@noble/post-quantum 0.6.1 → 0.7.1

package/utils.d.ts

@@ -84,9 +84,11 @@ export { concatBytesDoc as concatBytes };
  * ```
  */
 export declare const randomBytes: typeof randb;
+export declare function aarray<T>(item: unknown, title: string, inner?: (elm: T, title: string) => void): T[];
+export declare function aobject<T extends object>(value: unknown, title?: string): T;
 /**
  * Compares two byte arrays in a length-constant way for equal lengths.
- * Unequal lengths return `false` immediately, and there is no runtime type validation.
+ * Inputs are validated as byte arrays; unequal lengths return `false` immediately.
  * @param a - First byte array.
  * @param b - Second byte array.
  * @returns Whether both arrays contain the same bytes.
@@ -184,32 +186,66 @@ export type SigOpts = VerOpts & {
  * ```
  */
 export declare function validateOpts(opts: object): void;
+/** Keys accepted by `verify`. */
+export declare const VER_OPT_KEYS: readonly ['context'];
+/** Keys accepted by `sign`. */
+export declare const SIG_OPT_KEYS: readonly ['context', 'extraEntropy'];
+/**
+ * Rejects option keys the caller did not mean to set.
+ *
+ * Validating the types of known keys while ignoring unknown ones makes a typo
+ * indistinguishable from an omission, and for these options an omission is a
+ * security downgrade rather than a no-op: `{ ctx }` instead of `{ context }` signs
+ * with no domain separation, succeeds, and verifies for anyone who also supplies
+ * none. Nothing at any layer reports it. TypeScript catches this through excess
+ * property checks, so the exposure is JavaScript callers specifically.
+ *
+ * @param opts - Options object to check.
+ * @param allowed - The keys this call site accepts.
+ * Returns a frozen null-prototype snapshot so later reads cannot fall through to a polluted
+ * prototype. Like `checkOpts()` in noble-hashes, only enumerable own properties are copied.
+ * @throws If any other copied key is present or the bag has a custom prototype. {@link TypeError}
+ * @returns Sanitized snapshot of the enumerable own options.
+ * @example
+ * Accept a known option key. A key the list does not name, such as `ctx`, throws instead.
+ * ```ts
+ * import { checkOptKeys } from '@noble/post-quantum/utils.js';
+ * checkOptKeys({ context: new Uint8Array() }, ['context']);
+ * ```
+ */
+export declare function checkOptKeys<T extends object>(opts: T, allowed: readonly string[]): T;
 /**
  * Validates common verification options.
  * `context` itself is validated with `abytes(...)`, and individual algorithms may narrow support
  * further after this shared plain-object gate.
  * @param opts - Verification options. See {@link VerOpts}.
+ * @param allowed - Keys this call site accepts. Defaults to {@link VER_OPT_KEYS}; surfaces that
+ * take extra keys, or take fewer, pass their own list.
  * @throws On wrong argument types. {@link TypeError}
+ * @returns Frozen null-prototype snapshot of the validated options.
  * @example
  * Validate common verification options.
  * ```ts
  * validateVerOpts({ context: new Uint8Array([1]) });
  * ```
  */
-export declare function validateVerOpts(opts: TArg<VerOpts>): void;
+export declare function validateVerOpts<T extends TArg<VerOpts>>(opts: T, allowed?: readonly string[]): T;
 /**
  * Validates common signing options.
  * `extraEntropy` is validated with `abytes(...)`; exact lengths and extra algorithm-specific
  * restrictions are enforced later by callers.
  * @param opts - Signing options. See {@link SigOpts}.
+ * @param allowed - Keys this call site accepts. Defaults to {@link SIG_OPT_KEYS}; surfaces that
+ * take extra keys, or take fewer, pass their own list.
  * @throws On wrong argument types. {@link TypeError}
+ * @returns Frozen null-prototype snapshot of the validated options.
  * @example
  * Validate common signing options.
  * ```ts
  * validateSigOpts({ extraEntropy: new Uint8Array([1]) });
  * ```
  */
-export declare function validateSigOpts(opts: TArg<SigOpts>): void;
+export declare function validateSigOpts<T extends TArg<SigOpts>>(opts: T, allowed?: readonly string[]): T;
 /** Generic signature interface with key generation, signing, and verification. */
 export type Signer = CryptoKeys & {
     /** Public byte lengths for signatures and signing randomness. */
@@ -356,6 +392,7 @@ export declare function cleanBytes(...list: (TypedArray | TypedArray[])[]): void
  * Creates a 32-bit mask with the lowest `bits` bits set.
  * @param bits - Number of low bits to keep.
  * @returns Bit mask with `bits` ones.
+ * @throws On wrong argument types. {@link TypeError}
  * @throws On wrong argument ranges or values. {@link RangeError}
  * @example
  * Create a low-bit mask for packed-field operations.
@@ -417,4 +454,17 @@ export declare function checkHash(hash: CHash, requiredStrength?: number): void;
  * ```
  */
 export declare function getMessagePrehash(hash: CHash, msg: TArg<Uint8Array>, ctx?: TArg<Uint8Array>): TRet<Uint8Array>;
-//# sourceMappingURL=utils.d.ts.map
+/**
+ * Asserts something is a string.
+ * @param value - Value to validate.
+ * @param title - Label included in thrown errors.
+ * @returns The validated string.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Validate a label string.
+ *
+ * ```ts
+ * astring('example', 'label');
+ * ```
+ */
+export declare function astring(value: unknown, title?: string): string;

package/utils.js

@@ -3,7 +3,7 @@
  * @module
  */
 /*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) */
-import { abytes, abytes as abytes_, concatBytes, isLE, randomBytes as randb, } from '@noble/hashes/utils.js';
+import { abytes, abytes as abytes_, ahash as ahash_, anumber, bytesToHex, concatBytes, isBytes, isLE, randomBytes as randb, } from '@noble/hashes/utils.js';
 /**
  * Asserts that a value is a byte array and optionally checks its length.
  * Returns the original reference unchanged on success, and currently also accepts Node `Buffer`
@@ -44,9 +44,23 @@ export { concatBytesDoc as concatBytes };
  * ```
  */
 export const randomBytes = randb;
+export function aarray(item, title, inner = () => { }) {
+    if (!Array.isArray(item))
+        throw new TypeError(`"${title}" expected array, got type=${typeof item}`);
+    for (let i = 0; i < item.length; i++)
+        inner(item[i], `${title}[${i}]`);
+    return item;
+}
+export function aobject(value, title = 'object') {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        throw new TypeError(title === 'object'
+            ? 'expected valid options object'
+            : `"${title}" expected object, got type=${typeof value}`);
+    return value;
+}
 /**
  * Compares two byte arrays in a length-constant way for equal lengths.
- * Unequal lengths return `false` immediately, and there is no runtime type validation.
+ * Inputs are validated as byte arrays; unequal lengths return `false` immediately.
  * @param a - First byte array.
  * @param b - Second byte array.
  * @returns Whether both arrays contain the same bytes.
@@ -57,6 +71,8 @@ export const randomBytes = randb;
  * ```
  */
 export function equalBytes(a, b) {
+    a = abytes(a);
+    b = abytes(b);
     if (a.length !== b.length)
         return false;
     let diff = 0;
@@ -76,9 +92,10 @@ export function equalBytes(a, b) {
  * ```
  */
 export function copyBytes(bytes) {
-    // `Uint8Array.from(...)` would also accept arrays / other typed arrays. Keep this helper strict
-    // because callers use it at byte-validation boundaries before mutating the detached copy.
-    return Uint8Array.from(abytes(bytes));
+    // The typed-array constructor copies a typed-array source through its internal byte storage.
+    // Unlike `Uint8Array.from`, it does not invoke a subclass-overridden iterator. Keep the explicit
+    // validation because the constructor itself would also accept arrays and other typed arrays.
+    return new Uint8Array(abytes(bytes));
 }
 /**
  * Byte-swaps each 64-bit lane in place.
@@ -137,42 +154,110 @@ export const baswap64If = isLE
  */
 export function validateOpts(opts) {
     // Arrays silently passed here before, but these call sites expect named option-bag fields.
-    if (Object.prototype.toString.call(opts) !== '[object Object]')
-        throw new TypeError('expected valid options object');
+    if (isBytes(opts))
+        throw new TypeError('"opts" expected object, got Uint8Array');
+    aobject(opts, 'opts');
+    const proto = Object.getPrototypeOf(opts);
+    // Options are security parameters, not general class instances. Restricting the bag to own
+    // properties prevents values injected through Object.prototype (or a custom shared prototype)
+    // from silently changing signing behavior. Null-prototype records remain supported.
+    if (proto !== null && proto !== Object.prototype)
+        throw new TypeError('"opts" expected a plain object');
+}
+// Frozen because they are exported: an unfrozen array export lets anything in the
+// process push a key onto the accepted set and silently re-open exactly the hole this
+// validation closes.
+/** Keys accepted by `verify`. */
+export const VER_OPT_KEYS = /* @__PURE__ */ Object.freeze([
+    'context',
+]);
+/** Keys accepted by `sign`. */
+export const SIG_OPT_KEYS = /* @__PURE__ */ Object.freeze([
+    'context',
+    'extraEntropy',
+]);
+/**
+ * Rejects option keys the caller did not mean to set.
+ *
+ * Validating the types of known keys while ignoring unknown ones makes a typo
+ * indistinguishable from an omission, and for these options an omission is a
+ * security downgrade rather than a no-op: `{ ctx }` instead of `{ context }` signs
+ * with no domain separation, succeeds, and verifies for anyone who also supplies
+ * none. Nothing at any layer reports it. TypeScript catches this through excess
+ * property checks, so the exposure is JavaScript callers specifically.
+ *
+ * @param opts - Options object to check.
+ * @param allowed - The keys this call site accepts.
+ * Returns a frozen null-prototype snapshot so later reads cannot fall through to a polluted
+ * prototype. Like `checkOpts()` in noble-hashes, only enumerable own properties are copied.
+ * @throws If any other copied key is present or the bag has a custom prototype. {@link TypeError}
+ * @returns Sanitized snapshot of the enumerable own options.
+ * @example
+ * Accept a known option key. A key the list does not name, such as `ctx`, throws instead.
+ * ```ts
+ * import { checkOptKeys } from '@noble/post-quantum/utils.js';
+ * checkOptKeys({ context: new Uint8Array() }, ['context']);
+ * ```
+ */
+export function checkOptKeys(opts, allowed) {
+    validateOpts(opts);
+    // Snapshot once before validation: Object.assign follows the same own-enumerable option-bag
+    // semantics as noble-hashes, while the null prototype keeps omitted fields immune to pollution.
+    const normalized = Object.assign(Object.create(null), opts);
+    for (const [k, v] of Object.entries(normalized)) {
+        // `undefined` means unset everywhere else in these validators, and building an options bag by
+        // spread is a normal way to reach these calls, so present-but-undefined stays equivalent to
+        // omission.
+        if (v === undefined)
+            continue;
+        if (!allowed.includes(k))
+            throw new TypeError('unexpected option "' + String(k) + '"; expected one of: ' + allowed.join(', '));
+    }
+    return Object.freeze(normalized);
 }
 /**
  * Validates common verification options.
  * `context` itself is validated with `abytes(...)`, and individual algorithms may narrow support
  * further after this shared plain-object gate.
  * @param opts - Verification options. See {@link VerOpts}.
+ * @param allowed - Keys this call site accepts. Defaults to {@link VER_OPT_KEYS}; surfaces that
+ * take extra keys, or take fewer, pass their own list.
  * @throws On wrong argument types. {@link TypeError}
+ * @returns Frozen null-prototype snapshot of the validated options.
  * @example
  * Validate common verification options.
  * ```ts
  * validateVerOpts({ context: new Uint8Array([1]) });
  * ```
  */
-export function validateVerOpts(opts) {
-    validateOpts(opts);
-    if (opts.context !== undefined)
-        abytes(opts.context, undefined, 'opts.context');
+export function validateVerOpts(opts, allowed = VER_OPT_KEYS) {
+    const normalized = checkOptKeys(opts, allowed);
+    if (normalized.context !== undefined)
+        abytes(normalized.context, undefined, 'opts.context');
+    return normalized;
 }
 /**
  * Validates common signing options.
  * `extraEntropy` is validated with `abytes(...)`; exact lengths and extra algorithm-specific
  * restrictions are enforced later by callers.
  * @param opts - Signing options. See {@link SigOpts}.
+ * @param allowed - Keys this call site accepts. Defaults to {@link SIG_OPT_KEYS}; surfaces that
+ * take extra keys, or take fewer, pass their own list.
  * @throws On wrong argument types. {@link TypeError}
+ * @returns Frozen null-prototype snapshot of the validated options.
  * @example
  * Validate common signing options.
  * ```ts
  * validateSigOpts({ extraEntropy: new Uint8Array([1]) });
  * ```
  */
-export function validateSigOpts(opts) {
-    validateVerOpts(opts);
-    if (opts.extraEntropy !== false && opts.extraEntropy !== undefined)
-        abytes(opts.extraEntropy, undefined, 'opts.extraEntropy');
+export function validateSigOpts(opts, allowed = SIG_OPT_KEYS) {
+    const normalized = checkOptKeys(opts, allowed);
+    if (normalized.context !== undefined)
+        abytes(normalized.context, undefined, 'opts.context');
+    if (normalized.extraEntropy !== false && normalized.extraEntropy !== undefined)
+        abytes(normalized.extraEntropy, undefined, 'opts.extraEntropy');
+    return normalized;
 }
 /**
  * Builds a fixed-layout coder from byte lengths and nested coders.
@@ -247,11 +332,12 @@ export function vecCoder(c, vecLen) {
     return {
         bytesLen,
         encode: (u) => {
-            if (u.length !== vecLen)
-                throw new RangeError(`vecCoder.encode: wrong length=${u.length}. Expected: ${vecLen}`);
+            const uArr = aarray(u, 'u');
+            if (uArr.length !== vecLen)
+                throw new RangeError(`vecCoder.encode: wrong length=${uArr.length}. Expected: ${vecLen}`);
             const res = new Uint8Array(bytesLen);
-            for (let i = 0, pos = 0; i < u.length; i++) {
-                const b = coder.encode(u[i]);
+            for (let i = 0, pos = 0; i < uArr.length; i++) {
+                const b = coder.encode(uArr[i]);
                 res.set(b, pos);
                 b.fill(0); // clean
                 pos += b.length;
@@ -291,6 +377,7 @@ export function cleanBytes(...list) {
  * Creates a 32-bit mask with the lowest `bits` bits set.
  * @param bits - Number of low bits to keep.
  * @returns Bit mask with `bits` ones.
+ * @throws On wrong argument types. {@link TypeError}
  * @throws On wrong argument ranges or values. {@link RangeError}
  * @example
  * Create a low-bit mask for packed-field operations.
@@ -299,8 +386,9 @@ export function cleanBytes(...list) {
  * ```
  */
 export function getMask(bits) {
-    if (!Number.isSafeInteger(bits) || bits < 0 || bits > 32)
-        throw new RangeError(`expected bits in [0..32], got ${bits}`);
+    anumber(bits, 'bits');
+    if (bits > 32)
+        throw new RangeError('"bits" expected <= 32, got ' + bits);
     // JS shifts are modulo 32, so bit 32 needs an explicit full-width mask.
     return bits === 32 ? 0xffffffff : ~(-1 << bits) >>> 0;
 }
@@ -320,8 +408,8 @@ export const EMPTY = /* @__PURE__ */ Uint8Array.of();
  * ```
  */
 export function getMessage(msg, ctx = EMPTY) {
-    abytes_(msg);
-    abytes_(ctx);
+    abytes_(msg, undefined, 'msg');
+    abytes_(ctx, undefined, 'ctx');
     if (ctx.length > 255)
         throw new RangeError('context should be 255 bytes or less');
     return concatBytes(new Uint8Array([0, ctx.length]), ctx, msg);
@@ -331,6 +419,19 @@ export function getMessage(msg, ctx = EMPTY) {
 // SHAKE256, or another approved hash/XOF under that subtree.
 // 06 09 60 86 48 01 65 03 04 02
 const oidNistP = /* @__PURE__ */ Uint8Array.from([6, 9, 0x60, 0x86, 0x48, 1, 0x65, 3, 4, 2]);
+/**
+ * Output length, in bytes, that each XOF OID under this arc denotes.
+ *
+ * Unlike a fixed hash, an XOF's OID is a promise about the digest length: RFC 8702
+ * defines id-shake128 as SHAKE128 with 256-bit output and id-shake256 as SHAKE256 with
+ * 512-bit output, and FIPS 204 / FIPS 205 use exactly those pairings for pre-hash. Both
+ * bare noble-hashes defaults are half these values, so neither can be signed under its
+ * own OID.
+ */
+const XOF_OID_OUTPUT_LEN = /* @__PURE__ */ (() => ({
+    '060960864801650304020b': 32, // id-shake128, SHAKE128(M, 256)
+    '060960864801650304020c': 64, // id-shake256, SHAKE256(M, 512)
+}))();
 /**
  * Validates that a hash exposes a NIST hash OID and enough collision resistance.
  * Current accepted surface is broader than the FIPS algorithm tables: any hash/XOF under the NIST
@@ -349,11 +450,29 @@ const oidNistP = /* @__PURE__ */ Uint8Array.from([6, 9, 0x60, 0x86, 0x48, 1, 0x6
  * ```
  */
 export function checkHash(hash, requiredStrength = 0) {
-    if (!hash.oid || !equalBytes(hash.oid.subarray(0, 10), oidNistP))
-        throw new Error('hash.oid is invalid: expected NIST hash');
+    if (typeof hash !== 'function' || typeof hash.create !== 'function')
+        throw new TypeError('"hash" expected hash function, got type=' + typeof hash);
+    ahash_(hash);
+    anumber(requiredStrength, 'requiredStrength');
+    const oid = hash.oid;
+    abytes_(oid, undefined, 'hash.oid');
+    if (!equalBytes(oid.subarray(0, 10), oidNistP))
+        throw new Error('"hash.oid" is invalid: expected NIST hash');
     // FIPS 204 / FIPS 205 require both collision and second-preimage strength; for approved NIST
     // hashes/XOFs under this OID subtree, the collision bound from the configured digest length is
     // the tighter runtime check, so enforce that lower bound here.
+    // XOFs under this arc are identified by an OID that fixes their output length:
+    // FIPS 204 §5.4.1 (SHAKE128) and FIPS 205 §10.2.2 (both SHAKEs), matching RFC 8702, pair
+    // id-shake128 with SHAKE128(M, 256) and id-shake256 with SHAKE256(M, 512). getMessagePrehash embeds
+    // hash.oid beside hash(msg), so a shorter digest signs an M' that claims a length
+    // it does not have: noble-hashes' bare shake256 defaults to 32 bytes and cleared
+    // the collision bound at the 128-bit level, producing signatures a conformant
+    // verifier rejects because it recomputes 512 bits. Check the length the OID
+    // denotes rather than the generic bound.
+    const xofLen = XOF_OID_OUTPUT_LEN[bytesToHex(oid)];
+    if (xofLen !== undefined && hash.outputLen !== xofLen) {
+        throw new Error('Pre-hash XOF output length must be ' + xofLen + ' bytes for this OID, got: ' + hash.outputLen);
+    }
     const collisionResistance = (hash.outputLen * 8) / 2;
     if (requiredStrength > collisionResistance) {
         throw new Error('Pre-hash security strength too low: ' +
@@ -381,11 +500,31 @@ export function checkHash(hash, requiredStrength = 0) {
  * ```
  */
 export function getMessagePrehash(hash, msg, ctx = EMPTY) {
-    abytes_(msg);
-    abytes_(ctx);
+    checkHash(hash);
+    abytes_(msg, undefined, 'msg');
+    abytes_(ctx, undefined, 'ctx');
     if (ctx.length > 255)
         throw new RangeError('context should be 255 bytes or less');
     const hashed = hash(msg);
     return concatBytes(new Uint8Array([1, ctx.length]), ctx, hash.oid, hashed);
 }
-//# sourceMappingURL=utils.js.map
+/**
+ * Asserts something is a string.
+ * @param value - Value to validate.
+ * @param title - Label included in thrown errors.
+ * @returns The validated string.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Validate a label string.
+ *
+ * ```ts
+ * astring('example', 'label');
+ * ```
+ */
+export function astring(value, title = '') {
+    if (typeof value !== 'string') {
+        const prefix = title && `"${title}" `;
+        throw new TypeError(prefix + 'expected string, got type=' + typeof value);
+    }
+    return value;
+}

package/webcrypto.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Friendly async wrappers over ML-KEM and ML-KEM-768 + X25519 from built-in WebCrypto.
+ * Private keys use the same raw seed accepted by the synchronous implementations' `keygen(seed)`;
+ * they are not expanded decapsulation keys.
+ *
+ * # WebCrypto quirks
+ *
+ * - The algorithms are experimental: a runtime can expose `encapsulateBits` and friends while
+ *   implementing none of them, so support is probed with a full round-trip in `isSupported()`.
+ * - `MLKEM768-X25519` accepts `raw-seed` on import, but has no `raw-seed` / `raw-public` export.
+ *   Its key bytes are read out of the JWK `priv` / `pub` members instead.
+ * - base64url is hand-rolled: scure-base's `base64urlnopad` would do, but this module must not add
+ *   dependencies, and importing the synchronous implementations for four byte lengths would pull
+ *   the whole lattice math into a WebCrypto-only entrypoint.
+ * @module
+ */
+/*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) */
+import { type TArg, type TRet } from './utils.ts';
+type MLKEMName = 'ML-KEM-512' | 'ML-KEM-768' | 'ML-KEM-1024';
+/** Byte lengths for a WebCrypto wrapper's serialized keys and ciphertexts. */
+type KEMLengths = {
+    /** Deterministic key-generation seed length. */
+    seed: number;
+    /**
+     * Raw seed private-key length. Note this is the *seed*, not the expanded decapsulation key:
+     * for ML-KEM the synchronous `lengths.secretKey` is much larger (1632 / 2400 / 3168 bytes), so
+     * these private keys only fit the synchronous `keygen(seed)`, never its `decapsulate(ct, sk)`.
+     */
+    secretKey: number;
+    /** Serialized public-key length. */
+    publicKey: number;
+    /** Encapsulated ciphertext length. */
+    cipherText: number;
+};
+/** Async KEM interface backed by the current runtime's WebCrypto implementation. */
+export type WebCryptoKEM = {
+    /** WebCrypto algorithm name passed to `crypto.subtle`. */
+    webCryptoName: string;
+    /** Byte lengths for this WebCrypto wrapper's serialized keys and ciphertexts. */
+    lengths: KEMLengths;
+    /**
+     * Checks whether the runtime implements the complete WebCrypto surface used by this wrapper.
+     * Probes with a real key generation and encapsulation round-trip, and memoizes the result.
+     * @returns Whether key generation, serialization, encapsulation, and decapsulation are supported.
+     */
+    isSupported(): Promise<boolean>;
+    /**
+     * Generates a KEM key pair.
+     * @param seed - Optional raw seed for deterministic key generation.
+     * @returns Raw seed private key and serialized public key.
+     */
+    keygen(seed?: TArg<Uint8Array>): TRet<Promise<{
+        secretKey: Uint8Array;
+        publicKey: Uint8Array;
+    }>>;
+    /**
+     * Derives a serialized public key from a raw seed private key.
+     * @param secretKey - Raw seed private key.
+     * @returns Serialized public key.
+     */
+    getPublicKey(secretKey: TArg<Uint8Array>): TRet<Promise<Uint8Array>>;
+    /**
+     * Encapsulates a new random shared secret to a serialized public key.
+     * @param publicKey - Recipient public key.
+     * @returns Ciphertext and 32-byte shared secret.
+     */
+    encapsulate(publicKey: TArg<Uint8Array>): TRet<Promise<{
+        cipherText: Uint8Array;
+        sharedSecret: Uint8Array;
+    }>>;
+    /**
+     * Decapsulates a ciphertext with a raw seed private key.
+     * @param cipherText - Encapsulated ciphertext bytes.
+     * @param secretKey - Private key in WebCrypto `raw-seed` format.
+     * @returns Decapsulated 32-byte shared secret.
+     */
+    decapsulate(cipherText: TArg<Uint8Array>, secretKey: TArg<Uint8Array>): TRet<Promise<Uint8Array>>;
+};
+/** Async ML-KEM interface backed by the current runtime's WebCrypto implementation. */
+export type WebCryptoMLKEM = WebCryptoKEM & {
+    webCryptoName: MLKEMName;
+};
+/** WebCrypto ML-KEM-512 wrapper. */
+export declare const ml_kem512: TRet<WebCryptoMLKEM>;
+/** WebCrypto ML-KEM-768 wrapper. */
+export declare const ml_kem768: TRet<WebCryptoMLKEM>;
+/** WebCrypto ML-KEM-1024 wrapper. */
+export declare const ml_kem1024: TRet<WebCryptoMLKEM>;
+/** WebCrypto ML-KEM-768 + X25519 (X-Wing) wrapper. */
+export declare const ml_kem768_x25519: TRet<WebCryptoKEM>;
+export {};