@heossi/qnsi 0.3.2

package/dist/browser/encrypt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt.js","sourceRoot":"","sources":["../../src/browser/encrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,mDAAmD;AACnD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;AAEjF,oCAAoC;AACpC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,qCAAqC;AACrC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,oCAAoC;AACpC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAiB7B;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,SAAqB,EACrB,SAAqB,EACrB,SAAuB;IAEvB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACd,cAAc,SAAS,8CAA8C;YACpE,cAAc,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IAErC,uDAAuD;IACvD,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC;QAC9E,SAAS;QACT,SAAS;KACT,CAAC,CAAC;IAEH,oDAAoD;IACpD,MAAM,WAAW,GAAG,IAAI,UAAU,CACjC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC,UAAU,GAAG,iBAAiB,CAAC,CACpE,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE;QAC5F,SAAS;KACT,CAAC,CAAC;IAEH,6BAA6B;IAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAEpE,8BAA8B;IAC9B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,EACpD,MAAM,EACN,IAAI,UAAU,CAAC,SAAS,CAA4B,CACpD,CAAC;IAEF,OAAO;QACN,SAAS;QACT,aAAa,EAAE,IAAI,UAAU,CAAC,aAAa,CAAC;QAC5C,EAAE,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC;QACtB,UAAU,EAAE,IAAI,UAAU,CAAC,SAAS,CAAC;KACrC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,QAAqB,EACrB,UAAsB;IAEtB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACd,cAAc,QAAQ,CAAC,SAAS,8CAA8C;YAC7E,cAAc,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IAErC,0CAA0C;IAC1C,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC;QAC/C,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,UAAU,EAAE,QAAQ,CAAC,aAAa;QAClC,UAAU;KACV,CAAC,CAAC;IAEH,oDAAoD;IACpD,MAAM,WAAW,GAAG,IAAI,UAAU,CACjC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC,UAAU,GAAG,iBAAiB,CAAC,CACpE,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE;QAC5F,SAAS;KACT,CAAC,CAAC;IAEH,8BAA8B;IAC9B,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAA4B,CAAC;IACrF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAA4B,CAAC;IACrE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAC3D,MAAM,EACN,aAAa,CACb,CAAC;IAEF,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAqB;IACzD,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACpE,MAAM,QAAQ,GACb,CAAC;QACD,cAAc,CAAC,MAAM;QACrB,CAAC;QACD,QAAQ,CAAC,aAAa,CAAC,MAAM;QAC7B,CAAC;QACD,QAAQ,CAAC,EAAE,CAAC,MAAM;QAClB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;IAE5B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,mDAAmD;IACnD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,IAAI,CAAC,CAAC;IACZ,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC;IAEhC,mDAAmD;IACnD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,IAAI,CAAC,CAAC;IACZ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC;IAExC,0BAA0B;IAC1B,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC;IACpC,MAAM,IAAI,CAAC,CAAC;IACZ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,IAAI,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC;IAE7B,mCAAmC;IACnC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAExC,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAgB;IACtD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,iBAAiB;IACjB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,CAAC,CAAC;IACZ,IAAI,MAAM,GAAG,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACzC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAAC,CACzB,CAAC;IAClB,MAAM,IAAI,YAAY,CAAC;IAEvB,iBAAiB;IACjB,IAAI,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,IAAI,CAAC,CAAC;IACZ,IAAI,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC,CAAC;IAC5D,MAAM,IAAI,QAAQ,CAAC;IAEnB,KAAK;IACL,IAAI,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,CAAC,CAAC;IACZ,IAAI,MAAM,GAAG,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;IAC9C,MAAM,IAAI,KAAK,CAAC;IAEhB,mCAAmC;IACnC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;AACrD,CAAC"}

package/dist/browser/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * `@heossi/qnsi/browser` — browser-compatible PQC encryption subpath.
+ *
+ * Client-side encryption (CSE), digital signatures, and key management
+ * using NIST FIPS 203/204/205 standards via @noble/post-quantum.
+ *
+ * No native dependencies. No `node:` imports. Works in browsers, Deno,
+ * Bun, and Node.js. Folded in from the former standalone
+ * `@heossi/qnsi-browser` package (2026-05-16) so there is one install.
+ *
+ * Supported algorithms:
+ * - ML-KEM (FIPS 203): kyber-512, kyber-768, kyber-1024 — key encapsulation
+ * - ML-DSA (FIPS 204): dilithium-2, dilithium-3, dilithium-5 — digital signatures
+ * - SLH-DSA (FIPS 205): 12 parameter sets — hash-based signatures
+ *
+ * @example
+ * ```ts
+ * import {
+ *   initializePqcProvider,
+ *   encryptBeforeUpload,
+ *   decryptAfterDownload,
+ * } from "@heossi/qnsi/browser";
+ *
+ * await initializePqcProvider();
+ * const { publicKey, privateKey } = await generateEncryptionKeyPair("kyber-768");
+ * const envelope = await encryptBeforeUpload(plaintext, publicKey, "kyber-768");
+ * const decrypted = await decryptAfterDownload(envelope, privateKey);
+ * ```
+ *
+ * @module
+ */
+export type { SdkActivationConfig, SdkActivationLimits, SdkActivationResponse, SdkIdentifier, } from "../_activation/index.js";
+export { SdkActivationError_ } from "../_activation/index.js";
+export { type CseEnvelope, decryptAfterDownload, deserializeCseEnvelope, encryptBeforeUpload, serializeCseEnvelope, } from "./encrypt.js";
+export type { PqcAlgorithm, PqcKeyPair, PqcProvider } from "./pqc-types.js";
+export { detectRuntime, getActiveProvider, getLastActivation, getSupportedAlgorithms, type InitializePqcProviderOptions, initializePqcProvider, isProviderInitialized, NOBLE_SUPPORTED_ALGORITHMS, type RuntimeEnvironment, resetProvider, } from "./provider-setup.js";
+export { generateEncryptionKeyPair, generateSigningKeyPair, type SignedEnvelope, signData, verifySignature, } from "./sign.js";
+export { type BrowserSdkTelemetryConfig, type BrowserSdkTelemetryEvent, configureTelemetry, flushTelemetry, getTelemetryConfig, isTelemetryEnabled, recordTelemetryEvent, resetTelemetry, } from "./telemetry.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/browser/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/browser/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH,YAAY,EACX,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,GACb,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EACN,KAAK,WAAW,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,GACpB,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE5E,OAAO,EACN,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,4BAA4B,EACjC,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,kBAAkB,EACvB,aAAa,GACb,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACN,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,cAAc,EACnB,QAAQ,EACR,eAAe,GACf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACN,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,GACd,MAAM,gBAAgB,CAAC"}

package/dist/browser/index.js

@@ -0,0 +1,41 @@
+/**
+ * `@heossi/qnsi/browser` — browser-compatible PQC encryption subpath.
+ *
+ * Client-side encryption (CSE), digital signatures, and key management
+ * using NIST FIPS 203/204/205 standards via @noble/post-quantum.
+ *
+ * No native dependencies. No `node:` imports. Works in browsers, Deno,
+ * Bun, and Node.js. Folded in from the former standalone
+ * `@heossi/qnsi-browser` package (2026-05-16) so there is one install.
+ *
+ * Supported algorithms:
+ * - ML-KEM (FIPS 203): kyber-512, kyber-768, kyber-1024 — key encapsulation
+ * - ML-DSA (FIPS 204): dilithium-2, dilithium-3, dilithium-5 — digital signatures
+ * - SLH-DSA (FIPS 205): 12 parameter sets — hash-based signatures
+ *
+ * @example
+ * ```ts
+ * import {
+ *   initializePqcProvider,
+ *   encryptBeforeUpload,
+ *   decryptAfterDownload,
+ * } from "@heossi/qnsi/browser";
+ *
+ * await initializePqcProvider();
+ * const { publicKey, privateKey } = await generateEncryptionKeyPair("kyber-768");
+ * const envelope = await encryptBeforeUpload(plaintext, publicKey, "kyber-768");
+ * const decrypted = await decryptAfterDownload(envelope, privateKey);
+ * ```
+ *
+ * @module
+ */
+export { SdkActivationError_ } from "../_activation/index.js";
+// Client-side encryption (CSE) helpers
+export { decryptAfterDownload, deserializeCseEnvelope, encryptBeforeUpload, serializeCseEnvelope, } from "./encrypt.js";
+// Provider setup and auto-detection
+export { detectRuntime, getActiveProvider, getLastActivation, getSupportedAlgorithms, initializePqcProvider, isProviderInitialized, NOBLE_SUPPORTED_ALGORITHMS, resetProvider, } from "./provider-setup.js";
+// Digital signature helpers
+export { generateEncryptionKeyPair, generateSigningKeyPair, signData, verifySignature, } from "./sign.js";
+// Telemetry hooks (opt-in, no PII)
+export { configureTelemetry, flushTelemetry, getTelemetryConfig, isTelemetryEnabled, recordTelemetryEvent, resetTelemetry, } from "./telemetry.js";
+//# sourceMappingURL=index.js.map

package/dist/browser/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/browser/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAUH,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,uCAAuC;AACvC,OAAO,EAEN,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,GACpB,MAAM,cAAc,CAAC;AAGtB,oCAAoC;AACpC,OAAO,EACN,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EAEtB,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAE1B,aAAa,GACb,MAAM,qBAAqB,CAAC;AAC7B,4BAA4B;AAC5B,OAAO,EACN,yBAAyB,EACzB,sBAAsB,EAEtB,QAAQ,EACR,eAAe,GACf,MAAM,WAAW,CAAC;AACnB,mCAAmC;AACnC,OAAO,EAGN,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,GACd,MAAM,gBAAgB,CAAC"}

package/dist/browser/noble-provider.d.ts

@@ -0,0 +1,10 @@
+import type { PqcAlgorithm, PqcProvider } from "./pqc-types.js";
+export declare const NOBLE_SUPPORTED_ALGORITHMS: readonly PqcAlgorithm[];
+export declare function createNobleProvider(options?: {
+    readonly algorithms?: readonly PqcAlgorithm[];
+}): PqcProvider;
+export declare function createNobleProviderFactory(): (options?: {
+    readonly algorithms?: readonly PqcAlgorithm[];
+}) => Promise<PqcProvider>;
+export declare function registerNobleProvider(): void;
+//# sourceMappingURL=noble-provider.d.ts.map

package/dist/browser/noble-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"noble-provider.d.ts","sourceRoot":"","sources":["../../src/browser/noble-provider.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,YAAY,EAAc,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE5E,eAAO,MAAM,0BAA0B,EAAE,SAAS,YAAY,EAmB7D,CAAC;AA6CF,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CAC9C,GAAG,WAAW,CAoEd;AAED,wBAAgB,0BAA0B,KAC3B,UAAU;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CAC9C,KAAG,OAAO,CAAC,WAAW,CAAC,CAGxB;AAED,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C"}

package/dist/browser/noble-provider.js

@@ -0,0 +1,130 @@
+import { ml_dsa44, ml_dsa65, ml_dsa87 } from "@noble/post-quantum/ml-dsa.js";
+import { ml_kem512, ml_kem768, ml_kem1024 } from "@noble/post-quantum/ml-kem.js";
+import { slh_dsa_sha2_128f, slh_dsa_sha2_128s, slh_dsa_sha2_192f, slh_dsa_sha2_192s, slh_dsa_sha2_256f, slh_dsa_sha2_256s, slh_dsa_shake_128f, slh_dsa_shake_128s, slh_dsa_shake_192f, slh_dsa_shake_192s, slh_dsa_shake_256f, slh_dsa_shake_256s, } from "@noble/post-quantum/slh-dsa.js";
+export const NOBLE_SUPPORTED_ALGORITHMS = [
+    "kyber-512",
+    "kyber-768",
+    "kyber-1024",
+    "dilithium-2",
+    "dilithium-3",
+    "dilithium-5",
+    "sphincs-sha2-128f-simple",
+    "sphincs-sha2-128s-simple",
+    "sphincs-sha2-192f-simple",
+    "sphincs-sha2-192s-simple",
+    "sphincs-sha2-256f-simple",
+    "sphincs-sha2-256s-simple",
+    "sphincs-shake-128f-simple",
+    "sphincs-shake-128s-simple",
+    "sphincs-shake-192f-simple",
+    "sphincs-shake-192s-simple",
+    "sphincs-shake-256f-simple",
+    "sphincs-shake-256s-simple",
+];
+const KEM_BY_ALG = {
+    "kyber-512": ml_kem512,
+    "kyber-768": ml_kem768,
+    "kyber-1024": ml_kem1024,
+};
+const SIGNER_BY_ALG = {
+    "dilithium-2": ml_dsa44,
+    "dilithium-3": ml_dsa65,
+    "dilithium-5": ml_dsa87,
+    "sphincs-sha2-128f-simple": slh_dsa_sha2_128f,
+    "sphincs-sha2-128s-simple": slh_dsa_sha2_128s,
+    "sphincs-sha2-192f-simple": slh_dsa_sha2_192f,
+    "sphincs-sha2-192s-simple": slh_dsa_sha2_192s,
+    "sphincs-sha2-256f-simple": slh_dsa_sha2_256f,
+    "sphincs-sha2-256s-simple": slh_dsa_sha2_256s,
+    "sphincs-shake-128f-simple": slh_dsa_shake_128f,
+    "sphincs-shake-128s-simple": slh_dsa_shake_128s,
+    "sphincs-shake-192f-simple": slh_dsa_shake_192f,
+    "sphincs-shake-192s-simple": slh_dsa_shake_192s,
+    "sphincs-shake-256f-simple": slh_dsa_shake_256f,
+    "sphincs-shake-256s-simple": slh_dsa_shake_256s,
+};
+function assertSupportedAlgorithm(algorithm, enabled) {
+    if (!enabled.has(algorithm)) {
+        throw new Error(`Algorithm '${algorithm}' is not enabled in this provider instance. Enabled: ${[...enabled].join(", ")}`);
+    }
+}
+function getKem(algorithm) {
+    return KEM_BY_ALG[algorithm];
+}
+function getSigner(algorithm) {
+    return SIGNER_BY_ALG[algorithm];
+}
+export function createNobleProvider(options) {
+    const enabled = new Set(options?.algorithms ?? NOBLE_SUPPORTED_ALGORITHMS);
+    return {
+        name: "noble",
+        async generateKeyPair({ algorithm }) {
+            assertSupportedAlgorithm(algorithm, enabled);
+            const kem = getKem(algorithm);
+            if (kem) {
+                const kp = kem.keygen();
+                return {
+                    keyPair: {
+                        algorithm,
+                        publicKey: kp.publicKey,
+                        privateKey: kp.secretKey,
+                    },
+                };
+            }
+            const signer = getSigner(algorithm);
+            if (!signer) {
+                throw new Error(`Unsupported algorithm '${algorithm}'`);
+            }
+            const kp = signer.keygen();
+            return {
+                keyPair: {
+                    algorithm,
+                    publicKey: kp.publicKey,
+                    privateKey: kp.secretKey,
+                },
+            };
+        },
+        async encapsulate({ algorithm, publicKey, }) {
+            assertSupportedAlgorithm(algorithm, enabled);
+            const kem = getKem(algorithm);
+            if (!kem) {
+                throw new Error(`Algorithm '${algorithm}' is not a KEM algorithm`);
+            }
+            const { cipherText, sharedSecret } = kem.encapsulate(publicKey);
+            return { ciphertext: cipherText, sharedSecret };
+        },
+        async decapsulate({ algorithm, ciphertext, privateKey }) {
+            assertSupportedAlgorithm(algorithm, enabled);
+            const kem = getKem(algorithm);
+            if (!kem) {
+                throw new Error(`Algorithm '${algorithm}' is not a KEM algorithm`);
+            }
+            return kem.decapsulate(ciphertext, privateKey);
+        },
+        async sign({ algorithm, data, privateKey }) {
+            assertSupportedAlgorithm(algorithm, enabled);
+            const signer = getSigner(algorithm);
+            if (!signer) {
+                throw new Error(`Algorithm '${algorithm}' is not a signature algorithm`);
+            }
+            return { signature: signer.sign(data, privateKey) };
+        },
+        async verify({ algorithm, data, signature, publicKey }) {
+            assertSupportedAlgorithm(algorithm, enabled);
+            const signer = getSigner(algorithm);
+            if (!signer) {
+                throw new Error(`Algorithm '${algorithm}' is not a signature algorithm`);
+            }
+            return signer.verify(signature, data, publicKey);
+        },
+    };
+}
+export function createNobleProviderFactory() {
+    return async (options) => {
+        return createNobleProvider(options);
+    };
+}
+export function registerNobleProvider() {
+    // no-op; kept for backwards compatibility
+}
+//# sourceMappingURL=noble-provider.js.map

package/dist/browser/noble-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"noble-provider.js","sourceRoot":"","sources":["../../src/browser/noble-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EACN,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,gCAAgC,CAAC;AAKxC,MAAM,CAAC,MAAM,0BAA0B,GAA4B;IAClE,WAAW;IACX,WAAW;IACX,YAAY;IACZ,aAAa;IACb,aAAa;IACb,aAAa;IACb,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;CAC3B,CAAC;AAEF,MAAM,UAAU,GAAkC;IACjD,WAAW,EAAE,SAAS;IACtB,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE,UAAU;CACf,CAAC;AAEX,MAAM,aAAa,GAAqC;IACvD,aAAa,EAAE,QAAQ;IACvB,aAAa,EAAE,QAAQ;IACvB,aAAa,EAAE,QAAQ;IACvB,0BAA0B,EAAE,iBAAiB;IAC7C,0BAA0B,EAAE,iBAAiB;IAC7C,0BAA0B,EAAE,iBAAiB;IAC7C,0BAA0B,EAAE,iBAAiB;IAC7C,0BAA0B,EAAE,iBAAiB;IAC7C,0BAA0B,EAAE,iBAAiB;IAC7C,2BAA2B,EAAE,kBAAkB;IAC/C,2BAA2B,EAAE,kBAAkB;IAC/C,2BAA2B,EAAE,kBAAkB;IAC/C,2BAA2B,EAAE,kBAAkB;IAC/C,2BAA2B,EAAE,kBAAkB;IAC/C,2BAA2B,EAAE,kBAAkB;CACtC,CAAC;AAEX,SAAS,wBAAwB,CAChC,SAAuB,EACvB,OAAkC;IAElC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACd,cAAc,SAAS,wDAAwD,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxG,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,MAAM,CAAC,SAAuB;IACtC,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,SAAS,CAAC,SAAuB;IACzC,OAAO,aAAa,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAEnC;IACA,MAAM,OAAO,GAAG,IAAI,GAAG,CAAe,OAAO,EAAE,UAAU,IAAI,0BAA0B,CAAC,CAAC;IAEzF,OAAO;QACN,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE;YAClC,wBAAwB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9B,IAAI,GAAG,EAAE,CAAC;gBACT,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;gBACxB,OAAO;oBACN,OAAO,EAAE;wBACR,SAAS;wBACT,SAAS,EAAE,EAAE,CAAC,SAAS;wBACvB,UAAU,EAAE,EAAE,CAAC,SAAS;qBACxB;iBACD,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,SAAS,GAAG,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC3B,OAAO;gBACN,OAAO,EAAE;oBACR,SAAS;oBACT,SAAS,EAAE,EAAE,CAAC,SAAS;oBACvB,UAAU,EAAE,EAAE,CAAC,SAAS;iBACxB;aACD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,EACjB,SAAS,EACT,SAAS,GACT;YACA,wBAAwB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,cAAc,SAAS,0BAA0B,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YAChE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE;YACtD,wBAAwB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,cAAc,SAAS,0BAA0B,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAChD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE;YACzC,wBAAwB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,cAAc,SAAS,gCAAgC,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;QACrD,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE;YACrD,wBAAwB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,cAAc,SAAS,gCAAgC,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAClD,CAAC;KACD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B;IACzC,OAAO,KAAK,EAAE,OAEb,EAAwB,EAAE;QAC1B,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB;IACpC,0CAA0C;AAC3C,CAAC"}

package/dist/browser/pqc-types.d.ts

@@ -0,0 +1,40 @@
+export type PqcAlgorithm = "kyber-512" | "kyber-768" | "kyber-1024" | "dilithium-2" | "dilithium-3" | "dilithium-5" | "sphincs-sha2-128f-simple" | "sphincs-sha2-128s-simple" | "sphincs-sha2-192f-simple" | "sphincs-sha2-192s-simple" | "sphincs-sha2-256f-simple" | "sphincs-sha2-256s-simple" | "sphincs-shake-128f-simple" | "sphincs-shake-128s-simple" | "sphincs-shake-192f-simple" | "sphincs-shake-192s-simple" | "sphincs-shake-256f-simple" | "sphincs-shake-256s-simple";
+export interface PqcKeyPair {
+    readonly algorithm: PqcAlgorithm;
+    readonly publicKey: Uint8Array;
+    readonly privateKey: Uint8Array;
+}
+export interface PqcProvider {
+    readonly name: string;
+    generateKeyPair(input: {
+        readonly algorithm: PqcAlgorithm;
+    }): Promise<{
+        readonly keyPair: PqcKeyPair;
+    }>;
+    encapsulate(input: {
+        readonly algorithm: PqcAlgorithm;
+        readonly publicKey: Uint8Array;
+    }): Promise<{
+        readonly ciphertext: Uint8Array;
+        readonly sharedSecret: Uint8Array;
+    }>;
+    decapsulate(input: {
+        readonly algorithm: PqcAlgorithm;
+        readonly ciphertext: Uint8Array;
+        readonly privateKey: Uint8Array;
+    }): Promise<Uint8Array>;
+    sign(input: {
+        readonly algorithm: PqcAlgorithm;
+        readonly data: Uint8Array;
+        readonly privateKey: Uint8Array;
+    }): Promise<{
+        readonly signature: Uint8Array;
+    }>;
+    verify(input: {
+        readonly algorithm: PqcAlgorithm;
+        readonly data: Uint8Array;
+        readonly signature: Uint8Array;
+        readonly publicKey: Uint8Array;
+    }): Promise<boolean>;
+}
+//# sourceMappingURL=pqc-types.d.ts.map

package/dist/browser/pqc-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pqc-types.d.ts","sourceRoot":"","sources":["../../src/browser/pqc-types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GACrB,WAAW,GACX,WAAW,GACX,YAAY,GACZ,aAAa,GACb,aAAa,GACb,aAAa,GACb,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,CAAC;AAE/B,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,KAAK,EAAE;QACtB,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;KACjC,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IAC9C,WAAW,CAAC,KAAK,EAAE;QAClB,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;QACjC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;KAC/B,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IACpF,WAAW,CAAC,KAAK,EAAE;QAClB,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;QACjC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;QAChC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;KAChC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,IAAI,CAAC,KAAK,EAAE;QACX,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;QACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;KAChC,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,EAAE;QACb,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;QACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QAC1B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;QAC/B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;KAC/B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB"}

package/dist/browser/pqc-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pqc-types.js.map

package/dist/browser/pqc-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pqc-types.js","sourceRoot":"","sources":["../../src/browser/pqc-types.ts"],"names":[],"mappings":""}

package/dist/browser/provider-setup.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Provider auto-detection and registration for browser-sdk.
+ *
+ * In browser environments, uses a noble-backed provider (pure JS, 18 FIPS algorithms).
+ * In Node.js environments, uses the same noble-backed provider for deterministic behavior.
+ *
+ * @module
+ */
+import { type SdkActivationResponse } from "../_activation/index.js";
+import { createNobleProviderFactory, NOBLE_SUPPORTED_ALGORITHMS } from "./noble-provider.js";
+import type { PqcAlgorithm, PqcProvider } from "./pqc-types.js";
+/** Runtime environment detection result. */
+export type RuntimeEnvironment = "browser" | "node" | "edge";
+/** Options for initializing the PQC provider. */
+export interface InitializePqcProviderOptions {
+    /** QNSP API key — required. Get one at https://cloud.qnsp.cuilabs.io/signup */
+    readonly apiKey: string;
+    /** Optional subset of algorithms to enable. Defaults to all noble-supported. */
+    readonly algorithms?: readonly PqcAlgorithm[] | undefined;
+    /** Override platform URL (defaults to https://api.qnsp.cuilabs.io) */
+    readonly platformUrl?: string | undefined;
+}
+/**
+ * Detect the current runtime environment.
+ *
+ * - "browser": window/document available (standard browser)
+ * - "edge": no window but no process.versions.node (Cloudflare Workers, Deno Deploy, Vercel Edge)
+ * - "node": process.versions.node available (Node.js, Bun with node compat)
+ */
+export declare function detectRuntime(): RuntimeEnvironment;
+/**
+ * Initialize the PQC provider for the current runtime.
+ *
+ * Requires a valid QNSP API key. The SDK activates against the QNSP platform
+ * to validate the key and retrieve tier limits before enabling PQC operations.
+ *
+ * In browser/edge: always uses noble (pure JS, no native deps).
+ * In Node.js: uses noble for deterministic behavior.
+ *
+ * @param options - Configuration including apiKey (required) and optional algorithm subset.
+ * @returns The initialized PqcProvider instance.
+ * @throws {SdkActivationError_} if the API key is invalid or activation fails.
+ */
+export declare function initializePqcProvider(options: InitializePqcProviderOptions): Promise<PqcProvider>;
+/**
+ * Get the last SDK activation response (tier, limits, token).
+ * Returns null if not yet activated.
+ */
+export declare function getLastActivation(): SdkActivationResponse | null;
+/**
+ * Get the currently active PQC provider.
+ * Throws if initializePqcProvider() has not been called.
+ */
+export declare function getActiveProvider(): PqcProvider;
+/**
+ * Check if the PQC provider has been initialized.
+ */
+export declare function isProviderInitialized(): boolean;
+/**
+ * Reset the provider state. Primarily for testing.
+ */
+export declare function resetProvider(): void;
+/**
+ * Get the list of algorithms supported in the current environment.
+ * In browser/edge: noble's 18 FIPS algorithms.
+ * In Node.js: noble's 18 FIPS algorithms.
+ */
+export declare function getSupportedAlgorithms(): readonly PqcAlgorithm[];
+export { createNobleProviderFactory, NOBLE_SUPPORTED_ALGORITHMS };
+//# sourceMappingURL=provider-setup.d.ts.map

package/dist/browser/provider-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-setup.d.ts","sourceRoot":"","sources":["../../src/browser/provider-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAe,KAAK,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAEN,0BAA0B,EAC1B,0BAA0B,EAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGhE,4CAA4C;AAC5C,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAE7D,iDAAiD;AACjD,MAAM,WAAW,4BAA4B;IAC5C,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;IAC1D,sEAAsE;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,IAAI,kBAAkB,CASlD;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,4BAA4B,GACnC,OAAO,CAAC,WAAW,CAAC,CAoBtB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,qBAAqB,GAAG,IAAI,CAEhE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,WAAW,CAK/C;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAGpC;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,SAAS,YAAY,EAAE,CAEhE;AAED,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,CAAC"}

package/dist/browser/provider-setup.js

@@ -0,0 +1,101 @@
+/**
+ * Provider auto-detection and registration for browser-sdk.
+ *
+ * In browser environments, uses a noble-backed provider (pure JS, 18 FIPS algorithms).
+ * In Node.js environments, uses the same noble-backed provider for deterministic behavior.
+ *
+ * @module
+ */
+import { activateSdk } from "../_activation/index.js";
+import { createNobleProvider, createNobleProviderFactory, NOBLE_SUPPORTED_ALGORITHMS, } from "./noble-provider.js";
+import { SDK_PACKAGE_VERSION } from "./sdk-package-version.js";
+/**
+ * Detect the current runtime environment.
+ *
+ * - "browser": window/document available (standard browser)
+ * - "edge": no window but no process.versions.node (Cloudflare Workers, Deno Deploy, Vercel Edge)
+ * - "node": process.versions.node available (Node.js, Bun with node compat)
+ */
+export function detectRuntime() {
+    if (typeof globalThis.process !== "undefined" && globalThis.process.versions?.node) {
+        return "node";
+    }
+    // Use string-based property check to avoid needing DOM lib types
+    if ("window" in globalThis && "document" in globalThis) {
+        return "browser";
+    }
+    return "edge";
+}
+let initialized = false;
+let activeProvider = null;
+let lastActivation = null;
+/**
+ * Initialize the PQC provider for the current runtime.
+ *
+ * Requires a valid QNSP API key. The SDK activates against the QNSP platform
+ * to validate the key and retrieve tier limits before enabling PQC operations.
+ *
+ * In browser/edge: always uses noble (pure JS, no native deps).
+ * In Node.js: uses noble for deterministic behavior.
+ *
+ * @param options - Configuration including apiKey (required) and optional algorithm subset.
+ * @returns The initialized PqcProvider instance.
+ * @throws {SdkActivationError_} if the API key is invalid or activation fails.
+ */
+export async function initializePqcProvider(options) {
+    if (activeProvider) {
+        return activeProvider;
+    }
+    // Activate SDK against QNSP platform — validates API key, returns tier limits
+    const activation = await activateSdk({
+        apiKey: options.apiKey,
+        sdkId: "browser-sdk",
+        sdkVersion: SDK_PACKAGE_VERSION,
+        platformUrl: options.platformUrl,
+    });
+    lastActivation = activation;
+    const provider = createNobleProvider(options.algorithms ? { algorithms: options.algorithms } : undefined);
+    activeProvider = provider;
+    initialized = true;
+    return provider;
+}
+/**
+ * Get the last SDK activation response (tier, limits, token).
+ * Returns null if not yet activated.
+ */
+export function getLastActivation() {
+    return lastActivation;
+}
+/**
+ * Get the currently active PQC provider.
+ * Throws if initializePqcProvider() has not been called.
+ */
+export function getActiveProvider() {
+    if (!activeProvider) {
+        throw new Error("PQC provider not initialized. Call initializePqcProvider() first.");
+    }
+    return activeProvider;
+}
+/**
+ * Check if the PQC provider has been initialized.
+ */
+export function isProviderInitialized() {
+    return initialized;
+}
+/**
+ * Reset the provider state. Primarily for testing.
+ */
+export function resetProvider() {
+    activeProvider = null;
+    initialized = false;
+}
+/**
+ * Get the list of algorithms supported in the current environment.
+ * In browser/edge: noble's 18 FIPS algorithms.
+ * In Node.js: noble's 18 FIPS algorithms.
+ */
+export function getSupportedAlgorithms() {
+    return NOBLE_SUPPORTED_ALGORITHMS;
+}
+export { createNobleProviderFactory, NOBLE_SUPPORTED_ALGORITHMS };
+//# sourceMappingURL=provider-setup.js.map

package/dist/browser/provider-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-setup.js","sourceRoot":"","sources":["../../src/browser/provider-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAA8B,MAAM,yBAAyB,CAAC;AAClF,OAAO,EACN,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAe/D;;;;;;GAMG;AACH,MAAM,UAAU,aAAa;IAC5B,IAAI,OAAO,UAAU,CAAC,OAAO,KAAK,WAAW,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QACpF,OAAO,MAAM,CAAC;IACf,CAAC;IACD,iEAAiE;IACjE,IAAI,QAAQ,IAAI,UAAU,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;QACxD,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,IAAI,WAAW,GAAG,KAAK,CAAC;AACxB,IAAI,cAAc,GAAuB,IAAI,CAAC;AAC9C,IAAI,cAAc,GAAiC,IAAI,CAAC;AAExD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAqC;IAErC,IAAI,cAAc,EAAE,CAAC;QACpB,OAAO,cAAc,CAAC;IACvB,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,aAAa;QACpB,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,OAAO,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,cAAc,GAAG,UAAU,CAAC;IAE5B,MAAM,QAAQ,GAAG,mBAAmB,CACnC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CACnE,CAAC;IACF,cAAc,GAAG,QAAQ,CAAC;IAC1B,WAAW,GAAG,IAAI,CAAC;IACnB,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAChC,OAAO,cAAc,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAChC,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,cAAc,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACpC,OAAO,WAAW,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IAC5B,cAAc,GAAG,IAAI,CAAC;IACtB,WAAW,GAAG,KAAK,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACrC,OAAO,0BAA0B,CAAC;AACnC,CAAC;AAED,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,CAAC"}

package/dist/browser/sdk-package-version.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Published semver — used for SDK activation metering (must match the npm
+ * publish version of `@heossi/qnsi`).
+ *
+ * Kept as a literal (not a `../package.json` JSON import) because this module
+ * must stay browser-safe — no `node:fs` runtime read — and a static JSON
+ * import would resolve outside the package `rootDir` (TS6059). This mirrors
+ * the same release-bump contract as `SDK_VERSION` in `../_internal.ts`:
+ * **bump this in lockstep with `packages/qnsp/package.json` `version`.**
+ */
+export declare const SDK_PACKAGE_VERSION = "0.3.0";
+//# sourceMappingURL=sdk-package-version.d.ts.map

package/dist/browser/sdk-package-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-package-version.d.ts","sourceRoot":"","sources":["../../src/browser/sdk-package-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,UAAU,CAAC"}

package/dist/browser/sdk-package-version.js

@@ -0,0 +1,12 @@
+/**
+ * Published semver — used for SDK activation metering (must match the npm
+ * publish version of `@heossi/qnsi`).
+ *
+ * Kept as a literal (not a `../package.json` JSON import) because this module
+ * must stay browser-safe — no `node:fs` runtime read — and a static JSON
+ * import would resolve outside the package `rootDir` (TS6059). This mirrors
+ * the same release-bump contract as `SDK_VERSION` in `../_internal.ts`:
+ * **bump this in lockstep with `packages/qnsp/package.json` `version`.**
+ */
+export const SDK_PACKAGE_VERSION = "0.3.0";
+//# sourceMappingURL=sdk-package-version.js.map

package/dist/browser/sdk-package-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-package-version.js","sourceRoot":"","sources":["../../src/browser/sdk-package-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC"}

package/dist/browser/sign.d.ts

@@ -0,0 +1,65 @@
+/**
+ * PQC digital signature helpers for browser-side operations.
+ *
+ * Supports:
+ * - ML-DSA (FIPS 204): dilithium-2, dilithium-3, dilithium-5
+ * - SLH-DSA (FIPS 205): all 12 parameter sets (SHA-2 and SHAKE variants)
+ *
+ * No node: imports. Works in browsers, Deno, Bun, and Node.js 20+.
+ *
+ * @module
+ */
+import type { PqcAlgorithm } from "./pqc-types.js";
+/**
+ * Signed data envelope containing the signature and metadata.
+ */
+export interface SignedEnvelope {
+    /** PQC algorithm used for signing. */
+    readonly algorithm: PqcAlgorithm;
+    /** The digital signature bytes. */
+    readonly signature: Uint8Array;
+    /** The original data that was signed. */
+    readonly data: Uint8Array;
+}
+/**
+ * Sign data using a PQC signature algorithm.
+ *
+ * @param data - Data to sign
+ * @param privateKey - Signer's PQC private key
+ * @param algorithm - Signature algorithm (ML-DSA or SLH-DSA)
+ * @returns Signed envelope containing signature + original data
+ */
+export declare function signData(data: Uint8Array, privateKey: Uint8Array, algorithm: PqcAlgorithm): Promise<SignedEnvelope>;
+/**
+ * Verify a PQC digital signature.
+ *
+ * @param data - Original data that was signed
+ * @param signature - The signature to verify
+ * @param publicKey - Signer's PQC public key
+ * @param algorithm - Signature algorithm used
+ * @returns true if the signature is valid, false otherwise
+ */
+export declare function verifySignature(data: Uint8Array, signature: Uint8Array, publicKey: Uint8Array, algorithm: PqcAlgorithm): Promise<boolean>;
+/**
+ * Generate a PQC key pair for signing operations.
+ *
+ * @param algorithm - Signature algorithm (ML-DSA or SLH-DSA)
+ * @returns Key pair with public and private keys
+ */
+export declare function generateSigningKeyPair(algorithm: PqcAlgorithm): Promise<{
+    readonly publicKey: Uint8Array;
+    readonly privateKey: Uint8Array;
+    readonly algorithm: PqcAlgorithm;
+}>;
+/**
+ * Generate a PQC key pair for KEM (encryption) operations.
+ *
+ * @param algorithm - KEM algorithm (kyber-512, kyber-768, kyber-1024)
+ * @returns Key pair with public and private keys
+ */
+export declare function generateEncryptionKeyPair(algorithm: PqcAlgorithm): Promise<{
+    readonly publicKey: Uint8Array;
+    readonly privateKey: Uint8Array;
+    readonly algorithm: PqcAlgorithm;
+}>;
+//# sourceMappingURL=sign.d.ts.map

package/dist/browser/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/browser/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAsBnD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC9B,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,mCAAmC;IACnC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAC7B,IAAI,EAAE,UAAU,EAChB,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,YAAY,GACrB,OAAO,CAAC,cAAc,CAAC,CA6BzB;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACpC,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,YAAY,GACrB,OAAO,CAAC,OAAO,CAAC,CA4BlB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,SAAS,EAAE,YAAY,GAAG,OAAO,CAAC;IAC9E,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;CACjC,CAAC,CAWD;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAAC,SAAS,EAAE,YAAY,GAAG,OAAO,CAAC;IACjF,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;CACjC,CAAC,CAYD"}