
+| Crate | Where | Why flagged |
+|-------|-------|-------------|
+| `serde` / `serde_json` | **dev-only** | reserved for future NIST ACVP JSON fixtures |
+| `wasm-bindgen` / `js-sys` / `getrandom/js` | **bindings/wasm only** | JS interop — not used by native Rust consumers |
+
+## Running tests
+
+```bash
+cargo test
+cargo clippy --workspace --all-targets -- -D warnings
+```
+
+## License
+
+Licensed under the [Apache License, Version 2.0](./LICENSE).

package/dist/bundler/constants.js

@@ -0,0 +1,63 @@
+/** @type {const} */
+export const ENCLAVE_PQ_SUITE_ID = "ENCLAVE_PQ_SUITE_v1";
+/** @type {const} */
+export const KDF_LABEL_PREFIX = "enclave-kdf-v1";
+/** @type {const} */
+export const KEM = Object.freeze({
+  ALGORITHM: "ML-KEM-1024",
+  PUBLIC_KEY_BYTES: 1568,
+  SECRET_KEY_SEED_BYTES: 64,
+  SECRET_KEY_EXPANDED_BYTES: 3168,
+  SECRET_KEY_BYTES: 3168,
+  CIPHERTEXT_BYTES: 1568,
+  SHARED_SECRET_BYTES: 32,
+  ENCAP_RANDOMNESS_BYTES: 32,
+});
+/** @type {const} */
+export const SIG = Object.freeze({
+  ALGORITHM: "ML-DSA-87",
+  PUBLIC_KEY_BYTES: 2592,
+  SECRET_KEY_SEED_BYTES: 32,
+  SECRET_KEY_EXPANDED_BYTES: 4896,
+  SECRET_KEY_BYTES: 4896,
+  SIGNATURE_BYTES: 4627,
+  MAX_CONTEXT_BYTES: 255,
+});
+/** @type {const} */
+export const AEAD = Object.freeze({
+  ALGORITHM: "AES-256-GCM",
+  KEY_BYTES: 32,
+  NONCE_BYTES: 12,
+  TAG_BYTES: 16,
+});
+/** @type {const} */
+export const HASH = Object.freeze({
+  ALGORITHM: "SHAKE256",
+  DEFAULT_OUTPUT_BYTES: 32,
+});
+/** @type {const} */
+export const PWHASH = Object.freeze({
+  ALGORITHM: "Argon2id",
+  SALT_BYTES: 16,
+  OUTPUT_BYTES: 32,
+  /**
+   * OWASP Password Storage Cheat Sheet baseline (verified 2026-07-14):
+   * m=19456 (19 MiB), t=2, p=1. Deliberately slow + memory-hard — do not
+   * lower these for login latency without treating that as a security tradeoff.
+   */
+  RECOMMENDED_PARAMS: Object.freeze({
+    memoryCostKib: 19456,
+    iterations: 2,
+    parallelism: 1,
+  }),
+});
+
+/** @param {unknown} err */
+export function isPairwiseConsistencyFailure(err) {
+  return err instanceof Error && err.name === "PairwiseConsistencyFailureError";
+}
+
+/** @param {unknown} err */
+export function isSelfTestFailure(err) {
+  return err instanceof Error && err.name === "SelfTestFailureError";
+}

package/dist/bundler/enclave_pqc_primitives_wasm.d.ts

@@ -0,0 +1,218 @@
+/* tslint:disable */
+/* eslint-disable */
+
+/**
+ * Canonical suite identifier matching the Rust crate (Category 5 algorithms).
+ */
+export function ENCLAVE_PQ_SUITE_ID(): string;
+
+/**
+ * Domain-separation prefix for the Enclave labeled KDF.
+ */
+export function KDF_LABEL_PREFIX(): string;
+
+/**
+ * Algorithm identifier (`"Argon2id"`).
+ */
+export function PWHASH_ALGORITHM(): string;
+
+/**
+ * Derived key length in bytes (matches AES-256-GCM key size).
+ */
+export function PWHASH_OUTPUT_BYTES(): number;
+
+/**
+ * Salt length in bytes produced by [`generate_salt`].
+ */
+export function PWHASH_SALT_BYTES(): number;
+
+/**
+ * OWASP baseline Argon2id params: `{ memoryCostKib, iterations, parallelism }`.
+ *
+ * Sourced from the OWASP Password Storage Cheat Sheet (19 MiB / t=2 / p=1).
+ * Slow and memory-hard by design — lowering these for login latency is a
+ * security tradeoff, not a free optimization.
+ */
+export function RECOMMENDED_PARAMS(): any;
+
+/**
+ * Decrypt AES-256-GCM ciphertext (including trailing tag).
+ *
+ * Throws on authentication failure (`AeadFailure: ...`).
+ */
+export function aeadDecrypt(key: Uint8Array, nonce: Uint8Array, ciphertext: Uint8Array, aad: Uint8Array): Uint8Array;
+
+/**
+ * Encrypt with AES-256-GCM under an explicit key and nonce.
+ *
+ * Returns `ciphertext || tag` (16-byte tag suffix). Callers must ensure
+ * `(key, nonce)` uniqueness.
+ */
+export function aeadEncrypt(key: Uint8Array, nonce: Uint8Array, plaintext: Uint8Array, aad: Uint8Array): Uint8Array;
+
+/**
+ * Cryptographically random 16-byte salt for Argon2id.
+ */
+export function generateSalt(): Uint8Array;
+
+/**
+ * Return the [`CryptoUsageRecord`] from the last WASM primitive call.
+ *
+ * Shape: `{ algorithm, suiteId, operation, crateVersion }`.
+ * Returns `undefined` if no operation has run yet in this WASM instance.
+ *
+ * This is the CBOM attach point for product layers (Encrypt, etc.). This
+ * binding does not persist or transmit the record.
+ */
+export function getLastUsageRecord(): any;
+
+/**
+ * SHAKE256 over UTF-8 string bytes.
+ */
+export function hashUtf8(value: string, output_len: number): Uint8Array;
+
+/**
+ * Decapsulate an ML-KEM-1024 ciphertext.
+ *
+ * `secret_key` may be a 64-byte seed or a 3168-byte expanded key.
+ */
+export function kemDecapsulate(ciphertext: Uint8Array, secret_key: Uint8Array): Uint8Array;
+
+/**
+ * Encapsulate a shared secret to an ML-KEM-1024 public key.
+ *
+ * Returns `{ ciphertext, sharedSecret }` (1568 / 32 bytes).
+ */
+export function kemEncapsulate(public_key: Uint8Array): any;
+
+/**
+ * Deterministic encapsulation for known-answer / KAT compliance.
+ *
+ * # Hazmat
+ *
+ * **KATs only.** Production code must call [`kem_encapsulate`].
+ */
+export function kemEncapsulateDeterministic(public_key: Uint8Array, m: Uint8Array): any;
+
+/**
+ * Expand a 64-byte seed-form secret key to the FIPS expanded encoding
+ * ([`kem::SECRET_KEY_BYTES`] bytes).
+ */
+export function kemExpandedSecretKey(secret_key: Uint8Array): Uint8Array;
+
+/**
+ * Generate a fresh ML-KEM-1024 keypair (includes PCT).
+ *
+ * Returns `{ publicKey, secretKey }` where `secretKey` is the preferred
+ * seed form ([`kem::SECRET_KEY_SEED_BYTES`] = 64). Expanded size is
+ * [`kem::SECRET_KEY_BYTES`] = 3168 — use [`kem_expanded_secret_key`].
+ *
+ * Throws `PairwiseConsistencyFailureError` if the PCT fails.
+ */
+export function kemGenerateKeypair(): any;
+
+/**
+ * Derive an ML-KEM-1024 keypair from a 64-byte seed (`d || z`). Includes PCT.
+ */
+export function kemKeypairFromSeed(seed: Uint8Array): any;
+
+/**
+ * Derive key material with `enclave-kdf-v1` labeled SHAKE256.
+ *
+ * Throws `InvalidParameter` on empty `label` or `length == 0`.
+ */
+export function labeledKdf(label: string, ikm: Uint8Array, length: number): Uint8Array;
+
+/**
+ * [`labeled_kdf`] with a 32-byte output.
+ */
+export function labeledKdf32(label: string, ikm: Uint8Array): Uint8Array;
+
+/**
+ * Derive a 32-byte key from a password + salt with Argon2id.
+ *
+ * `params` must be `{ memoryCostKib, iterations, parallelism }` (see
+ * [`recommended_params`]). Throws on empty password / wrong salt length /
+ * invalid costs.
+ *
+ * This call is intentionally slow (~tens–hundreds of ms depending on host).
+ * That cost is the offline brute-force defense — do not lower params casually.
+ */
+export function pwhashDeriveKey(password: Uint8Array, salt: Uint8Array, params: any): Uint8Array;
+
+/**
+ * Run known-answer CASTs for ML-KEM-1024, ML-DSA-87, and Argon2id.
+ *
+ * Throws `SelfTestFailureError` if any CAST fails. Pair-wise consistency is
+ * already enforced inside key generation — this is the power-on / module-entry
+ * known-answer path. The Argon2id CAST is slower (memory-hard by design).
+ */
+export function runSelfTests(): void;
+
+/**
+ * One-shot SHAKE256 hash of `input` into `output_len` bytes.
+ */
+export function shake256(input: Uint8Array, output_len: number): Uint8Array;
+
+/**
+ * Expand a 32-byte seed-form secret key to the FIPS expanded encoding
+ * ([`sig::SECRET_KEY_BYTES`] bytes).
+ */
+export function sigExpandedSecretKey(secret_key: Uint8Array): Uint8Array;
+
+/**
+ * Generate a fresh ML-DSA-87 keypair (includes PCT).
+ *
+ * Returns `{ publicKey, secretKey }` where `secretKey` is the preferred
+ * seed form ([`sig::SECRET_KEY_SEED_BYTES`] = 32). Expanded size is
+ * [`sig::SECRET_KEY_BYTES`] = 4896.
+ *
+ * Throws `PairwiseConsistencyFailureError` if the PCT fails.
+ */
+export function sigGenerateKeypair(): any;
+
+/**
+ * Derive an ML-DSA-87 keypair from a 32-byte seed. Includes PCT.
+ */
+export function sigKeypairFromSeed(seed: Uint8Array): any;
+
+/**
+ * Sign a message with empty context (deterministic ML-DSA-87).
+ *
+ * Empty `message` throws `InvalidLength` (matches Rust).
+ */
+export function sigSign(secret_key: Uint8Array, message: Uint8Array): Uint8Array;
+
+/**
+ * Deterministic ML-DSA.Sign with an explicit context (`context.len() <= 255`).
+ *
+ * Empty `message` or `context.len() > 255` throws (matches Rust).
+ */
+export function sigSignWithContext(secret_key: Uint8Array, message: Uint8Array, context: Uint8Array): Uint8Array;
+
+/**
+ * Verify an ML-DSA-87 signature (empty context).
+ *
+ * Returns `false` on a cryptographically invalid signature. Throws only for
+ * malformed input lengths / encodings.
+ */
+export function sigVerify(public_key: Uint8Array, message: Uint8Array, signature: Uint8Array): boolean;
+
+/**
+ * Verify an ML-DSA-87 signature with an explicit context.
+ *
+ * Returns `false` on cryptographic failure; throws on malformed lengths.
+ */
+export function sigVerifyWithContext(public_key: Uint8Array, message: Uint8Array, signature: Uint8Array, context: Uint8Array): boolean;
+
+/**
+ * Overwrite a JS `Uint8Array` in place with zeros.
+ *
+ * # Security note
+ *
+ * Rust-side secret keys are zeroized on `Drop`, but that guarantee **does not**
+ * cross the WASM boundary. Once secret material lives in a JS `Uint8Array`, the
+ * JS garbage collector will not zero it. Call this when you are finished with
+ * long-lived secret buffers.
+ */
+export function zeroize(buf: Uint8Array): void;

package/dist/bundler/enclave_pqc_primitives_wasm.js

@@ -0,0 +1,9 @@
+/* @ts-self-types="./enclave_pqc_primitives_wasm.d.ts" */
+import * as wasm from "./enclave_pqc_primitives_wasm_bg.wasm";
+import { __wbg_set_wasm } from "./enclave_pqc_primitives_wasm_bg.js";
+
+__wbg_set_wasm(wasm);
+wasm.__wbindgen_start();
+export {
+    ENCLAVE_PQ_SUITE_ID, KDF_LABEL_PREFIX, PWHASH_ALGORITHM, PWHASH_OUTPUT_BYTES, PWHASH_SALT_BYTES, RECOMMENDED_PARAMS, aeadDecrypt, aeadEncrypt, generateSalt, getLastUsageRecord, hashUtf8, kemDecapsulate, kemEncapsulate, kemEncapsulateDeterministic, kemExpandedSecretKey, kemGenerateKeypair, kemKeypairFromSeed, labeledKdf, labeledKdf32, pwhashDeriveKey, runSelfTests, shake256, sigExpandedSecretKey, sigGenerateKeypair, sigKeypairFromSeed, sigSign, sigSignWithContext, sigVerify, sigVerifyWithContext, zeroize
+} from "./enclave_pqc_primitives_wasm_bg.js";