@noble/post-quantum 0.6.0 → 0.7.0

package/falcon.js

@@ -12,7 +12,7 @@ import { bytesToNumberLE, numberToHexUnpadded } from '@noble/curves/utils.js';
 import { shake256 } from '@noble/hashes/sha3.js';
 import { abytes, bytesToHex, createView, hexToBytes, randomBytes, swap32IfBE, u32, u8, } from '@noble/hashes/utils.js';
 import { genCrystals } from "./_crystals.js";
-import { cleanBytes, getMask, baswap64If, splitCoder, validateSigOpts, validateVerOpts, } from "./utils.js";
+import { baswap64If, cleanBytes, getMask, splitCoder, validateSigOpts, validateVerOpts, } from "./utils.js";
 /*
 FIPS-206 would likely improve the situation with spec.
 
@@ -124,10 +124,11 @@ const bitsCoderMSB = (newPoly, N, d, c) => {
 // encode() zeroizes the temporary encoded body after copying, so wrapped encoders must return
 // owned scratch bytes rather than caller-owned buffers.
 const headerCoder = (tag, restCoder) => {
+    const coder = restCoder;
     return {
-        bytesLen: 1 + restCoder.bytesLen,
+        bytesLen: 1 + coder.bytesLen,
         encode(value) {
-            const body = restCoder.encode(value);
+            const body = coder.encode(value);
             const out = new Uint8Array(1 + body.length);
             out[0] = tag;
             out.set(body, 1);
@@ -137,7 +138,7 @@ const headerCoder = (tag, restCoder) => {
         decode(data) {
             if (data[0] !== tag)
                 throw new Error(`wrong tag: expected ${tag}, got 0x${data[0]}`);
-            return restCoder.decode(data.subarray(1));
+            return coder.decode(data.subarray(1));
         },
     };
 };
@@ -377,7 +378,7 @@ const u8f = (arr) => new Uint8Array(arr.buffer, arr.byteOffset, arr.byteLength);
 const f64a = (arr) => new Float64Array(baswap64If(Uint8Array.from(arr.subarray(0, Math.floor(arr.byteLength / 8) * 8))).buffer);
 // Exact big-endian binary64 hex helper for constants. Only decode() is currently used; malformed
 // inputs fail through lower-level hex / DataView checks instead of an explicit wrapper guard.
-const Float = {
+const Float = /* @__PURE__ */ Object.freeze({
     encode(n) {
         const bytes = new Uint8Array(8);
         const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
@@ -389,7 +390,7 @@ const Float = {
         const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
         return view.getFloat64(0, false);
     },
-};
+});
 // Decode a 64-bit bigint bit pattern into the exact binary64 value.
 const f64b = (n) => Float.decode(numberToHexUnpadded(n));
 // Constants
@@ -402,6 +403,17 @@ const Q = 12289; // 12 * 1024 + 1
 // Falcon's midpoint floor(q/2); the only live use is the mirrored G-reconstruction reduction below.
 const Qhalf = Q >> 1;
 const QBig = BigInt(Q);
+const _0n = /* @__PURE__ */ BigInt(0);
+const _1n = /* @__PURE__ */ BigInt(1);
+const _10n = /* @__PURE__ */ BigInt(10);
+const _25n = /* @__PURE__ */ BigInt(25);
+const _31n = /* @__PURE__ */ BigInt(31);
+const _32n = /* @__PURE__ */ BigInt(32);
+const _63n = /* @__PURE__ */ BigInt(63);
+const _64n = /* @__PURE__ */ BigInt(64);
+// Low 32 bits and low 63 bits of a bigint, used by the chacha20 counter and gaussian sampler.
+const MASK_32n = /* @__PURE__ */ BigInt('0xffffffff');
+const MASK_63n = /* @__PURE__ */ BigInt('0x7fffffffffffffff');
 //const R = 4091; // 2^16 mod q
 // This 16-bit Montgomery kernel uses R = 2^16, so mul(x, R2) converts x into Montgomery form.
 const R2 = 10952; // 2^32 mod q
@@ -438,38 +450,38 @@ const BITLENGTH = [
 // Smaller Falcon dimensions reuse the N = 1024, q = 12289 table by summing 2^(10-logn) draws.
 // The trailing 0 sentinel guarantees gaussSingle()
 // always selects a tail bucket when x = 0 is missed.
-const gauss_1024_12289 = [
-    1283868770400643928n,
-    6416574995475331444n,
-    4078260278032692663n,
-    2353523259288686585n,
-    1227179971273316331n,
-    575931623374121527n,
-    242543240509105209n,
-    91437049221049666n,
-    30799446349977173n,
-    9255276791179340n,
-    2478152334826140n,
-    590642893610164n,
-    125206034929641n,
-    23590435911403n,
-    3948334035941n,
-    586753615614n,
-    77391054539n,
-    9056793210n,
-    940121950n,
-    86539696n,
-    7062824n,
-    510971n,
-    32764n,
-    1862n,
-    94n,
-    4n,
-    0n,
-];
+const gauss_1024_12289 = /* @__PURE__ */ [
+    '1283868770400643928',
+    '6416574995475331444',
+    '4078260278032692663',
+    '2353523259288686585',
+    '1227179971273316331',
+    '575931623374121527',
+    '242543240509105209',
+    '91437049221049666',
+    '30799446349977173',
+    '9255276791179340',
+    '2478152334826140',
+    '590642893610164',
+    '125206034929641',
+    '23590435911403',
+    '3948334035941',
+    '586753615614',
+    '77391054539',
+    '9056793210',
+    '940121950',
+    '86539696',
+    '7062824',
+    '510971',
+    '32764',
+    '1862',
+    '94',
+    '4',
+    '0',
+].map(BigInt);
 // Exact binary64 1/sigma payloads from round-3 fpr.h. Nearby decimal spellings round 1 ULP low in
 // JS, so keep these as decoded bit patterns and recheck the raw payloads after edits.
-const INV_SIGMA = [
+const INV_SIGMA = /* @__PURE__ */ Object.freeze([
     0.0, // unused
     f64b(BigInt('4574611497772390042')),
     f64b(BigInt('4574501679055810265')),
@@ -481,11 +493,11 @@ const INV_SIGMA = [
     f64b(BigInt('4573721358406441454')),
     f64b(BigInt('4573606369665796042')),
     f64b(BigInt('4573496814039276259')),
-];
+]);
 // Exact binary64 sigma_min constants from round-3 fpr.h indexed by logn; despite one PQClean
 // summary comment, these are sigma_min itself, not 1/sigma_min, which is why this table stays
 // separate from INV_SIGMA.
-const SIGMA_MIN = [
+const SIGMA_MIN = /* @__PURE__ */ Object.freeze([
     0.0, // unused
     f64b(BigInt('4607707126469777035')),
     f64b(BigInt('4607777455861499430')),
@@ -497,7 +509,7 @@ const SIGMA_MIN = [
     f64b(BigInt('4608340089478362016')),
     f64b(BigInt('4608433670533905013')),
     f64b(BigInt('4608525754002622308')),
-];
+]);
 // Falcon Table 3.1 RCDT values for chi, split into 24-bit limbs; storage is [high, mid, low],
 // so gaussian0() intentionally compares them against v0, v1, v2 in reverse order. The final
 // RCDT[18] = 0 row is omitted because the algorithm iterates only over i = 0..17.
@@ -1146,9 +1158,9 @@ function genFalcon(opts) {
             let val = 0;
             for (let i = 0; i < g; i++) {
                 const r128 = bytesToNumberLE(this.shake.xof(16));
-                const r1 = r128 & 0x7fffffffffffffffn;
-                const r2 = (r128 >> 64n) & 0x7fffffffffffffffn;
-                const sign = Number((r128 >> 63n) & 1n);
+                const r1 = r128 & MASK_63n;
+                const r2 = (r128 >> _64n) & MASK_63n;
+                const sign = Number((r128 >> _63n) & _1n);
                 let f = r1 < gauss_1024_12289[0] ? 1 : 0;
                 let v = 0;
                 for (let k = 1; k < gauss_1024_12289.length; k++) {
@@ -1185,7 +1197,7 @@ function genFalcon(opts) {
             const n = 1 << logn;
             const d = new Array(n >> 1);
             for (let k = 0; k < n; k += 2) {
-                let s = 0n;
+                let s = _0n;
                 for (let i = 0; i <= k; i += 2)
                     s += a[i] * a[k - i];
                 for (let i = k + 2; i < n; i += 2)
@@ -1193,7 +1205,7 @@ function genFalcon(opts) {
                 d[k >>> 1] = s;
             }
             for (let k = 0; k < n; k += 2) {
-                let s = 0n;
+                let s = _0n;
                 for (let i = 1; i < k; i += 2)
                     s += a[i] * a[k - i];
                 for (let i = k + 1; i < n; i += 2)
@@ -1205,7 +1217,7 @@ function genFalcon(opts) {
         mulConjD(logn, d, a, b) {
             const n = 1 << logn;
             for (let k = 0; k < n; k++) {
-                let s = 0n;
+                let s = _0n;
                 for (let i = 0; i <= k; i += 2)
                     s += b[i >>> 1] * a[k - i];
                 for (let i = k + 2 - (k & 1); i < n; i += 2)
@@ -1220,7 +1232,7 @@ function genFalcon(opts) {
         subMul(logn, a, b, c, e) {
             const n = 1 << logn;
             for (let k = 0; k < n; k++) {
-                let s = 0n;
+                let s = _0n;
                 for (let i = 0; i <= k; i++)
                     s += b[i] * c[k - i];
                 for (let i = k + 1; i < n; i++)
@@ -1264,7 +1276,7 @@ function genFalcon(opts) {
             const Gx = new Float64Array(n);
             const k = new Array(n);
             while (true) {
-                let scaleFG = 31n * (FGlen - 10n);
+                let scaleFG = _31n * (FGlen - _10n);
                 for (let i = 0; i < n; i++) {
                     Fx[i] = Number(F[i] >> scaleFG);
                     Gx[i] = Number(G[i] >> scaleFG);
@@ -1283,16 +1295,16 @@ function genFalcon(opts) {
                 }
                 F = this.subMul(logn, F, f, k, scaleK); // 3:     F ← F - kf
                 G = this.subMul(logn, G, g, k, scaleK); // 4:     G ← G - kg
-                const maxfgNew = scaleK + BigInt(Math.round(fgMaxBits)) + 10n;
+                const maxfgNew = scaleK + BigInt(Math.round(fgMaxBits)) + _10n;
                 if (maxfgNew < maxFGBits)
                     maxFGBits = maxfgNew;
-                if (FGlen > 1n && FGlen * 31n >= maxFGBits + 31n)
+                if (FGlen > _1n && FGlen * _31n >= maxFGBits + _31n)
                     FGlen--;
-                if (scaleK <= 0n)
+                if (scaleK <= _0n)
                     break;
-                scaleK -= 25n;
-                if (scaleK < 0n)
-                    scaleK = 0n;
+                scaleK -= _25n;
+                if (scaleK < _0n)
+                    scaleK = _0n;
             }
             return true;
         }
@@ -1320,11 +1332,11 @@ function genFalcon(opts) {
                 const xf = f[0];
                 const xg = g[0];
                 // We can rely on 'invert' to throw if they are not coprime.
-                if (xf <= 0n || xg <= 0n)
+                if (xf <= _0n || xg <= _0n)
                     return false;
                 try {
                     const u1 = invert(xf, xg); //  if gcd(f, g) ≠ 1 then
-                    const v1 = (1n - u1 * xf) / xg;
+                    const v1 = (_1n - u1 * xf) / xg;
                     F[0] = -v1 * QBig; // 5:     (F, G) ← (vq, uq)
                     G[0] = u1 * QBig;
                     return true;
@@ -1606,7 +1618,14 @@ function genFalcon(opts) {
                 return headerCoder(0x30 + logn, splitCoder('falcon.signature', NONCELEN, sigLen, msg.length)).encode([nonce, pad(sigLen).encode(s2), msg]);
             },
             decode(data) {
+                // Keep API misuse on the coder's TypeError path before reading the container length.
+                abytes(data, undefined, 'signature');
+                // The compressed-signature field is fixed-width here; only the message is variable. A
+                // container shorter than the fixed part would make the s2 field borrow bytes from nowhere
+                // and let a truncated encoding open to the same message.
                 const msgLen = data.length - NONCELEN - sigLen - 1;
+                if (msgLen < 0)
+                    throw new Error('signature coder: wrong length');
                 const [nonce, s2, msg] = headerCoder(0x30 + logn, splitCoder('falcon.signature', NONCELEN, sigLen, msgLen)).decode(data);
                 return { nonce, s2: decodeSig(s2), msg };
             },
@@ -1621,7 +1640,13 @@ function genFalcon(opts) {
                 return headerCoder(0x30 + logn, splitCoder('falcon.detachedSignature', NONCELEN, getSigLen(s2))).encode([nonce, opts.padded ? pad(sigLen).encode(s2) : s2]);
             },
             decode(data) {
-                const [nonce, raw] = headerCoder(0x30 + logn, splitCoder('falcon.detachedSignature', NONCELEN, data.length - NONCELEN - 1)).decode(data);
+                // Padded detached signatures are fixed-length (`lengths.signature`), so the payload width
+                // must come from the parameter set, not from the input: deriving it would accept appended
+                // zero bytes and truncated padding as extra valid encodings of the same signature.
+                // Unpadded signatures are variable-length; decodeUnpaddedSig() enforces the exact canonical
+                // bitlength of whatever remains.
+                const payloadLen = opts.padded ? sigLen : data.length - NONCELEN - 1;
+                const [nonce, raw] = headerCoder(0x30 + logn, splitCoder('falcon.detachedSignature', NONCELEN, payloadLen)).decode(data);
                 const s2 = decodeSig(raw);
                 return { nonce, s2 };
             },
@@ -1709,7 +1734,7 @@ function genFalcon(opts) {
         shakeBuf;
         ctrView;
         // ChaCha
-        ctr = 0n;
+        ctr = _0n;
         buf;
         buf32;
         pos;
@@ -1759,8 +1784,8 @@ function genFalcon(opts) {
             const out32 = swap32IfBE(this.buf32);
             for (let i = 0; i < 8; i++, this.ctr++) {
                 const n = swap32IfBE(this.nonce32.slice()); // [n0, n1, n2, n3]
-                n[2] ^= Number(this.ctr & 0xffffffffn);
-                n[3] ^= Number(this.ctr >> 32n);
+                n[2] ^= Number(this.ctr & MASK_32n);
+                n[3] ^= Number(this.ctr >> _32n);
                 // chacha20() takes raw nonce bytes; on BE the word-normalized temp must be swapped back.
                 swap32IfBE(n.subarray(1));
                 chacha20(this.key, u8(n.subarray(1)), EMPTY_CHACHA20_BLOCK, this.curBlock, n[0]);
@@ -2077,7 +2102,8 @@ function genFalcon(opts) {
         //         ▷ Remove 1 byte for the header, and 40 bytes for r
         // 11: while (s = ⊥)
         // 12: return sig = (r, s)
-        abytes(msg);
+        abytes(msg, undefined, 'msg');
+        abytes(sk, secretKeyCoder.bytesLen, 'secretKey');
         // One RNG stream drives both the public 40-byte nonce and the 48-byte sampler seed, so
         // deterministic rnd hooks make signatures deterministic for fixed secretKey/message inputs.
         const nonce = rnd(40);
@@ -2171,18 +2197,20 @@ function genFalcon(opts) {
         intPoly.sub(s1, c0); // 5: s₁ ← c - s₂h mod q ▷ s₁ should be normalized between -q/2 and q/2
         return intPoly.isShort(signedCoder.encode(s1), s2); // 6: if ||(s₁, s₂)||² < [β²] then
     };
-    const info = { type: 'falcon' };
-    const keyLengths = {
+    const info = Object.freeze({ type: 'falcon' });
+    const keyLengths = Object.freeze({
         seed: 48,
         publicKey: publicKeyCoder.bytesLen,
         secretKey: secretKeyCoder.bytesLen,
-    };
+    });
     // Noble exposes a 48-byte sampler-seed hook,
     // but Falcon still samples/encodes a separate 40-byte nonce per signature.
     const getRnd = (opts = {}) => {
         validateSigOpts(opts);
         if (opts.context !== undefined)
             throw new Error('context is not supported');
+        if (opts.random !== undefined && typeof opts.random !== 'function')
+            throw new TypeError('"opts.random" expected function, got type=' + typeof opts.random);
         if (opts.random !== undefined)
             return opts.random;
         if (opts.extraEntropy === undefined)
@@ -2197,11 +2225,17 @@ function genFalcon(opts) {
         if (opts.context !== undefined)
             throw new Error('context is not supported');
     };
-    const tests = { publicKeyCoder, privateKeyCoder: secretKeyCoder, maxS2Len: opts.maxS2Len };
+    const tests = Object.freeze({
+        publicKeyCoder: Object.freeze(publicKeyCoder),
+        privateKeyCoder: Object.freeze(secretKeyCoder),
+        maxS2Len: opts.maxS2Len,
+    });
     // `signRand` documents only the sampler-seed input length;
     // detached/attached signatures still include their own 40-byte nonce.
-    const attachedLengths = { ...keyLengths, signRand: 48 };
-    const lengths = opts.padded ? { ...attachedLengths, signature: opts.sigLen } : attachedLengths;
+    const attachedLengths = Object.freeze({ ...keyLengths, signRand: 48 });
+    const lengths = opts.padded
+        ? Object.freeze({ ...attachedLengths, signature: opts.sigLen })
+        : attachedLengths;
     const keygen = (seed) => {
         const randSeed = seed === undefined;
         if (randSeed)
@@ -2216,6 +2250,7 @@ function genFalcon(opts) {
         return { publicKey: pk, secretKey: sk };
     };
     const getPublicKey = (sk) => {
+        abytes(sk, secretKeyCoder.bytesLen, 'secretKey');
         const [f, g, F] = secretKeyCoder.decode(sk);
         try {
             const h = computePublic(f, g);
@@ -2238,9 +2273,10 @@ function genFalcon(opts) {
      */
     const verify = (sig, msg, pk, verOpts = {}) => {
         checkVerOpts(verOpts);
-        abytes(sig);
-        abytes(msg);
-        abytes(pk);
+        abytes(sig, undefined, 'signature');
+        abytes(msg, undefined, 'msg');
+        // Length/canonical public-key failures are decoded below and return false; only type is fatal.
+        abytes(pk, undefined, 'publicKey');
         try {
             const { s2, nonce } = SignatureCoderDetached(logn).decode(sig);
             return verifyRaw(pk, s2, nonce, msg);
@@ -2249,7 +2285,7 @@ function genFalcon(opts) {
             return false;
         }
     };
-    const attached = {
+    const attached = Object.freeze({
         info,
         lengths: attachedLengths,
         keygen,
@@ -2267,7 +2303,7 @@ function genFalcon(opts) {
                 return msg;
             throw new Error('invalid signature');
         },
-    };
+    });
     const res = {
         info,
         lengths,
@@ -2278,7 +2314,7 @@ function genFalcon(opts) {
         verify,
     };
     res.__test = tests;
-    return res;
+    return Object.freeze(res);
 }
 const falcon512opts = {
     N: 512,
@@ -2362,7 +2398,7 @@ export const falcon1024padded = /* @__PURE__ */ (() => genFalcon({
     maxS2Len: 1239,
 }))();
 // NOTE: for tests only, don't use
-export const __tests = /* @__PURE__ */ (() => ({
+export const __tests = /* @__PURE__ */ (() => Object.freeze({
     BNORM_MAX,
     COMPLEX_ROOTS,
     Float,
@@ -2375,4 +2411,3 @@ export const __tests = /* @__PURE__ */ (() => ({
     falcon1024: falcon1024.__test,
     falcon1024padded: falcon1024padded.__test,
 }))();
-//# sourceMappingURL=falcon.js.map

package/hybrid.d.ts

@@ -78,7 +78,7 @@ import { type EdDSA } from '@noble/curves/abstract/edwards.js';
 import { type MontgomeryECDH } from '@noble/curves/abstract/montgomery.js';
 import { type ECDSA } from '@noble/curves/abstract/weierstrass.js';
 import { type CHash, type CHashXOF } from '@noble/hashes/utils.js';
-import { type KEM, type Signer } from './utils.ts';
+import { type KEM, type Signer, type TArg, type TRet } from './utils.ts';
 type CurveECDH = ECDSA | MontgomeryECDH;
 type CurveSign = ECDSA | EdDSA;
 /**
@@ -104,7 +104,7 @@ type CurveSign = ECDSA | EdDSA;
  * const publicKeyLen = kem.lengths.publicKey;
  * ```
  */
-export declare function ecdhKem(curve: CurveECDH, allowZeroKey?: boolean): KEM;
+export declare function ecdhKem(curve: CurveECDH, allowZeroKey?: boolean): TRet<KEM>;
 /**
  * Wraps a curve signer as a generic `Signer`.
  * Signatures stay in the wrapped curve's native byte encoding.
@@ -126,9 +126,9 @@ export declare function ecdhKem(curve: CurveECDH, allowZeroKey?: boolean): KEM;
  * const sigLen = signer.lengths.signature;
  * ```
  */
-export declare function ecSigner(curve: CurveSign, allowZeroKey?: boolean): Signer;
+export declare function ecSigner(curve: CurveSign, allowZeroKey?: boolean): TRet<Signer>;
 /** Seed-expansion callback used by the hybrid combiners. */
-export type ExpandSeed = (seed: Uint8Array, len: number) => Uint8Array;
+export type ExpandSeed = (seed: TArg<Uint8Array>, len: number) => TRet<Uint8Array>;
 type XOF = CHashXOF<any, {
     dkLen: number;
 }>;
@@ -146,9 +146,9 @@ type XOF = CHashXOF<any, {
  * const seed = expandSeed(new Uint8Array([1]), 4);
  * ```
  */
-export declare function expandSeedXof(xof: XOF): ExpandSeed;
+export declare function expandSeedXof(xof: TArg<XOF>): TRet<ExpandSeed>;
 /** Combines public keys, ciphertexts, and shared secrets into one shared secret. */
-export type Combiner = (publicKeys: Uint8Array[], cipherTexts: Uint8Array[], sharedSecrets: Uint8Array[]) => Uint8Array;
+export type Combiner = (publicKeys: TArg<Uint8Array[]>, cipherTexts: TArg<Uint8Array[]>, sharedSecrets: TArg<Uint8Array[]>) => TRet<Uint8Array>;
 /**
  * Combines multiple KEMs into one composite KEM.
  * @param realSeedLen - Input seed length expected by `expandSeed`.
@@ -176,7 +176,7 @@ export type Combiner = (publicKeys: Uint8Array[], cipherTexts: Uint8Array[], sha
  */
 export declare function combineKEMS(realSeedLen: number | undefined, // how much bytes expandSeed expects
 realMsgLen: number | undefined, // how much bytes combiner returns
-expandSeed: ExpandSeed, combiner: Combiner, ...kems: KEM[]): KEM;
+expandSeed: TArg<ExpandSeed>, combiner: TArg<Combiner>, ...kems: TArg<KEM[]>): TRet<KEM>;
 /**
  * Combines multiple signers into one composite signer.
  * @param realSeedLen - Input seed length expected by `expandSeed`.
@@ -190,10 +190,14 @@ expandSeed: ExpandSeed, combiner: Combiner, ...kems: KEM[]): KEM;
  * import { combineSigners, expandSeedXof } from '@noble/post-quantum/hybrid.js';
  * import { ml_dsa44 } from '@noble/post-quantum/ml-dsa.js';
  * const hybrid = combineSigners(32, expandSeedXof(shake256), ml_dsa44, ml_dsa44);
- * const { publicKey } = hybrid.keygen();
+ * const seed = new Uint8Array(hybrid.lengths.seed!).fill(1);
+ * const { secretKey, publicKey } = hybrid.keygen(seed);
+ * const msg = new TextEncoder().encode('hello noble');
+ * const sig = hybrid.sign(msg, secretKey);
+ * const isValid = hybrid.verify(sig, msg, publicKey);
  * ```
  */
-export declare function combineSigners(realSeedLen: number | undefined, expandSeed: ExpandSeed, ...signers: Signer[]): Signer;
+export declare function combineSigners(realSeedLen: number | undefined, expandSeed: TArg<ExpandSeed>, ...signers: TArg<Signer[]>): TRet<Signer>;
 /**
  * Builds a QSF hybrid KEM preset from a PQ KEM and an elliptic-curve KEM.
  * The combined shared-secret length follows `kdf.outputLen`; the built-in presets use 32-byte
@@ -218,11 +222,11 @@ export declare function combineSigners(realSeedLen: number | undefined, expandSe
  * const publicKeyLen = kem.lengths.publicKey;
  * ```
  */
-export declare function QSF(label: string, pqc: KEM, curveKEM: KEM, xof: XOF, kdf: CHash): KEM;
+export declare function QSF(label: string, pqc: TArg<KEM>, curveKEM: TArg<KEM>, xof: TArg<XOF>, kdf: CHash): TRet<KEM>;
 /** QSF preset combining ML-KEM-768 with P-256. */
-export declare const QSF_ml_kem768_p256: KEM;
+export declare const QSF_ml_kem768_p256: TRet<KEM>;
 /** QSF preset combining ML-KEM-1024 with P-384. */
-export declare const QSF_ml_kem1024_p384: KEM;
+export declare const QSF_ml_kem1024_p384: TRet<KEM>;
 /**
  * Builds the "KitchenSink" hybrid KEM combiner.
  * The current builder always derives a fixed 32-byte output,
@@ -249,33 +253,18 @@ export declare const QSF_ml_kem1024_p384: KEM;
  * const publicKeyLen = kem.lengths.publicKey;
  * ```
  */
-export declare function createKitchenSink(label: string, pqc: KEM, curveKEM: KEM, xof: XOF, hash: CHash): KEM;
+export declare function createKitchenSink(label: string, pqc: TArg<KEM>, curveKEM: TArg<KEM>, xof: TArg<XOF>, hash: CHash): TRet<KEM>;
 /** KitchenSink preset combining ML-KEM-768 with X25519.
  * Caller randomness splits into 32 ML-KEM coins plus a 32-byte X25519 ephemeral-secret seed.
  */
-export declare const KitchenSink_ml_kem768_x25519: KEM;
+export declare const KitchenSink_ml_kem768_x25519: TRet<KEM>;
 /** X25519 + ML-KEM-768 hybrid preset.
  * Uses the hard-coded domain-separation label `\\.//^\\` and hashes only `ct1 || pk1`
  * from the X25519 side in addition to the two component shared secrets.
  */
-export declare const ml_kem768_x25519: KEM;
+export declare const ml_kem768_x25519: TRet<KEM>;
 /** P-256 + ML-KEM-768 hybrid preset. */
-export declare const ml_kem768_p256: KEM;
+export declare const ml_kem768_p256: TRet<KEM>;
 /** P-384 + ML-KEM-1024 hybrid preset. */
-export declare const ml_kem1024_p384: KEM;
-/** Legacy alias for `ml_kem768_x25519`. */
-export declare const XWing: KEM;
-/** Legacy alias for `ml_kem768_x25519`. */
-export declare const MLKEM768X25519: KEM;
-/** Legacy alias for `ml_kem768_p256`. */
-export declare const MLKEM768P256: KEM;
-/** Legacy alias for `ml_kem1024_p384`. */
-export declare const MLKEM1024P384: KEM;
-/** Legacy alias for `QSF_ml_kem768_p256`. */
-export declare const QSFMLKEM768P256: KEM;
-/** Legacy alias for `QSF_ml_kem1024_p384`. */
-export declare const QSFMLKEM1024P384: KEM;
-/** Legacy alias for `KitchenSink_ml_kem768_x25519`. */
-export declare const KitchenSinkMLKEM768X25519: KEM;
+export declare const ml_kem1024_p384: TRet<KEM>;
 export {};
-//# sourceMappingURL=hybrid.d.ts.map